summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.mailmap1
-rw-r--r--doc/guix.texi153
-rw-r--r--doc/htmlxref.cnf2
-rw-r--r--gnu/build/activation.scm5
-rw-r--r--gnu/build/file-systems.scm14
-rw-r--r--gnu/local.mk11
-rw-r--r--gnu/packages/admin.scm8
-rw-r--r--gnu/packages/android.scm101
-rw-r--r--gnu/packages/animation.scm13
-rw-r--r--gnu/packages/backup.scm7
-rw-r--r--gnu/packages/bioinformatics.scm42
-rw-r--r--gnu/packages/bootloaders.scm6
-rw-r--r--gnu/packages/compression.scm77
-rw-r--r--gnu/packages/cpp.scm59
-rw-r--r--gnu/packages/cross-base.scm9
-rw-r--r--gnu/packages/databases.scm4
-rw-r--r--gnu/packages/dictionaries.scm54
-rw-r--r--gnu/packages/emacs.scm75
-rw-r--r--gnu/packages/fonts.scm280
-rw-r--r--gnu/packages/game-development.scm66
-rw-r--r--gnu/packages/games.scm153
-rw-r--r--gnu/packages/gnome.scm3
-rw-r--r--gnu/packages/gnupg.scm2
-rw-r--r--gnu/packages/golang.scm8
-rw-r--r--gnu/packages/graphics.scm43
-rw-r--r--gnu/packages/gsasl.scm30
-rw-r--r--gnu/packages/image-processing.scm66
-rw-r--r--gnu/packages/image.scm14
-rw-r--r--gnu/packages/imagemagick.scm20
-rw-r--r--gnu/packages/java.scm9
-rw-r--r--gnu/packages/kodi.scm6
-rw-r--r--gnu/packages/linux.scm35
-rw-r--r--gnu/packages/lisp.scm172
-rw-r--r--gnu/packages/mail.scm16
-rw-r--r--gnu/packages/mes.scm10
-rw-r--r--gnu/packages/networking.scm52
-rw-r--r--gnu/packages/openldap.scm10
-rw-r--r--gnu/packages/patches/jasper-CVE-2017-6850.patch284
-rw-r--r--gnu/packages/patches/libgit2-0.25.1-mtime-0.patch14
-rw-r--r--gnu/packages/patches/libssh-hostname-parser-bug.patch31
-rw-r--r--gnu/packages/patches/openldap-CVE-2017-9287.patch37
-rw-r--r--gnu/packages/patches/openscenegraph-ffmpeg3.patch156
-rw-r--r--gnu/packages/patches/qemu-CVE-2017-8112.patch41
-rw-r--r--gnu/packages/patches/qemu-CVE-2017-8309.patch46
-rw-r--r--gnu/packages/patches/qemu-CVE-2017-8379.patch98
-rw-r--r--gnu/packages/patches/qemu-CVE-2017-8380.patch53
-rw-r--r--gnu/packages/python.scm378
-rw-r--r--gnu/packages/qemu.scm6
-rw-r--r--gnu/packages/qt.scm137
-rw-r--r--gnu/packages/regex.scm4
-rw-r--r--gnu/packages/scheme.scm3
-rw-r--r--gnu/packages/shells.scm105
-rw-r--r--gnu/packages/ssh.scm7
-rw-r--r--gnu/packages/terminals.scm11
-rw-r--r--gnu/packages/version-control.scm62
-rw-r--r--gnu/packages/video.scm183
-rw-r--r--gnu/packages/vtk.scm93
-rw-r--r--gnu/packages/wine.scm5
-rw-r--r--gnu/packages/xdisorg.scm34
-rw-r--r--gnu/tests/base.scm9
-rw-r--r--guix/build/download.scm9
-rw-r--r--guix/build/font-build-system.scm5
-rw-r--r--guix/build/syscalls.scm7
-rw-r--r--guix/derivations.scm47
-rw-r--r--guix/git-download.scm3
-rw-r--r--guix/licenses.scm9
-rw-r--r--guix/scripts/gc.scm8
-rw-r--r--guix/scripts/refresh.scm34
-rwxr-xr-xguix/scripts/substitute.scm10
-rw-r--r--guix/ssh.scm76
-rw-r--r--guix/ui.scm87
-rw-r--r--nix/libstore/build.cc11
-rw-r--r--nix/nix-daemon/guix-daemon.cc12
-rw-r--r--tests/containers.scm3
-rw-r--r--tests/derivations.scm8
-rw-r--r--tests/guix-daemon.sh36
-rw-r--r--tests/guix-package-net.sh2
77 files changed, 2825 insertions, 975 deletions
diff --git a/.mailmap b/.mailmap
index 6598e8e743..32c77307b8 100644
--- a/.mailmap
+++ b/.mailmap
@@ -43,6 +43,7 @@ Mathieu Lirzin <mthl@gnu.org> <mathieu.lirzin@openmailbox.org>
 Mathieu Othacehe <m.othacehe@gmail.com>
 Nikita Karetnikov <nikita@karetnikov.org> <nikita.karetnikov@gmail.com>
 ng0 <ng0@no-reply.pragmatique.xyz>
+ng0 <ng0@no-reply.pragmatique.xyz> <ng0@pragmatique.xyz>
 ng0 <ng0@no-reply.pragmatique.xyz> <contact.ng0@cryptolab.net>
 ng0 <ng0@no-reply.pragmatique.xyz> <ng0@we.make.ritual.n0.is>
 ng0 <ng0@no-reply.pragmatique.xyz> <ngillmann@runbox.com>
diff --git a/doc/guix.texi b/doc/guix.texi
index 7cbfdecba2..e8fba43afe 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -1146,6 +1146,24 @@ Allow at most @var{n} build jobs in parallel.  The default value is
 locally; instead, the daemon will offload builds (@pxref{Daemon Offload
 Setup}), or simply fail.
 
+@item --max-silent-time=@var{seconds}
+When the build or substitution process remains silent for more than
+@var{seconds}, terminate it and report a build failure.
+
+The default value is @code{0}, which disables the timeout.
+
+The value specified here can be overridden by clients (@pxref{Common
+Build Options, @code{--max-silent-time}}).
+
+@item --timeout=@var{seconds}
+Likewise, when the build or substitution process lasts for more than
+@var{seconds}, terminate it and report a build failure.
+
+The default value is @code{0}, which disables the timeout.
+
+The value specified here can be overridden by clients (@pxref{Common
+Build Options, @code{--timeout}}).
+
 @item --rounds=@var{N}
 Build each derivation @var{n} times in a row, and raise an error if
 consecutive build results are not bit-for-bit identical.  Note that this
@@ -4940,12 +4958,15 @@ instead of offloading builds to remote machines.
 When the build or substitution process remains silent for more than
 @var{seconds}, terminate it and report a build failure.
 
+By default, the daemon's setting is honored (@pxref{Invoking
+guix-daemon, @code{--max-silent-time}}).
+
 @item --timeout=@var{seconds}
 Likewise, when the build or substitution process lasts for more than
 @var{seconds}, terminate it and report a build failure.
 
-By default there is no timeout.  This behavior can be restored with
-@code{--timeout=0}.
+By default, the daemon's setting is honored (@pxref{Invoking
+guix-daemon, @code{--timeout}}).
 
 @item --verbosity=@var{level}
 Use the given verbosity level.  @var{level} must be an integer between 0
@@ -5854,6 +5875,11 @@ The @code{non-core} subset refers to the remaining packages.  It is
 typically useful in cases where an update of the core packages would be
 inconvenient.
 
+@item --manifest=@var{file}
+@itemx -m @var{file}
+Select all the packages from the manifest in @var{file}. This is useful to
+check if any packages of the user manifest can be updated.
+
 @item --type=@var{updater}
 @itemx -t @var{updater}
 Select only packages handled by @var{updater} (may be a comma-separated
@@ -7331,7 +7357,7 @@ Access to @file{/dev/sdX} usually requires root privileges.
 @end enumerate
 
 Once this is done, you should be able to reboot the system and boot from
-the USB stick.  The latter usually requires you to get in the BIOS' or
+the USB stick.  The latter usually requires you to get in the BIOS or
 UEFI boot menu, where you can choose to boot from the USB stick.
 
 @xref{Installing GuixSD in a VM}, if, instead, you would like to install
@@ -7696,10 +7722,12 @@ Boot the USB installation image in an VM:
 @example
 qemu-system-x86_64 -m 1024 -smp 1 \
   -net user -net nic,model=virtio -boot menu=on \
-  -drive file=guixsd.img \
-  -drive file=guixsd-usb-install-@value{VERSION}.@var{system}
+  -drive file=guixsd-usb-install-@value{VERSION}.@var{system} \
+  -drive file=guixsd.img
 @end example
 
+The ordering of the drives matters.
+
 In the VM console, quickly press the @kbd{F12} key to enter the boot
 menu.  Then press the @kbd{2} key and the @kbd{RET} key to validate your
 selection.
@@ -13530,6 +13558,64 @@ Whether the server should add its configuration to response.
 @end table
 @end deftp
 
+@deftp {Data Type} nginx-upstream-configuration
+Data type representing the configuration of an nginx @code{upstream}
+block.  This type has the following parameters:
+
+@table @asis
+@item @code{name}
+Name for this group of servers.
+
+@item @code{servers}
+Specify the addresses of the servers in the group.  The address can be
+specified as a IP address (e.g. @samp{127.0.0.1}), domain name
+(e.g. @samp{backend1.example.com}) or a path to a UNIX socket using the
+prefix @samp{unix:}.  For addresses using an IP address or domain name,
+the default port is 80, and a different port can be specified
+explicitly.
+
+@end table
+@end deftp
+
+@deftp {Data Type} nginx-location-configuration
+Data type representing the configuration of an nginx @code{location}
+block.  This type has the following parameters:
+
+@table @asis
+@item @code{uri}
+URI which this location block matches.
+
+@anchor{nginx-location-configuration body}
+@item @code{body}
+Body of the location block, specified as a string. This can contain many
+configuration directives.  For example, to pass requests to a upstream
+server group defined using an @code{nginx-upstream-configuration} block,
+the following directive would be specified in the body @samp{proxy_pass
+http://upstream-name;}.
+
+@end table
+@end deftp
+
+@deftp {Data Type} nginx-named-location-configuration
+Data type representing the configuration of an nginx named location
+block.  Named location blocks are used for request redirection, and not
+used for regular request processing.  This type has the following
+parameters:
+
+@table @asis
+@item @code{name}
+Name to identify this location block.
+
+@item @code{body}
+@xref{nginx-location-configuration body}, as the body for named location
+blocks can be used in a similar way to the
+@code{nginx-location-configuration body}.  One restriction is that the
+body of a named location block cannot contain location blocks.
+
+@end table
+@end deftp
+
+
 @node DNS Services
 @subsubsection DNS Services
 @cindex DNS (domain name system)
@@ -14296,63 +14382,6 @@ Defaults to @samp{#f}.
 @c %end of automatic openvpn-server documentation
 
 
-@deftp {Data Type} nginx-upstream-configuration
-Data type representing the configuration of an nginx @code{upstream}
-block.  This type has the following parameters:
-
-@table @asis
-@item @code{name}
-Name for this group of servers.
-
-@item @code{servers}
-Specify the addresses of the servers in the group.  The address can be
-specified as a IP address (e.g. @samp{127.0.0.1}), domain name
-(e.g. @samp{backend1.example.com}) or a path to a UNIX socket using the
-prefix @samp{unix:}.  For addresses using an IP address or domain name,
-the default port is 80, and a different port can be specified
-explicitly.
-
-@end table
-@end deftp
-
-@deftp {Data Type} nginx-location-configuration
-Data type representing the configuration of an nginx @code{location}
-block.  This type has the following parameters:
-
-@table @asis
-@item @code{uri}
-URI which this location block matches.
-
-@anchor{nginx-location-configuration body}
-@item @code{body}
-Body of the location block, specified as a string. This can contain many
-configuration directives.  For example, to pass requests to a upstream
-server group defined using an @code{nginx-upstream-configuration} block,
-the following directive would be specified in the body @samp{proxy_pass
-http://upstream-name;}.
-
-@end table
-@end deftp
-
-@deftp {Data Type} nginx-named-location-configuration
-Data type representing the configuration of an nginx named location
-block.  Named location blocks are used for request redirection, and not
-used for regular request processing.  This type has the following
-parameters:
-
-@table @asis
-@item @code{name}
-Name to identify this location block.
-
-@item @code{body}
-@xref{nginx-location-configuration body}, as the body for named location
-blocks can be used in a similar way to the
-@code{nginx-location-configuration body}.  One restriction is that the
-body of a named location block cannot contain location blocks.
-
-@end table
-@end deftp
-
 @node Network File System
 @subsubsection Network File System
 @cindex NFS
diff --git a/doc/htmlxref.cnf b/doc/htmlxref.cnf
index 78f427bd07..c1ce636495 100644
--- a/doc/htmlxref.cnf
+++ b/doc/htmlxref.cnf
@@ -221,7 +221,7 @@ easejs		node	${GS}/easejs/manual/
 
 EMACS_GUIX = https://alezost.github.io/guix.el/manual/latest
 emacs-guix	mono	${EMACS_GUIX}/emacs-guix.html
-emacs-guix	node	${EMACS_GUIX}/html_node/index.html
+emacs-guix	node	${EMACS_GUIX}/html_node/
 
 emacs-muse	node	${GS}/emacs-muse/manual/muse.html
 emacs-muse	node	${GS}/emacs-muse/manual/html_node/
diff --git a/gnu/build/activation.scm b/gnu/build/activation.scm
index a1d2a9cc7d..299c0728cb 100644
--- a/gnu/build/activation.scm
+++ b/gnu/build/activation.scm
@@ -130,14 +130,15 @@ properties.  Return #t on success."
       ;; 'useradd' fails with "Cannot determine your user name" if the root
       ;; account doesn't exist.  Thus, for bootstrapping purposes, create that
       ;; one manually.
-      (begin
+      (let ((home (or home "/root")))
         (call-with-output-file "/etc/shadow"
           (cut format <> "~a::::::::~%" name))
         (call-with-output-file "/etc/passwd"
           (cut format <> "~a:x:~a:~a:~a:~a:~a~%"
                name "0" "0" comment home shell))
         (chmod "/etc/shadow" #o600)
-        (copy-account-skeletons (or home "/root"))
+        (copy-account-skeletons home)
+        (chmod home #o700)
         #t)
 
       ;; Use 'useradd' from the Shadow package.
diff --git a/gnu/build/file-systems.scm b/gnu/build/file-systems.scm
index 17c1182ce6..10be0dc83c 100644
--- a/gnu/build/file-systems.scm
+++ b/gnu/build/file-systems.scm
@@ -245,7 +245,12 @@ Trailing spaces are trimmed."
   "Find and read the first primary volume descriptor, starting at OFFSET.
    Return #f if not found."
   (let* ((sblock    (read-superblock device offset 2048 iso9660-superblock?))
-         (type-code (if sblock (array-ref sblock 0) 255)))
+         (type-code (if sblock
+                        (bytevector-u8-ref sblock 0)
+                        (error (format #f
+                                       "Could not read ISO9660 primary
+volume descriptor from ~s"
+                                       device)))))
     (match type-code
       (255 #f) ; Volume Descriptor Set Terminator.
       (1 sblock) ; Primary Volume Descriptor
@@ -255,7 +260,11 @@ Trailing spaces are trimmed."
   "Return the raw contents of DEVICE's iso9660 primary volume descriptor
 as a bytevector, or #f if DEVICE does not contain an iso9660 file system."
   ;; Start reading at sector 16.
-  (read-iso9660-primary-volume-descriptor device (* 2048 16)))
+  ;; Since we are not sure that the device contains an ISO9660 filesystem,
+  ;; we have to find that out first.
+  (if (read-superblock device (* 2048 16) 2048 iso9660-superblock?)
+      (read-iso9660-primary-volume-descriptor device (* 2048 16))
+      #f)) ; Device does not contain an iso9660 filesystem.
 
 (define (iso9660-superblock-uuid sblock)
   "Return the modification time of an iso9660 primary volume descriptor
@@ -283,6 +292,7 @@ SBLOCK as a bytevector."
 (define (iso9660-superblock-volume-name sblock)
   "Return the volume name of SBLOCK as a string.  The volume name is an ASCII
 string.  Trailing spaces are trimmed."
+  ;; Note: Valid characters are of the set "[0-9][A-Z]_" (ECMA-119 Appendix A)
   (string-trim-right (latin1->string (sub-bytevector sblock 40 32)
                                      (lambda (c) #f)) #\space))
 
diff --git a/gnu/local.mk b/gnu/local.mk
index 922c33aca3..cb8fbc5db9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -95,6 +95,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/connman.scm			\
   %D%/packages/cook.scm				\
   %D%/packages/cpio.scm				\
+  %D%/packages/cpp.scm 				\
   %D%/packages/cppi.scm				\
   %D%/packages/cross-base.scm			\
   %D%/packages/crypto.scm			\
@@ -394,7 +395,6 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/video.scm			\
   %D%/packages/vim.scm				\
   %D%/packages/vpn.scm				\
-  %D%/packages/vtk.scm				\
   %D%/packages/w3m.scm				\
   %D%/packages/wdiff.scm			\
   %D%/packages/web.scm				\
@@ -684,7 +684,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
   %D%/packages/patches/ilmbase-fix-tests.patch			\
   %D%/packages/patches/isl-0.11.1-aarch64-support.patch	\
-  %D%/packages/patches/jasper-CVE-2017-6850.patch		\
   %D%/packages/patches/jbig2dec-ignore-testtest.patch		\
   %D%/packages/patches/jbig2dec-CVE-2016-9601.patch		\
   %D%/packages/patches/jbig2dec-CVE-2017-7885.patch		\
@@ -729,6 +728,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libevent-2.1-dns-tests.patch		\
   %D%/packages/patches/libevent-2.1-skip-failing-test.patch	\
   %D%/packages/patches/libextractor-ffmpeg-3.patch		\
+  %D%/packages/patches/libgit2-0.25.1-mtime-0.patch		\
   %D%/packages/patches/libgdata-fix-tests.patch			\
   %D%/packages/patches/libgdata-glib-duplicate-tests.patch	\
   %D%/packages/patches/libgit2-use-after-free.patch		\
@@ -744,6 +744,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libsndfile-armhf-type-checks.patch	\
   %D%/packages/patches/libsndfile-CVE-2017-8361-8363-8365.patch	\
   %D%/packages/patches/libsndfile-CVE-2017-8362.patch		\
+  %D%/packages/patches/libssh-hostname-parser-bug.patch		\
   %D%/packages/patches/libssh2-fix-build-failure-with-gcrypt.patch	\
   %D%/packages/patches/libtar-CVE-2013-4420.patch 		\
   %D%/packages/patches/libtasn1-CVE-2017-6891.patch 		\
@@ -862,9 +863,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/ocaml-findlib-make-install.patch	\
   %D%/packages/patches/omake-fix-non-determinism.patch	\
   %D%/packages/patches/ola-readdir-r.patch			\
+  %D%/packages/patches/openscenegraph-ffmpeg3.patch             \
   %D%/packages/patches/openexr-missing-samples.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9850-CVE-2016-9851.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-9572-CVE-2016-9573.patch		\
+  %D%/packages/patches/openldap-CVE-2017-9287.patch		\
   %D%/packages/patches/openocd-nrf52.patch			\
   %D%/packages/patches/openssl-runpath.patch			\
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch		\
@@ -954,6 +957,10 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch	\
   %D%/packages/patches/python2-subprocess32-disable-input-test.patch	\
   %D%/packages/patches/qemu-CVE-2017-7493.patch			\
+  %D%/packages/patches/qemu-CVE-2017-8112.patch			\
+  %D%/packages/patches/qemu-CVE-2017-8309.patch			\
+  %D%/packages/patches/qemu-CVE-2017-8379.patch			\
+  %D%/packages/patches/qemu-CVE-2017-8380.patch			\
   %D%/packages/patches/qt4-ldflags.patch			\
   %D%/packages/patches/qtscript-disable-tests.patch		\
   %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index e80dc5867d..730fe052cd 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -802,7 +802,7 @@ system administrator.")
 (define-public sudo
   (package
     (name "sudo")
-    (version "1.8.19p1")
+    (version "1.8.20p2")
     (source (origin
               (method url-fetch)
               (uri
@@ -812,7 +812,10 @@ system administrator.")
                                     version ".tar.gz")))
               (sha256
                (base32
-                "14pwdwl03kdbbyjkvxrfx409x3c1fjqz8aqz2wgwddinhz7v3bxq"))))
+                "1na5likm1srnd1g5sjx7b0543sczw0yppacyqsazfdg9b48awhmx"))
+              (modules '((guix build utils)))
+              (snippet
+               '(delete-file-recursively "lib/zlib"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -860,6 +863,7 @@ system administrator.")
     (inputs
      `(("groff" ,groff)
        ("linux-pam" ,linux-pam)
+       ("zlib" ,zlib)
        ("coreutils" ,coreutils)))
     (home-page "https://www.sudo.ws/")
     (synopsis "Run commands as root")
diff --git a/gnu/packages/android.scm b/gnu/packages/android.scm
index e23d0fd910..be3f50add2 100644
--- a/gnu/packages/android.scm
+++ b/gnu/packages/android.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2015 Kai-Chung Yan <seamlikok@gmail.com>
 ;;; Copyright © 2016 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Julien Lepiller <julien@lepiller.eu>
+;;; Copyright © 2017 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -23,8 +24,13 @@
   #:use-module (guix packages)
   #:use-module (guix git-download)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system python)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages ssh)
+  #:use-module (gnu packages version-control)
   #:use-module (gnu packages tls))
 
 ;; The Makefiles that we add are largely based on the Debian
@@ -298,3 +304,98 @@ with an emulator instance or connected Android device.  It facilitates a variety
 of device actions, such as installing and debugging apps, and it provides access
 to a Unix shell that can run commands on the connected device or emulator.")
     (license license:asl2.0)))
+
+(define-public git-repo
+  (package
+    (name "git-repo")
+    (version "1.12.37")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gerrit.googlesource.com/git-repo")
+             (commit (string-append "v" version))))
+       (file-name (string-append "git-repo-" version "-checkout"))
+       (sha256
+        (base32 "0qp7jqhblv7xblfgpcq4n18dyjdv8shz7r60c3vnjxx2fngkj2jd"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:python ,python-2 ; code says: "Python 3 support is … experimental."
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'set-executable-paths
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (git (assoc-ref inputs "git"))
+                    (gpg (assoc-ref inputs "gnupg"))
+                    (ssh (assoc-ref inputs "ssh")))
+               (substitute* '("repo" "git_command.py")
+                 (("^GIT = 'git' ")
+                  (string-append "GIT = '" git "/bin/git' ")))
+               (substitute* "repo"
+                 ((" cmd = \\['gpg',")
+                  (string-append " cmd = ['" gpg "/bin/gpg',")))
+               (substitute* "git_config.py"
+                 ((" command_base = \\['ssh',")
+                  (string-append " command_base = ['" ssh "/bin/ssh',")))
+               #t)))
+         (add-before 'build 'do-not-clone-this-source
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (repo-dir (string-append out "/share/" ,name)))
+               (substitute* "repo"
+                 (("^def _FindRepo\\(\\):.*")
+                  (format #f "
+def _FindRepo():
+  '''Look for a repo installation, starting at the current directory.'''
+  # Use the installed version of git-repo.
+  repo_main = '~a/main.py'
+  curdir = os.getcwd()
+  olddir = None
+  while curdir != '/' and curdir != olddir:
+    dot_repo = os.path.join(curdir, repodir)
+    if os.path.isdir(dot_repo):
+      return (repo_main, dot_repo)
+    else:
+      olddir = curdir
+      curdir = os.path.dirname(curdir)
+  return None, ''
+
+  # The remaining of this function is dead code.  It was used to
+  # find a git-checked-out version in the local project.\n" repo-dir))
+                 ;; Neither clone, check out, nor verify the git repository
+                 (("(^\\s+)_Clone\\(.*\\)") "")
+                 (("(^\\s+)_Checkout\\(.*\\)") "")
+                 ((" rev = _Verify\\(.*\\)") " rev = None"))
+               #t)))
+         (delete 'build) ; nothing to build
+         (replace 'check
+           (lambda _
+             (zero? (system* "python" "-m" "nose"))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin-dir (string-append out "/bin"))
+                    (repo-dir (string-append out "/share/" ,name)))
+               (mkdir-p bin-dir)
+               (mkdir-p repo-dir)
+               (copy-recursively "." repo-dir)
+               (delete-file-recursively (string-append repo-dir "/tests"))
+               (symlink (string-append repo-dir "/repo")
+                        (string-append bin-dir "/repo"))
+               #t))))))
+    (inputs
+     ;; TODO: Add git-remote-persistent-https once it is available in guix
+     `(("git" ,git)
+       ("gnupg" ,gnupg)
+       ("ssh", openssh)))
+    (native-inputs
+     `(("nose" ,python2-nose)))
+    (home-page "https://code.google.com/p/git-repo/")
+    (synopsis "Helps to manage many Git repositories.")
+    (description "Repo is a tool built on top of Git.  Repo helps manage many
+Git repositories, does the uploads to revision control systems, and automates
+parts of the development workflow.  Repo is not meant to replace Git, only to
+make it easier to work with Git.  The repo command is an executable Python
+script that you can put anywhere in your path.")
+    (license license:asl2.0)))
diff --git a/gnu/packages/animation.scm b/gnu/packages/animation.scm
index cbbfa6ed4a..3c590950fd 100644
--- a/gnu/packages/animation.scm
+++ b/gnu/packages/animation.scm
@@ -147,8 +147,21 @@ for tweening, preventing the need to hand-draw each frame.")
               (patches
                (search-patches "synfigstudio-fix-ui-with-gtk3.patch"))))
     (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ;; This fixes the file chooser crash that happens with GTK 3.
+         (add-after 'install 'wrap-program
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (gtk (assoc-ref inputs "gtk+"))
+                    (gtk-share (string-append gtk "/share")))
+               (wrap-program (string-append out "/bin/synfigstudio")
+                 `("XDG_DATA_DIRS" ":" prefix (,gtk-share)))
+               #t))))))
     (inputs
      `(("gtkmm" ,gtkmm)
+       ("gtk+" ,gtk+)
        ("libsigc++" ,libsigc++)
        ("synfig" ,synfig)))
     (native-inputs
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index 5f0e84beed..035ef8c32c 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -118,7 +118,7 @@ spying and/or modification by the server.")
 (define-public par2cmdline
   (package
     (name "par2cmdline")
-    (version "0.7.0")
+    (version "0.7.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/Parchive/par2cmdline/archive/v"
@@ -126,14 +126,13 @@ spying and/or modification by the server.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1m9vnv3pg0nds47raq2rd2kfpaad1sc10hv40hll5byksqlbfxyq"))))
+                "0b2m90jmxm37zpvwcmhshdznnh3l5g5ahdx459a9ckgsxy77jkl9"))))
     (native-inputs
      `(("automake" ,automake)
        ("autoconf" ,autoconf)))
     (build-system gnu-build-system)
     (arguments
-     `(#:parallel-tests? #f
-       #:phases
+     `(#:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'autoreconf
            (lambda _ (zero? (system* "autoreconf" "-vfi")))))))
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index c42e65c2c9..a5c28afc6e 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -2093,7 +2093,7 @@ identify enrichments with functional annotations of the genome.")
 (define-public diamond
   (package
     (name "diamond")
-    (version "0.9.2")
+    (version "0.9.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -2102,7 +2102,7 @@ identify enrichments with functional annotations of the genome.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "03dam11dmrg6f2zsmdbqwzwkmnq5krlckh1acgarw91gcz2nhbpj"))))
+                "1fs5ilvda50vfdg9wll35w8hcpq3jlkp8q2kim4llkwljkj8bls3"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f ; no "check" target
@@ -3214,6 +3214,44 @@ data.")
     (supported-systems '("x86_64-linux"))
     (license license:bsd-3)))
 
