Merge branch 'master' into core-updates

132 files changed, 5604 insertions, 1825 deletions

diff --git a/doc/contributing.texi b/doc/contributing.texi
index 0073f24518..00edd47710 100644
--- a/doc/contributing.texi
+++ b/doc/contributing.texi
@@ -31,7 +31,13 @@ choice.
 @section Building from Git
 
 If you want to hack Guix itself, it is recommended to use the latest
-version from the Git repository.  When building Guix from a checkout,
+version from the Git repository:
+
+@example
+git clone https://git.savannah.gnu.org/git/guix.git
+@end example
+
+When building Guix from a checkout,
 the following packages are required in addition to those mentioned in
 the installation instructions (@pxref{Requirements}).
 
diff --git a/doc/guix.texi b/doc/guix.texi
index 6cf20aa09f..dfa1e22fcc 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -2315,6 +2315,22 @@ package builds referenced by those generations can be reclaimed.  This
 is achieved by running @code{guix package --delete-generations}
 (@pxref{Invoking guix package}).
 
+Our recommendation is to run a garbage collection periodically, or when
+you are short on disk space.  For instance, to guarantee that at least
+5@tie{}GB are available on your disk, simply run:
+
+@example
+guix gc -F 5G
+@end example
+
+It is perfectly safe to run as a non-interactive periodic job
+(@pxref{Scheduled Job Execution}, for how to set up such a job on
+GuixSD).  Running @command{guix gc} with no arguments will collect as
+much garbage as it can, but that is often inconvenient: you may find
+yourself having to rebuild or re-download software that is ``dead'' from
+the GC viewpoint but that is necessary to build other pieces of
+software---e.g., the compiler tool chain.
+
 The @command{guix gc} command has three modes of operation: it can be
 used to garbage-collect any dead files (the default), to delete specific
 files (the @code{--delete} option), to print garbage-collector
@@ -6338,6 +6354,16 @@ The available options are:
 Use substitute information from @var{urls}.
 @xref{client-substitute-urls, the same option for @code{guix build}}.
 
+@item --sort=@var{key}
+Sort lines according to @var{key}, one of the following options:
+
+@table @code
+@item closure
+the total size of the item's closure (the default);
+@item self
+the size of each item.
+@end table
+
 @item --map-file=@var{file}
 Write a graphical map of disk usage in PNG format to @var{file}.
 
@@ -6934,7 +6960,8 @@ guarantee that the store items it provides will indeed remain available
 for as long as @var{ttl}.
 
 Additionally, when @option{--cache} is used, cached entries that have
-not been accessed for @var{ttl} may be deleted.
+not been accessed for @var{ttl} and that no longer have a corresponding
+item in the store, may be deleted.
 
 @item --nar-path=@var{path}
 Use @var{path} as the prefix for the URLs of ``nar'' files
@@ -14746,6 +14773,10 @@ from source.
 @item @code{one-shot?} (default: @code{#f})
 Only evaluate specifications and build derivations once.
 
+@item @code{fallback?} (default: @code{#f})
+When substituting a pre-built binary fails, fall back to building
+packages locally.
+
 @item @code{load-path} (default: @code{'()})
 This allows users to define their own packages and make them visible to
 cuirass as in @command{guix build} command.
@@ -15921,10 +15952,10 @@ The type of a bootloader configuration declaration.
 @cindex UEFI, bootloader
 @cindex BIOS, bootloader
 The bootloader to use, as a @code{bootloader} object. For now
-@code{grub-bootloader}, @code{grub-efi-bootloader} and
-@code{extlinux-bootloader} are supported.  @code{grub-efi-bootloader},
-allows to boot on modern systems using the @dfn{Unified Extensible
-Firmware Interface} (UEFI).
+@code{grub-bootloader}, @code{grub-efi-bootloader},
+@code{extlinux-bootloader} and @code{u-boot-bootloader} are supported.
+@code{grub-efi-bootloader} allows to boot on modern systems using the
+@dfn{Unified Extensible Firmware Interface} (UEFI).
 
 Available bootloaders are described in @code{(gnu bootloader @dots{})}
 modules.
diff --git a/etc/guix-daemon.conf.in b/etc/guix-daemon.conf.in
index 09c70cde38..74706055f8 100644
--- a/etc/guix-daemon.conf.in
+++ b/etc/guix-daemon.conf.in
@@ -7,6 +7,4 @@ start on runlevel [2345]
 
 stop on runlevel [016]
 
-task
-
 exec @localstatedir@/guix/profiles/per-user/root/guix-profile/bin/guix-daemon --build-users-group=guixbuild
diff --git a/gnu/bootloader/u-boot.scm b/gnu/bootloader/u-boot.scm
new file mode 100644
index 0000000000..963b0d7597
--- /dev/null
+++ b/gnu/bootloader/u-boot.scm
@@ -0,0 +1,47 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 David Craven <david@craven.ch>
+;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader u-boot)
+  #:use-module (gnu bootloader extlinux)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu system)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (guix gexp)
+  #:use-module (guix monads)
+  #:use-module (guix records)
+  #:use-module (guix utils)
+  #:export (u-boot-bootloader))
+
+(define install-u-boot
+  #~(lambda (bootloader device mount-point)
+      (if bootloader
+        (error "Failed to install U-Boot"))))
+
+
+
+;;;
+;;; Bootloader definitions.
+;;;
+
+(define u-boot-bootloader
+  (bootloader
+   (inherit extlinux-bootloader)
+   (name 'u-boot)
+   (package #f)
+   (installer install-u-boot)))
diff --git a/gnu/build/vm.scm b/gnu/build/vm.scm
index 2d41c5756b..727494ad93 100644
--- a/gnu/build/vm.scm
+++ b/gnu/build/vm.scm
@@ -76,11 +76,14 @@
                            (qemu (qemu-command)) (memory-size 512)
                            linux initrd
                            make-disk-image?
+                           single-file-output?
                            (disk-image-size (* 100 (expt 2 20)))
                            (disk-image-format "qcow2")
                            (references-graphs '()))
   "Run BUILDER, a Scheme file, into a VM running LINUX with INITRD, and copy
-the result to OUTPUT.
+the result to OUTPUT.  If SINGLE-FILE-OUTPUT? is true, copy a single file from
+/xchg to OUTPUT.  Otherwise, copy the contents of /xchg to a new directory
+OUTPUT.
 
 When MAKE-DISK-IMAGE? is true, OUTPUT will contain a VM image of
 DISK-IMAGE-SIZE bytes resulting from the execution of BUILDER, which may
@@ -137,8 +140,17 @@ the #:references-graphs parameter of 'derivation'."
 
   ;; When MAKE-DISK-IMAGE? is true, the image is in OUTPUT already.
   (unless make-disk-image?
-    (mkdir output)
-    (copy-recursively "xchg" output)))
+    (if single-file-output?
+        (let ((graph? (lambda (name stat)
+                        (member (basename name) references-graphs))))
+          (match (find-files "xchg" (negate graph?))
+            ((result)
+             (copy-file result output))
+            (x
+             (error "did not find a single result file" x))))
+        (begin
+          (mkdir output)
+          (copy-recursively "xchg" output)))))
 
 
 ;;;
@@ -157,8 +169,8 @@ the #:references-graphs parameter of 'derivation'."
 (define (estimated-partition-size graphs)
   "Return the estimated size of a partition that can store the store items
 given by GRAPHS, a list of file names produced by #:references-graphs."
-  ;; Simply add a 20% overhead.
-  (round (* 1.2 (closure-size graphs))))
+  ;; Simply add a 25% overhead.
+  (round (* 1.25 (closure-size graphs))))
 
 (define* (initialize-partition-table device partitions
                                      #:key
@@ -354,9 +366,9 @@ SYSTEM-DIRECTORY is the name of the directory of the 'system' derivation."
       (error "failed to create GRUB EFI image"))))
 
 (define* (make-iso9660-image grub config-file os-drv target
-                             #:key (volume-id "GuixSD") (volume-uuid #f))
+                             #:key (volume-id "GuixSD_image") (volume-uuid #f))
   "Given a GRUB package, creates an iso image as TARGET, using CONFIG-FILE as
-Grub configuration and OS-DRV as the stuff in it."
+GRUB configuration and OS-DRV as the stuff in it."
   (let ((grub-mkrescue (string-append grub "/bin/grub-mkrescue")))
     (mkdir-p "/tmp/root/var/run")
     (mkdir-p "/tmp/root/run")
@@ -367,6 +379,19 @@ Grub configuration and OS-DRV as the stuff in it."
                             "var=/tmp/root/var"
                             "run=/tmp/root/run"
                             "--"
+                            ;; Store two copies of the headers.
+                            ;; The resulting ISO-9660 image has a DOS MBR and
+                            ;; one protective partition (with type 0xCD).
+                            ;; Because GuixSD only uses actual partitions
+                            ;; rather than what /proc/partitions returns, work
+                            ;; around it by storing the primary volume
+                            ;; descriptor twice, once where it should be and
+                            ;; once in the partition.
+                            ;; Allegedly, otherwise, many other GNU tools
+                            ;; (automounters etc) would also be confused by
+                            ;; the extra partition so it makes sense to
+                            ;; store two copies in any case.
+                            "-boot_image" "any" "partition_offset=16"
                             "-volid" ,(string-upcase volume-id)
                             ,@(if volume-uuid
                                   `("-volume_date" "uuid"
@@ -427,11 +452,14 @@ passing it a directory name where it is mounted."
 
         ;; Create a tiny configuration file telling the embedded grub
         ;; where to load the real thing.
+        ;; XXX This is quite fragile, and can prevent the image from booting
+        ;; when there's more than one volume with this label present.
+        ;; Reproducible almost-UUIDs could reduce the risk (not eliminate it).
         (call-with-output-file grub-config
           (lambda (port)
             (format port
                     "insmod part_msdos~@
-                    search --set=root --label GuixSD~@
+                    search --set=root --label GuixSD_image~@
                     configfile /boot/grub/grub.cfg~%")))
 
         (display "creating EFI firmware image...")
diff --git a/gnu/local.mk b/gnu/local.mk
index 8b3caac629..f01ed62ff9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -40,6 +40,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/bootloader.scm				\
   %D%/bootloader/grub.scm                       \
   %D%/bootloader/extlinux.scm                   \
+  %D%/bootloader/u-boot.scm                     \
   %D%/packages.scm				\
   %D%/packages/abduco.scm			\
   %D%/packages/abiword.scm			\
@@ -98,6 +99,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/cpio.scm				\
   %D%/packages/cpp.scm 				\
   %D%/packages/cppi.scm				\
+  %D%/packages/cran.scm				\
   %D%/packages/cross-base.scm			\
   %D%/packages/crypto.scm			\
   %D%/packages/cryptsetup.scm			\
@@ -149,6 +151,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/fonts.scm			\
   %D%/packages/fontutils.scm			\
   %D%/packages/fpga.scm				\
+  %D%/packages/forth.scm			\
   %D%/packages/freedesktop.scm			\
   %D%/packages/freeipmi.scm			\
   %D%/packages/ftp.scm				\
@@ -163,7 +166,6 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/gdb.scm				\
   %D%/packages/geo.scm				\
   %D%/packages/gettext.scm			\
-  %D%/packages/gforth.scm			\
   %D%/packages/ghostscript.scm			\
   %D%/packages/gimp.scm				\
   %D%/packages/gkrellm.scm			\
@@ -264,6 +266,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/maths.scm			\
   %D%/packages/mc.scm				\
   %D%/packages/mcrypt.scm			\
+  %D%/packages/medical.scm			\
   %D%/packages/mes.scm				\
   %D%/packages/messaging.scm			\
   %D%/packages/mingw.scm			\
@@ -327,7 +330,6 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/pv.scm				\
   %D%/packages/python.scm			\
   %D%/packages/tryton.scm			\
-  %D%/packages/qemu.scm				\
   %D%/packages/qt.scm				\
   %D%/packages/ragel.scm			\
   %D%/packages/rails.scm			\
@@ -363,6 +365,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/skribilo.scm			\
   %D%/packages/slang.scm			\
   %D%/packages/smalltalk.scm			\
+  %D%/packages/sml.scm				\
   %D%/packages/speech.scm			\
   %D%/packages/spice.scm			\
   %D%/packages/ssh.scm				\
@@ -397,6 +400,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/version-control.scm		\
   %D%/packages/video.scm			\
   %D%/packages/vim.scm				\
+  %D%/packages/virtualization.scm		\
   %D%/packages/vpn.scm				\
   %D%/packages/w3m.scm				\
   %D%/packages/wdiff.scm			\
@@ -518,7 +522,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/awesome-reproducible-png.patch		\
   %D%/packages/patches/azr3.patch				\
   %D%/packages/patches/bash-completion-directories.patch	\
-  %D%/packages/patches/bigloo-gc-shebangs.patch			\
   %D%/packages/patches/binutils-ld-new-dtags.patch		\
   %D%/packages/patches/binutils-loongson-workaround.patch	\
   %D%/packages/patches/blast+-fix-makefile.patch		\
@@ -534,6 +537,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ceph-skip-collect-sys-info-test.patch	\
   %D%/packages/patches/ceph-skip-unittest_blockdev.patch	\
   %D%/packages/patches/chicken-CVE-2017-6949.patch		\
+  %D%/packages/patches/chicken-CVE-2017-11343.patch		\
   %D%/packages/patches/chmlib-inttypes.patch			\
   %D%/packages/patches/clang-libc-search-path.patch		\
   %D%/packages/patches/clang-3.8-libc-search-path.patch		\
@@ -574,6 +578,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/emacs-source-date-epoch.patch		\
   %D%/packages/patches/eudev-rules-directory.patch		\
   %D%/packages/patches/evilwm-lost-focus-bug.patch		\
+  %D%/packages/patches/evince-CVE-2017-1000083.patch		\
   %D%/packages/patches/exim-CVE-2017-1000369.patch		\
   %D%/packages/patches/fabric-tests.patch			\
   %D%/packages/patches/fastcap-mulGlobal.patch			\
@@ -684,8 +689,10 @@ dist_patch_DATA =						\
   %D%/packages/patches/hdf-eos5-remove-gctp.patch		\
   %D%/packages/patches/hdf-eos5-fix-szip.patch			\
   %D%/packages/patches/hdf-eos5-fortrantests.patch		\
+  %D%/packages/patches/heimdal-CVE-2017-6594.patch		\
+  %D%/packages/patches/heimdal-CVE-2017-11103.patch		\
+  %D%/packages/patches/hmmer-remove-cpu-specificity.patch	\
   %D%/packages/patches/higan-remove-march-native-flag.patch	\
-  %D%/packages/patches/hop-linker-flags.patch			\
   %D%/packages/patches/hubbub-sort-entities.patch		\
   %D%/packages/patches/hurd-fix-eth-multiplexer-dependency.patch        \
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
@@ -696,6 +703,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ilmbase-fix-tests.patch			\
   %D%/packages/patches/intltool-perl-compatibility.patch	\
   %D%/packages/patches/isl-0.11.1-aarch64-support.patch	\
+  %D%/packages/patches/jacal-fix-texinfo.patch			\
   %D%/packages/patches/jbig2dec-ignore-testtest.patch		\
   %D%/packages/patches/jbig2dec-CVE-2016-9601.patch		\
   %D%/packages/patches/jbig2dec-CVE-2017-7885.patch		\
@@ -771,6 +779,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libtool-skip-tests2.patch		\
   %D%/packages/patches/libunwind-CVE-2015-3239.patch		\
   %D%/packages/patches/libunistring-gnulib-multi-core.patch	\
+  %D%/packages/patches/libusb-0.1-disable-tests.patch		\
   %D%/packages/patches/libvpx-CVE-2016-2818.patch		\
   %D%/packages/patches/libxcb-python-3.5-compat.patch		\
   %D%/packages/patches/libxml2-CVE-2016-4658.patch		\
@@ -812,6 +821,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/mesa-skip-disk-cache-test.patch		\
   %D%/packages/patches/mesa-wayland-egl-symbols-check-mips.patch	\
   %D%/packages/patches/metabat-remove-compilation-date.patch	\
+  %D%/packages/patches/metabat-fix-compilation.patch		\
   %D%/packages/patches/mhash-keygen-test-segfault.patch		\
   %D%/packages/patches/mingw-w64-5.0rc2-gcc-4.9.3.patch		\
   %D%/packages/patches/mpc123-initialize-ao.patch		\
@@ -932,17 +942,16 @@ dist_patch_DATA =						\
   %D%/packages/patches/python-statsmodels-fix-tests.patch	\
   %D%/packages/patches/python-configobj-setuptools.patch	\
   %D%/packages/patches/python-cython-fix-tests-32bit.patch	\
-  %D%/packages/patches/python-fake-factory-fix-build-32bit.patch	\
   %D%/packages/patches/python-faker-fix-build-32bit.patch	\
   %D%/packages/patches/python-pandas-skip-failing-tests.patch	\
   %D%/packages/patches/python-paste-remove-website-test.patch	\
   %D%/packages/patches/python-paste-remove-timing-test.patch	\
+  %D%/packages/patches/python-pbr-fix-man-page-support.patch	\
   %D%/packages/patches/python-pillow-freetype-2.7-test-failure.patch	\
   %D%/packages/patches/python-pygit2-disable-network-tests.patch	\
   %D%/packages/patches/python-pycrypto-CVE-2013-7459.patch	\
   %D%/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \
   %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch	\
-  %D%/packages/patches/python-pyopenssl-17.1.0-test-overflow.patch	\
   %D%/packages/patches/python2-subprocess32-disable-input-test.patch	\
   %D%/packages/patches/qemu-CVE-2017-7493.patch			\
   %D%/packages/patches/qemu-CVE-2017-8112.patch			\
@@ -950,9 +959,11 @@ dist_patch_DATA =						\
   %D%/packages/patches/qemu-CVE-2017-8379.patch			\
   %D%/packages/patches/qemu-CVE-2017-8380.patch			\
   %D%/packages/patches/qemu-CVE-2017-9524.patch			\
+  %D%/packages/patches/qemu-CVE-2017-11334.patch		\
   %D%/packages/patches/qt4-ldflags.patch			\
   %D%/packages/patches/qtscript-disable-tests.patch		\
   %D%/packages/patches/quagga-reproducible-build.patch          \
+  %D%/packages/patches/quassel-fix-tls-check.patch              \
   %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
   %D%/packages/patches/rapicorn-isnan.patch			\
   %D%/packages/patches/raptor2-heap-overflow.patch		\
@@ -983,11 +994,14 @@ dist_patch_DATA =						\
   %D%/packages/patches/slim-reset.patch				\
   %D%/packages/patches/slim-login.patch				\
   %D%/packages/patches/slurm-configure-remove-nonfree-contribs.patch \
+  %D%/packages/patches/sooperlooper-build-with-wx-30.patch 	\
   %D%/packages/patches/spice-CVE-2016-9577.patch		\
   %D%/packages/patches/spice-CVE-2016-9578-1.patch		\
   %D%/packages/patches/spice-CVE-2016-9578-2.patch		\
+  %D%/packages/patches/spice-CVE-2017-7506.patch		\
   %D%/packages/patches/steghide-fixes.patch			\
   %D%/packages/patches/superlu-dist-scotchmetis.patch		\
+  %D%/packages/patches/supertuxkart-angelscript-ftbfs.patch		\
   %D%/packages/patches/swish-e-search.patch			\
   %D%/packages/patches/swish-e-format-security.patch		\
   %D%/packages/patches/synfigstudio-fix-ui-with-gtk3.patch 	\
@@ -1038,6 +1052,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/vorbis-tools-CVE-2014-9640.patch		\
   %D%/packages/patches/vorbis-tools-CVE-2015-6749.patch		\
   %D%/packages/patches/vpnc-script.patch			\
+  %D%/packages/patches/vsearch-unbundle-cityhash.patch		\
   %D%/packages/patches/vte-CVE-2012-2738-pt1.patch			\
   %D%/packages/patches/vte-CVE-2012-2738-pt2.patch			\
   %D%/packages/patches/weechat-python.patch			\
diff --git a/gnu/packages/acct.scm b/gnu/packages/acct.scm
index c86713cb35..a0aac153b0 100644
--- a/gnu/packages/acct.scm
+++ b/gnu/packages/acct.scm
@@ -25,7 +25,7 @@
 (define-public acct
   (package
     (name "acct")
-    (version "6.6.3")
+    (version "6.6.4")
     (source
      (origin
       (method url-fetch)
@@ -33,7 +33,7 @@
                           version ".tar.gz"))
       (sha256
        (base32
-        "14x0zklwlg7cc7amlyzffqr8az3fqj1h9dyj0hvl1kpi7cr7kbjy"))))
+        "0gv6m8giazshvgpvwbng98chpas09myyfw1zr2y7hqxib0mvy5ac"))))
     (build-system gnu-build-system)
     (home-page "https://gnu.org/software/acct/")
     (synopsis "Standard login and process accounting utilities")
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 5fa9d5b06c..2f58cb3a28 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -271,7 +271,13 @@ re-executing them as necessary.")
                "05n65k4ixl85dc6rxc51b1b732gnmm8xnqi424dy9f1nz7ppb3xy"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:configure-flags '("--localstatedir=/var")
+     `(#:configure-flags '("--localstatedir=/var"
+
+                           ;; Make sure 'PATH_PROCNET_DEV' gets defined when
+                           ;; cross-compiling (by default it does not.)
+                           ,@(if (%current-target-system)
+                                 '("--with-path-procnet-dev=/proc/net/dev")
+                                 '()))
        ;; On some systems, 'libls.sh' may fail with an error such as:
        ;; "Failed to tell switch -a apart from -A".
        #:parallel-tests? #f))
@@ -300,7 +306,7 @@ hostname.")
                 "0hdpai78n63l3v3fgr3kkiqzhd0awrpfnnzz4mf7lmxdh61qb37w"))))
     (build-system gnu-build-system)
     (arguments
-     '(;; Assume System V `setpgrp (void)', which is the default on GNU
+     `(;; Assume System V `setpgrp (void)', which is the default on GNU
        ;; variants (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
        #:configure-flags
        '("--with-libpam" "ac_cv_func_setpgrp_void=yes")
@@ -310,7 +316,10 @@ hostname.")
          (add-before 'build 'set-nscd-file-name
            (lambda* (#:key inputs #:allow-other-keys)
              ;; Use the right file name for nscd.
-             (let ((libc (assoc-ref inputs "libc")))
+             (let ((libc (assoc-ref inputs
+                                    ,(if (%current-target-system)
+                                         "cross-libc"
+                                         "libc"))))
                (substitute* "lib/nscd.c"
                  (("/usr/sbin/nscd")
                   (string-append libc "/sbin/nscd"))))))
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index 8a04cfe1b3..40700cae3d 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -1136,7 +1136,7 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
 (define-public guitarix
   (package
     (name "guitarix")
-    (version "0.35.4")
+    (version "0.35.5")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -1144,7 +1144,7 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
                    version ".tar.xz"))
              (sha256
               (base32
-               "1vip4d5hc20vjkh8c9bwn92gyqcc6a1ml6hs39djp59mmybr13dp"))))
+               "00pfb6qa3jfa6qaql7isnb8srfdfmk362ygslh7y0qkm36qasmh4"))))
     (build-system waf-build-system)
     (arguments
      `(#:tests? #f ; no "check" target
@@ -2766,7 +2766,8 @@ machine-readable ASCII format.")
     (description "shntool is a multi-purpose WAVE data processing and reporting
 utility.  File formats are abstracted from its core, so it can process any file
 that contains WAVE data, compressed or not---provided there exists a format
-module to handle that particular file type.")
+module to handle that particular file type.  It can also generate CUE files, and
+use them split WAVE data into multiple files.")
     (home-page "http://etree.org/shnutils/shntool/")
     ;; 'install-sh' bears the x11 license
     (license (list license:gpl2+ license:x11))))
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index 1ef4e42015..20b375abe1 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -118,7 +118,7 @@ spying and/or modification by the server.")
 (define-public par2cmdline
   (package
     (name "par2cmdline")
-    (version "0.7.2")
+    (version "0.7.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/Parchive/par2cmdline/archive/v"
@@ -126,7 +126,7 @@ spying and/or modification by the server.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0rsrca7903g08zrifv4102gkxrhmzvgwd1sb6vw9pa00qhzsfkzs"))))
+                "0dqwarc2aw5clgpf24d9dxh43b0k0z3l6kksn30arx9bdlmrk5rx"))))
     (native-inputs
      `(("automake" ,automake)
        ("autoconf" ,autoconf)))
@@ -136,10 +136,15 @@ spying and/or modification by the server.")
        (modify-phases %standard-phases
          (add-after 'unpack 'autoreconf
            (lambda _ (zero? (system* "autoreconf" "-vfi")))))))
-    (synopsis "File verification and repair tool")
-    (description "Par2cmdline is a tool for generating RAID-like PAR2 recovery
-files using Reed-Solomon coding.  PAR2 files can be stored along side backups
-or distributed files for recovering from bitrot.")
+    (synopsis "File verification and repair tools")
+    (description "Par2cmdline uses Reed-Solomon error-correcting codes to
+generate and verify PAR2 recovery files.  These files can be distributed
+alongside the source files or stored together with back-ups to protect against
+transmission errors or @dfn{bit rot}, the degradation of storage media over
+time.
+Unlike a simple checksum, PAR2 doesn't merely detect errors: as long as the
+damage isn't too extensive (and smaller than the size of the recovery file), it
+can even repair them.")
     (home-page "https://github.com/Parchive/par2cmdline")
     (license license:gpl3+)))
 
@@ -456,13 +461,13 @@ detection, and lossless compression.")
 (define-public borg
   (package
     (name "borg")
-    (version "1.0.10")
+    (version "1.0.11")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "borgbackup" version))
               (sha256
                (base32
-                "1sarmpzwr8dhbg0hsvaclcsjfax36ssb32d9klhhah4j8kqji3wp"))
+                "14fjk5dfwmjkn7nmkbhhbrk3g1wfrn8arvqd5r9jaij534nzsvpw"))
               (modules '((guix build utils)))
               (snippet
                '(for-each
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index d42aa55560..725d91b976 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -835,23 +835,11 @@ GLIBC/HURD for a Hurd host"
          `(modify-phases ,phases
             (add-before 'configure 'fix-pwd
               (lambda _
-                ;; Use `pwd' instead of `/bin/pwd' for glibc-2.21
+                ;; Use `pwd' instead of `/bin/pwd' for glibc-2.22.
                 (substitute* "configure"
                   (("/bin/pwd") "pwd"))
                 #t))))))))
 
-(define-public glibc-2.21
-  (package
-    (inherit glibc-2.22)
-    (version "2.21")
-    (source (origin
-              (inherit (package-source glibc-2.22))
-              (uri (string-append "mirror://gnu/glibc/glibc-"
-                                  version ".tar.xz"))
-              (sha256
-               (base32
-                "1f135546j34s9bfkydmx2nhh9vwxlx60jldi80zmsnln6wj3dsxf"))))))
-
 (define-public glibc-locales
   (package
     (inherit glibc)
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 82cd1e420d..3b4cc359ee 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -248,7 +248,7 @@ structure of the predicted RNA.")
        ("python-nose" ,python2-nose)
        ("python-pysam" ,python2-pysam)))
     (inputs
-     `(("htslib" ,htslib)
+     `(("htslib" ,htslib-1.3) ; At least one test fails on htslib-1.4+.
        ("samtools" ,samtools)
        ("bwa" ,bwa)
        ("grep" ,grep)
@@ -300,7 +300,7 @@ BAM files.")
 (define-public bcftools
   (package
     (name "bcftools")
-    (version "1.3.1")
+    (version "1.5")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -308,33 +308,27 @@ BAM files.")
                     version "/bcftools-" version ".tar.bz2"))
               (sha256
                (base32
-                "095ry68vmz9q5s1scjsa698dhgyvgw5aicz24c19iwfbai07mhqj"))
+                "0093hkkvxmbwfaa7905s6185jymynvg42kq6sxv7fili11l5mxwz"))
               (modules '((guix build utils)))
               (snippet
                ;; Delete bundled htslib.
-               '(delete-file-recursively "htslib-1.3.1"))))
+               '(delete-file-recursively "htslib-1.5"))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
+       #:configure-flags (list "--with-htslib=system")
        #:make-flags
        (list
         "USE_GPL=1"
+        "LIBS=-lgsl -lgslcblas"
         (string-append "prefix=" (assoc-ref %outputs "out"))
         (string-append "HTSDIR=" (assoc-ref %build-inputs "htslib") "/include")
-        (string-append "HTSLIB=" (assoc-ref %build-inputs "htslib") "/lib/libhts.a")
+        (string-append "HTSLIB=" (assoc-ref %build-inputs "htslib") "/lib/libhts.so")
         (string-append "BGZIP=" (assoc-ref %build-inputs "htslib") "/bin/bgzip")
-        (string-append "TABIX=" (assoc-ref %build-inputs "htslib") "/bin/tabix"))
+        (string-append "TABIX=" (assoc-ref %build-inputs "htslib") "/bin/tabix")
+        (string-append "PACKAGE_VERSION=" ,version))
        #:phases
        (modify-phases %standard-phases
-         (add-after 'unpack 'patch-Makefile
-           (lambda _
-             (substitute* "Makefile"
-               ;; Do not attempt to build htslib.
-               (("^include \\$\\(HTSDIR\\)/htslib\\.mk") "")
-               ;; Link against GSL cblas.
-               (("-lcblas") "-lgslcblas"))
-             #t))
-         (delete 'configure)
          (add-before 'check 'patch-tests
            (lambda _
              (substitute* "test/test.pl"
@@ -1195,7 +1189,7 @@ errors at the end of reads.")
 (define-public bowtie
   (package
     (name "bowtie")
-    (version "2.2.9")
+    (version "2.3.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/BenLangmead/bowtie2/archive/v"
@@ -1203,7 +1197,7 @@ errors at the end of reads.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1vp5db8i7is57iwjybcdg18f5ivyzlj5g1ix1nlvxainzivhz55g"))
+                "0hwa5r9qbglppb7sz5z79rlmmddr3n51n468jb3wh8rwjgn3yr90"))
               (modules '((guix build utils)))
               (snippet
                '(substitute* "Makefile"
@@ -1211,28 +1205,28 @@ errors at the end of reads.")
                   (("-DBUILD_HOST=.*") "-DBUILD_HOST=\"\\\"guix\\\"\"")
                   (("-DBUILD_TIME=.*") "-DBUILD_TIME=\"\\\"0\\\"\"")))))
     (build-system gnu-build-system)
-    (inputs `(("perl" ,perl)
-              ("perl-clone" ,perl-clone)
-              ("perl-test-deep" ,perl-test-deep)
-              ("perl-test-simple" ,perl-test-simple)
-              ("python" ,python-2)
-              ("tbb" ,tbb)))
+    (inputs
+     `(("perl" ,perl)
+       ("perl-clone" ,perl-clone)
+       ("perl-test-deep" ,perl-test-deep)
+       ("perl-test-simple" ,perl-test-simple)
+       ("python" ,python-2)
+       ("tbb" ,tbb)
+       ("zlib" ,zlib)))
     (arguments
      '(#:make-flags
        (list "allall"
              "WITH_TBB=1"
              (string-append "prefix=" (assoc-ref %outputs "out")))
        #:phases
-       (alist-delete
-        'configure
-        (alist-replace
-         'check
-         (lambda* (#:key outputs #:allow-other-keys)
-           (system* "perl"
-                    "scripts/test/simple_tests.pl"
-                    "--bowtie2=./bowtie2"
-                    "--bowtie2-build=./bowtie2-build"))
-         %standard-phases))))
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (replace 'check
+           (lambda* (#:key outputs #:allow-other-keys)
+             (zero? (system* "perl"
+                             "scripts/test/simple_tests.pl"
+                             "--bowtie2=./bowtie2"
+                             "--bowtie2-build=./bowtie2-build")))))))
     (home-page "http://bowtie-bio.sourceforge.net/bowtie2/index.shtml")
     (synopsis "Fast and sensitive nucleotide sequence read aligner")
     (description
@@ -1424,7 +1418,7 @@ multiple sequence alignments.")
 (define-public python-pysam
   (package
     (name "python-pysam")
-    (version "0.10.0")
+    (version "0.11.2.2")
     (source (origin
               (method url-fetch)
               ;; Test data is missing on PyPi.
@@ -1434,7 +1428,7 @@ multiple sequence alignments.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1mmvn91agr238kwz7226xq0i7k84lg2nxywn9712mzj7gvgqhfy8"))
+                "1cfqdxsqs3xhacns9n0271ck6wkc76px66ddjm91wfw2jxxfklvc"))
               (modules '((guix build utils)))
               (snippet
                ;; Drop bundled htslib. TODO: Also remove samtools and bcftools.
@@ -1533,13 +1527,13 @@ UCSC genome browser.")
 (define-public python-plastid
   (package
     (name "python-plastid")
-    (version "0.4.6")
+    (version "0.4.8")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "plastid" version))
               (sha256
                (base32
-                "1sqkz5d3b9kf688mp7k771c87ins42j7j0whmkb49cb3fsg8s8lj"))))
+                "0l24dd3q66if8yj042m4s0g95n6acn7im1imqd3p6h8ns43kxhj8"))))
     (build-system python-build-system)
     (arguments
      ;; Some test files are not included.
@@ -3051,7 +3045,7 @@ manipulating HTS data.")
 (define-public htslib
   (package
     (name "htslib")
-    (version "1.3.1")
+    (version "1.5")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3059,7 +3053,7 @@ manipulating HTS data.")
                     version "/htslib-" version ".tar.bz2"))
               (sha256
                (base32
-                "1rja282fwdc25ql6izkhdyh8ppw8x2fs0w0js78zgkmqjlikmma9"))))
+                "0bcjmnbwp2bib1z1bkrp95w9v2syzdwdfqww10mkb1hxlmg52ax0"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -3071,7 +3065,9 @@ manipulating HTS data.")
               (("/bin/bash") (which "bash")))
             #t)))))
     (inputs
-     `(("zlib" ,zlib)))
+     `(("openssl" ,openssl)
+       ("curl" ,curl)
+       ("zlib" ,zlib)))
     (native-inputs
      `(("perl" ,perl)))
     (home-page "http://www.htslib.org")
@@ -3083,6 +3079,20 @@ data.  It also provides the bgzip, htsfile, and tabix utilities.")
     ;; the rest is released under the Expat license
     (license (list license:expat license:bsd-3))))
 
+;; This package should be removed once no packages rely upon it.
+(define htslib-1.3
+  (package
+    (inherit htslib)
+    (version "1.3.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/samtools/htslib/releases/download/"
+                    version "/htslib-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "1rja282fwdc25ql6izkhdyh8ppw8x2fs0w0js78zgkmqjlikmma9"))))))
+
 (define-public idr
   (package
     (name "idr")
@@ -3457,23 +3467,20 @@ form of assemblies or reads.")
                    license:cpl1.0))))     ; Open Bloom Filter
 
 (define-public metabat
-  ;; We package from a git commit because compilation of the released version
-  ;; fails.
-  (let ((commit "cbdca756993e66ae57e50a27970595dda9cbde1b"))
-    (package
-      (name "metabat")
-      (version (string-append "0.32.4-1." (string-take commit 8)))
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-               (url "https://bitbucket.org/berkeleylab/metabat.git")
-               (commit commit)))
-         (file-name (string-append name "-" version))
-         (sha256
-          (base32
-           "0byia8nsip6zvc4ha0qkxkxxyjf4x7jcvy48q2dvb0pzr989syzr"))
-         (patches (search-patches "metabat-remove-compilation-date.patch"))))
+  (package
+    (name "metabat")
+    (version "2.11.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://bitbucket.org/berkeleylab/metabat/get/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0ll00l81aflscgggs5nfhj12cbvdiz3gg7f7n5f537a3xhx60vn9"))
+       (patches (search-patches "metabat-remove-compilation-date.patch"
+                                "metabat-fix-compilation.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -3490,35 +3497,35 @@ form of assemblies or reads.")
                 "#include \"htslib/kseq.h\""))
              #t))
          (add-after 'unpack 'fix-scons
-            (lambda* (#:key inputs #:allow-other-keys)
-              (substitute* "SConstruct"
-                (("^htslib_dir = 'samtools'")
-                 (string-append "hitslib_dir = '"
-                                (assoc-ref inputs "htslib")
-                                "'"))
-                (("^samtools_dir = 'samtools'")
-                 (string-append "samtools_dir = '"
-                                (assoc-ref inputs "htslib")
-                                "'"))
-                (("^findStaticOrShared\\('bam', hts_lib")
-                 (string-append "findStaticOrShared('bam', '"
-                                (assoc-ref inputs "samtools")
-                                "/lib'"))
-                ;; Do not distribute README.
-                (("^env\\.Install\\(idir_prefix, 'README\\.md'\\)") ""))
-              #t))
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "SConstruct"
+               (("^htslib_dir += 'samtools'")
+                (string-append "htslib_dir = '"
+                               (assoc-ref inputs "htslib")
+                               "'"))
+               (("^samtools_dir = 'samtools'")
+                (string-append "samtools_dir = '"
+                               (assoc-ref inputs "samtools")
+                               "'"))
+               (("^findStaticOrShared\\('bam', hts_lib")
+                (string-append "findStaticOrShared('bam', '"
+                               (assoc-ref inputs "samtools")
+                               "/lib'"))
+               ;; Do not distribute README.
+               (("^env\\.Install\\(idir_prefix, 'README\\.md'\\)") ""))
+             #t))
          (delete 'configure)
          (replace 'build
-                  (lambda* (#:key inputs outputs #:allow-other-keys)
-                    (mkdir (assoc-ref outputs "out"))
-                    (zero? (system* "scons"
-                                    (string-append
-                                     "PREFIX="
-                                     (assoc-ref outputs "out"))
-                                    (string-append
-                                     "BOOST_ROOT="
-                                     (assoc-ref inputs "boost"))
-                                    "install"))))
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (mkdir (assoc-ref outputs "out"))
+             (zero? (system* "scons"
+                             (string-append
+                              "PREFIX="
+                              (assoc-ref outputs "out"))
+                             (string-append
+                              "BOOST_ROOT="
+                              (assoc-ref inputs "boost"))
+                             "install"))))
          ;; Check and install are carried out during build phase.
          (delete 'check)
          (delete 'install))))
@@ -3539,8 +3546,8 @@ sequences to deconvolute complex microbial communities, or metagenome binning,
 enables the study of individual organisms and their interactions.  MetaBAT is
 an automated metagenome binning software, which integrates empirical
 probabilistic distances of genome abundance and tetranucleotide frequency.")
-   (license (license:non-copyleft "file://license.txt"
-                                  "See license.txt in the distribution.")))))
+    (license (license:non-copyleft "file://license.txt"
+                                   "See license.txt in the distribution."))))
 
 (define-public minced
   (package
@@ -4320,6 +4327,8 @@ extremely diverse sets of genomes.")
     (description
      "RAxML is a tool for phylogenetic analysis and post-analysis of large
 phylogenies.")
+    ;; The source includes x86 specific code
+    (supported-systems '("x86_64-linux" "i686-linux"))
     (license license:gpl2+)))
 
 (define-public rsem
@@ -4512,7 +4521,7 @@ to the user's query of interest.")
 (define-public samtools
   (package
     (name "samtools")
-    (version "1.3.1")
+    (version "1.5")
     (source
      (origin
        (method url-fetch)
@@ -4521,7 +4530,7 @@ to the user's query of interest.")
                        version "/samtools-" version ".tar.bz2"))
        (sha256
         (base32
-         "0znnnxc467jbf1as2dpskrjhfh8mbll760j6w6rdkwlwbqsp8gbc"))))
+         "1xidmv0jmfy7l0kb32hdnlshcxgzi1hmygvig0cqrq1fhckdlhl5"))))
     (build-system gnu-build-system)
     (arguments
      `(#:modules ((ice-9 ftw)
@@ -4529,36 +4538,35 @@ to the user's query of interest.")
                   (guix build gnu-build-system)
                   (guix build utils))
        #:make-flags (list (string-append "prefix=" (assoc-ref %outputs "out")))
-       #:configure-flags (list "--with-ncurses")
+       #:configure-flags (list "--with-ncurses" "--with-htslib=system")
        #:phases
-       (alist-cons-after
-        'unpack 'patch-tests
-        (lambda _
-          (substitute* "test/test.pl"
-            ;; The test script calls out to /bin/bash
-            (("/bin/bash") (which "bash")))
-          #t)
-        (alist-cons-after
-         'install 'install-library
-         (lambda* (#:key outputs #:allow-other-keys)
-           (let ((lib (string-append (assoc-ref outputs "out") "/lib")))
-             (install-file "libbam.a" lib)
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-tests
+           (lambda _
+             (substitute* "test/test.pl"
+               ;; The test script calls out to /bin/bash
+               (("/bin/bash") (which "bash")))
              #t))
-         (alist-cons-after
-          'install 'install-headers
-          (lambda* (#:key outputs #:allow-other-keys)
-            (let ((include (string-append (assoc-ref outputs "out")
-                                          "/include/samtools/")))
-              (for-each (lambda (file)
-                          (install-file file include))
-                        (scandir "." (lambda (name) (string-match "\\.h$" name))))
-              #t))
-          %standard-phases)))))
+         (add-after 'install 'install-library
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((lib (string-append (assoc-ref outputs "out") "/lib")))
+               (install-file "libbam.a" lib)
+               #t)))
+         (add-after 'install 'install-headers
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((include (string-append (assoc-ref outputs "out")
+                                           "/include/samtools/")))
+               (for-each (lambda (file)
+                           (install-file file include))
+                         (scandir "." (lambda (name) (string-match "\\.h$" name))))
+               #t))))))
     (native-inputs `(("pkg-config" ,pkg-config)))
-    (inputs `(("ncurses" ,ncurses)
-              ("perl" ,perl)
-              ("python" ,python)
-              ("zlib" ,zlib)))
+    (inputs
+     `(("htslib" ,htslib)
+       ("ncurses" ,ncurses)
+       ("perl" ,perl)
+       ("python" ,python)
+       ("zlib" ,zlib)))
     (home-page "http://samtools.sourceforge.net")
     (synopsis "Utilities to efficiently manipulate nucleotide sequence alignments")
     (description
@@ -5316,6 +5324,8 @@ and operational taxonomic unit (OTU) picking of next generation
 sequencing (NGS) reads.  The core algorithm is based on approximate seeds and
 allows for fast and sensitive analyses of nucleotide sequences.  The main
 application of SortMeRNA is filtering rRNA from metatranscriptomic data.")
+    ;; The source includes x86 specific code
+    (supported-systems '("x86_64-linux" "i686-linux"))
     (license license:lgpl3)))
 
 (define-public star
@@ -6528,13 +6538,13 @@ abnormal copy number.")
 (define-public r-s4vectors
   (package
     (name "r-s4vectors")
-    (version "0.14.0")
+    (version "0.14.3")
     (source (origin
               (method url-fetch)
               (uri (bioconductor-uri "S4Vectors" version))
               (sha256
                (base32
-                "0ywwrs4d752xfk0p0w122kvi0xvp6nmxnyynchbsa8zciqymhgv8"))))
+                "1r7s4pfw026qazzic090mhk8d9m39j2nwl87dyqcpdylyq7gq5qs"))))
     (properties
      `((upstream-name . "S4Vectors")))
     (build-system r-build-system)
@@ -6780,13 +6790,13 @@ different technologies, including microarrays, RNA-seq, and quantitative PCR.")
 (define-public r-genomicranges
   (package
     (name "r-genomicranges")
-    (version "1.28.0")
+    (version "1.28.4")
     (source (origin
               (method url-fetch)
               (uri (bioconductor-uri "GenomicRanges" version))
               (sha256
                (base32
-                "10x9zx0b7j05d1j6p0xs4q4f4wzbhf3rq64wzi9cgv7f44q43a5n"))))
+                "1y15kg1q81h8rmga83ljiwr8whkajcargfjiljr212d6if17ys1z"))))
     (properties
      `((upstream-name . "GenomicRanges")))
     (build-system r-build-system)
@@ -7559,7 +7569,7 @@ Stephens (1990).")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1y0nqpk8cw5a34sd9hmin3z4v7iqm6hf6l22cl81vlbxqbjibxc8"))))
+                "0479qx4bapgcp5chj10a63chk0s28x9cx1gamz3f5m3yd7jzwcf2"))))
     (properties
      `((upstream-name . "BSgenome.Hsapiens.UCSC.hg19")))
     (build-system r-build-system)
diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index 76dad2923e..53cf7741a9 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -40,8 +40,8 @@
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages python)
-  #:use-module (gnu packages qemu)
   #:use-module (gnu packages texinfo)
+  #:use-module (gnu packages virtualization)
   #:use-module (guix build-system gnu)
   #:use-module (guix download)
   #:use-module (guix git-download)
diff --git a/gnu/packages/build-tools.scm b/gnu/packages/build-tools.scm
index 66f46433f9..353c9c8efb 100644
--- a/gnu/packages/build-tools.scm
+++ b/gnu/packages/build-tools.scm
@@ -23,6 +23,7 @@
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (gnu packages)
+  #:use-module (gnu packages compression)
   #:use-module (gnu packages python)
   #:use-module (gnu packages ninja)
   #:use-module (guix build-system gnu)
@@ -69,7 +70,7 @@ makes a few sacrifices to acquire fast full and incremental build times.")
 (define-public meson
   (package
     (name "meson")
-    (version "0.40.1")
+    (version "0.41.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/mesonbuild/meson/"
@@ -77,7 +78,7 @@ makes a few sacrifices to acquire fast full and incremental build times.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0yl6iryh89nn6hzhwv7kg16ki1chh9h0x1yk1y130h87iq42a35r"))))
+                "12ygjh1dxi8z06nl704rfb6zj0m2zjqp279nymfgzfgy5zq032d4"))))
     (build-system python-build-system)
     (inputs `(("ninja", ninja)))
     (home-page "https://mesonbuild.com/")
@@ -90,3 +91,37 @@ Autoconf/Automake/make combo.  Build specifications, also known as @dfn{Meson
 files}, are written in a custom domain-specific language (DSL) that resembles
 Python.")
     (license license:asl2.0)))
+
+(define-public premake4
+  (package
+    (name "premake")
+    (version "4.3")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/premake/Premake/"
+                                  version "/premake-" version "-src.zip"))
+              (sha256
+               (base32
+                "1017rd0wsjfyq2jvpjjhpszaa7kmig6q1nimw76qx3cjz2868lrn"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("unzip" ,unzip))) ; for unpacking the source
+    (arguments
+     `(#:make-flags '("CC=gcc")
+       #:tests? #f ; No test suite
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (add-after 'unpack 'enter-source
+           (lambda _ (chdir "build/gmake.unix") #t))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (install-file "../../bin/release/premake4"
+                           (string-append (assoc-ref outputs "out") "/bin"))
+             #t)))))
+    (synopsis "Portable software build tool")
+    (description "@code{premake4} is a command line utility that reads a
+scripted definition of a software project and outputs @file{Makefile}s or
+other lower-level build files.")
+    (home-page "https://premake.github.io")
+    (license license:bsd-3)))
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
new file mode 100644
index 0000000000..9ebfbbed2d
--- /dev/null
+++ b/gnu/packages/cran.scm
@@ -0,0 +1,44 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2015, 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages cran)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix utils)
+  #:use-module (guix build-system r))
+
+(define-public r-colorspace
+  (package
+    (name "r-colorspace")
+    (version "1.3-2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "colorspace" version))
+       (sha256
+        (base32 "0d1ya7hx4y58n5ivwmdmq2zgh0g2sbv7ykh13n85c1355csd57yx"))))
+    (build-system r-build-system)
+    (home-page "http://cran.r-project.org/web/packages/colorspace")
+    (synopsis "Color space manipulation")
+    (description
+     "This package carries out a mapping between assorted color spaces
+including RGB, HSV, HLS, CIEXYZ, CIELUV, HCL (polar CIELUV), CIELAB and polar
+CIELAB.  Qualitative, sequential, and diverging color palettes based on HCL
+colors are provided.")
+    (license license:bsd-3)))
diff --git a/gnu/packages/crypto.scm b/gnu/packages/crypto.scm
index 6f02d8691d..d02bc20f20 100644
--- a/gnu/packages/crypto.scm
+++ b/gnu/packages/crypto.scm
@@ -57,7 +57,7 @@
 (define-public libsodium
   (package
     (name "libsodium")
-    (version "1.0.12")
+    (version "1.0.13")
     (source (origin
             (method url-fetch)
             (uri (list (string-append
@@ -68,7 +68,7 @@
                         "releases/old/libsodium-" version ".tar.gz")))
             (sha256
              (base32
-              "159givfh5jgli3cifxgssivkklfyfq6lzyjgrx8h4jx5ncdqyr5q"))))
+              "1z93wfg4k5svg8yck6cgdr6ysj91kbpn03nyzwxanncy3b5sq4ww"))))
     (build-system gnu-build-system)
     (synopsis "Portable NaCl-based crypto library")
     (description
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index cb852e7268..af06ec43f0 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -339,14 +339,14 @@ device-specific programs to convert and print many types of files.")
 (define-public hplip
   (package
     (name "hplip")
-    (version "3.16.11")
+    (version "3.17.6")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/hplip/hplip/" version
                                   "/hplip-" version ".tar.gz"))
               (sha256
                (base32
-                "094vkyr0rjng72m13dgr824cdl7q20x23qjxzih4w7l9njn0rqpn"))))
+                "0zhhnp3ksd9i2maaqrsjn4p3y7im3llgylp2y8qgmqypm8s7ha40"))))
     (build-system gnu-build-system)
     (home-page "http://hplipopensource.com/")
     (synopsis "HP Printer Drivers")
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 4aafba02f1..3caada25bd 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -293,7 +293,7 @@ mapping from string keys to string values.")
 (define-public mysql
   (package
     (name "mysql")
-    (version "5.7.18")
+    (version "5.7.19")
     (source (origin
              (method url-fetch)
              (uri (list (string-append
@@ -305,7 +305,7 @@ mapping from string keys to string values.")
                           name "-" version ".tar.gz")))
              (sha256
               (base32
-               "18m1mr55k9zmvnyqs0wr50csqsz3scs09fykh60wsml6c3np2p8b"))))
+               "1c8y54yk756179nx4dgg79dijmjdq5n8l057cnqsg70pjdpyfl9y"))))
     (build-system cmake-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/debug.scm b/gnu/packages/debug.scm
index 27193c8bba..34c1061418 100644
--- a/gnu/packages/debug.scm
+++ b/gnu/packages/debug.scm
@@ -32,7 +32,7 @@
   #:use-module (gnu packages llvm)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pretty-print)
-  #:use-module (gnu packages qemu)
+  #:use-module (gnu packages virtualization)
   #:use-module (ice-9 match)
   #:use-module (srfi srfi-1))
 
diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index e9fb7cc496..ccb13d4fec 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -443,17 +443,17 @@ served by AS112.  Stub and forward zones are supported.")
 (define-public yadifa
   (package
     (name "yadifa")
-    (version "2.2.4")
+    (version "2.2.5")
     (source
-     (let ((revision "6924"))
+     (let ((build "6937"))
        (origin
          (method url-fetch)
          (uri
           (string-append "http://cdn.yadifa.eu/sites/default/files/releases/"
-                         name "-" version "-" revision ".tar.gz"))
+                         name "-" version "-" build ".tar.gz"))
          (sha256
           (base32
-           "060ydcfn9876bs6p5xi3p1k20ca547f4jck25r5x1hnxjlv7ss03")))))
+           "146fs52izf6dfwsxal3srpwin2yyl41g31cy4pyvbi5mqy2craj7")))))
     (build-system gnu-build-system)
     (native-inputs
      `(("which" ,which)))
@@ -470,10 +470,7 @@ served by AS112.  Stub and forward zones are supported.")
                                "--enable-shared"        "--disable-static"
                                "--enable-messages"      "--enable-ctrl"
                                "--enable-nsec"          "--enable-nsec3"
-                               "--enable-tsig"          "--enable-caching"
-                               ;; NSID is a rarely-used debugging aid, that also
-                               ;; causes the build to fail. Just disable it.
-                               "--disable-nsid")))
+                               "--enable-tsig"          "--enable-caching")))
     (home-page "http://www.yadifa.eu/")
     (synopsis "Authoritative DNS name server")
     (description "YADIFA is an authoritative name server for the @dfn{Domain
@@ -486,14 +483,14 @@ Extensions} (DNSSEC).")
 (define-public knot
   (package
     (name "knot")
-    (version "2.5.2")
+    (version "2.5.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://secure.nic.cz/files/knot-dns/"
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1sgmw8k9qccc7bgxbwrvahdinj1bjq90iza55rxj199mxsj72ri8"))
+                "13lxxnnw0v7s0q648grz87bwlfwjh5sfbj1qax7jdklalqqy52np"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 75122af8b3..43de130574 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -2514,6 +2514,35 @@ number.")
 @code{org-mode} to be rendered as UTF-8 characters.")
     (license license:gpl3+)))
 
