summary refs log tree commit diff
path: root/gnu/packages/patches
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches')
-rw-r--r--gnu/packages/patches/at-spi2-core-meson-compat.patch18
-rw-r--r--gnu/packages/patches/blender-2.79-newer-ffmpeg.patch80
-rw-r--r--gnu/packages/patches/blender-2.79-python-3.7-fix.patch43
-rw-r--r--gnu/packages/patches/cracklib-CVE-2016-6318.patch95
-rw-r--r--gnu/packages/patches/cracklib-fix-buffer-overflow.patch39
-rw-r--r--gnu/packages/patches/dropbear-CVE-2018-15599.patch240
-rw-r--r--gnu/packages/patches/elixir-path-length.patch15
-rw-r--r--gnu/packages/patches/knot-include-system-lmdb-header.patch34
-rw-r--r--gnu/packages/patches/libextractor-CVE-2018-20430.patch60
-rw-r--r--gnu/packages/patches/libextractor-CVE-2018-20431.patch53
-rw-r--r--gnu/packages/patches/libgit2-avoid-python.patch322
-rw-r--r--gnu/packages/patches/libgit2-oom-test.patch62
-rw-r--r--gnu/packages/patches/python-flint-includes.patch131
-rw-r--r--gnu/packages/patches/totem-meson-compat.patch14
14 files changed, 657 insertions, 549 deletions
diff --git a/gnu/packages/patches/at-spi2-core-meson-compat.patch b/gnu/packages/patches/at-spi2-core-meson-compat.patch
new file mode 100644
index 0000000000..168a31b4ed
--- /dev/null
+++ b/gnu/packages/patches/at-spi2-core-meson-compat.patch
@@ -0,0 +1,18 @@
+Fix build with Meson 0.50.0 and above.
+
+Taken from upstream repository:
+https://gitlab.gnome.org/GNOME/at-spi2-core/commit/44a812ea51223d82f21a098a2d45fcc5c329ce7a
+
+diff --git a/atspi/meson.build b/atspi/meson.build
+index b7a9357df1c4857dffa2ec123cd3073e67a07fea..2a6915d76202dabf923b50e6a8b85cbb83cb43d0 100644
+--- a/atspi/meson.build
++++ b/atspi/meson.build
+@@ -57,7 +57,7 @@ atspi_headers = [
+ 
+ atspi_includedir = join_paths(get_option('prefix'), get_option('includedir'), 'at-spi-2.0', 'atspi')
+ 
+-install_headers(atspi_headers, subdir: atspi_includedir)
++install_headers(atspi_headers, install_dir: atspi_includedir)
+ 
+ atspi_enums = gnome.mkenums('atspi-enum-types',
+                             sources: [ 'atspi-constants.h', 'atspi-types.h' ],
diff --git a/gnu/packages/patches/blender-2.79-newer-ffmpeg.patch b/gnu/packages/patches/blender-2.79-newer-ffmpeg.patch
new file mode 100644
index 0000000000..363489bc70
--- /dev/null
+++ b/gnu/packages/patches/blender-2.79-newer-ffmpeg.patch
@@ -0,0 +1,80 @@
+https://sources.debian.org/data/main/b/blender/2.79.b+dfsg0-4/debian/patches/0008-fix_building_with_latest_versions_of_FFmpeg.patch
+
+From: Bastien Montagne <montagne29@wanadoo.fr>
+Date: Tue, 8 May 2018 16:00:52 +0200
+Subject: fix_building_with_latest_versions_of_FFmpeg
+
+Some years-old deprecated stuff has now been removed.
+
+Correct solution is probably to use valid defines etc. in own code, but
+this is more FFMEPG maintainer task (since it also may change how old
+FFMPEG we do support...).
+---
+ intern/ffmpeg/ffmpeg_compat.h                  | 39 ++++++++++++++++++++++++++
+ source/blender/blenkernel/intern/writeffmpeg.c |  3 +-
+ 2 files changed, 41 insertions(+), 1 deletion(-)
+
+diff --git a/intern/ffmpeg/ffmpeg_compat.h b/intern/ffmpeg/ffmpeg_compat.h
+index 9c06c8a..f7f437c 100644
+--- a/intern/ffmpeg/ffmpeg_compat.h
++++ b/intern/ffmpeg/ffmpeg_compat.h
+@@ -109,6 +109,45 @@ int av_sample_fmt_is_planar(enum AVSampleFormat sample_fmt)
+ 
+ #endif
+ 
++/* XXX TODO Probably fix to correct modern flags in code? Not sure how old FFMPEG we want to support though,
++ * so for now this will do. */
++
++#ifndef FF_MIN_BUFFER_SIZE
++#  ifdef AV_INPUT_BUFFER_MIN_SIZE
++#    define FF_MIN_BUFFER_SIZE AV_INPUT_BUFFER_MIN_SIZE
++#  endif
++#endif
++
++#ifndef FF_INPUT_BUFFER_PADDING_SIZE
++#  ifdef AV_INPUT_BUFFER_PADDING_SIZE
++#    define FF_INPUT_BUFFER_PADDING_SIZE AV_INPUT_BUFFER_PADDING_SIZE
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_GLOBAL_HEADER
++#  ifdef AV_CODEC_FLAG_GLOBAL_HEADER
++#    define CODEC_FLAG_GLOBAL_HEADER AV_CODEC_FLAG_GLOBAL_HEADER
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_GLOBAL_HEADER
++#  ifdef AV_CODEC_FLAG_GLOBAL_HEADER
++#    define CODEC_FLAG_GLOBAL_HEADER AV_CODEC_FLAG_GLOBAL_HEADER
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_INTERLACED_DCT
++#  ifdef AV_CODEC_FLAG_INTERLACED_DCT
++#    define CODEC_FLAG_INTERLACED_DCT AV_CODEC_FLAG_INTERLACED_DCT
++#  endif
++#endif
++
++#ifndef CODEC_FLAG_INTERLACED_ME
++#  ifdef AV_CODEC_FLAG_INTERLACED_ME
++#    define CODEC_FLAG_INTERLACED_ME AV_CODEC_FLAG_INTERLACED_ME
++#  endif
++#endif
++
+ /* FFmpeg upstream 1.0 is the first who added AV_ prefix. */
+ #if LIBAVCODEC_VERSION_INT < AV_VERSION_INT(54, 59, 100)
+ #  define AV_CODEC_ID_NONE CODEC_ID_NONE
+diff --git a/source/blender/blenkernel/intern/writeffmpeg.c b/source/blender/blenkernel/intern/writeffmpeg.c
+index a19e414..04d508a 100644
+--- a/source/blender/blenkernel/intern/writeffmpeg.c
++++ b/source/blender/blenkernel/intern/writeffmpeg.c
+@@ -605,7 +605,8 @@ static AVStream *alloc_video_stream(FFMpegContext *context, RenderData *rd, int
+ 	c->rc_buffer_aggressivity = 1.0;
+ #endif
+ 
+-	c->me_method = ME_EPZS;
++	/* Deprecated and not doing anything since July 2015, deleted in recent ffmpeg */
++	//c->me_method = ME_EPZS;
+ 	
+ 	codec = avcodec_find_encoder(c->codec_id);
+ 	if (!codec)
diff --git a/gnu/packages/patches/blender-2.79-python-3.7-fix.patch b/gnu/packages/patches/blender-2.79-python-3.7-fix.patch
new file mode 100644
index 0000000000..fd1d8ba437
--- /dev/null
+++ b/gnu/packages/patches/blender-2.79-python-3.7-fix.patch
@@ -0,0 +1,43 @@
+Copied from https://git.blender.org/gitweb/gitweb.cgi/blender.git/patch/1db47a2ccd1e68994bf8140eba6cc2a26a2bc91f
+Fixes <https://bugs.gnu.org/33608>.