+(define-public kaiju
+  (package
+    (name "kaiju")
+    (version "1.5.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/bioinformatics-centre/kaiju/archive/v"
+                    version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0afbfalfw9y39bkwnqjrh9bghs118ws1pzj5h8l0nblgn3mbjdks"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ; There are no tests.
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (add-before 'build 'move-to-src-dir
+           (lambda _ (chdir "src") #t))
+         (replace 'install
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let ((bin (string-append (assoc-ref outputs "out") "/bin")))
+               (mkdir-p bin)
+               (chdir "..")
+               (copy-recursively "bin" bin)
+               (copy-recursively "util" bin))
+             #t)))))
+    (inputs
+     `(("perl" ,perl)))
+    (home-page "http://kaiju.binf.ku.dk/")
+    (synopsis "Fast and sensitive taxonomic classification for metagenomics")
+    (description "Kaiju is a program for sensitive taxonomic classification
+of high-throughput sequencing reads from metagenomic whole genome sequencing
+experiments.")
+    (license license:gpl3+)))
+
 (define-public macs
   (package
     (name "macs")
diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 4bea418618..dec462b0cb 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -91,7 +91,11 @@
                      ;; Make the font visible.
                      (copy-file (assoc-ref inputs "unifont") "unifont.bdf.gz")
                      (system* "gunzip" "unifont.bdf.gz")
-                     #t)))))
+                     #t)))
+
+       ;; We suspect there are race conditions when running tests in parallel:
+       ;; <https://bugs.gnu.org/26936>.
+       #:parallel-tests? #f))
     (inputs
      `(("gettext" ,gettext-minimal)
 
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 11db2a66f7..3742ff5865 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -15,6 +15,7 @@
 ;;; Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2016 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 ng0 <contact.ng0@cryptolab.net>
+;;; Copyright © 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -37,6 +38,7 @@
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix git-download)
+  #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
   #:use-module (guix build-system python)
@@ -46,10 +48,13 @@
   #:use-module (gnu packages backup)
   #:use-module (gnu packages base)
   #:use-module (gnu packages check)
+  #:use-module (gnu packages curl)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages tls)
   #:use-module (gnu packages valgrind)
+  #:use-module (gnu packages zip)
   #:use-module (ice-9 match)
   #:use-module ((srfi srfi-1) #:select (last)))
 
@@ -1159,6 +1164,78 @@ or junctions, and always follows hard links.")
                    ;; expat-licenced (or ‘MIT’) code.
                    license:expat))))
 
+(define-public unshield
+  (package
+    (name "unshield")
+    (version "1.4.2")
+    (source
+     (origin (method url-fetch)
+             (uri (string-append "http://github.com/twogood/unshield/archive/"
+                                 version ".tar.gz"))
+             (sha256
+              (base32
+               "0x7ps644yp5dka2zhb8w0ifqmw3d255jafpzfwv8xbcpgq6fmm2x"))))
+    (build-system cmake-build-system)
+    (inputs
+     `(("zlib" ,zlib)
+       ("openssl" ,openssl)
+       ;; test data that is otherwise downloaded with curl
+       ("unshield-avigomanager11b22.zip"
+        ,(origin
+           (method url-fetch)
+           (uri (string-append "https://www.dropbox.com/s/8r4b6752swe3nhu/\"
+unshield-avigomanager11b22.zip?dl=1"))
+           (sha256
+            (base32 "0fwq7lih04if68wpwpsk5wjqyvh32db76a41sq6gbx4dn1lc3ddn"))
+           (file-name "unshield-avigomanager11b22.zip")))
+       ("unshield-the-feeble-files-spanish.zip"
+        ,(origin
+           (method url-fetch)
+           (uri (string-append "https://www.dropbox.com/s/1ng0z9kfxc7eb1e/\"
+unshield-the-feeble-files-spanish.zip?dl=1"))
+           (sha256
+            (base32 "1k5cw6vnpja8yjlnhx5124xrw9i8s1l539hfdqqrqz3l5gn0bnyd"))
+           (file-name "unshield-the-feeble-files-spanish.zip")))))
+    (native-inputs
+     `(("unzip" ,unzip)))
+    (arguments
+     `(#:out-of-source? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'pre-check
+           (lambda* (#:key inputs #:allow-other-keys)
+             (for-each (lambda (i)
+                         (copy-file (assoc-ref inputs i)
+                                    (string-append "test/v0/" i)))
+                       '("unshield-avigomanager11b22.zip"
+                         "unshield-the-feeble-files-spanish.zip"))
+             (substitute* (find-files "test/" "/*\\.sh")
+               ;; Tests expect the unshield binary in a specific
+               ;; location.
+               (("/var/tmp/unshield/bin/unshield")
+                (string-append (getcwd) "/src/unshield"))
+               ;; We no longer need to download the data.
+               ((".?URL=.*$") "")
+               (("curl -(|f)sSL -o test.zip .*") ""))
+             (substitute* "test/v0/avigomanager.sh"
+               (("test.zip")
+                (string-append (getcwd)
+                  "/test/v0/unshield-avigomanager11b22.zip")))
+             (substitute* "test/v0/the-feeble-files-spanish.sh"
+               (("test.zip")
+                (string-append (getcwd)
+                               "/test/v0/unshield-the-feeble-files-spanish.zip")))
+             #t))
+         (replace 'check
+           (lambda _
+            (zero? (system* "./run-tests.sh")))))))
+    (home-page "https://github.com/twogood/unshield")
+    (synopsis "Extract CAB files from InstallShield installers")
+    (description
+     "@command{unshield} is a tool and library for extracting @file{.cab}
+ archives from InstallShield installers.")
+    (license license:expat)))
+
 (define-public unrar
   (package
     (name "unrar")
diff --git a/gnu/packages/cpp.scm b/gnu/packages/cpp.scm
new file mode 100644
index 0000000000..da192553a5
--- /dev/null
+++ b/gnu/packages/cpp.scm
@@ -0,0 +1,59 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Ethan R. Jones <doubleplusgood23@gmail.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages cpp)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix build-system gnu)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages autotools))
+
+(define-public libzen
+  (package
+    (name "libzen")
+    (version "0.4.35")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://mediaarea.net/download/source/"
+                                  name "/" version "/"
+                                  name "_" version ".tar.bz2"))
+              (sha256
+               (base32
+                "12a1icgcffgv503ii2k1453kxg5hfly09mf4zjcc80aq8a6rf8by"))))
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:phases
+       ;; build scripts not in root of archive
+       (modify-phases %standard-phases
+         (add-before 'configure 'pre-configure
+           (lambda _
+             (chdir "Project/GNU/Library")))
+         (add-before 'configure 'autogen
+           (lambda _
+             (zero? (system* "./autogen.sh")))))))
+    (home-page "https://github.com/MediaArea/ZenLib")
+    (synopsis "C++ utility library")
+    (description "ZenLib is a C++ utility library.  It includes classes for handling
+strings, configuration, bit streams, threading, translation, and cross-platform
+operating system functions.")
+    (license license:zlib)))
diff --git a/gnu/packages/cross-base.scm b/gnu/packages/cross-base.scm
index d5ca9b8da0..abc3a2821c 100644
--- a/gnu/packages/cross-base.scm
+++ b/gnu/packages/cross-base.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2016 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
@@ -40,10 +40,13 @@
             cross-gcc
             cross-newlib?))
 
-(define %xgcc
+(define-syntax %xgcc
   ;; GCC package used as the basis for cross-compilation.  It doesn't have to
   ;; be 'gcc' and can be a specific variant such as 'gcc-4.8'.
-  gcc)
+  ;;
+  ;; Note: This is a macro so that we do not refer to 'gcc' from the top
+  ;; level, which would lead to circular-dependency issues.
+  (identifier-syntax gcc))
 
 (define %gcc-include-paths
   ;; Environment variables for header search paths.
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 26706b8275..c46e917b89 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -372,7 +372,7 @@ Language.")
 (define-public mariadb
   (package
     (name "mariadb")
-    (version "10.1.23")
+    (version "10.1.24")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://downloads.mariadb.org/f/"
@@ -380,7 +380,7 @@ Language.")
                                   name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1gq08dj9skr0gli1nj7a8wl92w8lmmqy0sbxvkmy79dz4i713n2l"))))
+                "07jm9m7d5x4zdpasdjs98m36dkjl7ypc9jz4xmnczj0ybfp9kpxk"))))
     (build-system cmake-build-system)
     (arguments
      '(#:configure-flags
diff --git a/gnu/packages/dictionaries.scm b/gnu/packages/dictionaries.scm
index 1e766d73bd..df12bf8a32 100644
--- a/gnu/packages/dictionaries.scm
+++ b/gnu/packages/dictionaries.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -25,6 +25,11 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial)
   #:use-module (gnu packages base)
+  #:use-module (gnu packages curl)
+  #:use-module (gnu packages emacs)
+  #:use-module (gnu packages fribidi)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages readline)
   #:use-module (gnu packages texinfo)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages tcl))
@@ -200,3 +205,50 @@ work, such as sentence length and other readability measures.")
 It comes with a German-English dictionary with approximately 270,000 entries.")
     (home-page  "http://www-user.tu-chemnitz.de/~fri/ding/")
     (license gpl2+)))
+
+(define-public translate-shell
+  (package
+    (name "translate-shell")
+    (version "0.9.6.3")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://github.com/soimort/" name "/archive/v"
+                            version ".tar.gz"))
+        (sha256
+         (base32
+          "13rjq9v3ykk5c0i5daybpnqnyg09cbcgjzykx49h2h5hvspixvi5"))
+        (file-name (string-append name "-" version ".tar.gz"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure) ; no configure phase
+         (add-after 'install 'emacs-install
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out   (assoc-ref outputs "out"))
+                    (dest  (string-append out "/share/emacs/site-lisp"))
+                    (emacs (string-append (assoc-ref inputs "emacs") "/bin/emacs")))
+               (install-file "google-translate-mode.el" dest)
+               (emacs-generate-autoloads ,name dest)))))
+       #:make-flags (list (string-append "PREFIX=" %output))
+       #:imported-modules (,@%gnu-build-system-modules (guix build emacs-utils))
+       #:modules ((guix build gnu-build-system)
+                  (guix build emacs-utils)
+                  (guix build utils))
+       #:test-target "test"))
+    (propagated-inputs
+     `(("curl" ,curl)
+       ("fribidi" ,fribidi)
+       ("rlwrap" ,rlwrap)))
+    (native-inputs
+     `(("emacs" ,emacs-minimal)
+       ("util-linux" ,util-linux))) ; hexdump, for the test
+    (home-page "https://www.soimort.org/translate-shell")
+    (synopsis "Translations from the command line")
+    (description
+     "Translate Shell (formerly Google Translate CLI) is a command-line
+translator powered by Google Translate (default), Bing Translator,
+Yandex.Translate and Apertium.  It gives you easy access to one of these
+translation engines from your terminal.")
+    (license public-domain)))
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index e840d51255..81a74d1fb5 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -335,28 +335,7 @@ metadata.")
               (sha256
                (base32
                 "0pp3n8q6kc70blqsaw0zlzp6bc327dpgdrjr0cnh7hqg1lras7ka"))))
-    (build-system trivial-build-system)
-    (native-inputs `(("emacs" ,emacs-minimal)))
-    (arguments
-     `(#:modules ((guix build utils)
-                  (guix build emacs-utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-         (use-modules (guix build emacs-utils))
-
-         (let* ((emacs    (string-append (assoc-ref %build-inputs "emacs")
-                                         "/bin/emacs"))
-                (source   (assoc-ref %build-inputs "source"))
-                (lisp-dir (string-append %output
-                                         "/share/emacs/site-lisp"))
-                (target   (string-append lisp-dir "/paredit.el")))
-           (mkdir-p lisp-dir)
-           (copy-file source target)
-           (with-directory-excursion lisp-dir
-             (parameterize ((%emacs emacs))
-               (emacs-generate-autoloads ,name lisp-dir)
-               (emacs-batch-eval '(byte-compile-file "paredit.el"))))))))
+    (build-system emacs-build-system)
     (home-page "http://mumble.net/~campbell/emacs/paredit/")
     (synopsis "Emacs minor mode for editing parentheses")
     (description
@@ -386,31 +365,7 @@ when typing parentheses directly or commenting out code line by line.")
               (sha256
                (base32
                 "0xxrmf0jnyljxvllc22qa0v8lgi4k1ldnayjm5hf68m25jsr378l"))))
-    (build-system gnu-build-system)
-    (arguments
-     `(#:modules ((guix build gnu-build-system)
-                  (guix build emacs-utils)
-                  (guix build utils))
-       #:imported-modules (,@%gnu-build-system-modules
-                           (guix build emacs-utils))
-
-       #:make-flags (list (string-append "PREFIX="
-                                         (assoc-ref %outputs "out"))
-                          ;; Don't put .el files in a 'git-modes'
-                          ;; sub-directory.
-                          (string-append "LISPDIR="
-                                         (assoc-ref %outputs "out")
-                                         "/share/emacs/site-lisp"))
-       #:tests? #f  ; no check target
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  (add-after 'install 'emacs-autoloads
-                             (lambda* (#:key outputs #:allow-other-keys)
-                               (let* ((out  (assoc-ref outputs "out"))
-                                      (lisp (string-append
-                                             out "/share/emacs/site-lisp/")))
-                                 (emacs-generate-autoloads ,name lisp)))))))
-    (native-inputs `(("emacs" ,emacs-minimal)))
+    (build-system emacs-build-system)
     (home-page "https://github.com/magit/git-modes")
     (synopsis "Emacs major modes for Git configuration files")
     (description
@@ -694,30 +649,7 @@ programs.")
               (sha256
                (base32
                 "07312bvvyz86lf64vdkxg2l1wgfjl25ljdjwlf1bdzj01c4hm88x"))))
-    (build-system trivial-build-system)
-    (arguments
-     `(#:modules ((guix build utils)
-                  (guix build emacs-utils))
-
-       #:builder (begin
-                   (use-modules (guix build emacs-utils)
-                                (guix build utils))
-
-                   (let* ((out     (assoc-ref %outputs "out"))
-                          (lispdir (string-append out
-                                                  "/share/emacs/site-lisp/"
-                                                  "guix.d/let-alist-"
-                                                  ,version))
-                          (emacs   (assoc-ref %build-inputs "emacs")))
-
-                     (mkdir-p lispdir)
-                     (copy-file (assoc-ref %build-inputs "source")
-                                (string-append lispdir "/let-alist.el"))
-
-                     (setenv "PATH" (string-append emacs "/bin"))
-                     (emacs-byte-compile-directory lispdir)
-                     #t))))
-    (native-inputs `(("emacs" ,emacs-minimal)))
+    (build-system emacs-build-system)
     (home-page "https://elpa.gnu.org/packages/let-alist.html")
     (synopsis "Easily let-bind values of an assoc-list by their names")
     (description
@@ -2084,6 +2016,7 @@ source code using IPython.")
                (base32
                 "07wgcvg038l88gxvjr0gjpjhyk743w22x1rqghz3gkmif0g70say"))))
     (build-system emacs-build-system)
+    (arguments '(#:include '("\\.el$" "\\.wsdl$" "\\.info$")))
     (propagated-inputs
      `(("emacs-async" ,emacs-async)))
     (home-page "https://elpa.gnu.org/packages/debbugs.html")
diff --git a/gnu/packages/fonts.scm b/gnu/packages/fonts.scm
index 954c588189..73d76a461f 100644
--- a/gnu/packages/fonts.scm
+++ b/gnu/packages/fonts.scm
@@ -7,7 +7,7 @@
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015, 2016 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2016, 2017 ng0 <ng0@libertad.pw>
+;;; Copyright © 2016, 2017 ng0 <ng0@no-reply.pragmatique.xyz>
 ;;; Copyright © 2016 Jookia <166291@gmail.com>
 ;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2016 Dmitry Nikolaev <cameltheman@gmail.com>
@@ -107,7 +107,6 @@ TrueType (TTF) files.")
              (sha256
               (base32
                "1mqpds24wfs5cmfhj57fsfs07mji2z8812i5c4pi5pbi738s977s"))))
-    (build-system trivial-build-system)
     (build-system font-build-system)
     (arguments
      `(#:phases
@@ -232,34 +231,7 @@ sans-serif designed for on-screen reading.  It is used by GNOME@tie{}3.")
               (sha256
                (base32
                 "010m4zfqan4w04b6bs9pm3gapn9hsb18bmwwgp2p6y6idj52g43q"))))
-    (build-system trivial-build-system)
-    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-
-         (let ((tar      (string-append (assoc-ref %build-inputs "tar")
-                                        "/bin/tar"))
-               (PATH     (string-append (assoc-ref %build-inputs "gzip")
-                                        "/bin"))
-               (font-dir (string-append %output "/share/fonts/truetype"))
-               (doc-dir  (string-append %output "/share/doc/" ,name)))
-           (setenv "PATH" PATH)
-           (system* tar "xvf" (assoc-ref %build-inputs "source"))
-           (mkdir-p font-dir)
-           (mkdir-p doc-dir)
-           (chdir (string-append "liberation-fonts-ttf-" ,version))
-           (for-each (lambda (ttf)
-                       (install-file ttf font-dir))
-                     (find-files "." "\\.ttf$"))
-           (for-each (lambda (doc)
-                       (install-file doc doc-dir))
-                     '("AUTHORS" "ChangeLog" "LICENSE" "README" "TODO"))))))
-    (native-inputs
-     `(("source" ,source)
-       ("tar" ,tar)
-       ("gzip" ,gzip)))
+    (build-system font-build-system)
     (home-page "https://pagure.io/liberation-fonts/")
     (synopsis
      "Fonts compatible with Arial, Times New Roman, and Courier New")
@@ -431,42 +403,14 @@ text in Simplified Chinese, Traditional Chinese, Japanese, and Korean.")
 (define-public font-cns11643
   (package
     (name "font-cns11643")
-    (version "98.1.20170405")
+    (version "98.1.20170524")
     (source (origin
               (method url-fetch)
               (uri "http://www.cns11643.gov.tw/AIDB/Open_Data.zip")
               (sha256
                (base32
-                "02kb3bwjrra0k2hlr2p8xswd2y0xs6j8d9vm6yrby734h02a40qf"))))
-    (outputs '("out" "tw-kai" "tw-sung"))
-    (build-system trivial-build-system)
-    (native-inputs
-     `(("unzip" ,unzip)))
-    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-         (let* ((font-dir "/share/fonts/truetype/cns11643")
-                (out (string-append
-                      (assoc-ref %outputs "out") font-dir))
-                (tw-kai (string-append
-                         (assoc-ref %outputs "tw-kai") font-dir))
-                (tw-sung (string-append
-                          (assoc-ref %outputs "tw-sung") font-dir))
-                (unzip (string-append
-                        (assoc-ref %build-inputs "unzip") "/bin/unzip")))
-           (system* unzip (assoc-ref %build-inputs "source"))
-           (chdir "Open_Data/Fonts/")
-           (install-file "TW-Kai-98_1.ttf" tw-kai)
-           (install-file "TW-Sung-98_1.ttf" tw-sung)
-           (install-file "TW-Kai-98_1.ttf" out)
-           (install-file "TW-Kai-Ext-B-98_1.ttf" out)
-           (install-file "TW-Kai-Plus-98_1.ttf" out)
-           (install-file "TW-Sung-98_1.ttf" out)
-           (install-file "TW-Sung-Ext-B-98_1.ttf" out)
-           (install-file "TW-Sung-Plus-98_1.ttf" out)
-           #t))))
+                "1iad6rklxkx03ji1fav9faq7cmqkci3i6pcyg2ilvh984j5qzhq3"))))
+    (build-system font-build-system)
     (home-page "http://www.cns11643.gov.tw/AIDB/welcome.do")
     (synopsis "CJK TrueType fonts, TW-Kai and TW-Sung")
     (description
@@ -499,19 +443,7 @@ encoded in the user defined area of the Big-5 code.
        (sha256
         (base32
          "1qkljldbmb53zp1rcmpsb8rzy67rnsqcjxi549m9743ifk4isl78"))))
-    (build-system trivial-build-system)
-    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-         (let ((font-dir (string-append %output
-                                        "/share/fonts/truetype/cns11643"))
-               (source (assoc-ref %build-inputs "source")))
-           (mkdir-p font-dir)
-           (copy-file source
-                      (string-append font-dir "/" "ebas927.ttf"))
-           #t))))
+    (build-system font-build-system)
     (home-page
      (string-append "http://www.cns11643.gov.tw/AIDB/download.do"
                     "?name=%E5%AD%97%E5%9E%8B%E4%B8%8B%E8%BC%89"))
@@ -1073,26 +1005,8 @@ designed to work well in user interface environments.")
                                 name "-" version ".zip"))
             (sha256
              (base32
-              "1frhmw41lnnm9rda2zs202pvfi5vzlrsw4xfp4mswl0qgws61mcd"))))
-   (build-system trivial-build-system)
-   (native-inputs
-    `(("unzip" ,unzip)))
-   (arguments
-    `(#:modules ((guix build utils))
-      #:builder (begin
-                  (use-modules (guix build utils))
-                  (let* ((font-dir (string-append %output
-                                                  "/share/fonts/opentype"))
-                         (source (assoc-ref %build-inputs "source"))
-                         (src-otf-file (string-append "font-awesome-"
-                                                      ,version
-                                                      "/fonts/FontAwesome.otf"))
-                         (dest-otf-file (string-append font-dir "/FontAwesome.otf"))
-                         (unzip (assoc-ref %build-inputs "unzip")))
-                    (setenv "PATH" (string-append unzip "/bin"))
-                    (mkdir-p font-dir)
-                    (system* "unzip" source "-d" ".")
-                    (copy-file src-otf-file dest-otf-file)))))
+              "1m1rfwm4sjkv10j3xd2dhwk286a5912b2zgvc692cmxi5gxs68jf"))))
+   (build-system font-build-system)
    (home-page "http://fontawesome.io")
    (synopsis "Font that contains a rich iconset")
    (description
@@ -1166,111 +1080,105 @@ later hand-tweaked with the gbdfed(1) editor:
 
 (define-public font-comic-neue
   (package
-   (name "font-comic-neue")
-   (version "2.3")
-   (source (origin
-            (method url-fetch)
-            (uri (string-append
-                  "http://www.comicneue.com/comic-neue-" version ".zip"))
-            (sha256
-             (base32
-              "1695hkpd8kqnr2a88p8xs496slgzxjjkzpa9aa33ml3pnh7519zk"))))
-   (build-system trivial-build-system)
-   (arguments
-    `(#:modules ((guix build utils))
-      #:builder (begin
-                  (use-modules (guix build utils))
-                  (let ((font-dir (string-append %output
-                                                 "/share/fonts/truetype"))
-                        (source (assoc-ref %build-inputs "source"))
-                        (unzip  (string-append (assoc-ref %build-inputs "unzip")
-                                               "/bin/unzip")))
-                    (mkdir-p font-dir)
-                    (system* unzip source)
-                    (with-directory-excursion
-                     (string-append "Web")
-                     (for-each (lambda (ttf)
-                                 (install-file ttf font-dir))
-                               (find-files "." "\\.ttf$")))))))
-   (native-inputs `(("unzip" ,unzip)))
-   (home-page "http://www.comicneue.com/")
-   (synopsis "Font that fixes the shortcomings of Comic Sans")
-   (description
-    "Comic Neue is a font that attempts to create a respectable casual
+    (name "font-comic-neue")
+    (version "2.3")
+    (source (origin
+              (method url-fetch/zipbomb)
+              (uri (string-append
+                    "http://www.comicneue.com/comic-neue-" version ".zip"))
+              (sha256
+               (base32
+                "1695hkpd8kqnr2a88p8xs496slgzxjjkzpa9aa33ml3pnh7519zk"))))
+    (build-system font-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ;; Delete Mac OS X specific files. If not deleted, these cause
+         ;; several hidden files to be installed.
+         (add-before 'install 'delete-macosx-files
+           (lambda _
+             (delete-file-recursively "__MACOSX")
+             #t))
+         (add-after 'install 'install-conf
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((conf-dir (string-append (assoc-ref outputs "out")
+                                            "/share/fontconfig/conf.avail")))
+               (mkdir-p conf-dir)
+               (call-with-output-file
+                   (string-append conf-dir "/30-comic-neue.conf")
+                 (lambda (port)
+                   (format port "<?xml version=\"1.0\"?>
+<!DOCTYPE fontconfig SYSTEM \"fonts.dtd\">
+<fontconfig>
+  <!-- If Comic Sans is missing, use Comic Neue instead. -->
+  <alias>
+    <family>Comic Sans MS</family>
+    <prefer>
+      <family>Comic Neue</family>
+    </prefer>
+  </alias>
+</fontconfig>\n"))))
+             #t)))))
+    (home-page "http://www.comicneue.com/")
+    (synopsis "Font that fixes the shortcomings of Comic Sans")
+    (description
+     "Comic Neue is a font that attempts to create a respectable casual
 typeface, by mimicking Comic Sans while fixing its most obvious shortcomings.")
-   (license license:silofl1.1)))
+    (license license:silofl1.1)))
 
 (define-public font-iosevka
   (package
-   (name "font-iosevka")
-   (version "1.11.0")
-   (source (origin
-            (method url-fetch)
-            (uri (string-append
-                  "https://github.com/be5invis/Iosevka/releases/download/v"
-                  version "/iosevka-pack-" version ".zip"))
-            (sha256
-             (base32
-              "0d8prdk7s5z94sdfd0y92cvqq531yqrlg7hnadbnhd7fs9jqr5hj"))))
-   (build-system trivial-build-system)
-   (arguments
-    `(#:modules ((guix build utils))
-      #:builder (begin
-                  (use-modules (guix build utils))
-                  (let ((font-dir (string-append %output
-                                                 "/share/fonts/truetype"))
-                        (source (assoc-ref %build-inputs "source"))
-                        (unzip  (string-append (assoc-ref %build-inputs "unzip")
-                                               "/bin/unzip")))
-                    (mkdir-p font-dir)
-                    (system* unzip "-d" font-dir source)))))
-   (native-inputs `(("unzip" ,unzip)))
-   (home-page "https://be5invis.github.io/Iosevka/")
-   (synopsis "Coders' typeface, built from code")
-   (description
-    "Iosevka is a slender monospace sans-serif or slab-serif typeface inspired
+    (name "font-iosevka")
+    (version "1.12.5")
+    (source (origin
+              (method url-fetch/zipbomb)
+              (uri (string-append
+                    "https://github.com/be5invis/Iosevka/releases/download/v"
+                    version "/iosevka-pack-" version ".zip"))
+              (sha256
+               (base32
+                "0s3g6mk0ngwsrw9h9dqinb50cd9i8zhqdcmmh93fhyf4d87yfwyi"))))
+    (build-system font-build-system)
+    (home-page "https://be5invis.github.io/Iosevka/")
+    (synopsis "Coders' typeface, built from code")
+    (description
+     "Iosevka is a slender monospace sans-serif or slab-serif typeface inspired
 by Pragmata Pro, M+, and PF DIN Mono, designed to be the ideal font for
 programming.  Iosevka is completely generated from its source code.")
-   (license (list license:silofl1.1  ; build artifacts (i.e. the fonts)
-                  license:bsd-3))))  ; supporting code
+    (license (list license:silofl1.1 ; build artifacts (i.e. the fonts)
+                   license:bsd-3)))) ; supporting code
 