+(define-public emacs-org-pomodoro
+  (package
+    (name "emacs-org-pomodoro")
+    (version "2.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "https://github.com/lolownia/org-pomodoro/archive/"
+             version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1jalsggw3q5kvj353f84x4nl04a5vmq07h75ggppy1627lb31zm4"))))
+    (build-system emacs-build-system)
+    (propagated-inputs
+     `(("emacs-alert" ,emacs-alert)))
+    (home-page "https://github.com/lolownia/org-pomodoro")
+    (synopsis "Pomodoro technique for org-mode")
+    (description "@code{emacs-org-pomodoro} adds very basic support for
+Pomodoro technique in Emacs org-mode.
+
+Run @code{M-x org-pomodoro} for the task at point or select one of the
+last tasks that you clocked time for.  Each clocked-in pomodoro starts
+a timer of 25 minutes and after each pomodoro a break timer of 5
+minutes is started automatically.  Every 4 breaks a long break is
+started with 20 minutes.  All values are customizable.")
+    (license license:gpl3+)))
+
 (define-public emacs-org-trello
   (package
     (name "emacs-org-trello")
@@ -2586,14 +2615,14 @@ package provides a light and a dark variant.")
 (define-public emacs-ahungry-theme
   (package
     (name "emacs-ahungry-theme")
-    (version "1.3.0")
+    (version "1.4.0")
     (source
      (origin (method url-fetch)
              (uri (string-append "https://elpa.gnu.org/packages/ahungry-theme-"
                                  version ".tar"))
              (sha256
               (base32
-               "1p2zaq0s4bbl5cx6wyab24wamw7m0mysb0v47dqjmnvfc25z84rq"))))
+               "1n8k12mfn01f20j0pyd7ycj77x0y3a008xc94frklaaqjc0v26s4"))))
     (build-system emacs-build-system)
     (home-page "https://github.com/ahungry/color-theme-ahungry")
     (synopsis "Ahungry color theme for Emacs")
diff --git a/gnu/packages/enlightenment.scm b/gnu/packages/enlightenment.scm
index 866db9687c..b62ab5f6f5 100644
--- a/gnu/packages/enlightenment.scm
+++ b/gnu/packages/enlightenment.scm
@@ -327,7 +327,7 @@ Libraries stack (eo, evas, ecore, edje, emotion, ethumb and elementary).")
 (define-public edi
   (package
     (name "edi")
-    (version "0.5.0")
+    (version "0.5.1")
     (source
       (origin
         (method url-fetch)
@@ -335,7 +335,7 @@ Libraries stack (eo, evas, ecore, edje, emotion, ethumb and elementary).")
                             "download/v" version "/edi-" version ".tar.bz2"))
         (sha256
          (base32
-          "1l90x1bw82a0df6r11wd55qizhi99gg0qcljwxga606ahy6ycnkn"))))
+          "0k0ymi9ilhkypqb9pniv365kh3jgbl2g2k0ylvsmisn2jhbqk49a"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/finance.scm b/gnu/packages/finance.scm
index 04ae70b07a..748b59c9e1 100644
--- a/gnu/packages/finance.scm
+++ b/gnu/packages/finance.scm
@@ -70,7 +70,8 @@
        ("miniupnpc" ,miniupnpc)
        ("openssl" ,openssl)
        ("protobuf" ,protobuf)
-       ("qtbase" ,qtbase)))
+       ;; TODO Build with the modular Qt.
+       ("qt" ,qt)))
     (arguments
      `(#:configure-flags
         (list
diff --git a/gnu/packages/flashing-tools.scm b/gnu/packages/flashing-tools.scm
index f25c25fbfb..127fc795a3 100644
--- a/gnu/packages/flashing-tools.scm
+++ b/gnu/packages/flashing-tools.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -82,6 +83,37 @@ network/graphics/storage controller cards, and various other
 programmer devices.")
     (license gpl2)))
 
+(define-public 0xffff
+  (package
+    (name "0xffff")
+    (version "0.7")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (string-append "https://github.com/pali/0xffff/archive/"
+                          version ".tar.gz"))
+      (file-name (string-append "0xFFFF" version ".tar.gz" ))
+      (sha256
+       (base32
+        "1g4032c81wkk37wvbg1dxcqq6mnd76y9x7f2crmzqi6z4q9jcxmj"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("libusb",libusb-0.1))) ; doesn't work with libusb-compat
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure)) ; no configure
+       #:make-flags (list (string-append "PREFIX=" %output))
+       #:tests? #f)) ; no 'check' target
+    (home-page "https://github.com/pali/0xFFFF")
+    (synopsis "Flash FIASCO images on Maemo devices")
+    (description
+     "The Open Free Fiasco Firmware Flasher (0xFFFF) is a flashing tool
+for FIASCO images.  It supports generating, unpacking, editing and
+flashing of FIASCO images for Maemo devices.  Use it with care.  It can
+brick your device.")
+    (license gpl3+)))
+
 (define-public avrdude
   (package
     (name "avrdude")
diff --git a/gnu/packages/fonts.scm b/gnu/packages/fonts.scm
index ceadbe1c39..51073eff9f 100644
--- a/gnu/packages/fonts.scm
+++ b/gnu/packages/fonts.scm
@@ -472,24 +472,7 @@ variants.")
               (sha256
                (base32
                 "1mkmxq8g2hjcglb3zajfqj20r4r88l78ymsp2xyl5yav8w3f7dz4"))))
-    (build-system trivial-build-system)
-    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-         (let ((PATH (string-append (assoc-ref %build-inputs "tar")  "/bin:"
-                                    (assoc-ref %build-inputs "gzip") "/bin"))
-               (font-dir (string-append (assoc-ref %outputs "out")
-                                        "/share/fonts/wenquanyi/")))
-           (setenv "PATH" PATH)
-           (mkdir-p font-dir)
-           (system* "tar" "xvf" (assoc-ref %build-inputs "source"))
-           (chdir "wqy-zenhei")
-           (install-file "wqy-zenhei.ttc" font-dir)))))
-    (native-inputs
-     `(("gzip" ,gzip)
-       ("tar" ,tar)))
+    (build-system font-build-system)
     (home-page "http://wenq.org/wqy2/")
     (synopsis "CJK font")
     (description
@@ -516,23 +499,7 @@ ko (Korean) locales for @code{fontconfig}.")
               (sha256
                (base32
                 "0gi1yxqph8xx869ichpzzxvx6y50wda5hi77lrpacdma4f0aq0i8"))))
-    (build-system trivial-build-system)
-    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
-         (let ((PATH (string-append (assoc-ref %build-inputs "tar")  "/bin:"
-                                    (assoc-ref %build-inputs "gzip") "/bin"))
-               (font-dir (string-append (assoc-ref %outputs "out")
-                                        "/share/fonts/wenquanyi")))
-           (mkdir-p font-dir)
-           (setenv "PATH" PATH)
-           (system* "tar" "xvf" (assoc-ref %build-inputs "source"))
-           (install-file "wqy-microhei/wqy-microhei.ttc" font-dir)))))
-    (native-inputs
-     `(("gzip" ,gzip)
-       ("tar" ,tar)))
+    (build-system font-build-system)
     (home-page "http://wenq.org/wqy2/")
     (synopsis "CJK font")
     (description
@@ -594,7 +561,7 @@ languages, plus Greek and Cyrillic.")
 (define-public font-gnu-unifont
   (package
     (name "font-gnu-unifont")
-    (version "10.0.04")
+    (version "10.0.05")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -602,7 +569,7 @@ languages, plus Greek and Cyrillic.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "150p79rq4rzb4pbg2dwcz93k1chzzvm0l0nwh60spw19nfyrxj0p"))))
+                "07sajc32l2knnz6gmd81zxjhcxq8xr6r2kf42wig56vj05s3d1cb"))))
     (build-system gnu-build-system)
     (outputs '("out" ; TrueType version
                "pcf" ; PCF (bitmap) version
diff --git a/gnu/packages/gforth.scm b/gnu/packages/forth.scm
index b2a67ce58c..6d66faf5d6 100644
--- a/gnu/packages/gforth.scm
+++ b/gnu/packages/forth.scm
@@ -17,7 +17,7 @@
 ;;; You should have received a copy of the GNU General Public License
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
-(define-module (gnu packages gforth)
+(define-module (gnu packages forth)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
diff --git a/gnu/packages/game-development.scm b/gnu/packages/game-development.scm
index 67f6c55017..dabe951da8 100644
--- a/gnu/packages/game-development.scm
+++ b/gnu/packages/game-development.scm
@@ -380,7 +380,7 @@ support.")
 (define-public tiled
   (package
     (name "tiled")
-    (version "1.0.1")
+    (version "1.0.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/bjorn/tiled/archive/v"
@@ -388,7 +388,7 @@ support.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1y75jmpcf2lv8s3g9v3ghnrwvs2fc4ni7nx74csaylg1g04cwlq7"))))
+                "134xi74xajh38rj1qhmc4x1zmncfdmqb01axnkxh6zs3qz0rxp93"))))
     (build-system gnu-build-system)
     (inputs
      `(("qtbase" ,qtbase)
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index a7f697ece4..2dec9a3951 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -1386,6 +1386,7 @@ This game is based on the GPL version of the famous game TuxRacer.")
        (sha256
         (base32
          "10l2ljmd7mv8f9ylarqmxxryicdnph2qkm3g5maxnsm2k2q0n20b"))
+       (patches (search-patches "supertuxkart-angelscript-ftbfs.patch"))
        (modules '((guix build utils)))
        (snippet
         ;; Delete bundled library sources
@@ -3493,7 +3494,7 @@ throwing people around in pseudo-randomly generated buildings.")
 (define-public hyperrogue
   (package
     (name "hyperrogue")
-    (version "9.4g")
+    (version "9.4n")
     ;; When updating this package, be sure to update the "hyperrogue-data"
     ;; origin in native-inputs.
     (source (origin
@@ -3504,10 +3505,11 @@ throwing people around in pseudo-randomly generated buildings.")
                     "-src.tgz"))
               (sha256
                (base32
-                "09j9gnx701x28zfkrv3rjqlr56p89hyxk78gkpmmdfjgcq076pc2"))))
+                "1kf9i9gqadnb0m143c860dcvdn91vp6vnfzma4bcgfgwmcn9sx0r"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ; no check target
+       #:make-flags '("CXXFLAGS=-std=c++11")
        #:phases
        (modify-phases %standard-phases
          (add-after 'set-paths 'set-sdl-paths
@@ -3578,7 +3580,7 @@ throwing people around in pseudo-randomly generated buildings.")
              "-win.zip"))
            (sha256
             (base32
-             "1r57db4hm7fjcd27p8b6cdsnq2cgkym2kp9lrw7ha2asdf8w6gkb"))))
+             "1vrk0k0ch3azpa72y7acmmpifvks6c0466fvmz804hici93pglvi"))))
        ("unzip" ,unzip)))
     (inputs
      `(("font-dejavu" ,font-dejavu)
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 1e2e9ad711..8a9ddf62c7 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -96,6 +96,7 @@
   #:use-module (gnu packages lua)
   #:use-module (gnu packages image)
   #:use-module (gnu packages imagemagick)
+  #:use-module (gnu packages music)
   #:use-module (gnu packages networking)
   #:use-module (gnu packages password-utils)
   #:use-module (gnu packages pcre)
@@ -131,8 +132,8 @@
   #:use-module (gnu packages samba)
   #:use-module (gnu packages readline)
   #:use-module (gnu packages fonts)
-  #:use-module (gnu packages qemu)
   #:use-module (gnu packages speech)
+  #:use-module (gnu packages virtualization)
   #:use-module (srfi srfi-1))
 
 (define-public brasero
@@ -614,6 +615,7 @@ forgotten when the session ends.")
              (uri (string-append "mirror://gnome/sources/" name "/"
                                  (version-major+minor version) "/"
                                  name "-" version ".tar.xz"))
+             (patches (search-patches "evince-CVE-2017-1000083.patch"))
              (sha256
               (base32
                "13yw0i68dgqp9alyliy3zifszh7rikkpi1xbz5binvxxgfpraf04"))))
@@ -3539,7 +3541,15 @@ for application developers.")
        ("nettle" ,nettle)
        ("vala" ,vala)))
     (arguments
-     `(#:phases
+     `(;; Disable automatic GStreamer plugin installation via PackageKit and
+       ;; all that.
+       #:configure-flags '("--disable-easy-codec-installation"
+
+                           ;; Do not build .a files for the plugins, it's
+                           ;; completely useless.  This saves 2 MiB.
+                           "--disable-static")
+
+       #:phases
        (modify-phases %standard-phases
          (add-after
           'install 'wrap-totem
@@ -3924,6 +3934,67 @@ the same backend as XSANE uses. This means that all existing scanners will
 work and the interface is well tested.")
     (license license:gpl3+)))
 
+(define-public eolie
+  (package
+    (name "eolie")
+    (version "0.9.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/gnumdk/eolie/"
+                                  "releases/download/"
+                                  (version-major+minor version)
+                                  "/eolie-" version ".tar.xz"))
+              (sha256
+               (base32
+                "1lb3rd2as12vq24fcf9nmlhggf8vka3kli2i92i8iylwi7nq5n2a"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:modules ((guix build glib-or-gtk-build-system)
+                  (guix build utils)
+                  (ice-9 match))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'wrap 'wrap-more
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out  (assoc-ref outputs "out"))
+                    ;; These libraries must be on LD_LIBRARY_PATH.
+                    (libs '("gtkspell3" "webkitgtk" "libsoup" "libsecret"
+                            "atk" "gtk+" "gsettings-desktop-schemas"
+                            "gobject-introspection"))
+                    (path (string-join
+                           (map (lambda (lib)
+                                  (string-append (assoc-ref inputs lib) "/lib"))
+                                libs)
+                           ":")))
+               (wrap-program (string-append out "/bin/eolie")
+                 `("LD_LIBRARY_PATH" ":" prefix (,path))
+                 `("PYTHONPATH" ":" prefix (,(getenv "PYTHONPATH")))
+                 `("GI_TYPELIB_PATH" = (,(getenv "GI_TYPELIB_PATH")))))
+             #t)))))
+    (native-inputs
+     `(("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("gobject-introspection" ,gobject-introspection)
+       ("glib-networking" ,glib-networking)
+       ("cairo" ,cairo)
+       ("gtk+" ,gtk+)
+       ("atk" ,atk)    ; propagated by gtk+, but we need it in LD_LIBRARY_PATH
+       ("python" ,python-wrapper)
+       ("python-pygobject" ,python-pygobject)
+       ("python-pycairo" ,python-pycairo)
+       ("libsecret" ,libsecret)
+       ("gtkspell3" ,gtkspell3)
+       ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
+       ("webkitgtk" ,webkitgtk)))
+    (home-page "https://github.com/gnumdk/eolie/")
+    (synopsis "Web browser for GNOME")
+    (description
+     "Eolie is a new web browser for GNOME.  It features Firefox sync support,
+a secret password store, an adblocker, and a modern UI.")
+    (license license:gpl3+)))
+
 (define-public epiphany
   (package
     (name "epiphany")
@@ -5868,7 +5939,7 @@ like GNOME, Unity, Budgie, Pantheon, XFCE, Mate, etc.")
 (define-public moka-icon-theme
   (package
     (name "moka-icon-theme")
-    (version "5.3.5")
+    (version "5.3.6")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/moka-project"
@@ -5877,7 +5948,7 @@ like GNOME, Unity, Budgie, Pantheon, XFCE, Mate, etc.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "062rab0ggmgb3y0d6b3k5d47wsadi28cdnyyr2vqbjhza01dglci"))))
+                "04axinv79qnngsxkwqzi5j9lc3hn24rjqps5ai8d42pdnfaf0x37"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -6419,3 +6490,63 @@ duration, cost, and current progress.  It can also show a report of resource
 utilization that highlights under-utilized and over-utilized resources.  These
 views can be printed as PDF or PostScript files, or exported to HTML.")
     (license license:gpl2+)))
+
+(define-public lollypop
+  (package
+    (name "lollypop")
+    (version "0.9.240")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/gnumdk/lollypop/"
+                           "releases/download/" version "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0n1ycmg6dgz1pajs80fwlcbxw3rx1hff1xw6ja67zngm85ydbjvq"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:imported-modules ((guix build python-build-system)
+                           ,@%glib-or-gtk-build-system-modules)
+       #:phases (modify-phases %standard-phases
+                  (add-after 'install 'wrap-program
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let ((out               (assoc-ref outputs "out"))
+                            (gi-typelib-path   (getenv "GI_TYPELIB_PATH")))
+                        (wrap-program (string-append out "/bin/lollypop")
+                          `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path))))
+                      #t))
+                  (add-after 'install 'wrap
+                    (@@ (guix build python-build-system) wrap)))))
+    (native-inputs
+     `(("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("gobject-introspection" ,gobject-introspection)
+       ("gtk+" ,gtk+)
+       ("libnotify" ,libnotify)
+       ("libsecret" ,libsecret)
+       ("libsoup" ,libsoup)
+       ("python" ,python)
+       ("python-beautifulsoup4" ,python-beautifulsoup4)
+       ("python-gst" ,python-gst)
+       ("python-pycairo" ,python-pycairo)
+       ("python-pygobject" ,python-pygobject)
+       ("python-pylast" ,python-pylast)
+       ("totem-pl-parser" ,totem-pl-parser)
+       ("webkitgtk" ,webkitgtk)))
+    (propagated-inputs
+     `(;; gst-plugins-base is required to start Lollypop,
+       ;; the others are required to play streaming.
+       ("gst-plugins-base" ,gst-plugins-base)
+       ("gst-plugins-good" ,gst-plugins-good)
+       ("gst-plugins-ugly" ,gst-plugins-ugly)))
+    (home-page "https://gnumdk.github.io/lollypop-web")
+    (synopsis "GNOME music playing application")
+    (description
+     "Lollypop is a music player designed to play well with GNOME desktop.
+Lollypop plays audio formats such as mp3, mp4, ogg and flac and gets information
+from artists and tracks from the web.  It also fetches cover artworks
+automatically and it can stream songs from online music services and charts.")
+    (license license:gpl3+)))
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index db32b988ed..d4f1018f86 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -514,7 +514,46 @@ standards.")
         (mozilla-patch "icecat-bug-1368576.patch"        "5a51a9ef8149" "0j0f9j0pryv3ik4bizhv8s6rr4dl1mjm01c23msayr0vbnpcagcs")
         (mozilla-patch "icecat-bug-1369913.patch"        "f47eaebc0c5c" "1b52xm3awpigasaz0hk5b13l7v4ry9vrawf571lzy2wwhphs4nxx")
         (mozilla-patch "icecat-bug-1371424.patch"        "40ce248a8c15" "1b722fiifr999ga0991cg5mlhidcnvf3zx2aiq5zjaabqn0f4dzk")
-        (mozilla-patch "icecat-bug-1372112.patch"        "0c8359ac6718" "1w0v2p5jnhzvcsx8h1bglwjhp5y5bg1g8pzpvjw7pg1wlq2frccr")))
+        (mozilla-patch "icecat-bug-1372112.patch"        "0c8359ac6718" "1w0v2p5jnhzvcsx8h1bglwjhp5y5bg1g8pzpvjw7pg1wlq2frccr")
+        (mozilla-patch "icecat-bug-1354443-pt1.patch"    "8c27a68ee87e" "0kn05q8nvp26w5rnj8r0byw89h2awmwn04l9l3xv2i5w2a7zmjzf")
+        (mozilla-patch "icecat-bug-1354443-pt2.patch"    "b2ee0c5466da" "0jgwsppq0606lwg5jk9q69lqa14q3j7h3c7q6mxbz7zqrcg7d0zg")
+        (mozilla-patch "icecat-bug-1354443-pt3.patch"    "25f6ec16e501" "1yqd5ndwgd8x2pj9k2bnaq3rb1g7wikq0ii7l4dm6bqwabi2rdsg")
+        (mozilla-patch "icecat-bug-1354443-pt4.patch"    "30443b4f758e" "0riszl3xnpfq5ffywygrc12nsvx0ffd36d5rf4vp87r8lj3fr55r")
+        (mozilla-patch "icecat-bug-1354443-pt5.patch"    "1b934ab92c59" "114cvfzfxgkwwd4zpnrmm2kx6m94k0b3xcraba9aawwwhdxj6a1d")
+        (mozilla-patch "icecat-bug-1354443-pt6.patch"    "830a345dc0e7" "01riivv033w3mr8b2myaw38rz2za1bdlhybny737ly68hhc67xdz")
+        (mozilla-patch "icecat-bug-1365189.patch"        "5c26df489768" "1fdw4zbn0ilfghanxky4y7qcmkpkks2q1aqkzv26dnhhrr8350a1")
+        (mozilla-patch "icecat-bug-1365875.patch"        "f21e4d78a0a8" "0szsc3zm3wgrw8pxm0rz54whkrc14yy4d8vwmxgqsdns43qjgkpk")
+        (mozilla-patch "icecat-bug-1346590.patch"        "f19b6c6a0c6c" "0wkr010qnh4127z1j7fp45sqdk2da9x7j2k405r0x5bgqdd09qzp")
+        (mozilla-patch "icecat-bug-1376087.patch"        "8353a3fa4106" "0kzs8pl6spjwgdsmiw702zvbvz73ng9zf184clsfr82l8kmggbgw")
+        (mozilla-patch "icecat-bug-1371889.patch"        "b38fed9a9772" "14vzsldlv4hjpxgnl6fjjbzhgcwsmd52v06cgmv0a7y3lnggj3hp")
+        (mozilla-patch "icecat-bug-1322896.patch"        "c254d3cc826c" "0pixwr18qik87c8qf4irg6hdffd8rbwpng73jxg05h7s827nfw3g")
+        (mozilla-patch "icecat-bug-1368652.patch"        "6356dbf20658" "0a0hsxkik7ysfa48w8k21lidaabwpmxi1d3214r5zqkqqfhn9qjm")
+        (mozilla-patch "icecat-bug-1358073.patch"        "8d6e685d061b" "0430gwg7zzbg0q9w2m04s5ljh47bc8x1gxvmkzbn23bh1wy4d4sq")
+        (mozilla-patch "icecat-bug-1370869.patch"        "3b8fde840188" "0vkymvzkfpzpg86npa5vpvvf564k18hkfdz8857rl0z4dp4rybzx")
+        (mozilla-patch "icecat-bug-1369994.patch"        "267b649087ff" "04wzazdm0kvbfcgmlhx8qs1ibqn8sbvqdsd237rja5wpr761xxf1")
+        (mozilla-patch "icecat-bug-1354796.patch"        "69d1a9de76b9" "1q0p4kf8pvnkwwff3lz526pjj15a25pf724awblkcnzamwbib5ns")
+        (mozilla-patch "icecat-bug-1363027.patch"        "c5eaa2d51b9f" "1xyj5n1vqhscc369q6wxibs2igbilaiwyc0q9cq64j2qx8q0yqah")
+        (mozilla-patch "icecat-bug-1364189.patch"        "852a7781259e" "12y344p54avz5mrqirq14zp4csx8ydilnjv9nsw48kpa9y0l5xsg")
+        (mozilla-patch "icecat-bug-1342417.patch"        "37ccdc5fff2b" "1acywg8girplbs7wjrjbvkximhiyizddmnkkq1ldd0l3qbx9nihc")
+        (mozilla-patch "icecat-bug-1362924-pt1.patch"    "057ed884ecb0" "1m49bqkq5lzc2j59wgwy0gbzvqj50p9lfn7cbc2n01v6d7m8rc2j")
+        (mozilla-patch "icecat-bug-1362924-pt2.patch"    "dd7ed649b82f" "1fama1l2vx4p6ahhrsrpysfbk9nh5gwbi4pdnclpyxd42idsdqxs")
+        (mozilla-patch "icecat-bug-1353312.patch"        "731958f7ff4d" "0l3i3mkb6rslnjag3caf4xyhjzxn91wfs0g6dbika4sxnhfs5d4i")
+        (mozilla-patch "icecat-bug-1364870.patch"        "de8deecbcb02" "048ic1vk7fd7wxqjgjqlnb7kv03ynaa4wkrk0ka8m39pkjh3yyxj")
+        (mozilla-patch "icecat-bug-1365333.patch"        "e3d13b270f45" "0jr8hpxpmfgrbh09xd9nj597cdnc6kl6gs5nir4zlzbbn8kp3429")
+        (mozilla-patch "icecat-bug-1372063.patch"        "58a144bf9677" "12y8vikbzcfcfiidjdq67dvdhhvylx68wdgnypsafrd1q8dx9jza")
+        (mozilla-patch "icecat-bug-1373970.patch"        "8321ef71adb5" "1wk8kq9n2vhqlinvvw01avv3c7qj0k3qnn7dj0whnl08a5yrqhpl")
+        (mozilla-patch "icecat-bug-1338646.patch"        "322c18d011af" "1yqb7zmjz211ryb98pjj7axbj6bwkj63rmfyifsybdy3zpb4nf48")
+        (mozilla-patch "icecat-bug-1371283.patch"        "f9bc084fbb8a" "1ssml15yzx9s0wraq4n0xvq5bw7j8xq0p2y39h8j3f1c448n0j50")
+        (mozilla-patch "icecat-bug-1359477.patch"        "9b70b5b852e4" "0z2bi7w46g7mm8msav8vz28mgvnv21z3a5876n9gpw317gns4d6a")
+        (mozilla-patch "icecat-bug-1366903.patch"        "6785c2a852da" "0p9jr171qi59scr5lrj6g0mv8mgm1i1wglr3jd16xywb0ymynnn5")
+        (mozilla-patch "icecat-bug-1368105.patch"        "11c8e23f0fd7" "0zcikv6dn7biii4gspv2kfvma5hc76hk86jahm3zl2zlkk8ikfm9")
+        (mozilla-patch "icecat-bug-1355168.patch"        "f45ba43512ad" "0p28q5acns5zjj7ks2x5lrmwzzps741507sq31xvrpzan5yav37x")
+        (mozilla-patch "icecat-bug-1308820.patch"        "e9a10fac6aae" "1s2zaka6ik1rmylamyh38vsqnqlblbqdhjpp0cv08fjb9flh5sbw")
+        (mozilla-patch "icecat-bug-1305036.patch"        "c42a348f2ed0" "1pz7qbdv9xvyd1dy7g9h047c0gmrgp5qdy2360qjk6879n74h1zb")
+        (mozilla-patch "icecat-bug-1342913.patch"        "f02db36497d2" "0g1kg418l1cibh5k1sjqj2vs2jcblpbn7b06qazk2kzcg70vf5gv")
+        (mozilla-patch "icecat-bug-1374047.patch"        "0a44ed156da5" "1y8z1czm7f91p9bpd32b9k43nl0b9g4fzwv4w0khby9y38xgvcbs")
+        (mozilla-patch "icecat-bug-1371259.patch"        "0a86729d653e" "0wyh7qskjwq9274d25p2ajylaab5mj5h8by58rz9lxsz06zrnz9f")
+        (mozilla-patch "icecat-bug-1378826.patch"        "98ff43fb228a" "0ih0nsmk8rzdrajzlnryqiqb71jg7v4p71hfla2hrlvn41r3709m")))
       (modules '((guix build utils)))
       (snippet
        '(begin
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 6c0eda99c8..176336d710 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -64,14 +64,14 @@
 (define-public orc
   (package
     (name "orc")
-    (version "0.4.26")
+    (version "0.4.27")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/data/src/"
                                   "orc/orc-" version ".tar.xz"))
               (sha256
                (base32
-                "0jd69ynvr3k70mlxxgbsk047l1rd63m1wkj3qdcq7644xy0gllkx"))))
+                "14vbwdydwarcvswzf744jdjb3ibhv6k4j6hzdacfan41zic3xrai"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -98,7 +98,7 @@ arrays of data.")
 (define-public gstreamer
   (package
     (name "gstreamer")
-    (version "1.12.1")
+    (version "1.12.2")
     (source
      (origin
       (method url-fetch)
@@ -107,7 +107,7 @@ arrays of data.")
             version ".tar.xz"))
       (sha256
        (base32
-        "1lm6lcr0rv0mzsdl9vjdnf3vb136qmcslvz3m5zlai7zngcbji4h"))))
+        "1fllz7n58lavyy4nh64xc7izd4ffhl12a2ff0yg4z67al8wkzplz"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -146,7 +146,7 @@ This package provides the core library and elements.")
 (define-public gst-plugins-base
   (package
     (name "gst-plugins-base")
-    (version "1.12.1")
+    (version "1.12.2")
     (source
      (origin
       (method url-fetch)
@@ -154,7 +154,7 @@ This package provides the core library and elements.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0r84krn8dpimp6kk9cf38danrbbsypx6j6ykr6rl1a3lnnnrzkhc"))))
+        "0x86a7aph0y6gyq178plvwvbbyhkfb3hf0gadx9sk5z1mzixqrsh"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (propagated-inputs
@@ -201,7 +201,7 @@ for the GStreamer multimedia library.")
 (define-public gst-plugins-good
   (package
     (name "gst-plugins-good")
-    (version "1.12.1")
+    (version "1.12.2")
     (source
      (origin
       (method url-fetch)
@@ -210,7 +210,7 @@ for the GStreamer multimedia library.")
             name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0jzm5jp22238y3rb0j1dsxyp77dq0wk03gn9kvq25rphlx38w7hj"))))
+        "15pfw54fsh9s9xwrnbap4z4njwgqdfvq52k562d2hc5b11rfx4am"))))
     (build-system gnu-build-system)
     (inputs
      `(("aalib" ,aalib)
@@ -266,14 +266,14 @@ developers consider to have good quality code and correct functionality.")
 (define-public gst-plugins-bad
   (package
     (name "gst-plugins-bad")
-    (version "1.12.1")
+    (version "1.12.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/src/"
                                   name "/" name "-" version ".tar.xz"))
               (sha256
                (base32
-                "15svf3d4n13r1c18mx9ya3ymibv0vbx9s593j0cm0kn4s54q1vvx"))))
+                "0dwyq03g2m0p16dwx8q5qvjn5x9ia72h21sf87mp97gmwkfpwb4w"))))
     (outputs '("out" "doc"))
     (build-system gnu-build-system)
     (arguments
@@ -343,7 +343,7 @@ par compared to the rest.")
 (define-public gst-plugins-ugly
   (package
     (name "gst-plugins-ugly")
-    (version "1.12.1")
+    (version "1.12.2")
     (source
      (origin
        (method url-fetch)
@@ -351,7 +351,7 @@ par compared to the rest.")
                            name "/" name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0s8hiv4asqd6nwnksqv6cwpzan41zd0nd8nhlm7s64wp0lyi5hlg"))))
+         "0rplyp1qk359c97ig9i2vc1v34g92khd8dslwfipva1ypwmr9hqw"))))
     (build-system gnu-build-system)
     (inputs
      `(("gst-plugins-base" ,gst-plugins-base)
@@ -382,7 +382,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
 (define-public gst-libav
   (package
     (name "gst-libav")
-    (version "1.12.1")
+    (version "1.12.2")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -390,7 +390,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0xshib0hsn8yjmd12ipsrbrvxa5qnhnz7zmdj7lms6b3vwzq5msm"))))
+                "1crdahkjm23byg1awcrjkmgfbalfpvvac7h7whm6b2r1pfwkbdsv"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--with-system-libav")
@@ -420,7 +420,7 @@ compression formats through the use of the libav library.")
 (define-public python-gst
   (package
     (name "python-gst")
-    (version "1.12.1")
+    (version "1.12.2")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -428,7 +428,7 @@ compression formats through the use of the libav library.")
                     "gst-python-" version ".tar.xz"))
               (sha256
                (base32
-                "18bq03xdc0jgrza4114lrcj82yai4azkjzfxflqagc0y417vw88p"))))
+                "0iwy0v2k27wd3957ich6j5f0f04b0wb2mb175ypf2lx68snk5k7l"))))
     (build-system gnu-build-system)
     (arguments
      ;; XXX: Factorize python-sitedir with python-build-system.
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index d077ae992a..0d1989e524 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -13,6 +13,7 @@
 ;;; Copyright © 2017 Andy Wingo <wingo@igalia.com>
 ;;; Copyright © 2017 David Thompson <davet@gnu.org>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2017 Theodoros Foradis <theodoros.for@openmailbox.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -530,6 +531,13 @@ many readers as needed).")
 library.")
     (license license:lgpl3+)))
 
+(define-public guile-ncurses/gpm
+  (package
+    (inherit guile-ncurses)
+    (name "guile-ncurses-with-gpm")
+    (inputs `(("ncurses" ,ncurses/gpm)
+              ("guile" ,guile-2.2)))))
+
 (define-public mcron
   (package
     (name "mcron")
@@ -1350,20 +1358,21 @@ capabilities.")
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (propagated-inputs
-     `(("guile" ,guile-2.0)
+     `(("guile" ,guile-2.2)
        ("guile-lib" ,guile-lib)))
     (inputs
      `(("libffi" ,libffi)))
     (arguments
-      `(#:phases
-        (modify-phases %standard-phases
-          (add-before 'configure 'pre-configure
-            (lambda* (#:key outputs #:allow-other-keys)
-              (let ((out (assoc-ref outputs "out")))
-                (substitute* (find-files "." "^Makefile.in$")
-                  (("guilemoduledir =.*guile/site" all)
-                   (string-append all "/2.0")))
-                #t))))))
+     `(#:configure-flags '("--disable-Werror")
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'pre-configure
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (substitute* (find-files "." "^Makefile.in$")
+                 (("guilemoduledir =.*guile/site" all)
+                  (string-append all "/@GUILE_EFFECTIVE_VERSION@")))
+               #t))))))
     (synopsis "Generate C bindings for Guile")
     (description "G-Wrap is a tool and Guile library for generating function
 wrappers for inter-language calls.  It currently only supports generating Guile
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index c543655fb8..dfda2126ab 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -25,7 +25,6 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
   #:use-module (guix download)
-  #:use-module (guix hg-download)
   #:use-module (guix utils)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
@@ -46,14 +45,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.8-10")
+    (version "6.9.9-0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "040qs7nwcm84bjd9wryvd58zqfykbmn3y3qfc90lnldww7v6ihlg"))))
+               "02xnvgjnmz2d4yv4iy1kh7an5w631p1s319jw23c8zpmqhfhk2ha"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
@@ -162,70 +161,54 @@ script.")
     (license (package-license imagemagick))))
 
 (define-public graphicsmagick
-  (let ((changeset "6156b4c2992d855ece6079653b3b93c3229fc4b8") ; fix CVE-2017-6335
-        (revision "3"))
-    (package
-      (name "graphicsmagick")
-      (version (string-append "1.3.25-" revision "."
-                              (string-take changeset 7)))
-      (source (origin
-                (method hg-fetch)
-                (uri (hg-reference
-                      (url "http://hg.code.sf.net/p/graphicsmagick/code")
-                      (changeset changeset)))
-                (file-name (string-append name "-" version "-checkout"))
-                ;;(method url-fetch)
-                ;;(uri (string-append "ftp://ftp.graphicsmagick.org/pub/"
-                ;;                    "GraphicsMagick/" (version-major+minor version)
-                ;;                    "/GraphicsMagick-" version ".tar.xz"))
-                (sha256
-                 (base32
-                  "08yfsn8mrqkwpax43vv1crfr55rcf004wwpzsinr5c6m0asqr08b"))
-                (modules '((guix build utils)))
-                (snippet
-                  ;; Remove bundled software. This reduces the size of the built
-                  ;; source checkout from 177 MiB to 49 MiB. This should not be
-                  ;; necessary when using the GraphicsMagick release tarball,
-                  ;; because these files are not distributed there.
-                  '(for-each delete-file-recursively '("bzlib" "dcraw" "hp2xx"
-                                                       "jbig" "jp2" "jpeg"
-                                                       "lcms" "libxml" "png"
-                                                       "ralcgm" "tiff" "ttf"
-                                                       "webp" "wmf" "xlib"
-                                                       "zlib")))))
-      (build-system gnu-build-system)
-      (arguments
-       `(#:configure-flags
-         (list "--with-frozenpaths"
-               "--enable-shared=yes"
-               "--with-x=yes"
-               "--with-quantum-depth=16" ; required by Octave
-               "--enable-quantum-library-names"
-               (string-append "--with-gs-font-dir="
-                              (assoc-ref %build-inputs "gs-fonts")
-                              "/share/fonts/type1/ghostscript"))))
-      (inputs
-       `(("graphviz" ,graphviz)
-         ("ghostscript" ,ghostscript)
-         ("gs-fonts" ,gs-fonts)
-         ("lcms" ,lcms)
-         ("libx11" ,libx11)
-         ("libxml2" ,libxml2)
-         ("libtiff" ,libtiff)
-         ("libpng" ,libpng)
-         ("libjpeg" ,libjpeg)
-         ("freetype" ,freetype)
-         ("bzip2" ,bzip2)
-         ("xz" ,xz)
-         ("zlib" ,zlib)))
-      (native-inputs
-       `(("pkg-config" ,pkg-config)))
-      (outputs '("out"                  ; 13 MiB
-                 "doc"))                ; ~7 MiB
-      (home-page "http://www.graphicsmagick.org")
-      (synopsis "Create, edit, compose, or convert bitmap images")
-      (description
-       "GraphicsMagick provides a comprehensive collection of utilities,
+  (package
+    (name "graphicsmagick")
+    (version "1.3.26")
+    (source (origin
+              (method url-fetch)
+              (uri
+                (list
+                  (string-append "mirror://sourceforge/" name "/" name
+                                 "/" version "/GraphicsMagick-" version ".tar.xz")
+                  (string-append "ftp://ftp.graphicsmagick.org/pub/"
+                                 "GraphicsMagick/" (version-major+minor version)
+                                 "/GraphicsMagick-" version ".tar.xz")))
+              (sha256
+               (base32
+                "122zgs96dqrys62mnh8x5yvfff6km4d3yrnvaxzg3mg5sprib87v"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags
+       (list "--with-frozenpaths"
+             "--enable-shared=yes"
+             "--with-x=yes"
+             "--with-quantum-depth=16" ; required by Octave
+             "--enable-quantum-library-names"
+             (string-append "--with-gs-font-dir="
+                            (assoc-ref %build-inputs "gs-fonts")
+                            "/share/fonts/type1/ghostscript"))))
+    (inputs
+     `(("graphviz" ,graphviz)
+       ("ghostscript" ,ghostscript)
+       ("gs-fonts" ,gs-fonts)
+       ("lcms" ,lcms)
+       ("libx11" ,libx11)
+       ("libxml2" ,libxml2)
+       ("libtiff" ,libtiff)
+       ("libpng" ,libpng)
+       ("libjpeg" ,libjpeg)
+       ("freetype" ,freetype)
+       ("bzip2" ,bzip2)
+       ("xz" ,xz)
+       ("zlib" ,zlib)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (outputs '("out"                  ; 13 MiB
+               "doc"))                ; ~7 MiB
+    (home-page "http://www.graphicsmagick.org")
+    (synopsis "Create, edit, compose, or convert bitmap images")
+    (description
+     "GraphicsMagick provides a comprehensive collection of utilities,
 programming interfaces, and GUIs, to support file format conversion, image
 processing, and 2D vector rendering.")
-      (license license:expat))))
+    (license license:expat)))
diff --git a/gnu/packages/irc.scm b/gnu/packages/irc.scm
index 011665d387..1d6ac82e5f 100644
--- a/gnu/packages/irc.scm
+++ b/gnu/packages/irc.scm
@@ -66,6 +66,7 @@
         (method url-fetch)
         (uri (string-append "http://quassel-irc.org/pub/quassel-"
                             version ".tar.bz2"))
+        (patches (search-patches "quassel-fix-tls-check.patch"))
         (sha256
          (base32
           "0ka456fb8ha3w7g74xlzfg6w4azxjjxgrhl4aqpbwg3lnd6fbr4k"))))
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index f231380506..5744db6ebc 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -1543,7 +1543,7 @@ IcedTea build harness.")
       (license license:gpl2+))))
 
 (define-public icedtea-8
-  (let* ((version "3.4.0")
+  (let* ((version "3.5.0")
          (drop (lambda (name hash)
                  (origin
                    (method url-fetch)
@@ -1552,7 +1552,7 @@ IcedTea build harness.")
                          "/icedtea8/" version "/" name ".tar.xz"))
                    (sha256 (base32 hash))))))
     (package (inherit icedtea-7)
-      (version "3.4.0")
+      (version "3.5.0")
       (source (origin
                 (method url-fetch)
                 (uri (string-append
@@ -1560,7 +1560,7 @@ IcedTea build harness.")
                       version ".tar.xz"))
                 (sha256
                  (base32
-                  "16if055973y6yw7n5gczp8iksvc31cy4p5by9lkbniadqj4z665m"))
+                  "1dfa7ing61i73m6wfx2kx59q44npqdiy7cd66xmslyy0xh09xa4s"))
                 (modules '((guix build utils)))
                 (snippet
                  '(begin
@@ -1632,34 +1632,34 @@ IcedTea build harness.")
        `(("jdk" ,icedtea-7 "jdk")
          ("openjdk-src"
           ,(drop "openjdk"
-                 "0va5i3zr8y8ncv914rz914jda9d88gq0viww3smdqnln8n78rszi"))
+                 "0di7gmyis1p6rpksmff1q21ck85i51sqcl9awqyvg7xiwggq0wsm"))
          ("aarch32-drop"
           ,(drop "aarch32"
                  "0cway5a5hcfyh4pzl9zz5xr7lil4gsliy6r5iqbaasd2d9alvqiq"))
          ("corba-drop"
           ,(drop "corba"
-                 "1l9zr97a3kq00bj4i8wcdsjlz3xlfldxd8zhkcxikinwd5n0n8a7"))
+                 "1xk64bsdxfc66g61d8k6xrhqj8rc56vzrlxx6s23gkr45604bl8x"))
          ("jaxp-drop"
           ,(drop "jaxp"
-                 "0lqxrsr3xlpwm2na6f2rpl7znrz34dkb9dg3zjmympyjy4kqljn7"))
+                 "1iw9xa4s5kxijdqpf0ih4x6g0lw142yy11vrzfmz6n1y4b0ic7iw"))
          ("jaxws-drop"
           ,(drop "jaxws"
-                 "1b3chckk10dzrpa7cswmcf1jvryaiwkj8lihfqjr5j7l668jwr4h"))
+                 "14p2l4j985wh5cdd4hfmm18gb5wmry73yiysdx9pg3aqpkw9qms7"))
          ("jdk-drop"
           ,(drop "jdk"
-                 "15lq0k2jv2x26x6vqkbljdcxk35i3b60pcsw3j1sdfmlk1xy6wgc"))
+                 "1qwmb80vicn7jd801f3j23lyil7327ks54d3s87czwv8h108m40r"))
          ("langtools-drop"
           ,(drop "langtools"
-                 "17xkb8ahkg04ri0bp5wblcp1a2lp8j7c83ic5zdbggvgm339k5s8"))
+                 "175pi2privhcvn9sbam5mhhgcvicfqbgldiw25fi5g80fqkkrza9"))
          ("hotspot-drop"
           ,(drop "hotspot"
-                 "0xpx8ykaq0ki6r0dl3dzca2xgp1p82z8mvsxcs2931ib667ncgcp"))
+                 "1qdyn02p4ssl3p7z9aadhzl9qdam2q7pvwddz2jkyvajcrxb0mpi"))
          ("nashorn-drop"
           ,(drop "nashorn"
-                 "1bnn4731lhlvg8axy4mjxgvh646yl22hp52wipx8cfca4vkn2f1z"))
+                 "0kzmpf5b9kwhrvnwn7m20q3dzz8s82jjvbac84606x3ff97xk5gr"))
          ("shenandoah-drop"
           ,(drop "shenandoah"
-                 "0fpxl8zlii1hpm777r875ys2cr5ih3gb6p1nm9jfa6krjrccrxv1"))
+                 "0kjc5m5jj2bzyy1vj1s59khv5xjfnkxy18z0g4bdb1kb3g21c5wi"))
          ,@(fold alist-delete (package-native-inputs icedtea-7)
                  '("jdk" "openjdk-src" "corba-drop" "jaxp-drop" "jaxws-drop"
                    "jdk-drop" "langtools-drop" "hotspot-drop")))))))
@@ -4672,3 +4672,28 @@ generate classes, directly in binary form.  The provided common
 transformations and analysis algorithms allow to easily assemble custom
 complex transformations and code analysis tools.")
     (license license:bsd-3)))
+
+(define-public java-commons-cli-1.2
+  ;; This is a bootstrap dependency for Maven2.
+  (package
+    (inherit java-commons-cli)
+    (version "1.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://apache/commons/cli/source/"
+                                  "commons-cli-" version "-src.tar.gz"))
+              (sha256
+               (base32
+                "0rvfgzgv2pc1m091dfj3ih9ddsjjppr1f1wf0qmc3bk6b1kwv2dm"))))
+    (arguments
+     `(#:jar-name "commons-cli.jar"
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'fix-build-xml
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "build.xml"
+               (("dir=\"\\$\\{test.home\\}/java\"")
+                "dir=\"${test.home}\""))
+             #t)))))
+    (native-inputs
+     `(("java-junit" ,java-junit)))))
diff --git a/gnu/packages/kerberos.scm b/gnu/packages/kerberos.scm
index 24583d82ea..48b2204190 100644
--- a/gnu/packages/kerberos.scm
+++ b/gnu/packages/kerberos.scm
@@ -90,7 +90,8 @@ authentication for client/server applications by using secret-key
 cryptography.")
     (license (license:non-copyleft "file://NOTICE"
                                    "See NOTICE in the distribution."))
-    (home-page "http://web.mit.edu/kerberos/")))
+    (home-page "http://web.mit.edu/kerberos/")
+    (properties '((cpe-name . "kerberos")))))
 
 (define-public shishi
   (package
@@ -138,6 +139,8 @@ secure manner through client-server mutual authentication via tickets.")
               (sha256
                (base32
                 "19gypf9vzfrs2bw231qljfl4cqc1riyg0ai0xmm1nd1wngnpphma"))
+              (patches (search-patches "heimdal-CVE-2017-6594.patch"
+                                       "heimdal-CVE-2017-11103.patch"))
               (modules '((guix build utils)))
               (snippet
                '(substitute* "configure"
diff --git a/gnu/packages/ldc.scm b/gnu/packages/ldc.scm
index 918843c077..03cd033376 100644
--- a/gnu/packages/ldc.scm
+++ b/gnu/packages/ldc.scm
@@ -279,7 +279,7 @@ latest DMD frontend and uses LLVM as backend.")
 (define-public dub
   (package
     (name "dub")
-    (version "1.3.0")
+    (version "1.4.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/dlang/dub/archive/"
@@ -287,7 +287,7 @@ latest DMD frontend and uses LLVM as backend.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "056mvf01z51qc3i1qnx7yaqr728q8pss8zabiv5zpfx2ynfsw3k7"))))
+                "1w3pznyjnmsmasrvv93f82l0sr31fpwg2zcj8hh1b2gvc5761qhi"))))
    (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ; it would have tested itself by installing some packages (vibe etc)
diff --git a/gnu/packages/libreoffice.scm b/gnu/packages/libreoffice.scm
index b49e360205..f7775ff4a0 100644
--- a/gnu/packages/libreoffice.scm
+++ b/gnu/packages/libreoffice.scm
@@ -614,14 +614,14 @@ spreadsheet documents.")
 (define-public libstaroffice
   (package
     (name "libstaroffice")
-    (version "0.0.3")
+    (version "0.0.4")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://github.com/fosnola/libstaroffice/releases/download/"
                            version "/libstaroffice-" version ".tar.xz"))
        (sha256 (base32
-                "1ii2wi3wr5npyz9gby1bjk8r4wyflpfpc6gx7mmqkhsc9c8frpmy"))))
+                "0flh0hs31fsq1dmkhf2502lxskiy7fbj5q8gn4b4f502s228fwkf"))))
     (build-system gnu-build-system)
     (inputs
      `(("librevenge" ,librevenge)
diff --git a/gnu/packages/libusb.scm b/gnu/packages/libusb.scm
index ffbe5b1a88..ed97ed9de7 100644
--- a/gnu/packages/libusb.scm
+++ b/gnu/packages/libusb.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2015, 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Theodoros Foradis <theodoros.for@openmailbox.org>
+;;; Copyright © 2017 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -95,6 +96,21 @@ devices on various operating systems.")
 version of libusb to run with newer libusb.")
     (license lgpl2.1+)))
 
+;; required by 0xffff, which compiles with libusb-compat, but executes only
+;; with libusb-0.1
+(define-public libusb-0.1
+  (package (inherit libusb)
+    (version "0.1.12")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (string-append "mirror://sourceforge/libusb/libusb-0.1 (LEGACY)/"
+                          version "/libusb-" version ".tar.gz"))
+      (sha256
+       (base32
+        "0i4bacxkyr7xyqxbmb00ypkrv4swkgm0mghbzjsnw6blvvczgxip"))
+      (patches (search-patches "libusb-0.1-disable-tests.patch"))))))
+
 (define-public libusb4java
   ;; There is no public release so we take the latest version from git.
   (let ((commit "396d642a57678a0d9663b062c980fe100cc0ea1e")
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index d0dcb259b9..cb56439fd5 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -365,8 +365,8 @@ It has been modified to remove all non-free binary blobs.")
 