+
+From 1db47a2ccd1e68994bf8140eba6cc2a26a2bc91f Mon Sep 17 00:00:00 2001
+From: Campbell Barton <ideasman42@gmail.com>
+Date: Thu, 12 Jul 2018 08:28:06 +0200
+Subject: [PATCH] Fix PyRNA class registration w/ Python 3.7
+
+In Python3.7 this now raises an error.
+---
+ source/blender/python/intern/bpy_rna.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/source/blender/python/intern/bpy_rna.c b/source/blender/python/intern/bpy_rna.c
+index 9052b6f580a..80b0aa7a51b 100644
+--- a/source/blender/python/intern/bpy_rna.c
++++ b/source/blender/python/intern/bpy_rna.c
+@@ -7577,10 +7577,12 @@ static int bpy_class_validate_recursive(PointerRNA *dummyptr, StructRNA *srna, v
+ 		if (!(flag & PROP_REGISTER))
+ 			continue;
+ 
++		/* TODO(campbell): Use Python3.7x _PyObject_LookupAttr(), also in the macro below. */
+ 		identifier = RNA_property_identifier(prop);
+ 		item = PyObject_GetAttrString(py_class, identifier);
+ 
+ 		if (item == NULL) {
++			PyErr_Clear();
+ 			/* Sneaky workaround to use the class name as the bl_idname */
+ 
+ #define     BPY_REPLACEMENT_STRING(rna_attr, py_attr)                         \
+@@ -7596,6 +7598,9 @@ static int bpy_class_validate_recursive(PointerRNA *dummyptr, StructRNA *srna, v
+ 					}                                                         \
+ 					Py_DECREF(item);                                          \
+ 				}                                                             \
++				else {                                                        \
++					PyErr_Clear();                                            \
++				}                                                             \
+ 			}  /* intentionally allow else here */
+ 
+ 			if (false) {}  /* needed for macro */
+-- 
+2.20.1
+
diff --git a/gnu/packages/patches/cracklib-CVE-2016-6318.patch b/gnu/packages/patches/cracklib-CVE-2016-6318.patch
deleted file mode 100644
index 4806ecaae9..0000000000
--- a/gnu/packages/patches/cracklib-CVE-2016-6318.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-Fix CVE-2016-6318.
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318
-
-Patch copied from Red Hat:
-
-https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-6318
-https://bugzilla.redhat.com/attachment.cgi?id=1188599&action=diff
-
-It is not safe to pass words longer than STRINGSIZE further to cracklib
-so the longbuffer cannot be longer than STRINGSIZE.
-diff -up cracklib-2.9.0/lib/fascist.c.longgecos cracklib-2.9.0/lib/fascist.c
---- cracklib-2.9.0/lib/fascist.c.longgecos	2014-02-06 16:03:59.000000000 +0100
-+++ cracklib-2.9.0/lib/fascist.c	2016-08-08 12:05:40.279235815 +0200
-@@ -515,7 +515,7 @@ FascistGecosUser(char *password, const c
-     char gbuffer[STRINGSIZE];
-     char tbuffer[STRINGSIZE];
-     char *uwords[STRINGSIZE];
--    char longbuffer[STRINGSIZE * 2];
-+    char longbuffer[STRINGSIZE];
- 
-     if (gecos == NULL)
- 	gecos = "";
-@@ -596,38 +596,47 @@ FascistGecosUser(char *password, const c
-     {
- 	for (i = 0; i < j; i++)
- 	{
--	    strcpy(longbuffer, uwords[i]);
--	    strcat(longbuffer, uwords[j]);
--
--	    if (GTry(longbuffer, password))
-+	    if (strlen(uwords[i]) + strlen(uwords[j]) < STRINGSIZE)
- 	    {
--		return _("it is derived from your password entry");
--	    }
--
--	    strcpy(longbuffer, uwords[j]);
--	    strcat(longbuffer, uwords[i]);
-+		strcpy(longbuffer, uwords[i]);
-+		strcat(longbuffer, uwords[j]);
- 
--	    if (GTry(longbuffer, password))
--	    {
--		return _("it's derived from your password entry");
-+		if (GTry(longbuffer, password))
-+		{
-+		    return _("it is derived from your password entry");
-+		}
-+
-+		strcpy(longbuffer, uwords[j]);
-+		strcat(longbuffer, uwords[i]);
-+
-+		if (GTry(longbuffer, password))
-+		{
-+		   return _("it's derived from your password entry");
-+		}
- 	    }
- 
--	    longbuffer[0] = uwords[i][0];
--	    longbuffer[1] = '\0';
--	    strcat(longbuffer, uwords[j]);
--
--	    if (GTry(longbuffer, password))
-+	    if (strlen(uwords[j]) < STRINGSIZE - 1)
- 	    {
--		return _("it is derivable from your password entry");
-+		longbuffer[0] = uwords[i][0];
-+		longbuffer[1] = '\0';
-+		strcat(longbuffer, uwords[j]);
-+
-+		if (GTry(longbuffer, password))
-+		{
-+		    return _("it is derivable from your password entry");
-+		}
- 	    }
- 
--	    longbuffer[0] = uwords[j][0];
--	    longbuffer[1] = '\0';
--	    strcat(longbuffer, uwords[i]);
--
--	    if (GTry(longbuffer, password))
-+	    if (strlen(uwords[i]) < STRINGSIZE - 1)
- 	    {
--		return _("it's derivable from your password entry");
-+		longbuffer[0] = uwords[j][0];
-+		longbuffer[1] = '\0';
-+		strcat(longbuffer, uwords[i]);
-+
-+		if (GTry(longbuffer, password))
-+		{
-+		    return _("it's derivable from your password entry");
-+		}
- 	    }
- 	}
-     }
diff --git a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch b/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
deleted file mode 100644
index b1c990f282..0000000000
--- a/gnu/packages/patches/cracklib-fix-buffer-overflow.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Fix buffer overflow processing long words in Mangle().