 (define-public font-go
-  (let ((commit "b7f8df6bc082334698d4505fb85fa05e99156b72")
+  (let ((commit "f03a046406d4d7fbfd4ed29f554da8f6114049fc")
         (revision "1"))
     (package
-     (name "font-go")
-     (version (string-append "20161115-" revision "." (string-take commit 7)))
-     (source (origin
-              (file-name (string-append "go-image-" version "-checkout"))
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://go.googlesource.com/image")
-                    (commit commit)))
-              (sha256
-               (base32
-                "1ywxs6dmcyzwwsmnan3qqza7znprnbvmdi260x6sjmydz6dyq2zs"))))
-     (build-system trivial-build-system)
-     (arguments
-      `(#:modules ((guix build utils))
-        #:builder (begin
-                    (use-modules (guix build utils))
-                    (let ((font-dir (string-append %output
-                                                   "/share/fonts/truetype"))
-                          (source (assoc-ref %build-inputs "source")))
-                      (mkdir-p font-dir)
-                      (with-directory-excursion
-                       (string-append source "/font/gofont/ttfs")
-                       (for-each (lambda (ttf)
-                                   (install-file ttf font-dir))
-                                 (find-files "." "\\.ttf$")))))))
-     (home-page "https://blog.golang.org/go-fonts")
-     (synopsis "The Go font family")
-     (description
-      "The Go font family is a set of WGL4 TrueType fonts from the Bigelow &
+      (name "font-go")
+      (version (string-append "20170330-" revision "." (string-take commit 7)))
+      (source (origin
+                (file-name (string-append "go-image-" version "-checkout"))
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://go.googlesource.com/image")
+                      (commit commit)))
+                (sha256
+                 (base32
+                  "1aq6mnjayks55gd9ahavk6jfydlq5lm4xm0xk4pd5sqa74p5p74d"))))
+      (build-system font-build-system)
+      (arguments
+       `(#:phases
+         (modify-phases %standard-phases
+           (add-before 'install 'chdir
+             (lambda _
+               (chdir "font/gofont/ttfs")
+               #t)))))
+      (home-page "https://blog.golang.org/go-fonts")
+      (synopsis "The Go font family")
+      (description
+       "The Go font family is a set of WGL4 TrueType fonts from the Bigelow &
 Holmes type foundry, released under the same license as the Go programming
 language.  It includes a set of proportional, sans-serif fonts, and a set of
 monospace, slab-serif fonts.")
-     (license (package-license go-1.4)))))
+      (license (package-license go-1.4)))))
 
 (define-public font-google-material-design-icons
   (package
diff --git a/gnu/packages/game-development.scm b/gnu/packages/game-development.scm
index b7bcdee94c..6d9e4061d1 100644
--- a/gnu/packages/game-development.scm
+++ b/gnu/packages/game-development.scm
@@ -249,6 +249,47 @@ levels.")
        `(("python2-pathlib" ,python2-pathlib)
          ,@(package-propagated-inputs python2-tmx))))))
 
+(define-public python-xsge
+  (package
+    (name "python-xsge")
+    (version "2017.04.10")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://savannah/xsge/xsge-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "04il5yx0py6kchxxw6ydbbx0wpiyjf9dgkwsdynirpkczlnid3am"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         ;; xSGE's setup.py script does not support one of the Python build
+         ;; system's default flags, "--single-version-externally-managed".
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (zero?
+              (system* "python" "setup.py" "install"
+                       (string-append "--prefix=" (assoc-ref outputs "out"))
+                       "--root=/")))))
+       #:tests? #f)) ; no check target
+    (propagated-inputs
+     `(("python-sge-pygame" ,python-sge-pygame)
+       ("python-pygame" ,python-pygame)
+       ("python-six" ,python-six)
+       ("python-tmx" ,python-tmx)))
+    (home-page "http://xsge.nongnu.org")
+    (synopsis "Extensions for the SGE Game Engine")
+    (description
+     "xSGE is a collection of modules that make doing certain tasks with the SGE
+Game Engine easier.  In addition to SGE's conveniences, the user has access to a
+GUI toolkit, lighting and physics frameworks and @code{Tiled} TMX format
+support.")
+    (license license:gpl3+)))
+
+(define-public python2-xsge
+  (package-with-python2 python-xsge))
+
 (define-public tiled
   (package
     (name "tiled")
@@ -442,8 +483,9 @@ programming language.")
     (version "4.4.2")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://download.gna.org/allegro/allegro/"
-                                  version "/allegro-" version ".tar.gz"))
+              (uri (string-append "https://github.com/liballeg/allegro5/"
+                                  "releases/download/" version "/allegro-"
+                                  version ".tar.gz"))
               (sha256
                (base32
                 "1p0ghkmpc4kwij1z9rzxfv7adnpy4ayi0ifahlns1bdzgmbyf88v"))))
@@ -477,14 +519,18 @@ etc.")
 (define-public allegro
   (package
     (name "allegro")
-    (version "5.2.0")
+    (version "5.2.2.0")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://download.gna.org/allegro/allegro/"
-                                  version "/allegro-" version ".tar.gz"))
+              (uri (string-append "https://github.com/liballeg/allegro5/releases"
+                                  "/download/" version "/allegro-"
+                                  (if (equal? "0" (string-take-right version 1))
+                                    (string-drop-right version 2)
+                                    version)
+                                  ".tar.gz"))
               (sha256
                (base32
-                "1mwzgzc4nb5k5zkbq7yrc6hg63yxq3wk69lmjag1h19x8b6njnmg"))))
+                "1z4lrrlmn471wb7vzbd9iw7g379vj0k964vy1s64hcvv5bhvk1g2"))))
     (build-system cmake-build-system)
     (arguments `(#:tests? #f)) ; there are no tests
     (inputs
@@ -520,8 +566,12 @@ etc.")
     (version "5.0.11")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://download.gna.org/allegro/allegro/"
-                                  version "/allegro-" version ".tar.gz"))
+              (uri (string-append "https://github.com/liballeg/allegro5/releases"
+                                  "/download/" version "/allegro-"
+                                  (if (equal? "0" (string-take-right version 1))
+                                    (string-drop-right version 2)
+                                    version)
+                                  ".tar.gz"))
               (sha256
                (base32
                 "0cd51qrh97jrr0xdmnivqgwljpmizg8pixsgvc4blqqlaz4i9zj9"))))))
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index 60d885500c..9153a2b5cf 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -17,7 +17,7 @@
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2016, 2017 Rodger Fox <thylakoid@openmailbox.org>
 ;;; Copyright © 2016 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
-;;; Copyright © 2016, 2017 ng0 <contact.ng0@cryptolab.net>
+;;; Copyright © 2016, 2017 ng0 <ng0@no-reply.pragmatique.xyz>
 ;;; Copyright © 2016 Albin Söderqvist <albin@fripost.org>
 ;;; Copyright © 2016, 2017 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
@@ -30,6 +30,7 @@
 ;;; Copyright © 2017 nee <nee-git@hidamari.blue>
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -66,6 +67,7 @@
   #:use-module (gnu packages avahi)
   #:use-module (gnu packages boost)
   #:use-module (gnu packages documentation)
+  #:use-module (gnu packages docbook)
   #:use-module (gnu packages fltk)
   #:use-module (gnu packages fribidi)
   #:use-module (gnu packages game-development)
@@ -134,6 +136,82 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system trivial))
 
+(define-public cataclysm-dda
+  (package
+    (name "cataclysm-dda")
+    (version "0.C")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/CleverRaven/Cataclysm-DDA/"
+                                  "archive/" version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1xlajmgl9cviqyjpp5g5q4rbljy9gqc49v54bi8gpzr68s14gsb9"))
+              (modules '((guix build utils)))
+              (snippet
+               ;; Import cmath header for the std::pow function.
+               '(for-each (lambda (file)
+                            (substitute* file
+                              (("#include <math.h>")
+                               "#include <cmath>")))
+                          (find-files "src")))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
+                          "USE_HOME_DIR=1" "DYNAMIC_LINKING=1" "RELEASE=1")
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda _
+             (substitute* "Makefile"
+               (("ncursesw5-config") "ncursesw6-config")
+               (("RELEASE_FLAGS = -Werror") "RELEASE_FLAGS ="))
+             #t))
+         (add-after 'build 'build-tiles
+           (lambda* (#:key make-flags outputs #:allow-other-keys)
+             ;; Change prefix directory and enable tile graphics and sound.
+             (zero?
+              (apply system* "make" "TILES=1" "SOUND=1"
+                     (string-append "PREFIX="
+                                    (assoc-ref outputs "tiles"))
+                     (cdr make-flags)))))
+         (add-after 'install 'install-tiles
+           (lambda* (#:key make-flags outputs #:allow-other-keys)
+             (zero?
+              (apply system* "make" "install" "TILES=1" "SOUND=1"
+                     (string-append "PREFIX="
+                                    (assoc-ref outputs "tiles"))
+                     (cdr make-flags))))))
+       ;; TODO: Add libtap++ from https://github.com/cbab/libtappp as a native
+       ;;       input in order to support tests.
+       #:tests? #f))
+    (outputs '("out"
+               "tiles")) ; For tile graphics and sound support.
+    (native-inputs
+     `(("gettext" ,gettext-minimal)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("freetype" ,freetype)
+       ("libogg" ,libogg)
+       ("libvorbis" ,libvorbis)
+       ("ncurses" ,ncurses)
+       ("sdl2" ,sdl2)
+       ("sdl2-image", sdl2-image)
+       ("sdl2-ttf" ,sdl2-ttf)
+       ("sdl2-mixer" ,sdl2-mixer)))
+    (home-page "http://en.cataclysmdda.com/")
+    (synopsis "Survival horror roguelike video game")
+    (description
+     "Cataclysm: Dark Days Ahead is a roguelike set in a post-apocalyptic world.
+Struggle to survive in a harsh, persistent, procedurally generated world.
+Scavenge the remnants of a dead civilization for food, equipment, or, if you are
+lucky, a vehicle with a full tank of gas to get you out of Dodge.  Fight to
+defeat or escape from a wide variety of powerful monstrosities, from zombies to
+giant insects to killer robots and things far stranger and deadlier, and against
+the others like yourself, that want what you have.")
+    (license license:cc-by-sa3.0)))
+
 (define-public freedoom
   (package
    (name "freedoom")
@@ -1097,7 +1175,7 @@ either by Infocom or created using the Inform compiler.")
 (define-public retroarch
   (package
     (name "retroarch")
-    (version "1.5.0")
+    (version "1.6.0")
     (source
      (origin
        (method url-fetch)
@@ -1105,7 +1183,7 @@ either by Infocom or created using the Inform compiler.")
                            version ".tar.gz"))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-        (base32 "1rbdax3i33myg1v938pxy28117ihff2lml1ky6g70c8099fkirjx"))))
+        (base32 "01h9mswlfjk3zpdxwk1ciy5qkq6xq925gvk6wrh8k066b2wx8f8k"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f                      ; no tests
@@ -3403,16 +3481,20 @@ for Un*x systems with X11.")
 (define-public freeciv
   (package
    (name "freeciv")
-   (version "2.5.6")
+   (version "2.5.7")
    (source
     (origin
      (method url-fetch)
-     (uri (string-append
-           "http://download.gna.org/freeciv/"
-           "stable/freeciv-" version ".tar.bz2"))
+     (uri (list (string-append
+                  "http://files.freeciv.org/stable/freeciv-"
+                  version ".tar.bz2")
+                (string-append
+                  "mirror://sourceforge/freeciv/Freeciv%20"
+                  (version-major+minor version) "/" version
+                  "/freeciv-" version ".tar.bz2")))
      (sha256
       (base32
-       "16wrnsx5rmbz6rjs03bhy0vn20i6n6g73lx7fjpai98ixhzc5bfg"))))
+       "1lmydnnqraa947l7gdz6xgm0bgks1ywsivp9h4v8jr3avcv6gqzz"))))
    (build-system gnu-build-system)
    (inputs
     `(("curl" ,curl)
@@ -4272,3 +4354,58 @@ at their peak of economic growth and military prowess.
                    license:lgpl3
                    license:mpl2.0
                    license:zlib))))
+
+;; There have been no official releases.
+(define-public open-adventure
+  (let* ((commit "2483a23690d205f01ecb66165cf4522b541cd991")
+         (revision "1"))
+    (package
+      (name "open-adventure")
+      (version (string-append "2.5-" revision "." (string-take commit 7)))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://gitlab.com/esr/open-adventure")
+                      (commit commit)))
+                (file-name (string-append name "-" version "-checkout"))
+                (sha256
+                 (base32
+                  "1gkvkwbq5cl3llfc7nl41van8awn4myx782pg33bxpbx5l9scwb4"))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:make-flags (list "CC=gcc")
+         #:parallel-build? #f ; not supported
+         #:phases
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (add-before 'build 'use-echo
+             (lambda _
+               (substitute* "tests/Makefile"
+                 (("/bin/echo") (which "echo")))
+               #t))
+           (add-after 'build 'build-manpage
+             (lambda _
+               ;; This target is missing a dependency
+               (substitute* "Makefile"
+                 ((".asc.6:" line)
+                  (string-append line " advent.txt")))
+               (zero? (system* "make" ".asc.6"))))
+           ;; There is no install target
+           (replace 'install
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out"))
+                      (bin (string-append out "/bin"))
+                      (man (string-append out "/share/man/man6")))
+                 (install-file "advent" bin)
+                 (install-file "advent.6" man))
+               #t)))))
+      (native-inputs
+       `(("asciidoc" ,asciidoc)))
+      (home-page "https://gitlab.com/esr/open-adventure")
+      (synopsis "Colossal Cave Adventure")
+      (description "The original Colossal Cave Adventure from 1976 was the
+origin of all text adventures, dungeon-crawl (computer) games, and
+computer-hosted roleplaying games.  This is the last version released by
+Crowther & Woods, its original authors, in 1995.  It has been known as
+\"adventure 2.5\" and \"430-point adventure\".")
+      (license license:bsd-2))))
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 59ce2587ee..84ae1cf2f1 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -11,7 +11,7 @@
 ;;; Copyright © 2015, 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015, 2016, 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
-;;; Copyright © 2015, 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 Rene Saavedra <rennes@openmailbox.org>
 ;;; Copyright © 2016 Jochem Raat <jchmrt@riseup.net>
 ;;; Copyright © 2016, 2017 Kei Kebreau <kei@openmailbox.org>
@@ -5485,6 +5485,7 @@ documents and diagrams, playing media, scanning, and much more.")
                 (uri (git-reference
                       (url "git://git.gnome.org/byzanz")
                       (commit commit)))
+                (file-name (string-append name "-" version "-checkout"))
                 (sha256
                  (base32
                   "1l60myzxf9cav27v5v3nsijlslz9r7ip6d5kiirfpkf9k0w26hz3"))))
diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index 440e7d550f..c2b02789bf 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -410,7 +410,7 @@ and every application benefits from this.")
 (define-public python-gpg
   (package
     (name "python-gpg")
-    (version (package-version gpgme))
+    (version "1.8.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "gpg" version))
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 13c5529f9d..70cae6d871 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -203,7 +203,7 @@ sequential processes (CSP) concurrent programming features added.")
   (package
     (inherit go-1.4)
     (name "go")
-    (version "1.8.1")
+    (version "1.8.3")
     (source
      (origin
        (method url-fetch)
@@ -211,7 +211,7 @@ sequential processes (CSP) concurrent programming features added.")
                            name version ".src.tar.gz"))
        (sha256
         (base32
-         "0mqf8ydxdx1pwmrs8p8wl5y1qrplzxmxzgb6vkghy4l67z0g9nik"))))
+         "19lzv4lqixj3v2gjaff0fdbbmgsq5r8lrfd61z2zvp778wjflpaz"))))
     (arguments
      (substitute-keyword-arguments (package-arguments go-1.4)
        ((#:phases phases)
@@ -257,8 +257,8 @@ sequential processes (CSP) concurrent programming features added.")
                      "\"-Wl,-rpath=" gcclib "\", \"-lgcc_s\", ")))
 
                  ;; Disable failing tests: these tests attempt to access
-                 ;; commands or network resources which are neither available or
-                 ;; necessary for the build to succeed.
+                 ;; commands or network resources which are neither available
+                 ;; nor necessary for the build to succeed.
                  (for-each
                   (match-lambda
                     ((file regex)
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index cc1497cb8d..90a2909ab2 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -54,6 +55,7 @@
   #:use-module (gnu packages image)
   #:use-module (gnu packages jemalloc)
   #:use-module (gnu packages photo)
+  #:use-module (gnu packages pth)
   #:use-module (gnu packages python)
   #:use-module (gnu packages qt)
   #:use-module (gnu packages readline)
@@ -318,6 +320,47 @@ visual effects work for film.")
     (home-page "http://www.openimageio.org")
     (license license:bsd-3)))
 
+(define-public openscenegraph
+  (package
+    (name "openscenegraph")
+    (version "3.4.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://trac.openscenegraph.org/downloads/developer_releases/"
+                           "OpenSceneGraph-" version ".zip"))
+       (sha256
+        (base32
+         "03h4wfqqk7rf3mpz0sa99gy715cwpala7964z2npd8jxfn27swjw"))
+       (patches (search-patches "openscenegraph-ffmpeg3.patch"))
+       (file-name (string-append name "-" version ".zip"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:tests? #f ;; No test target available.
+       #:configure-flags
+       (list (string-append "-DCMAKE_INSTALL_RPATH="
+                            (assoc-ref %outputs "out") "/lib:"
+                            (assoc-ref %outputs "out") "/lib64"))))
+    (native-inputs
+     `(("unzip" ,unzip)))
+    (inputs
+     `(("giflib", giflib)
+       ("jasper", jasper)
+       ("librsvg", librsvg)
+       ("pth", pth)
+       ("qtbase", qtbase)
+       ("ffmpeg", ffmpeg)
+       ("mesa", mesa)))
+    (synopsis "High performance real-time graphics toolkit")
+    (description
+     "The OpenSceneGraph is an open source high performance 3D graphics toolkit,
+used by application developers in fields such as visual simulation, games,
+virtual reality, scientific visualization and modelling.")
+    (home-page "http://www.openscenegraph.org")
+    ;; The 'LICENSE' file explains that the source is licensed under
+    ;; LGPL 2.1, but with 4 exceptions. This version is called OSGPL.
+    (license license:lgpl2.1)))
+
 (define-public rapicorn
   (package
     (name "rapicorn")
diff --git a/gnu/packages/gsasl.scm b/gnu/packages/gsasl.scm
index 17b44d9f4f..727d0f0d52 100644
--- a/gnu/packages/gsasl.scm
+++ b/gnu/packages/gsasl.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,20 +31,21 @@
 
 (define-public libntlm
   (package
-   (name "libntlm")
-   (version "1.3")
-   (source (origin
-            (method url-fetch)
-            (uri (string-append "http://www.nongnu.org/libntlm/releases/libntlm-" version
-                                ".tar.gz"))
-            (sha256 (base32
-                     "101pr110ardcj2di940g6vaqifsaxc44h6hjn81l63dvmkj5a6ga"))))
-   (build-system gnu-build-system)
-   (synopsis "Library that implements NTLM authentication")
-   (description
-    "Libntlm is a library that implements NTLM authentication.")
-   (license license:lgpl2.1+)
-   (home-page "http://www.nongnu.org/libntlm/")))
+    (name "libntlm")
+    (version "1.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.nongnu.org/libntlm/releases/"
+                                  "libntlm-" version ".tar.gz"))
+              (sha256
+               (base32
+                "129532iiip2cjr5h03bgz184v64v27sfm1r70v3ms4yk65gdf5c4"))))
+    (build-system gnu-build-system)
+    (synopsis "Library that implements NTLM authentication")
+    (description
+     "Libntlm is a library that implements NTLM authentication.")
+    (license license:lgpl2.1+)
+    (home-page "http://www.nongnu.org/libntlm/")))
 
 (define-public gss
   (package
diff --git a/gnu/packages/image-processing.scm b/gnu/packages/image-processing.scm
index 1753b926c6..0037fdb26c 100644
--- a/gnu/packages/image-processing.scm
+++ b/gnu/packages/image-processing.scm
@@ -1,6 +1,9 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2014 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -29,6 +32,8 @@
   #:use-module (gnu packages boost)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages documentation)
+  #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gl)
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages graphics)
   #:use-module (gnu packages graphviz)
@@ -37,8 +42,10 @@
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages serialization)
+  #:use-module (gnu packages xiph)
   #:use-module (gnu packages xml)
-  #:use-module (gnu packages vtk))
+  #:use-module (gnu packages xorg))
 
 ;; We use the latest snapshot of this package because the latest release is
 ;; from 2011 and has known vulnerabilities that cannot easily be fixed by
@@ -128,3 +135,60 @@ is built around a plug-in structure that makes it easy to add functionality
 without compromising the original code base and it makes use of a wide variety
 of external libraries that provide additional functionality.")
     (license license:gpl3+)))
+
+(define-public vtk
+  (package
+    (name "vtk")
+    (version "7.1.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.vtk.org/files/release/"
+                                  (version-major+minor version)
+                                  "/VTK-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0yj96z58haan77gzilnqp7xpf8hg5jk11a3jx55p2ksd400s0gjz"))))
+    (build-system cmake-build-system)
+    (arguments
+     '(#:build-type "Release"           ;Build without '-g' to save space.
+       ;; -DVTK_USE_SYSTEM_NETCDF:BOOL=TRUE requires netcdf_cxx
+       #:configure-flags '("-DVTK_USE_SYSTEM_EXPAT:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_FREETYPE:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_HDF5:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_JPEG:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_JSONCPP:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_LIBXML2:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_OGGTHEORA:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_PNG:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_TIFF:BOOL=TRUE"
+                           "-DVTK_USE_SYSTEM_ZLIB:BOOL=TRUE")
+       #:tests? #f))                              ;XXX: no "test" target
+    (inputs
+     `(("libXt" ,libxt)
+       ("xproto" ,xproto)
+       ("libX11" ,libx11)
+       ("libxml2" ,libxml2)
+       ("mesa" ,mesa)
+       ("glu" ,glu)
+       ("expat" ,expat)
+       ("freetype" ,freetype)
+       ("hdf5" ,hdf5)
+       ("jpeg" ,libjpeg)
+       ("jsoncpp" ,jsoncpp)
+       ("libogg" ,libogg)
+       ("libtheora" ,libtheora)
+       ("png" ,libpng)
+       ("tiff" ,libtiff)
+       ("zlib" ,zlib)))
+    (home-page "http://www.vtk.org/")
+    (synopsis "Libraries for 3D computer graphics")
+    (description
+     "The Visualization Toolkit (VTK) is a C++ library for 3D computer graphics,
+image processing and visualization.  It supports a wide variety of
+visualization algorithms including: scalar, vector, tensor, texture, and
+volumetric methods; and advanced modeling techniques such as: implicit
+modeling, polygon reduction, mesh smoothing, cutting, contouring, and Delaunay
+triangulation.  VTK has an extensive information visualization framework, has
+a suite of 3D interaction widgets, supports parallel processing, and
+integrates with various databases on GUI toolkits such as Qt and Tk.")
+    (license license:bsd-3)))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index fe9e457f34..f6337e0fc2 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013, 2015, 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014, 2015 Alex Kost <alezost@gmail.com>
@@ -391,7 +391,7 @@ collection of tools for doing simple manipulations of TIFF images.")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "http://download.osgeo.org/libtiff/tiff-"
+       (uri (string-append "ftp://download.osgeo.org/libtiff/tiff-"
                            version ".tar.gz"))
        (sha256
         (base32
@@ -951,15 +951,15 @@ convert, manipulate, filter and display a wide variety of image formats.")
 (define-public jasper
   (package
     (name "jasper")
-    (version "2.0.12")
+    (version "2.0.13")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://www.ece.uvic.ca/~frodo/jasper"
-                                  "/software/jasper-" version ".tar.gz"))
+              (uri (string-append "https://github.com/mdadams/jasper/archive/"
+                                  "version-" version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1njdbxv7d4anzrd476wjww2qsi96dd8vfnp4hri0srrqxpszl92v"))
-              (patches (search-patches "jasper-CVE-2017-6850.patch"))))
+                "090cyqcvqp4y12nc57gvcbrk3ap1rnnixd4qj90sx0pw3fs1615m"))))
     (build-system cmake-build-system)
     (inputs `(("libjpeg" ,libjpeg)))
     (synopsis "JPEG-2000 library")
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index bde3ebe402..a0ca4528f9 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -46,14 +46,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.8-6")
+    (version "6.9.8-9")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1sxg2wx3nrzbymh5wcqiv1x401nrz95xkrqgk3x446vx8lq7ln6w"))))
+               "0wr6wcmvaw62f6pkgnpqnjmp331wfwmds9wmqzr4zv53s9k1lkzn"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
@@ -163,7 +163,7 @@ script.")
 