 (define %intel-compatible-systems '("x86_64-linux" "i686-linux"))
 
-(define %linux-libre-version "4.12")
-(define %linux-libre-hash "153ibjdgys7friij4hnkvmp9ycvx50zgpyl9mwbr4prr409q3ndf")
+(define %linux-libre-version "4.12.3")
+(define %linux-libre-hash "1b02snh41fgr5i55wlc86nvksyzy1cq994mkmj195pa57hy6y6ak")
 
 (define-public linux-libre
   (make-linux-libre %linux-libre-version
@@ -375,14 +375,14 @@ It has been modified to remove all non-free binary blobs.")
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.9
-  (make-linux-libre "4.9.36"
-                    "1z58f15my3a8c3j8hfc6p9ydmwgq1399kp1zsbrfd89rxz3m4v6r"
+  (make-linux-libre "4.9.39"
+                    "03rnbz1wf3d0fi5zrhygx1b20bx23fy310d8h74zc6z4jh6fsbx3"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.4
-  (make-linux-libre "4.4.76"
-                    "1qzgjqj7zv8hk162viyjy4cn24snwy159j8vir6d5jsrkvwq5wrk"
+  (make-linux-libre "4.4.78"
+                    "0g8pc0kam33rn2dx9fkp7w749s38qs2iykawpj0k9jm19775hn4k"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
@@ -428,11 +428,18 @@ It has been modified to remove all non-free binary blobs.")
        ;; ("cracklib" ,cracklib)
        ))
     (arguments
-     '(;; Most users, such as `shadow', expect the headers to be under
+     `(;; Most users, such as `shadow', expect the headers to be under
        ;; `security'.
        #:configure-flags (list (string-append "--includedir="
                                               (assoc-ref %outputs "out")
-                                              "/include/security"))
+                                              "/include/security")
+
+                               ;; XXX: <rpc/rpc.h> is missing from glibc when
+                               ;; cross-compiling, so we have to disable NIS
+                               ;; support altogether.
+                               ,@(if (%current-target-system)
+                                     '("--disable-nis")
+                                     '()))
 
        ;; XXX: Tests won't run in chroot, presumably because /etc/pam.d
        ;; isn't available.
@@ -1832,7 +1839,10 @@ system.")
     (native-search-paths
      (list (search-path-specification
             (variable "LOADKEYS_KEYMAP_PATH")
-            (files (list "share/keymaps")))))
+            ;; Append ‘/**’ to recursively search all directories.  One can then
+            ;; run (for example) ‘loadkeys en-latin9’ instead of having to find
+            ;; and type ‘i386/colemak/en-latin9’ on a mislabelled keyboard.
+            (files (list "share/keymaps/**")))))
     (native-inputs `(("pkg-config" ,pkg-config)))
     (home-page "http://kbd-project.org/")
     (synopsis "Linux keyboard utilities and keyboard maps")
@@ -3001,6 +3011,18 @@ applications running on the Linux console.  It allows users to select items
 and copy/paste text in the console and in xterm.")
     (license license:gpl2+)))
 
+(define-public ncurses/gpm
+  (package/inherit ncurses
+    (name "ncurses-with-gpm")
+    (arguments
+        (substitute-keyword-arguments (package-arguments ncurses)
+         ((#:configure-flags cf)
+          `(cons (string-append "--with-gpm="
+                                (assoc-ref %build-inputs "gpm")
+                                "/lib/libgpm.so.2") ,cf))))
+    (inputs
+     `(("gpm" ,gpm)))))
+
 (define-public btrfs-progs
   (package
     (name "btrfs-progs")
@@ -3758,7 +3780,7 @@ Light is the successor of lightscript.")
 (define-public tlp
   (package
     (name "tlp")
-    (version "0.9")
+    (version "1.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3768,7 +3790,7 @@ Light is the successor of lightscript.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0xksm8ar6dbq0azbfz8qs9yyzqg1j333lyd5znc074rz8inj4yw8"))))
+                "1v3qpj9kp4rxwqapayd0i9419wwv4bikyrzjvqn0r9xkgnr1f9v4"))))
     (inputs `(("bash" ,bash)
               ("dbus" ,dbus)
               ("ethtool" ,ethtool)
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index 51802229b0..7374cdda1f 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -265,7 +265,7 @@ operating systems.")
   (package
     (inherit mutt)
     (name "neomutt")
-    (version "20170609")
+    (version "20170714")
     (source
      (origin
        (method url-fetch)
@@ -273,7 +273,7 @@ operating systems.")
                            "/archive/" name "-" version ".tar.gz"))
        (sha256
         (base32
-         "1kdhnhdlv84v6brhqgh8g0h6cpcbwfc59b4g09zkkgqc4fnggapy"))))
+         "10x3sxai773n0gfqpi904ci1qvngymcbc2didswrm92wz4h8km20"))))
     (inputs
      `(("cyrus-sasl" ,cyrus-sasl)
        ("gdbm" ,gdbm)
@@ -416,7 +416,7 @@ and corrections.  It is based on a Bayesian filter.")
 (define-public offlineimap
   (package
     (name "offlineimap")
-    (version "7.1.1")
+    (version "7.1.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/OfflineIMAP/offlineimap/"
@@ -424,7 +424,7 @@ and corrections.  It is based on a Bayesian filter.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "00xpxh0pxcvv3mjgb3vq3x51v498dhqcaixyb3a4srmfgskzh956"))))
+                "0rnw7gpx3cp4irja5143haszgv4xhndc8wivhg8r0gpp6ig460vj"))))
     (build-system python-build-system)
     (native-inputs
      `(("asciidoc" ,asciidoc)))
@@ -805,7 +805,7 @@ and search library.")
 (define-public getmail
   (package
     (name "getmail")
-    (version "4.52.0")
+    (version "5.1")
     (source
      (origin
        (method url-fetch)
@@ -813,7 +813,7 @@ and search library.")
                            name "-" version ".tar.gz"))
        (sha256
         (base32
-         "0pzplrlxwbxydvfw4kkwn60l40hk1h5sxawaa6pi0k75c220k4ni"))))
+         "0zh220vx10wi6x61qi0mjayjxgvllk9f6vd4hjrgzha1xbjj0vix"))))
     (build-system python-build-system)
     (arguments
      `(#:tests? #f ; no tests
diff --git a/gnu/packages/man.scm b/gnu/packages/man.scm
index 8319a7e41b..4eefafbe12 100644
--- a/gnu/packages/man.scm
+++ b/gnu/packages/man.scm
@@ -37,7 +37,7 @@
 (define-public libpipeline
   (package
     (name "libpipeline")
-    (version "1.4.0")
+    (version "1.4.2")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -45,7 +45,7 @@
                     version ".tar.gz"))
               (sha256
                (base32
-                "1dlvp2mxlhg5zbj509kc60h7g39hpgwkzkpdf855cyzizgkmkivr"))))
+                "1gkrfqkphdc6gk8gic68asallj59i3cfq6nd31ppks0cljdgrwgy"))))
     (build-system gnu-build-system)
     (home-page "http://libpipeline.nongnu.org/")
     (synopsis "C library for manipulating pipelines of subprocesses")
@@ -57,14 +57,14 @@ a flexible and convenient way.")
 (define-public man-db
   (package
     (name "man-db")
-    (version "2.7.5")
+    (version "2.7.6.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://savannah/man-db/man-db-"
                                   version ".tar.xz"))
               (sha256
                (base32
-                "056a3il7agfazac12yggcg4gf412yq34k065im0cpfxbcw6xskaw"))))
+                "0gqgs4zc3r87apns0k5qp689p2ylxx2596s2mkmkxjjay99brv88"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -93,7 +93,12 @@ a flexible and convenient way.")
              (xz    (assoc-ref %build-inputs "xz"))
              (util  (assoc-ref %build-inputs "util-linux")))
          ;; Invoke groff, less, gzip, bzip2, and xz directly from the store.
-         (append (list "--disable-setuid" ;; Disable setuid man user.
+         (append (list ;; Disable setuid man user.
+                       "--disable-setuid"
+                       ;; Don't constrain ownership of system-wide cache files.
+                       ;; Otherwise creating the manpage database fails with
+                       ;; man-db > 2.7.5.
+                       "--disable-cache-owner"
                        (string-append "--with-pager=" less "/bin/less")
                        (string-append "--with-gzip=" gzip "/bin/gzip")
                        (string-append "--with-bzip2=" bzip2 "/bin/gzip")
@@ -133,7 +138,7 @@ the traditional flat-text whatis databases.")
 (define-public man-pages
   (package
     (name "man-pages")
-    (version "4.11")
+    (version "4.12")
     (source (origin
               (method url-fetch)
               (uri
@@ -146,7 +151,7 @@ the traditional flat-text whatis databases.")
                     "man-pages-" version ".tar.xz")))
               (sha256
                (base32
-                "097m0gsbaz0gf9ir4lmph3h5jj6wmydk1rglfz82dysybx4q1pmd"))))
+                "14z0zcwm0m98fk2m2b3pvr8rs2sb602mg8f7wwb4xl7yj7cpjvbg"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (alist-delete 'configure %standard-phases)
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index 352ce636e6..87cc46b0a4 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -437,7 +437,7 @@ large scale eigenvalue problems.")
                           version ".tgz"))
       (sha256
        (base32
-        "0yavf6m9l78pwlnk5g61cg8x28mr30j0g8gkai0jrdqfjjmf3whs"))))
+        "1j51r7n5w4k7r3lrvy7710xrpkg40wf4rqnmngfz6ck9ypckzign"))))
     (build-system cmake-build-system)
     (home-page "http://www.netlib.org/lapack/")
     (inputs `(("fortran" ,gfortran)
diff --git a/gnu/packages/medical.scm b/gnu/packages/medical.scm
new file mode 100644
index 0000000000..c0d9d597b7
--- /dev/null
+++ b/gnu/packages/medical.scm
@@ -0,0 +1,60 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017 Quiliro <quiliro@fsfla.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages medical)
+  #:use-module (guix build-system python)
+  #:use-module (guix download)
+  #:use-module (guix licenses)
+  #:use-module (guix packages)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages qt))
+
+(define-public openmolar-1
+  (package
+   (name "openmolar")
+   (version "1.0.15-gd81f9e5")
+   (source (origin
+             (method url-fetch)
+             (uri (string-append
+                   "https://static.openmolar.com/om1/releases/openmolar-"
+                   version ".tar.gz"))
+             (sha256
+              (base32
+               "1cfdzfbi6wslw7k0dc6ad6xrgs75iwsl91cg73w4myswaqqkfk3z"))))
+   (build-system python-build-system)
+   (arguments
+    `(#:use-setuptools? #f
+      #:phases
+      (modify-phases %standard-phases
+        (add-after 'unpack 'patch-/usr
+          (lambda* (#:key outputs #:allow-other-keys)
+            (substitute* "setup.py"
+              (("/usr") (assoc-ref outputs "out")))
+            #t)))))
+   (inputs
+    `(("python-pyqt+qscintilla" ,python-pyqt+qscintilla)
+      ("python-mysqlclient" ,python-mysqlclient)
+      ("qscintilla" ,qscintilla)))
+   (home-page "https://openmolar.com/om1")
+   (synopsis "Dental practice management software")
+   (description "Openmolar is a dental practice management suite.  Its
+functionality includes appointments, patient records, treatment planning,
+billing etc.  It is a full featured, reliable and thoroughly tested
+application and has been translated into many languages.")
+   (license gpl3+)))
diff --git a/gnu/packages/messaging.scm b/gnu/packages/messaging.scm
index 827e9edee9..eb9e869152 100644
--- a/gnu/packages/messaging.scm
+++ b/gnu/packages/messaging.scm
@@ -670,7 +670,7 @@ protocols.")
 (define-public c-toxcore
   (package
     (name "c-toxcore")
-    (version "0.1.1")
+    (version "0.1.9")
     (source
      (origin
        (method url-fetch)
@@ -679,32 +679,20 @@ protocols.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "0dybpz44pi0zm8djppjna0r8yh5wvl3l885dv2f1wp5366bk59n3"))))
-    (build-system gnu-build-system)
+         "1y30xc1dzq9knww274d4y0m8gridcf5j851rxdri8j2s64p3qqgk"))))
+    (build-system cmake-build-system)
     (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("libtool" ,libtool)
-       ("check" ,check)
-       ("pkg-config" ,pkg-config)))
-    (inputs
+     `(("pkg-config" ,pkg-config)))
+    (propagated-inputs
      `(("libsodium" ,libsodium)
        ("opus" ,opus)
        ("libvpx" ,libvpx)))
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'autoconf
-           ;; The tarball source is not bootstrapped.
-           (lambda _
-             (zero? (system* "autoreconf" "-vfi")))))
-       #:tests? #f)) ; FIXME: Testsuite fails, needs internet connection.
+    (home-page "https://tox.chat")
     (synopsis "Library for the Tox encrypted messenger protocol")
     (description
-     "Official fork of the C library implementation of the Tox
-encrypted messenger protocol.")
-    (license license:gpl3+)
-    (home-page "https://tox.chat")))
+     "Official fork of the C library implementation of the Tox encrypted
+messenger protocol.")
+    (license license:gpl3+)))
 
 (define-public utox
   (package
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 8a3a5809c7..789e596f84 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;;
@@ -290,14 +290,17 @@ This package contains the binary.")
 (define-public mpg123
   (package
     (name "mpg123")
-    (version "1.25.0")
+    (version "1.25.2")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://sourceforge/mpg123/mpg123/" version
-                                  "/mpg123-" version ".tar.bz2"))
+              (uri (list (string-append "mirror://sourceforge/mpg123/mpg123/"
+                                        version "/mpg123-" version ".tar.bz2")
+                         (string-append
+                          "http://www.mpg123.org/download/mpg123-"
+                          version ".tar.bz2")))
               (sha256
                (base32
-                "0j2fyb984cwvhn8kicf87y39bhjsg43p14aj893hzq25n0fkwbjm"))))
+                "0f7fib7qyd9lah3fqcsjlqcni4bip4hw7iglkz3vz4fjibxv052k"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--with-default-audio=pulse")))
     (native-inputs `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/music.scm b/gnu/packages/music.scm
index 947773289c..40996b11be 100644
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@@ -2101,13 +2101,13 @@ event-based scripts for scrobbling, notifications, etc.")
 (define-public python-mutagen
   (package
     (name "python-mutagen")
-    (version "1.36")
+    (version "1.38")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "mutagen" version))
               (sha256
                (base32
-                "1kabb9b81hgvpd3wcznww549vss12b1xlvpnxg1r6n4c7gikgvnp"))))
+                "0rl7sxn1rcjl48fwga3dqf9f6pzspsny4ngxyf6pp337mrq0z693"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-pytest" ,python-pytest)))
@@ -2345,6 +2345,78 @@ part.  The player is based on a highly modified version of the ModPlug engine,
 with a number of bugfixes and changes to improve IT playback.")
     (license license:gpl2+)))
 
+(define-public sooperlooper
+  (package
+    (name "sooperlooper")
+    (version "1.7.3")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://essej.net/sooperlooper/sooperlooper-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0n2gdxw1fx8nxxnpzf4sj0kp6k6zi1yq59cbz6qqzcnsnpnvszbs"))
+              (patches (search-patches "sooperlooper-build-with-wx-30.patch"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list "CXXFLAGS=-std=gnu++11")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'add-sigc++-includes
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let ((sig (assoc-ref inputs "libsigc++"))
+                   (xml (assoc-ref inputs "libxml2"))
+                   (cwd (getcwd)))
+               (setenv "CPATH"
+                       (string-append sig "/include/sigc++-2.0:"
+                                      sig "/lib/sigc++-2.0/include:"
+                                      xml "/include/libxml2/:"
+                                      cwd "/libs/pbd:"
+                                      cwd "/libs/midi++")))
+             (substitute* '("src/control_osc.hpp"
+                            "src/gui/app_frame.hpp"
+                            "src/gui/config_panel.hpp"
+                            "src/gui/keys_panel.hpp"
+                            "src/gui/latency_panel.hpp"
+                            "src/gui/main_panel.hpp"
+                            "src/gui/midi_bind_panel.hpp"
+                            "src/gui/prefs_dialog.hpp")
+               (("sigc\\+\\+/object.h")
+                "sigc++/sigc++.h"))
+             (substitute* '("src/engine.cpp"
+                            "src/gui/latency_panel.cpp"
+                            "src/gui/looper_panel.cpp"
+                            "src/gui/main_panel.cpp")
+               (("(\\(| )bind " _ pre)
+                (string-append pre "sigc::bind ")))
+             #t))
+         (add-after 'unpack 'fix-xpm-warnings
+           (lambda _
+             (substitute* (find-files "." "\\.xpm$")
+               (("static char") "static const char"))
+             #t)))))
+    (inputs
+     `(("jack" ,jack-1)
+       ("alsa-lib" ,alsa-lib)
+       ("wxwidgets" ,wxwidgets-gtk2)
+       ("libsndfile" ,libsndfile)
+       ("libsamplerate" ,libsamplerate)
+       ("liblo" ,liblo)
+       ("rubberband" ,rubberband)
+       ("libxml2" ,libxml2)
+       ("libsigc++" ,libsigc++)
+       ("ncurses" ,ncurses)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "http://essej.net/sooperlooper/")
+    (synopsis "Live looping sampler")
+    (description
+     "SooperLooper is a live looping sampler capable of immediate loop
+recording, overdubbing, multiplying, reversing and more. It allows for
+multiple simultaneous multi-channel loops limited only by your computer's
+available memory.")
+    (license license:gpl2+)))
+
 (define-public moc
   (package
     (name "moc")
diff --git a/gnu/packages/nano.scm b/gnu/packages/nano.scm
index 093adaae0a..4d0f89996e 100644
--- a/gnu/packages/nano.scm
+++ b/gnu/packages/nano.scm
@@ -29,7 +29,7 @@
 (define-public nano
   (package
     (name "nano")
-    (version "2.8.5")
+    (version "2.8.6")
     (source
      (origin
       (method url-fetch)
@@ -37,7 +37,7 @@
                           version ".tar.xz"))
       (sha256
        (base32
-        "1hl9gni3qmblr062a7w6vz16gvxbswgc5c19c923ja0bk48vyhyb"))))
+        "0xjpm2ka56x5ycrgjh06v110na13xlbm42bs8qibk7g578m9cils"))))
     (build-system gnu-build-system)
     (inputs
      `(("gettext" ,gettext-minimal)
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index d4b9a3d129..2f4d3d233e 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -9,7 +9,7 @@
 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2016, 2017 ng0 <ng0@libertad.pw>
-;;; Copyright © 2016 Arun Isaac <arunisaac@systemreboot.net>
+;;; Copyright © 2016, 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2016 Benz Schenk <benz.schenk@uzh.ch>
 ;;; Copyright © 2016, 2017 Pjotr Prins <pjotr.guix@thebird.nl>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
@@ -70,6 +70,7 @@
   #:use-module (gnu packages textutils)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages valgrind)
+  #:use-module (gnu packages wm)
   #:use-module (gnu packages xml)
   #:use-module (ice-9 match))
 
@@ -1103,7 +1104,7 @@ gone wild and are suddenly taking up your bandwidth.")
 (define-public nzbget
   (package
     (name "nzbget")
-    (version "18.1")
+    (version "19.1")
     (source
      (origin
        (method url-fetch)
@@ -1112,14 +1113,22 @@ gone wild and are suddenly taking up your bandwidth.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "1a8wmbhc1si1n8axzrr8ysmrd3gr643lbh6pvzmr0hnd65fixmx5"))))
+         "0y713g7gd4n5chbhr8lv7k50rxkmzysrg13sscxam3s386mmlb1r"))
+       (modules '((guix build utils)))
+       (snippet
+        ;; Reported upstream as <https://github.com/nzbget/nzbget/pull/414>.
+        '(begin
+           (substitute* "daemon/connect/TlsSocket.cpp"
+             (("gnutls_certificate-verification_status_print")
+              "gnutls_certificate_verification_status_print"))
+           #t))))
     (arguments
      `(#:configure-flags
        (list
-        (string-append "--with-libcurses-includes=" (assoc-ref
-%build-inputs "ncurses") "/include")
-        (string-append "--with-libcurses-libraries=" (assoc-ref
-%build-inputs "ncurses") "/lib")
+        (string-append "--with-libcurses-includes="
+                       (assoc-ref %build-inputs "ncurses") "/include")
+        (string-append "--with-libcurses-libraries="
+                       (assoc-ref %build-inputs "ncurses") "/lib")
         (string-append "--with-tlslib=GnuTLS"))))
     (build-system gnu-build-system)
     (inputs `(("gnutls", gnutls)
@@ -1387,3 +1396,35 @@ newer and only works on Ethernet network interfaces.")
     ;; AGPL 3 with exception for linking with OpenSSL. See the 'LICENSE' file in
     ;; the source distribution for more information.
     (license license:agpl3)))
+
+(define-public bmon
+  (package
+    (name "bmon")
+    (version "4.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/tgraf/bmon/releases/download/v"
+                           version "/bmon-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0ylzriv4pwh76344abzl1w219x188gshbycbna35gsyfp09c7z82"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("libconfuse" ,libconfuse)
+       ("libnl" ,libnl)
+       ("ncurses" ,ncurses)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (synopsis "Bandwidth monitor")
+    (description "bmon is a monitoring and debugging tool to capture
+networking-related statistics and prepare them visually in a human-friendly
+way.  It features various output methods including an interactive curses user
+interface and a programmable text output for scripting.")
+    (home-page "https://github.com/tgraf/bmon")
+    ;; README.md mentions both the 2-clause BSD and expat licenses, but all
+    ;; the source files only have expat license headers. Upstream has been
+    ;; contacted for clarification: https://github.com/tgraf/bmon/issues/59
+    ;; Update the license field when upstream responds.
+    (license (list license:bsd-2
+                   license:expat))))
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index d4415fc501..2cebabbcaf 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -134,6 +134,10 @@
        ("procps" ,procps)
        ("util-linux" ,util-linux)
        ("which" ,which)))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "NODE_PATH")
+            (files '("lib/node_modules")))))
     (inputs
      `(("c-ares" ,c-ares)
        ("http-parser" ,http-parser)
diff --git a/gnu/packages/ntp.scm b/gnu/packages/ntp.scm
index 00526f526f..959aa55a76 100644
--- a/gnu/packages/ntp.scm
+++ b/gnu/packages/ntp.scm
@@ -98,16 +98,14 @@ computers over a network.")
 (define-public openntpd
   (package
     (name "openntpd")
-    (version "6.0p1")
+    (version "6.1p1")
     (source (origin
               (method url-fetch)
-              ;; XXX Use mirror://openbsd
               (uri (string-append
-                    "http://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/openntpd-"
-                    version ".tar.gz"))
+                    "mirror://openbsd/OpenNTPD/" name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1s3plmxmybwpfrimq6sc54wxnn6ca7rb2g5k2bdjm4c88w4q1axi"))))
+                "1ykx9ga76k5m54h7k5x4ds2clxsyfniss5vmf88pxnrip5bx6if8"))))
     (build-system gnu-build-system)
     (home-page "http://www.openntpd.org/")
     (synopsis "NTP client and server by the OpenBSD Project")
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index 8cc18162aa..8a5062802c 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017 Muriithi Frederick Muriuki <fredmanglis@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,7 +26,7 @@
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system python)
-  #:use-module ((guix licenses) #:select (gpl2+ gpl3+ lgpl2.1+ asl2.0))
+  #:use-module ((guix licenses) #:select (gpl2+ gpl3+ lgpl2.1+ asl2.0 bsd-3))
   #:use-module (gnu packages)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages file)
@@ -52,6 +53,7 @@
   #:use-module (gnu packages tls)
   #:use-module (gnu packages ssh)
   #:use-module (gnu packages vim)
+  #:use-module (gnu packages serialization)
   #:use-module (srfi srfi-1)
   #:use-module (ice-9 match))
 
@@ -74,8 +76,8 @@
   ;; Note: the 'update-guix-package.scm' script expects this definition to
   ;; start precisely like this.
   (let ((version "0.13.0")
-        (commit "de9d8f0e295928d92e0e5ea43a4e594fa78c76fb")
-        (revision 2))
+        (commit "b547349d505c57fd679b6e48c472d8ab65469c96")
+        (revision 3))
     (package
       (name "guix")
 