-
-Patch adpated from upstream commit, omitting changes to 'NEWS':
-
-https://github.com/cracklib/cracklib/commit/33d7fa4585247cd2247a1ffa032ad245836c6edb
-
-From 33d7fa4585247cd2247a1ffa032ad245836c6edb Mon Sep 17 00:00:00 2001
-From: Jan Dittberner <jan@dittberner.info>
-Date: Thu, 25 Aug 2016 17:17:53 +0200
-Subject: [PATCH] Fix a buffer overflow processing long words
-
-A buffer overflow processing long words has been discovered. This commit
-applies the patch from
-https://build.opensuse.org/package/view_file/Base:System/cracklib/0004-overflow-processing-long-words.patch
-by Howard Guo.
-
-See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835386 and
-http://www.openwall.com/lists/oss-security/2016/08/23/8
----
- src/NEWS        | 1 +
- src/lib/rules.c | 5 ++---
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/lib/rules.c b/src/lib/rules.c
-index d193cc0..3a2aa46 100644
---- a/lib/rules.c
-+++ b/lib/rules.c
-@@ -434,9 +434,8 @@ Mangle(input, control)		/* returns a pointer to a controlled Mangle */
- {
-     int limit;
-     register char *ptr;
--    static char area[STRINGSIZE];
--    char area2[STRINGSIZE];
--    area[0] = '\0';
-+    static char area[STRINGSIZE * 2] = {0};
-+    char area2[STRINGSIZE * 2] = {0};
-     strcpy(area, input);
- 
-     for (ptr = control; *ptr; ptr++)
diff --git a/gnu/packages/patches/dropbear-CVE-2018-15599.patch b/gnu/packages/patches/dropbear-CVE-2018-15599.patch
deleted file mode 100644
index a474552cd2..0000000000
--- a/gnu/packages/patches/dropbear-CVE-2018-15599.patch
+++ /dev/null
@@ -1,240 +0,0 @@
-Fix CVE-2018-15599:
-
-http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15599
-
-Patch copied from upstream source repository:
-
-https://github.com/mkj/dropbear/commit/52adbb34c32d3e2e1bcdb941e20a6f81138b8248
-
-From 52adbb34c32d3e2e1bcdb941e20a6f81138b8248 Mon Sep 17 00:00:00 2001
-From: Matt Johnston <matt@ucc.asn.au>
-Date: Thu, 23 Aug 2018 23:43:12 +0800
-Subject: [PATCH] Wait to fail invalid usernames
-
----
- auth.h           |  6 +++---
- svr-auth.c       | 19 +++++--------------
- svr-authpam.c    | 26 ++++++++++++++++++++++----
- svr-authpasswd.c | 27 ++++++++++++++-------------
- svr-authpubkey.c | 11 ++++++++++-
- 5 files changed, 54 insertions(+), 35 deletions(-)
-
-diff --git a/auth.h b/auth.h
-index da498f5b..98f54683 100644
---- a/auth.h
-+++ b/auth.h
-@@ -37,9 +37,9 @@ void recv_msg_userauth_request(void);
- void send_msg_userauth_failure(int partial, int incrfail);
- void send_msg_userauth_success(void);
- void send_msg_userauth_banner(const buffer *msg);
--void svr_auth_password(void);
--void svr_auth_pubkey(void);
--void svr_auth_pam(void);
-+void svr_auth_password(int valid_user);
-+void svr_auth_pubkey(int valid_user);
-+void svr_auth_pam(int valid_user);
- 
- #if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT
- int svr_pubkey_allows_agentfwd(void);
-diff --git a/svr-auth.c b/svr-auth.c
-index c19c0901..edde86bc 100644
---- a/svr-auth.c
-+++ b/svr-auth.c
-@@ -149,10 +149,8 @@ void recv_msg_userauth_request() {
- 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
- 				strncmp(methodname, AUTH_METHOD_PASSWORD,
- 					AUTH_METHOD_PASSWORD_LEN) == 0) {
--			if (valid_user) {
--				svr_auth_password();
--				goto out;
--			}
-+			svr_auth_password(valid_user);
-+			goto out;
- 		}
- 	}
- #endif
-@@ -164,10 +162,8 @@ void recv_msg_userauth_request() {
- 		if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
- 				strncmp(methodname, AUTH_METHOD_PASSWORD,
- 					AUTH_METHOD_PASSWORD_LEN) == 0) {
--			if (valid_user) {
--				svr_auth_pam();
--				goto out;
--			}
-+			svr_auth_pam(valid_user);
-+			goto out;
- 		}
- 	}
- #endif
-@@ -177,12 +173,7 @@ void recv_msg_userauth_request() {
- 	if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
- 			strncmp(methodname, AUTH_METHOD_PUBKEY,
- 				AUTH_METHOD_PUBKEY_LEN) == 0) {
--		if (valid_user) {
--			svr_auth_pubkey();
--		} else {
--			/* pubkey has no failure delay */
--			send_msg_userauth_failure(0, 0);
--		}
-+		svr_auth_pubkey(valid_user);
- 		goto out;
- 	}
- #endif
-diff --git a/svr-authpam.c b/svr-authpam.c
-index 05e4f3e5..d201bc96 100644
---- a/svr-authpam.c
-+++ b/svr-authpam.c
-@@ -178,13 +178,14 @@ pamConvFunc(int num_msg,
-  * Keyboard interactive would be a lot nicer, but since PAM is synchronous, it
-  * gets very messy trying to send the interactive challenges, and read the
-  * interactive responses, over the network. */
--void svr_auth_pam() {
-+void svr_auth_pam(int valid_user) {
- 
- 	struct UserDataS userData = {NULL, NULL};
- 	struct pam_conv pamConv = {
- 		pamConvFunc,
- 		&userData /* submitted to pamvConvFunc as appdata_ptr */ 
- 	};
-+	const char* printable_user = NULL;
- 
- 	pam_handle_t* pamHandlep = NULL;
- 
-@@ -204,12 +205,23 @@ void svr_auth_pam() {
- 
- 	password = buf_getstring(ses.payload, &passwordlen);
- 
-+	/* We run the PAM conversation regardless of whether the username is valid
-+	in case the conversation function has an inherent delay.
-+	Use ses.authstate.username rather than ses.authstate.pw_name.