 (define-public graphicsmagick
   (let ((changeset "6156b4c2992d855ece6079653b3b93c3229fc4b8") ; fix CVE-2017-6335
-        (revision "2"))
+        (revision "3"))
     (package
       (name "graphicsmagick")
       (version (string-append "1.3.25-" revision "."
@@ -180,7 +180,19 @@ script.")
                 ;;                    "/GraphicsMagick-" version ".tar.xz"))
                 (sha256
                  (base32
-                  "08yfsn8mrqkwpax43vv1crfr55rcf004wwpzsinr5c6m0asqr08b"))))
+                  "08yfsn8mrqkwpax43vv1crfr55rcf004wwpzsinr5c6m0asqr08b"))
+                (modules '((guix build utils)))
+                (snippet
+                  ;; Remove bundled software. This reduces the size of the built
+                  ;; source checkout from 177 MiB to 49 MiB. This should not be
+                  ;; necessary when using the GraphicsMagick release tarball,
+                  ;; because these files are not distributed there.
+                  '(for-each delete-file-recursively '("bzlib" "dcraw" "hp2xx"
+                                                       "jbig" "jp2" "jpeg"
+                                                       "lcms" "libxml" "png"
+                                                       "ralcgm" "tiff" "ttf"
+                                                       "webp" "wmf" "xlib"
+                                                       "zlib")))))
       (build-system gnu-build-system)
       (arguments
        `(#:configure-flags
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index b422a1effe..9a129b8d91 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -640,11 +640,16 @@ the standard javac executable.  The tool runs on JamVM instead of SableVM.")))
                  (base32
                   "1v2rww76ww322mpg3s12a1kkc6gkp31bm9gcxs532h0wq285fiw4"))))
       (arguments
-       `(#:configure-flags
+       `(#:make-flags
+         ;; Ensure that the initial heap size is smaller than the maximum
+         ;; size.  By default only Xmx is set, which can lead to invalid
+         ;; memory settings on some machines with a lot of memory.
+         '("JAVAC_MEM_OPT=-J-Xms512M -J-Xmx768M")
+         #:configure-flags
          (list (string-append "--with-ecj-jar="
                               (assoc-ref %build-inputs "ecj-bootstrap")
                               "/share/java/ecj-bootstrap.jar")
-               (string-append "JAVAC="
+               (string-append "--with-javac="
                               (assoc-ref %build-inputs "ecj-javac-wrapper")
                               "/bin/javac")
                (string-append "JAVA="
diff --git a/gnu/packages/kodi.scm b/gnu/packages/kodi.scm
index cdab7eca03..061d5f1b2e 100644
--- a/gnu/packages/kodi.scm
+++ b/gnu/packages/kodi.scm
@@ -239,8 +239,8 @@ generator library for C++.")
 (define-public kodi
   ;; We package the git version because the current released
   ;; version was cut while the cmake transition was in turmoil.
-  (let ((commit "1a38948ad068870671042bff2d8ac615dca9e5d8")
-        (revision "5"))
+  (let ((commit "f22d62dc3f6e811a538dda9c434e1804abb8b95f")
+        (revision "6"))
   (package
     (name "kodi")
     (version (string-append "18.0_alpha-" revision "-" (string-take commit 7)))
@@ -252,7 +252,7 @@ generator library for C++.")
               (file-name (string-append name "-" version "-checkout"))
               (sha256
                (base32
-                "1apkiicmxb6ncqhznflb8wc4n770jx89asw1drmch7lq7j9m6sns"))
+                "0x8fqvid8b8qra327z615r2ygfkdca2p7wccdj5nfb4i5gy0sr09"))
               (snippet
                '(begin
                   (use-modules (guix build utils))
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 11deb2fd79..2dadc77ee5 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -24,6 +24,7 @@
 ;;; Copyright © 2017 Gábor Boskovits <boskovits@gmail.com>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -47,6 +48,7 @@
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages attr)
   #:use-module (gnu packages autotools)
+  #:use-module (gnu packages backup)
   #:use-module (gnu packages base)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bison)
@@ -377,8 +379,8 @@ It has been modified to remove all non-free binary blobs.")
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.1
-  (make-linux-libre "4.1.39"
-                    "06pb3zpkfkc7pb7yh537vvzn8i9nhqyx58kqxv0wq23b4hhpza7d"
+  (make-linux-libre "4.1.40"
+                    "0ygc5qaxwd4yxyzyq6qya9w111q24xqzxd33x73pmg3hr7asvy4x"
                     %intel-compatible-systems
                     #:configuration-file kernel-config
                     #:patches
@@ -1605,6 +1607,31 @@ up: on the server side there's nothing to do; on the client side mounting the
 file system is as easy as logging into the server with an SSH client.")
     (license license:gpl2+)))
 
+(define-public archivemount
+  (package
+    (name "archivemount")
+    (version "0.8.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://www.cybernoia.de/software/archivemount/"
+                           "archivemount-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1diiw6pnlnrnikn6l5ld92dx59lhrxjlqms8885vwbynsjl5q127"))))
+    (build-system gnu-build-system)
+    (inputs `(("fuse", fuse)
+              ("libarchive", libarchive)))
+    (native-inputs `(("pkg-config", pkg-config)))
+    (home-page "http://www.cybernoia.de/software/archivemount")
+    (synopsis "Tool for mounting archive files with FUSE")
+    (description "archivemount is a FUSE-based file system for Unix variants,
+including Linux.  Its purpose is to mount archives (i.e. tar, tar.gz, etc.) to a
+mount point where it can be read from or written to as with any other file
+system.  This makes accessing the contents of the archive, which may be
+compressed, transparent to other programs, without decompressing them.")
+    (license license:lgpl2.0+)))
+
 (define-public numactl
   (package
     (name "numactl")
@@ -3362,14 +3389,14 @@ the default @code{nsswitch} and the experimental @code{umich_ldap}.")
 (define-public mcelog
   (package
     (name "mcelog")
-    (version "151")
+    (version "152")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://git.kernel.org/cgit/utils/cpu/mce/"
                                   "mcelog.git/snapshot/v" version ".tar.gz"))
               (sha256
                (base32
-                "1cgfdlz51hv2zbph00ylzm8z94gv8wakx7dva1pa4jcl3hnq0dh5"))
+                "0df1kbiw1pl84l6b9g515lpk5a81hmy8r27yakr4hrmi2vwzdfh6"))
               (file-name (string-append name "-" version ".tar.gz"))
               (modules '((guix build utils)))
               (snippet
diff --git a/gnu/packages/lisp.scm b/gnu/packages/lisp.scm
index 64acc75e59..e92ae2ebfe 100644
--- a/gnu/packages/lisp.scm
+++ b/gnu/packages/lisp.scm
@@ -881,6 +881,16 @@ from other CLXes around the net.")
 (define-public ecl-clx
   (sbcl-package->ecl-package sbcl-clx))
 
+(define-public sbcl-cl-ppcre-unicode
+  (package (inherit sbcl-cl-ppcre)
+    (name "sbcl-cl-ppcre-unicode")
+    (arguments
+     `(#:tests? #f ; tests fail with "Component :CL-PPCRE-TEST not found"
+       #:asd-file "cl-ppcre-unicode.asd"))
+    (inputs
+     `(("sbcl-cl-ppcre" ,sbcl-cl-ppcre)
+       ("sbcl-cl-unicode" ,sbcl-cl-unicode)))))
+
 (define-public sbcl-stumpwm
   (package
     (name "sbcl-stumpwm")
@@ -1216,3 +1226,165 @@ multiple inspectors with independent history.")
            (delete 'create-asd-file)
            (delete 'cleanup)
            (delete 'create-symlinks)))))))
+
+(define-public sbcl-parse-js
+  (let ((commit "fbadc6029bec7039602abfc06c73bb52970998f6")
+        (revision "1"))
+    (package
+      (name "sbcl-parse-js")
+      (version (string-append "0.0.0-" revision "." (string-take commit 9)))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "http://marijn.haverbeke.nl/git/parse-js")
+               (commit commit)))
+         (file-name (string-append name "-" commit "-checkout"))
+         (sha256
+          (base32
+           "1wddrnr5kiya5s3gp4cdq6crbfy9fqcz7fr44p81502sj3bvdv39"))))
+      (build-system asdf-build-system/sbcl)
+      (home-page "http://marijnhaverbeke.nl/parse-js/")
+      (synopsis "Parse JavaScript")
+      (description "Parse-js is a Common Lisp package for parsing
+JavaScript (ECMAScript 3).  It has basic support for ECMAScript 5.")
+      (license license:zlib))))
+
+(define-public sbcl-parse-number
+  (package
+    (name "sbcl-parse-number")
+    (version "1.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/sharplispers/parse-number/"
+                           "archive/v" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1k6s4v65ksc1j5i0dprvzfvj213v6nah7i0rgd0726ngfjisj9ir"))))
+    (build-system asdf-build-system/sbcl)
+    (home-page "http://www.cliki.net/PARSE-NUMBER")
+    (synopsis "Parse numbers")
+    (description "@code{parse-number} is a library of functions for parsing
+strings into one of the standard Common Lisp number types without using the
+reader.  @code{parse-number} accepts an arbitrary string and attempts to parse
+the string into one of the standard Common Lisp number types, if possible, or
+else @code{parse-number} signals an error of type @code{invalid-number}.")
+    (license license:bsd-3)))
+
+(define-public sbcl-iterate
+  (package
+    (name "sbcl-iterate")
+    ;; The latest official release (1.4.3) fails to build so we have to take
+    ;; the current darcs tarball from quicklisp.
+    (version "20160825")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://beta.quicklisp.org/archive/iterate/"
+                           "2016-08-25/iterate-"
+                           version "-darcs.tgz"))
+       (sha256
+        (base32
+         "0kvz16gnxnkdz0fy1x8y5yr28nfm7i2qpvix7mgwccdpjmsb4pgm"))))
+    (build-system asdf-build-system/sbcl)
+    (home-page "https://common-lisp.net/project/iterate/")
+    (synopsis "Iteration construct for Common Lisp")
+    (description "@code{iterate} is an iteration construct for Common Lisp.
+It is similar to the @code{CL:LOOP} macro, with these distinguishing marks:
+
+@itemize
+@item it is extensible,
+@item it helps editors like Emacs indent iterate forms by having a more
+  lisp-like syntax, and
+@item it isn't part of the ANSI standard for Common Lisp.
+@end itemize\n")
+    (license license:expat)))
+
+(define-public sbcl-cl-uglify-js
+  ;; There have been many bug fixes since the 2010 release.
+  (let ((commit "429c5e1d844e2f96b44db8fccc92d6e8e28afdd5")
+        (revision "1"))
+    (package
+      (name "sbcl-cl-uglify-js")
+      (version (string-append "0.1-" revision "." (string-take commit 9)))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/mishoo/cl-uglify-js.git")
+               (commit commit)))
+         (sha256
+          (base32
+           "0k39y3c93jgxpr7gwz7w0d8yknn1fdnxrjhd03057lvk5w8js27a"))))
+      (build-system asdf-build-system/sbcl)
+      (inputs
+       `(("sbcl-parse-js" ,sbcl-parse-js)
+         ("sbcl-cl-ppcre" ,sbcl-cl-ppcre)
+         ("sbcl-cl-ppcre-unicode" ,sbcl-cl-ppcre-unicode)
+         ("sbcl-parse-number" ,sbcl-parse-number)
+         ("sbcl-iterate" ,sbcl-iterate)))
+      (home-page "https://github.com/mishoo/cl-uglify-js")
+      (synopsis "JavaScript compressor library for Common Lisp")
+      (description "This is a Common Lisp version of UglifyJS, a JavaScript
+compressor.  It works on data produced by @code{parse-js} to generate a
+@dfn{minified} version of the code.  Currently it can:
+
+@itemize
+@item reduce variable names (usually to single letters)
+@item join consecutive @code{var} statements
+@item resolve simple binary expressions
+@item group most consecutive statements using the ``sequence'' operator (comma)
+@item remove unnecessary blocks
+@item convert @code{IF} expressions in various ways that result in smaller code
+@item remove some unreachable code
+@end itemize\n")
+      (license license:zlib))))
+
+(define-public uglify-js
+  (package
+    (inherit sbcl-cl-uglify-js)
+    (name "uglify-js")
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (let* ((bin    (string-append (assoc-ref %outputs "out") "/bin/"))
+              (script (string-append bin "uglify-js")))
+         (use-modules (guix build utils))
+         (mkdir-p bin)
+         (with-output-to-file script
+           (lambda _
+             (format #t "#!~a/bin/sbcl --script
+ (require :asdf)
+ (push (truename \"~a/lib/sbcl\") asdf:*central-registry*)"
+                     (assoc-ref %build-inputs "sbcl")
+                     (assoc-ref %build-inputs "sbcl-cl-uglify-js"))
+             ;; FIXME: cannot use progn here because otherwise it fails to
+             ;; find cl-uglify-js.
+             (for-each
+              write
+              '(;; Quiet, please!
+                (let ((*standard-output* (make-broadcast-stream))
+                      (*error-output* (make-broadcast-stream)))
+                  (asdf:load-system :cl-uglify-js))
+                (let ((file (cadr *posix-argv*)))
+                  (if file
+                      (format t "~a"
+                              (cl-uglify-js:ast-gen-code
+                               (cl-uglify-js:ast-mangle
+                                (cl-uglify-js:ast-squeeze
+                                 (with-open-file (in file)
+                                                 (parse-js:parse-js in))))
+                               :beautify nil))
+                      (progn
+                       (format *error-output*
+                               "Please provide a JavaScript file.~%")
+                       (sb-ext:exit :code 1))))))))
+         (chmod script #o755)
+         #t)))
+    (inputs
+     `(("sbcl" ,sbcl)
+       ("sbcl-cl-uglify-js" ,sbcl-cl-uglify-js)))
+    (synopsis "JavaScript compressor")))
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index a35221cff9..9cb88fdee0 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -225,14 +225,14 @@ aliasing facilities to work just as they would on normal mail.")
 (define-public mutt
   (package
     (name "mutt")
-    (version "1.8.2")
+    (version "1.8.3")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://bitbucket.org/mutt/mutt/downloads/"
                                  "mutt-" version ".tar.gz"))
              (sha256
               (base32
-               "0dgjjryp1ggbc6ivy9cfz5jl3gnbahb6d6hcwn7c7wk5npqpn18x"))
+               "0hpd896mw630sd6ps60hpka8cg691nvr627n8kmabv7zcxnp90cv"))
              (patches (search-patches "mutt-store-references.patch"))))
     (build-system gnu-build-system)
     (inputs
@@ -265,7 +265,7 @@ operating systems.")
   (package
     (inherit mutt)
     (name "neomutt")
-    (version "20170428")
+    (version "20170602")
     (source
      (origin
        (method url-fetch)
@@ -273,7 +273,7 @@ operating systems.")
                            "/archive/" name "-" version ".tar.gz"))
        (sha256
         (base32
-         "01nkq0lyxcs0pk2i3rvzplg8bi1ga7kcm6hfh6r6w2qjzdm0q466"))))
+         "1kzhkz8bdqbdh5b6pzqb6ikp8d3nsic906b5pkmi6qlaga32yxjk"))))
     (inputs
      `(("cyrus-sasl" ,cyrus-sasl)
        ("gdbm" ,gdbm)
@@ -672,14 +672,14 @@ invoking @command{notifymuch} from the post-new hook.")
 (define-public notmuch
   (package
     (name "notmuch")
-    (version "0.24.1")
+    (version "0.24.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://notmuchmail.org/releases/notmuch-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "18rw0rim6zxhnr2nggial029x4raaxqcgf9klfbdhv89qvi7s4gs"))))
+                "0lfchvapk11qazdgsxj42igp9mpp83zbd0h1jj6r3ifmhikajxma"))))
     (build-system gnu-build-system)
     (arguments
      '(#:make-flags (list "V=1") ; Verbose test output.
@@ -1089,7 +1089,7 @@ facilities for checking incoming mail.")
 (define-public dovecot
   (package
     (name "dovecot")
-    (version "2.2.29.1")
+    (version "2.2.30.1")
     (source
      (origin
        (method url-fetch)
@@ -1097,7 +1097,7 @@ facilities for checking incoming mail.")
                            (version-major+minor version) "/"
                            name "-" version ".tar.gz"))
        (sha256 (base32
-                "127kn3fgmahw9fvgz2w3zaghq98ip4j8640wqa3rw7mrgvxrzync"))))
+                "1943n0b9zcwvymslai9qmdmnfy47zdnqjwkql586imycyx4xnjch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/mes.scm b/gnu/packages/mes.scm
index 1e233a852d..e711148c7c 100644
--- a/gnu/packages/mes.scm
+++ b/gnu/packages/mes.scm
@@ -34,14 +34,14 @@
 (define-public nyacc
   (package
     (name "nyacc")
-    (version "0.78.3")
+    (version "0.79.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://savannah/nyacc/"
                                   name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0xrnl2hl9rpl50n8cihvclcd951zj640fj5kpi3d6ihwcqjcdi0a"))))
+                "14rhr9nv1022r7m94agb3299y0k093aq1ps22zgii3aa7cf9h1w4"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("guile" ,guile-2.2)))
@@ -54,10 +54,10 @@ extensive examples, including parsers for the Javascript and C99 languages.")
     (license (list gpl3+ lgpl3+))))
 
 (define-public mes
-  (let ((commit "d4420bbcc9f994e2cce430cf156f383dc4092bca")
+  (let ((commit "7fdca75d2188b28df806b34ec92627d57aafa9ae")
         (revision "0")
         (triplet "i686-unknown-linux-gnu")
-        (version "0.6"))
+        (version "0.7"))
     (package
       (name "mes")
       (version (string-append version "-" revision "." (string-take commit 7)))
@@ -68,7 +68,7 @@ extensive examples, including parsers for the Javascript and C99 languages.")
                       (commit commit)))
                 (file-name (string-append name "-" version))
                 (sha256
-                 (base32 "0qqywk3siyhf08v7xac08lqldklrqfndlp495wgy6ii9fn93197k"))))
+                 (base32 "0fvzr1ai2rmi46zdi5b2bdjb6s8ip78mkmsk02yxl46rajmp2pb1"))))
       (build-system gnu-build-system)
       (supported-systems '("i686-linux" "x86_64-linux"))
       (propagated-inputs
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index 94152226da..1e22b70329 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -13,6 +13,7 @@
 ;;; Copyright © 2016 Benz Schenk <benz.schenk@uzh.ch>
 ;;; Copyright © 2016, 2017 Pjotr Prins <pjotr.guix@thebird.nl>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1184,3 +1185,54 @@ enabled due to license conflicts between the BSD advertising clause and the GPL.
     ;; others under a 4-clause BSD license. Refer to the files in the source
     ;; distribution for clarification.
     (license (list license:bsd-3 license:bsd-4))))
+
+(define-public spiped
+  (package
+    (name "spiped")
+    (version "1.6.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://www.tarsnap.com/spiped/spiped-"
+                                  version ".tgz"))
+              (sha256
+               (base32
+                "1r51rdcl7nib1yv3yvgd5alwlkkwmr387brqavaklb0p2bwzixz6"))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:test-target "test"
+       #:make-flags (let* ((out (assoc-ref %outputs "out"))
+                           (bindir (string-append out "/bin"))
+                           (man1dir (string-append out "/share/man/man1")))
+                      (list "CC=gcc" ; It tries to invoke `c99`.
+                            (string-append "BINDIR=" bindir)
+                            (string-append "MAN1DIR=" man1dir)))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-command-invocations
+           (lambda _
+             (substitute* '("Makefile"
+                            "libcperciva/cpusupport/Build/cpusupport.sh"
+                            "libcperciva/POSIX/posix-cflags.sh"
+                            "libcperciva/POSIX/posix-l.sh")
+               (("command -p") ""))
+             #t))
+         (delete 'configure) ; No ./configure script.
+         (add-after 'install 'install-more-docs
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref %outputs "out"))
+                    (misc (string-append out "/share/doc/spiped")))
+               (install-file "DESIGN.md" misc)
+               #t))))))
+    (native-inputs
+     `(("procps" ,procps))) ; `ps` is used by the test suite.
+    (inputs
+     `(("openssl" ,openssl)))
+    (home-page "https://www.tarsnap.com/spiped.html")
+    (synopsis "Create secure pipes between sockets")
+    (description "Spiped (pronounced \"ess-pipe-dee\") is a utility for creating
+symmetrically encrypted and authenticated pipes between socket addresses, so
+that one may connect to one address (e.g., a UNIX socket on localhost) and
+transparently have a connection established to another address (e.g., a UNIX
+socket on a different system).  This is similar to 'ssh -L' functionality, but
+does not use SSH and requires a pre-shared symmetric key.")
+    (license license:bsd-2)))
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index 987719492f..24bf603c44 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -31,6 +31,7 @@
   #:use-module (gnu packages linux)
   #:use-module (gnu packages python)
   #:use-module (gnu packages tls)
+  #:use-module (gnu packages)
   #:use-module ((guix licenses) #:select (openldap2.8 lgpl2.1+))
   #:use-module (guix packages)
   #:use-module (guix download)
@@ -39,6 +40,7 @@
 (define-public openldap
   (package
    (name "openldap")
+   (replacement openldap/fixed)
    (version "2.4.44")
    (source (origin
             (method url-fetch)
@@ -79,6 +81,14 @@
    (license openldap2.8)
    (home-page "http://www.openldap.org/")))
 