@@ -91,7 +93,7 @@
                       (commit commit)))
                 (sha256
                  (base32
-                  "0px7n4vajc9am3snhnnvddrmnwnb2ygwz0f8isk0qhk8b1ks4kdx"))
+                  "0q6qr9hvrac1wj2ygn4jj4w89h1m35zkcjjd741sibc3l46pa93l"))
                 (file-name (string-append "guix-" version "-checkout"))))
       (build-system gnu-build-system)
       (arguments
@@ -516,3 +518,183 @@ different.  It recursively unpacks archives of many kinds and transforms
 various binary formats into more human readable forms to compare them.  It can
 compare two tarballs, ISO images, or PDFs just as easily.")
     (license gpl3+)))
+
+(define-public python-anaconda-client
+  (package
+    (name "python-anaconda-client")
+    (version "1.6.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/Anaconda-Platform/"
+                           "anaconda-client/archive/" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1wv4wi6k5jz7rlwfgvgfdizv77x3cr1wa2aj0k1595g7fbhkjhz2"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-pyyaml" ,python-pyyaml)
+       ("python-requests" ,python-requests)
+       ("python-clyent" ,python-clyent)))
+    (native-inputs
+     `(("python-pytz" ,python-pytz)
+       ("python-dateutil" ,python-dateutil)
+       ("python-mock" ,python-mock)
+       ("python-coverage" ,python-coverage)
+       ("python-pillow" ,python-pillow)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ;; This is needed for some tests.
+         (add-before 'check 'set-up-home
+           (lambda* _ (setenv "HOME" "/tmp") #t))
+         (add-before 'check 'remove-network-tests
+           (lambda* _
+             ;; Remove tests requiring a network connection
+             (let ((network-tests '("tests/test_upload.py"
+                                    "tests/test_authorizations.py"
+                                    "tests/test_login.py"
+                                    "tests/test_whoami.py"
+                                    "utils/notebook/tests/test_data_uri.py"
+                                    "utils/notebook/tests/test_base.py"
+                                    "utils/notebook/tests/test_downloader.py"
+                                    "inspect_package/tests/test_conda.py")))
+               (with-directory-excursion "binstar_client"
+                 (for-each delete-file network-tests)))
+             #t)))))
+    (home-page "https://github.com/Anaconda-Platform/anaconda-client")
+    (synopsis "Anaconda Cloud command line client library")
+    (description
+     "Anaconda Cloud command line client library provides an interface to
+Anaconda Cloud.  Anaconda Cloud is useful for sharing packages, notebooks and
+environments.")
+    (license bsd-3)))
+
+(define-public python2-anaconda-client
+  (package-with-python2 python-anaconda-client))
+
+(define-public python-conda
+  (package
+    (name "python-conda")
+    (version "4.3.16")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/conda/conda/archive/"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1jq8hyrc5npb5sf4vw6s6by4602yj8f79vzpbwdfgpkn02nfk1dv"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'create-version-file
+           (lambda _
+             (with-output-to-file "conda/.version"
+               (lambda () (display ,version)))
+             #t))
+         (add-before 'check 'remove-failing-tests
+           (lambda _
+             ;; These tests require internet/network access
+             (let ((network-tests '("test_cli.py"
+                                    "test_create.py"
+                                    "test_export.py"
+                                    "test_fetch.py"
+                                    "test_history.py"
+                                    "test_info.py"
+                                    "test_install.py"
+                                    "test_priority.py"
+                                    "conda_env/test_cli.py"
+                                    "conda_env/test_create.py"
+                                    "conda_env/specs/test_notebook.py"
+                                    "conda_env/utils/test_notebooks.py"
+                                    "core/test_index.py"
+                                    "core/test_repodata.py")))
+               (with-directory-excursion "tests"
+                 (for-each delete-file network-tests)
+
+                 ;; FIXME: This test creates a file, then deletes it and tests
+                 ;; that the file was deleted.  For some reason it fails when
+                 ;; building with guix, but does not when you run it in the
+                 ;; directory left when you build with the --keep-failed
+                 ;; option
+                 (delete-file "gateways/disk/test_delete.py")
+                 #t))))
+         (replace 'check
+           (lambda _
+             (setenv "HOME" "/tmp")
+             (zero? (system* "py.test")))))))
+    (native-inputs
+     `(("python-ruamel.yaml" ,python-ruamel.yaml)
+       ("python-requests" ,python-requests)
+       ("python-pycosat" ,python-pycosat)
+       ("python-pytest" ,python-pytest)
+       ("python-responses" ,python-responses)
+       ("python-pyyaml" ,python-pyyaml)
+       ("python-anaconda-client" ,python-anaconda-client)))
+    (home-page "https://github.com/conda/conda")
+    (synopsis "Cross-platform, OS-agnostic, system-level binary package manager")
+    (description
+     "Conda is a cross-platform, Python-agnostic binary package manager.  It
+is the package manager used by Anaconda installations, but it may be used for
+other systems as well.  Conda makes environments first-class citizens, making
+it easy to create independent environments even for C libraries.  Conda is
+written entirely in Python.
+
+This package provides Conda as a library.")
+    (license bsd-3)))
+
+(define-public python2-conda
+  (package-with-python2 python-conda))
+
+(define-public conda
+  (package (inherit python-conda)
+    (name "conda")
+    (arguments
+     (substitute-keyword-arguments (package-arguments python-conda)
+       ((#:phases phases)
+        `(modify-phases ,phases
+           (replace 'build
+             (lambda* (#:key outputs #:allow-other-keys)
+               ;; This test fails when run before installation.
+               (delete-file "tests/test_activate.py")
+
+               ;; Fix broken defaults
+               (substitute* "conda/base/context.py"
+                 (("return sys.prefix")
+                  (string-append "return \"" (assoc-ref outputs "out") "\""))
+                 (("return (prefix_is_writable\\(self.root_prefix\\))" _ match)
+                  (string-append "return False if self.root_prefix == self.conda_prefix else "
+                                 match)))
+
+               ;; The util/setup-testing.py is used to build conda in
+               ;; application form, rather than the default, library form.
+               ;; With this, we are able to run commands like `conda --help`
+               ;; directly on the command line
+               (zero? (system* "python" "utils/setup-testing.py" "build_py"))))
+           (replace 'install
+             (lambda* (#:key inputs outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out"))
+                      (target (string-append out "/lib/python"
+                                             ((@@ (guix build python-build-system)
+                                                  get-python-version)
+                                              (assoc-ref inputs "python"))
+                                             "/site-packages/")))
+                 ;; The installer aborts if the target directory is not on
+                 ;; PYTHONPATH.
+                 (setenv "PYTHONPATH"
+                         (string-append target ":" (getenv "PYTHONPATH")))
+
+                 ;; And it aborts if the directory doesn't exist.
+                 (mkdir-p target)
+                 (zero? (system* "python" "utils/setup-testing.py" "install"
+                                 (string-append "--prefix=" out))))))))))
+    (description
+     "Conda is a cross-platform, Python-agnostic binary package manager.  It
+is the package manager used by Anaconda installations, but it may be used for
+other systems as well.  Conda makes environments first-class citizens, making
+it easy to create independent environments even for C libraries.  Conda is
+written entirely in Python.")))
diff --git a/gnu/packages/parallel.scm b/gnu/packages/parallel.scm
index 37126040af..179fa7ed32 100644
--- a/gnu/packages/parallel.scm
+++ b/gnu/packages/parallel.scm
@@ -45,7 +45,7 @@
 (define-public parallel
   (package
     (name "parallel")
-    (version "20170522")
+    (version "20170722")
     (source
      (origin
       (method url-fetch)
@@ -53,7 +53,7 @@
                           version ".tar.bz2"))
       (sha256
        (base32
-        "1k5wlcc0dr2fxna0vi48s0l6pvbyl4pbclbih4103f1155im23ca"))))
+        "117g50bx1kcbrqix0f1539z5rzhvgsni2wddjv939wcxkrdb1idx"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/patches/bigloo-gc-shebangs.patch b/gnu/packages/patches/bigloo-gc-shebangs.patch
deleted file mode 100644
index 367708610a..0000000000
--- a/gnu/packages/patches/bigloo-gc-shebangs.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Patch shebangs in source that gets unpacked by `configure'.
-
---- bigloo4.1a/gc/install-gc-7.4.0	2014-02-04 14:55:03.000000000 +0100
-+++ bigloo4.1a/gc/install-gc-7.4.0	2014-02-04 14:55:36.000000000 +0100
-@@ -29,10 +29,12 @@ fi
- 
- # untar the two versions of the GC
- $tar xfz $src -C ../gc || (echo "$tar xfz $src failed"; exit 1)
--/bin/rm -rf "../gc/$gc"_fth
-+rm -rf "../gc/$gc"_fth
-+find ../gc/$gc -perm /111 -type f | xargs sed -i -e"s|/bin/sh|`type -P sh`|g"
- mv ../gc/$gc "../gc/$gc"_fth || (echo "mv $gc failed"; exit 1)
- 
- $tar xfz $src  -C ../gc || (echo "$tar xfz $src failed"; exit 1)
-+find ../gc/$gc -perm /111 -type f | xargs sed -i -e"s|/bin/sh|`type -P sh`|g"
- 
- # general Bigloo patch
- (cd "../gc/$gc"_fth && $patch -p1 < ../$gc.patch > /dev/null)
diff --git a/gnu/packages/patches/chicken-CVE-2017-11343.patch b/gnu/packages/patches/chicken-CVE-2017-11343.patch
new file mode 100644
index 0000000000..1d46ad50d9
--- /dev/null
+++ b/gnu/packages/patches/chicken-CVE-2017-11343.patch
@@ -0,0 +1,57 @@
+Fix CVE-2017-11343:
+
+https://lists.nongnu.org/archive/html/chicken-announce/2017-07/msg00000.html
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11343
+
+Patch copied from upstream mailing list:
+
+http://lists.gnu.org/archive/html/chicken-hackers/2017-06/txtod8Pa1wGU0.txt
+
+From ae2633195cc5f4f61c9da4ac90f0c14c010dcc3d Mon Sep 17 00:00:00 2001
+From: Peter Bex <address@hidden>
+Date: Fri, 30 Jun 2017 15:39:45 +0200
+Subject: [PATCH 2/2] Initialize symbol table after setting up randomization
+
+Otherwise, the symbol table wouldn't be correctly randomized.
+---
+ NEWS      | 3 +++
+ runtime.c | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+#diff --git a/NEWS b/NEWS
+#index f4b0e041..6588b30e 100644
+#--- a/NEWS
+#+++ b/NEWS
+#@@ -96,6 +96,9 @@
+#     buffer overrun and/or segfault (thanks to Lemonboy).
+#   - CVE-2017-9334: `length' no longer crashes on improper lists (fixes
+#     #1375, thanks to "megane").
+#+  - The randomization factor of the symbol table was set before
+#+    the random seed was set, causing it to have a fixed value on many
+#+    platforms.
+# 
+# - Core Libraries
+#   - Unit "posix": If file-lock, file-lock/blocking or file-unlock are
+diff --git a/runtime.c b/runtime.c
+index 81c54dd2..a4580abc 100644
+--- a/runtime.c
++++ b/runtime.c
+@@ -799,7 +799,6 @@ int CHICKEN_initialize(int heap, int stack, int symbols, void *toplevel)
+   C_initial_timer_interrupt_period = INITIAL_TIMER_INTERRUPT_PERIOD;
+   C_timer_interrupt_counter = INITIAL_TIMER_INTERRUPT_PERIOD;
+   memset(signal_mapping_table, 0, sizeof(int) * NSIG);
+-  initialize_symbol_table();
+   C_dlerror = "cannot load compiled code dynamically - this is a statically linked executable";
+   error_location = C_SCHEME_FALSE;
+   C_pre_gc_hook = NULL;
+@@ -816,6 +815,7 @@ int CHICKEN_initialize(int heap, int stack, int symbols, void *toplevel)
+   callback_continuation_level = 0;
+   gc_ms = 0;
+   (void)C_randomize(C_fix(time(NULL)));
++  initialize_symbol_table();
+ 
+   if (profiling) {
+ #ifndef C_NONUNIX
+-- 
+2.11.0
+
diff --git a/gnu/packages/patches/evince-CVE-2017-1000083.patch b/gnu/packages/patches/evince-CVE-2017-1000083.patch
new file mode 100644
index 0000000000..2ca062f337
--- /dev/null
+++ b/gnu/packages/patches/evince-CVE-2017-1000083.patch
@@ -0,0 +1,109 @@
+Fix CVE-2017-1000083.
+
+http://seclists.org/oss-sec/2017/q3/128
+https://bugzilla.gnome.org/show_bug.cgi?id=784630
+
+Patch copied from upstream source repository:
+
+https://git.gnome.org/browse/evince/commit/?id=717df38fd8509bf883b70d680c9b1b3cf36732ee
+
+From 717df38fd8509bf883b70d680c9b1b3cf36732ee Mon Sep 17 00:00:00 2001
+From: Bastien Nocera <hadess@hadess.net>
+Date: Thu, 6 Jul 2017 20:02:00 +0200
+Subject: comics: Remove support for tar and tar-like commands
+
+diff --git a/backend/comics/comics-document.c b/backend/comics/comics-document.c
+index 4c74731..641d785 100644
+--- a/backend/comics/comics-document.c
++++ b/backend/comics/comics-document.c
+@@ -56,8 +56,7 @@ typedef enum
+ 	RARLABS,
+ 	GNAUNRAR,
+ 	UNZIP,
+-	P7ZIP,
+-	TAR
++	P7ZIP
+ } ComicBookDecompressType;
+ 
+ typedef struct _ComicsDocumentClass ComicsDocumentClass;
+@@ -117,9 +116,6 @@ static const ComicBookDecompressCommand command_usage_def[] = {
+ 
+         /* 7zip */
+ 	{NULL               , "%s l -- %s"     , "%s x -y %s -o%s", FALSE, OFFSET_7Z},
+-
+-        /* tar */
+-	{"%s -xOf"          , "%s -tf %s"      , NULL             , FALSE, NO_OFFSET}
+ };
+ 
+ static GSList*    get_supported_image_extensions (void);
+@@ -364,13 +360,6 @@ comics_check_decompress_command	(gchar          *mime_type,
+ 			comics_document->command_usage = GNAUNRAR;
+ 			return TRUE;
+ 		}
+-		comics_document->selected_command =
+-				g_find_program_in_path ("bsdtar");
+-		if (comics_document->selected_command) {
+-			comics_document->command_usage = TAR;
+-			return TRUE;
+-		}
+-
+ 	} else if (g_content_type_is_a (mime_type, "application/x-cbz") ||
+ 		   g_content_type_is_a (mime_type, "application/zip")) {
+ 		/* InfoZIP's unzip program */
+@@ -396,12 +385,6 @@ comics_check_decompress_command	(gchar          *mime_type,
+ 			comics_document->command_usage = P7ZIP;
+ 			return TRUE;
+ 		}
+-		comics_document->selected_command =
+-				g_find_program_in_path ("bsdtar");
+-		if (comics_document->selected_command) {
+-			comics_document->command_usage = TAR;
+-			return TRUE;
+-		}
+ 
+ 	} else if (g_content_type_is_a (mime_type, "application/x-cb7") ||
+ 		   g_content_type_is_a (mime_type, "application/x-7z-compressed")) {
+@@ -425,27 +408,6 @@ comics_check_decompress_command	(gchar          *mime_type,
+ 			comics_document->command_usage = P7ZIP;
+ 			return TRUE;
+ 		}
+-		comics_document->selected_command =
+-				g_find_program_in_path ("bsdtar");
+-		if (comics_document->selected_command) {
+-			comics_document->command_usage = TAR;
+-			return TRUE;
+-		}
+-	} else if (g_content_type_is_a (mime_type, "application/x-cbt") ||
+-		   g_content_type_is_a (mime_type, "application/x-tar")) {
+-		/* tar utility (Tape ARchive) */
+-		comics_document->selected_command =
+-				g_find_program_in_path ("tar");
+-		if (comics_document->selected_command) {
+-			comics_document->command_usage = TAR;
+-			return TRUE;
+-		}
+-		comics_document->selected_command =
+-				g_find_program_in_path ("bsdtar");
+-		if (comics_document->selected_command) {
+-			comics_document->command_usage = TAR;
+-			return TRUE;
+-		}
+ 	} else {
+ 		g_set_error (error,
+ 			     EV_DOCUMENT_ERROR,
+diff --git a/configure.ac b/configure.ac
+index 9e9f831..7eb0f1f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -795,7 +795,7 @@ AC_SUBST(TIFF_MIME_TYPES)
+ AC_SUBST(APPDATA_TIFF_MIME_TYPES)
+ AM_SUBST_NOTMAKE(APPDATA_TIFF_MIME_TYPES)
+ if test "x$enable_comics" = "xyes"; then
+-        COMICS_MIME_TYPES="application/x-cbr;application/x-cbz;application/x-cb7;application/x-cbt;application/x-ext-cbr;application/x-ext-cbz;application/vnd.comicbook+zip;application/x-ext-cb7;application/x-ext-cbt"
++        COMICS_MIME_TYPES="application/x-cbr;application/x-cbz;application/x-cb7;application/x-ext-cbr;application/x-ext-cbz;application/vnd.comicbook+zip;application/x-ext-cb7;"
+         APPDATA_COMICS_MIME_TYPES=$(echo "<mimetype>$COMICS_MIME_TYPES</mimetype>" | sed -e 's/;/<\/mimetype>\n    <mimetype>/g')
+         if test -z "$EVINCE_MIME_TYPES"; then
+            EVINCE_MIME_TYPES="${COMICS_MIME_TYPES}"
+-- 
+cgit v0.12
+
diff --git a/gnu/packages/patches/heimdal-CVE-2017-11103.patch b/gnu/packages/patches/heimdal-CVE-2017-11103.patch
new file mode 100644
index 0000000000..d76f0df369
--- /dev/null
+++ b/gnu/packages/patches/heimdal-CVE-2017-11103.patch
@@ -0,0 +1,45 @@
+Fix CVE-2017-11103:
+
+https://orpheus-lyre.info/
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103
+https://security-tracker.debian.org/tracker/CVE-2017-11103
+
+Patch lifted from upstream source repository:
+
+https://github.com/heimdal/heimdal/commit/6dd3eb836bbb80a00ffced4ad57077a1cdf227ea
+
+From 6dd3eb836bbb80a00ffced4ad57077a1cdf227ea Mon Sep 17 00:00:00 2001
+From: Jeffrey Altman <jaltman@secure-endpoints.com>
+Date: Wed, 12 Apr 2017 15:40:42 -0400
+Subject: [PATCH] CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation
+
+In _krb5_extract_ticket() the KDC-REP service name must be obtained from
+encrypted version stored in 'enc_part' instead of the unencrypted version
+stored in 'ticket'.  Use of the unecrypted version provides an
+opportunity for successful server impersonation and other attacks.
+
+Identified by Jeffrey Altman, Viktor Duchovni and Nico Williams.
+
+Change-Id: I45ef61e8a46e0f6588d64b5bd572a24c7432547c
+---
+ lib/krb5/ticket.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/krb5/ticket.c b/lib/krb5/ticket.c
+index d95d96d1b..b8d81c6ad 100644
+--- a/lib/krb5/ticket.c
++++ b/lib/krb5/ticket.c
+@@ -705,8 +705,8 @@ _krb5_extract_ticket(krb5_context context,
+     /* check server referral and save principal */
+     ret = _krb5_principalname2krb5_principal (context,
+ 					      &tmp_principal,
+-					      rep->kdc_rep.ticket.sname,
+-					      rep->kdc_rep.ticket.realm);
++					      rep->enc_part.sname,
++					      rep->enc_part.srealm);
+     if (ret)
+ 	goto out;
+     if((flags & EXTRACT_TICKET_ALLOW_SERVER_MISMATCH) == 0){
+-- 
+2.13.3
+
diff --git a/gnu/packages/patches/heimdal-CVE-2017-6594.patch b/gnu/packages/patches/heimdal-CVE-2017-6594.patch
new file mode 100644
index 0000000000..714af60304
--- /dev/null
+++ b/gnu/packages/patches/heimdal-CVE-2017-6594.patch
@@ -0,0 +1,85 @@
+Fix CVE-2017-6594:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6594
+https://security-tracker.debian.org/tracker/CVE-2017-6594
+
+Patch lifted from upstream source repository:
+
+https://github.com/heimdal/heimdal/commit/b1e699103f08d6a0ca46a122193c9da65f6cf837
+
+To apply the patch to Heimdal 1.5.3 release tarball, the changes to 'NEWS' and
+files in 'tests/' are removed, and hunk #4 of 'kdc/krb5tgs.c' is modified.
+
+From b1e699103f08d6a0ca46a122193c9da65f6cf837 Mon Sep 17 00:00:00 2001
+From: Viktor Dukhovni <viktor@twosigma.com>
+Date: Wed, 10 Aug 2016 23:31:14 +0000
+Subject: [PATCH] Fix transit path validation CVE-2017-6594
+
+Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm
+to not be added to the transit path of issued tickets.  This may, in
+some cases, enable bypass of capath policy in Heimdal versions 1.5
+through 7.2.
+
+Note, this may break sites that rely on the bug.  With the bug some
+incomplete [capaths] worked, that should not have.  These may now break
+authentication in some cross-realm configurations.
+---
+ NEWS                   | 14 ++++++++++++++
+ kdc/krb5tgs.c          | 12 ++++++++++--
+ tests/kdc/check-kdc.in | 17 +++++++++++++++++
+ tests/kdc/krb5.conf.in |  4 ++++
+ 4 files changed, 45 insertions(+), 2 deletions(-)
+
+diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c
+index 6048b9c55..98503812f 100644
+--- a/kdc/krb5tgs.c
++++ b/kdc/krb5tgs.c
+@@ -655,8 +655,12 @@ fix_transited_encoding(krb5_context context,
+ 		  "Decoding transited encoding");
+ 	return ret;
+     }
++
++    /*
++     * If the realm of the presented tgt is neither the client nor the server
++     * realm, it is a transit realm and must be added to transited set.
++     */
+     if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) {
+-	/* not us, so add the previous realm to transited set */
+ 	if (num_realms + 1 > UINT_MAX/sizeof(*realms)) {
+ 	    ret = ERANGE;
+ 	    goto free_realms;
+@@ -737,6 +741,7 @@ tgs_make_reply(krb5_context context,
+ 	       const char *server_name,
+ 	       hdb_entry_ex *client,
+ 	       krb5_principal client_principal,
++               const char *tgt_realm,
+ 	       hdb_entry_ex *krbtgt,
+ 	       krb5_enctype krbtgt_etype,
+ 	       krb5_principals spp,
+@@ -798,7 +803,7 @@ tgs_make_reply(krb5_context context,
+ 				 &tgt->transited, &et,
+ 				 krb5_principal_get_realm(context, client_principal),
+ 				 krb5_principal_get_realm(context, server->entry.principal),
+-				 krb5_principal_get_realm(context, krbtgt->entry.principal));
++				 tgt_realm);
+     if(ret)
+ 	goto out;
+ 
+@@ -1519,4 +1524,6 @@ tgs_build_reply(krb5_context context,
+     krb5_keyblock sessionkey;
+     krb5_kvno kvno;
+     krb5_data rspac;
++    const char *tgt_realm = /* Realm of TGT issuer */
++        krb5_principal_get_realm(context, krbtgt->entry.principal);
+
+@@ -2324,6 +2331,7 @@ server_lookup:
+ 			 spn,
+ 			 client,
+ 			 cp,
++                         tgt_realm,
+ 			 krbtgt_out,
+ 			 tkey_sign->key.keytype,
+ 			 spp,
+-- 
+2.13.3
+
diff --git a/gnu/packages/patches/hop-linker-flags.patch b/gnu/packages/patches/hop-linker-flags.patch
deleted file mode 100644
index f1f5dbfbd9..0000000000
--- a/gnu/packages/patches/hop-linker-flags.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-Make hop's link rules honor flags set by the --blflags configure argument.
-
---- hop-2.4.0/src/Makefile	2015-05-05 19:41:04.800151036 -0500
-+++ hop-2.4.0/src/Makefile	2015-05-05 19:40:40.916150417 -0500
-@@ -69,10 +69,10 @@
- 	$(MAKE) link.$(LINK) DEST=$@
- 
- link.dynamic:
--	@ $(call link,$(BIGLOO),$(BCFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$(DEST))
-+	@ $(call link,$(BIGLOO),$(BCFLAGS) $(BLFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$(DEST))
- 
- link.static:
--	@ $(call link,$(BIGLOO),$(BCFLAGS),$(BCFLAGSDEV),-static-all-bigloo $(OBJECTS),-o,$(DEST))
-+	@ $(call link,$(BIGLOO),$(BCFLAGS) $(BLFLAGS),$(BCFLAGSDEV),-static-all-bigloo $(OBJECTS),-o,$(DEST))
- 
- link.library:
- 	echo "***ERROR: link.library not currently supported!"
---- hop-2.4.0/hopc/Makefile	2013-01-30 07:17:59.000000000 -0600
-+++ hop-2.4.0/hopc/Makefile	2015-05-05 19:45:21.876157699 -0500
-@@ -62,7 +62,7 @@
- 	mkdir -p $@
- 
- $(BUILDBINDIR)/$(EXEC): .afile .etags $(OBJECTS)
--	@ $(call link,$(BIGLOO),$(BCFLAGS),,$(OBJECTS),-o,$@)
-+	@ $(call link,$(BIGLOO),$(BCFLAGS) $(BLFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$@)
- 
- $(BUILDBINDIR)/$(EXEC).jar: .afile .etags .jfile $(BGL_CLASSES) META-INF/MANIFEST.MF jvm-stdlibs jvm-share jvm-lib
- 	$(JAR) $@ META-INF/MANIFEST.MF -C o/class_s .
---- hop-2.4.0/hophz/Makefile	2013-01-30 07:17:59.000000000 -0600
-+++ hop-2.4.0/hophz/Makefile	2015-05-05 19:59:42.996180030 -0500
-@@ -16,9 +16,6 @@
- -include ../etc/Makefile.hopconfig
- -include ../etc/Makefile.version
- 
--BLFLAGS		= 
--BLINKFLAGS 	= -suffix hop
--
- #*---------------------------------------------------------------------*/
- #*    Target and Project                                               */
- #*---------------------------------------------------------------------*/
-@@ -72,7 +69,7 @@
- 	mkdir -p $@
- 
- $(BUILDBINDIR)/$(EXEC): .afile .etags $(OBJECTS)
--	@ $(call link,$(BIGLOO),$(BCFLAGS),$(BLINKFLAGS),$(OBJECTS),-o,$@)
-+	@ $(call link,$(BIGLOO),$(BCFLAGS) $(BLFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$@)
- 
- $(BUILDBINDIR)/$(EXEC).jar: .afile .etags .jfile $(BGL_CLASSES) META-INF/MANIFEST.MF jvm-stdlibs jvm-share jvm-lib
- 	@ $(JAR) $@ META-INF/MANIFEST.MF -C o/class_s .
---- hop-2.4.0/hopsh/Makefile	2013-01-30 07:17:59.000000000 -0600
-+++ hop-2.4.0/hopsh/Makefile	2015-05-05 19:46:36.060159626 -0500
-@@ -60,7 +60,7 @@
- 	mkdir -p $@
- 
- $(BUILDBINDIR)/$(EXEC): .afile .etags $(OBJECTS)
--	@ $(call link,$(BIGLOO),$(BCFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$@)
-+	@ $(call link,$(BIGLOO),$(BCFLAGS) $(BLFLAGS),$(BCFLAGSDEV),$(OBJECTS),-o,$@)
- 
- $(BUILDBINDIR)/$(EXEC).jar: .afile .etags .jfile $(BGL_CLASSES) META-INF/MANIFEST.MF jvm-stdlibs jvm-share jvm-lib
- 	@ $(JAR) $@ META-INF/MANIFEST.MF -C o/class_s .
diff --git a/gnu/packages/patches/libusb-0.1-disable-tests.patch b/gnu/packages/patches/libusb-0.1-disable-tests.patch
new file mode 100644
index 0000000000..37dd8bd111
--- /dev/null
+++ b/gnu/packages/patches/libusb-0.1-disable-tests.patch
@@ -0,0 +1,15 @@
+Disable tests who fail because they have to run as root.
+
+--- libusb-0.1.12/tests/Makefile.in	2006-03-04 03:54:06.000000000 +0100
++++ libusb-0.1.12/tests/Makefile.in	2017-07-13 16:17:45.201728019 +0200
+@@ -255,8 +255,8 @@
+ hub_strings_LDADD = $(top_builddir)/libusbpp.la @OSLIBS@
+ driver_name_SOURCES = driver_name.cpp
+ driver_name_LDADD = $(top_builddir)/libusbpp.la @OSLIBS@
+-TESTS = testlibusb descriptor_test id_test find_hubs find_mice \
+-		get_resolution hub_strings $(OS_SPECIFIC)
++TESTS = testlibusb descriptor_test id_test find_hubs find_mice
++		#get_resolution hub_strings $(OS_SPECIFIC)
+ 
+ XFAIL_TESTS = get_resolution hub_strings $(OS_SPECIFIC_XFAIL)
+ all: all-am
diff --git a/gnu/packages/patches/metabat-fix-compilation.patch b/gnu/packages/patches/metabat-fix-compilation.patch
new file mode 100644
index 0000000000..7086a96e86
--- /dev/null
+++ b/gnu/packages/patches/metabat-fix-compilation.patch
@@ -0,0 +1,39 @@
+This patch changes metabat so that (1) it is not build statically, (2) it uses
+shared libraries rather than static libraries where possible.
+
+diff --git a/SConstruct b/SConstruct
+index 69cdc0a..ac99bcb 100644
+--- a/SConstruct
++++ b/SConstruct
+@@ -26,8 +26,6 @@ debug = ARGUMENTS.get('DEBUG', None)
+ build_flags = ['-Wall', '-g', '-std=c++11', '-fopenmp']
+ link_flags = ['-lstdc++', '-lm', '-fopenmp']
+ 
+-if platform.platform(True, True).find('Darwin') == -1:
+-    link_flags.extend(['-static', '-static-libgcc', '-static-libstdc++'])
+ 
+ if debug is None:
+     build_flags.extend(['-O3', '-DNDEBUG', '-Wno-unknown-pragmas', '-Wno-deprecated-declarations', '-Wno-overflow', '-Wno-unused-variable'])
+@@ -110,17 +108,17 @@ def findStaticOrShared( lib, testPaths, static_source_list, link_flag_list, stat
+     for path in testPaths:
+         if not os.path.isdir(path):
+             continue
++        for testfile in ('%s/lib%s.so' % (path, lib), '%s/lib%s.dylib' % (path, lib)):
++            if os.path.isfile(testfile):
++                print "Found shared library %s as %s" % (lib, testfile)
++                link_flag_list.extend( ["-L%s" % (path), "-l%s" % (lib) ] )
++                return
+         for suffix in staticSuffixes:
+             testfile = '%s/lib%s%s' % (path, lib, suffix)
+             if os.path.isfile(testfile):
+                 static_source_list.append(testfile)
+                 print "Found static library %s as %s" % (lib, testfile)
+                 return
+-        for testfile in ('%s/lib%s.so' % (path, lib), '%s/lib%s.dylib' % (path, lib)):
+-            if os.path.isfile(testfile):
+-                print "Found shared library %s as %s" % (lib, testfile)
+-                link_flag_list.extend( ["-L%s" % (path), "-l%s" % (lib) ] )
+-                return
+     print "Could not find library for %s!!! Looked in %s" % (lib, testPaths)
+     return
+ 
diff --git a/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch b/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch
deleted file mode 100644
index cb60896fad..0000000000
--- a/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-These tests fail on 32-bit due to an overflow.
-
-Upstream bug URL: https://github.com/joke2k/faker/issues/408
-
-diff --git a/faker/tests/__init__.py b/faker/tests/__init__.py
-index 6026772..58b6b83 100644
---- a/faker/tests/__init__.py
-+++ b/faker/tests/__init__.py
-@@ -384,7 +384,6 @@ class FactoryTestCase(unittest.TestCase):
-         provider = Provider
-         # test century
-         self.assertTrue(self._datetime_to_time(provider.date_time_this_century(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
--        self.assertTrue(self._datetime_to_time(provider.date_time_this_century(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
-         # test decade
-         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
-         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
-@@ -413,8 +412,6 @@ class FactoryTestCase(unittest.TestCase):
- 
-         # ensure all methods provide timezone aware datetimes
-         with self.assertRaises(TypeError):
--            provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now()
--        with self.assertRaises(TypeError):
-             provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now()
-         with self.assertRaises(TypeError):
-             provider.date_time_this_year(after_now=False, tzinfo=utc) <= datetime.datetime.now()
-@@ -423,7 +420,6 @@ class FactoryTestCase(unittest.TestCase):
- 
-         # test century
-         self.assertTrue(provider.date_time_this_century(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
--        self.assertTrue(provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
-         # test decade
-         self.assertTrue(provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
-         self.assertTrue(provider.date_time_this_decade(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
--- 
-2.11.1
-
diff --git a/gnu/packages/patches/python-pyopenssl-17.1.0-test-overflow.patch b/gnu/packages/patches/python-pyopenssl-17.1.0-test-overflow.patch
deleted file mode 100644
index 06b2f4fe03..0000000000
--- a/gnu/packages/patches/python-pyopenssl-17.1.0-test-overflow.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-Resolves a test failure on 32-bit platforms.
-
-https://github.com/pyca/pyopenssl/issues/657
-
-Patch copied from upstream source repository:
-
-https://github.com/pyca/pyopenssl/commit/ecc0325479c0d5c5f2ca88b4550e87cdb59d6c95
-
-From ecc0325479c0d5c5f2ca88b4550e87cdb59d6c95 Mon Sep 17 00:00:00 2001
-From: Alex Gaynor <alex.gaynor@gmail.com>
-Date: Thu, 6 Jul 2017 22:14:44 -0400
-Subject: [PATCH] Fixed #657 -- handle OverflowErrors on large allocation
- requests
-
----
- tests/test_rand.py | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/tests/test_rand.py b/tests/test_rand.py
-index bdd3af08..6adf72a1 100644
---- a/tests/test_rand.py
-+++ b/tests/test_rand.py
-@@ -32,10 +32,10 @@ def test_bytes_wrong_args(self, args):
- 
-     def test_insufficient_memory(self):
-         """
--        `OpenSSL.rand.bytes` raises `MemoryError` if more bytes are requested
--        than will fit in memory.
-+        `OpenSSL.rand.bytes` raises `MemoryError` or `OverflowError` if more
-+        bytes are requested than will fit in memory.
-         """
--        with pytest.raises(MemoryError):
-+        with pytest.raises((MemoryError, OverflowError)):
-             rand.bytes(sys.maxsize)
- 
-     def test_bytes(self):
diff --git a/gnu/packages/patches/qemu-CVE-2017-11334.patch b/gnu/packages/patches/qemu-CVE-2017-11334.patch
new file mode 100644
index 0000000000..cb68c803aa
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-11334.patch
@@ -0,0 +1,52 @@
+Fix CVE-2017-11334:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1471638
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11334
+
+Patch copied from upstream source repository:
+
+http://git.qemu.org/?p=qemu.git;a=commitdiff;h=04bf2526ce87f21b32c9acba1c5518708c243ad0
+
+From 04bf2526ce87f21b32c9acba1c5518708c243ad0 Mon Sep 17 00:00:00 2001
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Date: Wed, 12 Jul 2017 18:08:40 +0530
+Subject: [PATCH] exec: use qemu_ram_ptr_length to access guest ram
+
+When accessing guest's ram block during DMA operation, use
+'qemu_ram_ptr_length' to get ram block pointer. It ensures
+that DMA operation of given length is possible; And avoids
+any OOB memory access situations.
+
+Reported-by: Alex <broscutamaker@gmail.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Message-Id: <20170712123840.29328-1-ppandit@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+---
+ exec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/exec.c b/exec.c
+index a083ff89ad..ad103ce483 100644
+--- a/exec.c
++++ b/exec.c
+@@ -2929,7 +2929,7 @@ static MemTxResult address_space_write_continue(AddressSpace *as, hwaddr addr,
+             }
+         } else {
+             /* RAM case */
+-            ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
++            ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l);
+             memcpy(ptr, buf, l);
+             invalidate_and_set_dirty(mr, addr1, l);
+         }
+@@ -3020,7 +3020,7 @@ MemTxResult address_space_read_continue(AddressSpace *as, hwaddr addr,
+             }
+         } else {
+             /* RAM case */
+-            ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
++            ptr = qemu_ram_ptr_length(mr->ram_block, addr1, &l);
+             memcpy(buf, ptr, l);
+         }
+ 
+-- 
+2.13.3
+
diff --git a/gnu/packages/patches/quassel-fix-tls-check.patch b/gnu/packages/patches/quassel-fix-tls-check.patch
new file mode 100644
index 0000000000..057bc02a14
--- /dev/null
+++ b/gnu/packages/patches/quassel-fix-tls-check.patch
@@ -0,0 +1,25 @@
+This allows quasselclient to connect to SSL-enabled quasselcore instances.
+
+The check in qglobal.h requires -fPIC (not -fPIE as it is now). When this check
+fails SSL / TLS is disabled.
+
+This patch comes from the upstream source repository [0] and can be
+removed when the next version is packaged.
+
+[0] https://github.com/quassel/quassel/commit/4768c9e99f99b581d4e32e797db91d0182391696
+
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -428,6 +428,11 @@ endif()
+ cmake_push_check_state(RESET)
+ set(CMAKE_REQUIRED_INCLUDES ${QT_INCLUDES} ${Qt5Core_INCLUDE_DIRS})
+ set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${Qt5Core_EXECUTABLE_COMPILE_FLAGS}")
++
++if (USE_QT5 AND Qt5_POSITION_INDEPENDENT_CODE)
++    set(CMAKE_REQUIRED_FLAGS "-fPIC -DQT_NO_VERSION_TAGGING")
++endif()
++
+ check_cxx_source_compiles("
+     #include \"qglobal.h\"
+     #if defined QT_NO_SSL
+
diff --git a/gnu/packages/patches/sooperlooper-build-with-wx-30.patch b/gnu/packages/patches/sooperlooper-build-with-wx-30.patch
new file mode 100644
index 0000000000..43f4b9be69
--- /dev/null
+++ b/gnu/packages/patches/sooperlooper-build-with-wx-30.patch
@@ -0,0 +1,179 @@
+Downloaded from https://anonscm.debian.org/cgit/pkg-multimedia/sooperlooper.git/plain/debian/patches/04-build_with_wx_30.patch -O gnu/packages/patches/sooperlooper-build-with-wx-30.patch
+
+Author: Jaromír Mikeš <mira.mikes@seznam.cz>, Olly Betts <olly@survex.com>
+Description: build against wx 3.0.
+Forwarded: yes
+
+Index: sooperlooper/src/gui/main_panel.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/main_panel.cpp
++++ sooperlooper/src/gui/main_panel.cpp
+@@ -448,7 +448,7 @@ MainPanel::init_loopers (int count)
+ 		while (count < (int)_looper_panels.size()) {
+ 			looperpan = _looper_panels.back();
+ 			_looper_panels.pop_back();
+-			_main_sizer->Remove(looperpan);
++			_main_sizer->Detach(looperpan);
+ 			looperpan->Destroy();
+ 		}
+ 	}
+@@ -1277,7 +1277,7 @@ void MainPanel::misc_action (bool releas
+ 		}
+ 
+ 
+-		wxString filename = do_file_selector (wxT("Choose file to save loop"), wxT("wav"), wxT("WAVE files (*.wav)|*.wav;*.WAV;*.Wav"),  wxSAVE|wxCHANGE_DIR|wxOVERWRITE_PROMPT);
++		wxString filename = do_file_selector (wxT("Choose file to save loop"), wxT("wav"), wxT("WAVE files (*.wav)|*.wav;*.WAV;*.Wav"),  wxFD_SAVE|wxFD_CHANGE_DIR|wxFD_OVERWRITE_PROMPT);
+ 		
+ 		if ( !filename.empty() )
+ 		{
+@@ -1296,7 +1296,7 @@ void MainPanel::misc_action (bool releas
+ 			index = 0;
+ 		}
+ 
+-		wxString filename = do_file_selector (wxT("Choose file to open"), wxT(""), wxT("*.slsess"), wxOPEN|wxCHANGE_DIR);
++		wxString filename = do_file_selector (wxT("Choose file to open"), wxT(""), wxT("*.slsess"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 		
+ 		if ( !filename.empty() )
+ 		{
+@@ -1408,7 +1408,7 @@ void MainPanel::set_curr_loop (int index
+ 
+ void MainPanel::do_load_session ()
+ {
+-	wxString filename = do_file_selector (wxT("Choose session to load"), wxT("*.slsess"), wxT("*.slsess"), wxOPEN|wxCHANGE_DIR);
++	wxString filename = do_file_selector (wxT("Choose session to load"), wxT("*.slsess"), wxT("*.slsess"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 	
+ 	if ( !filename.empty() )
+ 	{
+@@ -1419,7 +1419,7 @@ void MainPanel::do_load_session ()
+ 
+ void MainPanel::do_save_session (bool write_audio)
+ {
+-	wxString filename = do_file_selector (wxT("Choose file to save session"), wxT("slsess"), wxT("*.slsess"), wxSAVE|wxCHANGE_DIR|wxOVERWRITE_PROMPT);
++	wxString filename = do_file_selector (wxT("Choose file to save session"), wxT("slsess"), wxT("*.slsess"), wxFD_SAVE|wxFD_CHANGE_DIR|wxFD_OVERWRITE_PROMPT);
+ 	
+ 	if ( !filename.empty() )
+ 	{
+Index: sooperlooper/src/gui/pix_button.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/pix_button.cpp
++++ sooperlooper/src/gui/pix_button.cpp
+@@ -250,7 +250,7 @@ PixButton::OnMouseEvents (wxMouseEvent &
+ 		pt.x += bounds.x;
+ 		pt.y += bounds.y;
+ 
+-		if (bounds.Inside(pt)) {
++		if (bounds.Contains(pt)) {
+ 			clicked (get_mouse_button(ev)); // emit
+ 
+ 			if (ev.MiddleUp() && ev.ControlDown()) {
+Index: sooperlooper/src/gui/looper_panel.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/looper_panel.cpp
++++ sooperlooper/src/gui/looper_panel.cpp
+@@ -1428,7 +1428,7 @@ LooperPanel::clicked_events (int button,
+ 	if (cmd == wxT("save"))
+ 	{
+ 		wxString filename = _mainpanel->do_file_selector (wxT("Choose file to save loop"),
+-											      wxT("wav"), wxT("WAVE files (*.wav)|*.wav;*.WAV;*.Wav"),  wxSAVE|wxCHANGE_DIR|wxOVERWRITE_PROMPT);
++											      wxT("wav"), wxT("WAVE files (*.wav)|*.wav;*.WAV;*.Wav"),  wxFD_SAVE|wxFD_CHANGE_DIR|wxFD_OVERWRITE_PROMPT);
+ 		
+ 		if ( !filename.empty() )
+ 		{
+@@ -1442,7 +1442,7 @@ LooperPanel::clicked_events (int button,
+ 	}
+ 	else if (cmd == wxT("load"))
+ 	{
+-		wxString filename = _mainpanel->do_file_selector(wxT("Choose file to open"), wxT(""), wxT("Audio files (*.wav,*.aif)|*.wav;*.WAV;*.Wav;*.aif;*.aiff;*.AIF;*.AIFF|All files (*.*)|*.*"), wxOPEN|wxCHANGE_DIR);
++		wxString filename = _mainpanel->do_file_selector(wxT("Choose file to open"), wxT(""), wxT("Audio files (*.wav,*.aif)|*.wav;*.WAV;*.Wav;*.aif;*.aiff;*.AIF;*.AIFF|All files (*.*)|*.*"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 		
+ 		if ( !filename.empty() )
+ 		{
+Index: sooperlooper/src/gui/keyboard_target.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/keyboard_target.cpp
++++ sooperlooper/src/gui/keyboard_target.cpp
+@@ -553,10 +553,10 @@ KeyboardTarget::keycode_from_name (const
+                         keycode = WXK_RETURN;
+                     }
+                     else if ( keyname == wxT("PGUP") ) {
+-                        keycode = WXK_PRIOR;
++                        keycode = WXK_PAGEUP;
+                     }
+                     else if ( keyname == wxT("PGDN") ) {
+-                        keycode = WXK_NEXT;
++                        keycode = WXK_PAGEDOWN;
+                     }
+                     else if ( keyname == wxT("LEFT") ) {
+                         keycode = WXK_LEFT;
+@@ -630,10 +630,10 @@ wxString KeyboardTarget::name_from_keyco
+ 	case WXK_RETURN:
+ 		text += wxT("return");
+ 		break;
+-	case WXK_PRIOR:
++	case WXK_PAGEUP:
+ 		text += wxT("pageup");
+ 		break;
+-	case WXK_NEXT:
++	case WXK_PAGEDOWN:
+ 		text += wxT("pagedown");
+ 		break;
+ 	case WXK_LEFT:
+Index: sooperlooper/src/gui/check_box.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/check_box.cpp
++++ sooperlooper/src/gui/check_box.cpp
+@@ -237,7 +237,7 @@ CheckBox::OnMouseEvents (wxMouseEvent &e
+ 	}
+ 	else if (ev.LeftUp())
+ 	{
+-		if (bounds.Inside(ev.GetPosition())) {
++		if (bounds.Contains(ev.GetPosition())) {
+ 			// toggle value
+ 			_value = !_value;
+ 		
+Index: sooperlooper/src/gui/midi_bind_panel.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/midi_bind_panel.cpp
++++ sooperlooper/src/gui/midi_bind_panel.cpp
+@@ -880,7 +880,7 @@ void MidiBindPanel::on_button (wxCommand
+ 	}
+ 	else if (ev.GetId() == ID_LoadButton)
+ 	{
+-		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to open"), wxT(""), wxT("*.slb"), wxOPEN|wxCHANGE_DIR);
++		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to open"), wxT(""), wxT("*.slb"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 		if ( !filename.empty() )
+ 		{
+ 			_parent->get_loop_control().load_midi_bindings(filename,  _append_check->GetValue());
+@@ -888,7 +888,7 @@ void MidiBindPanel::on_button (wxCommand
+ 	}
+ 	else if (ev.GetId() == ID_SaveButton)
+ 	{
+-		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to save"), wxT(""), wxT("*.slb"), wxSAVE|wxCHANGE_DIR|wxOVERWRITE_PROMPT);
++		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to save"), wxT(""), wxT("*.slb"), wxFD_SAVE|wxFD_CHANGE_DIR|wxFD_OVERWRITE_PROMPT);
+ 
+ 		if ( !filename.empty() )
+ 		{
+Index: sooperlooper/src/gui/config_panel.cpp
+===================================================================
+--- sooperlooper.orig/src/gui/config_panel.cpp
++++ sooperlooper/src/gui/config_panel.cpp
+@@ -378,7 +378,7 @@ void ConfigPanel::on_button (wxCommandEv
+ 	else if (ev.GetId() == ID_MidiBrowseButton) {
+ 		
+ 		_parent->get_keyboard().set_enabled(false);
+-		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to use"), wxT(""), wxT("*.slb"), wxOPEN|wxCHANGE_DIR);
++		wxString filename = _parent->do_file_selector(wxT("Choose midi binding file to use"), wxT(""), wxT("*.slb"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 		_parent->get_keyboard().set_enabled(true);
+ 		
+ 		if ( !filename.empty() )
+@@ -389,8 +389,8 @@ void ConfigPanel::on_button (wxCommandEv
+ 	else if (ev.GetId() == ID_SessionBrowseButton) {
+ 		
+ 		_parent->get_keyboard().set_enabled(false);
+-		wxString filename = _parent->do_file_selector(wxT("Choose session file to use"), wxT(""), wxT("*.slsess"), wxOPEN|wxCHANGE_DIR);
+-		//wxString filename = wxFileSelector(wxT("Choose session file to use"), wxT(""), wxT(""), wxT(""), wxT("*.slsess"), wxOPEN|wxCHANGE_DIR);
++		wxString filename = _parent->do_file_selector(wxT("Choose session file to use"), wxT(""), wxT("*.slsess"), wxFD_OPEN|wxFD_CHANGE_DIR);
++		//wxString filename = wxFileSelector(wxT("Choose session file to use"), wxT(""), wxT(""), wxT(""), wxT("*.slsess"), wxFD_OPEN|wxFD_CHANGE_DIR);
+ 		_parent->get_keyboard().set_enabled(true);
+ 		
+ 		if ( !filename.empty() )
diff --git a/gnu/packages/patches/spice-CVE-2017-7506.patch b/gnu/packages/patches/spice-CVE-2017-7506.patch
new file mode 100644
index 0000000000..37d8f02831
--- /dev/null
+++ b/gnu/packages/patches/spice-CVE-2017-7506.patch
@@ -0,0 +1,158 @@
+Fix CVE-2017-7506:
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1452606
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7506
+
+Patches copied from Debian spice package version
+'spice_0.12.8-2.1+deb9u1.debian.tar.xz':
+http://security.debian.org/debian-security/pool/updates/main/s/spice/spice_0.12.8-2.1+deb9u1.debian.tar.xz
+
+The patches had to be adapted to apply to the latest spice tarball, and
+are based on these upstream commits:
+
+https://cgit.freedesktop.org/spice/spice/commit/?id=111ab38611cef5012f1565a65fa2d8a8a05cce37
+https://cgit.freedesktop.org/spice/spice/commit/?id=571cec91e71c2aae0d5f439ea2d8439d0c3d75eb
+https://cgit.freedesktop.org/spice/spice/commit/?id=fbbcdad773e2791cfb988f4748faa41943551ca6
+
+From 257f69d619fed407493156c8a7b952abc8a51314 Mon Sep 17 00:00:00 2001
+Date: Mon, 15 May 2017 15:57:28 +0100
+Subject: [spice-server 1/3] reds: Disconnect when receiving overly big
+ ClientMonitorsConfig
+
+Total message size received from the client was unlimited. There is
+a 2kiB size check on individual agent messages, but the MonitorsConfig
+message can be split in multiple chunks, and the size of the
+non-chunked MonitorsConfig message was never checked. This could easily
+lead to memory exhaustion on the host.
+
+---
+ server/reds.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/server/reds.c b/server/reds.c
+index f439a3668..7be85fdfc 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -993,19 +993,34 @@ static void reds_client_monitors_config_cleanup(void)
+ static void reds_on_main_agent_monitors_config(
+         MainChannelClient *mcc, void *message, size_t size)
+ {
++    const unsigned int MAX_MONITORS = 256;
++    const unsigned int MAX_MONITOR_CONFIG_SIZE =
++       sizeof(VDAgentMonitorsConfig) + MAX_MONITORS * sizeof(VDAgentMonConfig);
++
+     VDAgentMessage *msg_header;
+     VDAgentMonitorsConfig *monitors_config;
+     RedsClientMonitorsConfig *cmc = &reds->client_monitors_config;
+ 
++    // limit size of message sent by the client as this can cause a DoS through
++    // memory exhaustion, or potentially some integer overflows
++    if (sizeof(VDAgentMessage) + MAX_MONITOR_CONFIG_SIZE - cmc->buffer_size < size) {
++        goto overflow;
++    }
+     cmc->buffer_size += size;
+     cmc->buffer = realloc(cmc->buffer, cmc->buffer_size);
+     spice_assert(cmc->buffer);
+     cmc->mcc = mcc;
+     memcpy(cmc->buffer + cmc->buffer_pos, message, size);
+     cmc->buffer_pos += size;
++    if (sizeof(VDAgentMessage) > cmc->buffer_size) {
++        spice_debug("not enough data yet. %d", cmc->buffer_size);
++        return;
++    }
+     msg_header = (VDAgentMessage *)cmc->buffer;
+-    if (sizeof(VDAgentMessage) > cmc->buffer_size ||
+-            msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) {
++    if (msg_header->size > MAX_MONITOR_CONFIG_SIZE) {
++        goto overflow;
++    }
++    if (msg_header->size > cmc->buffer_size - sizeof(VDAgentMessage)) {
+         spice_debug("not enough data yet. %d", cmc->buffer_size);
+         return;
+     }
+@@ -1013,6 +1028,12 @@ static void reds_on_main_agent_monitors_config(
+     spice_debug("%s: %d", __func__, monitors_config->num_of_monitors);
+     red_dispatcher_client_monitors_config(monitors_config);
+     reds_client_monitors_config_cleanup();
++    return;
++
++overflow:
++    spice_warning("received invalid MonitorsConfig request from client, disconnecting");
++    red_channel_client_disconnect(main_channel_client_get_base(mcc));
++    reds_client_monitors_config_cleanup();
+ }
+ 
+ void reds_on_main_agent_data(MainChannelClient *mcc, void *message, size_t size)
+-- 
+2.13.0
+From ff2b4ef70181087d5abd50bad76d026ec5088a93 Mon Sep 17 00:00:00 2001
+Date: Mon, 15 May 2017 15:57:28 +0100
+Subject: [spice-server 2/3] reds: Avoid integer overflows handling monitor
+ configuration
+
+Avoid VDAgentMessage::size integer overflows.
+
+---
+ server/reds.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/server/reds.c b/server/reds.c
+index 7be85fdfc..e1c8c1086 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -1024,6 +1024,9 @@ static void reds_on_main_agent_monitors_config(
+         spice_debug("not enough data yet. %d", cmc->buffer_size);
+         return;
+     }
++    if (msg_header->size < sizeof(VDAgentMonitorsConfig)) {
++        goto overflow;
++    }
+     monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header));
+     spice_debug("%s: %d", __func__, monitors_config->num_of_monitors);
+     red_dispatcher_client_monitors_config(monitors_config);
+-- 
+2.13.0
+From 8cc3d7df2792751939cc832f4110c57e2addfca5 Mon Sep 17 00:00:00 2001
+Date: Mon, 15 May 2017 15:57:28 +0100
+Subject: [spice-server 3/3] reds: Avoid buffer overflows handling monitor
+ configuration
+
+It was also possible for a malicious client to set
+VDAgentMonitorsConfig::num_of_monitors to a number larger
+than the actual size of VDAgentMOnitorsConfig::monitors.
+This would lead to buffer overflows, which could allow the guest to
+read part of the host memory. This might cause write overflows in the
+host as well, but controlling the content of such buffers seems
+complicated.
+
+---
+ server/reds.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/server/reds.c b/server/reds.c
+index e1c8c1086..3a42c3755 100644
+--- a/server/reds.c
++++ b/server/reds.c
+@@ -1000,6 +1000,7 @@ static void reds_on_main_agent_monitors_config(
+     VDAgentMessage *msg_header;
+     VDAgentMonitorsConfig *monitors_config;
+     RedsClientMonitorsConfig *cmc = &reds->client_monitors_config;
++    uint32_t max_monitors;
+ 
+     // limit size of message sent by the client as this can cause a DoS through
+     // memory exhaustion, or potentially some integer overflows
+@@ -1028,6 +1029,12 @@ static void reds_on_main_agent_monitors_config(
+         goto overflow;
+     }
+     monitors_config = (VDAgentMonitorsConfig *)(cmc->buffer + sizeof(*msg_header));
++    // limit the monitor number to avoid buffer overflows
++    max_monitors = (msg_header->size - sizeof(VDAgentMonitorsConfig)) /
++                   sizeof(VDAgentMonConfig);
++    if (monitors_config->num_of_monitors > max_monitors) {
++        goto overflow;
++    }
+     spice_debug("%s: %d", __func__, monitors_config->num_of_monitors);
+     red_dispatcher_client_monitors_config(monitors_config);
+     reds_client_monitors_config_cleanup();
+-- 
+2.13.0
diff --git a/gnu/packages/patches/supertuxkart-angelscript-ftbfs.patch b/gnu/packages/patches/supertuxkart-angelscript-ftbfs.patch
new file mode 100644
index 0000000000..db3c56861b
--- /dev/null
+++ b/gnu/packages/patches/supertuxkart-angelscript-ftbfs.patch
@@ -0,0 +1,42 @@
+https://github.com/supertuxkart/stk-code/commit/5e05f1178ce6bc5f3a653b55ab3dc6d016196341.patch
+
+From 5e05f1178ce6bc5f3a653b55ab3dc6d016196341 Mon Sep 17 00:00:00 2001
+From: Deve <deveee@gmail.com>
+Date: Mon, 3 Oct 2016 23:26:09 +0200
+Subject: [PATCH] Fixed compiler error on Linux with non-x86 64bit platforms,
+ e.g. arm64, mips, and s390x architectures
+
+This modification is already applied in upstream angelscript repository:
+https://sourceforge.net/p/angelscript/code/2353/
+
+Thanks to Adrian Bunk and Andreas Jonsson
+---
+ lib/angelscript/projects/cmake/CMakeLists.txt | 1 +
+ lib/angelscript/source/as_config.h            | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/angelscript/projects/cmake/CMakeLists.txt b/lib/angelscript/projects/cmake/CMakeLists.txt
+index e93971315e..755d8378c3 100644
+--- a/lib/angelscript/projects/cmake/CMakeLists.txt
++++ b/lib/angelscript/projects/cmake/CMakeLists.txt
+@@ -67,6 +67,7 @@ set(ANGELSCRIPT_SOURCE
+     ../../source/as_builder.cpp
+     ../../source/as_bytecode.cpp
+     ../../source/as_callfunc.cpp
++    ../../source/as_callfunc_mips.cpp
+     ../../source/as_callfunc_x86.cpp
+     ../../source/as_callfunc_x64_gcc.cpp
+     ../../source/as_callfunc_x64_msvc.cpp
+diff --git a/lib/angelscript/source/as_config.h b/lib/angelscript/source/as_config.h
+index cb05bffbd5..5bb5b8e800 100644
+--- a/lib/angelscript/source/as_config.h
++++ b/lib/angelscript/source/as_config.h
+@@ -844,7 +844,7 @@
+ 			#define THISCALL_PASS_OBJECT_POINTER_ON_THE_STACK
+ 			#define AS_X86
+ 			#undef AS_NO_THISCALL_FUNCTOR_METHOD
+-		#elif defined(__LP64__) && !defined(__arm64__)
++		#elif defined(__x86_64__)
+ 			#define AS_X64_GCC
+ 			#undef AS_NO_THISCALL_FUNCTOR_METHOD
+ 			#define HAS_128_BIT_PRIMITIVES
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 61aaf7c153..574ae4a6ba 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -34,6 +34,7 @@
   (package
    (name "pcre")
    (version "8.40")
+   (replacement pcre-8.41)
    (source (origin
             (method url-fetch)
             (uri (list
@@ -72,6 +73,21 @@ POSIX regular expression API.")
    (license license:bsd-3)
    (home-page "http://www.pcre.org/")))
 
+(define pcre-8.41
+  (package
+    (inherit pcre)
+    (version "8.41")
+    (source (origin
+              (method url-fetch)
+              (uri (list (string-append "mirror://sourceforge/pcre/pcre/"
+                                        version "/pcre-" version ".tar.bz2")
+                         (string-append "ftp://ftp.csx.cam.ac.uk"
+                                        "/pub/software/programming/pcre/"
+                                        "pcre-" version ".tar.bz2")))
+              (sha256
+               (base32
+                "0c5m469p5pd7jip621ipq6hbgh7128lzh7xndllfgh77ban7wb76"))))))
+
 (define-public pcre2
   (package
     (name "pcre2")
diff --git a/gnu/packages/photo.scm b/gnu/packages/photo.scm
index 1811e8ad3e..7cfbe2ffbe 100644
--- a/gnu/packages/photo.scm
+++ b/gnu/packages/photo.scm
@@ -255,7 +255,7 @@ overlapping images, as well as some command line tools.")
        ("help2man" ,help2man)
        ("imagemagick" ,imagemagick)
        ("libxml2" ,libxml2)
-       ("texlive-minimal" ,texlive-minimal)
+       ("texlive-minimal" ,texlive-tiny)
        ("tidy" ,tidy)
        ("transfig" ,transfig)))
     (inputs
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index ba9153b68b..3bd6710667 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -43,6 +43,7 @@
 ;;; Copyright © 2017 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2017 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
+;;; Copyright © 2017 Muriithi Frederick Muriuki <fredmanglis@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -100,6 +101,7 @@
   #:use-module (gnu packages qt)
   #:use-module (gnu packages readline)
   #:use-module (gnu packages sdl)
+  #:use-module (gnu packages search)
   #:use-module (gnu packages shells)
   #:use-module (gnu packages ssh)
   #:use-module (gnu packages statistics)
@@ -655,26 +657,50 @@ on localhost.")
 (define-public python-pytz
   (package
     (name "python-pytz")
-    (version "2016.10")
+    (version "2017.2")
     (source
      (origin
       (method url-fetch)
-      (uri (pypi-uri "pytz" version ".tar.bz2"))
+      (uri (pypi-uri "pytz" version ".zip"))
       (sha256
        (base32
-        "0az099cyp6p5xbsvfcdacj4hvxncbwm2ayn3h55mcp07zb2b45kh"))))
+        "12cmd3j46d2gcw08bspvp6s9icfcvx88zjz52n1bli9dyvl5dh7m"))))
     (build-system python-build-system)
-    (arguments `(#:tests? #f)) ; no test target
+    (native-inputs
+     `(("unzip" ,unzip)))
     (home-page "http://pythonhosted.org/pytz")
     (synopsis "Python timezone library")
-    (description
-     "This library allows accurate and cross platform timezone calculations
-using Python 2.4 or higher and provides access to the Olson timezone database.")
+    (description "This library brings the Olson tz database into Python.  It
+allows accurate and cross platform timezone calculations using Python 2.4 or
+higher.  It also solves the issue of ambiguous times at the end of daylight
+saving time.  Almost all of the Olson timezones are supported.")
     (license license:expat)))
 
 (define-public python2-pytz
   (package-with-python2 python-pytz))
 
+(define-public python-clyent
+  (package
+    (name "python-clyent")
+    (version "1.2.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "clyent" version))
+       (sha256
+        (base32
+         "1r9987qmy1pz3hq54160bapqsywpq14waw4w9x3ly8hmq7kpgfbj"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-mock" ,python-mock)))
+    (home-page "https://github.com/binstar/clyent")
+    (synopsis "Command line client library")
+    (description "Clyent is a Python command line utiliy library.  It is used
+by @code{binstar}, @code{binstar-build} and @code{chalmers}.")
+    (license license:bsd-3)))
+
+(define-public python2-clyent
+  (package-with-python2 python-clyent))
 
 (define-public python-babel
   (package
@@ -2715,6 +2741,46 @@ version numbers.")
              (propagated-inputs
               `(("python2-functools32" ,python2-functools32))))))
 
+(define-public python-schema
+  (package
+    (name "python-schema")
+    (version "0.6.6")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "schema" version))
+       (sha256
+        (base32
+         "1lw28j9w9vxyigg7vkfkvi6ic9lgjkdnfvnxdr7pklslqvzmk2vm"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (home-page "https://github.com/keleshev/schema")
+    (synopsis "Simple data validation library")
+    (description
+     "@code{python-schema} is a library for validating Python data
+structures, such as those obtained from config-files, forms, external
+services or command-line parsing, converted from JSON/YAML (or
+something else) to Python data-types.")
+    (license license:psfl)))
+
+(define-public python2-schema
+  (package-with-python2 python-schema))
+
+(define-public python-schema-0.5
+  (package (inherit python-schema)
+    (version "0.5.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "schema" version))
+       (sha256
+        (base32
+         "10zqvpaky51kgb8nd42bk7jwl8cn2zvayxjpdc1wwmpybj92x67s"))))))
+
+(define-public python2-schema-0.5
+  (package-with-python2 python-schema-0.5))
+
 (define-public python-kitchen
   (package
     (name "python-kitchen")
@@ -3125,6 +3191,36 @@ reStructuredText.")
 (define-public python2-pygments
   (package-with-python2 python-pygments))
 
+(define-public python-sphinxcontrib-websupport
+  (package
+    (name "python-sphinxcontrib-websupport")
+    (version "1.0.1")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "sphinxcontrib-websupport" version))
+              (sha256
+               (base32
+                "1f9f0wjpi9nhikbyaz6d19s7qvzdf1nq2g5dsh640fma4q9rd1bs"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-mock" ,python-mock)
+       ("python-pytest" ,python-pytest)
+       ("python-xapian-bindings" ,python-xapian-bindings)))
+    ;; Needed for running the test suite
+    (native-inputs
+     `(("python-six" ,python-six)
+       ("python-jinja2" ,python-jinja2)
+       ("python-docutils" ,python-docutils)
+       ("python-sphinx" ,python-sphinx)
+       ("python-sqlalchemy" ,python-sqlalchemy)
+       ("python-whoosh" ,python-whoosh)))
+    (home-page "http://sphinx-doc.org/")
+    (synopsis "Sphinx API for web applications")
+    (description "This package provides a Python API to easily integrate
+Sphinx documentation into your web application.  It provides tools to
+integrate Sphinx documents in web templates and to handle searches.")
+    (license license:bsd-3)))
+
 (define-public python-sphinx
   (package
     (name "python-sphinx")
@@ -3169,6 +3265,36 @@ sources.")
     (license license:bsd-3)
     (properties `((python2-variant . ,(delay python2-sphinx))))))
 