-+	After PAM succeeds we then check the valid_user flag too */
-+
- 	/* used to pass data to the PAM conversation function - don't bother with
- 	 * strdup() etc since these are touched only by our own conversation
- 	 * function (above) which takes care of it */
--	userData.user = ses.authstate.pw_name;
-+	userData.user = ses.authstate.username;
- 	userData.passwd = password;
- 
-+	if (ses.authstate.pw_name) {
-+		printable_user = ses.authstate.pw_name;
-+	} else {
-+		printable_user = "<invalid username>";
-+	}
-+
- 	/* Init pam */
- 	if ((rc = pam_start("sshd", NULL, &pamConv, &pamHandlep)) != PAM_SUCCESS) {
- 		dropbear_log(LOG_WARNING, "pam_start() failed, rc=%d, %s", 
-@@ -242,7 +254,7 @@ void svr_auth_pam() {
- 				rc, pam_strerror(pamHandlep, rc));
- 		dropbear_log(LOG_WARNING,
- 				"Bad PAM password attempt for '%s' from %s",
--				ses.authstate.pw_name,
-+				printable_user,
- 				svr_ses.addrstring);
- 		send_msg_userauth_failure(0, 1);
- 		goto cleanup;
-@@ -253,12 +265,18 @@ void svr_auth_pam() {
- 				rc, pam_strerror(pamHandlep, rc));
- 		dropbear_log(LOG_WARNING,
- 				"Bad PAM password attempt for '%s' from %s",
--				ses.authstate.pw_name,
-+				printable_user,
- 				svr_ses.addrstring);
- 		send_msg_userauth_failure(0, 1);
- 		goto cleanup;
- 	}
- 
-+	if (!valid_user) {
-+		/* PAM auth succeeded but the username isn't allowed in for another reason
-+		(checkusername() failed) */
-+		send_msg_userauth_failure(0, 1);
-+	}
-+
- 	/* successful authentication */
- 	dropbear_log(LOG_NOTICE, "PAM password auth succeeded for '%s' from %s",
- 			ses.authstate.pw_name,
-diff --git a/svr-authpasswd.c b/svr-authpasswd.c
-index bdee2aa1..69c7d8af 100644
---- a/svr-authpasswd.c
-+++ b/svr-authpasswd.c
-@@ -48,22 +48,14 @@ static int constant_time_strcmp(const char* a, const char* b) {
- 
- /* Process a password auth request, sending success or failure messages as
-  * appropriate */
--void svr_auth_password() {
-+void svr_auth_password(int valid_user) {
- 	
- 	char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */
- 	char * testcrypt = NULL; /* crypt generated from the user's password sent */
--	char * password;
-+	char * password = NULL;
- 	unsigned int passwordlen;
--
- 	unsigned int changepw;
- 
--	passwdcrypt = ses.authstate.pw_passwd;
--
--#ifdef DEBUG_HACKCRYPT
--	/* debugging crypt for non-root testing with shadows */
--	passwdcrypt = DEBUG_HACKCRYPT;
--#endif
--
- 	/* check if client wants to change password */
- 	changepw = buf_getbool(ses.payload);
- 	if (changepw) {
-@@ -73,12 +65,21 @@ void svr_auth_password() {
- 	}
- 
- 	password = buf_getstring(ses.payload, &passwordlen);
--
--	/* the first bytes of passwdcrypt are the salt */
--	testcrypt = crypt(password, passwdcrypt);
-+	if (valid_user) {
-+		/* the first bytes of passwdcrypt are the salt */
-+		passwdcrypt = ses.authstate.pw_passwd;
-+		testcrypt = crypt(password, passwdcrypt);
-+	}
- 	m_burn(password, passwordlen);
- 	m_free(password);
- 
-+	/* After we have got the payload contents we can exit if the username
-+	is invalid. Invalid users have already been logged. */
-+	if (!valid_user) {
-+		send_msg_userauth_failure(0, 1);
-+		return;
-+	}
-+
- 	if (testcrypt == NULL) {
- 		/* crypt() with an invalid salt like "!!" */
- 		dropbear_log(LOG_WARNING, "User account '%s' is locked",
-diff --git a/svr-authpubkey.c b/svr-authpubkey.c
-index aa6087c9..ff481c87 100644
---- a/svr-authpubkey.c
-+++ b/svr-authpubkey.c
-@@ -79,7 +79,7 @@ static int checkfileperm(char * filename);
- 
- /* process a pubkey auth request, sending success or failure message as
-  * appropriate */
--void svr_auth_pubkey() {
-+void svr_auth_pubkey(int valid_user) {
- 
- 	unsigned char testkey; /* whether we're just checking if a key is usable */
- 	char* algo = NULL; /* pubkey algo */
-@@ -102,6 +102,15 @@ void svr_auth_pubkey() {
- 	keybloblen = buf_getint(ses.payload);
- 	keyblob = buf_getptr(ses.payload, keybloblen);
- 
-+	if (!valid_user) {
-+		/* Return failure once we have read the contents of the packet
-+		required to validate a public key. 
-+		Avoids blind user enumeration though it isn't possible to prevent
-+		testing for user existence if the public key is known */
-+		send_msg_userauth_failure(0, 0);
-+		goto out;
-+	}
-+
- 	/* check if the key is valid */
- 	if (checkpubkey(algo, algolen, keyblob, keybloblen) == DROPBEAR_FAILURE) {
- 		send_msg_userauth_failure(0, 0);
diff --git a/gnu/packages/patches/elixir-path-length.patch b/gnu/packages/patches/elixir-path-length.patch
new file mode 100644
index 0000000000..aa8bf38829
--- /dev/null
+++ b/gnu/packages/patches/elixir-path-length.patch
@@ -0,0 +1,15 @@
+In the package definition the call to the command 'git' is substituted with
+the full path to the git executable. This change causes the mix formatting tool
+to complain that the line is too long. This workaround reformats the file
+after the substitution is made.
+
+--- a/Makefile
++++ b/Makefile
+@@ -213,6 +213,7 @@
+ TEST_ERLS = $(addprefix $(TEST_EBIN)/, $(addsuffix .beam, $(basename $(notdir $(wildcard $(TEST_ERL)/*.erl)))))
+ 
+ test_formatted: compile
++	bin/elixir bin/mix format lib/mix/lib/mix/scm/git.ex
+ 	bin/elixir bin/mix format --check-formatted
+ 
+ test_erlang: compile $(TEST_ERLS)
diff --git a/gnu/packages/patches/knot-include-system-lmdb-header.patch b/gnu/packages/patches/knot-include-system-lmdb-header.patch
new file mode 100644
index 0000000000..5c5c0beabc
--- /dev/null
+++ b/gnu/packages/patches/knot-include-system-lmdb-header.patch
@@ -0,0 +1,34 @@
+From: Tobias Geerinckx-Rice <me@tobias.gr>
+Date: Wed, 20 Mar 2019 00:08:00 +0100
+Subject: [PATCH] gnu: knot: Include system <lmdb.h>.
+
+Copied verbatim from Knot master[0].