+(define openldap/fixed
+  (package
+    (inherit openldap)
+    (source
+      (origin
+        (inherit (package-source openldap))
+        (patches (search-patches "openldap-CVE-2017-9287.patch"))))))
+
 (define-public nss-pam-ldapd
   (package
     (name "nss-pam-ldapd")
diff --git a/gnu/packages/patches/jasper-CVE-2017-6850.patch b/gnu/packages/patches/jasper-CVE-2017-6850.patch
deleted file mode 100644
index 07672762a1..0000000000
--- a/gnu/packages/patches/jasper-CVE-2017-6850.patch
+++ /dev/null
@@ -1,284 +0,0 @@
-This patch is from upstream and should be fixed included in the next release
-
-From e96fc4fdd525fa0ede28074a7e2b1caf94b58b0d Mon Sep 17 00:00:00 2001
-From: Michael Adams <mdadams@ece.uvic.ca>
-Date: Sat, 4 Mar 2017 14:43:24 -0800
-Subject: [PATCH] Fixed bugs due to uninitialized data in the JP2 decoder.
- Also, added some comments marking I/O stream interfaces that probably need to
- be changed (in the long term) to fix integer overflow problems.
-
----
- src/libjasper/base/jas_stream.c | 18 +++++++++++++++++
- src/libjasper/jp2/jp2_cod.c     | 44 ++++++++++++++++++++++++++++-------------
- 2 files changed, 48 insertions(+), 14 deletions(-)
-
-diff --git a/src/libjasper/base/jas_stream.c b/src/libjasper/base/jas_stream.c
-index 327ee57..d70408f 100644
---- a/src/libjasper/base/jas_stream.c
-+++ b/src/libjasper/base/jas_stream.c
-@@ -664,6 +664,7 @@ int jas_stream_ungetc(jas_stream_t *stream, int c)
- 	return 0;
- }
- 
-+/* FIXME integral type */
- int jas_stream_read(jas_stream_t *stream, void *buf, int cnt)
- {
- 	int n;
-@@ -690,6 +691,7 @@ int jas_stream_read(jas_stream_t *stream, void *buf, int cnt)
- 	return n;
- }
- 
-+/* FIXME integral type */
- int jas_stream_write(jas_stream_t *stream, const void *buf, int cnt)
- {
- 	int n;
-@@ -742,6 +744,7 @@ int jas_stream_puts(jas_stream_t *stream, const char *s)
- 	return 0;
- }
- 
-+/* FIXME integral type */
- char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize)
- {
- 	int c;
-@@ -765,6 +768,7 @@ char *jas_stream_gets(jas_stream_t *stream, char *buf, int bufsize)
- 	return buf;
- }
- 
-+/* FIXME integral type */
- int jas_stream_gobble(jas_stream_t *stream, int n)
- {
- 	int m;
-@@ -783,6 +787,7 @@ int jas_stream_gobble(jas_stream_t *stream, int n)
- 	return n;
- }
- 
-+/* FIXME integral type */
- int jas_stream_pad(jas_stream_t *stream, int n, int c)
- {
- 	int m;
-@@ -885,6 +890,7 @@ long jas_stream_tell(jas_stream_t *stream)
- * Buffer initialization code.
- \******************************************************************************/
- 
-+/* FIXME integral type */
- static void jas_stream_initbuf(jas_stream_t *stream, int bufmode, char *buf,
-   int bufsize)
- {
-@@ -1060,6 +1066,7 @@ static int jas_strtoopenmode(const char *s)
- 	return openmode;
- }
- 
-+/* FIXME integral type */
- int jas_stream_copy(jas_stream_t *out, jas_stream_t *in, int n)
- {
- 	int all;
-@@ -1085,6 +1092,7 @@ int jas_stream_copy(jas_stream_t *out, jas_stream_t *in, int n)
- 	return 0;
- }
- 
-+/* FIXME integral type */
- long jas_stream_setrwcount(jas_stream_t *stream, long rwcnt)
- {
- 	int old;
-@@ -1094,6 +1102,7 @@ long jas_stream_setrwcount(jas_stream_t *stream, long rwcnt)
- 	return old;
- }
- 
-+/* FIXME integral type */
- int jas_stream_display(jas_stream_t *stream, FILE *fp, int n)
- {
- 	unsigned char buf[16];
-@@ -1168,6 +1177,7 @@ long jas_stream_length(jas_stream_t *stream)
- * Memory stream object.
- \******************************************************************************/
- 
-+/* FIXME integral type */
- static int mem_read(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	ssize_t n;
-@@ -1209,6 +1219,7 @@ static int mem_resize(jas_stream_memobj_t *m, size_t bufsize)
- 	return 0;
- }
- 
-+/* FIXME integral type */
- static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	size_t n;
-@@ -1264,6 +1275,7 @@ static int mem_write(jas_stream_obj_t *obj, char *buf, int cnt)
- 	return ret;
- }
- 
-+/* FIXME integral type */
- static long mem_seek(jas_stream_obj_t *obj, long offset, int origin)
- {
- 	jas_stream_memobj_t *m = (jas_stream_memobj_t *)obj;
-@@ -1310,6 +1322,7 @@ static int mem_close(jas_stream_obj_t *obj)
- * File stream object.
- \******************************************************************************/
- 
-+/* FIXME integral type */
- static int file_read(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	jas_stream_fileobj_t *fileobj;
-@@ -1318,6 +1331,7 @@ static int file_read(jas_stream_obj_t *obj, char *buf, int cnt)
- 	return read(fileobj->fd, buf, cnt);
- }
- 
-+/* FIXME integral type */
- static int file_write(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	jas_stream_fileobj_t *fileobj;
-@@ -1326,6 +1340,7 @@ static int file_write(jas_stream_obj_t *obj, char *buf, int cnt)
- 	return write(fileobj->fd, buf, cnt);
- }
- 
-+/* FIXME integral type */
- static long file_seek(jas_stream_obj_t *obj, long offset, int origin)
- {
- 	jas_stream_fileobj_t *fileobj;
-@@ -1352,6 +1367,7 @@ static int file_close(jas_stream_obj_t *obj)
- * Stdio file stream object.
- \******************************************************************************/
- 
-+/* FIXME integral type */
- static int sfile_read(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	FILE *fp;
-@@ -1367,6 +1383,7 @@ static int sfile_read(jas_stream_obj_t *obj, char *buf, int cnt)
- 	return result;
- }
- 
-+/* FIXME integral type */
- static int sfile_write(jas_stream_obj_t *obj, char *buf, int cnt)
- {
- 	FILE *fp;
-@@ -1377,6 +1394,7 @@ static int sfile_write(jas_stream_obj_t *obj, char *buf, int cnt)
- 	return (n != JAS_CAST(size_t, cnt)) ? (-1) : cnt;
- }
- 
-+/* FIXME integral type */
- static long sfile_seek(jas_stream_obj_t *obj, long offset, int origin)
- {
- 	FILE *fp;
-diff --git a/src/libjasper/jp2/jp2_cod.c b/src/libjasper/jp2/jp2_cod.c
-index 7f3608a..8d98a2c 100644
---- a/src/libjasper/jp2/jp2_cod.c
-+++ b/src/libjasper/jp2/jp2_cod.c
-@@ -183,15 +183,28 @@ jp2_boxinfo_t jp2_boxinfo_unk = {
- * Box constructor.
- \******************************************************************************/
- 
--jp2_box_t *jp2_box_create(int type)
-+jp2_box_t *jp2_box_create0()
- {
- 	jp2_box_t *box;
--	jp2_boxinfo_t *boxinfo;
--
- 	if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
- 		return 0;
- 	}
- 	memset(box, 0, sizeof(jp2_box_t));
-+	box->type = 0;
-+	box->len = 0;
-+	// Mark the box data as never having been constructed
-+	// so that we will not errantly attempt to destroy it later.
-+	box->ops = &jp2_boxinfo_unk.ops;
-+	return box;
-+}
-+
-+jp2_box_t *jp2_box_create(int type)
-+{
-+	jp2_box_t *box;
-+	jp2_boxinfo_t *boxinfo;
-+	if (!(box = jp2_box_create0())) {
-+		return 0;
-+	}
- 	box->type = type;
- 	box->len = 0;
- 	if (!(boxinfo = jp2_boxinfolookup(type))) {
-@@ -248,14 +261,9 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
- 	box = 0;
- 	tmpstream = 0;
- 
--	if (!(box = jas_malloc(sizeof(jp2_box_t)))) {
-+	if (!(box = jp2_box_create0())) {
- 		goto error;
- 	}
--
--	// Mark the box data as never having been constructed
--	// so that we will not errantly attempt to destroy it later.
--	box->ops = &jp2_boxinfo_unk.ops;
--
- 	if (jp2_getuint32(in, &len) || jp2_getuint32(in, &box->type)) {
- 		goto error;
- 	}
-@@ -263,10 +271,12 @@ jp2_box_t *jp2_box_get(jas_stream_t *in)
- 	box->info = boxinfo;
- 	box->len = len;
- 	JAS_DBGLOG(10, (
--	  "preliminary processing of JP2 box: type=%c%s%c (0x%08x); length=%d\n",
-+	  "preliminary processing of JP2 box: "
-+	  "type=%c%s%c (0x%08x); length=%"PRIuFAST32"\n",
- 	  '"', boxinfo->name, '"', box->type, box->len
- 	  ));
- 	if (box->len == 1) {
-+		JAS_DBGLOG(10, ("big length\n"));
- 		if (jp2_getuint64(in, &extlen)) {
- 			goto error;
- 		}
-@@ -382,6 +392,7 @@ static int jp2_bpcc_getdata(jp2_box_t *box, jas_stream_t *in)
- {
- 	jp2_bpcc_t *bpcc = &box->data.bpcc;
- 	unsigned int i;
-+	bpcc->bpcs = 0;
- 	bpcc->numcmpts = box->datalen;
- 	if (!(bpcc->bpcs = jas_alloc2(bpcc->numcmpts, sizeof(uint_fast8_t)))) {
- 		return -1;
-@@ -462,6 +473,7 @@ static int jp2_cdef_getdata(jp2_box_t *box, jas_stream_t *in)
- 	jp2_cdef_t *cdef = &box->data.cdef;
- 	jp2_cdefchan_t *chan;
- 	unsigned int channo;
-+	cdef->ents = 0;
- 	if (jp2_getuint16(in, &cdef->numchans)) {
- 		return -1;
- 	}
-@@ -518,7 +530,9 @@ int jp2_box_put(jp2_box_t *box, jas_stream_t *out)
- 	}
- 
- 	if (dataflag) {
--		if (jas_stream_copy(out, tmpstream, box->len - JP2_BOX_HDRLEN(false))) {
-+		if (jas_stream_copy(out, tmpstream, box->len -
-+		  JP2_BOX_HDRLEN(false))) {
-+			jas_eprintf("cannot copy box data\n");
- 			goto error;
- 		}
- 		jas_stream_close(tmpstream);
-@@ -777,6 +791,7 @@ static int jp2_cmap_getdata(jp2_box_t *box, jas_stream_t *in)
- 	jp2_cmap_t *cmap = &box->data.cmap;
- 	jp2_cmapent_t *ent;
- 	unsigned int i;
-+	cmap->ents = 0;
- 
- 	cmap->numchans = (box->datalen) / 4;
- 	if (!(cmap->ents = jas_alloc2(cmap->numchans, sizeof(jp2_cmapent_t)))) {
-@@ -835,6 +850,7 @@ static int jp2_pclr_getdata(jp2_box_t *box, jas_stream_t *in)
- 	int_fast32_t x;
- 
- 	pclr->lutdata = 0;
-+	pclr->bpc = 0;
- 
- 	if (jp2_getuint16(in, &pclr->numlutents) ||
- 	  jp2_getuint8(in, &pclr->numchans)) {
-@@ -869,9 +885,9 @@ static int jp2_pclr_putdata(jp2_box_t *box, jas_stream_t *out)
- #if 0
- 	jp2_pclr_t *pclr = &box->data.pclr;
- #endif
--/* Eliminate warning about unused variable. */
--box = 0;
--out = 0;
-+	/* Eliminate warning about unused variable. */
-+	box = 0;
-+	out = 0;
- 	return -1;
- }
- 
diff --git a/gnu/packages/patches/libgit2-0.25.1-mtime-0.patch b/gnu/packages/patches/libgit2-0.25.1-mtime-0.patch
new file mode 100644
index 0000000000..a6fdb50fff
--- /dev/null
+++ b/gnu/packages/patches/libgit2-0.25.1-mtime-0.patch
@@ -0,0 +1,14 @@
+The Clar test framework has a bug whereby it skips the parsing phase
+on files with mtime=0.
+
+Reported upstream at <https://github.com/vmg/clar/pull/78>.
+
+diff --git a/tests/generate.py b/tests/generate.py
+index b639c8f..111ca41 100644
+--- a/tests/generate.py
++++ b/tests/generate.py
+@@ -63,3 +63,3 @@ class Module(object):
+ 
+-        self.mtime = 0
++        self.mtime = None # Guix sets all file mtimes to '0'
+         self.enabled = True
diff --git a/gnu/packages/patches/libssh-hostname-parser-bug.patch b/gnu/packages/patches/libssh-hostname-parser-bug.patch
new file mode 100644
index 0000000000..69f46cbdd6
--- /dev/null
+++ b/gnu/packages/patches/libssh-hostname-parser-bug.patch
@@ -0,0 +1,31 @@
+Fix "Hostname" parsing in OpenSSH config files, as reported
+at <https://red.libssh.org/issues/260>.
+
+From: Niels Ole Salscheider <niels_ole@salscheider-online.de>
+Date: Mon, 8 May 2017 17:36:13 +0200
+Subject: [PATCH] Fix reading of the first parameter
+
+This is a fixup for 7b8b5eb4eac314a3a29be812bef0264c6611f6e7.
+Previously, it would return as long as the parameter was _not_ seen
+before. It also did not handle the case for the unsupported opcode (-1)
+which would cause a segfault when accessing the "seen" array.
+---
+ src/config.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/config.c b/src/config.c
+index 7c03b27..238a655 100644
+--- a/src/config.c
++++ b/src/config.c
+@@ -218,8 +218,9 @@ static int ssh_config_parse_line(ssh_session session, const char *line,
+   }
+ 
+   opcode = ssh_config_get_opcode(keyword);
+-  if (*parsing == 1 && opcode != SOC_HOST) {
+-      if (seen[opcode] == 0) {
++  if (*parsing == 1 && opcode != SOC_HOST &&
++      opcode > SOC_UNSUPPORTED && opcode < SOC_END) {
++      if (seen[opcode] == 1) {
+           return 0;
+       }
+       seen[opcode] = 1;
diff --git a/gnu/packages/patches/openldap-CVE-2017-9287.patch b/gnu/packages/patches/openldap-CVE-2017-9287.patch
new file mode 100644
index 0000000000..5ca2a60c60
--- /dev/null
+++ b/gnu/packages/patches/openldap-CVE-2017-9287.patch
@@ -0,0 +1,37 @@
+Fix CVE-2017-9287:
+
+https://www.openldap.org/its/?findid=8655
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9287
+
+Patch copied from upstream source repository:
+
+https://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e
+
+From 0cee1ffb6021b1aae3fcc9581699da1c85a6dd6e Mon Sep 17 00:00:00 2001
+From: Ryan Tandy <ryan@nardis.ca>
+Date: Wed, 17 May 2017 20:07:39 -0700
+Subject: [PATCH] ITS#8655 fix double free on paged search with pagesize 0
+
+Fixes a double free when a search includes the Paged Results control
+with a page size of 0 and the search base matches the filter.
+---
+ servers/slapd/back-mdb/search.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/servers/slapd/back-mdb/search.c b/servers/slapd/back-mdb/search.c
+index 301d1a498c..43442aa242 100644
+--- a/servers/slapd/back-mdb/search.c
++++ b/servers/slapd/back-mdb/search.c
+@@ -1066,7 +1066,8 @@ notfound:
+ 			/* check size limit */
+ 			if ( get_pagedresults(op) > SLAP_CONTROL_IGNORED ) {
+ 				if ( rs->sr_nentries >= ((PagedResultsState *)op->o_pagedresults_state)->ps_size ) {
+-					mdb_entry_return( op, e );
++					if (e != base)
++						mdb_entry_return( op, e );
+ 					e = NULL;
+ 					send_paged_response( op, rs, &lastid, tentries );
+ 					goto done;
+-- 
+2.13.0
+
diff --git a/gnu/packages/patches/openscenegraph-ffmpeg3.patch b/gnu/packages/patches/openscenegraph-ffmpeg3.patch
new file mode 100644
index 0000000000..02c04a5583
--- /dev/null
+++ b/gnu/packages/patches/openscenegraph-ffmpeg3.patch
@@ -0,0 +1,156 @@
+Description: Replace deprecated FFmpeg API
+Author: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
+See <http://forum.openscenegraph.org/viewtopic.php?t=15832>.
+--- a/src/osgPlugins/ffmpeg/FFmpegDecoderVideo.cpp
++++ b/src/osgPlugins/ffmpeg/FFmpegDecoderVideo.cpp
+@@ -71,7 +71,7 @@ void FFmpegDecoderVideo::open(AVStream *
+     findAspectRatio();
+ 
+     // Find out whether we support Alpha channel
+-    m_alpha_channel = (m_context->pix_fmt == PIX_FMT_YUVA420P);
++    m_alpha_channel = (m_context->pix_fmt == AV_PIX_FMT_YUVA420P);
+ 
+     // Find out the framerate
+     m_frame_rate = av_q2d(stream->avg_frame_rate);
+@@ -91,20 +91,19 @@ void FFmpegDecoderVideo::open(AVStream *
+         throw std::runtime_error("avcodec_open() failed");
+ 
+     // Allocate video frame
+-    m_frame.reset(avcodec_alloc_frame());
++    m_frame.reset(av_frame_alloc());
+ 
+     // Allocate converted RGB frame
+-    m_frame_rgba.reset(avcodec_alloc_frame());
+-    m_buffer_rgba[0].resize(avpicture_get_size(PIX_FMT_RGB24, width(), height()));
++    m_frame_rgba.reset(av_frame_alloc());
++    m_buffer_rgba[0].resize(avpicture_get_size(AV_PIX_FMT_RGB24, width(), height()));
+     m_buffer_rgba[1].resize(m_buffer_rgba[0].size());
+ 
+     // Assign appropriate parts of the buffer to image planes in m_frame_rgba
+-    avpicture_fill((AVPicture *) (m_frame_rgba).get(), &(m_buffer_rgba[0])[0], PIX_FMT_RGB24, width(), height());
++    avpicture_fill((AVPicture *) (m_frame_rgba).get(), &(m_buffer_rgba[0])[0], AV_PIX_FMT_RGB24, width(), height());
+ 
+     // Override get_buffer()/release_buffer() from codec context in order to retrieve the PTS of each frame.
+     m_context->opaque = this;
+-    m_context->get_buffer = getBuffer;
+-    m_context->release_buffer = releaseBuffer;
++    m_context->get_buffer2 = getBuffer;
+ }
+ 
+ 
+@@ -263,8 +262,8 @@ int FFmpegDecoderVideo::convert(AVPictur
+ #ifdef USE_SWSCALE
+     if (m_swscale_ctx==0)
+     {
+-        m_swscale_ctx = sws_getContext(src_width, src_height, (PixelFormat) src_pix_fmt,
+-                                      src_width, src_height, (PixelFormat) dst_pix_fmt,
++        m_swscale_ctx = sws_getContext(src_width, src_height, (AVPixelFormat) src_pix_fmt,
++                                      src_width, src_height, (AVPixelFormat) dst_pix_fmt,
+                                       /*SWS_BILINEAR*/ SWS_BICUBIC, NULL, NULL, NULL);
+     }
+ 
+@@ -311,14 +310,14 @@ void FFmpegDecoderVideo::publishFrame(co
+     AVPicture * const dst = (AVPicture *) m_frame_rgba.get();
+ 
+     // Assign appropriate parts of the buffer to image planes in m_frame_rgba
+-    avpicture_fill((AVPicture *) (m_frame_rgba).get(), &(m_buffer_rgba[m_writeBuffer])[0], PIX_FMT_RGB24, width(), height());
++    avpicture_fill((AVPicture *) (m_frame_rgba).get(), &(m_buffer_rgba[m_writeBuffer])[0], AV_PIX_FMT_RGB24, width(), height());
+ 
+     // Convert YUVA420p (i.e. YUV420p plus alpha channel) using our own routine
+ 
+-    if (m_context->pix_fmt == PIX_FMT_YUVA420P)
++    if (m_context->pix_fmt == AV_PIX_FMT_YUVA420P)
+         yuva420pToRgba(dst, src, width(), height());
+     else
+-        convert(dst, PIX_FMT_RGB24, src, m_context->pix_fmt, width(), height());
++        convert(dst, AV_PIX_FMT_RGB24, src, m_context->pix_fmt, width(), height());
+ 
+     // Wait 'delay' seconds before publishing the picture.
+     int i_delay = static_cast<int>(delay * 1000000 + 0.5);
+@@ -345,7 +344,7 @@ void FFmpegDecoderVideo::publishFrame(co
+ 
+ void FFmpegDecoderVideo::yuva420pToRgba(AVPicture * const dst, AVPicture * const src, int width, int height)
+ {
+-    convert(dst, PIX_FMT_RGB24, src, m_context->pix_fmt, width, height);
++    convert(dst, AV_PIX_FMT_RGB24, src, m_context->pix_fmt, width, height);
+ 
+     const size_t bpp = 4;
+ 
+@@ -363,31 +362,28 @@ void FFmpegDecoderVideo::yuva420pToRgba(
+     }
+ }
+ 
+-
+-
+-int FFmpegDecoderVideo::getBuffer(AVCodecContext * const context, AVFrame * const picture)
++int FFmpegDecoderVideo::getBuffer(AVCodecContext * const context, AVFrame * const picture, int flags)
+ {
++    AVBufferRef *ref;
+     const FFmpegDecoderVideo * const this_ = reinterpret_cast<const FFmpegDecoderVideo*>(context->opaque);
+ 
+-    const int result = avcodec_default_get_buffer(context, picture);
++    const int result = avcodec_default_get_buffer2(context, picture, flags);
+     int64_t * p_pts = reinterpret_cast<int64_t*>( av_malloc(sizeof(int64_t)) );
+ 
+     *p_pts = this_->m_packet_pts;
+     picture->opaque = p_pts;
+ 
++    ref = av_buffer_create((uint8_t *)picture->opaque, sizeof(int64_t), FFmpegDecoderVideo::freeBuffer, picture->buf[0], flags);
++    picture->buf[0] = ref;
++
+     return result;
+ }
+ 
+-
+-
+-void FFmpegDecoderVideo::releaseBuffer(AVCodecContext * const context, AVFrame * const picture)
++void FFmpegDecoderVideo::freeBuffer(void *opaque, uint8_t *data)
+ {
+-    if (picture != 0)
+-        av_freep(&picture->opaque);
+-
+-    avcodec_default_release_buffer(context, picture);
++    AVBufferRef *ref = (AVBufferRef *)opaque;
++    av_buffer_unref(&ref);
++    av_free(data);
+ }
+ 
+-
+-
+ } // namespace osgFFmpeg
+--- a/src/osgPlugins/ffmpeg/FFmpegDecoderVideo.hpp
++++ b/src/osgPlugins/ffmpeg/FFmpegDecoderVideo.hpp
+@@ -94,8 +94,8 @@ private:
+                 int src_pix_fmt, int src_width, int src_height);
+ 
+ 
+-    static int getBuffer(AVCodecContext * context, AVFrame * picture);
+-    static void releaseBuffer(AVCodecContext * context, AVFrame * picture);
++    static int getBuffer(AVCodecContext * context, AVFrame * picture, int flags);
++    static void freeBuffer(void * opaque, uint8_t *data);
+ 
+     PacketQueue &           m_packets;
+     FFmpegClocks &          m_clocks;
+--- a/src/osgPlugins/ffmpeg/FFmpegParameters.cpp
++++ b/src/osgPlugins/ffmpeg/FFmpegParameters.cpp
+@@ -19,7 +19,7 @@ extern "C"
+     #include <libavutil/pixdesc.h>
+ }
+ 
+-inline PixelFormat osg_av_get_pix_fmt(const char *name) { return av_get_pix_fmt(name); }
++inline AVPixelFormat osg_av_get_pix_fmt(const char *name) { return av_get_pix_fmt(name); }
+ 
+ 
+ namespace osgFFmpeg {
+--- a/src/osgPlugins/ffmpeg/FFmpegDecoderAudio.cpp	2016-02-18 21:25:39.627923629 +0000
++++ b/src/osgPlugins/ffmpeg/FFmpegDecoderAudio.cpp	2016-02-18 21:26:17.071140100 +0000
+@@ -227,8 +227,7 @@
+         if (avcodec_open2(m_context, p_codec, NULL) < 0)
+             throw std::runtime_error("avcodec_open() failed");
+ 
+-        m_context->get_buffer = avcodec_default_get_buffer;
+-        m_context->release_buffer = avcodec_default_release_buffer;
++        m_context->get_buffer2 = avcodec_default_get_buffer2;
+ 
+     }
+ 
diff --git a/gnu/packages/patches/qemu-CVE-2017-8112.patch b/gnu/packages/patches/qemu-CVE-2017-8112.patch
new file mode 100644
index 0000000000..88b33aa2f0
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-8112.patch
@@ -0,0 +1,41 @@
+Fix CVE-2017-8112:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8112
+
+Patch copied from upstream source repository:
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=f68826989cd4d1217797251339579c57b3c0934e
+
+From f68826989cd4d1217797251339579c57b3c0934e Mon Sep 17 00:00:00 2001
+From: P J P <ppandit@redhat.com>
+Date: Tue, 25 Apr 2017 18:36:23 +0530
+Subject: [PATCH] vmw_pvscsi: check message ring page count at initialisation
+
+A guest could set the message ring page count to zero, resulting in
+infinite loop. Add check to avoid it.
+
+Reported-by: YY Z <bigbird475958471@gmail.com>
+Signed-off-by: P J P <ppandit@redhat.com>
+Message-Id: <20170425130623.3649-1-ppandit@redhat.com>
+Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/scsi/vmw_pvscsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
+index 75575461e2..4a106da856 100644
+--- a/hw/scsi/vmw_pvscsi.c
++++ b/hw/scsi/vmw_pvscsi.c
+@@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
+     uint32_t len_log2;
+     uint32_t ring_size;
+ 
+-    if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
++    if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
+         return -1;
+     }
+     ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
+-- 
+2.13.0
+
diff --git a/gnu/packages/patches/qemu-CVE-2017-8309.patch b/gnu/packages/patches/qemu-CVE-2017-8309.patch
new file mode 100644
index 0000000000..dc4b4006b7
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-8309.patch
@@ -0,0 +1,46 @@
+Fix CVE-2017-8309:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8309
+
+Patch copied from upstream source repository:
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=3268a845f41253fb55852a8429c32b50f36f349a
+
+From 3268a845f41253fb55852a8429c32b50f36f349a Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 28 Apr 2017 09:56:12 +0200
+Subject: [PATCH] audio: release capture buffers
+
+AUD_add_capture() allocates two buffers which are never released.
+Add the missing calls to AUD_del_capture().
+
+Impact: Allows vnc clients to exhaust host memory by repeatedly
+starting and stopping audio capture.
+
+Fixes: CVE-2017-8309
+Cc: P J P <ppandit@redhat.com>
+Cc: Huawei PSIRT <PSIRT@huawei.com>
+Reported-by: "Jiangxin (hunter, SCC)" <jiangxin1@huawei.com>
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Reviewed-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-id: 20170428075612.9997-1-kraxel@redhat.com
+---
+ audio/audio.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/audio/audio.c b/audio/audio.c
+index c8898d8422..beafed209b 100644
+--- a/audio/audio.c
++++ b/audio/audio.c
+@@ -2028,6 +2028,8 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
+                     sw = sw1;
+                 }
+                 QLIST_REMOVE (cap, entries);
++                g_free (cap->hw.mix_buf);
++                g_free (cap->buf);
+                 g_free (cap);
+             }
+             return;
+-- 
+2.13.0
+
diff --git a/gnu/packages/patches/qemu-CVE-2017-8379.patch b/gnu/packages/patches/qemu-CVE-2017-8379.patch
new file mode 100644
index 0000000000..200b133d3e
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-8379.patch
@@ -0,0 +1,98 @@
+Fix CVE-2017-8379:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8379
+
+Patch copied from upstream source repository:
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=fa18f36a461984eae50ab957e47ec78dae3c14fc
+
+From fa18f36a461984eae50ab957e47ec78dae3c14fc Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Fri, 28 Apr 2017 10:42:37 +0200
+Subject: [PATCH] input: limit kbd queue depth
+
+Apply a limit to the number of items we accept into the keyboard queue.
+
+Impact: Without this limit vnc clients can exhaust host memory by
+sending keyboard events faster than qemu feeds them to the guest.
+
+Fixes: CVE-2017-8379
+Cc: P J P <ppandit@redhat.com>
+Cc: Huawei PSIRT <PSIRT@huawei.com>
+Reported-by: jiangxin1@huawei.com
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-id: 20170428084237.23960-1-kraxel@redhat.com
+---
+ ui/input.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/ui/input.c b/ui/input.c
+index ed88cda6d6..fb1f404095 100644
+--- a/ui/input.c
++++ b/ui/input.c
+@@ -41,6 +41,8 @@ static QTAILQ_HEAD(QemuInputEventQueueHead, QemuInputEventQueue) kbd_queue =
+     QTAILQ_HEAD_INITIALIZER(kbd_queue);
+ static QEMUTimer *kbd_timer;
+ static uint32_t kbd_default_delay_ms = 10;
++static uint32_t queue_count;
++static uint32_t queue_limit = 1024;
+ 
+ QemuInputHandlerState *qemu_input_handler_register(DeviceState *dev,
+                                                    QemuInputHandler *handler)
+@@ -268,6 +270,7 @@ static void qemu_input_queue_process(void *opaque)
+             break;
+         }
+         QTAILQ_REMOVE(queue, item, node);
++        queue_count--;
+         g_free(item);
+     }
+ }
+@@ -282,6 +285,7 @@ static void qemu_input_queue_delay(struct QemuInputEventQueueHead *queue,
+     item->delay_ms = delay_ms;
+     item->timer = timer;
+     QTAILQ_INSERT_TAIL(queue, item, node);
++    queue_count++;
+ 
+     if (start_timer) {
+         timer_mod(item->timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL)
+@@ -298,6 +302,7 @@ static void qemu_input_queue_event(struct QemuInputEventQueueHead *queue,
+     item->src = src;
+     item->evt = evt;
+     QTAILQ_INSERT_TAIL(queue, item, node);
++    queue_count++;
+ }
+ 
+ static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue)
+@@ -306,6 +311,7 @@ static void qemu_input_queue_sync(struct QemuInputEventQueueHead *queue)
+ 
+     item->type = QEMU_INPUT_QUEUE_SYNC;
+     QTAILQ_INSERT_TAIL(queue, item, node);
++    queue_count++;
+ }
+ 
+ void qemu_input_event_send_impl(QemuConsole *src, InputEvent *evt)
+@@ -381,7 +387,7 @@ void qemu_input_event_send_key(QemuConsole *src, KeyValue *key, bool down)
+         qemu_input_event_send(src, evt);
+         qemu_input_event_sync();
+         qapi_free_InputEvent(evt);
+-    } else {
++    } else if (queue_count < queue_limit) {
+         qemu_input_queue_event(&kbd_queue, src, evt);
+         qemu_input_queue_sync(&kbd_queue);
+     }
+@@ -409,8 +415,10 @@ void qemu_input_event_send_key_delay(uint32_t delay_ms)
+         kbd_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, qemu_input_queue_process,
+                                  &kbd_queue);
+     }
+-    qemu_input_queue_delay(&kbd_queue, kbd_timer,
+-                           delay_ms ? delay_ms : kbd_default_delay_ms);
++    if (queue_count < queue_limit) {
++        qemu_input_queue_delay(&kbd_queue, kbd_timer,
++                               delay_ms ? delay_ms : kbd_default_delay_ms);
++    }
+ }
+ 
+ InputEvent *qemu_input_event_new_btn(InputButton btn, bool down)
+-- 
+2.13.0
+
diff --git a/gnu/packages/patches/qemu-CVE-2017-8380.patch b/gnu/packages/patches/qemu-CVE-2017-8380.patch
new file mode 100644
index 0000000000..65e49fc885
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-8380.patch
@@ -0,0 +1,53 @@
+Fix CVE-2017-8380:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8380
+
+Patch copied from upstream source repository:
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f
+
+From 24dfa9fa2f90a95ac33c7372de4f4f2c8a2c141f Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Mon, 24 Apr 2017 17:36:34 +0530
+Subject: [PATCH] scsi: avoid an off-by-one error in megasas_mmio_write
+
+While reading magic sequence(MFI_SEQ) in megasas_mmio_write,
+an off-by-one error could occur as 's->adp_reset' index is not
+reset after reading the last sequence.
+
+Reported-by: YY Z <bigbird475958471@gmail.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-Id: <20170424120634.12268-1-ppandit@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ hw/scsi/megasas.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
+index 84b8caf901..804122ab05 100644
+--- a/hw/scsi/megasas.c
++++ b/hw/scsi/megasas.c
+@@ -2138,15 +2138,15 @@ static void megasas_mmio_write(void *opaque, hwaddr addr,
+     case MFI_SEQ:
+         trace_megasas_mmio_writel("MFI_SEQ", val);
+         /* Magic sequence to start ADP reset */
+-        if (adp_reset_seq[s->adp_reset] == val) {
+-            s->adp_reset++;
++        if (adp_reset_seq[s->adp_reset++] == val) {
++            if (s->adp_reset == 6) {
++                s->adp_reset = 0;
++                s->diag = MFI_DIAG_WRITE_ENABLE;
++            }
+         } else {
+             s->adp_reset = 0;
+             s->diag = 0;
+         }
+-        if (s->adp_reset == 6) {
+-            s->diag = MFI_DIAG_WRITE_ENABLE;
+-        }
+         break;
+     case MFI_DIAG:
+         trace_megasas_mmio_writel("MFI_DIAG", val);
+-- 
+2.13.0
+
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 3e2141e7f4..19ffe729bf 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -1574,14 +1574,14 @@ existing ones.")
 (define-public scons
   (package
     (name "scons")
-    (version "2.3.4")
+    (version "2.5.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/scons/scons/" version
                                  "/scons-" version ".tar.gz"))
              (sha256
               (base32
-               "0hdlci43wjz8maryj83mz04ir6rwcdrrzpd7cpzvdlzycqhdfmsb"))))
+               "1wji1z9jdkhnmm99apx6fhld9cs52rr56aigniyrcsmlwy52298b"))))
     (build-system python-build-system)
     (arguments
      ;; With Python 3.x, fails to build with a syntax error.
@@ -14926,3 +14926,377 @@ Supported metrics are:
 