+(define-public python-sphinx-1.6
+  (package (inherit python-sphinx)
+    (name "python-sphinx")
+    (version "1.6.3")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "Sphinx" version))
+              (sha256
+               (base32
+                "1rj6f3i8hmrx2qlkshi5kp5xcy98dlynwlyl05yvflj5f66dp2xg"))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _
+             ;; Requires Internet access.
+             (delete-file "tests/test_build_linkcheck.py")
+             (substitute* "tests/test_build_latex.py"
+               (("@pytest.mark.sphinx\\('latex', testroot='images'\\)")
+                "@pytest.mark.skip()"))
+             (zero? (system* "make" "test")))))))
+    (propagated-inputs
+     `(("python-sphinxcontrib-websupport" ,python-sphinxcontrib-websupport)
+       ,@(package-propagated-inputs python-sphinx)))
+    (native-inputs
+     `(("python-pytest" ,python-pytest-3.0)
+       ("imagemagick" ,imagemagick) ; for "convert"
+       ,@(package-native-inputs python-sphinx)))
+    (properties '())))
+
 (define-public python-sphinx-1.5.3
   (package
     (inherit python-sphinx)
@@ -3684,7 +3810,39 @@ association studies (GWAS) on extremely large data sets.")
        ("pkg-config" ,pkg-config)
        ("python-sphinx" ,python-sphinx)
        ("python-numpydoc" ,python-numpydoc)
-       ("texlive" ,texlive)
+       ("texlive" ,(texlive-union (list texlive-fonts-amsfonts
+                                        texlive-fonts-ec
+                                        texlive-generic-ifxetex
+                                        texlive-generic-pdftex
+                                        texlive-latex-amsfonts
+                                        texlive-latex-capt-of
+                                        texlive-latex-cmap
+                                        texlive-latex-environ
+                                        texlive-latex-eqparbox
+                                        texlive-latex-etoolbox
+                                        texlive-latex-expdlist
+                                        texlive-latex-fancyhdr
+                                        texlive-latex-fancyvrb
+                                        texlive-latex-fncychap
+                                        texlive-latex-float
+                                        texlive-latex-framed
+                                        texlive-latex-geometry
+                                        texlive-latex-graphics
+                                        texlive-latex-hyperref
+                                        texlive-latex-mdwtools
+                                        texlive-latex-multirow
+                                        texlive-latex-oberdiek
+                                        texlive-latex-parskip
+                                        texlive-latex-preview
+                                        texlive-latex-tabulary
+                                        texlive-latex-threeparttable
+                                        texlive-latex-titlesec
+                                        texlive-latex-trimspaces
+                                        texlive-latex-ucs
+                                        texlive-latex-upquote
+                                        texlive-latex-url
+                                        texlive-latex-varwidth
+                                        texlive-latex-wrapfig)))
        ("texinfo" ,texinfo)
        ("perl" ,perl)
        ("scipy-sphinx-theme"
@@ -3713,6 +3871,11 @@ association studies (GWAS) on extremely large data sets.")
                     (scipy-sphinx-theme "scipy-sphinx-theme")
                     (sphinx-theme-checkout (assoc-ref inputs scipy-sphinx-theme))
                     (pyver ,(string-append "PYVER=")))
+
+               ;; FIXME: this is needed to for texlive-union to generate
+               ;; fonts, which are not found.
+               (setenv "HOME" "/tmp")
+
                (with-directory-excursion "doc"
                  (copy-recursively sphinx-theme-checkout scipy-sphinx-theme)
                  (mkdir-p html)
@@ -4480,6 +4643,35 @@ multivalue dictionary that retains the order of insertions and deletions.")
 (define-public python2-furl
   (package-with-python2 python-furl))
 
+(define-public python-flaky
+  (package
+    (name "python-flaky")
+    (version "3.4.0")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "flaky" version))
+              (sha256
+               (base32
+                "18pkmf79rfkfpy1d2rrx3v55nxj762ilyk9rvd6s6dccxw58imsa"))))
+    (build-system python-build-system)
+    (arguments
+     ;; TODO: Tests require 'coveralls' and 'genty' which are not in Guix yet.
+     '(#:tests? #f))
+    (home-page "https://github.com/box/flaky")
+    (synopsis "Automatically rerun flaky tests")
+    (description
+     "Flaky is a plugin for @code{nose} or @code{py.test} that automatically
+reruns flaky tests.
+
+Ideally, tests reliably pass or fail, but sometimes test fixtures must rely
+on components that aren't 100% reliable.  With flaky, instead of removing
+those tests or marking them to @code{@skip}, they can be automatically
+retried.")
+    (license license:asl2.0)))
+
+(define-public python2-flaky
+  (package-with-python2 python-flaky))
+
 (define-public python-flask-babel
   (package
     (name "python-flask-babel")
@@ -5429,7 +5621,40 @@ tools for mocking system commands and recording calls to those.")
        ("python-nose" ,python-nose)
        ("python-sphinx" ,python-sphinx)
        ("python-shpinx-rtd-theme" ,python-sphinx-rtd-theme)
-       ("texlive" ,texlive)
+       ;; FIXME: It's possible that a smaller union would work just as well.
+       ("texlive" ,(texlive-union (list texlive-fonts-amsfonts
+                                        texlive-fonts-ec
+                                        texlive-generic-ifxetex
+                                        texlive-generic-pdftex
+                                        texlive-latex-amsfonts
+                                        texlive-latex-capt-of
+                                        texlive-latex-cmap
+                                        texlive-latex-environ
+                                        texlive-latex-eqparbox
+                                        texlive-latex-etoolbox
+                                        texlive-latex-expdlist
+                                        texlive-latex-fancyhdr
+                                        texlive-latex-fancyvrb
+                                        texlive-latex-fncychap
+                                        texlive-latex-float
+                                        texlive-latex-framed
+                                        texlive-latex-geometry
+                                        texlive-latex-graphics
+                                        texlive-latex-hyperref
+                                        texlive-latex-mdwtools
+                                        texlive-latex-multirow
+                                        texlive-latex-oberdiek
+                                        texlive-latex-parskip
+                                        texlive-latex-preview
+                                        texlive-latex-tabulary
+                                        texlive-latex-threeparttable
+                                        texlive-latex-titlesec
+                                        texlive-latex-trimspaces
+                                        texlive-latex-ucs
+                                        texlive-latex-upquote
+                                        texlive-latex-url
+                                        texlive-latex-varwidth
+                                        texlive-latex-wrapfig)))
        ("texinfo" ,texinfo)))
     (arguments
      `(#:phases
@@ -6049,13 +6274,13 @@ of the structure, dynamics, and functions of complex networks.")
 (define-public snakemake
   (package
     (name "snakemake")
-    (version "3.11.2")
+    (version "3.13.3")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "snakemake" version))
        (sha256
-        (base32 "0qcp7y9csvanyzh08jppryhd5di8r1z7p0d4wkfg5591pj3bb8zp"))))
+        (base32 "1nixb944r4hlskwkzc4wjs34b40xpxpw9gmhhm5p09gvmm22ap5d"))))
     (build-system python-build-system)
     (arguments
      ;; TODO: Package missing test dependencies.
@@ -6337,6 +6562,31 @@ connection to each user.")
 (define-public python2-backports-abc
   (package-with-python2 python-backports-abc))
 
+(define-public python-backports-csv
+  (package
+    (name "python-backports-csv")
+    (version "1.0.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "backports.csv" version))
+       (sha256
+        (base32
+         "1imzbrradkfn8s2m1qcimyn74dn1mz2p3j381jljn166rf2i6hlc"))))
+    (build-system python-build-system)
+    (home-page "https://github.com/ryanhiebert/backports.csv")
+    (synopsis "Backport of Python 3's csv module for Python 2")
+    (description
+     "Provides a  backport of Python 3's @code{csv} module for parsing
+comma separated values.  The API of the @code{csv} module in Python 2
+is drastically different from the @code{csv} module in Python 3.
+This is due, for the most part, to the difference between str in
+Python 2 and Python 3.")
+    (license license:psfl)))
+
+(define-public python2-backports-csv
+  (package-with-python2 python-backports-csv))
+
 (define-public python2-backports-shutil-get-terminal-size
   (package
     (name "python2-backports-shutil-get-terminal-size")
@@ -7392,14 +7642,14 @@ responses, rather than doing any computation.")
 (define-public python-cryptography-vectors
   (package
     (name "python-cryptography-vectors")
-    (version "1.9")
+    (version "2.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography_vectors" version))
        (sha256
         (base32
-         "1wvq1p1viam1diz9x6d61x1bsy6cninv7cjgd35x9ffig9r6gxxv"))))
+         "0qadys01517k5wy0rifxip02p08kzrqxm5j0lmmlp0kr07h9jc7h"))))
     (build-system python-build-system)
     (home-page "https://github.com/pyca/cryptography")
     (synopsis "Test vectors for the cryptography package")
@@ -7414,14 +7664,14 @@ responses, rather than doing any computation.")
 (define-public python-cryptography
   (package
     (name "python-cryptography")
-    (version "1.9")
+    (version "2.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography" version))
        (sha256
         (base32
-         "10j8r1s29f4h59kp3mla14g588rm7qpn90nrczijk03i49q3662m"))))
+         "1c40qlxyn1jgg99f3pqi7146d3561rn9zdqc7w8f7kwr9ysm696k"))))
     (build-system python-build-system)
     (inputs
      `(("openssl" ,openssl)))
@@ -7463,16 +7713,14 @@ message digests and key derivation functions.")
 (define-public python-pyopenssl
   (package
     (name "python-pyopenssl")
-    (version "17.1.0")
+    (version "17.2.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyOpenSSL" version))
-       (patches
-        (search-patches "python-pyopenssl-17.1.0-test-overflow.patch"))
        (sha256
         (base32
-         "0qwmqhfsq84ydir9dz273ypmlcvs7v71m1jns0sd4k0h6lfsa82s"))))
+         "0d283g4zi0hr9papd24mjl70mi15gyzq6fx618rizi87dgipqqax"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
@@ -7496,7 +7744,8 @@ message digests and key derivation functions.")
     (inputs
      `(("openssl" ,openssl)))
     (native-inputs
-     `(("python-pretend" ,python-pretend)
+     `(("python-flaky" ,python-flaky)
+       ("python-pretend" ,python-pretend)
        ("python-pytest" ,python-pytest-3.0)))
     (home-page "https://github.com/pyca/pyopenssl")
     (synopsis "Python wrapper module around the OpenSSL library")
@@ -11641,53 +11890,6 @@ addresses, and phone numbers.")
        `(("python2-ipaddress" ,python2-ipaddress)
          ,@(package-propagated-inputs base))))))
 
-(define-public python-fake-factory
-  (package
-  (name "python-fake-factory")
-  (version "0.7.2")
-  (source (origin
-            (method url-fetch)
-            (uri (pypi-uri "fake-factory" version))
-            (sha256
-             (base32
-              "0vs0dkmg0dlaxf8w6q2i3k0i03gmp56ablldv7ci9x3nbadkn71g"))
-            (patches
-             (search-patches
-              "python-fake-factory-fix-build-32bit.patch"))))
-  (build-system python-build-system)
-  (arguments
-   '(#:phases
-     (modify-phases %standard-phases
-       (replace 'check
-         (lambda _
-           (zero? (system* "python" "-m" "unittest" "-v" "faker.tests")))))))
-  (native-inputs
-   `(;; For testing
-     ("python-email-validator" ,python-email-validator)
-     ("python-mock" ,python-mock)
-     ("python-ukpostcodeparser" ,python-ukpostcodeparser)))
-  (propagated-inputs
-   `(("python-dateutil" ,python-dateutil)
-     ("python-six" ,python-six)))
-  (home-page "https://github.com/joke2k/faker")
-  (synopsis "Python package that generates fake data")
-  (description
-   "Faker is a Python package that generates fake data such as names,
-addresses, and phone numbers.")
-  (license license:expat)
-  (properties `((python2-variant . ,(delay python2-fake-factory))
-                (superseded . ,python-faker)))))
-
-(define-public python2-fake-factory
-  (let ((base (package-with-python2 (strip-python2-variant
-                                     python-fake-factory))))
-    (package
-      (inherit base)
-      (properties `((superseded . ,python2-faker)))
-      (propagated-inputs
-       `(("python2-ipaddress" ,python2-ipaddress)
-         ,@(package-propagated-inputs base))))))
-
 (define-public python-pyaml
   (package
     (name "python-pyaml")
@@ -14297,6 +14499,29 @@ pytest report.")
 (define-public python2-pytest-warnings
   (package-with-python2 python-pytest-warnings))
 
+(define-public python-pytest-capturelog
+  (package
+    (name "python-pytest-capturelog")
+    (version "0.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pytest-capturelog" version ".tar.gz"))
+       (sha256
+        (base32
+         "038049nyjl7di59ycnxvc9nydivc5m8np3hqq84j2iirkccdbs5n"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("pytest" ,python-pytest-3.0)))
+    (home-page "http://bitbucket.org/memedough/pytest-capturelog/overview")
+    (synopsis "Pytest plugin to catch log messages")
+    (description
+     "Python-pytest-catchlog is a pytest plugin to catch log messages.")
+    (license license:expat)))
+
+(define-public python2-pytest-capturelog
+  (package-with-python2 python-pytest-capturelog))
+
 (define-public python-pytest-catchlog
   (package
     (name "python-pytest-catchlog")
@@ -15173,6 +15398,49 @@ by path in a JSON document (see RFC 6901).")
 (define-public python2-jsonpointer
   (package-with-python2 python-jsonpointer))
 
+(define-public python-jsonpatch
+  (package
+    (name "python-jsonpatch")
+    (version "1.16")
+    (source
+     (origin
+       (method url-fetch)
+       ;; pypi version lacks tests.js
+       (uri (string-append "https://github.com/stefankoegl/python-json-patch/"
+                           "archive/v" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "085ykisl8v7mv9h7hvhdy3l2fjzs4214gx32r5k6nx4f76hbv6y5"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-jsonpointer" ,python-jsonpointer)))
+    (home-page "https://github.com/stefankoegl/python-json-patch")
+    (synopsis "Applying JSON Patches in Python 2.6+ and 3.x")
+    (description "@code{jsonpatch} is a library and program that allows
+applying JSON Patches according to RFC 6902.")
+    (license license:bsd-3)))
+
+(define-public python2-jsonpatch
+  (package-with-python2 python-jsonpatch))
+
+(define-public python-jsonpatch-0.4
+  (package (inherit python-jsonpatch)
+    (name "python-jsonpatch")
+    (version "0.4")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/stefankoegl/python-json-patch/"
+                           "archive/v" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0j0cd9z9zyp8kppp464jxrfgrnbgkzl1yi10i5gsv8yz6d95929d"))))))
+
+(define-public python2-jsonpatch-0.4
+  (package-with-python2 python-jsonpatch-0.4))
+
 (define-public python-rfc3987
   (package
     (name "python-rfc3987")
diff --git a/gnu/packages/qt.scm b/gnu/packages/qt.scm
index 65067efe75..3e3588a505 100644
--- a/gnu/packages/qt.scm
+++ b/gnu/packages/qt.scm
@@ -5,6 +5,8 @@
 ;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 ng0 <ng0@libertad.pw>
 ;;; Copyright © 2016 Thomas Danckaert <post@thomasdanckaert.be>
+;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017 Quiliro <quiliro@fsfla.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,6 +30,7 @@
   #:use-module (guix build utils)
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system trivial)
   #:use-module (guix packages)
   #:use-module (guix utils)
   #:use-module (gnu packages)
@@ -1374,6 +1377,109 @@ contain over 620 classes.")
            (inputs
             `(("python" ,python-2)))))
 
+(define-public qscintilla
+  (package
+    (name "qscintilla")
+    (version "2.10.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/pyqt/QScintilla2/"
+                                  "QScintilla-" version "/QScintilla_gpl-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0r7s7ndblv3jc0xig1y4l64b6mfr879cdv3zwdndn27rj6fqmycp"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (chdir "Qt4Qt5")
+               (substitute* "qscintilla.pro"
+                 (("\\$\\$\\[QT_INSTALL_LIBS\\]")
+                  (string-append out "/lib"))
+                 (("\\$\\$\\[QT_INSTALL_HEADERS\\]")
+                  (string-append out "/include"))
+                 (("\\$\\$\\[QT_INSTALL_TRANSLATIONS\\]")
+                  (string-append out "/translations"))
+                 (("\\$\\$\\[QT_INSTALL_DATA\\]") out)
+                 (("\\$\\$\\[QT_HOST_DATA\\]") out))
+               (zero? (system* "qmake"))))))))
+    (native-inputs `(("qtbase" ,qtbase)))
+    (home-page "http://www.riverbankcomputing.co.uk/software/qscintilla/intro")
+    (synopsis "Qt port of the Scintilla C++ editor control")
+    (description "QScintilla is a port to Qt of Neil Hodgson's Scintilla C++
+editor control.  QScintilla includes features especially useful when editing
+and debugging source code.  These include support for syntax styling, error
+indicators, code completion and call tips.")
+    (license license:gpl3+)))
+
+(define-public python-qscintilla
+  (package (inherit qscintilla)
+    (name "python-qscintilla")
+    (arguments
+     `(#:configure-flags
+       (list "--pyqt=PyQt5"
+             (string-append "--pyqt-sipdir="
+                            (assoc-ref %build-inputs "python-pyqt")
+                            "/share/sip")
+             (string-append "--qsci-incdir="
+                            (assoc-ref %build-inputs "qscintilla")
+                            "/include")
+             (string-append "--qsci-libdir="
+                            (assoc-ref %build-inputs "qscintilla")
+                            "/lib"))
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs configure-flags #:allow-other-keys)
+             (chdir "Python")
+             (and (zero? (apply system* "python3" "configure.py"
+                                configure-flags))
+                  ;; Install to the right directory
+                  (begin
+                    (substitute* '("Makefile"
+                                   "Qsci/Makefile")
+                      (("\\$\\(INSTALL_ROOT\\)/gnu/store/[^/]+")
+                       (assoc-ref outputs "out")))
+                    #t)))))))
+    (inputs
+     `(("qscintilla" ,qscintilla)
+       ("python" ,python)
+       ("python-pyqt" ,python-pyqt)))
+    (description "QScintilla is a port to Qt of Neil Hodgson's Scintilla C++
+editor control.  QScintilla includes features especially useful when editing
+and debugging source code.  These include support for syntax styling, error
+indicators, code completion and call tips.
+
+This package provides the Python bindings.")))
+
+;; PyQt only looks for modules in its own directory.  It ignores environment
+;; variables such as PYTHONPATH, so we need to build a union package to make
+;; it work.
+(define-public python-pyqt+qscintilla
+  (package (inherit python-pyqt)
+    (name "python-pyqt+qscintilla")
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+     '(#:modules ((guix build union))
+       #:builder (begin
+                   (use-modules (ice-9 match)
+                                (guix build union))
+                   (match %build-inputs
+                     (((names . directories) ...)
+                      (union-build (assoc-ref %outputs "out")
+                                   directories))))))
+    (inputs
+     `(("python-pyqt" ,python-pyqt)
+       ("python-qscintilla" ,python-qscintilla)))
+    (synopsis "Union of PyQt and the Qscintilla extension")
+    (description
+     "This package contains the union of PyQt and the Qscintilla extension.")))
+
 (define-public qtkeychain
   (package
     (name "qtkeychain")
diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index b7f298d2be..4e0121040e 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -147,14 +147,14 @@ anywhere.")
 (define-public samba
   (package
     (name "samba")
-    (version "4.6.4")
+    (version "4.6.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.samba.org/pub/samba/stable/"
                                  "samba-" version ".tar.gz"))
              (sha256
               (base32
-               "0qcsinhcq3frlqp7bfav5mdc9xn1h4xy4l6vfpf8cmcfs4lp7ija"))))
+               "13hs7xplygbl5dgwnn3l0hkbc0a282wdrkbx5c7y6nnqyw4whcgw"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm
index dae00732af..161138285e 100644
--- a/gnu/packages/scheme.scm
+++ b/gnu/packages/scheme.scm
@@ -35,10 +35,14 @@
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial)
+  #:use-module (gnu packages bdw-gc)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages libevent)
+  #:use-module (gnu packages libunistring)
   #:use-module (gnu packages m4)
   #:use-module (gnu packages multiprecision)
   #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages pcre)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages emacs)
   #:use-module (gnu packages ghostscript)
@@ -195,47 +199,35 @@ features an integrated Emacs-like editor and a large runtime library.")
 (define-public bigloo
   (package
     (name "bigloo")
-    (version "4.1a")
+    (version "4.3a")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp-sop.inria.fr/indes/fp/Bigloo/bigloo"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "170q7nh08n4v20xl81fxb0xcdxphqqacfa643hsa8i2ar6pki04c"))
-             (patches (search-patches "bigloo-gc-shebangs.patch"))))
+               "03rcqs6kvy2j5lqk4fidqay5qfyp474qqspbh6wk4qdbds6w599w"))
+             ;; Remove bundled libraries.
+             (modules '((guix build utils)))
+             (snippet
+              '(for-each delete-file-recursively
+                         '("gc" "gmp" "libuv")))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
        #:phases
        (modify-phases %standard-phases
          (replace 'configure
-           (lambda* (#:key outputs #:allow-other-keys)
+           (lambda* (#:key inputs outputs #:allow-other-keys)
 
              (substitute* "configure"
                (("^shell=.*$")
-                (string-append "shell=" (which "bash") "\n")))
-
-             ;; Since libgc's pthread redirects are used, we end up
-             ;; using libgc symbols, so we must link against it.
-             ;; Reported on 2013-06-25.
-             (substitute* "api/pthread/src/Makefile"
-               (("^EXTRALIBS[[:blank:]]*=(.*)$" _ value)
-                (string-append "EXTRALIBS = "
-                               (string-trim-right value)
-                               " -l$(GCLIB)_fth-$(RELEASE)"
-                               " -Wl,-rpath=" (assoc-ref outputs "out")
-                               "/lib/bigloo/" ,version)))
-
-             ;; Those variables are used by libgc's `configure'.
-             (setenv "SHELL" (which "sh"))
-             (setenv "CONFIG_SHELL" (which "sh"))
-
-             ;; ... but they turned out to be overridden later, so work
-             ;; around that.
-             (substitute* (find-files "gc" "^configure-gc")
-               (("sh=/bin/sh")
-                (string-append "sh=" (which "sh"))))
+                (string-append "shell=" (which "bash") "\n"))
+               (("`date`") "0"))
+             (substitute* "autoconf/runtest.in"
+               ((", @DATE@") ""))
+             (substitute* "autoconf/osversion"
+               (("^version.*$") "version=\"\"\n"))
 
              ;; The `configure' script doesn't understand options
              ;; of those of Autoconf.
@@ -243,28 +235,39 @@ features an integrated Emacs-like editor and a large runtime library.")
                (zero?
                 (system* "./configure"
                          (string-append "--prefix=" out)
-                         ;; FIXME: Currently fails, see
-                         ;; <http://article.gmane.org/gmane.lisp.scheme.bigloo/6126>.
-                         ;; "--customgc=no" ; use our libgc
+                         ; use system libraries
+                         "--customgc=no"
+                         "--customunistring=no"
+                         "--customlibuv=no"
                          (string-append"--mv=" (which "mv"))
                          (string-append "--rm=" (which "rm"))
                          "--cflags=-fPIC"
                          (string-append "--ldflags=-Wl,-rpath="
                                         (assoc-ref outputs "out")
-                                        "/lib/bigloo/" ,version))))))
+                                        "/lib/bigloo/" ,version)
+                         (string-append "--lispdir=" out
+                                        "/share/emacs/site-lisp")
+                         "--sharedbde=yes"
+                         "--sharedcompiler=yes")))))
          (add-after 'install 'install-emacs-modes
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
                     (dir (string-append out "/share/emacs/site-lisp")))
                (zero? (system* "make" "-C" "bmacs" "all" "install"
-                               (string-append "EMACSBRAND=emacs24")
+                               (string-append "EMACSBRAND=emacs25")
                                (string-append "EMACSDIR=" dir)))))))))
     (inputs
      `(("emacs" ,emacs)                      ;UDE needs the X version of Emacs
+       ("libgc" ,libgc)
+       ("libunistring" ,libunistring)
+       ("libuv" ,libuv)
+       ("openssl" ,openssl)
+       ("sqlite" ,sqlite)
 
        ;; Optional APIs for which Bigloo has bindings.
        ("avahi" ,avahi)
-       ("libphidget" ,libphidget)))
+       ("libphidget" ,libphidget)
+       ("pcre" ,pcre)))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
     (propagated-inputs
@@ -285,21 +288,23 @@ Scheme and C programs and between Scheme and Java programs.")
 (define-public hop
   (package
     (name "hop")
-    (version "2.5.1")
+    (version "3.1.0-pre2")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp-sop.inria.fr/indes/fp/Hop/hop-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "1bvp7pc71bln5yvfj87s8750c6l53wjl6f8m12v62q9926adhwys"))
-             (patches (search-patches "hop-linker-flags.patch"))))
+               "09m7pahjsp7wxzd20cdph9j3mgf2nq5dyckcjljcd40m25v85kks"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:phases
+     `(#:test-target "test"
+       #:make-flags '("BIGLOO=bigloo")
+       #:parallel-build? #f
+       #:phases
        (modify-phases %standard-phases
          (replace 'configure
-           (lambda* (#:key outputs #:allow-other-keys)
+           (lambda* (#:key inputs outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
                (zero?
                 (system* "./configure"
@@ -307,11 +312,16 @@ Scheme and C programs and between Scheme and Java programs.")
                          (string-append "--blflags="
                                         ;; user flags completely override useful
                                         ;; default flags, so repeat them here.
-                                        "-copt \\$(CPICFLAGS) -L\\$(BUILDLIBDIR) "
-                                        "-ldopt -Wl,-rpath," out "/lib")))))))
-       #:tests? #f))                                ; no test suite
+                                        "-copt \\$(CPICFLAGS) "
+                                        "-L \\$(BUILDLIBDIR) "
+                                        "-ldopt -Wl,-rpath," out "/lib")))))))))
     (inputs `(("avahi" ,avahi)
               ("bigloo" ,bigloo)
+              ("libgc" ,libgc)
+              ("libunistring" ,libunistring)
+              ("libuv" ,libuv)
+              ("pcre" ,pcre)
+              ("sqlite" ,sqlite)
               ("which" ,which)))
     (home-page "http://hop.inria.fr/")
     (synopsis "Multi-tier programming language for the Web 2.0")
@@ -335,7 +345,8 @@ mashups, office (web agendas, mail clients, ...), etc.")
                (base32
                 "12b9gaa9lqh39lj1v4wm48f6z8ww3jdkvc5bh9gqqvn6kd2wwnk0"))
               (patches
-               (search-patches "chicken-CVE-2017-6949.patch"))))
+               (search-patches "chicken-CVE-2017-6949.patch"
+                               "chicken-CVE-2017-11343.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/screen.scm b/gnu/packages/screen.scm
index af0079be20..ef67595a89 100644
--- a/gnu/packages/screen.scm
+++ b/gnu/packages/screen.scm
@@ -37,13 +37,13 @@
 (define-public screen
   (package
     (name "screen")
-    (version "4.6.0")
+    (version "4.6.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/screen/screen-"
                                  version ".tar.gz"))
              (sha256
-              (base32 "1m7yd2bs1i623kk27nfy3qa2mgjp5qjqxwj5qz21r51ycmmp0cwl"))))
+              (base32 "0r3wpfxnr5kw73b8ndja26jk03nfbks06iyfmgb5aqb2rdkazadb"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("makeinfo" ,texinfo)))
diff --git a/gnu/packages/search.scm b/gnu/packages/search.scm
index 8651b985e3..cc8c0630bb 100644
--- a/gnu/packages/search.scm
+++ b/gnu/packages/search.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2014 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015, 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
+;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,6 +31,7 @@
   #:use-module (gnu packages databases)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages python)
   #:use-module (gnu packages web)
   #:use-module (gnu packages xml))
 
@@ -70,6 +72,32 @@ rich set of boolean query operators.")
     (home-page "https://xapian.org/")
     (license (list gpl2+ bsd-3 x11))))
 
+(define-public python-xapian-bindings
+  (package (inherit xapian)
+    (name "python-xapian-bindings")
+    (version (package-version xapian))
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://oligarchy.co.uk/xapian/" version
+                                  "/xapian-bindings-" version ".tar.xz"))
+              (sha256
+               (base32
+                "0fca9nsf7pj3fq991xcm5iainz3s8yqik4ycvavm09y486n3wciv"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags '("--with-python3")
+       #:make-flags
+       (list (string-append "pkgpylibdir="
+                            (assoc-ref %outputs "out")
+                            "/lib/python3.5/site-packages/xapian"))))
+    (inputs
+     `(("python" ,python)
+       ("python-sphinx" ,python-sphinx) ; for documentation
+       ("xapian" ,xapian)
+       ("zlib" ,zlib)))
+    (synopsis "Python bindings for the Xapian search engine library")
+    (license gpl2+)))
+
 (define-public libtocc
   (package
     (name "libtocc")
diff --git a/gnu/packages/serialization.scm b/gnu/packages/serialization.scm
index 6b7461e62b..3994191bd2 100644
--- a/gnu/packages/serialization.scm
+++ b/gnu/packages/serialization.scm
@@ -6,6 +6,7 @@
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Corentin Bocquillon <corentin@nybble.fr>
 ;;; Copyright © 2017 Gregor Giesen <giesen@zaehlwerk.net>
+;;; Copyright © 2017 Frederick M. Muriithi <fredmanglis@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -38,7 +39,8 @@
   #:use-module (gnu packages lua)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
-  #:use-module (gnu packages perl))
+  #:use-module (gnu packages perl)
+  #:use-module (guix build-system python))
 
 (define-public cereal
   (package
@@ -351,3 +353,33 @@ it is comparable to protobuf.")
 “Trivial integration”, and “Serious testing”.
 However, “Memory efficiency” and “Speed” have not been primary goals.")
     (license license:expat)))
+
+(define-public python-ruamel.yaml
+  (package
+    (name "python-ruamel.yaml")
+    (version "0.15.19")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "ruamel.yaml" version))
+       (sha256
+        (base32
+         "0qx779avw8d1vsjqyi7z21h1g5ykp8paqavgj0lzbp8h7bw9vpgv"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (arguments
+     `(;; TODO: Tests require packaging "ruamel.std.pathlib".
+       #:tests? #f))
+    (home-page "https://bitbucket.org/ruamel/yaml")
+    (synopsis "YAML 1.2 parser/emitter")
+    (description
+     "This package provides YAML parser/emitter that supports roundtrip
+preservation of comments, seq/map flow style, and map key order.  It
+is a derivative of Kirill Simonov’s PyYAML 3.11.  It supports YAML 1.2
+and has round-trip loaders and dumpers.  It supports comments.  Block
+style and key ordering are kept, so you can diff the source.")
+    (license license:expat)))
+
+(define-public python2-ruamel.yaml
+  (package-with-python2 python-ruamel.yaml))
diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm
index 65e0eda50a..8d2a957eae 100644
--- a/gnu/packages/shells.scm
+++ b/gnu/packages/shells.scm
@@ -6,8 +6,9 @@
 ;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2016 Stefan Reichör <stefan@xsteve.at>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2017 ng0 <ng0@no-reply.infotropique.org>
+;;; Copyright © 2017 ng0 <ng0@infotropique.org>
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -54,17 +55,12 @@
     (version "0.5.9.1")
     (source
      (origin
-       ;; The canonical source is offline, so we fetch the source code
-       ;; from the Git repository. See:
-       ;; https://www.mail-archive.com/dash@vger.kernel.org/msg01323.html
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://git.kernel.org/pub/scm/utils/dash/dash.git/")
-              (commit (string-append "v" version))))
-       (file-name (string-append name "-" version "-checkout"))
+       (method url-fetch)
+       (uri (string-append "http://gondor.apana.org.au/~herbert/dash/files/"
+                           "dash-" version ".tar.gz"))
        (sha256
         (base32
-         "0p01vx7rbyf5hyyaff7h8cbhq81bm5fmq1m933484lncl9rafcai"))
+         "0ng695mq5ngg43h7ljhxvbjm46ym3nayj6ssn47d2gm9fbm5pkay"))
        (modules '((guix build utils)))
        (snippet
         '(begin
@@ -75,17 +71,10 @@
               "a command interpreter based on the original Bourne shell"))
            #t))))
     (build-system gnu-build-system)
-    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)))
     (inputs
      `(("libedit" ,libedit)))
     (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'bootstrap
-           (lambda _ (zero? (system* "autoreconf" "-vfi")))))
-       #:configure-flags '("--with-libedit")))
+     '(#:configure-flags '("--with-libedit")))
     (home-page "http://gondor.apana.org.au/~herbert/dash")
     (synopsis "POSIX-compliant shell optimised for size")
     (description
@@ -564,6 +553,29 @@ extra programs.  > is just another unix command, < is essentially cat(1).
 A @code{andglob} program is also provided along with s.")
       (license bsd-3))))
 
+(define-public oksh
+  (package
+    (name "oksh")
+    (version "0.5.9")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://connochaetos.org/oksh/oksh-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "0ln9yf6pxngsviqszv8klnnvn8vcpplvj1njdn8xr2y8frkbw8r3"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(; The test files are not part of the distributed tarball.
+       #:tests? #f))
+    (home-page "https://connochaetos.org/oksh")
+    (synopsis "Port of OpenBSD Korn Shell")
+    (description
+     "Oksh is a port of the OpenBSD Korn Shell.
+The OpenBSD Korn Shell is a cleaned up and enhanced ksh.")
+    (license gpl3+)))
+
 (define-public loksh
   (package
     (name "loksh")
@@ -599,3 +611,42 @@ interactive POSIX shell targeted at resource-constrained systems.")
     ;; The file 'LEGAL' says it is the public domain, and the 2
     ;; exceptions which are listed are not included in this port.
     (license public-domain)))
+
+(define-public mksh
+  (package
+    (name "mksh")
+    (version "55")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R"
+                           version ".tgz"))
+       (sha256
+        (base32
+         "0mssqd2wp3cs9x01v6g66iy3ymdxagbyw2c0v597vnc1l6s2rm6f"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ; tests require access to /dev/tty
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (replace 'build
+           (lambda _
+             (setenv "CC" "gcc")
+             (zero? (system* (which "sh") "Build.sh"))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin"))
+                    (man (string-append out "/share/man/man1")))
+               (install-file "mksh" bin)
+               (with-directory-excursion bin
+                 (symlink "mksh" "ksh"))
+               (install-file "mksh.1" man)))))))
+    (home-page "https://www.mirbsd.org/mksh.htm")
+    (synopsis "Korn Shell from MirBSD")
+    (description "mksh is an actively developed free implementation of the
+Korn Shell programming language and a successor to the Public Domain Korn
+Shell (pdksh).")
+    (license (list miros
+                   isc)))) ; strlcpy.c
diff --git a/gnu/packages/sml.scm b/gnu/packages/sml.scm
new file mode 100644
index 0000000000..6e57c4a4a0
--- /dev/null
+++ b/gnu/packages/sml.scm
@@ -0,0 +1,72 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Andy Patterson <ajpatter@uwaterloo.ca>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages sml)
+  #:use-module (gnu packages lesstif)
+  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages xorg)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix download)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages))
+
+(define-public polyml
+  (package
+    (name "polyml")
+    (version "5.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/polyml/polyml/archive/v"
+                           version ".tar.gz"))
+       (sha256
+        (base32 "0ycjl746h0m22w9nsdssjl47d56jih12gpkdg3yw65gakj70sd0r"))
+       (file-name (string-append name "-" version ".tar.gz"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("gmp" ,gmp)
+       ("lesstif",lesstif)
+       ("libffi" ,libffi)
+       ("libx11" ,libx11)
+       ("libxt" ,libxt)))
+    (arguments
+     '(#:configure-flags
+       (list "--with-system-libffi=yes"
+             "--with-x=yes"
+             "--with-threads=yes"
+             "--with-gmp=yes")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'build 'build-compiler
+           (lambda* (#:key make-flags parallel-build? #:allow-other-keys)
+             (define flags
+               (if parallel-build?
+                   (cons (format #f "-j~d" (parallel-job-count))
+                         make-flags)
+                   make-flags))
+             (apply system* "make" (append flags (list "compiler"))))))))
+    (home-page "http://www.polyml.org/")
+    (synopsis "Standard ML implementation")
+    (description "Poly/ML is a Standard ML implementation.  It is fully
+compatible with the ML97 standard.  It includes a thread library, a foreign
+function interface, and a symbolic debugger.")
+    ;; Some source files specify 'or any later version'; some don't
+    (license
+     (list license:lgpl2.1
+           license:lgpl2.1+))))
diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 838db4b35d..8e3c5e2b7f 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -90,7 +90,7 @@
   over a network connection.  It can be used to redirect traffic from a USB device
   to a different (virtual) machine than the one to which the USB device is
   attached.")
-      (home-page "http://www.spice-space.org")
+      (home-page "https://www.spice-space.org")
       (license (list license:gpl2+ license:lgpl2.0+ license:lgpl2.1+)))))
 
 (define-public virglrenderer
@@ -122,7 +122,7 @@ system to use the host GPU to accelerate 3D rendering.")
 (define-public spice-protocol
   (package
     (name "spice-protocol")
-    (version "0.12.12")
+    (version "0.12.13")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -130,7 +130,7 @@ system to use the host GPU to accelerate 3D rendering.")
                 "spice-protocol-" version ".tar.bz2"))
               (sha256
                (base32
-                "00wx81f2ml62g3maw63jq9w217zym921rdi38h7lpm5m8ckxraqp"))))
+                "0cwrgkp558mblcf4vrhacb3iizz12khsrrl82w38w9nj0ar13vl9"))))
     (build-system gnu-build-system)
     (synopsis "Protocol headers for the SPICE protocol")
     (description "SPICE (the Simple Protocol for Independent Computing
@@ -211,7 +211,8 @@ which allows users to view a desktop computing environment.")
                (base32
                 "0za03i77j8i3g5l2np2j7vy8cqsdbkm9wbv4hjnaqq9xhz2sa0gr"))
               (patches
-               (search-patches "spice-CVE-2016-9577.patch"
+               (search-patches "spice-CVE-2017-7506.patch"
+                               "spice-CVE-2016-9577.patch"
                                "spice-CVE-2016-9578-1.patch"
                                "spice-CVE-2016-9578-2.patch"))))
     (build-system gnu-build-system)
@@ -297,7 +298,7 @@ resolution scaling on graphical console window resize.")
 (define-public virt-viewer
   (package
     (name "virt-viewer")
-    (version "4.0")
+    (version "5.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -305,7 +306,7 @@ resolution scaling on graphical console window resize.")
                 "virt-viewer-" version ".tar.gz"))
               (sha256
                (base32
-                "07zsi1fqg05mag1ayniaqj25fzb6dxg76d4ka5196lq4l477nhhw"))))
+                "0blbp1wkw8ahss9va0bmcz2yx18j0mvm6fzrzhh2ly3sja5ysb8b"))))
     (build-system gnu-build-system)
     (inputs
       `(("gtk+" ,gtk+)
diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index c11976a125..22737b7aec 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -130,16 +130,12 @@ a server that supports the SSH-2 protocol.")
    (name "openssh")
    (version "7.5p1")
    (source (origin
-            (method url-fetch)
-            (uri (let ((tail (string-append name "-" version ".tar.gz")))
-                   (list (string-append "http://openbsd.cs.fau.de/pub/OpenBSD/OpenSSH/portable/"
-                                        tail)
-                         (string-append "http://ftp.fr.openbsd.org/pub/OpenBSD/OpenSSH/portable/"
-                                        tail)
-                         (string-append "http://ftp2.fr.openbsd.org/pub/OpenBSD/OpenSSH/portable/"
-                                        tail))))
-            (sha256 (base32
-                     "1w7rb5gbrikxdkp8w7zxnci4549gk4bw1lml01s59w5rzb2y6ilq"))))
+             (method url-fetch)
+             (uri (string-append "mirror://openbsd/OpenSSH/portable/"
+                                 name "-" version ".tar.gz"))
+             (sha256
+              (base32
+               "1w7rb5gbrikxdkp8w7zxnci4549gk4bw1lml01s59w5rzb2y6ilq"))))
    (build-system gnu-build-system)
    (native-inputs `(("groff" ,groff)))
    (inputs `(("openssl" ,openssl)
@@ -347,13 +343,13 @@ authentication scheme.")
 (define-public mosh
   (package
     (name "mosh")
-    (version "1.3.0")
+    (version "1.3.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://mosh.org/mosh-" version ".tar.gz"))
               (sha256
                (base32
-                "0xikz40q873g9ihvz3x6bwkcb9hb8kcnp5wpcmb72pg5c7s143ij"))))
+                "05hjhlp6lk8yjcy59zywpf0r6s0h0b9zxq0lw66dh9x8vxrhaq6s"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -409,8 +405,8 @@ especially over Wi-Fi, cellular, and long-distance links.")
     (description
      "Eternal Terminal (ET) is a remote shell that automatically reconnects
 without interrupting the session.  Unlike SSH sessions, ET sessions will
-survive even after the network outages or IP changes.  ET uses a custom
-protocol over TCP, not the SSH protocol.")
+survive even network outages and IP changes.  ET uses a custom protocol over
+TCP, not the SSH protocol.")
     (home-page "https://mistertea.github.io/EternalTCP/")
     (license license:asl2.0)))
 
diff --git a/gnu/packages/statistics.scm b/gnu/packages/statistics.scm
index 41c0668151..604bdf9c5f 100644
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@@ -34,6 +34,7 @@
   #:use-module (guix build-system trivial)
   #:use-module (gnu packages)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages cran)
   #:use-module (gnu packages curl)
   #:use-module (gnu packages gcc)
   #:use-module (gnu packages gtk)
@@ -644,26 +645,6 @@ interactive data exploration and manipulation and optionally leverage
 caching.")
     (license license:gpl2)))
 
-(define-public r-colorspace
-  (package
-    (name "r-colorspace")
-    (version "1.3-2")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (cran-uri "colorspace" version))
-       (sha256
-        (base32 "0d1ya7hx4y58n5ivwmdmq2zgh0g2sbv7ykh13n85c1355csd57yx"))))
-    (build-system r-build-system)
-    (home-page "http://cran.r-project.org/web/packages/colorspace")
-    (synopsis "Color space manipulation")
-    (description
-     "This package carries out a mapping between assorted color spaces
-including RGB, HSV, HLS, CIEXYZ, CIELUV, HCL (polar CIELUV), CIELAB and polar
-CIELAB.  Qualitative, sequential, and diverging color palettes based on HCL
-colors are provided.")
-    (license license:bsd-3)))
-
 (define-public r-dichromat
   (package
     (name "r-dichromat")
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index 91f4b3d0ed..a914d41c43 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -107,7 +107,7 @@ silently and reliably flow across to every other.")
 (define-public qsyncthingtray
   (package
     (name "qsyncthingtray")
-    (version "0.5.7")
+    (version "0.5.8")
     (source
       (origin
         (method url-fetch)
@@ -117,7 +117,7 @@ silently and reliably flow across to every other.")
         (file-name (string-append name "-" version ".tar.gz"))
         (sha256
          (base32
-          "1qzlxgq36sb1dk621nkbjw9k6y3css6q3z8xzx6nv7f327vanvp6"))))
+          "1024778ml7q62ziqm4d22z5sc1715l34846pwfyzfpcyl32qlhpz"))))
     (build-system cmake-build-system)
     (arguments
      `(#:configure-flags '("-DQST_BUILD_WEBKIT=1")
diff --git a/gnu/packages/terminals.scm b/gnu/packages/terminals.scm
index 028cc99bfd..df093c293d 100644
--- a/gnu/packages/terminals.scm
+++ b/gnu/packages/terminals.scm
@@ -34,6 +34,7 @@
   #:use-module (guix packages)
   #:use-module (gnu packages)
   #:use-module (gnu packages autotools)
+  #:use-module (gnu packages docbook)
   #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages gl)
@@ -41,17 +42,14 @@
   #:use-module (gnu packages gnome)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages ncurses)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages qt)
   #:use-module (gnu packages wm)
-  #:use-module (gnu packages ncurses)
-  #:use-module (gnu packages gtk)
-  #:use-module (gnu packages gnome)
   #:use-module (gnu packages xdisorg)
   #:use-module (gnu packages xml)
-  #:use-module (gnu packages docbook)
-  #:use-module (gnu packages qt)
   #:use-module (srfi srfi-26))
 
 (define-public tilda
diff --git a/gnu/packages/tex.scm b/gnu/packages/tex.scm
index 3b9fb275fc..601705e98a 100644
--- a/gnu/packages/tex.scm
+++ b/gnu/packages/tex.scm
@@ -201,11 +201,41 @@ This package contains the binaries.")
        #:builder
        (begin
          (use-modules (guix build utils))
-         (let ((target (string-append (assoc-ref %outputs "out")
-                                      "/share/texmf-dist/dvips")))
-           (mkdir-p target)
-           (copy-recursively (assoc-ref %build-inputs "source") target)
+         (let* ((root (string-append (assoc-ref %outputs "out")
+                                     "/share/texmf-dist"))
+                (dvips (string-append root "/dvips"))
+                (maps  (string-append root "/fonts/map/dvips/tetex"))
+                (encs  (string-append root "/fonts/enc/dvips/base")))
+           (mkdir-p dvips)
+           (copy-recursively (assoc-ref %build-inputs "source") dvips)
+           (mkdir-p maps)
+           (copy-recursively (assoc-ref %build-inputs "dvips-font-maps") maps)
+           (mkdir-p encs)
+           (copy-recursively (assoc-ref %build-inputs "dvips-base-enc") encs)
            #t))))
+    (native-inputs
+     `(("dvips-font-maps"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/map/dvips/tetex"))
+                 (revision %texlive-revision)))
+           (sha256
+            (base32
+             "100208pg7q6lj7swiq9p9287nn6b64bl62bnlaxpjni9y2kdrqy5"))))
+       ("dvips-base-enc"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/enc/dvips/base"))
+                 (revision %texlive-revision)))
+           (sha256
+            (base32
+             "1xnf6ms0h87r55kxik4vicwr1907scj789lhqflqns8svvsli5iy"))))))
     (home-page "http://www.ctan.org/pkg/dvips")
     (synopsis "DVI to PostScript drivers")
     (description "This package provides files needed for converting DVI files
@@ -429,6 +459,40 @@ converters, will completely supplant the older patterns.")
 build fonts using the Metafont system.")
     (license license:knuth)))
 
+(define-public texlive-fontname
+  (package
+    (name "texlive-fontname")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/fonts/map/fontname"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0cssbzcx15221dynp5sii72qh4l18mwkr14n8w1xb19j8pbaqasz"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/fonts/map/fontname")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "https://www.ctan.org/pkg/fontname")
+    (synopsis "Scheme for naming fonts in TeX")
+    (description "This is Fontname, a naming scheme for (the base part of)
+external TeX font filenames.  This makes at most eight-character names
+from (almost) arbitrarily complex font names, thus helping portability of TeX
+documents.")
+    (license license:public-domain)))
+
 (define-public texlive-fonts-cm
   (package
     (name "texlive-fonts-cm")
@@ -1442,7 +1506,7 @@ distribution.")
                 "1n3i5adsyy7jw0imnzrm2i8wkf73i3mjk9h3ic8cb9cd19i4r9r3"))))
     (build-system texlive-build-system)
     (arguments
-     '(#:tex-directory "latex/babel"
+     '(#:tex-directory "generic/babel"
        #:phases
        (modify-phases %standard-phases
          ;; This package tries to produce babel.aux twice but refuses to
@@ -1464,6 +1528,28 @@ what has to be done for each language.  Users of XeTeX are advised to use the
 polyglossia package rather than Babel.")
     (license license:lppl1.3+)))
 
+(define-public texlive-generic-babel-english
+  (package
+    (name "texlive-generic-babel-english")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "generic" "babel-english"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1s404wbx91z5w65hm024kyl4h56zsa096irx18vsx8jvlmwsr5wc"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "generic/babel-english"))
+    (home-page "http://www.ctan.org/pkg/babel-english")
+    (synopsis "Babel support for English")
+    (description
+     "This package provides the language definition file for support of
+English in @code{babel}.  Care is taken to select British hyphenation patterns
+for British English and Australian text, and default (\"american\") patterns
+for Canadian and USA text.")
+    (license license:lppl1.3+)))
+
 (define-public texlive-latex-cyrillic
   (package
     (name "texlive-latex-cyrillic")
@@ -1517,6 +1603,7 @@ standard LaTeX packages."
     (let ((default-packages
             (list texlive-bin
                   texlive-dvips
+                  texlive-fontname
                   texlive-fonts-cm
                   texlive-fonts-latex
                   texlive-metafont-base
@@ -1525,6 +1612,7 @@ standard LaTeX packages."
                   texlive-latex-amsmath
                   texlive-latex-amscls
                   texlive-latex-babel
+                  texlive-generic-babel-english
                   texlive-latex-cyrillic
                   texlive-latex-graphics
                   texlive-latex-psnfss
@@ -1558,7 +1646,8 @@ standard LaTeX packages."
                  (((names . directories) ...)
                   (union-build (assoc-ref %outputs "out")
                                directories
-                               #:create-all-directories? #t)))
+                               #:create-all-directories? #t
+                               #:log-port (%make-void-port "w"))))
 
                ;; The configuration file "texmf.cnf" is provided by the
                ;; "texlive-bin" package.  We take it and override only the
@@ -1602,6 +1691,289 @@ distribution.")
     (description "This is a very limited subset of the TeX Live distribution.
 It includes little more than the required set of LaTeX packages.")))
 