+
+[0]: https://gitlab.labs.nic.cz/knot/knot-dns/commit/b557430cffbb1c6b30617a394b02acc514e7e536
+
+From b557430cffbb1c6b30617a394b02acc514e7e536 Mon Sep 17 00:00:00 2001
+From: Daniel Salzman <daniel.salzman@nic.cz>
+Date: Wed, 6 Mar 2019 17:35:44 +0100
+Subject: [PATCH] journal: include proper header <lmdb.h>
+
+fixes #638
+---
+ src/knot/journal/knot_lmdb.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/knot/journal/knot_lmdb.h b/src/knot/journal/knot_lmdb.h
+index 35a88845c..b1d09cbb4 100644
+--- a/src/knot/journal/knot_lmdb.h
++++ b/src/knot/journal/knot_lmdb.h
+@@ -16,7 +16,7 @@
+ 
+ #pragma once
+ 
+-#include "contrib/lmdb/lmdb.h"
++#include <lmdb.h>
+ 
+ #include <stdbool.h>
+ #include <stdlib.h>
+-- 
+2.18.1
+
diff --git a/gnu/packages/patches/libextractor-CVE-2018-20430.patch b/gnu/packages/patches/libextractor-CVE-2018-20430.patch
deleted file mode 100644
index 570cd7c006..0000000000
--- a/gnu/packages/patches/libextractor-CVE-2018-20430.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-Fix CVE-2018-20430:
-
-https://gnunet.org/bugs/view.php?id=5493
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20430
-https://security-tracker.debian.org/tracker/CVE-2018-20430
-
-Patch copied from upstream source repository:
-
-https://gnunet.org/git/libextractor.git/commit/?id=b405d707b36e0654900cba78e89f49779efea110
-
-From b405d707b36e0654900cba78e89f49779efea110 Mon Sep 17 00:00:00 2001
-From: Christian Grothoff <christian@grothoff.org>
-Date: Thu, 20 Dec 2018 22:47:53 +0100
-Subject: [PATCH] fix #5493 (out of bounds read)
-
----
- src/common/convert.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/src/common/convert.c b/src/common/convert.c
-index c0edf21..2be2108 100644
---- a/src/common/convert.c
-+++ b/src/common/convert.c
-@@ -36,8 +36,8 @@
-  *  string is returned.
-  */
- char *
--EXTRACTOR_common_convert_to_utf8 (const char *input, 
--				  size_t len, 
-+EXTRACTOR_common_convert_to_utf8 (const char *input,
-+				  size_t len,
- 				  const char *charset)
- {
- #if HAVE_ICONV
-@@ -52,7 +52,7 @@ EXTRACTOR_common_convert_to_utf8 (const char *input,
-   i = input;
-   cd = iconv_open ("UTF-8", charset);
-   if (cd == (iconv_t) - 1)
--    return strdup (i);
-+    return strndup (i, len);
-   if (len > 1024 * 1024)
-     {
-       iconv_close (cd);
-@@ -67,11 +67,11 @@ EXTRACTOR_common_convert_to_utf8 (const char *input,
-     }
-   itmp = tmp;
-   finSize = tmpSize;
--  if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == SIZE_MAX)
-+  if (iconv (cd, (char **) &input, &len, &itmp, &finSize) == ((size_t) -1))
-     {
-       iconv_close (cd);
-       free (tmp);
--      return strdup (i);
-+      return strndup (i, len);
-     }
-   ret = malloc (tmpSize - finSize + 1);
-   if (ret == NULL)
--- 
-2.20.1
-
diff --git a/gnu/packages/patches/libextractor-CVE-2018-20431.patch b/gnu/packages/patches/libextractor-CVE-2018-20431.patch
deleted file mode 100644
index 855c5ba64b..0000000000
--- a/gnu/packages/patches/libextractor-CVE-2018-20431.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-Fix CVE-2018-20431:
-
-https://gnunet.org/bugs/view.php?id=5494
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20431
-https://security-tracker.debian.org/tracker/CVE-2018-20431
-
-Patch copied from upstream source repository:
-
-https://gnunet.org/git/libextractor.git/commit/?id=489c4a540bb2c4744471441425b8932b97a153e7
-
-To apply the patch to libextractor 1.8 release tarball,
-hunk #1 which patches ChangeLog is removed. 
-
-From 489c4a540bb2c4744471441425b8932b97a153e7 Mon Sep 17 00:00:00 2001
-From: Christian Grothoff <christian@grothoff.org>
-Date: Thu, 20 Dec 2018 23:02:28 +0100
-Subject: [PATCH] fix #5494
-
----
- ChangeLog                    | 3 ++-
- src/plugins/ole2_extractor.c | 9 +++++++--
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/src/plugins/ole2_extractor.c b/src/plugins/ole2_extractor.c
-index 53fa1b9..a48b726 100644
---- a/src/plugins/ole2_extractor.c
-+++ b/src/plugins/ole2_extractor.c
-@@ -173,7 +173,7 @@ struct ProcContext
-   EXTRACTOR_MetaDataProcessor proc;
- 
-   /**
--   * Closure for 'proc'.
-+   * Closure for @e proc.
-    */
-   void *proc_cls;
- 
-@@ -213,7 +213,12 @@ process_metadata (gpointer key,
- 
-   if (G_VALUE_TYPE(gval) == G_TYPE_STRING)
-     {
--      contents = strdup (g_value_get_string (gval));
-+      const char *gvals;
-+
-+      gvals = g_value_get_string (gval);
-+      if (NULL == gvals)
-+        return;
-+      contents = strdup (gvals);
-     }
-   else
-     {
--- 
-2.20.1
-
diff --git a/gnu/packages/patches/libgit2-avoid-python.patch b/gnu/packages/patches/libgit2-avoid-python.patch
new file mode 100644
index 0000000000..b2e5141563
--- /dev/null
+++ b/gnu/packages/patches/libgit2-avoid-python.patch
@@ -0,0 +1,322 @@
+This provides a Guile reimplementation of clar's "generate.py".
+It makes it possible for us to remove Python from libgit2's build-time
+dependencies.
+libgit2 is used in order to fetch a lot of sources for guix packages.
+Both Python2 and Python3 builds acted up in the past.
+Hence this patch which makes the number of libgit2 dependencies very
+small.
+The reimplementation tries to keep as close as possible to the original
+in both structure and runtime effect.  Some things are thus overly
+convoluted just to make them the same as in the original.
+
+Both implementations basically do:
+
+grep -r 'test_.*__.*' . > clar.suite
+
+It is important that the directory traversal order of the original and
+the reimplementation stay the same.
+
+diff -ruN orig/libgit2-0.27.7/tests/CMakeLists.txt libgit2-0.27.7/tests/CMakeLists.txt
+--- orig/libgit2-0.27.7/tests/CMakeLists.txt	1970-01-01 01:00:00.000000000 +0100
++++ libgit2-0.27.7/tests/CMakeLists.txt	2019-03-04 11:13:06.640118979 +0100
+@@ -1,10 +1,3 @@
+-FIND_PACKAGE(PythonInterp)
+-
+-IF(NOT PYTHONINTERP_FOUND)
+-  MESSAGE(FATAL_ERROR "Could not find a python interpeter, which is needed to build the tests. "
+-    "Make sure python is available, or pass -DBUILD_CLAR=OFF to skip building the tests")
+-ENDIF()
+-
+ SET(CLAR_FIXTURES "${CMAKE_CURRENT_SOURCE_DIR}/resources/")
+ SET(CLAR_PATH "${CMAKE_CURRENT_SOURCE_DIR}")
+ ADD_DEFINITIONS(-DCLAR_FIXTURE_PATH=\"${CLAR_FIXTURES}\")
+@@ -21,7 +14,7 @@
+ 
+ ADD_CUSTOM_COMMAND(
+ 	OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/clar.suite
+-	COMMAND ${PYTHON_EXECUTABLE} generate.py -o "${CMAKE_CURRENT_BINARY_DIR}" -f -xonline -xstress -xperf .
++	COMMAND guile generate.scm -o "${CMAKE_CURRENT_BINARY_DIR}" -f -x online -x stress -x perf .