 (define-public python2-radon
   (package-with-python2 python-radon))
+
+(define-public python-sure
+  (package
+    (name "python-sure")
+    (version "1.4.6")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "sure" version))
+       (sha256
+        (base32
+         "1iyqsy2d6radi88g1qf0lziy5b39h5cpb3g5jiqyb4xi46ig3x1z"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-mock" ,python-mock)
+       ("python-six" ,python-six)))
+    (native-inputs
+     `(("python-nose" ,python-nose)))
+    (home-page "https://github.com/gabrielfalcao/sure")
+    (synopsis "Automated testing library in python for python")
+    (description
+     "Sure is a python library that leverages a DSL for writing assertions.
+Sure is heavily inspired by @code{RSpec Expectations} and @code{should.js}.")
+    (license license:gpl3+)))
+
+(define-public python2-sure
+  (package-with-python2 python-sure))
+
+(define-public python2-couleur
+  ;; This package does not seem to support python3 at all, hence,
+  ;; only the python2 variant definition is provided.
+  (package
+    (name "python2-couleur")
+    (version "0.6.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "couleur" version))
+       (sha256
+        (base32
+         "1qqaxyqz74wvid0cr119dhcwz0h0if5b5by44zl49pd5z65v58k1"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:python ,python-2))
+    (home-page "https://github.com/gabrielfalcao/couleur")
+    (synopsis
+     "ANSI terminal tool for python, colored shell and other handy fancy features")
+    (description
+     "@code{Couleur} provides python programs a way to use the ANSI features in a unix
+terminal such as coloured output in the shell, overwriting output, indentation, etc.")
+    ;; README.md says ASL2.0, but all source code headers are LGPL3+.
+    ;; https://github.com/gabrielfalcao/couleur/issues/11
+    (license license:lgpl3+)))
+
+(define-public python-misaka
+  (package
+    (name "python-misaka")
+    (version "2.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "misaka" version))
+       (sha256
+        (base32
+         "1yqrq3a5rracirmvk52n28nn6ckdaz897gnigv89a9gmyn87sqw7"))))
+    (build-system python-build-system)
+    (arguments
+     `(;; Line 37 of setup.py calls self.run_command('develop')
+       ;; in the 'check' phase. This command seems to be trying
+       ;; to write to
+       ;; /gnu/store/...-python-<version>/lib/python<version>/site-packages/
+       ;; for which it does not have the permission to write.
+       #:tests? #f))
+    (propagated-inputs
+     `(("python-cffi" ,python-cffi)))
+    (home-page "https://github.com/FSX/misaka")
+    (synopsis "Python binding for Hoedown")
+    (description
+     "@code{Misaka} is a CFFI-based binding for @code{Hoedown}, a fast markdown processing
+library written in C.  It features a fast HTML renderer and functionality to make custom
+renderers (e.g. man pages or LaTeX).")
+    (license license:expat)))
+
+(define-public python2-misaka
+  (package-with-python2 python-misaka))
+
+(define-public python2-steadymark
+  ;; This is forced into being a python2 only variant
+  ;; due to its dependence on couleur that has no support
+  ;; for python3
+  (package
+    (name "python2-steadymark")
+    (version "0.7.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "steadymark" version))
+       (sha256
+        (base32
+         "1640i9g8dycql3cc8j0bky0jkzj0q39blfbp4lsgpkprkfgcdk8v"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-couleur" ,python2-couleur)
+       ("python-sure" ,python2-sure)
+       ("python-misaka" ,python2-misaka)))
+    (arguments
+     `(#:python ,python-2
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'patch-setup-py
+           (lambda _
+             ;; Update requirements from dependency==version
+             ;; to dependency>=version
+             (substitute* "setup.py"
+               (("==") ">="))
+             #t)))))
+    (home-page "https://github.com/gabrielfalcao/steadymark")
+    (synopsis "Markdown-based test runner for python")
+    (description
+     "@code{Steadymark} allows documentation to be written in github-flavoured
+markdown.  The documentation may contain snippets of code surrounded by python
+code blocks and @code{Steadymark} will find these snippets and run them, making
+sure that there are no old malfunctional examples in the documentation examples.")
+    (license license:expat)))
+
+(define-public python-nose-randomly
+  (package
+    (name "python-nose-randomly")
+    (version "1.2.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "nose-randomly" version))
+       (sha256
+        (base32
+         "1cw9dlr1zh3w4i438kin7z0rm8092ki52hayisyc43h9pcplq7rn"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-nose" ,python-nose)
+       ("python-numpy" ,python-numpy)))
+    (home-page "https://github.com/adamchainz/nose-randomly")
+    (synopsis
+     "Nose plugin to randomly order tests and control random.seed")
+    (description
+     "This is a @code{Nose} plugin to randomly order tests which can be quite
+powerful in discovering hidden flaws in the tests themselves, while helping to
+reduce inter-test dependencies.  It also helps in controlling @code{random.seed},
+by resetting it to a repeatable number for each test, enabling the tests to
+create data based on random numbers and yet remain repeatable.")
+    (license license:bsd-3)))
+
+(define-public python2-nose-randomly
+  (package-with-python2 python-nose-randomly))
+
+(define-public python-jsonpointer
+  (package
+    (name "python-jsonpointer")
+    (version "1.10")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "jsonpointer" version))
+       (sha256
+        (base32
+         "1cg0gvgqjysydv6p45v4jywg1jb3v48c7m3cbpi57zgf6nndr9cz"))))
+  (build-system python-build-system)
+  (home-page "https://github.com/stefankoegl/python-json-pointer")
+  (synopsis "Identify specific nodes in a JSON document")
+  (description "@code{jsonpointer} allows you to access specific nodes
+by path in a JSON document (see RFC 6901).")
+  (license license:bsd-3)))
+
+(define-public python2-jsonpointer
+  (package-with-python2 python-jsonpointer))
+
+(define-public python-rfc3987
+  (package
+    (name "python-rfc3987")
+    (version "1.3.7")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "rfc3987" version))
+      (sha256
+       (base32
+        "192pclzs2y0yaywqkrlvd0x73740q310kvqvm6jldhi619mq59wi"))))
+    (build-system python-build-system)
+    (home-page "http://pypi.python.org/pypi/rfc3987")
+    (synopsis "Parsing and validation of URIs (RFC 3986) and IRIs (RFC 3987)")
+    (description "@code{rfc3987} provides routines for parsing and
+validation of URIs (see RFC 3986) and IRIs (see RFC 3987).")
+    (license license:gpl3+)))
+
+(define-public python2-rfc3987
+  (package-with-python2 python-rfc3987))
+
+(define-public python-validate-email
+  (package
+    (name "python-validate-email")
+    (version "1.3")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "validate_email" version))
+      (sha256
+       (base32
+        "1bxffaf5yz2cph8ki55vdvdypbwkvn2xr1firlcy62vqbzf1jivq"))))
+    (build-system python-build-system)
+    (home-page "http://github.com/syrusakbary/validate_email")
+    (synopsis "Verifies if an email address is valid and really exists")
+    (description "@code{validate_email} can be used to verify if an email
+address is valid and really exists.")
+    (license license:lgpl3+)))
+
+(define-public python2-validate-email
+  (package-with-python2 python-validate-email))
+
+(define-public python-flex
+  (package
+    (name "python-flex")
+    (version "6.10.0")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "flex" version))
+      (sha256
+       (base32
+        "00pamnwla3khk8nyla7y28dq9jnh69swd7f4jfsl7sn1izs8n8zk"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-click" ,python-click)
+       ("python-iso8601" ,python-iso8601)
+       ("python-jsonpointer" ,python-jsonpointer)
+       ("python-pyyaml" ,python-pyyaml)
+       ("python-requests" ,python-requests)
+       ("python-rfc3987" ,python-rfc3987)
+       ("python-six" ,python-six)
+       ("python-validate-email" ,python-validate-email)))
+    (home-page "https://github.com/pipermerriam/flex")
+    (synopsis "Validates Swagger schemata")
+    (description "@code{flex} can be used to validate Swagger schemata.")
+    (license license:bsd-3)))
+
+(define-public python2-flex
+  (package-with-python2 python-flex))
+
+(define-public python-marshmallow
+  (package
+    (name "python-marshmallow")
+    (version "3.0.0b2")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "marshmallow" version))
+      (sha256
+       (base32
+        "11bnpvfdbczr74177p295zbkdrax2cahvbj5bqhhlprgz2xxi5d9"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-dateutil" ,python-dateutil)
+       ("python-simplejson" ,python-simplejson)))
+    (native-inputs
+     `(("python-pytest-3.0" ,python-pytest-3.0)
+       ("python-pytz" ,python-pytz)))
+    (home-page "https://github.com/marshmallow-code/marshmallow")
+    (synopsis "Convert complex datatypes to and from native
+Python datatypes.")
+    (description "@code{marshmallow} provides a library for converting
+complex datatypes to and from native Python datatypes.")
+    (license license:expat)))
+
+(define-public python2-marshmallow
+  (package-with-python2 python-marshmallow))
+
+(define-public python-bottle
+  (package
+    (name "python-bottle")
+    (version "0.12.13")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "bottle" version))
+      (sha256
+        (base32
+          "0m9k2a7yxvggc4kw8fsvj381vgsvfcdshg5nzy6vwrxiw2p53drr"))))
+    (build-system python-build-system)
+    (home-page "http://bottlepy.org/")
+    (synopsis "WSGI framework for small web-applications.")
+    (description "@code{python-bottle} is a WSGI framework for small web-applications.")
+    (license license:expat)))
+
+(define-public python2-bottle
+  (package-with-python2 python-bottle))
+
+(define-public python-apispec
+  (package
+    (name "python-apispec")
+    (version "0.22.0")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "apispec" version))
+      (sha256
+        (base32
+          "0y3jxmgp2d24am3hxl40f5rw9abb0r8037sagax3dv64h4n1azwq"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-pyyaml" ,python-pyyaml)))
+    (native-inputs
+     `(("python-pytest-3.0" ,python-pytest-3.0)
+       ("python-flask" ,python-flask)
+       ("python-marshmallow" ,python-marshmallow)
+       ("python-tornado" ,python-tornado)
+       ("python-bottle" ,python-bottle)
+       ("python-mock" ,python-mock)))
+    (home-page "https://github.com/marshmallow-code/apispec")
+    (synopsis "Swagger 2.0 API specification generator")
+    (description "@code{python-apispec} is a pluggable API specification
+generator. Currently supports the OpenAPI specification (f.k.a.
+Swagger 2.0).")
+    (license license:expat)))
+
+(define-public python2-apispec
+  (package-with-python2 python-apispec))
+
+(define-public python-flasgger
+  (package
+    (name "python-flasgger")
+    (version "0.6.3")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://github.com/rochacbruno/flasgger/archive/"
+                            version ".tar.gz"))
+        (file-name (string-append name "-" version ".tar.gz"))
+        (sha256
+          (base32
+            "1gqzlm0rb55fdpsy5ipkganlx9cnpi454fqyycr03jm22zql14ay"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (substitute* "Makefile"
+               (("flake8 flasgger --ignore=F403")
+                "flake8 flasgger --ignore=E731,F403"))
+             (setenv "PYTHONPATH" (string-append (getcwd)
+                                                 ":"
+                                                 (getenv "PYTHONPATH")))
+             (zero? (system* "py.test")))))))
+    (propagated-inputs
+     `(("python-flask" ,python-flask)
+       ("python-pyyaml" ,python-pyyaml)
+       ("python-jsonschema" ,python-jsonschema)
+       ("python-mistune" ,python-mistune)
+       ("python-six" ,python-six)))
+    (native-inputs
+     `(("python-decorator" ,python-decorator)
+       ("python-flake8" ,python-flake8)
+       ("python-flask-restful" ,python-flask-restful)
+       ("python-flex" ,python-flex)
+       ("python-pytest-3.0" ,python-pytest-3.0)
+       ("python-pytest-cov" ,python-pytest-cov)
+       ("python-marshmallow" ,python-marshmallow)
+       ("python-apispec" ,python-apispec)))
+    (home-page "https://github.com/rochacbruno/flasgger/")
+    (synopsis "Extract Swagger specs from your Flask project")
+    (description "@code{python-flasgger} allows extracting Swagger specs
+from your Flask project.  It is a fork of Flask-Swagger.")
+    (license license:expat)))
+
+(define-public python2-flasgger
+  (package-with-python2 python-flasgger))
diff --git a/gnu/packages/qemu.scm b/gnu/packages/qemu.scm
index 0734b6d0f7..31354b25d7 100644
--- a/gnu/packages/qemu.scm
+++ b/gnu/packages/qemu.scm
@@ -74,7 +74,11 @@
              (method url-fetch)
              (uri (string-append "http://wiki.qemu-project.org/download/qemu-"
                                  version ".tar.xz"))
-             (patches (search-patches "qemu-CVE-2017-7493.patch"))
+             (patches (search-patches "qemu-CVE-2017-7493.patch"
+                                      "qemu-CVE-2017-8112.patch"
+                                      "qemu-CVE-2017-8309.patch"
+                                      "qemu-CVE-2017-8379.patch"
+                                      "qemu-CVE-2017-8380.patch"))
              (sha256
               (base32
                "08mhfs0ndbkyqgw7fjaa9vjxf4dinrly656f6hjzvmaz7hzc677h"))))
diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
index d94c652ab2..e9cc4ce87e 100644
--- a/gnu/packages/qt.scm
+++ b/gnu/packages/qt.scm
@@ -349,7 +349,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtbase
   (package
     (name "qtbase")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -358,16 +358,18 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "01f07yjly7y24njl2h4hyknmi7pf8yd9gky23szcfkd40ap12wf1"))
+               "0v19spxa4sfq0a35nab9n8n2s3jd0443px0k45zhhg103apv4zi6"))
              (modules '((guix build utils)))
              (snippet
+               ;; corelib uses bundled harfbuzz, md4, md5, sha3
               '(begin
-                ;; Remove one of the two bundled harfbuzz copies in addition
-                ;; to passing "-system-harfbuzz".
-                (delete-file-recursively "src/3rdparty/harfbuzz-ng")
-                ;; Remove the bundled sqlite copy in addition to
-                ;; passing "-system-sqlite".
-                (delete-file-recursively "src/3rdparty/sqlite")))))
+                (for-each
+                  (lambda (dir)
+                    (delete-file-recursively (string-append "src/3rdparty/" dir)))
+                  (list "double-conversion" "freetype" "harfbuzz-ng"
+                        "libpng" "libjpeg" "pcre2" "sqlite" "xcb"
+                        "xkbcommon" "zlib"))
+                #t))))
     (build-system gnu-build-system)
     (propagated-inputs
      `(("mesa" ,mesa)))
@@ -403,7 +405,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
        ("mysql" ,mysql)
        ("nss" ,nss)
        ("openssl" ,openssl)
-       ("pcre" ,pcre)
+       ("pcre2" ,pcre2)
        ("postgresql" ,postgresql)
        ("pulseaudio" ,pulseaudio)
        ("sqlite" ,sqlite)
@@ -459,11 +461,12 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                        ;; Do not build examples; if desired, these could go
                        ;; into a separate output, but for the time being, we
                        ;; prefer to save the space and build time.
-                       "-nomake" "examples"
+                       "-no-compile-examples"
                        ;; Most "-system-..." are automatic, but some use
                        ;; the bundled copy by default.
                        "-system-sqlite"
                        "-system-harfbuzz"
+                       "-system-pcre"
                        ;; explicitly link with openssl instead of dlopening it
                        "-openssl-linked"
                        ;; explicitly link with dbus instead of dlopening it
@@ -529,7 +532,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtsvg
   (package (inherit qtbase)
     (name "qtsvg")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -538,7 +541,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "12fwzbp28szqw1sk3flb8i6xnxgl94siwyy41ffdmd0s44f1jwwq"))))
+               "0zpy53vb0ckaj71ffl450qv9kipl8gwwcbbras8kbg6bpl8srl8g"))))
     (propagated-inputs `())
     (native-inputs `(("perl" ,perl)))
     (inputs
@@ -572,7 +575,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtimageformats
   (package (inherit qtsvg)
     (name "qtimageformats")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -581,7 +584,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0vv0wh5q5sih294x661djzwvgdwy7r6xpnxsc111k5hwq7m5w13m"))
+               "10alm3kz3md835hf5hx7322bak9pp9igi2knvymxsjqr8x87jq94"))
              (modules '((guix build utils)))
              (snippet
               '(delete-file-recursively "src/3rdparty"))))
@@ -598,7 +601,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtx11extras
   (package (inherit qtsvg)
     (name "qtx11extras")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -607,7 +610,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "03i8lk9qcdf8h2k4f3rkqqkzbrlnyaspv9mgjkn4k61s2asz5mxy"))))
+               "0smzs29zqi77s1038ddkj3wzcchajqrjymwa5jgva7n2dn2x40wy"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -619,7 +622,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtxmlpatterns
   (package (inherit qtsvg)
     (name "qtxmlpatterns")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -628,7 +631,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "016s75j2cml7kc8scdm9a6pmxm8jhs424lml2h9znm1flmgadzvv"))))
+               "1f2mly7ddw4hpr3x0lpdahcikivwhiwa3238yrg4gz2c3lxj5y21"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:phases phases)
@@ -644,7 +647,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtdeclarative
   (package (inherit qtsvg)
     (name "qtdeclarative")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -653,7 +656,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0ilaf2sprpk9fg2j3905hxnhm0xbnm88ppk4zifp7n0jmnwix51j"))))
+               "1g9yz7q2laqs80m4i6zngxrq3pd7z5khr2f48glma8cmiw4p56rw"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -670,7 +673,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtconnectivity
   (package (inherit qtsvg)
     (name "qtconnectivity")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -679,7 +682,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1w97na5s420y08dcydqinbqb0rd9h4pfdnjbwslr0qvzsvlh2bbv"))))
+               "0k52acsywr849nw86dfjqcv1lqgnq01akqrm0qjs7ysm1ayg8mcp"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:phases phases)
@@ -702,7 +705,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtwebsockets
   (package (inherit qtsvg)
     (name "qtwebsockets")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -711,7 +714,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1xa5p36grqxz3fa08amn7r3dy6k28g6y0gkc6jgj7lyhjzr0l4da"))))
+               "1ml60p50hr3f68l0fiyqg2pf6n37flzxafzasis42jm4m757m5v2"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -723,7 +726,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtsensors
   (package (inherit qtsvg)
     (name "qtsensors")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -732,7 +735,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "15p7bp21yj4cdl5yfc9qnn4lhhiwiwx3b71lrb431kgqxhwhcp9s"))))
+               "0jdaw0i6rirs66x4cjh8l24fsyp020x1mv1psyf3ffbkdq1pngjx"))))
     (native-inputs
      `(("perl" ,perl)
        ("qtdeclarative" ,qtdeclarative)))
@@ -741,7 +744,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtmultimedia
   (package (inherit qtsvg)
     (name "qtmultimedia")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -750,7 +753,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "01sakngvsqr90qhrxyghfqdpddpxwbjyzzhm34k0hlpr6i409g58"))
+               "1vk0vlp9wapj1pip5v0v0sxynlig38m3a1qbjhid3rm27f971cqb"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -776,7 +779,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtwayland
   (package (inherit qtsvg)
     (name "qtwayland")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -785,7 +788,11 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "06ilh55vaxbkyv7irw0n11gxgc34ypx2qhqawxzy7kllzg9zcl7z"))))
+               "0zlxlxrc15x69jwhcc6h0xi4mfchbb3pf27y3zy22yi3ynv2p04v"))
+             (modules '((guix build utils)))
+             (snippet
+               ;; The examples try to build and cause the build to fail
+              '(delete-file-recursively "examples"))))
     (native-inputs
      `(("glib" ,glib)
        ("perl" ,perl)
@@ -807,7 +814,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtserialport
   (package (inherit qtsvg)
     (name "qtserialport")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -816,7 +823,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1b86al3zn1pxyk0n59vh8bqxrpz2m0j33ygclaqbxl1sszg7ycaj"))))
+               "0zwxfbyn5rg6vyrgpi5c3n852vd32m37ghzyj4l50ljndlz2w0l0"))))
     (native-inputs `(("perl" ,perl)))
     (inputs
      `(("qtbase" ,qtbase)
@@ -825,7 +832,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtserialbus
   (package (inherit qtsvg)
     (name "qtserialbus")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -834,7 +841,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "02n1b1wrvfg6c7z15c5c5gv9r5gd4pp58jrd1a8d8fg3ybcksd2q"))))
+               "1zw32ha5hz7zsdp8m2dk58kivxd66vkzijbnhi8jvzjp4nf0pm1f"))))
     (inputs
      `(("qtbase" ,qtbase)
        ("qtserialport" ,qtserialport)))))
@@ -842,7 +849,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtwebchannel
   (package (inherit qtsvg)
     (name "qtwebchannel")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -851,7 +858,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0jhbgp9rdp5lpwjrykxmg4lb60wk7gm3dldz5kp3b8ms2dab3xav"))))
+               "1fg1g2h9s9v6lg10ix59pzws35fyh3hh5x2005pyp84xdg47mvqj"))))
     (native-inputs
      `(("perl" ,perl)
        ("qtdeclarative" ,qtdeclarative)
@@ -861,7 +868,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtlocation
   (package (inherit qtsvg)
     (name "qtlocation")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -870,7 +877,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1fqssa8rhq83lnxjcdh4ijqck3lmqglpk8yax8x17w49v6gf78a8"))))
+               "1xia1y1pjill9m880rgmsl2zshcg1nvwkyfdb2lz8g8x9fj0pvp3"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -879,12 +886,16 @@ developers using C++ or QML, a CSS & JavaScript like language.")
        ("qtdeclarative" ,qtdeclarative)
        ("qtquickcontrols" ,qtquickcontrols)
        ("qtserialport" ,qtserialport)))
-    (inputs `(("qtbase" ,qtbase)))))
+    (inputs
+     `(("icu4c" ,icu4c)
+       ("openssl" ,openssl)
+       ("qtbase" ,qtbase)
+       ("zlib" ,zlib)))))
 
 (define-public qttools
   (package (inherit qtsvg)
     (name "qttools")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -893,7 +904,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "10wx4vydj91yag30457c7azx4ihrwky42l7zzwkbmdlksdv8xv4m"))))
+               "1vl5lapnbaam51pfw89pshh6rxqwfrbpj0j8gdhzdngr6n79dzk4"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -907,7 +918,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtscript
   (package (inherit qtsvg)
     (name "qtscript")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -916,7 +927,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1lssbsjf2p2ag02fjq6k6vk7vywhj4jsl286r2fqi78q5lfvjfi9"))
+               "0r697ap324l8lnbqbhrrqzsl9k4nmk6lcijxlaqn3ksxgfzbcciw"))
              (patches (search-patches "qtscript-disable-tests.patch"))))
     (native-inputs
      `(("perl" ,perl)
@@ -927,7 +938,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtquickcontrols
   (package (inherit qtsvg)
     (name "qtquickcontrols")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -936,7 +947,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "09mkswxw7wa2l8xz9fbblxr1pbi86hggis55j4k8ifnrrw60vrq4"))))
+               "1zjl2wp5407y8iabwi30j4jpxh2j4y0ijb5jvvpdq583nbzgyg8p"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -947,7 +958,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtquickcontrols2
   (package (inherit qtsvg)
     (name "qtquickcontrols2")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -956,7 +967,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "06yy98x4vic2yrlpp83gf4kvl7kd93q62k178w0cy4sgqxp8d6dh"))))
+               "170xgk4jw1b1rpq8838dc5sb0dyv1jap3yfgg5hymrjzrk0nzaq9"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -967,7 +978,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtgraphicaleffects
   (package (inherit qtsvg)
     (name "qtgraphicaleffects")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -976,7 +987,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "06frknb7m8bgg55rs7jjm61iziisy2ykzrrc5dy3vj0aad89najz"))))
+               "1cz4ykwlm1c0hbv4d8y07bwyz87nkz5l9ss3f65vadm8zcabqw55"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -1010,7 +1021,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtgamepad
   (package (inherit qtsvg)
     (name "qtgamepad")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1019,7 +1030,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0dwcrq60h802z694h4108figlr3yvp8fpzhwjzbjm503v8yaxw5j"))))
+               "0lpj2qspidx6s2568m5v40j2zdnrl8zwjdp40zg4y2q6hy2gg597"))))
     (native-inputs
      `(("perl" ,perl)
        ("pkg-config" ,pkg-config)))
@@ -1034,7 +1045,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtscxml
   (package (inherit qtsvg)
     (name "qtscxml")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1043,7 +1054,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1i4xl24q4i32mbhyndrwaz0xj79d9n84s320gmkf5rwnfcwrvfxn"))
+               "0f2jnhl30ij6y4wzlvgjsqgpaywq4g0wc4yjw8s888vcfl062nb4"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -1058,7 +1069,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtpurchasing
   (package (inherit qtsvg)
     (name "qtpurchasing")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1067,7 +1078,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0mdkw73yx1csz9mf3wl0w1x1b8cv9j5px4nvakrknkjzaa9qgzdk"))))
+               "0xcka24qjdydqhf7fhn2i2ycn3zsi4vzqv9s77wzmaksrazwb13q"))))
     (inputs
      `(("qtbase" ,qtbase)
        ("qtdeclarative" ,qtdeclarative)))))
@@ -1075,7 +1086,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtcanvas3d
   (package (inherit qtsvg)
     (name "qtcanvas3d")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1084,7 +1095,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "18yaikbwk4d7sh09psi3kjn1mxjp4d2f3qchfzgq5x96yn8gfijl"))
+               "1jrv79rhpqyp4ip5fnf40plqcq9byl1fy8287ghq4jfhpm9bq5yq"))
              (modules '((guix build utils)))
              (snippet
               '(delete-file-recursively "examples/canvas3d/3rdparty"))))
@@ -1109,7 +1120,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtcharts
   (package (inherit qtsvg)
     (name "qtcharts")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1118,7 +1129,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "11m5g1fxip6z2xk1z6g6h4rq7v282qbkxflan8hs87hadnzars03"))))
+               "17m86csjymvcnprk8m4y6hx1qhlk9811rhqwwkqdymyyswx6xs3l"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -1129,7 +1140,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
 (define-public qtdatavis3d
   (package (inherit qtsvg)
     (name "qtdatavis3d")
-    (version "5.8.0")
+    (version "5.9.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.qt.io/official_releases/qt/"
@@ -1138,7 +1149,7 @@ developers using C++ or QML, a CSS & JavaScript like language.")
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1n2vdf6n7pr9xrjwbvbar899q74shx6cy19x32adxfn2iilygwbp"))))
+               "1wvilla48jlw6zv2hc32ra0bs8p13s68sqbgr91bzbn7h7qaysv9"))))
     (arguments
      (substitute-keyword-arguments (package-arguments qtsvg)
        ((#:tests? _ #f) #f))) ; TODO: Enable the tests
@@ -1441,7 +1452,7 @@ different kinds of sliders, and much more.")
 (define-public qtwebkit
   (package
     (name "qtwebkit")
-    (version "5.8.0")
+    (version "5.9.0")
     (source
       (origin
         (method url-fetch)
@@ -1453,7 +1464,7 @@ different kinds of sliders, and much more.")
         ;; <http://lists.qt-project.org/pipermail/development/2016-May/025923.html>.
         (sha256
          (base32
-          "1v0vj6slyh19mjrrpbqdzb47fr0f4xk7bc8803xjzybb11h8dbkr"))))
+          "012fd8khiasfn8wx5ci310y94ap3y90a011f66cajm80fhxikbcd"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)
diff --git a/gnu/packages/regex.scm b/gnu/packages/regex.scm
index 2b32aa3381..18b7a7ed79 100644
--- a/gnu/packages/regex.scm
+++ b/gnu/packages/regex.scm
@@ -28,7 +28,7 @@
 (define-public re2
    (package
      (name "re2")
-     (version "2017-05-01")
+     (version "2017-06-01")
      (source (origin
                (method url-fetch)
                (uri
@@ -38,7 +38,7 @@
                (file-name (string-append name "-" version ".tar.gz"))
                (sha256
                 (base32
-                 "19glvic4ipd122yhcavf7ifg7ms5k61398vq7gyb90wggf2w0z9k"))))
+                 "0bjhmmcx17mc8gfbf3cc4bwjcyf415mas3026v3c35g5fsaxyq5v"))))
      (build-system gnu-build-system)
      (arguments
       `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm
index f6aee005c4..eacfd733db 100644
--- a/gnu/packages/scheme.scm
+++ b/gnu/packages/scheme.scm
@@ -7,6 +7,7 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2016, 2017 ng0 <contact.ng0@cryptolab.net>
 ;;; Copyright © 2017 John Darrington <jmd@gnu.org>
+;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -780,7 +781,9 @@ engineering.")
            (let ((gzip (assoc-ref %build-inputs "gzip"))
                  (source (assoc-ref %build-inputs "source"))
                  (texinfo (assoc-ref %build-inputs "texinfo"))
+                 (html-dir (string-append %output "/share/doc/" ,name "/html"))
                  (info-dir (string-append %output "/share/info")))
+             (copy-recursively (string-append source "/html") html-dir)
              (setenv "PATH" (string-append gzip "/bin"
                                            ":" texinfo "/bin"))
              (mkdir-p info-dir)
diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm
index 47d3a46148..5e04e86539 100644
--- a/gnu/packages/shells.scm
+++ b/gnu/packages/shells.scm
@@ -459,6 +459,111 @@ and redirections, and a complete syscall library for low-level access to the
 operating system.")
       (license bsd-3))))
 