+(define-public texlive-latex-amsrefs
+  (package
+    (name "texlive-latex-amsrefs")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "amsrefs"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "15i4k479dwrpr0kspmm70g1yn4p3dkh0whyzmr93hph9bggnh1i1"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/amsrefs"))
+    (home-page "http://www.ctan.org/pkg/amsrefs")
+    (synopsis "LaTeX-based replacement for BibTeX")
+    (description
+     "Amsrefs is a LaTeX package for bibliographies that provides an archival
+data format similar to the format of BibTeX database files, but adapted to
+make direct processing by LaTeX easier.  The package can be used either in
+conjunction with BibTeX or as a replacement for BibTeX.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-bigfoot
+  (package
+    (name "texlive-latex-bigfoot")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "bigfoot"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "092g8alnsdwlgl1isdnqrr32l161994295kadr1n05d81xgj5wnv"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/bigfoot"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-generated-file
+           (lambda _
+             (for-each delete-file (find-files "." "\\.drv$"))
+             #t)))))
+    (home-page "http://www.ctan.org/pkg/bigfoot")
+    (synopsis "Footnotes for critical editions")
+    (description
+     "This package aims to provide a one-stop solution to requirements for
+footnotes.  It offers: Multiple footnote apparatus superior to that of
+@code{manyfoot}.  Footnotes can be formatted in separate paragraphs, or be run
+into a single paragraph (this choice may be selected per footnote series);
+Things you might have expected (such as @code{\\verb}-like material in
+footnotes, and color selections over page breaks) now work.  Note that the
+majority of the bigfoot package's interface is identical to that of
+@code{manyfoot}; users should seek information from that package's
+documentation.  The bigfoot bundle also provides the @code{perpage} and
+@code{suffix} packages.")
+    (license license:gpl2+)))
+
+(define-public texlive-latex-blindtext
+  (package
+    (name "texlive-latex-blindtext")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "blindtext"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1jrja9b1pzdh9zgv1jh807w4xijqja58n2mqny6dkwicv8qfgbfg"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/blindtext"))
+    (home-page "http://www.ctan.org/pkg/blindtext")
+    (synopsis "Producing 'blind' text for testing")
+    (description
+     "The package provides the commands @code{\\blindtext} and
+@code{\\Blindtext} for creating \"blind\" text useful in testing new classes
+and packages, and @code{\\blinddocument}, @code{\\Blinddocument} for creating
+an entire random document with sections, lists, mathematics, etc.  The package
+supports three languages, @code{english}, @code{(n)german} and @code{latin};
+the @code{latin} option provides a short \"lorem ipsum\" (for a fuller \"lorem
+ipsum\" text, see the @code{lipsum} package).")
+    (license license:lppl)))
+
+(define-public texlive-latex-dinbrief
+  (package
+    (name "texlive-latex-dinbrief")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "dinbrief"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0lb0kiy8fxzl6cnhcw1sggy6jrjvcd6kj1kkw3k9lkimm388yjz6"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/dinbrief"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-generated-file
+           (lambda _
+             (delete-file "dinbrief.drv")
+             #t)))))
+    (home-page "http://www.ctan.org/pkg/dinbrief")
+    (synopsis "German letter DIN style")
+    (description
+     "This package implements a document layout for writing letters according
+to the rules of DIN (Deutsches Institut für Normung, German standardisation
+institute).  A style file for LaTeX 2.09 (with limited support of the
+features) is part of the package.  Since the letter layout is based on a
+German standard, the user guide is written in German, but most macros have
+English names from which the user can recognize what they are used for.  In
+addition there are example files showing how letters may be created with the
+package.")
+    (license license:lppl)))
+
+(define-public texlive-latex-draftwatermark
+  (package
+    (name "texlive-latex-draftwatermark")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "draftwatermark"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1zyl2pcz2x529gzj5m93a1s4ipymdabf7qdjl3l1673pizd4hfyv"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/draftwatermark"))
+    (home-page "http://www.ctan.org/pkg/draftwatermark")
+    (synopsis "Put a grey textual watermark on document pages")
+    (description
+     "This package provides a means to add a textual, light grey watermark on
+every page or on the first page of a document.  Typical usage may consist in
+writing words such as DRAFT or CONFIDENTIAL across document pages.  The
+package performs a similar function to that of @code{draftcopy}, but its
+implementation is output device independent, and made very simple by relying
+on everypage.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-environ
+  (package
+    (name "texlive-latex-environ")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "environ"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "06h28b26dyjkj9shksphgqfv4130jfkwhbw737hxn7d3yvdfffyd"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/environ"))
+    (home-page "http://www.ctan.org/pkg/environ")
+    (synopsis "New interface for environments in LaTeX")
+    (description
+     "This package provides the @code{\\collect@@body} command (as in
+@code{amsmath}), as well as a @code{\\long} version @code{\\Collect@@Body},
+for collecting the body text of an environment.  These commands are used to
+define a new author interface to creating new environments.")
+    (license license:lppl)))
+
+(define-public texlive-latex-eqparbox
+  (package
+    (name "texlive-latex-eqparbox")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "eqparbox"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0pvmhsd4xmpil0m3c7qcgwilbk266mlkzv03g0jr8r3zd8jxlyzq"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/eqparbox"))
+    (home-page "http://www.ctan.org/pkg/eqparbox")
+    (synopsis "Create equal-widthed parboxes")
+    (description
+     "LaTeX users sometimes need to ensure that two or more blocks of text
+occupy the same amount of horizontal space on the page.  To that end, the
+@code{eqparbox} package defines a new command, @code{\\eqparbox}, which works
+just like @code{\\parbox}, except that instead of specifying a width, one
+specifies a tag.  All @code{eqparbox}es with the same tag---regardless of
+where they are in the document---will stretch to fit the widest
+@code{eqparbox} with that tag.  This simple, equal-width mechanism can be used
+for a variety of alignment purposes, as is evidenced by the examples in
+@code{eqparbox}'s documentation.  Various derivatives of @code{\\eqparbox} are
+also provided.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-expdlist
+  (package
+    (name "texlive-latex-expdlist")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "expdlist"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1x7byk6x10njir3y9rm56glhdzrxwqag7gsnw2sqn1czlq525w7r"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/expdlist"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-generated-file
+           (lambda _
+             (for-each delete-file
+                       (find-files "." "\\.drv$"))
+             #t)))))
+    (home-page "http://www.ctan.org/pkg/expdlist")
+    (synopsis "Expanded description environments")
+    (description
+     "The package provides additional features for the LaTeX
+@code{description} environment, including adjustable left margin.  The package
+also allows the user to \"break\" a list (for example, to interpose a comment)
+without affecting the structure of the list (this works for @code{itemize} and
+@code{enumerate} lists, and numbered lists remain in sequence).")
+    (license license:lppl)))
+
+(define-public texlive-latex-filemod
+  (package
+    (name "texlive-latex-filemod")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/filemod"))
+                    (revision %texlive-revision)))
+              (sha256
+               (base32
+                "0vpxilfw69xv78f03g0j0zw0bw4qcn36whqp8phcq48qk1ax2kr2"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/filemod")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/filemod")
+    (synopsis "Provide file modification times, and compare them")
+    (description
+     "This package provides macros to read and compare the modification dates
+of files.  The files may be @code{.tex} files, images or other files (as long
+as they can be found by LaTeX).  It uses the @code{\\pdffilemoddate} primitive
+of pdfLaTeX to find the file modification date as PDF date string, parses the
+string and returns the value to the user.  The package will also work for DVI
+output with recent versions of the LaTeX compiler which uses pdfLaTeX in DVI
+mode.  The functionality is provided by purely expandable macros or by faster
+but non-expandable ones.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-ifplatform
+  (package
+    (name "texlive-latex-ifplatform")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "ifplatform"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "11gvvjvmdfs9b7mm19yf80zwkx49jqcbq6g8qb9y5ns1r1qvnixp"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/ifplatform"))
+    (home-page "http://www.ctan.org/pkg/ifplatform")
+    (synopsis "Conditionals to test which platform is being used")
+    (description
+     "This package uses the (La)TeX extension @code{-shell-escape} to
+establish whether the document is being processed on a Windows or on a
+Unix-like system, or on Cygwin (Unix environment over a Windows system).
+Booleans provided are: @code{\\ifwindows}, @code{\\iflinux}, @code{\\ifmacosx}
+and @code{\\ifcygwin}.  The package also preserves the output of @code{uname}
+on a Unix-like system, which may be used to distinguish between various
+classes of systems.")
+    (license license:lppl)))
+
 (define-public texlive-latex-natbib
   (package
     (name "texlive-latex-natbib")
@@ -1625,6 +1997,66 @@ that are compatible with @code{natbib}: @code{plainnat}, @code{unsrtnat},
 designed from the start to be compatible with @code{natbib}.")
     (license license:lppl)))
 
+(define-public texlive-latex-psfrag
+  (package
+    (name "texlive-latex-psfrag")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "psfrag"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1dxbl5il7wbbsp0v45vk884xi1192wxw03849pb1g5q4x808n352"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/psfrag"))
+    (home-page "http://www.ctan.org/pkg/psfrag")
+    (synopsis "Replace strings in encapsulated PostScript figures")
+    (description
+     "This package allows LaTeX constructions (equations, picture
+environments, etc.) to be precisely superimposed over Encapsulated PostScript
+figures, using your own favorite drawing tool to create an EPS figure and
+placing simple text \"tags\" where each replacement is to be placed, with
+PSfrag automatically removing these tags from the figure and replacing them
+with a user specified LaTeX construction, properly aligned, scaled, and/or
+rotated.")
+    (license (license:fsf-free "file://psfrag.dtx"))))
+
+(define-public texlive-latex-pstool
+  (package
+    (name "texlive-latex-pstool")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "pstool"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1kwlk1x67lad4xb7gpkxqgdlxwpi6nvq1r9wika7m92abmyf18h3"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/pstool"
+       #:tex-format "latex"))
+    (inputs
+     `(("texlive-fonts-cm" ,texlive-fonts-cm)
+       ("texlive-latex-filecontents" ,texlive-latex-filecontents)))
+    (propagated-inputs
+     `(("texlive-latex-bigfoot" ,texlive-latex-bigfoot)
+       ("texlive-latex-filemod" ,texlive-latex-filemod)
+       ("texlive-latex-graphics" ,texlive-latex-graphics)
+       ("texlive-latex-ifplatform" ,texlive-latex-ifplatform)
+       ("texlive-latex-oberdiek" ,texlive-latex-oberdiek)
+       ("texlive-latex-psfrag" ,texlive-latex-psfrag)
+       ("texlive-latex-trimspaces" ,texlive-latex-trimspaces)))
+    (home-page "http://www.ctan.org/pkg/pstool")
+    (synopsis "Process PostScript graphisc within pdfLaTeX documents")
+    (description
+     "This is a package for processing PostScript graphics with @code{psfrag}
+labels within pdfLaTeX documents.  Every graphic is compiled individually,
+drastically speeding up compilation time when only a single figure needs
+re-processing.")
+    (license license:lppl)))
+
 (define-public texlive-latex-seminar
   (package
     (name "texlive-latex-seminar")
@@ -1652,6 +2084,283 @@ recent classes such as powerdot or beamer, both of which are tuned to
 21st-century presentation styles.")
     (license license:lppl1.2+)))
 
+(define-public texlive-latex-trimspaces
+  (package
+    (name "texlive-latex-trimspaces")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "trimspaces"))
+              (sha256
+               (base32
+                "0da00lb32am4g63mn96625wg48p3pj3spx79lajrk17d549apwqa"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/trimspaces"
+       #:tex-format "latex"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-bug
+           (lambda _
+             ;; The "ins" file refers to the wrong source file.
+             (substitute* "trimspaces.ins"
+               (("pstool.tex") "trimspaces.tex"))
+             #t)))))
+    (inputs
+     `(("texlive-latex-filecontents" ,texlive-latex-filecontents)))
+    (home-page "http://www.ctan.org/pkg/trimspaces")
+    (synopsis "Trim spaces around an argument or within a macro")
+    (description
+     "This very short package allows you to expandably remove spaces around a
+token list (commands are provided to remove spaces before, spaces after, or
+both); or to remove surrounding spaces within a macro definition, or to define
+space-stripped macros.")
+    (license license:lppl)))
+
+(define-public texlive-latex-capt-of
+  (package
+    (name "texlive-latex-capt-of")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/capt-of"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1y2s50f6lz0jx2748lj3iy56hrpcczgnbzmvphxv7aqndyyamd4x"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/capt-of")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/capt-of")
+    (synopsis "Captions on more than floats")
+    (description
+     "This package defines a command @code{\\captionof} for putting a caption
+to something that's not a float.")
+    (license license:lppl)))
+
+(define-public texlive-latex-etoolbox
+  (package
+    (name "texlive-latex-etoolbox")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/etoolbox"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0016bscnpima9krrg2569mva78xzwnygzlvg87dznsm6gf8g589v"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/etoolbox")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/etoolbox")
+    (synopsis "e-TeX tools for LaTeX")
+    (description
+     "This package is a toolbox of programming facilities geared primarily
+towards LaTeX class and package authors.  It provides LaTeX frontends to some
+of the new primitives provided by e-TeX as well as some generic tools which
+are not strictly related to e-TeX but match the profile of this package.  The
+package provides functions that seem to offer alternative ways of implementing
+some LaTeX kernel commands; nevertheless, the package will not modify any part
+of the LaTeX kernel.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-fncychap
+  (package
+    (name "texlive-latex-fncychap")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/fncychap"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0fdk84dbicfjfprkz6vk15x36mvlhaw9isjmgkc56jp2khwjswwq"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/fncychap")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/fncychap")
+    (synopsis "Seven predefined chapter heading styles")
+    (description
+     "This package provides seven predefined chapter heading styles.  Each
+style can be modified using a set of simple commands.  Optionally one can
+modify the formatting routines in order to create additional chapter
+headings.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-framed
+  (package
+    (name "texlive-latex-framed")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/framed"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "14a4ydqsvp3vcfavl21jrv0ybiqypaaqzg2q2cs3rzkandg7w98x"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/framed")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/framed")
+    (synopsis "Framed or shaded regions that can break across pages")
+    (description
+     "The package creates three environments: @code{framed}, which puts an
+ordinary frame box around the region, @code{shaded}, which shades the region,
+and @code{leftbar}, which places a line at the left side.  The environments
+allow a break at their start (the @code{\\FrameCommand} enables creation of a
+title that is “attached” to the environment); breaks are also allowed in the
+course of the framed/shaded matter.  There is also a command
+@code{\\MakeFramed} to make your own framed-style environments.")
+    ;; The header states: "These macros may be freely transmitted, reproduced,
+    ;; or modified for any purpose provided that this notice is left intact."
+    (license (license:fsf-free "file://framed.sty"))))
+
+(define-public texlive-latex-g-brief
+  (package
+    (name "texlive-latex-g-brief")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "g-brief"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0sikazkg0dpkcpzlbqw8qzxr81paf2f443vsrh14jnw7s4gswvc5"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/g-brief"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-generated-file
+           (lambda _
+             (delete-file "g-brief.drv")
+             #t)))))
+    (home-page "http://www.ctan.org/pkg/g-brief")
+    (synopsis "Letter document class")
+    (description
+     "This package is designed for formatting formless letters in German; it
+can also be used for English (by those who can read the documentation).  There
+are LaTeX 2.09 @code{documentstyle} and LaTeX 2e class files for both an
+\"old\" and a \"new\" version of g-brief.")
+    (license license:lppl)))
+
+(define-public texlive-latex-galois
+  (package
+    (name "texlive-latex-galois")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "galois"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0d4l0msk8j5pi95xnmm9wygv1vbpkwkv5amx9l0km86cs79jpp1h"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/galois"))
+    (home-page "http://www.ctan.org/pkg/galois")
+    (synopsis "Typeset Galois connections")
+    (description
+     "The package deals with connections in two-dimensional style, optionally
+in colour.")
+    (license license:lppl)))
+
+(define-public texlive-latex-gcite
+  (package
+    (name "texlive-latex-gcite")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "gcite"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "03g9by54yrypn599y98r1xh7qw0bbbmpzq0bfwpj6j5q5rkl1mfa"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/gcite"))
+    (home-page "http://www.ctan.org/pkg/gcite")
+    (synopsis "Citations in a reader-friendly style")
+    (description
+     "The package allows citations in the German style, which is considered by
+many to be particularly reader-friendly.  The citation provides a small amount
+of bibliographic information in a footnote on the page where each citation is
+made.  It combines a desire to eliminate unnecessary page-turning with the
+look-up efficiency afforded by numeric citations.  The package makes use of
+BibLaTeX, and is considered experimental.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-geometry
+  (package
+    (name "texlive-latex-geometry")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "geometry"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1r2kfcwclg33yk5z8mvlagwxj7nr1mc3w4bdpmhrwv6dn8mrbvw8"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/geometry"))
+    (home-page "http://www.ctan.org/pkg/geometry")
+    (synopsis "Flexible and complete interface to document dimensions")
+    (description
+     "This package provides an easy and flexible user interface to customize
+page layout, implementing auto-centering and auto-balancing mechanisms so that
+the users have only to give the least description for the page layout.  The
+package knows about all the standard paper sizes, so that the user need not
+know what the nominal \"real\" dimensions of the paper are, just its standard
+name (such as a4, letter, etc.).  An important feature is the package's
+ability to communicate the paper size it's set up to the output.")
+    (license license:lppl)))
+
 (define-public texlive-latex-hyperref
   (package
     (name "texlive-latex-hyperref")
@@ -1692,6 +2401,72 @@ pdf and HTML backends.  The package is distributed with the @code{backref} and
 @code{nameref} packages, which make use of the facilities of @code{hyperref}.")
     (license license:lppl1.3+)))
 
+(define-public texlive-latex-mdwtools
+  (package
+    (name "texlive-latex-mdwtools")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "mdwtools"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0caxs74hla28hc67csf5i5ahadx97w8vxh3mdmsprxbpd1mr7ssg"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/mdwtools"))
+    (home-page "http://www.ctan.org/pkg/mdwtools")
+    (synopsis "Miscellaneous tools by Mark Wooding")
+    (description
+     "This collection of tools includes: @code{atsupport} for short commands
+starting with @code{@@}, macros to sanitize the OT1 encoding of the
+@code{cmtt} fonts; a @code{doafter} command; improved @code{footnote} support;
+@code{mathenv} for various alignment in maths; list handling; @code{mdwmath}
+which adds some minor changes to LaTeX maths; a rewrite of LaTeX's tabular and
+array environments; verbatim handling; and syntax diagrams.")
+    (license license:gpl3+)))
+
+(define-public texlive-latex-polyglossia
+  (package
+    (name "texlive-latex-polyglossia")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "polyglossia"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "09mvszd5qgqg4cfglpj5qxyzjz190ppb9p8gnsnjydwp1akvhayf"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/polyglossia"))
+    (home-page "http://www.ctan.org/pkg/polyglossia")
+    (synopsis "Alternative to babel for XeLaTeX and LuaLaTeX")
+    (description
+     "This package provides a complete Babel replacement for users of LuaLaTeX
+and XeLaTeX; it relies on the @code{fontspec} package, version 2.0 at least.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-supertabular
+  (package
+    (name "texlive-latex-supertabular")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "supertabular"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "14b2bc7cqz4ckxxycim9sw6jkrr1pahivm1rdbpz5k6hl967w1s3"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/supertabular"))
+    (home-page "http://www.ctan.org/pkg/supertabular")
+    (synopsis "Multi-page tables package")
+    (description
+     "This package was a predecessor of @code{longtable}; the newer
+package (designed on quite different principles) is easier to use and more
+flexible, in many cases, but supertabular retains its usefulness in a few
+situations where longtable has problems.")
+    (license license:lppl1.3+)))
+
 (define-public texlive-tex-texinfo
   (package
     (name "texlive-tex-texinfo")
@@ -1727,6 +2502,34 @@ other programs in the distribution offer online interactive use (with
 hypertext linkages in some cases).")
     (license license:gpl3+)))
 
+(define-public texlive-latex-upquote
+  (package
+    (name "texlive-latex-upquote")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "upquote"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0d1050i973wnxigy0xpky5l7vn4ff7ldhkjpdqsw5s653gagwixp"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/upquote"))
+    (home-page "http://www.ctan.org/pkg/upquote")
+    (synopsis "Show \"realistic\" quotes in verbatim")
+    (description
+     "Typewriter-style fonts are best for program listings, but Computer
+Modern Typewriter prints @code{`} and @code{'} as bent opening and closing
+single quotes.  Other fonts, and most programming languages, print @code{`} as
+a grave accent and @code{'} upright; @code{'} is used both to open and to
+close quoted strings.  The package switches the typewriter font to Computer
+Modern Typewriter in OT1 encoding, and modifies the behaviour of
+@code{verbatim}, @code{verbatim*}, @code{\\verb}, and @code{\\verb*} to print
+in the expected way.  It does this regardless of other fonts or encodings in
+use, so long as the package is loaded after the other fonts were.  The package
+does not affect @code{\\tt}, @code{\\texttt}, etc.")
+    (license license:lppl1.2+)))
+
 (define-public texlive-latex-anysize
   (package
     (name "texlive-latex-anysize")
@@ -1804,6 +2607,40 @@ package uses 'drivers' to place the bars; the available drivers can work with
 drivers, and VTeX and pdfTeX.")
     (license license:lppl)))
 
+(define-public texlive-latex-cmap
+  (package
+    (name "texlive-latex-cmap")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/cmap"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1s1rv6zgw105w2j6ffhnk914qrix87y1ndzri1q72g2kbr91zlbg"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/cmap")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "https://www.tug.org/svn/texlive/tags/texlive-2017.1/\
+Master/texmf-dist/tex/latex/cmap/")
+    (synopsis "CMap support for PDF files")
+    (description
+     "This package embeds CMap tables into PDF files to make search and
+copy-and-paste functions work properly.")
+    (license license:lppl)))
+
 (define-public texlive-latex-colortbl
   (package
     (name "texlive-latex-colortbl")
@@ -2232,6 +3069,42 @@ splines, and filled circles and ellipses.  The package uses @code{tpic}
 @code{\\special} commands.")
     (license license:public-domain)))
 
+(define-public texlive-latex-enumitem
+  (package
+    (name "texlive-latex-enumitem")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/enumitem"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0q24b1bkdi9l6bw787bpggww83jh2vj8955aw2m5yccqbx4vgr5r"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/enumitem")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/enumitem")
+    (synopsis "Customize basic list environments")
+    (description
+     "This package is intended to ease customizing the three basic list
+environments: @code{enumerate}, @code{itemize} and @code{description}.  It
+extends their syntax to allow an optional argument where a set of parameters
+in the form @code{key=value} are available, for example:
+@code{\\begin{itemize}[itemsep=1ex,leftmargin=1cm]}.")
+    (license license:lppl1.3+)))
+
 (define-public texlive-latex-multirow
   (package
     (name "texlive-latex-multirow")
@@ -2287,6 +3160,40 @@ the included graphic.  LaTeX commands can be placed on the graphic at defined
 positions; a grid for orientation is available.")
     (license license:lppl1.0+)))
 
+(define-public texlive-latex-parskip
+  (package
+    (name "texlive-latex-parskip")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/parskip"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "14r6h9hqb0qgccxj5l1208694fx8sb8avmgzps36lsbbpszl7i7m"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/parskip")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/parskip")
+    (synopsis "Layout with zero \\parindent, non-zero \\parskip")
+    (description
+     "Simply changing @code{\\parskip} and @code{\\parindent} leaves a layout
+that is untidy; this package (though it is no substitute for a properly
+designed class) helps alleviate this untidiness.")
+    (license license:lppl)))
+
 (define-public texlive-latex-pdfpages
   (package
     (name "texlive-latex-pdfpages")
@@ -2368,6 +3275,197 @@ considered obsolete: it was superseded by @code{subfig}, but users may find
 the more recent @code{subcaption} package more satisfactory.")
     (license license:lppl)))
 
+(define-public texlive-latex-tabulary
+  (package
+    (name "texlive-latex-tabulary")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "tabulary"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1adkdx2zkk42g82nqf57lv1nc1z7kwl13jmy8vpcsizsa0xdnx9n"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/tabulary"))
+    (home-page "http://www.ctan.org/pkg/tabulary")
+    (synopsis "Tabular with variable width columns balanced")
+    (description
+     "The package defines a @code{tabular*}-like environment, @code{tabulary},
+taking a \"total width\" argument as well as the column specifications.  The
+environment uses column types @code{L}, @code{C}, @code{R} and @code{J} for
+variable width columns (@code{\\raggedright}, @code{\\centering},
+@code{\\raggedleft}, and normally justified).  In contrast to
+@code{tabularx}'s @code{X} columns, the width of each column is weighted
+according to the natural width of the widest cell in the column.")
+    (license license:lppl)))
+
+(define-public texlive-latex-threeparttable
+  (package
+    (name "texlive-latex-threeparttable")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/threeparttable"))
+                    (revision %texlive-revision)))
+              (sha256
+               (base32
+                "10vy9k150w2lviw8h22s2mcykff38xci653m5823s2vv44pwbmzq"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/threeparttable")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/threeparttable")
+    (synopsis "Tables with captions and notes all the same width")
+    (description
+     "This package facilitates tables with titles (captions) and notes.  The
+title and notes are given a width equal to the body of the table (a
+@code{tabular} environment).  By itself, a @code{threeparttable} does not
+float, but you can put it in a @code{table} or a @code{table*} or some other
+environment.")
+    (license (license:fsf-free "file://threeparttable.sty"))))
+
+(define-public texlive-fonts-txfonts
+  (package
+    (name "texlive-fonts-txfonts")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/txfonts"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0jl921qdphg8i7bkfprackn3xd4gmvxckc526nmzqsmahqkavgg2"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils)
+                  (ice-9 match))
+       #:builder
+       (begin
+         (use-modules (guix build utils)
+                      (ice-9 match))
+         (let ((root (string-append (assoc-ref %outputs "out")
+                                    "/share/texmf-dist/"))
+               (pkgs '(("source"        . "tex/latex/txfonts")
+                       ("txfonts-vf"    . "fonts/tfm/public/txfonts")
+                       ("txfonts-afm"   . "fonts/afm/public/txfonts")
+                       ("txfonts-tfm"   . "fonts/tfm/public/txfonts")
+                       ("txfonts-type1" . "fonts/type1/public/txfonts")
+                       ("txfonts-enc"   . "fonts/enc/dvips/txfonts")
+                       ("txfonts-map"   . "fonts/map/dvips/txfonts"))))
+           (for-each (match-lambda
+                       ((pkg . dir)
+                        (let ((target (string-append root dir)))
+                          (mkdir-p target)
+                          (copy-recursively (assoc-ref %build-inputs pkg)
+                                            target))))
+                     pkgs)
+           #t))))
+    (native-inputs
+     `(("txfonts-tfm"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/tfm/public/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-tfm-" version "-checkout"))
+           (sha256
+            (base32
+             "12ffmbrp48ap35qa3b4mi6ckif9q2vf7972jxh5dc1yzykhla2xv"))))
+       ("txfonts-vf"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/vf/public/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-vf-" version "-checkout"))
+           (sha256
+            (base32
+             "04acyfdwvxpfx4l2xh2bpzdmpvwdf2pzbs7a236b0xckz2jvc1ci"))))
+       ("txfonts-afm"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/afm/public/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-afm-" version "-checkout"))
+           (sha256
+            (base32
+             "1705klz51pnqzcs89s3521b84b6c89wlczflsh0vci66nl155yis"))))
+       ("txfonts-type1"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/type1/public/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-type1-" version "-checkout"))
+           (sha256
+            (base32
+             "0ajwr7zb6ch3gxd0g8p2i4llhy2wr9a9saz6jq6hm6fxf4pgl5h3"))))
+       ("txfonts-map"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/map/dvips/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-map-" version "-checkout"))
+           (sha256
+            (base32
+             "0kamr8a9x24jakas3v09dgv7kkpybj3i7qv4vz1iyypqr6kk1raj"))))
+       ("txfonts-enc"
+        ,(origin
+           (method svn-fetch)
+           (uri (svn-reference
+                 (url (string-append "svn://www.tug.org/texlive/tags/"
+                                     %texlive-tag "/Master/texmf-dist/"
+                                     "/fonts/enc/dvips/txfonts"))
+                 (revision %texlive-revision)))
+           (file-name (string-append name "-enc-" version "-checkout"))
+           (sha256
+            (base32
+             "1bal5fhw0xlhl37ayv8vlnqnsn1y82kadzfjhbgr223blspp4zsj"))))))
+    (home-page "http://www.ctan.org/pkg/threeparttable")
+    (synopsis "Times-like fonts in support of mathematics")
+    (description
+     "Txfonts supplies virtual text roman fonts using Adobe Times (or URW
+NimbusRomNo9L) with some modified and additional text symbols in the OT1, T1,
+and TS1 encodings; maths alphabets using Times/URW Nimbus; maths fonts
+providing all the symbols of the Computer Modern and AMS fonts, including all
+the Greek capital letters from CMR; and additional maths fonts of various
+other symbols.
+
+The set is complemented by a sans-serif set of text fonts, based on
+Helvetica/NimbusSanL, and a monospace set.
+
+All the fonts are in Type 1 format (AFM and PFB files), and are supported by
+TeX metrics (VF and TFM files) and macros for use with LaTeX.")
+    ;; Any version of the GPL with font exception.
+    (license license:gpl3+)))
+
 (define-public texlive-latex-titlesec
   (package
     (name "texlive-latex-titlesec")
@@ -2403,6 +3501,35 @@ styles.  It also includes a package to change the page styles when there are
 floats in a page.  You may assign headers/footers to individual floats, too.")
     (license license:lppl)))
 
+(define-public texlive-latex-type1cm
+  (package
+    (name "texlive-latex-type1cm")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "type1cm"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1lvxrqfwcwa4p31zyfm80gr05v8c28xybv5ri79zi2ngz6834z12"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/type1cm"))
+    (home-page "http://www.ctan.org/pkg/type1cm")
+    (synopsis "Arbitrary size font selection in LaTeX")
+    (description
+     "LaTeX, by default, restricts the sizes at which you can use its default
+computer modern fonts, to a fixed set of discrete sizes (effectively, a set
+specified by Knuth).  The @code{type1cm} package removes this restriction;
+this is particularly useful when using scalable versions of the CM
+fonts (Bakoma, or the versions from BSR/Y&Y, or True Type versions from Kinch,
+PCTeX, etc.).  In fact, since modern distributions will automatically generate
+any bitmap font you might need, @code{type1cm} has wider application than just
+those using scaleable versions of the fonts.  Note that the LaTeX distribution
+now contains a package @code{fix-cm},f which performs the task of
+@code{type1cm}, as well as doing the same job for T1- and TS1-encoded
+@code{ec} fonts.")
+    (license license:lppl)))
+
 (define-public texlive-latex-lh
   (package
     (name "texlive-latex-lh")
@@ -2462,6 +3589,40 @@ technical illustrations.  Its output is scalable PostScript or SVG, rather
 than the bitmaps Metafont creates.")
     (license license:lppl)))
 
+(define-public texlive-latex-varwidth
+  (package
+    (name "texlive-latex-varwidth")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/varwidth"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "1bmz9ap0ffyg7qry2xi7lki06qx4809w028xvk88cl66h7p46g52"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/varwidth")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/varwidth")
+    (synopsis "Variable-width minipage")
+    (description
+     "The @code{varwidth} environment is superficially similar to
+@code{minipage}, but the specified width is just a maximum value — the box may
+get a narrower “natural” width.")
+    (license license:lppl)))
+
 (define-public texlive-latex-wasysym
   (package
     (name "texlive-latex-wasysym")
@@ -2483,6 +3644,167 @@ lasy font set and other odds and ends.  The wasysym package implements an easy
 to use interface for these symbols.")
     (license license:lppl)))
 
+(define-public texlive-latex-wrapfig
+  (package
+    (name "texlive-latex-wrapfig")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/wrapfig"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "16xpyl0csmmwndz1xhzqfg9l0zcsnqxslsixsqkwd4zsvfj30sv4"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/wrapfig")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/wrapfig")
+    (synopsis "Produces figures which text can flow around")
+    (description
+     "This package allows figures or tables to have text wrapped around them.
+It does not work in combination with list environments, but can be used in a
+@code{parbox} or @code{minipage}, and in two-column format.")
+    (license license:lppl)))
+
+(define-public texlive-latex-ucs
+  (package
+    (name "texlive-latex-ucs")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/latex/ucs"))
+                    (revision %texlive-revision)))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0rrxwi60wmz5dfjifl4fwk66plf7wix85qnhfv4ylvmj6qi6hw37"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/latex/ucs")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/ucs")
+    (synopsis "Extended UTF-8 input encoding support for LaTeX")
+    (description
+     "The bundle provides the @code{ucs} package, and @code{utf8x.def},
+together with a large number of support files.  The @code{utf8x.def}
+definition file for use with @code{inputenc} covers a wider range of Unicode
+characters than does @code{utf8.def} in the LaTeX distribution.  The package
+provides facilities for efficient use of its large sets of Unicode characters.
+Glyph production may be controlled by various options, which permits use of
+non-ASCII characters when coding mathematical formulae.  Note that the bundle
+previously had an alias “unicode”; that alias has now been withdrawn, and no
+package of that name now exists.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-latex-preview
+  (package
+    (name "texlive-latex-preview")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "preview"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0j6fff6q0ca96nwfdgay2jm55792z4q9aa0rczmiw2qccyg5n2dv"))))
+    (build-system texlive-build-system)
+    (arguments
+     '(#:tex-directory "latex/preview"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-generated-file
+           (lambda _
+             (delete-file "preview.drv")
+             #t)))))
+    (home-page "http://www.ctan.org/pkg/preview")
+    (synopsis "Extract bits of a LaTeX source for output")
+    (description
+     "The main purpose of the preview package is the extraction of selected
+elements from a LaTeX source, like formulas or graphics, into separate
+pages of a DVI file.  A flexible and convenient interface allows it to
+specify what commands and constructs should be extracted.  This works
+with DVI files postprocessed by either Dvips and Ghostscript or
+dvipng, but it also works when you are using PDFTeX for generating PDF
+files.")
+    (license license:gpl3+)))
+
+(define-public texlive-latex-acronym
+  (package
+    (name "texlive-latex-acronym")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (texlive-ref "latex" "acronym"))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "0jmasg40bk53zdd2jc8nc18jvdai3p2wmamy7hwli8gls4nf25qp"))))
+    (build-system texlive-build-system)
+    (arguments '(#:tex-directory "latex/acronym"))
+    (home-page "http://www.ctan.org/pkg/acronym")
+    (synopsis "Expand acronyms at least once")
+    (description
+     "This package ensures that all acronyms used in the text are spelled out
+in full at least once.  It also provides an environment to build a list of
+acronyms used.  The package is compatible with PDF bookmarks.  The package
+requires the suffix package, which in turn requires that it runs under
+e-TeX.")
+    (license license:lppl1.3+)))
+
+(define-public texlive-generic-pdftex
+  (package
+    (name "texlive-generic-pdftex")
+    (version (number->string %texlive-revision))
+    (source (origin
+              (method svn-fetch)
+              (uri (svn-reference
+                    (url (string-append "svn://www.tug.org/texlive/tags/"
+                                        %texlive-tag "/Master/texmf-dist/"
+                                        "/tex/generic/pdftex"))
+                    (revision %texlive-revision)))
+              (sha256
+               (base32
+                "0k68zmqzs4qvrqxdwsrawbjb14hxqjfamq649azvai0jjxdpkljd"))))
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+         (let ((target (string-append (assoc-ref %outputs "out")
+                                      "/share/texmf-dist/tex/generic/pdftex")))
+           (mkdir-p target)
+           (copy-recursively (assoc-ref %build-inputs "source") target)
+           #t))))
+    (home-page "http://www.ctan.org/pkg/pdftex")
+    (synopsis "TeX extension for direct creation of PDF")
+    (description
+     "This package provides an extension of TeX which can be configured to
+directly generate PDF documents instead of DVI.")
+    (license license:gpl2+)))
+
 (define texlive-texmf
   (package
    (name "texlive-texmf")
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 869d0a7036..4d2ddd9279 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -431,22 +431,22 @@ required structures.")
 (define-public libressl
   (package
     (name "libressl")
-    (version "2.5.4")
-    (source
-     (origin
-      (method url-fetch)
-      (uri (string-append
-             "http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-"
-             version ".tar.gz"))
-      (sha256
-       (base32
-        "1ykf6dqlbafafhbdfmcj19pjj1z6wmsq0rmyqga1i0xv5x95nyhh"))))
+    (version "2.5.5")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://openbsd/LibreSSL/"
+                                  name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1i77viqy1afvbr392npk9v54k9zhr9zq2vhv6pliza22b0ymwzz5"))))
     (build-system gnu-build-system)
     (arguments
      ;; Do as if 'getentropy' was missing since older Linux kernels lack it
      ;; and libc would return ENOSYS, which is not properly handled.
      ;; See <https://lists.gnu.org/archive/html/guix-devel/2017-04/msg00235.html>.
-     '(#:configure-flags '("ac_cv_func_getentropy=no")))
+     '(#:configure-flags '("ac_cv_func_getentropy=no"
+                           ;; Provide a TLS-enabled netcat.
+                           "--enable-nc")))
     (native-search-paths
       ;; FIXME: These two variables must designate a single file or directory
       ;; and are not actually "search paths."  In practice it works OK in
@@ -460,9 +460,10 @@ required structures.")
             (files '("etc/ssl/certs/ca-certificates.crt")))))
     (home-page "https://www.libressl.org/")
     (synopsis "SSL/TLS implementation")
-    (description "LibreSSL is a version of the TLS/crypto stack forked
-from OpenSSL in 2014, with the goals of modernizing the codebase, improving
-security, and applying best practice development processes.")
+    (description "LibreSSL is a version of the TLS/crypto stack, forked from
+OpenSSL in 2014 with the goals of modernizing the codebase, improving security,
+and applying best practice development processes.  This package also includes a
+netcat implementation that supports TLS.")
     ;; Files taken from OpenSSL keep their license, others are under various
     ;; non-copyleft licenses.
     (license (list license:openssl
@@ -474,13 +475,13 @@ security, and applying best practice development processes.")
   (package
     (name "python-acme")
     ;; Remember to update the hash of certbot when updating python-acme.
-    (version "0.15.0")
+    (version "0.16.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "acme" version))
       (sha256
        (base32
-        "11zwgj663vr575pbqw74ia10wxaw16i8rnkcivsrbsx148rxdbcz"))))
+        "1kg9bnwywsr18hgvqyhxqqi90l2qa7449f41q3fdq2y59h9nk2sk"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -531,7 +532,7 @@ security, and applying best practice development processes.")
               (uri (pypi-uri name version))
               (sha256
                (base32
-                "1srvmjxz75dbafx7xfg1w3n9h3srr9p2ljnfsih9dwwd5cxh9i5q"))))
+                "11p1vsps5rbpha3k5jnmf9i6rcp6299h9b34wdh21cq6dgyh2n3r"))))
     (build-system python-build-system)
     (arguments
      `(,@(substitute-keyword-arguments (package-arguments python-acme)
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 465cdc9971..0d10af020c 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -120,14 +120,14 @@ as well as the classic centralized workflow.")
 (define-public git
   (package
    (name "git")
-   (version "2.13.2")
+   (version "2.13.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://kernel.org/software/scm/git/git-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1rfx2gj7dw9rw0w22ihi940zv3wdrj1xmjv25djq2vs6a4vsq40d"))))
+              "0qiy696pwqhbxcrvm3zhyjnfjrym541glhvgc4cynrwg8az27ali"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("native-perl" ,perl)
@@ -140,7 +140,7 @@ as well as the classic centralized workflow.")
                 version ".tar.xz"))
           (sha256
            (base32
-            "0vlbjsnksv5law813av03aa06dx3b0vhira8wgq83sq060qy3q9h"))))))
+            "1hl1fhbr3jn4y9pkj26kk9frj6wjlxiphl7x5c9ma6x4081xna0i"))))))
    (inputs
     `(("curl" ,curl)
       ("expat" ,expat)
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index 5338d375ee..d953ca0fd4 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -6,7 +6,7 @@
 ;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2015 Andy Patterson <ajpatter@uwaterloo.ca>
 ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2015, 2016 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2015, 2016, 2017 Alex Vong <alexvong1995@gmail.com>
 ;;; Copyright © 2016, 2017 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 Kei Kebreau <kei@openmailbox.org>
 ;;; Copyright © 2016 Dmitry Nikolaev <cameltheman@gmail.com>
@@ -980,7 +980,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
 (define-public mpv
   (package
     (name "mpv")
-    (version "0.25.0")
+    (version "0.26.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -988,7 +988,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
                     ".tar.gz"))
               (sha256
                (base32
-                "1khb7c4fdj1aak46lwyb3lq14w5jpxzws0zp6bdc87ljsvx3yhh7"))
+                "0ihvnwrp24jjf43k1hvy8n8w4ipl4z7apjppd4i0y9jzilsyzwys"))
               (file-name (string-append name "-" version ".tar.gz"))))
     (build-system waf-build-system)
     (native-inputs
@@ -1055,7 +1055,7 @@ projects while introducing many more.")
 (define-public gnome-mpv
   (package
     (name "gnome-mpv")
-    (version "0.11")
+    (version "0.12")
     (source
      (origin
        (method url-fetch)
@@ -1064,7 +1064,7 @@ projects while introducing many more.")
                            ".tar.xz"))
        (sha256
         (base32
-         "1hn3mpsxbrwf2m0nz4vzji4i6i896y8kqjb9kijqpk04cnrs3fgz"))))
+         "0dcnz9vlf791v8d15j7hpymv87h6nb15alww6xjq0zpal5hi44kc"))))
     (native-inputs
      `(("intltool" ,intltool)
        ("pkg-config" ,pkg-config)))
@@ -1121,7 +1121,7 @@ access to mpv's powerful playback capabilities.")
 (define-public youtube-dl
   (package
     (name "youtube-dl")
-    (version "2017.07.09")
+    (version "2017.07.23")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://yt-dl.org/downloads/"
@@ -1129,7 +1129,7 @@ access to mpv's powerful playback capabilities.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0phrfby2nk5y5x5173bbg3jcr2ajk849al3zji5y39z39dj36ba2"))))
+                "0h8jim7qx7b97wg7s8izz3and1xp70b9clqwpxl33xls9linh04m"))))
     (build-system python-build-system)
     (arguments
      ;; The problem here is that the directory for the man page and completion
@@ -1888,6 +1888,44 @@ your graphical desktop and encodes it as a video.  This is a useful tool for
 making @dfn{screencasts}.")
     (license license:gpl2+)))
 
+(define-public simplescreenrecorder
+  (package
+    (name "simplescreenrecorder")
+    (version "0.3.8")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/MaartenBaert/ssr/archive/"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0v8w35n8w772s08w7k0icynqdsdakbrcanbgx6j847bfqfsg21gg"))))
+    (build-system gnu-build-system)
+    ;; Although libx11, libxfixes, libxext are listed as build dependencies in
+    ;; README.md, the program builds and functions properly without them.
+    ;; As a result, they are omitted. Please add them back if problems appear.
+    (inputs
+     `(("alsa-lib" ,alsa-lib)
+       ("ffmpeg" ,ffmpeg)
+       ("glu" ,glu)
+       ("jack" ,jack-1)
+       ("libxi" ,libxi)
+       ("pulseaudio" ,pulseaudio)
+       ("qt" ,qt-4))) ; README.md: using Qt 5 causes some stability issues
+    (native-inputs `(("pkg-config" ,pkg-config)))
+    ;; Using HTTPS causes part of the page to be displayed improperly.
+    (home-page "http://www.maartenbaert.be/simplescreenrecorder/")
+    (synopsis "Screen recorder")
+    (description "SimpleScreenRecorder is an easy to use screen recorder with
+a graphical user interface.  It supports recording the entire screen, or a
+part of it, and allows encoding in many different codecs and file formats.
+Other features include a live preview and live streaming.")
+    (license (list license:gpl3+ ; most files
+                   license:zlib ; glinject/elfhacks.*
+                   license:isc ; glinject/*
+                   license:x11)))) ; build-aux/install-sh
+
 (define-public libsmpeg
   (package
     (name "libsmpeg")
@@ -1932,7 +1970,7 @@ and MPEG system streams.")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "ftp://ftp.videolan.org/pub/videolan/libbdplus/"
+       (uri (string-append "https://ftp.videolan.org/pub/videolan/libbdplus/"
                            version "/" name "-" version ".tar.bz2"))
        (sha256
         (base32 "02n87lysqn4kg2qk7d1ffrp96c44zkdlxdj0n16hbgrlrpiwlcd6"))))
@@ -1952,7 +1990,7 @@ specifications.")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "ftp://ftp.videolan.org/pub/videolan/libaacs/"
+       (uri (string-append "https://ftp.videolan.org/pub/videolan/libaacs/"
                            version "/" name "-" version ".tar.bz2"))
        (sha256
         (base32 "1kms92i0c7i1yl659kqjf19lm8172pnpik5lsxp19xphr74vvq27"))))
@@ -2108,7 +2146,7 @@ of modern, widely supported codecs.")
 (define-public openh264
   (package
     (name "openh264")
-    (version "1.6.0")
+    (version "1.7.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/cisco/"
@@ -2116,7 +2154,7 @@ of modern, widely supported codecs.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1ix2fhk62i4q4kbnkl0gfk4x53vxqavsn0pck1pashr566zhglv5"))))
+                "0gv571bqkxk7ic64dmavs1q8nr7p59mcf4ibqp4lc070gn6w61ww"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("nasm" ,nasm)
diff --git a/gnu/packages/vim.scm b/gnu/packages/vim.scm
index 27c0b0da9c..f8c9761924 100644
--- a/gnu/packages/vim.scm
+++ b/gnu/packages/vim.scm
@@ -60,7 +60,7 @@
 (define-public vim
   (package
     (name "vim")
-    (version "8.0.0600")
+    (version "8.0.0727")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://github.com/vim/vim/archive/v"
@@ -68,7 +68,7 @@
              (file-name (string-append name "-" version ".tar.gz"))
              (sha256
               (base32
-               "1ifaj0lfzqn06snkcd83l58m9r6lg7lk3wspx71k5ycvypyfi67s"))))
+               "0hwqglpsk8qlp2rn6q9p35fxk88xixljk1yv42m3j01g3bgqg0gx"))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
@@ -111,8 +111,20 @@ configuration files.")
 