+ 	DEPENDS ${SRC_TEST}
+ 	WORKING_DIRECTORY ${CLAR_PATH}
+ )
+diff -ruN orig/libgit2-0.27.7/tests/generate.scm libgit2-0.27.7/tests/generate.scm
+--- orig/libgit2-0.27.7/tests/generate.scm	1970-01-01 01:00:00.000000000 +0100
++++ libgit2-0.27.7/tests/generate.scm	2019-03-04 12:18:00.688040975 +0100
+@@ -0,0 +1,277 @@
++;; -*- geiser-scheme-implementation: guile -*-
++
++;;; Implementation: Danny Milosavljevic <dannym@scratchpost.org>
++;;; Based on: Implementation in Python by Vicent Marti.
++;;; License: ISC, like the original generate.py in clar.
++
++(use-modules (ice-9 ftw))
++(use-modules (ice-9 regex))
++(use-modules (ice-9 getopt-long))
++(use-modules (ice-9 rdelim))
++(use-modules (ice-9 match))
++(use-modules (ice-9 textual-ports))
++(use-modules (srfi srfi-1))
++
++(define (render-callback cb)
++  (if cb
++      (string-append "    { \"" (assoc-ref cb "short-name") "\", &"
++                     (assoc-ref cb "symbol") " }")
++      "    { NULL, NULL }"))
++
++(define (replace needle replacement haystack)
++  "Replace all occurences of NEEDLE in HAYSTACK by REPLACEMENT.
++NEEDLE is a regular expression."
++  (regexp-substitute/global #f needle haystack 'pre replacement 'post))
++
++(define (skip-comments* text)
++  (call-with-input-string
++   text
++   (lambda (port)
++     (let loop ((result '())
++                (section #f))
++       (define (consume-char)
++         (cons (read-char port) result))
++       (define (skip-char)
++         (read-char port)
++         result)
++       (match section
++        (#f
++         (match (peek-char port)
++          (#\/ (loop (consume-char) 'almost-in-block-comment))
++          (#\" (loop (consume-char) 'in-string-literal))
++          (#\' (loop (consume-char) 'in-character-literal))
++          ((? eof-object?) result)
++          (_ (loop (consume-char) section))))
++        ('almost-in-block-comment
++         (match (peek-char port)
++          (#\* (loop (consume-char) 'in-block-comment))
++          (#\/ (loop (consume-char) 'in-line-comment))
++          ((? eof-object?) result)
++          (_ (loop (consume-char) #f))))
++        ('in-line-comment
++         (match (peek-char port)
++          (#\newline (loop (consume-char) #f))
++          ((? eof-object?) result)
++          (_ (loop (skip-char) section))))
++        ('in-block-comment
++         (match (peek-char port)
++           (#\* (loop (skip-char) 'almost-out-of-block-comment))
++           ((? eof-object?) result)
++           (_ (loop (skip-char) section))))
++        ('almost-out-of-block-comment
++         (match (peek-char port)
++           (#\/ (loop (cons (read-char port) (cons #\* result)) #f))
++           (#\* (loop (skip-char) 'almost-out-of-block-comment))
++           ((? eof-object?) result)
++           (_ (loop (skip-char) 'in-block-comment))))
++        ('in-string-literal
++         (match (peek-char port)
++           (#\\ (loop (consume-char) 'in-string-literal-escape))
++           (#\" (loop (consume-char) #f))
++           ((? eof-object?) result)
++           (_ (loop (consume-char) section))))
++        ('in-string-literal-escape
++         (match (peek-char port)
++           ((? eof-object?) result)
++           (_ (loop (consume-char) 'in-string-literal))))
++        ('in-character-literal
++         (match (peek-char port)
++           (#\\ (loop (consume-char) 'in-character-literal-escape))
++           (#\' (loop (consume-char) #f))
++           ((? eof-object?) result)
++           (_ (loop (consume-char) section))))
++        ('in-character-literal-escape
++         (match (peek-char port)
++           ((? eof-object?) result)
++           (_ (loop (consume-char) 'in-character-literal)))))))))
++
++(define (skip-comments text)
++  (list->string (reverse (skip-comments* text))))
++
++(define (maybe-only items)
++  (match items
++   ((a) a)
++   (_ #f)))
++
++(define (Module name path excludes)
++  (let* ((clean-name (replace "_" "::" name))
++         (enabled (not (any (lambda (exclude)
++                              (string-prefix? exclude clean-name))
++                            excludes))))
++    (define (parse contents)
++      (define (cons-match match prev)
++        (cons
++         `(("declaration" . ,(match:substring match 1))
++           ("symbol" . ,(match:substring match 2))
++           ("short-name" . ,(match:substring match 3)))
++         prev))
++      (let* ((contents (skip-comments contents))
++             (entries (fold-matches (make-regexp
++                                     (string-append "^(void\\s+(test_"
++                                                    name
++                                                    "__(\\w+))\\s*\\(\\s*void\\s*\\))\\s*\\{")
++                                     regexp/newline)
++                                    contents
++                                    '()
++                                    cons-match))
++             (entries (reverse entries))
++             (callbacks (filter (lambda (entry)
++                                   (match (assoc-ref entry "short-name")
++                                    ("initialize" #f)
++                                    ("cleanup" #f)
++                                    (_ #t)))
++                                entries)))
++        (if (> (length callbacks) 0)
++            `(("name" . ,name)
++              ("enabled" . ,(if enabled "1" "0"))
++              ("clean-name" . ,clean-name)
++              ("initialize" . ,(maybe-only (filter-map (lambda (entry)
++                                                      (match (assoc-ref entry "short-name")
++                                                       ("initialize" entry)
++                                                       (_ #f)))
++                                                     entries)))
++              ("cleanup" . ,(maybe-only (filter-map (lambda (entry)
++                                                   (match (assoc-ref entry "short-name")
++                                                    ("cleanup" entry)
++                                                    (_ #f)))
++                                                  entries)))
++              ("callbacks" . ,callbacks))
++            #f)))
++
++    (define (refresh path)
++      (and (file-exists? path)
++           (parse (call-with-input-file path get-string-all))))
++    (refresh path)))
++
++(define (generate-TestSuite path output excludes)
++    (define (load)
++        (define enter? (const #t))
++        (define (leaf file stat result)
++          (let* ((module-root (string-drop (dirname file)
++                                           (string-length path)))
++                 (module-root (filter-map (match-lambda
++                                           ("" #f)
++                                           (a a))
++                                          (string-split module-root #\/))))
++            (define (make-module path)
++              (let* ((name (string-join (append module-root (list (string-drop-right (basename path) (string-length ".c")))) "_"))
++                     (name (replace "-" "_" name)))