+(define-public linenoise
+  (package
+    (name "linenoise")
+    (version "1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/antirez/linenoise/"
+                           "archive/" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "05006hd56xcvxjdpll4x720bpfan7vwqmxbw8a2kvm10w57ll1gm"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ;No tests are included
+       #:make-flags (list "CC=gcc")
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             ;; At the moment there is no 'make install' in upstream.
+             (let* ((out (assoc-ref outputs "out")))
+               (install-file "linenoise.h"
+                             (string-append out "/include/linenoise"))
+               (install-file "linenoise.c"
+                             (string-append out "/include/linenoise"))
+               #t))))))
+    (home-page "https://github.com/antirez/linenoise")
+    (synopsis "Minimal zero-config readline replacement")
+    (description
+     "Linenoise is a minimal, zero-config, readline replacement.
+Its features include:
+
+@enumerate
+@item Single and multi line editing mode with the usual key bindings
+@item History handling
+@item Completion
+@item Hints (suggestions at the right of the prompt as you type)
+@item A subset of VT100 escapes, ANSI.SYS compatible
+@end enumerate\n")
+    (license bsd-2)))
+
+(define-public s
+  (let ((commit "6604341edb3a775ff94415762af3ee9bd86bfb3c")
+        (revision "1"))
+    (package
+      (name "s")
+      (version (string-append "0.0.0-" revision "." (string-take commit 7)))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/rain-1/s")
+               (commit commit)))
+         (file-name (string-append name "-" version "-checkout"))
+         (sha256
+          (base32
+           "1075cml6dl15d770j3m12yz90cjacsdslbv3gank1nxd76vmpdcr"))))
+      (build-system gnu-build-system)
+      (inputs
+       `(("linenoise" ,linenoise)))
+      (arguments
+       `(#:tests? #f
+         #:make-flags (list "CC=gcc")
+         #:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'install-directory-fix
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out"))
+                      (bin (string-append out "/bin")))
+                 (substitute* "Makefile"
+                   (("out") bin))
+                 #t)))
+           (add-after 'install 'manpage
+             (lambda* (#:key outputs #:allow-other-keys)
+               (install-file "s.1" (string-append (assoc-ref outputs "out")
+                                                  "/share/man/man1"))))
+           (replace 'configure
+             (lambda* (#:key inputs outputs #:allow-other-keys)
+               ;; At this point linenoise is meant to be included,
+               ;; so we have to really copy it into the working directory
+               ;; of s.
+               (let* ((linenoise (assoc-ref inputs "linenoise"))
+                      (noisepath (string-append linenoise "/include/linenoise"))
+                      (out (assoc-ref outputs "out")))
+                 (copy-recursively noisepath "linenoise")
+                 (substitute* "s.c"
+                   (("/bin/s") (string-append out "/bin/s")))
+                 #t))))))
+      (home-page "https://github.com/rain-1/s")
+      (synopsis "Extremely minimal shell with the simplest syntax possible")
+      (description
+       "S is a new shell that aims to be extremely simple.
+S does not implemnt the POSIX shell standard.
+There are no globs or \"splatting\" where a variable $FOO turns into multiple
+command line arguments.  One token stays one token forever.
+This is a \"no surprises\" straightforward approach.
+
+There are no redirection operators > in the shell language, they are added as
+extra programs.  > is just another unix command, < is essentially cat(1).
+A @code{andglob} program is also provided along with s.")
+      (license bsd-3))))
+
 (define-public loksh
   (package
     (name "loksh")
diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index c96ed0a72b..d79663a2b5 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -58,15 +58,16 @@
 (define-public libssh
   (package
     (name "libssh")
-    (version "0.7.4")
+    (version "0.7.5")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "https://red.libssh.org/attachments/download/210/libssh-"
+                    "https://red.libssh.org/attachments/download/218/libssh-"
                     version ".tar.xz"))
               (sha256
                (base32
-                "03bcp9ksqp0s1pmwfmzhcknvkxay5k0mjzzxp3rjlifbng1vxq9r"))))
+                "15bh6dm9c50ndddzh3gqcgw7axp3ghrspjpkb1z3dr90vkanvs2l"))
+              (patches (search-patches "libssh-hostname-parser-bug.patch"))))
     (build-system cmake-build-system)
     (outputs '("out" "debug"))
     (arguments
diff --git a/gnu/packages/terminals.scm b/gnu/packages/terminals.scm
index a8007586c9..028cc99bfd 100644
--- a/gnu/packages/terminals.scm
+++ b/gnu/packages/terminals.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015, 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Mckinley Olsen <mck.olsen@gmail.com>
-;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
+;;; Copyright © 2016, 2017 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
 ;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 José Miguel Sánchez García <jmi2k@openmailbox.org>
@@ -146,17 +146,14 @@ insert mode and command mode where keybindings have different functions.")
 (define-public asciinema
   (package
     (name "asciinema")
-    (version "1.3.0")
+    (version "1.4.0")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append
-             "https://pypi.python.org/packages/06/96/93947d9be78aebb7985014fdf"
-             "4d84896dd0f62514d922ee03f5bb55a21fb/asciinema-" version
-             ".tar.gz"))
+       (uri (pypi-uri "asciinema" version))
        (sha256
         (base32
-         "1crdm9zfdbjflvz1gsqvy5zsbgwdfkj34z69kg6h5by70rrs1hdc"))))
+         "1jrf8c8711gkdilmvyv3d37kp8xfvdc5cqighw5k92a6g9z4acgv"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index cd684c04e7..32c9a132a6 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -14,6 +14,7 @@
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Vasile Dumitrascu <va511e@yahoo.com>
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2017 André <eu@euandre.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -335,7 +336,9 @@ everything from small to very large projects with speed and efficiency.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s"))))
+                "1cdwcw38frc1wf28x5ppddazv9hywc718j92f3xa3ybzzycyds3s"))
+              (patches (search-patches "libgit2-use-after-free.patch"
+                                       "libgit2-0.25.1-mtime-0.patch"))))
     (build-system cmake-build-system)
     (arguments
      `(#:phases
@@ -348,25 +351,13 @@ everything from small to very large projects with speed and efficiency.")
                (("/bin/cp") (which "cp"))
                (("/bin/rm") (which "rm")))
              #t))
-         (add-after 'unpack 'apply-patch
-           (lambda* (#:key inputs #:allow-other-keys)
-             ;; XXX: For some reason adding the patch in 'patches', which
-             ;; leads to a new tarball with all timestamps reset and ordering
-             ;; by name (slightly different file order compared to the
-             ;; original tarball) leads to an obscure Python error while
-             ;; running 'generate.py':
-             ;;   'Module' object has no attribute 'callbacks'
-             ;; Thus, apply the patch here, which minimizes disruption.
-             (let ((patch (assoc-ref inputs "patch")))
-               (zero? (system* "patch" "-p1" "--force" "--input" patch)))))
          ;; Run checks more verbosely.
          (replace 'check
            (lambda _ (zero? (system* "./libgit2_clar" "-v" "-Q")))))))
     (inputs
      `(("libssh2" ,libssh2)
        ("libcurl" ,curl)
-       ("python" ,python-wrapper)
-       ("patch" ,(search-patch "libgit2-use-after-free.patch"))))
+       ("python" ,python-wrapper)))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (propagated-inputs
@@ -423,6 +414,49 @@ as keys or passwords) in the same repository as your code, without requiring you
 to lock down your entire repository.")
     (license license:gpl3+)))
 
+(define-public git-remote-gcrypt
+  (package
+   (name "git-remote-gcrypt")
+   (version "1.0.1")
+   (source (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://git.spwhitton.name/git-remote-gcrypt")
+                   (commit version)))
+             (file-name (string-append name "-" version "-checkout"))
+             (sha256
+              (base32
+               "0znrx77vpm4a8l7yiybsxk5vrawijqqfxmp1p2yhaaw8cbgrj7az"))))
+   (build-system trivial-build-system)
+   (arguments
+    `(#:modules ((guix build utils))
+      #:builder (begin
+                  (use-modules (guix build utils))
+                  (let* ((source (assoc-ref %build-inputs "source"))
+                         (output (assoc-ref %outputs "out"))
+                         (bindir (string-append output "/bin")))
+                    (install-file (string-append source "/git-remote-gcrypt")
+                                  bindir)
+                    #t))))
+   (home-page "https://spwhitton.name/tech/code/git-remote-gcrypt/")
+   (synopsis "Whole remote repository encryption")
+   (description "git-remote-gcrypt is a Git remote helper to push and pull from
+repositories encrypted with GnuPG.  It works with the standard Git transports,
+including repository hosting services like GitLab.
+
+Remote helper programs are invoked by Git to handle network transport.  This
+helper handles @code{gcrypt:} URLs that access a remote repository encrypted
+with GPG, using our custom format.
+
+Supported locations are local, @code{rsync://} and @code{sftp://}, where the
+repository is stored as a set of files, or instead any Git URL where gcrypt
+will store the same representation in a Git repository, bridged over arbitrary
+Git transport.
+
+The aim is to provide confidential, authenticated Git storage and
+collaboration using typical untrusted file hosts or services.")
+   (license license:gpl3+)))
+
 (define-public cgit
   (package
     (name "cgit")
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index bfe3063242..4d1cecc4ef 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -18,6 +18,8 @@
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Chris Marusich <cmmarusich@gmail.com>
 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
+;;; Copyright © 2017 Ethan R. Jones <doubleplusgood23@gmail.com>
+;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -58,6 +60,7 @@
   #:use-module (gnu packages cdrom)
   #:use-module (gnu packages cmake)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages cpp)
   #:use-module (gnu packages curl)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages dejagnu)
@@ -308,7 +311,7 @@ designed to encode video or images into an H.265 / HEVC encoded bitstream.")
 (define-public libass
   (package
     (name "libass")
-    (version "0.13.6")
+    (version "0.13.7")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -316,7 +319,7 @@ designed to encode video or images into an H.265 / HEVC encoded bitstream.")
                     version "/libass-" version ".tar.xz"))
               (sha256
                (base32
-                "0b9cj5xfsa7zwlk5m146fhv102v51iqs3rapq0n2xrz30k8p9a7q"))))
+                "17byv926w1mxn56n896sxvdq4m0yv1l7qbm688h6zr3nzgsyarbh"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -657,7 +660,10 @@ audio/video codec library.")
                "1a22b913p2227ljz89c4fgjlyln5gcz8z58w32r0wh4srnnd60y4"))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("git" ,git) ; needed for a test
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("git" ,git) ; needed for a test
+       ("libtool" ,libtool)
        ("pkg-config" ,pkg-config)))
     ;; FIXME: Add optional inputs once available.
     (inputs
@@ -671,6 +677,7 @@ audio/video codec library.")
        ("gnutls" ,gnutls)
        ("liba52" ,liba52)
        ("libcddb" ,libcddb)
+       ("libdvbpsi" ,libdvbpsi)
        ("libgcrypt" ,libgcrypt)
        ("libkate" ,libkate)
        ("libmad" ,libmad)
@@ -685,6 +692,7 @@ audio/video codec library.")
        ("libxinerama" ,libxinerama)
        ("libxml2" ,libxml2)
        ("libxpm" ,libxpm)
+       ("livemedia-utils" ,livemedia-utils)
        ("lua" ,lua-5.1)
        ("mesa" ,mesa)
        ("opus" ,opus)
@@ -712,6 +720,15 @@ audio/video codec library.")
 
        #:phases
        (modify-phases %standard-phases
+         (add-before 'configure 'bootstrap
+           (lambda _ (zero? (system* "sh" "bootstrap"))))
+         (add-before 'bootstrap 'fix-livemedia-utils-prefix
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let ((livemedia-utils (assoc-ref inputs "livemedia-utils")))
+               (substitute* "configure.ac"
+                 (("LIVE555_PREFIX=\\$\\{LIVE555_PREFIX-\"/usr\"\\}")
+                  (string-append "LIVE555_PREFIX=" livemedia-utils)))
+               #t)))
          (add-before 'configure 'remove-visual-tests
            ;; Some of the tests require using the display to test out VLC,
            ;; which fails in our sandboxed build system
@@ -2052,3 +2069,163 @@ file format that has been used as a multimedia file format in a variety of platf
 applications.  It is a very powerful and extensible format that can accommodate
 practically any type of media.")
     (license license:mpl1.1)))
+
+(define-public libmediainfo
+  (package
+    (name "libmediainfo")
+    (version "0.7.95")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://mediaarea.net/download/source/"
+                                  name "/" version"/"
+                                  name "_" version ".tar.bz2"))
+              (sha256
+               (base32
+                "1kchh6285b07z5nixv619hc9gml2ysdayicdiv30frrlqiyxqw4b"))))
+    ;; TODO add a Big Buck Bunny webm for tests.
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)
+       ("zlib" ,zlib)
+       ("tinyxml2" ,tinyxml2)
+       ("curl" ,curl)
+       ("libzen" ,libzen)))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:tests? #f ; see above TODO
+       #:phases
+       ;; build scripts not in root of archive
+       (modify-phases %standard-phases
+         (add-before 'configure 'pre-configure
+           (lambda _
+             (chdir "Project/GNU/Library")))
+         (add-before 'configure 'autogen
+           (lambda _
+             (zero? (system* "./autogen.sh")))))))
+    (home-page "https://mediaarea.net/en/MediaInfo")
+    (synopsis "Library for retrieving media metadata")
+    (description "MediaInfo is a library used for retrieving technical
+information and other metadata about audio or video files.  A non-exhaustive
+list of the information MediaInfo can retrieve from media files include:
+
+@itemize
+@item General: title, author, director, album, track number, date, duration...
+@item Video: codec, aspect, fps, bitrate...
+@item Audio: codec, sample rate, channels, language, bitrate...
+@item Text: language of subtitle
+@item Chapters: number of chapters, list of chapters
+@end itemize
+
+MediaInfo supports the following formats:
+
+@itemize
+@item Video: MKV, OGM, AVI, DivX, WMV, QuickTime, Real, MPEG-1,
+MPEG-2, MPEG-4, DVD (VOB)...
+@item Video Codecs: DivX, XviD, MSMPEG4, ASP, H.264, AVC...)
+@item Audio: OGG, MP3, WAV, RA, AC3, DTS, AAC, M4A, AU, AIFF...
+@item  Subtitles: SRT, SSA, ASS, SAMI...
+@end itemize\n")
+    (license license:bsd-2)))
+
+;; TODO also have a GUI version available
+(define-public mediainfo
+  (package
+    (name "mediainfo")
+    (version "0.7.95")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://mediaarea.net/download/source/"
+                                  name "/" version "/"
+                                  name "_" version ".tar.bz2"))
+              (sha256
+               (base32
+                "0dy51a3i79jppmg1gi4f6h7jx4hcgnkmfim4d7d3gmnlbkjh8anv"))))
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)
+       ("zlib" ,zlib)
+       ("libmediainfo", libmediainfo)
+       ("libzen" ,libzen)))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:tests? #f ; lacks tests
+       #:phases
+       ;; build scripts not in root of archive
+       (modify-phases %standard-phases
+         (add-before 'configure 'pre-configure
+           (lambda _
+             (chdir "Project/GNU/CLI")))
+         (add-before 'configure 'autogen
+           (lambda _
+             (zero? (system* "./autogen.sh")))))))
+    (home-page "https://mediaarea.net/en/MediaInfo")
+    (synopsis "Utility for reading media metadata")
+    (description "MediaInfo is a utility used for retrieving technical
+information and other metadata about audio or video files.  It supports the
+many codecs and formats supported by libmediainfo.")
+    (license license:bsd-2)))
+
+(define-public livemedia-utils
+  (package
+    (name "livemedia-utils")
+    (version "2017.05.24")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "http://www.live555.com/liveMedia/public/live."
+                    version ".tar.gz"))
+              (sha256
+               (base32
+                "1ra64j3qa89hf3xika8jz9gd8al8mcaqlk5ivw5pclnd2df5f4im"))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:tests? #f ; no tests
+       #:make-flags (list "CC=gcc"
+                          (string-append "LDFLAGS=-Wl,-rpath="
+                                         (assoc-ref %outputs "out") "/lib")
+                          (string-append "PREFIX="
+                                         (assoc-ref %outputs "out")))
+       #:phases (modify-phases %standard-phases
+                  (add-before 'configure 'fix-makefiles-generation
+                    (lambda _
+                      (substitute* "genMakefiles"
+                        (("/bin/rm") "rm"))
+                      #t))
+                  (replace 'configure
+                    (lambda _
+                      (zero? (system* "./genMakefiles"
+                                      "linux-with-shared-libraries")))))))
+    (home-page "http://www.live555.com/liveMedia/")
+    (synopsis "Set of C++ libraries for multimedia streaming")
+    (description "This code forms a set of C++ libraries for multimedia
+streaming, using open standard protocols (RTP/RTCP, RTSP, SIP).  The libraries
+can be used to stream, receive, and process MPEG, H.265, H.264, H.263+, DV or
+JPEG video, and several audio codecs.  They can easily be extended to support
+additional (audio and/or video) codecs, and can also be used to build basic
+RTSP or SIP clients and servers.")
+    (license license:lgpl3+)))
+
+(define-public libdvbpsi
+  (package
+    (name "libdvbpsi")
+    (version "1.3.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://download.videolan.org/pub/libdvbpsi/"
+                    version "/libdvbpsi-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "0824r08kaspbrrg2dd5d46s475zb7j59brqkm2y6x3mdsnpng0yn"))))
+    (build-system gnu-build-system)
+    (home-page "https://www.videolan.org/developers/libdvbpsi.html")
+    (synopsis "Library for decoding and generation of MPEG TS and DVB PSI
+tables")
+    (description "libdvbpsi is a simple library designed for decoding and
+generation of MPEG TS and DVB PSI tables according to standards ISO/IEC 13818s
+and ITU-T H.222.0.")
+    (license license:lgpl2.1)))
diff --git a/gnu/packages/vtk.scm b/gnu/packages/vtk.scm
deleted file mode 100644
index 5a5c941270..0000000000
--- a/gnu/packages/vtk.scm
+++ /dev/null
@@ -1,93 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-(define-module (gnu packages vtk)
-  #:use-module (guix packages)
-  #:use-module (guix download)
-  #:use-module ((guix licenses) #:select (bsd-3))
-  #:use-module (guix utils)
-  #:use-module (guix build-system cmake)
-  #:use-module (gnu packages)
-  #:use-module (gnu packages compression)
-  #:use-module (gnu packages fontutils)
-  #:use-module (gnu packages gl)
-  #:use-module (gnu packages image)
-  #:use-module (gnu packages maths)
-  #:use-module (gnu packages serialization)
-  #:use-module (gnu packages xiph)
-  #:use-module (gnu packages xml)
-  #:use-module (gnu packages xorg))
-
-(define-public vtk
-  (package
-    (name "vtk")
-    (version "7.1.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "http://www.vtk.org/files/release/"
-                                  (version-major+minor version)
-                                  "/VTK-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0yj96z58haan77gzilnqp7xpf8hg5jk11a3jx55p2ksd400s0gjz"))))
-    (build-system cmake-build-system)
-    (arguments
-     '(#:build-type "Release"           ;Build without '-g' to save space.
-       ;; -DVTK_USE_SYSTEM_NETCDF:BOOL=TRUE requires netcdf_cxx
-       #:configure-flags '("-DVTK_USE_SYSTEM_EXPAT:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_FREETYPE:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_HDF5:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_JPEG:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_JSONCPP:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_LIBXML2:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_OGGTHEORA:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_PNG:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_TIFF:BOOL=TRUE"
-                           "-DVTK_USE_SYSTEM_ZLIB:BOOL=TRUE")
-       #:tests? #f))                              ;XXX: no "test" target
-    (inputs
-     `(("libXt" ,libxt)
-       ("xproto" ,xproto)
-       ("libX11" ,libx11)
-       ("libxml2" ,libxml2)
-       ("mesa" ,mesa)
-       ("glu" ,glu)
-       ("expat" ,expat)
-       ("freetype" ,freetype)
-       ("hdf5" ,hdf5)
-       ("jpeg" ,libjpeg)
-       ("jsoncpp" ,jsoncpp)
-       ("libogg" ,libogg)
-       ("libtheora" ,libtheora)
-       ("png" ,libpng)
-       ("tiff" ,libtiff)
-       ("zlib" ,zlib)))
-    (home-page "http://www.vtk.org/")
-    (synopsis "Libraries for 3D computer graphics")
-    (description
-     "The Visualization Toolkit (VTK) is a C++ library for 3D computer graphics,
-image processing and visualization.  It supports a wide variety of
-visualization algorithms including: scalar, vector, tensor, texture, and
-volumetric methods; and advanced modeling techniques such as: implicit
-modeling, polygon reduction, mesh smoothing, cutting, contouring, and Delaunay
-triangulation.  VTK has an extensive information visualization framework, has
-a suite of 3D interaction widgets, supports parallel processing, and
-integrates with various databases on GUI toolkits such as Qt and Tk.")
-    (license bsd-3)))
diff --git a/gnu/packages/wine.scm b/gnu/packages/wine.scm
index 9c82e01d67..34f145b89b 100644
--- a/gnu/packages/wine.scm
+++ b/gnu/packages/wine.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2014, 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2016 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -54,14 +55,14 @@
 (define-public wine
   (package
     (name "wine")
-    (version "2.4")
+    (version "2.9")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dl.winehq.org/wine/source/2.x"
                                   "/wine-" version ".tar.xz"))
               (sha256
                (base32
-                "13klfadvd44zdfrzh38al99s53i02x3mlhcj5z7fq7vqwh3xzdc7"))))
+                "0pslhs3kwjimlz5ad6vzzdw7lgbfpwl8vyg4jmf17p61pfxzfimc"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("gettext" ,gettext-minimal)
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index a2230c4e93..5007320c9c 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -441,7 +441,7 @@ of the screen selected by mouse.")
 (define-public slop
   (package
     (name "slop")
-    (version "6.3.38")
+    (version "6.3.41")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -450,7 +450,7 @@ of the screen selected by mouse.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1jh08k7nqx6hr4rmb5damzqhnqiac439i6i51fmzymzw3fqykas8"))))
+                "1yiv0ak1z7zbmcdw0dwx2gpblrh7l7s3l7y7sgpx071dy8s4rqpb"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f)) ; no "check" target
@@ -472,7 +472,7 @@ selection's dimensions to stdout.")
 (define-public maim
   (package
     (name "maim")
-    (version "5.4.62")
+    (version "5.4.63")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -481,7 +481,7 @@ selection's dimensions to stdout.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "084czvwcicl8apjlv729inxx8rpycra76ignfjmcbaq0hhn6ip6w"))))
+                "0ncly3mmg9pihda3jfwmvfa4sd3xanrm8hpvfq7lr2rl8rqknx80"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f))            ; no "check" target
@@ -958,6 +958,32 @@ demos.  It also acts as a nice screen locker.")
                "http://metadata.ftp-master.debian.org/changelogs/"
                "/main/x/xscreensaver/xscreensaver_5.36-1_copyright")))))
 
+(define-public xsel
+  (package
+    (name "xsel")
+    (version "1.2.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.vergenet.net/~conrad/software"
+                                  "/xsel/download/xsel-" version ".tar.gz"))
+              (sha256
+               (base32
+                "070lbcpw77j143jrbkh0y1v10ppn1jwmjf92800w7x42vh4cw9xr"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("libxt" ,libxt)))
+    (home-page "http://www.vergenet.net/~conrad/software/xsel/")
+    (synopsis "Manipulate X selection")
+    (description
+     "XSel is a command-line program for getting and setting the contents of
+the X selection.  Normally this is only accessible by manually highlighting
+information and pasting it with the middle mouse button.
+
+XSel reads from standard input and writes to standard output by default,
+but can also follow a growing file, display contents, delete entries and more.")
+    (license (license:x11-style "file://COPYING"
+                                "See COPYING in the distribution."))))
+
 (define-public xdpyprobe
   (package
     (name "xdpyprobe")
diff --git a/gnu/tests/base.scm b/gnu/tests/base.scm
index e5ac320b74..f5bbfafee3 100644
--- a/gnu/tests/base.scm
+++ b/gnu/tests/base.scm
@@ -199,6 +199,15 @@ info --version")
                          ',users+homes))
                marionette)))
 
+          (test-equal "permissions on /root"
+            #o700
+            (let ((root-home #$(any (lambda (account)
+                                      (and (zero? (user-account-uid account))
+                                           (user-account-home-directory
+                                            account)))
+                                    (operating-system-user-accounts os))))
+              (stat:perms (marionette-eval `(stat ,root-home) marionette))))
+
           (test-equal "no extra home directories"
             '()
 
diff --git a/guix/build/download.scm b/guix/build/download.scm
index ce4708a873..6ef6233346 100644
--- a/guix/build/download.scm
+++ b/guix/build/download.scm
@@ -296,6 +296,13 @@ session record port using PORT as its underlying communication port."
   (make-parameter (or (getenv "GUIX_TLS_CERTIFICATE_DIRECTORY")
                       (getenv "SSL_CERT_DIR"))))  ;like OpenSSL
 
+(define (set-certificate-credentials-x509-trust-file!* cred file format)
+  "Like 'set-certificate-credentials-x509-trust-file!', but without the file
+name decoding bug described at
+<https://debbugs.gnu.org/cgi/bugreport.cgi?bug=26948#17>."
+  (let ((data (call-with-input-file file get-bytevector-all)))
+    (set-certificate-credentials-x509-trust-data! cred data format)))
+
 (define (make-credendials-with-ca-trust-files directory)
   "Return certificate credentials with X.509 authority certificates read from
 DIRECTORY.  Those authority certificates are checked when
@@ -309,7 +316,7 @@ DIRECTORY.  Those authority certificates are checked when
                 (let ((file (string-append directory "/" file)))
                   ;; Protect against dangling symlinks.
                   (when (file-exists? file)
-                    (set-certificate-credentials-x509-trust-file!
+                    (set-certificate-credentials-x509-trust-file!*
                      cred file
                      x509-certificate-format/pem))))
               (or files '()))
diff --git a/guix/build/font-build-system.scm b/guix/build/font-build-system.scm
index cca1e93f0f..f2a646f6f4 100644
--- a/guix/build/font-build-system.scm
+++ b/guix/build/font-build-system.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
+;;; Copyright © 2017 Alex Griffin <a@ajgrf.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -50,9 +51,9 @@ archive, or a font file."
          (source (getcwd))
          (fonts (string-append out "/share/fonts")))
     (for-each (cut install-file <> (string-append fonts "/truetype"))
-              (find-files source "\\.ttf$"))
+              (find-files source "\\.(ttf|ttc)$"))
     (for-each (cut install-file <> (string-append fonts "/opentype"))
-              (find-files source "\\.otf$"))
+              (find-files source "\\.(otf|otc)$"))
     #t))
 
 (define %standard-phases
diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 52439afd44..2def2a108f 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -62,6 +62,7 @@
             file-system-fragment-size
             file-system-mount-flags
             statfs
+            free-disk-space
 
             processes
             mkdtemp!
@@ -697,6 +698,12 @@ mounted at FILE."
                    (list file (strerror err))
                    (list err)))))))
 
+(define (free-disk-space file)
+  "Return the free disk space, in bytes, on the file system that hosts FILE."
+  (let ((fs (statfs file)))
+    (* (file-system-block-size fs)
+       (file-system-blocks-available fs))))
+
 
 ;;;
 ;;; Containers.
diff --git a/guix/derivations.scm b/guix/derivations.scm
index 9aaab05ecb..b9ad9c9e8c 100644
--- a/guix/derivations.scm
+++ b/guix/derivations.scm
@@ -271,13 +271,14 @@ result is the set of prerequisites of DRV not already in valid."
 (define* (substitution-oracle store drv
                               #:key (mode (build-mode normal)))
   "Return a one-argument procedure that, when passed a store file name,
-returns #t if it's substitutable and #f otherwise.  The returned procedure
+returns a 'substitutable?' if it's substitutable and #f otherwise.
+The returned procedure
 knows about all substitutes for all the derivations listed in DRV, *except*
 those that are already valid (that is, it won't bother checking whether an
 item is substitutable if it's already on disk); it also knows about their
 prerequisites, unless they are themselves substitutable.
 