 (define-public vim-full
   (package
+    ;; This package should share its source with Vim, but it doesn't
+    ;; build reliably, and we want to keep Vim up to date due to the
+    ;; frequency of important bug fixes.
     (inherit vim)
     (name "vim-full")
+    (version "8.0.0600")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append "https://github.com/vim/vim/archive/v"
+                                 version ".tar.gz"))
+             (file-name (string-append name "-" version ".tar.gz"))
+             (sha256
+              (base32
+               "1ifaj0lfzqn06snkcd83l58m9r6lg7lk3wspx71k5ycvypyfi67s"))))
     (arguments
      `(#:configure-flags
        (list (string-append "--with-lua-prefix="
diff --git a/gnu/packages/qemu.scm b/gnu/packages/virtualization.scm
index 0bd314c660..d999d16e37 100644
--- a/gnu/packages/qemu.scm
+++ b/gnu/packages/virtualization.scm
@@ -19,7 +19,7 @@
 ;;; You should have received a copy of the GNU General Public License
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
-(define-module (gnu packages qemu)
+(define-module (gnu packages virtualization)
   #:use-module (gnu packages)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages attr)
@@ -42,6 +42,7 @@
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages polkit)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages selinux)
   #:use-module (gnu packages sdl)
   #:use-module (gnu packages spice)
   #:use-module (gnu packages texinfo)
@@ -80,7 +81,8 @@
                                       "qemu-CVE-2017-8309.patch"
                                       "qemu-CVE-2017-8379.patch"
                                       "qemu-CVE-2017-8380.patch"
-                                      "qemu-CVE-2017-9524.patch"))
+                                      "qemu-CVE-2017-9524.patch"
+                                      "qemu-CVE-2017-11334.patch"))
              (sha256
               (base32
                "08mhfs0ndbkyqgw7fjaa9vjxf4dinrly656f6hjzvmaz7hzc677h"))))
@@ -266,6 +268,52 @@ all common programming languages.  Vala bindings are also provided.")
     ;; files in the "tools" directory are released under GPLv2+.
     (license (list lgpl2.1+ gpl2+))))
 
+(define-public lxc
+  (package
+    (name "lxc")
+    (version "2.0.8")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://linuxcontainers.org/downloads/lxc/lxc-"
+                    version ".tar.gz"))
+              (sha256
+               (base32
+                "15449r56rqg3487kzsnfvz0w4p5ajrq0krcsdh6c9r6g0ark93hd"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("gnutls" ,gnutls)
+       ("libcap" ,libcap)
+       ("libseccomp" ,libseccomp)
+       ("libselinux" ,libselinux)))
+    (arguments
+     '(#:configure-flags
+       '("--sysconfdir=/etc"
+         "--localstatedir=/var")
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out         (assoc-ref outputs "out"))
+                    (bashcompdir (string-append out "/etc/bash_completion.d")))
+               (zero? (system*
+                       "make" "install"
+                       (string-append "bashcompdir=" bashcompdir)
+                       ;; Don't install files into /var and /etc.
+                       "LXCPATH=/tmp/var/lib/lxc"
+                       "localstatedir=/tmp/var"
+                       "sysconfdir=/tmp/etc"
+                       "sysconfigdir=/tmp/etc/default"))))))))
+    (synopsis "Linux container tools")
+    (home-page "https://linuxcontainers.org/")
+    (description
+     "LXC is a userspace interface for the Linux kernel containment features.
+Through a powerful API and simple tools, it lets Linux users easily create and
+manage system or application containers.")
+    (license lgpl2.1+)))
+
 (define-public libvirt
   (package
     (name "libvirt")
diff --git a/gnu/packages/vpn.scm b/gnu/packages/vpn.scm
index 063c8aacbe..aec8c1807d 100644
--- a/gnu/packages/vpn.scm
+++ b/gnu/packages/vpn.scm
@@ -219,11 +219,11 @@ private network between hosts on the internet.")
          "12xyq5h77b57cnkljdk8qyjxzys512b73019s20x6ck5brj1m8wa"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-pytest-runner" ,python-pytest-runner)
-       ("python-setuptools-scm" ,python-setuptools-scm)
+     `(("python-setuptools-scm" ,python-setuptools-scm)
        ;; For tests only.
        ("python-mock" ,python-mock)
-       ("python-pytest" ,python-pytest)))
+       ("python-pytest" ,python-pytest)
+       ("python-pytest-runner" ,python-pytest-runner)))
     (home-page "https://github.com/sshuttle/sshuttle")
     (synopsis "VPN that transparently forwards connections over SSH")
     (description "sshuttle creates an encrypted virtual private network (VPN)
diff --git a/gnu/packages/web-browsers.scm b/gnu/packages/web-browsers.scm
index 146f3a1fa2..b5fb39b95a 100644
--- a/gnu/packages/web-browsers.scm
+++ b/gnu/packages/web-browsers.scm
@@ -128,7 +128,7 @@ features including, tables, builtin image display, bookmarks, SSL and more.")
 (define-public lynx
   (package
     (name "lynx")
-    (version "2.8.9dev.11")
+    (version "2.8.9dev.15")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -136,7 +136,7 @@ features including, tables, builtin image display, bookmarks, SSL and more.")
                     "/lynx" version ".tar.bz2"))
               (sha256
                (base32
-                "1cqm1i7d209brkrpzaqqf2x951ra3l67dw8x9yg10vz7rpr9441a"))))
+                "16bdr7ai130ps67px8ssxnjxp5j6m4rin3in7jm22fxk0a8p2428"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("perl" ,perl)))
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 31a84dbc2a..69a979eaef 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -72,9 +72,9 @@
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages gperf)
   #:use-module (gnu packages gtk)
-  #:use-module (gnu packages icu4c)
   #:use-module (gnu packages image)
   #:use-module (gnu packages libidn)
+  #:use-module (gnu packages libunistring)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages base)
@@ -94,14 +94,14 @@
 (define-public httpd
   (package
     (name "httpd")
-    (version "2.4.26")
+    (version "2.4.27")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://apache/httpd/httpd-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "11ykcfv7b9zpd7fb93a7yhnyfwrilryjz21iklaf0yf8mwpvazm0"))))
+               "0fn1778mxhf78np2d8qlycg1c2ak18rxax41plahasca4clc3z3i"))))
     (build-system gnu-build-system)
     (native-inputs `(("pcre" ,pcre "bin")))       ;for 'pcre-config'
     (inputs `(("apr" ,apr)
@@ -132,14 +132,14 @@ and its related documentation.")
 (define-public nginx
   (package
     (name "nginx")
-    (version "1.12.0")
+    (version "1.12.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nginx.org/download/nginx-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0c2vg6530qplwk8rhldww5r3cwcbw1avka53qg9sh85nzlk2w8ml"))))
+                "1yvnmj7vlykrqdi6amkvs63lva6qkxd98sqv0a8hz8w5ci1bz4w7"))))
     (build-system gnu-build-system)
     (inputs `(("pcre" ,pcre)
               ("openssl" ,openssl)
@@ -543,7 +543,7 @@ for efficient socket-like bidirectional reliable communication channels.")
 (define-public libpsl
   (package
     (name "libpsl")
-    (version "0.17.0")
+    (version "0.18.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/rockdaboot/libpsl/"
@@ -551,10 +551,13 @@ for efficient socket-like bidirectional reliable communication channels.")
                                   "/libpsl-" version ".tar.gz"))
               (sha256
                (base32
-                "0jyxwc6bcvkcahkwcq237a0x209cysb63n5lak5m7zbglbb2jmq2"))))
+                "00iids8ldsqnnndmcfjp6kc00lv7fawf5l24mpbdbkh98yazgc4i"))))
     (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
     (inputs
-     `(("icu4c" ,icu4c)
+     `(("libidn2" ,libidn2)
+       ("libunistring" ,libunistring)
        ("python-2" ,python-2)))
     (home-page "https://github.com/rockdaboot/libpsl")
     (synopsis "C library for the Publix Suffix List")
@@ -2236,14 +2239,14 @@ kinds of HTML parsing operations.")
 (define-public perl-html-template
   (package
     (name "perl-html-template")
-    (version "2.95")
+    (version "2.97")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://cpan/authors/id/W/WO/WONKO/"
+              (uri (string-append "mirror://cpan/authors/id/S/SA/SAMTREGAR/"
                                   "HTML-Template-" version ".tar.gz"))
               (sha256
                (base32
-                "07ahpfgidxsw2yb7y8i7bbr8s64aq6qgq832h9jswmksxbd0l43q"))))
+                "17qjw8swj2q4b1ic285pndgrkmvpsqw0j68nhqzpk1daydhsyiv5"))))
     (build-system perl-build-system)
     (propagated-inputs
      `(("perl-cgi" ,perl-cgi)))
@@ -4702,3 +4705,58 @@ arrays.  It creates a JSON string on stdout from words provided as
 command-line arguments or read from stdin.")
     (license (list l:gpl2+
                    l:expat)))) ; json.c, json.h
+
+(define-public python-internetarchive
+  (package
+    (name "python-internetarchive")
+    (version "1.6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/jjjake/internetarchive/archive/"
+                           "v" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "00v1489rv1ydcihwbdl7sqpcpmm98b9kqqlfggr32k0ndmv7ivas"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:tests? #f ; 11 tests of 105 fail to mock "requests".
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'check)
+         (add-after 'install 'check
+           (lambda* (#:key inputs outputs target (tests? (not target)) #:allow-other-keys)
+             (if tests?
+               (begin
+                 (add-installed-pythonpath inputs outputs)
+                 (setenv "PATH" (string-append (assoc-ref outputs "out") "/bin"
+                                               ":" (getenv "PATH")))
+                 (zero? (system* "py.test")))
+               (begin
+                 (format #t "test suite not run~%")
+                 #t)))))))
+    (propagated-inputs
+     `(("python-requests" ,python-requests)
+       ("python-jsonpatch" ,python-jsonpatch-0.4)
+       ("python-docopt" ,python-docopt)
+       ("python-clint" ,python-clint)
+       ("python-six" ,python-six)
+       ("python-schema" ,python-schema-0.5)
+       ("python-backports-csv" ,python-backports-csv)))
+    (native-inputs
+     `(("python-pytest-3.0" ,python-pytest-3.0)
+       ("python-pytest-capturelog" ,python-pytest-capturelog)
+       ("python-responses" ,python-responses)))
+    (home-page "https://github.com/jjjake/internetarchive")
+    (synopsis "Command-line interface to archive.org")
+    (description "@code{ia} is a command-line tool for using
+@url{archive.org} from the command-line.  It also emplements the
+internetarchive python module for programatic access to archive.org.")
+    (properties
+     `((python2-variant . ,(delay python2-internetarchive))))
+    (license l:agpl3+)))
+
+(define-public python2-internetarchive
+  (package-with-python2
+   (strip-python2-variant python-internetarchive)))
diff --git a/gnu/packages/wm.scm b/gnu/packages/wm.scm
index f901fc1d55..4250f7d16b 100644
--- a/gnu/packages/wm.scm
+++ b/gnu/packages/wm.scm
@@ -9,7 +9,7 @@
 ;;; Copyright © 2016 Al McElrath <hello@yrns.org>
 ;;; Copyright © 2016 Carlo Zancanaro <carlo@zancanaro.id.au>
 ;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2016, 2017 ng0 <ng0@no-reply.pramatique.xyz>
+;;; Copyright © 2016, 2017 ng0 <ng0@infotropique.org>
 ;;; Copyright © 2016 doncatnip <gnopap@gmail.com>
 ;;; Copyright © 2016 Ivan Vilata i Balaguer <ivan@selidor.net>
 ;;; Copyright © 2017 Mekeor Melire <mekeor.melire@gmail.com>
@@ -94,7 +94,7 @@ nested include statements).")
 (define-public bspwm
   (package
     (name "bspwm")
-    (version "0.9")
+    (version "0.9.3")
     (source
      (origin
        (file-name (string-append name "-" version ".tar.gz"))
@@ -104,7 +104,7 @@ nested include statements).")
              version ".tar.gz"))
        (sha256
         (base32
-         "1pig0h2jk8wipyz90j69c4bk37bfyq60asnn0v0bqld2p2vjvyqy"))))
+         "17dwj7w16cdj7g4s2y2f96lgj5msq1s4543dnfa3rijlazzy6mmk"))))
     (build-system gnu-build-system)
     (inputs
      `(("libxcb" ,libxcb)
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index ecf7c82396..e091761f81 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -126,6 +126,7 @@ program.")
         (method url-fetch)
         (uri (string-append "https://github.com/astrand/xclip"
                             "/archive/" version ".tar.gz"))
+        (file-name (string-append name "-" version ".tar.gz"))
         (sha256
           (base32
            "0n7pczk9vv30zf8qfln8ba3hnif9yfdxg0m84djac469wc28hnya"))))
@@ -451,7 +452,7 @@ of the screen selected by mouse.")
 (define-public slop
   (package
     (name "slop")
-    (version "6.3.45")
+    (version "6.3.47")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -460,12 +461,13 @@ of the screen selected by mouse.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0lzyjcg6yff1vzlsda45i57khajp56yrmcjfa5faw3i60fnqqiy7"))))
+                "1kjivsq4c7dr7ggp44k09xm97i9chg8czvachqrfnv6fiqvwys0i"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f)) ; no "check" target
     (inputs
-     `(("glm" ,glm)
+     `(("glew" ,glew)
+       ("glm" ,glm)
        ("icu4c" ,icu4c)
        ("libxext" ,libxext)
        ("libxrender" ,libxrender)
@@ -483,7 +485,7 @@ selection's dimensions to stdout.")
 (define-public maim
   (package
     (name "maim")
-    (version "5.4.63")
+    (version "5.4.64")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -492,7 +494,7 @@ selection's dimensions to stdout.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0ncly3mmg9pihda3jfwmvfa4sd3xanrm8hpvfq7lr2rl8rqknx80"))))
+                "0y7ajwcp6x9q7581alz2b5xqijs5cb9l38h10fzinswqrcz53ak1"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f))            ; no "check" target
@@ -1060,7 +1062,7 @@ by name.")
 (define-public tint2
   (package
     (name "tint2")
-    (version "0.12.11")
+    (version "0.14.6")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gitlab.com/o9000/" name
@@ -1068,7 +1070,7 @@ by name.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0dv7zaj2ahnfclnwnwcz9arrvzxn65yy29z7fqdgifdh3jk1kl2h"))))
+                "1kwzwxy4myagybm3rc7dgynfgp75742n348qibn1p2an9ggyivda"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f                      ;no test target
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 30f30535d0..28d11efdae 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -56,6 +56,7 @@
   (package
     (name "expat")
     (version "2.2.1")
+    (replacement expat-2.2.2)
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/expat/expat/"
@@ -72,6 +73,18 @@ stream-oriented parser in which an application registers handlers for
 things the parser might find in the XML document (like start tags).")
     (license license:expat)))
 
+(define expat-2.2.2  ; Fixes CVE-2017-9233, CVE-2016-9063 and other issues.
+  (package
+    (inherit expat)
+    (version "2.2.2")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append "mirror://sourceforge/expat/expat/"
+                                 version "/expat-" version ".tar.bz2"))
+             (sha256
+              (base32
+               "0ik0r39ala9c6hj4kxrk933klgwkzlkbrfhvhaykx8l1rwgr2xj3"))))))
+
 (define-public libebml
   (package
     (name "libebml")
diff --git a/gnu/services.scm b/gnu/services.scm
index 5c314748da..8ef1ae7c77 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -624,9 +624,10 @@ kernel."
                         (target-type target-type))
                        (&message
                         (message
-                         (format #f (G_ "no target of type '~a' for service ~s")
+                         (format #f (G_ "no target of type '~a' for service '~a'")
                                  (service-type-name target-type)
-                                 service))))))
+                                 (service-type-name
+                                  (service-kind service))))))))
           (x
            (raise
             (condition (&ambiguous-target-service-error
diff --git a/gnu/services/cuirass.scm b/gnu/services/cuirass.scm
index 88a9a86111..d27a2bbc44 100644
--- a/gnu/services/cuirass.scm
+++ b/gnu/services/cuirass.scm
@@ -66,6 +66,8 @@
                     (default #f))
   (one-shot?        cuirass-configuration-one-shot? ;boolean
                     (default #f))
+  (fallback?        cuirass-configuration-fallback? ;boolean
+                    (default #f))
   (load-path        cuirass-configuration-load-path
                     (default '())))
 
@@ -84,6 +86,7 @@
          (specs            (cuirass-configuration-specifications config))
          (use-substitutes? (cuirass-configuration-use-substitutes? config))
          (one-shot?        (cuirass-configuration-one-shot? config))
+         (fallback?        (cuirass-configuration-fallback? config))
          (load-path        (cuirass-configuration-load-path config)))
      (list (shepherd-service
             (documentation "Run Cuirass.")
@@ -99,6 +102,7 @@
                             "--interval" #$(number->string interval)
                             #$@(if use-substitutes? '("--use-substitutes") '())
                             #$@(if one-shot? '("--one-shot") '())
+                            #$@(if fallback? '("--fallback") '())
                             #$@(if (null? load-path) '()
                                  `("--load-path" ,(string-join load-path ":"))))
                       #:user #$user
diff --git a/gnu/services/dbus.scm b/gnu/services/dbus.scm
index 26390a4acd..360a8af9ab 100644
--- a/gnu/services/dbus.scm
+++ b/gnu/services/dbus.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -205,7 +205,9 @@ includes the @code{etc/dbus-1/system.d} directories of each package listed in
                            (inherit config)
                            (services
                             (append (dbus-configuration-services config)
-                                    services)))))))
+                                    services)))))
+
+                (default-value (dbus-configuration))))
 
 (define* (dbus-service #:key (dbus dbus) (services '()))
   "Return a service that runs the \"system bus\", using @var{dbus}, with
@@ -297,7 +299,9 @@ and policy files.  For example, to allow avahi-daemon to use the system bus,
                            (inherit config)
                            (actions
                             (append (polkit-configuration-actions config)
-                                    actions)))))))
+                                    actions)))))
+
+                (default-value (polkit-configuration))))
 
 (define* (polkit-service #:key (polkit polkit))
   "Return a service that runs the
diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 36049587d3..50a561bf51 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Andy Wingo <wingo@igalia.com>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
@@ -653,6 +653,20 @@ seats.)"
            (inherit pam)
            (session (cons pam-elogind (pam-service-session pam)))))))
 
+(define (elogind-shepherd-service config)
+  "Return a Shepherd service to start elogind according to @var{config}."
+  (list (shepherd-service
+         (requirement '(dbus-system))
+         (provision '(elogind))
+         (start #~(make-forkexec-constructor
+                   (list #$(file-append (elogind-package config)
+                                        "/libexec/elogind/elogind"))
+                   #:environment-variables
+                   (list (string-append "ELOGIND_CONF_FILE="
+                                        #$(elogind-configuration-file
+                                           config)))))
+         (stop #~(make-kill-destructor)))))
+
 (define elogind-service-type
   (service-type (name 'elogind)
                 (extensions
@@ -663,6 +677,12 @@ seats.)"
                        (service-extension polkit-service-type
                                           (compose list elogind-package))
 
+                       ;; Start elogind from the Shepherd rather than waiting
+                       ;; for bus activation.  This ensures that it can handle
+                       ;; events like lid close, etc.
+                       (service-extension shepherd-root-service-type
+                                          elogind-shepherd-service)
+
                        ;; Provide the 'loginctl' command.
                        (service-extension profile-service-type
                                           (compose list elogind-package))
diff --git a/gnu/services/sysctl.scm b/gnu/services/sysctl.scm
index be5be59a05..5e9e6f0661 100644
--- a/gnu/services/sysctl.scm
+++ b/gnu/services/sysctl.scm
@@ -33,7 +33,7 @@
 ;;;
 
 (define-record-type* <sysctl-configuration>
-  sysctl-configuration make-sysctl-configuration?
+  sysctl-configuration make-sysctl-configuration
   sysctl-configuration?
   (sysctl   sysctl-configuration-sysctl    ; path of the 'sysctl' command
             (default (file-append procps "/sbin/sysctl")))
diff --git a/gnu/system.scm b/gnu/system.scm
index e813bfc20c..d8f0f0275c 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -403,17 +403,18 @@ OS."
 (define* (operating-system-directory-base-entries os #:key container?)
   "Return the basic entries of the 'system' directory of OS for use as the
 value of the SYSTEM-SERVICE-TYPE service."
-  (mlet %store-monad ((locale (operating-system-locale-directory os)))
-    (if container?
-        (return `(("locale" ,locale)))
-        (mlet %store-monad
-            ((kernel  ->  (operating-system-kernel os))
-             (initrd      (operating-system-initrd-file os))
-             (params      (operating-system-boot-parameters-file os)))
-          (return `(("kernel" ,kernel)
-                    ("parameters" ,params)
-                    ("initrd" ,initrd)
-                    ("locale" ,locale)))))))      ;used by libc
+  (let ((locale (operating-system-locale-directory os)))
+    (with-monad %store-monad
+      (if container?
+          (return `(("locale" ,locale)))
+          (mlet %store-monad
+              ((kernel  ->  (operating-system-kernel os))
+               (initrd      (operating-system-initrd-file os))
+               (params      (operating-system-boot-parameters-file os)))
+            (return `(("kernel" ,kernel)
+                      ("parameters" ,params)
+                      ("initrd" ,initrd)
+                      ("locale" ,locale))))))))   ;used by libc
 
 (define* (essential-services os #:key container?)
   "Return the list of essential services for OS.  These are special services
@@ -723,6 +724,8 @@ use 'plain-file' instead~%")
   (let ((shadow (@ (gnu packages admin) shadow)))
     (list (file-append shadow "/bin/passwd")
           (file-append shadow "/bin/su")
+          (file-append shadow "/bin/newuidmap")
+          (file-append shadow "/bin/newgidmap")
           (file-append inetutils "/bin/ping")
           (file-append inetutils "/bin/ping6")
           (file-append sudo "/bin/sudo")
diff --git a/gnu/system/install.scm b/gnu/system/install.scm
index f9aa7f6733..6837385daf 100644
--- a/gnu/system/install.scm
+++ b/gnu/system/install.scm
@@ -306,7 +306,7 @@ Use Alt-F2 for documentation.
      ;; the appropriate one.
      (cons* (file-system
               (mount-point "/")
-              (device "GuixSD")
+              (device "GuixSD_image")
               (title 'label)
               (type "ext4"))
 
diff --git a/gnu/system/locale.scm b/gnu/system/locale.scm
index 3bb9f950a8..75cb855b59 100644
--- a/gnu/system/locale.scm
+++ b/gnu/system/locale.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -19,10 +19,8 @@
 (define-module (gnu system locale)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:use-module (guix records)
   #:use-module (guix packages)
-  #:use-module (guix utils)
   #:use-module (gnu packages base)
   #:use-module (gnu packages compression)
   #:use-module (srfi srfi-26)
@@ -85,24 +83,15 @@ or #f on failure."
 (define* (localedef-command locale
                             #:key (libc (canonical-package glibc)))
   "Return a gexp that runs 'localedef' from LIBC to build LOCALE."
-  (define (maybe-version-directory)
-    ;; XXX: For libc prior to 2.22, GuixSD did not store locale data in a
-    ;; version-specific sub-directory.  Check whether this is the case.
-    ;; TODO: Remove this hack once libc 2.21 is buried.
-    (let ((version (package-version libc)))
-      (if (version>=? version "2.22")
-          (list version "/")
-          '())))
-
   #~(begin
       (format #t "building locale '~a'...~%"
               #$(locale-definition-name locale))
-      (zero? (system* (string-append #$libc "/bin/localedef")
+      (zero? (system* (string-append #+libc "/bin/localedef")
                       "--no-archive" "--prefix" #$output
                       "-i" #$(locale-definition-source locale)
                       "-f" #$(locale-definition-charset locale)
                       (string-append #$output "/"
-                                     #$@(maybe-version-directory)
+                                     #$(package-version libc) "/"
                                      #$(locale-definition-name locale))))))
 
 (define* (single-locale-directory locales
@@ -119,12 +108,7 @@ of LIBC."
     #~(begin
         (mkdir #$output)
 
-        ;; XXX: For libcs < 2.22, locale data is stored in the top-level
-        ;; directory.
-        ;; TODO: Remove this hack once libc 2.21 is buried.
-        #$(if (version>=? version "2.22")
-              #~(mkdir (string-append #$output "/" #$version))
-              #~(symlink "." (string-append #$output "/" #$version)))
+        (mkdir (string-append #$output "/" #$version))
 
         ;; 'localedef' executes 'gzip' to access compressed locale sources.
         (setenv "PATH" (string-append #$gzip "/bin"))
@@ -133,8 +117,7 @@ of LIBC."
          (and #$@(map (cut localedef-command <> #:libc libc)
                       locales)))))
 
-  (gexp->derivation (string-append "locale-" version) build
-                    #:local-build? #t))
+  (computed-file (string-append "locale-" version) build))
 
 (define* (locale-directory locales
                            #:key (libcs %default-locale-libcs))
@@ -148,18 +131,16 @@ data format changes between libc versions."
     ((libc)
      (single-locale-directory locales #:libc libc))
     ((libcs ..1)
-     (mlet %store-monad ((dirs (mapm %store-monad
-                                     (lambda (libc)
-                                       (single-locale-directory locales
-                                                                #:libc libc))
-                                     libcs)))
-       (gexp->derivation "locale-multiple-versions"
-                         (with-imported-modules '((guix build union))
-                           #~(begin
-                               (use-modules (guix build union))
-                               (union-build #$output (list #$@dirs))))
-                         #:local-build? #t
-                         #:substitutable? #f)))))
+     (let ((dirs (map (lambda (libc)
+                        (single-locale-directory locales #:libc libc))
+                      libcs)))
+       (computed-file "locale-multiple-versions"
+                      (with-imported-modules '((guix build union))
+                        #~(begin
+                            (use-modules (guix build union))
+                            (union-build #$output (list #$@dirs))))
+                      #:options '(#:local-build? #t
+                                  #:substitutable? #f))))))
 
 (define %default-locale-libcs
   ;; The libcs for which we build locales by default.
diff --git a/gnu/system/shadow.scm b/gnu/system/shadow.scm
index b30ef8e390..712e6df8d8 100644
--- a/gnu/system/shadow.scm
+++ b/gnu/system/shadow.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -143,7 +143,7 @@
     (with-imported-modules '((guix build utils))
       #~(begin
           (use-modules (guix build utils))
-          (copy-file (car (find-files #$guile-wm "wm-init-sample.scm"))
+          (copy-file (car (find-files #+guile-wm "wm-init-sample.scm"))
                      #$output))))
 
   (let ((profile (plain-file "bash_profile" "\
diff --git a/gnu/system/vm.scm b/gnu/system/vm.scm
index 66a2448ceb..90d29b0783 100644
--- a/gnu/system/vm.scm
+++ b/gnu/system/vm.scm
@@ -39,7 +39,7 @@
   #:use-module (gnu packages gawk)
   #:use-module (gnu packages bash)
   #:use-module (gnu packages less)
-  #:use-module (gnu packages qemu)
+  #:use-module (gnu packages virtualization)
   #:use-module (gnu packages disk)
   #:use-module (gnu packages zile)
   #:use-module (gnu packages linux)
@@ -68,7 +68,10 @@
 
             system-qemu-image/shared-store
             system-qemu-image/shared-store-script
-            system-disk-image))
+            system-disk-image
+
+            virtual-machine
+            virtual-machine?))
 
 
 ;;; Commentary:
@@ -105,16 +108,19 @@
                                              (guile-for-build
                                               (%guile-for-build))
 
+                                             (single-file-output? #f)
                                              (make-disk-image? #f)
                                              (references-graphs #f)
                                              (memory-size 256)
                                              (disk-image-format "qcow2")
                                              (disk-image-size 'guess))
   "Evaluate EXP in a QEMU virtual machine running LINUX with INITRD (a
-derivation).  In the virtual machine, EXP has access to all its inputs from the
-store; it should put its output files in the `/xchg' directory, which is
-copied to the derivation's output when the VM terminates.  The virtual machine
-runs with MEMORY-SIZE MiB of memory.
+derivation).  The virtual machine runs with MEMORY-SIZE MiB of memory.  In the
+virtual machine, EXP has access to all its inputs from the store; it should
+put its output file(s) in the '/xchg' directory.
+
+If SINGLE-FILE-OUTPUT? is true, copy a single file from '/xchg' to OUTPUT.
+Otherwise, copy the contents of /xchg to a new directory OUTPUT.
 
 When MAKE-DISK-IMAGE? is true, then create a QEMU disk image of type
 DISK-IMAGE-FORMAT (e.g., 'qcow2' or 'raw'), of DISK-IMAGE-SIZE bytes and
@@ -164,6 +170,7 @@ made available under the /xchg CIFS share."
                                 #:linux linux #:initrd initrd
                                 #:memory-size #$memory-size
                                 #:make-disk-image? #$make-disk-image?
+                                #:single-file-output? #$single-file-output?
                                 #:disk-image-format #$disk-image-format
                                 #:disk-image-size size
                                 #:references-graphs graphs)))))
@@ -219,6 +226,7 @@ INPUTS is a list of inputs (as for packages)."
            (reboot))))
    #:system system
    #:make-disk-image? #f
+   #:single-file-output? #t
    #:references-graphs inputs))
 
 (define* (qemu-image #:key
@@ -345,7 +353,7 @@ to USB sticks meant to be read-only."
     ;; Volume name of the root file system.  Since we don't know which device
     ;; will hold it, we use the volume name to find it (using the UUID would
     ;; be even better, but somewhat less convenient.)
-    (normalize-label "GuixSD"))
+    (normalize-label "GuixSD_image"))
 
   (define file-systems-to-keep
     (remove (lambda (fs)
@@ -576,7 +584,8 @@ with '-virtfs' options for the host file systems listed in SHARED-FS."
                                                 full-boot?
                                                 (disk-image-size
                                                  (* (if full-boot? 500 70)
-                                                    (expt 2 20))))
+                                                    (expt 2 20)))
+                                                (options '()))
   "Return a derivation that builds a script to run a virtual machine image of
 OS that shares its store with the host.  The virtual machine runs with
 MEMORY-SIZE MiB of memory.
@@ -609,7 +618,8 @@ it is mostly useful when FULL-BOOT?  is true."
               #$@(common-qemu-options image
                                       (map file-system-mapping-source
                                            (cons %store-mapping mappings)))
-              "-m " (number->string #$memory-size)))
+              "-m " (number->string #$memory-size)
+              #$@options))
 
     (define builder
       #~(call-with-output-file #$output
@@ -621,4 +631,63 @@ it is mostly useful when FULL-BOOT?  is true."
 
     (gexp->derivation "run-vm.sh" builder)))
 
+
+;;;
+;;; High-level abstraction.
+;;;
+
+(define-record-type* <virtual-machine> %virtual-machine
+  make-virtual-machine
+  virtual-machine?
+  (operating-system virtual-machine-operating-system) ;<operating-system>
+  (qemu             virtual-machine-qemu              ;<package>
+                    (default qemu))
+  (graphic?         virtual-machine-graphic?      ;Boolean
+                    (default #f))
+  (memory-size      virtual-machine-memory-size   ;integer (MiB)
+                    (default 256))
+  (port-forwardings virtual-machine-port-forwardings ;list of integer pairs
+                    (default '())))
+
+(define-syntax virtual-machine
+  (syntax-rules ()
+    "Declare a virtual machine running the specified OS, with the given
+options."
+    ((_ os)                                       ;shortcut
+     (%virtual-machine (operating-system os)))
+    ((_ fields ...)
+     (%virtual-machine fields ...))))
+
+(define (port-forwardings->qemu-options forwardings)
+  "Return the QEMU option for the given port FORWARDINGS as a string, where
+FORWARDINGS is a list of host-port/guest-port pairs."
+  (string-join
+   (map (match-lambda
+          ((host-port . guest-port)
+           (string-append "hostfwd=tcp::"
+                          (number->string host-port)
+                          "-:" (number->string guest-port))))
+        forwardings)
+   ","))
+
+(define-gexp-compiler (virtual-machine-compiler (vm <virtual-machine>)
+                                                system target)
+  ;; XXX: SYSTEM and TARGET are ignored.
+  (match vm
+    (($ <virtual-machine> os qemu graphic? memory-size ())
+     (system-qemu-image/shared-store-script os
+                                            #:qemu qemu
+                                            #:graphic? graphic?
+                                            #:memory-size memory-size))
+    (($ <virtual-machine> os qemu graphic? memory-size forwardings)
+     (let ((options
+            `("-net" ,(string-append
+                       "user,"
+                       (port-forwardings->qemu-options forwardings)))))
+       (system-qemu-image/shared-store-script os
+                                              #:qemu qemu
+                                              #:graphic? graphic?
+                                              #:memory-size memory-size
+                                              #:options options)))))
+
 ;;; vm.scm ends here
diff --git a/gnu/tests/base.scm b/gnu/tests/base.scm
index 8389b67f68..6132aa96ef 100644
--- a/gnu/tests/base.scm
+++ b/gnu/tests/base.scm
@@ -34,7 +34,6 @@
   #:use-module (gnu packages package-management)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:use-module (guix packages)
   #:use-module (srfi srfi-1)
   #:export (run-basic-test
@@ -393,17 +392,16 @@ info --version")
     "Instrument %SIMPLE-OS, run it in a VM, and run a series of basic
 functionality tests.")
    (value
-    (mlet* %store-monad ((os -> (marionette-operating-system
-                                 %simple-os
-                                 #:imported-modules '((gnu services herd)
-                                                      (guix combinators))))
-                         (run   (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
+    (let* ((os  (marionette-operating-system
+                 %simple-os
+                 #:imported-modules '((gnu services herd)
+                                      (guix combinators))))
+           (vm  (virtual-machine os)))
       ;; XXX: Add call to 'virtualized-operating-system' to get the exact same
       ;; set of services as the OS produced by
       ;; 'system-qemu-image/shared-store-script'.
       (run-basic-test (virtualized-operating-system os '())
-                      #~(list #$run))))))
+                      #~(list #$vm))))))
 
 
 ;;;
@@ -430,60 +428,60 @@ functionality tests.")
      (mcron-service (list job1 job2 job3)))))
 
 (define (run-mcron-test name)
-  (mlet* %store-monad ((os ->   (marionette-operating-system
-                                 %mcron-os
-                                 #:imported-modules '((gnu services herd)
-                                                      (guix combinators))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (gnu build marionette)
-                         (srfi srfi-64)
-                         (ice-9 match))
-
-            (define marionette
-              (make-marionette (list #$command)))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "mcron")
-
-            (test-eq "service running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'mcron)
-                  'running!)
-               marionette))
-
-            ;; Make sure root's mcron job runs, has its cwd set to "/root", and
-            ;; runs with the right UID/GID.
-            (test-equal "root's job"
-              '(0 0)
-              (wait-for-file "/root/witness" marionette))
-
-            ;; Likewise for Alice's job.  We cannot know what its GID is since
-            ;; it's chosen by 'groupadd', but it's strictly positive.
-            (test-assert "alice's job"
-              (match (wait-for-file "/home/alice/witness" marionette)
-                ((1000 gid)
-                 (>= gid 100))))
-
-            ;; Last, the job that uses a command; allows us to test whether
-            ;; $PATH is sane.  (Note that 'marionette-eval' stringifies objects
-            ;; that don't have a read syntax, hence the string.)
-            (test-equal "root's job with command"
-              "#<eof>"
-              (wait-for-file "/root/witness-touch" marionette))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation name test)))
+  (define os
+    (marionette-operating-system
+     %mcron-os
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64)
+                       (ice-9 match))
+
+          (define marionette
+            (make-marionette (list #$(virtual-machine os))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "mcron")
+
+          (test-eq "service running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'mcron)
+                'running!)
+             marionette))
+
+          ;; Make sure root's mcron job runs, has its cwd set to "/root", and
+          ;; runs with the right UID/GID.
+          (test-equal "root's job"
+            '(0 0)
+            (wait-for-file "/root/witness" marionette))
+
+          ;; Likewise for Alice's job.  We cannot know what its GID is since
+          ;; it's chosen by 'groupadd', but it's strictly positive.
+          (test-assert "alice's job"
+            (match (wait-for-file "/home/alice/witness" marionette)
+              ((1000 gid)
+               (>= gid 100))))
+
+          ;; Last, the job that uses a command; allows us to test whether
+          ;; $PATH is sane.  (Note that 'marionette-eval' stringifies objects
+          ;; that don't have a read syntax, hence the string.)
+          (test-equal "root's job with command"
+            "#<eof>"
+            (wait-for-file "/root/witness-touch" marionette))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation name test))
 
 (define %test-mcron
   (system-test
@@ -526,102 +524,102 @@ functionality tests.")
   ;; *after* nscd.  Failing to do that, libc will try to connect to nscd,
   ;; fail, then never try again (see '__nss_not_use_nscd_hosts' in libc),
   ;; leading to '.local' resolution failures.
-  (mlet* %store-monad ((os -> (marionette-operating-system
-                               %avahi-os
-                               #:requirements '(nscd)
-                               #:imported-modules '((gnu services herd)
-                                                    (guix combinators))))
-                       (run   (system-qemu-image/shared-store-script
-                               os #:graphic? #f)))
-    (define mdns-host-name
-      (string-append (operating-system-host-name os)
-                     ".local"))
-
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (gnu build marionette)
-                         (srfi srfi-1)
-                         (srfi srfi-64)
-                         (ice-9 match))
-
-            (define marionette
-              (make-marionette (list #$run)))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "avahi")
-
-            (test-assert "wait for services"
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
+  (define os
+    (marionette-operating-system
+     %avahi-os
+     #:requirements '(nscd)
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
 
-                  (start-service 'nscd)
-
-                  ;; XXX: Work around a race condition in nscd: nscd creates its
-                  ;; PID file before it is listening on its socket.
-                  (let ((sock (socket PF_UNIX SOCK_STREAM 0)))
-                    (let try ()
-                      (catch 'system-error
-                        (lambda ()
-                          (connect sock AF_UNIX "/var/run/nscd/socket")
-                          (close-port sock)
-                          (format #t "nscd is ready~%"))
-                        (lambda args
-                          (format #t "waiting for nscd...~%")
-                          (usleep 500000)
-                          (try)))))
-
-                  ;; Wait for the other useful things.
-                  (start-service 'avahi-daemon)
-                  (start-service 'networking)
-
-                  #t)
-               marionette))
-
-            (test-equal "avahi-resolve-host-name"
-              0
-              (marionette-eval
-               '(system*
-                 "/run/current-system/profile/bin/avahi-resolve-host-name"
-                 "-v" #$mdns-host-name)
-               marionette))
+  (define mdns-host-name
+    (string-append (operating-system-host-name os)
+                   ".local"))
 
-            (test-equal "avahi-browse"
-              0
-              (marionette-eval
-               '(system* "avahi-browse" "-avt")
-               marionette))
-
-            (test-assert "getaddrinfo .local"
-              ;; Wait for the 'avahi-daemon' service and perform a resolution.
-              (match (marionette-eval
-                      '(getaddrinfo #$mdns-host-name)
-                      marionette)
-                (((? vector? addrinfos) ..1)
-                 (pk 'getaddrinfo addrinfos)
-                 (and (any (lambda (ai)
-                             (= AF_INET (addrinfo:fam ai)))
-                           addrinfos)
-                      (any (lambda (ai)
-                             (= AF_INET6 (addrinfo:fam ai)))
-                           addrinfos)))))
-
-            (test-assert "gethostbyname .local"
-              (match (pk 'gethostbyname
-                         (marionette-eval '(gethostbyname #$mdns-host-name)
-                                          marionette))
-                ((? vector? result)
-                 (and (string=? (hostent:name result) #$mdns-host-name)
-                      (= (hostent:addrtype result) AF_INET)))))
-
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation "nss-mdns" test)))
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-1)
+                       (srfi srfi-64)
+                       (ice-9 match))
+
+          (define marionette
+            (make-marionette (list #$(virtual-machine os))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "avahi")
+
+          (test-assert "wait for services"
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+
+                (start-service 'nscd)
+
+                ;; XXX: Work around a race condition in nscd: nscd creates its
+                ;; PID file before it is listening on its socket.
+                (let ((sock (socket PF_UNIX SOCK_STREAM 0)))
+                  (let try ()
+                    (catch 'system-error
+                      (lambda ()
+                        (connect sock AF_UNIX "/var/run/nscd/socket")
+                        (close-port sock)
+                        (format #t "nscd is ready~%"))
+                      (lambda args
+                        (format #t "waiting for nscd...~%")
+                        (usleep 500000)
+                        (try)))))
+
+                ;; Wait for the other useful things.
+                (start-service 'avahi-daemon)
+                (start-service 'networking)
+
+                #t)
+             marionette))
+
+          (test-equal "avahi-resolve-host-name"
+            0
+            (marionette-eval
+             '(system*
+               "/run/current-system/profile/bin/avahi-resolve-host-name"
+               "-v" #$mdns-host-name)
+             marionette))
+
+          (test-equal "avahi-browse"
+            0
+            (marionette-eval
+             '(system* "avahi-browse" "-avt")
+             marionette))
+
+          (test-assert "getaddrinfo .local"
+            ;; Wait for the 'avahi-daemon' service and perform a resolution.
+            (match (marionette-eval
+                    '(getaddrinfo #$mdns-host-name)
+                    marionette)
+              (((? vector? addrinfos) ..1)
+               (pk 'getaddrinfo addrinfos)
+               (and (any (lambda (ai)
+                           (= AF_INET (addrinfo:fam ai)))
+                         addrinfos)
+                    (any (lambda (ai)
+                           (= AF_INET6 (addrinfo:fam ai)))
+                         addrinfos)))))
+
+          (test-assert "gethostbyname .local"
+            (match (pk 'gethostbyname
+                       (marionette-eval '(gethostbyname #$mdns-host-name)
+                                        marionette))
+              ((? vector? result)
+               (and (string=? (hostent:name result) #$mdns-host-name)
+                    (= (hostent:addrtype result) AF_INET)))))
+
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "nss-mdns" test))
 
 (define %test-nss-mdns
   (system-test
diff --git a/gnu/tests/dict.scm b/gnu/tests/dict.scm
index 16b6edbd9e..b9c741e3e0 100644
--- a/gnu/tests/dict.scm
+++ b/gnu/tests/dict.scm
@@ -27,7 +27,6 @@
   #:use-module (gnu packages wordnet)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:use-module (guix packages)
   #:use-module (guix modules)
   #:export (%test-dicod))
@@ -54,86 +53,90 @@
 
 (define* (run-dicod-test)
   "Run tests of 'dicod-service-type'."
-  (mlet* %store-monad ((os -> (marionette-operating-system
-                               %dicod-os
-                               #:imported-modules
-                               (source-module-closure '((gnu services herd)))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (ice-9 rdelim)
-                         (ice-9 regex)
-                         (srfi srfi-64)
-                         (gnu build marionette))
-            (define marionette
-              ;; Forward the guest's DICT port to local port 8000.
-              (make-marionette (list #$command "-net"
-                                     "user,hostfwd=tcp::8000-:2628")))
-
-            (define %dico-socket
-              (socket PF_INET SOCK_STREAM 0))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "dicod")
-
-            ;; Wait for the service to be started.
-            (test-eq "service is running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'dicod)
-                  'running!)
-               marionette))
-
-            ;; Wait until dicod is actually listening.
-            ;; TODO: Use a PID file instead.
-            (test-assert "connect inside"
-              (marionette-eval
-               '(begin
-                  (use-modules (ice-9 rdelim))
-                  (let ((sock (socket PF_INET SOCK_STREAM 0)))
-                    (let loop ((i 0))
-                      (pk 'try i)
-                      (catch 'system-error
-                        (lambda ()
-                          (connect sock AF_INET INADDR_LOOPBACK 2628))
-                        (lambda args
-                          (pk 'connection-error args)
-                          (when (< i 20)
-                            (sleep 1)
-                            (loop (+ 1 i))))))
-                    (read-line sock 'concat)))
-               marionette))
-
-            (test-assert "connect"
-              (let ((addr (make-socket-address AF_INET INADDR_LOOPBACK 8000)))
-                (connect %dico-socket addr)
-                (read-line %dico-socket 'concat)))
-
-            (test-equal "CLIENT"
-              "250 ok\r\n"
-              (begin
-                (display "CLIENT \"GNU Guile\"\r\n" %dico-socket)
-                (read-line %dico-socket 'concat)))
-
-            (test-assert "DEFINE"
-              (begin
-                (display "DEFINE ! hello\r\n" %dico-socket)
-                (display "QUIT\r\n" %dico-socket)
-                (let ((result (read-string %dico-socket)))
-                  (and (string-contains result "gcide")
-                       (string-contains result "hello")
-                       result))))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation "dicod" test)))
+  (define os
+    (marionette-operating-system
+     %dicod-os
+     #:imported-modules
+     (source-module-closure '((gnu services herd)))))
+
+  (define vm
+    (virtual-machine
+     (operating-system os)
+     (port-forwardings '((8000 . 2628)))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (ice-9 rdelim)
+                       (ice-9 regex)
+                       (srfi srfi-64)
+                       (gnu build marionette))
+          (define marionette
+            ;; Forward the guest's DICT port to local port 8000.
+            (make-marionette (list #$vm)))
+
+          (define %dico-socket
+            (socket PF_INET SOCK_STREAM 0))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "dicod")
+
+          ;; Wait for the service to be started.
+          (test-eq "service is running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'dicod)
+                'running!)
+             marionette))
+
+          ;; Wait until dicod is actually listening.
+          ;; TODO: Use a PID file instead.
+          (test-assert "connect inside"
+            (marionette-eval
+             '(begin
+                (use-modules (ice-9 rdelim))
+                (let ((sock (socket PF_INET SOCK_STREAM 0)))
+                  (let loop ((i 0))
+                    (pk 'try i)
+                    (catch 'system-error
+                      (lambda ()
+                        (connect sock AF_INET INADDR_LOOPBACK 2628))
+                      (lambda args
+                        (pk 'connection-error args)
+                        (when (< i 20)
+                          (sleep 1)
+                          (loop (+ 1 i))))))
+                  (read-line sock 'concat)))
+             marionette))
+
+          (test-assert "connect"
+            (let ((addr (make-socket-address AF_INET INADDR_LOOPBACK 8000)))
+              (connect %dico-socket addr)
+              (read-line %dico-socket 'concat)))
+
+          (test-equal "CLIENT"
+            "250 ok\r\n"
+            (begin
+              (display "CLIENT \"GNU Guile\"\r\n" %dico-socket)
+              (read-line %dico-socket 'concat)))
+
+          (test-assert "DEFINE"
+            (begin
+              (display "DEFINE ! hello\r\n" %dico-socket)
+              (display "QUIT\r\n" %dico-socket)
+              (let ((result (read-string %dico-socket)))
+                (and (string-contains result "gcide")
+                     (string-contains result "hello")
+                     result))))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "dicod" test))
 