++                (Module name path excludes)))
++            (if (string-suffix? ".c" file)
++                (let ((module (make-module file)))
++                  (if module
++                      (cons module result)
++                      result))
++                result)))
++        (define (down dir stat result)
++          result)
++        (define (up file state result)
++          result)
++        (define skip (const #f))
++        (file-system-fold enter? leaf down up skip error '() path))
++
++    (define (CallbacksTemplate module)
++      (string-append "static const struct clar_func _clar_cb_"
++                     (assoc-ref module "name") "[] = {\n"
++                     (string-join (map render-callback
++                                       (assoc-ref module "callbacks"))
++                                  ",\n")
++                     "\n};\n"))
++
++    (define (DeclarationTemplate module)
++      (string-append (string-join (map (lambda (cb)
++                                         (string-append "extern "
++                                                        (assoc-ref cb "declaration")
++                                                        ";"))
++                                       (assoc-ref module "callbacks"))
++                                  "\n")
++                     "\n"
++                     (if (assoc-ref module "initialize")
++                         (string-append "extern " (assoc-ref (assoc-ref module "initialize") "declaration") ";\n")
++                         "")
++                     (if (assoc-ref module "cleanup")
++                         (string-append "extern " (assoc-ref (assoc-ref module "cleanup") "declaration") ";\n")
++                         "")))
++
++    (define (InfoTemplate module)
++      (string-append "
++    {
++        \"" (assoc-ref module "clean-name") "\",
++    " (render-callback (assoc-ref module "initialize")) ",
++    " (render-callback (assoc-ref module "cleanup")) ",
++        _clar_cb_" (assoc-ref module "name") ", "
++        (number->string (length (assoc-ref module "callbacks")))
++        ", " (assoc-ref module "enabled") "
++    }"))
++
++    (define (Write data)
++      (define (name< module-a module-b)
++        (string<? (assoc-ref module-a "name")
++                  (assoc-ref module-b "name")))
++      (define modules (sort (load) name<))
++
++      (define (suite-count)
++        (length modules))
++
++      (define (callback-count)
++        (fold + 0 (map (lambda (entry)
++                         (length (assoc-ref entry "callbacks")))
++                         modules)))
++
++      (define (display-x value)
++        (display value data))
++
++      (for-each (compose display-x DeclarationTemplate) modules)
++      (for-each (compose display-x CallbacksTemplate) modules)
++
++      (display-x "static struct clar_suite _clar_suites[] = {")
++      (display-x (string-join (map InfoTemplate modules) ","))
++      (display-x "\n};\n")
++
++      (let ((suite-count-str (number->string (suite-count)))
++            (callback-count-str (number->string (callback-count))))
++        (display-x "static const size_t _clar_suite_count = ")
++        (display-x suite-count-str)
++        (display-x ";\n")
++
++        (display-x "static const size_t _clar_callback_count = ")
++        (display-x callback-count-str)
++        (display-x ";\n")
++
++        (display (string-append "Written `clar.suite` ("
++                                callback-count-str
++                                " tests in "
++                                suite-count-str
++                                " suites)"))
++        (newline))
++      #t)
++
++    (call-with-output-file (string-append output "/clar.suite") Write))
++
++;;; main
++
++(define (main)
++  (define option-spec
++    '((force (single-char #\f) (value #f))
++      (exclude (single-char #\x) (value #t))
++      (output (single-char #\o) (value #t))
++      (help  (single-char #\h) (value #f))))
++
++  (define options (getopt-long (command-line) option-spec #:stop-at-first-non-option #t))
++  (define args (reverse (option-ref options '() '())))
++  (when (> (length args) 1)
++    (display "More than one path given\n")
++    (exit 1))
++
++  (if (< (length args) 1)
++      (set! args '(".")))
++
++  (let* ((path (car args))
++         (output (option-ref options 'output path))
++         (excluded (filter-map (match-lambda
++                                (('exclude . value) value)
++                                (_ #f))
++                               options)))
++    (generate-TestSuite path output excluded)))
++
++(main)
diff --git a/gnu/packages/patches/libgit2-oom-test.patch b/gnu/packages/patches/libgit2-oom-test.patch
deleted file mode 100644
index 9667d1c0da..0000000000
--- a/gnu/packages/patches/libgit2-oom-test.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-Fix a test failure on 32-bit platforms as reported
-at <https://github.com/libgit2/libgit2/issues/4868>.
-
-From 415a8ae9c9b6ac18f0524b6af8e58408b426457d Mon Sep 17 00:00:00 2001
-From: Edward Thomson <ethomson@edwardthomson.com>
-Date: Thu, 13 Sep 2018 13:27:07 +0100
-Subject: [PATCH] tests: don't run buf::oom on 32-bit systems
-
-On a 32-bit Linux systems, the value large enough to make malloc
-guarantee a failure is also large enough that valgrind considers it
-"fishy".  Skip this test on those systems entirely.
----
- tests/buf/oom.c | 14 +++++++++-----
- 1 file changed, 9 insertions(+), 5 deletions(-)
-
-diff --git a/tests/buf/oom.c b/tests/buf/oom.c
-index 2741a8ddf2..ec3bad9979 100644
---- a/tests/buf/oom.c
-+++ b/tests/buf/oom.c
-@@ -11,12 +11,8 @@
-  */
- #if defined(GIT_ARCH_64) && defined(__linux__)
- # define TOOBIG 0x0fffffffffffffff
--#elif defined(__linux__)
--# define TOOBIG 0x0fffffff
- #elif defined(GIT_ARCH_64)
- # define TOOBIG 0xffffffffffffff00
--#else
--# define TOOBIG 0xffffff00
- #endif
- 
- /**
-@@ -25,13 +21,18 @@
-  * will fail.  And because the git_buf_grow() wrapper always
-  * sets mark_oom, the code in git_buf_try_grow() will free
-  * the internal buffer and set it to git_buf__oom.
-- * 
-+ *
-  * We initialized the internal buffer to (the static variable)
-  * git_buf__initbuf.  The purpose of this test is to make sure
-  * that we don't try to free the static buffer.
-+ *
-+ * Skip this test entirely on 32-bit platforms; a buffer large enough
-+ * to guarantee malloc failures is so large that valgrind considers
-+ * it likely to be an error.
-  */
- void test_buf_oom__grow(void)
- {
-+#ifdef GIT_ARCH_64
- 	git_buf buf = GIT_BUF_INIT;
- 
- 	git_buf_clear(&buf);
-@@ -40,6 +41,9 @@ void test_buf_oom__grow(void)
- 	cl_assert(git_buf_oom(&buf));
- 
- 	git_buf_free(&buf);
-+#else
-+    cl_skip();
-+#endif
- }
- 
- void test_buf_oom__grow_by(void)
diff --git a/gnu/packages/patches/python-flint-includes.patch b/gnu/packages/patches/python-flint-includes.patch
new file mode 100644
index 0000000000..c0cfe94a04
--- /dev/null
+++ b/gnu/packages/patches/python-flint-includes.patch
@@ -0,0 +1,131 @@
+The following patch, authored by Andreas Enge, looks for the flint include
+files in the correct subdirectory.