-Creating a single oracle (thus making a single 'substitutable-paths' call) and
+Creating a single oracle (thus making a single 'substitutable-path-info' call) and
 reusing it is much more efficient than calling 'has-substitutes?' or similar
 repeatedly, because it avoids the costs associated with launching the
 substituter many times."
@@ -318,21 +319,28 @@ substituter many times."
                                    (cons* self (dependencies drv) result)))))
                         '()
                         drv))))
-         (subst (list->set (substitutable-paths store paths))))
-    (cut set-contains? subst <>)))
+         (subst (fold (lambda (subst vhash)
+                        (vhash-cons (substitutable-path subst) subst
+                                    vhash))
+                      vlist-null
+                      (substitutable-path-info store paths))))
+    (lambda (item)
+      (match (vhash-assoc item subst)
+        (#f #f)
+        ((key . value) value)))))
 
 (define* (derivation-prerequisites-to-build store drv
                                             #:key
                                             (mode (build-mode normal))
                                             (outputs
                                              (derivation-output-names drv))
-                                            (substitutable?
+                                            (substitutable-info
                                              (substitution-oracle store
                                                                   (list drv)
                                                                   #:mode mode)))
   "Return two values: the list of derivation-inputs required to build the
 OUTPUTS of DRV and not already available in STORE, recursively, and the list
-of required store paths that can be substituted.  SUBSTITUTABLE? must be a
+of required store paths that can be substituted.  SUBSTITUTABLE-INFO must be a
 one-argument procedure similar to that returned by 'substitution-oracle'."
   (define built?
     (cut valid-path? store <>))
@@ -343,7 +351,7 @@ one-argument procedure similar to that returned by 'substitution-oracle'."
   (define input-substitutable?
     ;; Return true if and only if all of SUB-DRVS are subsitutable.  If at
     ;; least one is missing, then everything must be rebuilt.
-    (compose (cut every substitutable? <>) derivation-input-output-paths))
+    (compose (cut every substitutable-info <>) derivation-input-output-paths))
 
   (define (derivation-built? drv* sub-drvs)
     ;; In 'check' mode, assume that DRV is not built.
@@ -351,20 +359,24 @@ one-argument procedure similar to that returned by 'substitution-oracle'."
                    (eq? drv* drv)))
          (every built? (derivation-output-paths drv* sub-drvs))))
 
-  (define (derivation-substitutable? drv sub-drvs)
+  (define (derivation-substitutable-info drv sub-drvs)
     (and (substitutable-derivation? drv)
-         (every substitutable? (derivation-output-paths drv sub-drvs))))
+         (let ((info (filter-map substitutable-info
+                                 (derivation-output-paths drv sub-drvs))))
+           (and (= (length info) (length sub-drvs))
+                info))))
 
   (let loop ((drv        drv)
              (sub-drvs   outputs)
-             (build      '())
-             (substitute '()))
+             (build      '())                     ;list of <derivation-input>
+             (substitute '()))                    ;list of <substitutable>
     (cond ((derivation-built? drv sub-drvs)
            (values build substitute))
-          ((derivation-substitutable? drv sub-drvs)
-           (values build
-                   (append (derivation-output-paths drv sub-drvs)
-                           substitute)))
+          ((derivation-substitutable-info drv sub-drvs)
+           =>
+           (lambda (substitutables)
+             (values build
+                     (append substitutables substitute))))
           (else
            (let ((build  (if (substitutable-derivation? drv)
                              build
@@ -381,8 +393,9 @@ one-argument procedure similar to that returned by 'substitution-oracle'."
                     (append (append-map (lambda (input)
                                           (if (and (not (input-built? input))
                                                    (input-substitutable? input))
-                                              (derivation-input-output-paths
-                                               input)
+                                              (map substitutable-info
+                                                   (derivation-input-output-paths
+                                                    input))
                                               '()))
                                         (derivation-inputs drv))
                             substitute)
diff --git a/guix/git-download.scm b/guix/git-download.scm
index 9f6d20ee38..316835502c 100644
--- a/guix/git-download.scm
+++ b/guix/git-download.scm
@@ -146,7 +146,8 @@ absolute file name and STAT is the result of 'lstat'."
                           (line
                            (loop (cons line lines))))))
          (inodes      (map (lambda (file)
-                             (let ((stat (lstat file)))
+                             (let ((stat (lstat
+                                          (string-append directory "/" file))))
                                (cons (stat:dev stat) (stat:ino stat))))
                            files))
          (status      (close-pipe pipe)))
diff --git a/guix/licenses.scm b/guix/licenses.scm
index 8396b1a3c6..6845b89d90 100644
--- a/guix/licenses.scm
+++ b/guix/licenses.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2016, 2017 ng0 <ng0@libertad.pw>
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 Petter <petter@mykolab.ch>
+;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -37,7 +38,8 @@
             non-copyleft
             bsd-style                             ;deprecated!
             cc0
-            cc-by2.0 cc-by3.0 cc-by-sa2.0 cc-by-sa3.0 cc-by-sa4.0
+            cc-by2.0 cc-by3.0 cc-by4.0
+            cc-by-sa2.0 cc-by-sa3.0 cc-by-sa4.0
             cddl1.0
             cecill cecill-b cecill-c
             artistic2.0 clarified-artistic
@@ -181,6 +183,11 @@ at URI, which may be a file:// URI pointing the package's tree."
            "http://creativecommons.org/licenses/by-sa/2.0/"
            "Creative Commons Attribution-ShareAlike 2.0 Generic"))
 
+(define cc-by4.0
+  (license "CC-BY 4.0"
+           "http://creativecommons.org/licenses/by/4.0/"
+           "Creative Commons Attribution 4.0 Unported"))
+
 (define cc-by3.0
   (license "CC-BY 3.0"
            "http://creativecommons.org/licenses/by/3.0/"
diff --git a/guix/scripts/gc.scm b/guix/scripts/gc.scm
index 221467a108..0a9719d259 100644
--- a/guix/scripts/gc.scm
+++ b/guix/scripts/gc.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -20,7 +20,7 @@
   #:use-module (guix ui)
   #:use-module (guix scripts)
   #:use-module (guix store)
-  #:autoload   (guix build syscalls) (statfs)
+  #:autoload   (guix build syscalls) (free-disk-space)
   #:use-module (ice-9 match)
   #:use-module (ice-9 regex)
   #:use-module (srfi srfi-1)
@@ -184,9 +184,7 @@ Invoke the garbage collector.\n"))
 
   (define (ensure-free-space store space)
     ;; Attempt to have at least SPACE bytes available in STORE.
-    (let* ((fs    (statfs (%store-prefix)))
-           (free  (* (file-system-block-size fs)
-                     (file-system-blocks-available fs))))
+    (let ((free (free-disk-space (%store-prefix))))
       (if (> free space)
           (info (G_ "already ~h bytes available on ~a, nothing to do~%")
                 free (%store-prefix))
diff --git a/guix/scripts/refresh.scm b/guix/scripts/refresh.scm
index f85d6e5101..dd93e7d3e7 100644
--- a/guix/scripts/refresh.scm
+++ b/guix/scripts/refresh.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2014 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
+;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -27,6 +28,7 @@
   #:use-module (guix store)
   #:use-module (guix utils)
   #:use-module (guix packages)
+  #:use-module (guix profiles)
   #:use-module (guix upstream)
   #:use-module (guix discovery)
   #:use-module (guix graph)
@@ -79,6 +81,9 @@
         (option '(#\L "list-updaters") #f #f
                 (lambda args
                   (list-updaters-and-exit)))
+        (option '(#\m "manifest") #t #f
+                (lambda (opt name arg result)
+                  (alist-cons 'manifest arg result)))
         (option '(#\e "expression") #t #f
                 (lambda (opt name arg result)
                   (alist-cons 'expression arg result)))
@@ -125,6 +130,8 @@ specified with `--select'.\n"))
   -s, --select=SUBSET    select all the packages in SUBSET, one of
                          `core' or `non-core'"))
   (display (G_ "
+  -m, --manifest=FILE    select all the packages from the manifest in FILE"))
+  (display (G_ "
   -t, --type=UPDATER,... restrict to updates from the specified updaters
                          (e.g., 'gnu')"))
   (display (G_ "
@@ -308,6 +315,24 @@ dependent packages are rebuilt: ~{~a~^ ~}~%"
 
 
 ;;;
+;;; Manifest.
+;;;
+
+(define (manifest->packages manifest)
+  "Return the list of packages in MANIFEST."
+  (filter-map (lambda (entry)
+                (let ((item (manifest-entry-item entry)))
+                  (if (package? item) item #f)))
+              (manifest-entries manifest)))
+
+(define (packages-from-manifest manifest)
+  "Return the list of packages in loaded MANIFEST."
+  (let* ((user-module (make-user-module '((guix profiles) (gnu))))
+         (manifest    (load* manifest user-module)))
+    (manifest->packages manifest)))
+
+
+;;;
 ;;; Entry point.
 ;;;
 
@@ -378,8 +403,7 @@ update would trigger a complete rebuild."
          ;; the command line.
          (warn?           (or (assoc-ref opts 'argument)
                               (assoc-ref opts 'expression)))
-
-         (packages
+         (args-packages
           (match (filter-map (match-lambda
                                (('argument . spec)
                                 ;; Take either the specified version or the
@@ -400,7 +424,11 @@ update would trigger a complete rebuild."
                                     result))
                               '())))
             (some                                 ; user-specified packages
-             some))))
+             some)))
+         (packages
+          (match (assoc-ref opts 'manifest)
+            (#f args-packages)
+            ((? string? file) (packages-from-manifest file)))))
     (with-error-handling
       (with-store store
         (run-with-store store
diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
index 4ee15ba67d..71f30030b6 100755
--- a/guix/scripts/substitute.scm
+++ b/guix/scripts/substitute.scm
@@ -874,15 +874,7 @@ DESTINATION as a nar file.  Verify the substitute against ACL."
     (format #t "~a~%" (narinfo-hash narinfo))
 
     (format (current-error-port)
-            ;; TRANSLATORS: The second part of this message looks like
-            ;; "(4.1MiB installed)"; it shows the size of the package once
-            ;; installed.
-            (G_ "Downloading ~a~:[~*~; (~a installed)~]...~%")
-            (uri->string uri)
-            ;; Use the Nar size as an estimate of the installed size.
-            (narinfo-size narinfo)
-            (and=> (narinfo-size narinfo)
-                   (cute byte-count->string <>)))
+            (G_ "Downloading ~a...~%") (uri->string uri))
     (let*-values (((raw download-size)
                    ;; Note that Hydra currently generates Nars on the fly
                    ;; and doesn't specify a Content-Length, so
diff --git a/guix/ssh.scm b/guix/ssh.scm
index 4fb145230d..32cf6e464b 100644
--- a/guix/ssh.scm
+++ b/guix/ssh.scm
@@ -150,23 +150,44 @@ can be written."
   ;; makes a round trip every time 32 KiB have been transferred.  This
   ;; procedure instead opens a separate channel to use the remote
   ;; 'import-paths' procedure, which consumes all the data in a single round
-  ;; trip.
+  ;; trip.  This optimizes the successful case at the expense of error
+  ;; conditions: errors can only be reported once all the input has been
+  ;; consumed.
   (define import
     `(begin
-       (use-modules (guix))
-
-       (with-store store
-         (setvbuf (current-input-port) _IONBF)
-
-         ;; FIXME: Exceptions are silently swallowed.  We should report them
-         ;; somehow.
-         (import-paths store (current-input-port)))))
-
-  (open-remote-output-pipe session
-                           (string-join
-                            `("guile" "-c"
-                              ,(object->string
-                                (object->string import))))))
+       (use-modules (guix) (srfi srfi-34)
+                    (rnrs io ports) (rnrs bytevectors))
+
+       (define (consume-input port)
+         (let ((bv (make-bytevector 32768)))
+           (let loop ()
+             (let ((n (get-bytevector-n! port bv 0
+                                         (bytevector-length bv))))
+               (unless (eof-object? n)
+                 (loop))))))
+
+       ;; Upon completion, write an sexp that denotes the status.
+       (write
+        (catch #t
+          (lambda ()
+            (guard (c ((nix-protocol-error? c)
+                       ;; Consume all the input since the only time we can
+                       ;; report the error is after everything has been
+                       ;; consumed.
+                       (consume-input (current-input-port))
+                       (list 'protocol-error (nix-protocol-error-message c))))
+              (with-store store
+                (setvbuf (current-input-port) _IONBF)
+                (import-paths store (current-input-port))
+                '(success))))
+          (lambda args
+            (cons 'error args))))))
+
+  (open-remote-pipe session
+                    (string-join
+                     `("guile" "-c"
+                       ,(object->string (object->string import))))
+                    OPEN_BOTH))
 
 (define* (store-export-channel session files
                                #:key recursive?)
@@ -224,10 +245,29 @@ Return the list of store items actually sent."
     ;; mark of 'export-paths' would be enough, but in practice it's not.)
     (channel-send-eof port)
 
-    ;; Wait for completion of the remote process.
-    (let ((result (zero? (channel-get-exit-status port))))
+    ;; Wait for completion of the remote process and read the status sexp from
+    ;; PORT.
+    (let* ((result (false-if-exception (read port)))
+           (status (zero? (channel-get-exit-status port))))
       (close-port port)
-      missing)))
+      (match result
+        (('success . _)
+         missing)
+        (('protocol-error message)
+         (raise (condition
+                 (&nix-protocol-error (message message) (status 42)))))
+        (('error key args ...)
+         (raise (condition
+                 (&nix-protocol-error
+                  (message (call-with-output-string
+                             (lambda (port)
+                               (print-exception port #f key args))))
+                  (status 43)))))
+        (_
+         (raise (condition
+                 (&nix-protocol-error
+                  (message "unknown error while sending files over SSH")
+                  (status 44)))))))))
 
 (define (remote-store-session remote)
   "Return the SSH channel beneath REMOTE, a remote store as returned by
diff --git a/guix/ui.scm b/guix/ui.scm
index 9e0fa26d19..5060fd6dc7 100644
--- a/guix/ui.scm
+++ b/guix/ui.scm
@@ -38,7 +38,8 @@
   #:use-module (guix serialization)
   #:use-module ((guix build utils) #:select (mkdir-p))
   #:use-module ((guix licenses) #:select (license? license-name))
-  #:use-module ((guix build syscalls) #:select (terminal-columns))
+  #:use-module ((guix build syscalls)
+                #:select (free-disk-space terminal-columns))
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-11)
   #:use-module (srfi srfi-19)
@@ -581,6 +582,17 @@ error."
                   (derivation->output-path derivation out-name)))
                (derivation-outputs derivation))))
 
+(define (check-available-space need)
+  "Make sure at least NEED bytes are available in the store.  Otherwise emit a
+warning."
+  (let ((free (catch 'system-error
+                (lambda ()
+                  (free-disk-space (%store-prefix)))
+                (const #f))))
+    (when (and free (>= need free))
+      (warning (G_ "at least ~,1h MB needed but only ~,1h MB available in ~a~%")
+               (/ need 1e6) (/ free 1e6) (%store-prefix)))))
+
 (define* (show-what-to-build store drv
                              #:key dry-run? (use-substitutes? #t)
                              (mode (build-mode normal)))
@@ -588,7 +600,7 @@ error."
 derivations listed in DRV using MODE, a 'build-mode' value.  Return #t if
 there's something to build, #f otherwise.  When USE-SUBSTITUTES?, check and
 report what is prerequisites are available for download."
-  (define substitutable?
+  (define substitutable-info
     ;; Call 'substitutation-oracle' upfront so we don't end up launching the
     ;; substituter many times.  This makes a big difference, especially when
     ;; DRV is a long list as is the case with 'guix environment'.
@@ -600,7 +612,7 @@ report what is prerequisites are available for download."
     (or (null? (derivation-outputs drv))
         (let ((out (derivation->output-path drv))) ;XXX: assume "out" exists
           (or (valid-path? store out)
-              (substitutable? out)))))
+              (substitutable-info out)))))
 
   (let*-values (((build download)
                  (fold2 (lambda (drv build download)
@@ -608,7 +620,8 @@ report what is prerequisites are available for download."
                                         (derivation-prerequisites-to-build
                                          store drv
                                          #:mode mode
-                                         #:substitutable? substitutable?)))
+                                         #:substitutable-info
+                                         substitutable-info)))
                             (values (append b build)
                                     (append d download))))
                         '() '()
@@ -622,13 +635,26 @@ report what is prerequisites are available for download."
                  (if use-substitutes?
                      (delete-duplicates
                       (append download
-                              (remove (cut valid-path? store <>)
-                                      (append-map
-                                       substitutable-references
-                                       (substitutable-path-info store
-                                                                download)))))
+                              (filter-map (lambda (item)
+                                            (if (valid-path? store item)
+                                                #f
+                                                (substitutable-info item)))
+                                          (append-map
+                                           substitutable-references
+                                           download))))
                      download)))
-    ;; TODO: Show the installed size of DOWNLOAD.
+    (define installed-size
+      (reduce + 0 (map substitutable-nar-size download)))
+
+    (define download-size
+      (/ (reduce + 0 (map substitutable-download-size download))
+         1e6))
+
+    (define display-download-size?
+      ;; Sometimes narinfos lack information about the download size.  Only
+      ;; display when we have information for all of DOWNLOAD.
+      (not (any (compose zero? substitutable-download-size) download)))
+
     (if dry-run?
         (begin
           (format (current-error-port)
@@ -636,22 +662,43 @@ report what is prerequisites are available for download."
                       "~:[The following derivations would be built:~%~{   ~a~%~}~;~]"
                       (length build))
                   (null? build) build)
-          (format (current-error-port)
-                  (N_ "~:[The following file would be downloaded:~%~{   ~a~%~}~;~]"
-                      "~:[The following files would be downloaded:~%~{   ~a~%~}~;~]"
-                      (length download))
-                  (null? download) download))
+          (if display-download-size?
+              (format (current-error-port)
+                      ;; TRANSLATORS: "MB" is for "megabyte"; it should be
+                      ;; translated to the corresponding abbreviation.
+                      (G_ "~:[~,1h MB would be downloaded:~%~{   ~a~%~}~;~]")
+                      (null? download)
+                      download-size
+                      (map substitutable-path download))
+              (format (current-error-port)
+                      (N_ "~:[The following file would be downloaded:~%~{   ~a~%~}~;~]"
+                          "~:[The following files would be downloaded:~%~{   ~a~%~}~;~]"
+                          (length download))
+                      (null? download)
+                      (map substitutable-path download))))
         (begin
           (format (current-error-port)
                   (N_ "~:[The following derivation will be built:~%~{   ~a~%~}~;~]"
                       "~:[The following derivations will be built:~%~{   ~a~%~}~;~]"
                       (length build))
                   (null? build) build)
-          (format (current-error-port)
-                  (N_ "~:[The following file will be downloaded:~%~{   ~a~%~}~;~]"
-                      "~:[The following files will be downloaded:~%~{   ~a~%~}~;~]"
-                      (length download))
-                  (null? download) download)))
+          (if display-download-size?
+              (format (current-error-port)
+                      ;; TRANSLATORS: "MB" is for "megabyte"; it should be
+                      ;; translated to the corresponding abbreviation.
+                      (G_ "~:[~,1h MB will be downloaded:~%~{   ~a~%~}~;~]")
+                      (null? download)
+                      download-size
+                      (map substitutable-path download))
+              (format (current-error-port)
+                      (N_ "~:[The following file will be downloaded:~%~{   ~a~%~}~;~]"
+                          "~:[The following files will be downloaded:~%~{   ~a~%~}~;~]"
+                          (length download))
+                      (null? download)
+                      (map substitutable-path download)))))
+
+    (check-available-space installed-size)
+
     (pair? build)))
 
 (define show-what-to-build*
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index 9b7bb5391c..a93095dd1e 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -2449,8 +2449,11 @@ void DerivationGoal::registerOutputs()
             Hash h2 = recursive ? hashPath(ht, actualPath).first : hashFile(ht, actualPath);
             if (h != h2)
                 throw BuildError(
-                    format("output path `%1%' should have %2% hash `%3%', instead has `%4%'")
-                    % path % i->second.hashAlgo % printHash16or32(h) % printHash16or32(h2));
+                    format("%1% hash mismatch for output path `%2%'\n"
+			   "  expected: %3%\n"
+			   "  actual:   %4%")
+                    % i->second.hashAlgo % path
+		    % printHash16or32(h) % printHash16or32(h2));
         }
 
         /* Get rid of all weird permissions.  This also checks that
@@ -3096,7 +3099,9 @@ void SubstitutionGoal::finished()
             Hash expectedHash = parseHash16or32(hashType, string(expectedHashStr, n + 1));
             Hash actualHash = hashType == htSHA256 ? hash.first : hashPath(hashType, destPath).first;
             if (expectedHash != actualHash)
-                throw SubstError(format("hash mismatch in downloaded path `%1%': expected %2%, got %3%")
+                throw SubstError(format("hash mismatch in downloaded path `%1%'\n"
+					"  expected: %2%\n"
+					"  actual:   %3%")
                     % storePath % printHash(expectedHash) % printHash(actualHash));
         }
 
diff --git a/nix/nix-daemon/guix-daemon.cc b/nix/nix-daemon/guix-daemon.cc
index aa47a290d2..0d9c33d1d2 100644
--- a/nix/nix-daemon/guix-daemon.cc
+++ b/nix/nix-daemon/guix-daemon.cc
@@ -81,6 +81,8 @@ builds derivations on behalf of its clients.");
 #define GUIX_OPT_GC_KEEP_OUTPUTS 15
 #define GUIX_OPT_GC_KEEP_DERIVATIONS 16
 #define GUIX_OPT_BUILD_ROUNDS 17
+#define GUIX_OPT_TIMEOUT 18
+#define GUIX_OPT_MAX_SILENT_TIME 19
 
 static const struct argp_option options[] =
   {
@@ -91,6 +93,10 @@ static const struct argp_option options[] =
     },
     { "max-jobs", 'M', n_("N"), 0,
       n_("allow at most N build jobs") },
+    { "timeout", GUIX_OPT_TIMEOUT, n_("SECONDS"), 0,
+      n_("mark builds as failed after SECONDS of activity") },
+    { "max-silent-time", GUIX_OPT_MAX_SILENT_TIME, n_("SECONDS"), 0,
+      n_("mark builds as failed after SECONDS of silence") },
     { "disable-chroot", GUIX_OPT_DISABLE_CHROOT, 0, 0,
       n_("disable chroot builds") },
     { "chroot-directory", GUIX_OPT_CHROOT_DIR, n_("DIR"), 0,
@@ -245,6 +251,12 @@ parse_opt (int key, char *arg, struct argp_state *state)
     case 'M':
       settings.set ("build-max-jobs", arg);
       break;
+    case GUIX_OPT_TIMEOUT:
+      settings.set ("build-timeout", arg);
+      break;
+    case GUIX_OPT_MAX_SILENT_TIME:
+      settings.set ("build-max-silent-time", arg);
+      break;
     case GUIX_OPT_SYSTEM:
       settings.thisSystem = arg;
       break;
diff --git a/tests/containers.scm b/tests/containers.scm
index 0b3a4be12b..5323e5037d 100644
--- a/tests/containers.scm
+++ b/tests/containers.scm
@@ -194,11 +194,12 @@
                                    %namespaces 1
                                    (lambda ()
                                      (sleep 100))))
+            (expected (namespaces pid))
             (result (container-excursion* pid
                       (lambda ()
                         (namespaces 1)))))
        (kill pid SIGKILL)
-       (equal? result (namespaces pid))))))
+       (equal? result expected)))))
 
 (skip-if-unsupported)
 (test-equal "container-excursion*, same namespaces"
diff --git a/tests/derivations.scm b/tests/derivations.scm
index cabbf7b951..f3aad1b906 100644
--- a/tests/derivations.scm
+++ b/tests/derivations.scm
@@ -831,10 +831,10 @@
                     (derivation-prerequisites-to-build store drv))
                    ((build* download*)
                     (derivation-prerequisites-to-build store drv
-                                                       #:substitutable?
+                                                       #:substitutable-info
                                                        (const #f))))
         (and (null? build)
-             (equal? download (list output))
+             (equal? (map substitutable-path download) (list output))
              (null? download*)
              (null? build*))))))
 
@@ -879,7 +879,7 @@
           ;; See <http://bugs.gnu.org/18747>.
           (and (null? build)
                (match download
-                 (((? string? item))
+                 (((= substitutable-path item))
                   (string=? item (derivation->output-path drv))))))))))
 
 (test-assert "derivation-prerequisites-to-build in 'check' mode"
@@ -919,7 +919,7 @@
         (set! query paths)
         '())
 
-      (mock ((guix store) substitutable-paths
+      (mock ((guix store) substitutable-path-info
              record-substitutable-path-query)
 
             (let ((pred (substitution-oracle store (list drv))))
diff --git a/tests/guix-daemon.sh b/tests/guix-daemon.sh
index fde49e25a2..9186ffd585 100644
--- a/tests/guix-daemon.sh
+++ b/tests/guix-daemon.sh
@@ -145,3 +145,39 @@ guile -c '
            (exit
             (= 42 (pk (call-with-input-file (derivation->output-path drv)
                         read)))))))'
+
+
+kill "$daemon_pid"
+
+# Make sure the daemon's default 'timeout' and 'max-silent-time' settings are
+# honored.
+
+client_code='
+  (use-modules (guix) (gnu packages) (guix tests) (srfi srfi-34))
+
+  (with-store store
+    (let* ((build  (add-text-to-store store "build.sh"
+                                      "while true ; do : ; done"))
+           (bash   (add-to-store store "bash" #t "sha256"
+                                 (search-bootstrap-binary "bash"
+                                                          (%current-system))))
+           (drv    (derivation store "the-thing" bash
+                               `("-e" ,build)
+                               #:inputs `((,bash) (,build))
+                               #:env-vars `(("x" . ,(random-text))))))
+      (exit (guard (c ((nix-protocol-error? c)
+                       (->bool
+                        (string-contains (pk (nix-protocol-error-message c))
+                                         "failed"))))
+              (build-derivations store (list drv))
+              #f))))'
+
+
+for option in --max-silent-time=1 --timeout=1
+do
+    guix-daemon --listen="$socket" --disable-chroot "$option" &
+    daemon_pid=$!
+
+    GUIX_DAEMON_SOCKET="$socket" guile -c "$client_code"
+    kill "$daemon_pid"
+done
diff --git a/tests/guix-package-net.sh b/tests/guix-package-net.sh
index 1eff6abba3..927c856b23 100644
--- a/tests/guix-package-net.sh
+++ b/tests/guix-package-net.sh
@@ -49,7 +49,7 @@ profile="t-profile-$$"
 profile_alt="t-profile-alt-$$"
 rm -f "$profile"
 
-trap 'rm -f "$profile" "$profile_alt" "$profile-"[0-9]* ; rm -rf t-home-'"$$" EXIT
+trap 'rm -f "$profile" "$profile_alt" "$profile-"[0-9]* "$profile_alt-"[0-9]* ; rm -rf t-home-'"$$" EXIT
 
 
 guix package --bootstrap -p "$profile" -i guile-bootstrap