+
+diff -u -r python-flint-old/src/flint.pxd python-flint-new/src/flint.pxd
+--- python-flint-old/src/flint.pxd	2019-03-19 10:26:11.055748626 +0100
++++ python-flint-new/src/flint.pxd	2019-03-19 10:35:23.269341203 +0100
+@@ -27,7 +27,7 @@
+ 
+ ctypedef long fmpz_struct
+ 
+-cdef extern from "flint.h":
++cdef extern from "flint/flint.h":
+     ctypedef void * flint_rand_t
+     void flint_randinit(flint_rand_t state)
+     void flint_randclear(flint_rand_t state)
+@@ -35,7 +35,7 @@
+     long flint_get_num_threads()
+     void flint_cleanup()
+ 
+-cdef extern from "nmod_vec.h":
++cdef extern from "flint/nmod_vec.h":
+     ctypedef struct nmod_t:
+        mp_limb_t n
+        mp_limb_t ninv
+@@ -47,7 +47,7 @@
+     mp_limb_t nmod_mul(mp_limb_t a, mp_limb_t b, nmod_t mod)
+     mp_limb_t nmod_div(mp_limb_t a, mp_limb_t b, nmod_t mod)
+ 
+-cdef extern from "nmod_poly.h":
++cdef extern from "flint/nmod_poly.h":
+     ctypedef struct nmod_poly_struct:
+         mp_ptr coeffs
+         long alloc
+@@ -129,7 +129,7 @@
+     void nmod_poly_factor_init(nmod_poly_factor_t fac)
+     void nmod_poly_factor_clear(nmod_poly_factor_t fac)
+ 
+-cdef extern from "nmod_mat.h":
++cdef extern from "flint/nmod_mat.h":
+     ctypedef struct nmod_mat_struct:
+         mp_limb_t * entries
+         long r
+@@ -178,7 +178,7 @@
+     long nmod_mat_rref(nmod_mat_t A)
+     long nmod_mat_nullspace(nmod_mat_t X, nmod_mat_t A)
+ 
+-cdef extern from "fmpz.h":
++cdef extern from "flint/fmpz.h":
+     ctypedef fmpz_struct fmpz_t[1]
+     int COEFF_IS_MPZ(fmpz_struct v)
+     void fmpz_init(fmpz_t op)
+@@ -268,7 +268,7 @@
+     void fmpz_rfac_uiui(fmpz_t r, ulong x, ulong n)
+     void fmpz_primorial(fmpz_t res, ulong n)
+ 
+-cdef extern from "fmpz_factor.h":
++cdef extern from "flint/fmpz_factor.h":
+     ctypedef struct fmpz_factor_struct:
+         int sign
+         fmpz_struct * p
+@@ -280,7 +280,7 @@
+     void fmpz_factor_clear(fmpz_factor_t factor)
+     void fmpz_factor(fmpz_factor_t factor, fmpz_t n)
+ 
+-cdef extern from "fmpz_poly.h":
++cdef extern from "flint/fmpz_poly.h":
+     ctypedef struct fmpz_poly_struct:
+         fmpz_struct * coeffs
+         long alloc
+@@ -390,14 +390,14 @@
+     void fmpz_poly_cos_minpoly(fmpz_poly_t, ulong)
+     void fmpz_poly_swinnerton_dyer(fmpz_poly_t, ulong)
+ 
+-cdef extern from "fmpz_poly_factor.h":
++cdef extern from "flint/fmpz_poly_factor.h":
+     void fmpz_poly_factor_init(fmpz_poly_factor_t fac)
+     void fmpz_poly_factor_clear(fmpz_poly_factor_t fac)
+     void fmpz_poly_factor_zassenhaus(fmpz_poly_factor_t fac, fmpz_poly_t G)
+     void fmpz_poly_factor(fmpz_poly_factor_t fac, fmpz_poly_t G)
+     void fmpz_poly_factor_squarefree(fmpz_poly_factor_t fac, fmpz_poly_t G)
+ 
+-cdef extern from "fmpz_mat.h":
++cdef extern from "flint/fmpz_mat.h":
+     ctypedef struct fmpz_mat_struct:
+         fmpz_struct * entries
+         long r
+@@ -448,7 +448,7 @@
+     void fmpz_mat_snf(fmpz_mat_t S, const fmpz_mat_t A)
+     int fmpz_mat_is_in_snf(const fmpz_mat_t A)
+ 
+-cdef extern from "fmpz_lll.h":
++cdef extern from "flint/fmpz_lll.h":
+     ctypedef struct fmpz_lll_struct:
+         double delta
+         double eta
+@@ -461,7 +461,7 @@
+     void fmpz_lll(fmpz_mat_t B, fmpz_mat_t U, const fmpz_lll_t fl)
+ 
+ 
+-cdef extern from "fmpq.h":
++cdef extern from "flint/fmpq.h":
+     ctypedef struct fmpq_struct:
+         fmpz_struct num
+         fmpz_struct den
+@@ -506,7 +506,7 @@
+     void fmpq_next_signed_minimal(fmpq_t res, fmpq_t x)
+     void fmpq_harmonic_ui(fmpq_t res, ulong n)
+ 
+-cdef extern from "fmpq_poly.h":
++cdef extern from "flint/fmpq_poly.h":
+     ctypedef struct fmpq_poly_struct:
+         fmpz_struct * coeffs
+         fmpz_t den
+@@ -620,7 +620,7 @@
+     void fmpq_poly_compose_series(fmpq_poly_t res, fmpq_poly_t poly1, fmpq_poly_t poly2, long n)
+     void fmpq_poly_revert_series(fmpq_poly_t res, fmpq_poly_t poly1, long n)
+ 
+-cdef extern from "fmpq_mat.h":
++cdef extern from "flint/fmpq_mat.h":
+     ctypedef struct fmpq_mat_struct:
+         fmpq_struct * entries
+         long r
+@@ -672,7 +672,7 @@
+     long fmpq_mat_rref(fmpq_mat_t B, fmpq_mat_t A)
+     void fmpq_mat_transpose(fmpq_mat_t B, fmpq_mat_t A)
+ 
+-cdef extern from "arith.h":
++cdef extern from "flint/arith.h":
+     void arith_number_of_partitions(fmpz_t res, ulong n)
+     int arith_moebius_mu(fmpz_t n)
+     void arith_divisor_sigma(fmpz_t v, fmpz_t n, ulong k)
diff --git a/gnu/packages/patches/totem-meson-compat.patch b/gnu/packages/patches/totem-meson-compat.patch
new file mode 100644
index 0000000000..8557908dd0
--- /dev/null
+++ b/gnu/packages/patches/totem-meson-compat.patch
@@ -0,0 +1,14 @@
+Fix an error that occurs with Meson 0.50.0 and later:
+"ERROR: Subdir keyword must not be an absolute path".
+
+--- a/src/meson.build	2019-03-15 00:10:26.882293850 +0100
++++ b/src/meson.build	2019-03-15 00:10:54.312197229 +0100
+@@ -82,7 +82,7 @@
+ 
+ install_headers(
+   headers,
+-  subdir: join_paths(totem_includedir, totem_api_path)
++  install_dir: join_paths(totem_includedir, totem_api_path)
+ )
+ 
+ libtotem_player_sources = files(