 (define %test-dicod
   (system-test
diff --git a/gnu/tests/install.scm b/gnu/tests/install.scm
index 7c5d48104e..22e4181ab1 100644
--- a/gnu/tests/install.scm
+++ b/gnu/tests/install.scm
@@ -27,8 +27,8 @@
   #:use-module ((gnu build vm) #:select (qemu-command))
   #:use-module (gnu packages bootloaders)
   #:use-module (gnu packages ocr)
-  #:use-module (gnu packages qemu)
   #:use-module (gnu packages package-management)
+  #:use-module (gnu packages virtualization)
   #:use-module (guix store)
   #:use-module (guix monads)
   #:use-module (guix packages)
diff --git a/gnu/tests/mail.scm b/gnu/tests/mail.scm
index 247f4f667f..312df9b1cd 100644
--- a/gnu/tests/mail.scm
+++ b/gnu/tests/mail.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@member.fsf.org>
 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
+;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,7 +26,6 @@
   #:use-module (gnu services mail)
   #:use-module (gnu services networking)
   #:use-module (guix gexp)
-  #:use-module (guix monads)
   #:use-module (guix store)
   #:use-module (ice-9 ftw)
   #:export (%test-opensmtpd
@@ -44,105 +44,105 @@ accept from any for local deliver to mbox
 
 (define (run-opensmtpd-test)
   "Return a test of an OS running OpenSMTPD service."
-  (mlet* %store-monad ((command (system-qemu-image/shared-store-script
-                                 (marionette-operating-system
-                                  %opensmtpd-os
-                                  #:imported-modules '((gnu services herd)))
-                                 #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (rnrs base)
-                         (srfi srfi-64)
-                         (ice-9 rdelim)
-                         (ice-9 regex)
-                         (gnu build marionette))
-
-            (define marionette
-              (make-marionette
-               ;; Enable TCP forwarding of the guest's port 25.
-               '(#$command "-net" "user,hostfwd=tcp::1025-:25")))
-
-            (define (read-reply-code port)
-              "Read a SMTP reply from PORT and return its reply code."
-              (let* ((line      (read-line port))
-                     (mo        (string-match "([0-9]+)([ -]).*" line))
-                     (code      (string->number (match:substring mo 1)))
-                     (finished? (string= " " (match:substring mo 2))))
-                (if finished?
-                    code
-                    (read-reply-code port))))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "opensmptd")
-
-            (test-assert "service is running"
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'smtpd)
-                  #t)
-               marionette))
-
-            (test-assert "mbox is empty"
-              (marionette-eval
-               '(and (file-exists? "/var/mail")
-                     (not (file-exists? "/var/mail/root")))
-               marionette))
-
-            (test-eq "accept an email"
-              #t
-              (let* ((smtp (socket AF_INET SOCK_STREAM 0))
-                     (addr (make-socket-address AF_INET INADDR_LOOPBACK 1025)))
-                (connect smtp addr)
-                ;; Be greeted.
-                (read-reply-code smtp)             ;220
-                ;; Greet the server.
-                (write-line "EHLO somehost" smtp)
-                (read-reply-code smtp)             ;250
-                ;; Set sender email.
-                (write-line "MAIL FROM: <someone>" smtp)
-                (read-reply-code smtp)             ;250
-                ;; Set recipient email.
-                (write-line "RCPT TO: <root>" smtp)
-                (read-reply-code smtp)             ;250
-                ;; Send message.
-                (write-line "DATA" smtp)
-                (read-reply-code smtp)             ;354
-                (write-line "Subject: Hello" smtp)
-                (newline smtp)
-                (write-line "Nice to meet you!" smtp)
-                (write-line "." smtp)
-                (read-reply-code smtp)             ;250
-                ;; Say goodbye.
-                (write-line "QUIT" smtp)
-                (read-reply-code smtp)             ;221
-                (close smtp)
-                #t))
-
-            (test-assert "mail arrived"
-              (marionette-eval
-               '(begin
-                  (use-modules (ice-9 popen)
-                               (ice-9 rdelim))
-
-                  (define (queue-empty?)
-                    (eof-object?
-                     (read-line
-                      (open-input-pipe "smtpctl show queue"))))
-
-                  (let wait ()
-                    (if (queue-empty?)
-                        (file-exists? "/var/mail/root")
-                        (begin (sleep 1) (wait)))))
-               marionette))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation "opensmtpd-test" test)))
+  (define vm
+    (virtual-machine
+     (operating-system (marionette-operating-system
+                        %opensmtpd-os
+                        #:imported-modules '((gnu services herd))))
+     (port-forwardings '((1025 . 25)))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (rnrs base)
+                       (srfi srfi-64)
+                       (ice-9 rdelim)
+                       (ice-9 regex)
+                       (gnu build marionette))
+
+          (define marionette
+            (make-marionette '(#$vm)))
+
+          (define (read-reply-code port)
+            "Read a SMTP reply from PORT and return its reply code."
+            (let* ((line      (read-line port))
+                   (mo        (string-match "([0-9]+)([ -]).*" line))
+                   (code      (string->number (match:substring mo 1)))
+                   (finished? (string= " " (match:substring mo 2))))
+              (if finished?
+                  code
+                  (read-reply-code port))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "opensmptd")
+
+          (test-assert "service is running"
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'smtpd)
+                #t)
+             marionette))
+
+          (test-assert "mbox is empty"
+            (marionette-eval
+             '(and (file-exists? "/var/mail")
+                   (not (file-exists? "/var/mail/root")))
+             marionette))
+
+          (test-eq "accept an email"
+            #t
+            (let* ((smtp (socket AF_INET SOCK_STREAM 0))
+                   (addr (make-socket-address AF_INET INADDR_LOOPBACK 1025)))
+              (connect smtp addr)
+              ;; Be greeted.
+              (read-reply-code smtp)              ;220
+              ;; Greet the server.
+              (write-line "EHLO somehost" smtp)
+              (read-reply-code smtp)              ;250
+              ;; Set sender email.
+              (write-line "MAIL FROM: <someone>" smtp)
+              (read-reply-code smtp)              ;250
+              ;; Set recipient email.
+              (write-line "RCPT TO: <root>" smtp)
+              (read-reply-code smtp)              ;250
+              ;; Send message.
+              (write-line "DATA" smtp)
+              (read-reply-code smtp)              ;354
+              (write-line "Subject: Hello" smtp)
+              (newline smtp)
+              (write-line "Nice to meet you!" smtp)
+              (write-line "." smtp)
+              (read-reply-code smtp)              ;250
+              ;; Say goodbye.
+              (write-line "QUIT" smtp)
+              (read-reply-code smtp)              ;221
+              (close smtp)
+              #t))
+
+          (test-assert "mail arrived"
+            (marionette-eval
+             '(begin
+                (use-modules (ice-9 popen)
+                             (ice-9 rdelim))
+
+                (define (queue-empty?)
+                  (eof-object?
+                   (read-line
+                    (open-input-pipe "smtpctl show queue"))))
+
+                (let wait ()
+                  (if (queue-empty?)
+                      (file-exists? "/var/mail/root")
+                      (begin (sleep 1) (wait)))))
+             marionette))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "opensmtpd-test" test))
 
 (define %test-opensmtpd
   (system-test
@@ -179,100 +179,100 @@ acl_check_data:
 
 (define (run-exim-test)
   "Return a test of an OS running an Exim service."
-  (mlet* %store-monad ((command (system-qemu-image/shared-store-script
-                                 (marionette-operating-system
-                                  %exim-os
-                                  #:imported-modules '((gnu services herd)))
-                                 #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette)
-                               (ice-9 ftw))
-        #~(begin
-            (use-modules (rnrs base)
-                         (srfi srfi-64)
-                         (ice-9 ftw)
-                         (ice-9 rdelim)
-                         (ice-9 regex)
-                         (gnu build marionette))
-
-            (define marionette
-              (make-marionette
-               ;; Enable TCP forwarding of the guest's port 25.
-               '(#$command "-net" "user,hostfwd=tcp::1025-:25")))
-
-            (define (read-reply-code port)
-              "Read a SMTP reply from PORT and return its reply code."
-              (let* ((line      (read-line port))
-                     (mo        (string-match "([0-9]+)([ -]).*" line))
-                     (code      (string->number (match:substring mo 1)))
-                     (finished? (string= " " (match:substring mo 2))))
-                (if finished?
-                    code
-                    (read-reply-code port))))
-
-            (define smtp (socket AF_INET SOCK_STREAM 0))
-            (define addr (make-socket-address AF_INET INADDR_LOOPBACK 1025))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "exim")
-
-            (test-assert "service is running"
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'exim)
-                  #t)
-               marionette))
-
-            (sleep 1) ;; give the service time to start talking
-
-            (connect smtp addr)
-            ;; Be greeted.
-            (test-eq "greeting received"
-              220 (read-reply-code smtp))
-            ;; Greet the server.
-            (write-line "EHLO somehost" smtp)
-            (test-eq "greeting successful"
-              250 (read-reply-code smtp))
-            ;; Set sender email.
-            (write-line "MAIL FROM: test@example.com" smtp)
-            (test-eq "sender set"
-              250 (read-reply-code smtp)) ;250
-            ;; Set recipient email.
-            (write-line "RCPT TO: root@komputilo" smtp)
-            (test-eq "recipient set"
-              250 (read-reply-code smtp)) ;250
-            ;; Send message.
-            (write-line "DATA" smtp)
-            (test-eq "data begun"
-              354 (read-reply-code smtp)) ;354
-            (write-line "Subject: Hello" smtp)
-            (newline smtp)
-            (write-line "Nice to meet you!" smtp)
-            (write-line "." smtp)
-            (test-eq "message sent"
-              250 (read-reply-code smtp)) ;250
-            ;; Say goodbye.
-            (write-line "QUIT" smtp)
-            (test-eq "quit successful"
-              221 (read-reply-code smtp)) ;221
-            (close smtp)
-
-            (test-eq "the email is received"
-              1
-              (marionette-eval
-               '(begin
-                  (use-modules (ice-9 ftw))
-                  (length (scandir "/var/spool/exim/msglog"
-                                   (lambda (x) (not (string-prefix? "." x))))))
-               marionette))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation "exim-test" test)))
+  (define vm
+    (virtual-machine
+     (operating-system (marionette-operating-system
+                        %exim-os
+                        #:imported-modules '((gnu services herd))))
+     (port-forwardings '((1025 . 25)))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette)
+                             (ice-9 ftw))
+      #~(begin
+          (use-modules (rnrs base)
+                       (srfi srfi-64)
+                       (ice-9 ftw)
+                       (ice-9 rdelim)
+                       (ice-9 regex)
+                       (gnu build marionette))
+
+          (define marionette
+            (make-marionette '(#$vm)))
+
+          (define (read-reply-code port)
+            "Read a SMTP reply from PORT and return its reply code."
+            (let* ((line      (read-line port))
+                   (mo        (string-match "([0-9]+)([ -]).*" line))
+                   (code      (string->number (match:substring mo 1)))
+                   (finished? (string= " " (match:substring mo 2))))
+              (if finished?
+                  code
+                  (read-reply-code port))))
+
+          (define smtp (socket AF_INET SOCK_STREAM 0))
+          (define addr (make-socket-address AF_INET INADDR_LOOPBACK 1025))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "exim")
+
+          (test-assert "service is running"
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'exim)
+                #t)
+             marionette))
+
+          (sleep 1) ;; give the service time to start talking
+
+          (connect smtp addr)
+          ;; Be greeted.
+          (test-eq "greeting received"
+            220 (read-reply-code smtp))
+          ;; Greet the server.
+          (write-line "EHLO somehost" smtp)
+          (test-eq "greeting successful"
+            250 (read-reply-code smtp))
+          ;; Set sender email.
+          (write-line "MAIL FROM: test@example.com" smtp)
+          (test-eq "sender set"
+            250 (read-reply-code smtp))           ;250
+          ;; Set recipient email.
+          (write-line "RCPT TO: root@komputilo" smtp)
+          (test-eq "recipient set"
+            250 (read-reply-code smtp))           ;250
+          ;; Send message.
+          (write-line "DATA" smtp)
+          (test-eq "data begun"
+            354 (read-reply-code smtp))           ;354
+          (write-line "Subject: Hello" smtp)
+          (newline smtp)
+          (write-line "Nice to meet you!" smtp)
+          (write-line "." smtp)
+          (test-eq "message sent"
+            250 (read-reply-code smtp))           ;250
+          ;; Say goodbye.
+          (write-line "QUIT" smtp)
+          (test-eq "quit successful"
+            221 (read-reply-code smtp))           ;221
+          (close smtp)
+
+          (test-eq "the email is received"
+            1
+            (marionette-eval
+             '(begin
+                (use-modules (ice-9 ftw))
+                (length (scandir "/var/spool/exim/msglog"
+                                 (lambda (x) (not (string-prefix? "." x))))))
+             marionette))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "exim-test" test))
 
 (define %test-exim
   (system-test
diff --git a/gnu/tests/messaging.scm b/gnu/tests/messaging.scm
index b76b8e8434..0ba0c839de 100644
--- a/gnu/tests/messaging.scm
+++ b/gnu/tests/messaging.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -26,108 +27,109 @@
   #:use-module (gnu packages messaging)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:export (%test-prosody))
 
 (define (run-xmpp-test name xmpp-service pid-file create-account)
   "Run a test of an OS running XMPP-SERVICE, which writes its PID to PID-FILE."
-  (mlet* %store-monad ((os -> (marionette-operating-system
-                               (simple-operating-system (dhcp-client-service)
-                                                        xmpp-service)
-                               #:imported-modules '((gnu services herd))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f))
-                       (username -> "alice")
-                       (server -> "localhost")
-                       (jid -> (string-append username "@" server))
-                       (password -> "correct horse battery staple")
-                       (port -> 15222)
-                       (message -> "hello world")
-                       (witness -> "/tmp/freetalk-witness"))
-
-    (define script.ft
-      (scheme-file
-       "script.ft"
-       #~(begin
-           (define (handle-received-message time from nickname message)
-             (define (touch file-name)
-               (call-with-output-file file-name (const #t)))
-             (when (equal? message #$message)
-               (touch #$witness)))
-           (add-hook! ft-message-receive-hook handle-received-message)
-
-           (ft-set-jid! #$jid)
-           (ft-set-password! #$password)
-           (ft-set-server! #$server)
-           (ft-set-port! #$port)
-           (ft-set-sslconn! #f)
-           (ft-connect-blocking)
-           (ft-send-message #$jid #$message)
-
-           (ft-set-daemon)
-           (ft-main-loop))))
-
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (gnu build marionette)
-                         (srfi srfi-64))
-
-            (define marionette
-              ;; Enable TCP forwarding of the guest's port 5222.
-              (make-marionette (list #$command "-net"
-                                     (string-append "user,hostfwd=tcp::"
-                                                    (number->string #$port)
-                                                    "-:5222"))))
-
-            (define (host-wait-for-file file)
-              ;; Wait until FILE exists in the host.
-              (let loop ((i 60))
-                (cond ((file-exists? file)
-                       #t)
-                      ((> i 0)
-                       (begin
-                         (sleep 1))
-                       (loop (- i 1)))
-                      (else
-                       (error "file didn't show up" file)))))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "xmpp")
-
-            ;; Wait for XMPP service to be up and running.
-            (test-eq "service running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'xmpp-daemon)
-                  'running!)
-               marionette))
-
-            ;; Check XMPP service's PID.
-            (test-assert "service process id"
-              (let ((pid (number->string (wait-for-file #$pid-file
-                                                        marionette))))
-                (marionette-eval `(file-exists? (string-append "/proc/" ,pid))
-                                 marionette)))
-
-            ;; Alice sends an XMPP message to herself, with Freetalk.
-            (test-assert "client-to-server communication"
-              (let ((freetalk-bin (string-append #$freetalk "/bin/freetalk")))
-                (marionette-eval '(system* #$create-account #$jid #$password)
-                                 marionette)
-                ;; Freetalk requires write access to $HOME.
-                (setenv "HOME" "/tmp")
-                (system* freetalk-bin "-s" #$script.ft)
-                (host-wait-for-file #$witness)))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation name test)))
+  (define os
+    (marionette-operating-system
+     (simple-operating-system (dhcp-client-service)
+                              xmpp-service)
+     #:imported-modules '((gnu services herd))))
+
+  (define port 15222)
+
+  (define vm
+    (virtual-machine
+     (operating-system os)
+     (port-forwardings `((,port . 5222)))))
+
+  (define username "alice")
+  (define server "localhost")
+  (define jid (string-append username "@" server))
+  (define password "correct horse battery staple")
+  (define message "hello world")
+  (define witness "/tmp/freetalk-witness")
+
+  (define script.ft
+    (scheme-file
+     "script.ft"
+     #~(begin
+         (define (handle-received-message time from nickname message)
+           (define (touch file-name)
+             (call-with-output-file file-name (const #t)))
+           (when (equal? message #$message)
+             (touch #$witness)))
+         (add-hook! ft-message-receive-hook handle-received-message)
+
+         (ft-set-jid! #$jid)
+         (ft-set-password! #$password)
+         (ft-set-server! #$server)
+         (ft-set-port! #$port)
+         (ft-set-sslconn! #f)
+         (ft-connect-blocking)
+         (ft-send-message #$jid #$message)
+
+         (ft-set-daemon)
+         (ft-main-loop))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette (list #$vm)))
+
+          (define (host-wait-for-file file)
+            ;; Wait until FILE exists in the host.
+            (let loop ((i 60))
+              (cond ((file-exists? file)
+                     #t)
+                    ((> i 0)
+                     (begin
+                       (sleep 1))
+                     (loop (- i 1)))
+                    (else
+                     (error "file didn't show up" file)))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "xmpp")
+
+          ;; Wait for XMPP service to be up and running.
+          (test-eq "service running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'xmpp-daemon)
+                'running!)
+             marionette))
+
+          ;; Check XMPP service's PID.
+          (test-assert "service process id"
+            (let ((pid (number->string (wait-for-file #$pid-file
+                                                      marionette))))
+              (marionette-eval `(file-exists? (string-append "/proc/" ,pid))
+                               marionette)))
+
+          ;; Alice sends an XMPP message to herself, with Freetalk.
+          (test-assert "client-to-server communication"
+            (let ((freetalk-bin (string-append #$freetalk "/bin/freetalk")))
+              (marionette-eval '(system* #$create-account #$jid #$password)
+                               marionette)
+              ;; Freetalk requires write access to $HOME.
+              (setenv "HOME" "/tmp")
+              (system* freetalk-bin "-s" #$script.ft)
+              (host-wait-for-file #$witness)))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation name test))
 
 (define %create-prosody-account
   (program-file
diff --git a/gnu/tests/networking.scm b/gnu/tests/networking.scm
index cfcb490874..aeee105a1c 100644
--- a/gnu/tests/networking.scm
+++ b/gnu/tests/networking.scm
@@ -74,60 +74,61 @@ done" ))))))))))
 (define* (run-inetd-test)
   "Run tests in %INETD-OS, where the inetd service provides an echo service on
 port 7, and a dict service on port 2628."
-  (mlet* %store-monad ((os -> (marionette-operating-system %inetd-os))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (ice-9 rdelim)
-                         (srfi srfi-64)
-                         (gnu build marionette))
-            (define marionette
-              ;; Forward guest ports 7 and 2628 to host ports 8007 and 8628.
-              (make-marionette (list #$command "-net"
-                                     (string-append
-                                      "user"
-                                      ",hostfwd=tcp::8007-:7"
-                                      ",hostfwd=tcp::8628-:2628"))))
+  (define os
+    (marionette-operating-system %inetd-os))
 
-            (mkdir #$output)
-            (chdir #$output)
+  (define vm
+    (virtual-machine
+     (operating-system os)
+     (port-forwardings `((8007 . 7)
+                         (8628 . 2628)))))
 
-            (test-begin "inetd")
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (ice-9 rdelim)
+                       (srfi srfi-64)
+                       (gnu build marionette))
+          (define marionette
+            (make-marionette (list #$vm)))
 
-            ;; Make sure the PID file is created.
-            (test-assert "PID file"
-              (marionette-eval
-               '(file-exists? "/var/run/inetd.pid")
-              marionette))
+          (mkdir #$output)
+          (chdir #$output)
 
-            ;; Test the echo service.
-            (test-equal "echo response"
-              "Hello, Guix!"
-              (let ((echo (socket PF_INET SOCK_STREAM 0))
-                    (addr (make-socket-address AF_INET INADDR_LOOPBACK 8007)))
-                (connect echo addr)
-                (display "Hello, Guix!\n" echo)
-                (let ((response (read-line echo)))
-                  (close echo)
-                  response)))
+          (test-begin "inetd")
 
-            ;; Test the dict service
-            (test-equal "dict response"
-              "GNU Guix is a package management tool for the GNU system."
-              (let ((dict (socket PF_INET SOCK_STREAM 0))
-                    (addr (make-socket-address AF_INET INADDR_LOOPBACK 8628)))
-                (connect dict addr)
-                (display "DEFINE Guix\n" dict)
-                (let ((response (read-line dict)))
-                  (close dict)
-                  response)))
+          ;; Make sure the PID file is created.
+          (test-assert "PID file"
+            (marionette-eval
+             '(file-exists? "/var/run/inetd.pid")
+             marionette))
 
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+          ;; Test the echo service.
+          (test-equal "echo response"
+            "Hello, Guix!"
+            (let ((echo (socket PF_INET SOCK_STREAM 0))
+                  (addr (make-socket-address AF_INET INADDR_LOOPBACK 8007)))
+              (connect echo addr)
+              (display "Hello, Guix!\n" echo)
+              (let ((response (read-line echo)))
+                (close echo)
+                response)))
 
-    (gexp->derivation "inetd-test" test)))
+          ;; Test the dict service
+          (test-equal "dict response"
+            "GNU Guix is a package management tool for the GNU system."
+            (let ((dict (socket PF_INET SOCK_STREAM 0))
+                  (addr (make-socket-address AF_INET INADDR_LOOPBACK 8628)))
+              (connect dict addr)
+              (display "DEFINE Guix\n" dict)
+              (let ((response (read-line dict)))
+                (close dict)
+                response)))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "inetd-test" test))
 
 (define %test-inetd
   (system-test
diff --git a/gnu/tests/nfs.scm b/gnu/tests/nfs.scm
index 9e1ac1d55a..2e666b2c08 100644
--- a/gnu/tests/nfs.scm
+++ b/gnu/tests/nfs.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;;
@@ -55,75 +55,75 @@
 
 (define (run-nfs-test name socket)
   "Run a test of an OS running RPC-SERVICE, which should create SOCKET."
-  (mlet* %store-monad ((os ->   (marionette-operating-system
-                                 %base-os
-                                 #:imported-modules '((gnu services herd)
-                                                      (guix combinators))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (gnu build marionette)
-                         (srfi srfi-64))
-
-            (define marionette
-              (make-marionette (list #$command)))
-
-            (define (wait-for-socket file)
-              ;; Wait until SOCKET  exists in the guest
-              (marionette-eval
-               `(let loop ((i 10))
-                  (cond ((and (file-exists? ,file)
-                              (eq? 'socket (stat:type (stat ,file))))
-                         #t)
-                        ((> i 0)
-                         (sleep 1)
-                         (loop (- i 1)))
-                        (else
-                         (error "Socket didn't show up: " ,file))))
-               marionette))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "rpc-daemon")
-
-            ;; Wait for the rpcbind daemon to be up and running.
-            (test-eq "RPC service running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'rpcbind-daemon)
-                  'running!)
-               marionette))
-
-            ;; Check the socket file and that the service is still running.
-            (test-assert "RPC socket exists"
-              (and
-                (wait-for-socket #$socket)
-                (marionette-eval
-                 '(begin
-                    (use-modules (gnu services herd)
-                                 (srfi srfi-1))
-
-                    (live-service-running
-                     (find (lambda (live)
-                             (memq 'rpcbind-daemon
-                                   (live-service-provision live)))
-                           (current-services))))
-                 marionette)))
-
-            (test-assert "Probe RPC daemon"
-              (marionette-eval
-               '(zero? (system* "rpcinfo" "-p"))
-               marionette))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation name test)))
+  (define os
+    (marionette-operating-system
+     %base-os
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette (list #$(virtual-machine os))))
+
+          (define (wait-for-socket file)
+            ;; Wait until SOCKET  exists in the guest
+            (marionette-eval
+             `(let loop ((i 10))
+                (cond ((and (file-exists? ,file)
+                            (eq? 'socket (stat:type (stat ,file))))
+                       #t)
+                      ((> i 0)
+                       (sleep 1)
+                       (loop (- i 1)))
+                      (else
+                       (error "Socket didn't show up: " ,file))))
+             marionette))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "rpc-daemon")
+
+          ;; Wait for the rpcbind daemon to be up and running.
+          (test-eq "RPC service running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'rpcbind-daemon)
+                'running!)
+             marionette))
+
+          ;; Check the socket file and that the service is still running.
+          (test-assert "RPC socket exists"
+            (and
+             (wait-for-socket #$socket)
+             (marionette-eval
+              '(begin
+                 (use-modules (gnu services herd)
+                              (srfi srfi-1))
+
+                 (live-service-running
+                  (find (lambda (live)
+                          (memq 'rpcbind-daemon
+                                (live-service-provision live)))
+                        (current-services))))
+              marionette)))
+
+          (test-assert "Probe RPC daemon"
+            (marionette-eval
+             '(zero? (system* "rpcinfo" "-p"))
+             marionette))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation name test))
 
 (define %test-nfs
   (system-test
diff --git a/gnu/tests/ssh.scm b/gnu/tests/ssh.scm
index 0d2b842071..41be360355 100644
--- a/gnu/tests/ssh.scm
+++ b/gnu/tests/ssh.scm
@@ -27,7 +27,6 @@
   #:use-module (gnu packages ssh)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:export (%test-openssh
             %test-dropbear))
 
@@ -37,142 +36,143 @@ SSH-SERVICE must be configured to listen on port 22 and to allow for root and
 empty-password logins.
 
 When SFTP? is true, run an SFTP server test."
-  (mlet* %store-monad ((os ->   (marionette-operating-system
-                                 (simple-operating-system
-                                  (dhcp-client-service)
-                                  ssh-service)
-                                 #:imported-modules '((gnu services herd)
-                                                      (guix combinators))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (eval-when (expand load eval)
-              ;; Prepare to use Guile-SSH.
-              (set! %load-path
-                (cons (string-append #+guile-ssh "/share/guile/site/"
-                                     (effective-version))
-                      %load-path)))
-
-            (use-modules (gnu build marionette)
-                         (srfi srfi-26)
-                         (srfi srfi-64)
-                         (ice-9 match)
-                         (ssh session)
-                         (ssh auth)
-                         (ssh channel)
-                         (ssh sftp))
-
-            (define marionette
-              ;; Enable TCP forwarding of the guest's port 22.
-              (make-marionette (list #$command "-net"
-                                     "user,hostfwd=tcp::2222-:22")))
-
-            (define (make-session-for-test)
-              "Make a session with predefined parameters for a test."
-              (make-session #:user "root"
-                            #:port 2222
-                            #:host "localhost"
-                            #:log-verbosity 'protocol))
-
-            (define (call-with-connected-session proc)
-              "Call the one-argument procedure PROC with a freshly created and
+  (define os
+    (marionette-operating-system
+     (simple-operating-system (dhcp-client-service) ssh-service)
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+  (define vm
+    (virtual-machine
+     (operating-system os)
+     (port-forwardings '((2222 . 22)))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (eval-when (expand load eval)
+            ;; Prepare to use Guile-SSH.
+            (set! %load-path
+              (cons (string-append #+guile-ssh "/share/guile/site/"
+                                   (effective-version))
+                    %load-path)))
+
+          (use-modules (gnu build marionette)
+                       (srfi srfi-26)
+                       (srfi srfi-64)
+                       (ice-9 match)
+                       (ssh session)
+                       (ssh auth)
+                       (ssh channel)
+                       (ssh sftp))
+
+          (define marionette
+            ;; Enable TCP forwarding of the guest's port 22.
+            (make-marionette (list #$vm)))
+
+          (define (make-session-for-test)
+            "Make a session with predefined parameters for a test."
+            (make-session #:user "root"
+                          #:port 2222
+                          #:host "localhost"
+                          #:log-verbosity 'protocol))
+
+          (define (call-with-connected-session proc)
+            "Call the one-argument procedure PROC with a freshly created and
 connected SSH session object, return the result of the procedure call.  The
 session is disconnected when the PROC is finished."
-              (let ((session (make-session-for-test)))
-                (dynamic-wind
-                  (lambda ()
-                    (let ((result (connect! session)))
-                      (unless (equal? result 'ok)
-                        (error "Could not connect to a server"
-                               session result))))
-                  (lambda () (proc session))
-                  (lambda () (disconnect! session)))))
-
-            (define (call-with-connected-session/auth proc)
-              "Make an authenticated session.  We should be able to connect as
+            (let ((session (make-session-for-test)))
+              (dynamic-wind
+                (lambda ()
+                  (let ((result (connect! session)))
+                    (unless (equal? result 'ok)
+                      (error "Could not connect to a server"
+                             session result))))
+                (lambda () (proc session))
+                (lambda () (disconnect! session)))))
+
+          (define (call-with-connected-session/auth proc)
+            "Make an authenticated session.  We should be able to connect as
 root with an empty password."
-              (call-with-connected-session
-               (lambda (session)
-                 ;; Try the simple authentication methods.  Dropbear requires
-                 ;; 'none' when there are no passwords, whereas OpenSSH accepts
-                 ;; 'password' with an empty password.
-                 (let loop ((methods (list (cut userauth-password! <> "")
-                                           (cut userauth-none! <>))))
-                   (match methods
-                     (()
-                      (error "all the authentication methods failed"))
-                     ((auth rest ...)
-                      (match (pk 'auth (auth session))
-                        ('success
-                         (proc session))
-                        ('denied
-                         (loop rest)))))))))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "ssh-daemon")
-
-            ;; Wait for sshd to be up and running.
-            (test-eq "service running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'ssh-daemon)
-                  'running!)
-               marionette))
-
-            ;; Check sshd's PID file.
-            (test-equal "sshd PID"
-              (wait-for-file #$pid-file marionette)
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd)
-                               (srfi srfi-1))
-
-                  (live-service-running
-                   (find (lambda (live)
-                           (memq 'ssh-daemon
-                                 (live-service-provision live)))
-                         (current-services))))
-               marionette))
-
-            ;; Connect to the guest over SSH.  Make sure we can run a shell
-            ;; command there.
-            (test-equal "shell command"
-              'hello
-              (call-with-connected-session/auth
-               (lambda (session)
-                 ;; FIXME: 'get-server-public-key' segfaults.
-                 ;; (get-server-public-key session)
-                 (let ((channel (make-channel session)))
-                   (channel-open-session channel)
-                   (channel-request-exec channel "echo hello > /root/witness")
-                   (and (zero? (channel-get-exit-status channel))
-                        (wait-for-file "/root/witness" marionette))))))
-
-            ;; Connect to the guest over SFTP.  Make sure we can write and
-            ;; read a file there.
-            (unless #$sftp?
-              (test-skip 1))
-            (test-equal "SFTP file writing and reading"
-              'hello
-              (call-with-connected-session/auth
-               (lambda (session)
-                 (let ((sftp-session (make-sftp-session session))
-                       (witness "/root/sftp-witness"))
-                   (call-with-remote-output-file sftp-session witness
-                                                 (cut display "hello" <>))
-                   (call-with-remote-input-file sftp-session witness
-                                                read)))))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation name test)))
+            (call-with-connected-session
+             (lambda (session)
+               ;; Try the simple authentication methods.  Dropbear requires
+               ;; 'none' when there are no passwords, whereas OpenSSH accepts
+               ;; 'password' with an empty password.
+               (let loop ((methods (list (cut userauth-password! <> "")
+                                         (cut userauth-none! <>))))
+                 (match methods
+                   (()
+                    (error "all the authentication methods failed"))
+                   ((auth rest ...)
+                    (match (pk 'auth (auth session))
+                      ('success
+                       (proc session))
+                      ('denied
+                       (loop rest)))))))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "ssh-daemon")
+
+          ;; Wait for sshd to be up and running.
+          (test-eq "service running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'ssh-daemon)
+                'running!)
+             marionette))
+
+          ;; Check sshd's PID file.
+          (test-equal "sshd PID"
+            (wait-for-file #$pid-file marionette)
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd)
+                             (srfi srfi-1))
+
+                (live-service-running
+                 (find (lambda (live)
+                         (memq 'ssh-daemon
+                               (live-service-provision live)))
+                       (current-services))))
+             marionette))
+
+          ;; Connect to the guest over SSH.  Make sure we can run a shell
+          ;; command there.
+          (test-equal "shell command"
+            'hello
+            (call-with-connected-session/auth
+             (lambda (session)
+               ;; FIXME: 'get-server-public-key' segfaults.
+               ;; (get-server-public-key session)
+               (let ((channel (make-channel session)))
+                 (channel-open-session channel)
+                 (channel-request-exec channel "echo hello > /root/witness")
+                 (and (zero? (channel-get-exit-status channel))
+                      (wait-for-file "/root/witness" marionette))))))
+
+          ;; Connect to the guest over SFTP.  Make sure we can write and
+          ;; read a file there.
+          (unless #$sftp?
+            (test-skip 1))
+          (test-equal "SFTP file writing and reading"
+            'hello
+            (call-with-connected-session/auth
+             (lambda (session)
+               (let ((sftp-session (make-sftp-session session))
+                     (witness "/root/sftp-witness"))
+                 (call-with-remote-output-file sftp-session witness
+                                               (cut display "hello" <>))
+                 (call-with-remote-input-file sftp-session witness
+                                              read)))))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation name test))
 
 (define %test-openssh
   (system-test
diff --git a/gnu/tests/web.scm b/gnu/tests/web.scm
index bc7e3b89a9..3fa272c676 100644
--- a/gnu/tests/web.scm
+++ b/gnu/tests/web.scm
@@ -27,7 +27,6 @@
   #:use-module (gnu services networking)
   #:use-module (guix gexp)
   #:use-module (guix store)
-  #:use-module (guix monads)
   #:export (%test-nginx))
 
 (define %index.html-contents
@@ -65,68 +64,68 @@
 (define* (run-nginx-test #:optional (http-port 8042))
   "Run tests in %NGINX-OS, which has nginx running and listening on
 HTTP-PORT."
-  (mlet* %store-monad ((os ->   (marionette-operating-system
-                                 %nginx-os
-                                 #:imported-modules '((gnu services herd)
-                                                      (guix combinators))))
-                       (command (system-qemu-image/shared-store-script
-                                 os #:graphic? #f)))
-    (define test
-      (with-imported-modules '((gnu build marionette))
-        #~(begin
-            (use-modules (srfi srfi-11) (srfi srfi-64)
-                         (gnu build marionette)
-                         (web uri)
-                         (web client)
-                         (web response))
-
-            (define marionette
-              ;; Forward the guest's HTTP-PORT, where nginx is listening, to
-              ;; port 8080 in the host.
-              (make-marionette (list #$command "-net"
-                                     (string-append
-                                      "user,hostfwd=tcp::8080-:"
-                                      #$(number->string http-port)))))
-
-            (mkdir #$output)
-            (chdir #$output)
-
-            (test-begin "nginx")
-
-            ;; Wait for nginx to be up and running.
-            (test-eq "service running"
-              'running!
-              (marionette-eval
-               '(begin
-                  (use-modules (gnu services herd))
-                  (start-service 'nginx)
-                  'running!)
-               marionette))
-
-            ;; Make sure the PID file is created.
-            (test-assert "PID file"
-              (marionette-eval
-               '(file-exists? "/var/run/nginx/pid")
-               marionette))
-
-            ;; Retrieve the index.html file we put in /srv.
-            (test-equal "http-get"
-              '(200 #$%index.html-contents)
-              (let-values (((response text)
-                            (http-get "http://localhost:8080/index.html"
-                                      #:decode-body? #t)))
-                (list (response-code response) text)))
-
-            ;; There should be a log file in here.
-            (test-assert "log file"
-              (marionette-eval
-               '(file-exists? "/var/log/nginx/access.log")
-               marionette))
-
-            (test-end)
-            (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
-
-    (gexp->derivation "nginx-test" test)))
+  (define os
+    (marionette-operating-system
+     %nginx-os
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define vm
+    (virtual-machine
+     (operating-system os)
+     (port-forwardings `((8080 . ,http-port)))))
+
+  (define test
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (srfi srfi-11) (srfi srfi-64)
+                       (gnu build marionette)
+                       (web uri)
+                       (web client)
+                       (web response))
+
+          (define marionette
+            (make-marionette (list #$vm)))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "nginx")
+
+          ;; Wait for nginx to be up and running.
+          (test-eq "service running"
+            'running!
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (start-service 'nginx)
+                'running!)
+             marionette))
+
+          ;; Make sure the PID file is created.
+          (test-assert "PID file"
+            (marionette-eval
+             '(file-exists? "/var/run/nginx/pid")
+             marionette))
+
+          ;; Retrieve the index.html file we put in /srv.
+          (test-equal "http-get"
+            '(200 #$%index.html-contents)
+            (let-values (((response text)
+                          (http-get "http://localhost:8080/index.html"
+                                    #:decode-body? #t)))
+              (list (response-code response) text)))
+
+          ;; There should be a log file in here.
+          (test-assert "log file"
+            (marionette-eval
+             '(file-exists? "/var/log/nginx/access.log")
+             marionette))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "nginx-test" test))
 
 (define %test-nginx
   (system-test
diff --git a/guix/base32.scm b/guix/base32.scm
index 7b2e2a6712..49f191ba26 100644
--- a/guix/base32.scm
+++ b/guix/base32.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2015, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,6 +28,8 @@
             bytevector->nix-base32-string
             base32-string->bytevector
             nix-base32-string->bytevector
+            %nix-base32-charset
+            %rfc4648-base32-charset
             &invalid-base32-character
             invalid-base32-character?
             invalid-base32-character-value
@@ -152,11 +154,17 @@ the previous application or INIT."
     #\a #\b #\c #\d #\f #\g #\h #\i #\j #\k #\l #\m #\n
     #\p #\q #\r #\s #\v #\w #\x #\y #\z))
 
+(define %nix-base32-charset
+  (list->char-set (vector->list %nix-base32-chars)))
+
 (define %rfc4648-base32-chars
   #(#\a #\b #\c #\d #\e #\f #\g #\h #\i #\j #\k #\l #\m
     #\n #\o #\p #\q #\r #\s #\t #\u #\v #\w #\x #\y #\z
     #\2 #\3 #\4 #\5 #\6 #\7))
 
+(define %rfc4648-base32-charset
+  (list->char-set (vector->list %rfc4648-base32-chars)))
+
 (define bytevector->base32-string
   (make-bytevector->base32-string bytevector-quintet-fold
                                   %rfc4648-base32-chars))
diff --git a/guix/build/syscalls.scm b/guix/build/syscalls.scm
index 41208e32a8..55b0df3911 100644
--- a/guix/build/syscalls.scm
+++ b/guix/build/syscalls.scm
@@ -92,6 +92,7 @@
             all-network-interface-names
             network-interface-names
             network-interface-netmask
+            network-interface-running?
             loopback-network-interface?
             network-interface-address
             set-network-interface-netmask
@@ -1160,6 +1161,7 @@ bytes."
 (define-as-needed IFF_UP #x1)                     ;Interface is up
 (define-as-needed IFF_BROADCAST #x2)              ;Broadcast address valid.
 (define-as-needed IFF_LOOPBACK #x8)               ;Is a loopback net.
+(define-as-needed IFF_RUNNING #x40)               ;interface RFC2863 OPER_UP
 
 (define IF_NAMESIZE 16)                           ;maximum interface name size
 
@@ -1334,6 +1336,13 @@ interface NAME."
     (close-port sock)
     (not (zero? (logand flags IFF_LOOPBACK)))))
 
+(define (network-interface-running? name)
+  "Return true if NAME designates a running network interface."
+  (let* ((sock  (socket SOCK_STREAM AF_INET 0))
+         (flags (network-interface-flags sock name)))
+    (close-port sock)
+    (not (zero? (logand flags IFF_RUNNING)))))
+
 (define-as-needed (set-network-interface-flags socket name flags)
   "Set the flag of network interface NAME to FLAGS."
   (let ((req (make-bytevector ifreq-struct-size)))
diff --git a/guix/download.scm b/guix/download.scm
index c1da515477..d7590d4110 100644
--- a/guix/download.scm
+++ b/guix/download.scm
@@ -277,7 +277,56 @@
        "http://kde.mirrors.tds.net/pub/kde/"
        ;; Oceania
        "http://ftp.kddlabs.co.jp/pub/X11/kde/"
-       "http://kde.mirror.uber.com.au/"))))
+       "http://kde.mirror.uber.com.au/")
+      (openbsd
+       "https://ftp.openbsd.org/pub/OpenBSD/"
+       ;; Anycast CDN redirecting to your friendly local mirror.
+       "https://mirrors.evowise.com/pub/OpenBSD/"
+       ;; Other HTTPS mirrors from https://www.openbsd.org/ftp.html
+       "https://mirror.aarnet.edu.au/pub/OpenBSD/"
+       "https://ftp2.eu.openbsd.org/pub/OpenBSD/"
+       "https://openbsd.c3sl.ufpr.br/pub/OpenBSD/"
+       "https://openbsd.ipacct.com/pub/OpenBSD/"
+       "https://ftp.OpenBSD.org/pub/OpenBSD/"
+       "https://openbsd.cs.toronto.edu/pub/OpenBSD/"
+       "https://openbsd.delfic.org/pub/OpenBSD/"
+       "https://openbsd.mirror.netelligent.ca/pub/OpenBSD/"
+       "https://mirrors.ucr.ac.cr/pub/OpenBSD/"
+       "https://mirrors.dotsrc.org/pub/OpenBSD/"
+       "https://mirror.one.com/pub/OpenBSD/"
+       "https://ftp.fr.openbsd.org/pub/OpenBSD/"
+       "https://ftp2.fr.openbsd.org/pub/OpenBSD/"
+       "https://mirrors.ircam.fr/pub/OpenBSD/"
+       "https://ftp.spline.de/pub/OpenBSD/"
+       "https://mirror.hs-esslingen.de/pub/OpenBSD/"
+       "https://ftp.halifax.rwth-aachen.de/openbsd/"
+       "https://ftp.hostserver.de/pub/OpenBSD/"
+       "https://ftp.fau.de/pub/OpenBSD/"
+       "https://ftp.cc.uoc.gr/pub/OpenBSD/"
+       "https://openbsd.hk/pub/OpenBSD/"
+       "https://ftp.heanet.ie/pub/OpenBSD/"
+       "https://openbsd.mirror.garr.it/pub/OpenBSD/"
+       "https://mirror.litnet.lt/pub/OpenBSD/"
+       "https://mirror.meerval.net/pub/OpenBSD/"
+       "https://ftp.nluug.nl/pub/OpenBSD/"
+       "https://ftp.bit.nl/pub/OpenBSD/"
+       "https://mirrors.dalenys.com/pub/OpenBSD/"
+       "https://ftp.icm.edu.pl/pub/OpenBSD/"
+       "https://ftp.rnl.tecnico.ulisboa.pt/pub/OpenBSD/"
+       "https://mirrors.pidginhost.com/pub/OpenBSD/"
+       "https://mirror.yandex.ru/pub/OpenBSD/"
+       "https://ftp.eu.openbsd.org/pub/OpenBSD/"
+       "https://ftp.yzu.edu.tw/pub/OpenBSD/"
+       "https://www.mirrorservice.org/pub/OpenBSD/"
+       "https://anorien.csc.warwick.ac.uk/pub/OpenBSD/"
+       "https://mirror.bytemark.co.uk/pub/OpenBSD/"
+       "https://mirrors.sonic.net/pub/OpenBSD/"
+       "https://ftp3.usa.openbsd.org/pub/OpenBSD/"
+       "https://mirrors.syringanetworks.net/pub/OpenBSD/"
+       "https://openbsd.mirror.constant.com/pub/OpenBSD/"
+       "https://ftp4.usa.openbsd.org/pub/OpenBSD/"
+       "https://ftp5.usa.openbsd.org/pub/OpenBSD/"
+       "https://mirror.esc7.net/pub/OpenBSD/"))))
 
 (define %mirror-file
   ;; Copy of the list of mirrors to a file.  This allows us to keep a single
diff --git a/guix/gexp.scm b/guix/gexp.scm
index d9c4cb461e..2622c5cb62 100644
--- a/guix/gexp.scm
+++ b/guix/gexp.scm
@@ -269,8 +269,9 @@ vicinity of DIRECTORY."
           (string-append directory "/" file))
          (else file))))
 
-(define-syntax-rule (local-file file rest ...)
-  "Return an object representing local file FILE to add to the store; this
+(define-syntax local-file
+  (lambda (s)
+    "Return an object representing local file FILE to add to the store; this
 object can be used in a gexp.  If FILE is a relative file name, it is looked
 up relative to the source file where this form appears.  FILE will be added to
 the store under NAME--by default the base name of FILE.
@@ -283,10 +284,23 @@ When RECURSIVE? is true, call (SELECT?  FILE STAT) for each directory entry,
 where FILE is the entry's absolute file name and STAT is the result of
 'lstat'; exclude entries for which SELECT? does not return true.
 
-This is the declarative counterpart of the 'interned-file' monadic procedure."
-  (%local-file file
-               (delay (absolute-file-name file (current-source-directory)))
-               rest ...))
+This is the declarative counterpart of the 'interned-file' monadic procedure.
+It is implemented as a macro to capture the current source directory where it
+appears."
+    (syntax-case s ()
+      ((_ file rest ...)
+       #'(%local-file file
+                      (delay (absolute-file-name file (current-source-directory)))
+                      rest ...))
+      ((_)
+       #'(syntax-error "missing file name"))
+      (id
+       (identifier? #'id)
+       ;; XXX: We could return #'(lambda (file . rest) ...).  However,
+       ;; (syntax-source #'id) is #f so (current-source-directory) would not
+       ;; work.  Thus, simply forbid this form.
+       #'(syntax-error
+          "'local-file' is a macro and cannot be used like this")))))
 
 (define (local-file-absolute-file-name file)
   "Return the absolute file name for FILE, a <local-file> instance.  A
@@ -706,15 +720,17 @@ references; otherwise, return only non-native references."
            (cons `(,thing ,output) result)
            result))
       (($ <gexp-input> (lst ...) output n?)
-       (if (eqv? native? n?)
-           (fold-right add-reference-inputs result
-                       ;; XXX: For now, automatically convert LST to a list of
-                       ;; gexp-inputs.
-                       (map (match-lambda
-                              ((? gexp-input? x) x)
-                              (x (%gexp-input x "out" (or n? native?))))
-                            lst))
-           result))
+       (fold-right add-reference-inputs result
+                   ;; XXX: For now, automatically convert LST to a list of
+                   ;; gexp-inputs.  Inherit N?.
+                   (map (match-lambda
+                          ((? gexp-input? x)
+                           (%gexp-input (gexp-input-thing x)
+                                        (gexp-input-output x)
+                                        n?))
+                          (x
+                           (%gexp-input x "out" n?)))
+                        lst)))
       (_
        ;; Ignore references to other kinds of objects.
        result)))
diff --git a/guix/licenses.scm b/guix/licenses.scm
index 1bed56af20..b7dadd9750 100644
--- a/guix/licenses.scm
+++ b/guix/licenses.scm
@@ -12,6 +12,7 @@
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 Petter <petter@mykolab.ch>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -67,6 +68,7 @@
             lppl1.3a lppl1.3a+
             lppl1.3b lppl1.3b+
             lppl1.3c lppl1.3c+
+            miros
             mpl1.0 mpl1.1 mpl2.0
             ms-pl
             ncsa
@@ -452,6 +454,11 @@ at URI, which may be a file:// URI pointing the package's tree."
            "https://www.latex-project.org/lppl/lppl-1-3c/"
            "LaTeX Project Public License 1.3c or later"))
 
+(define miros
+  (license "MirOS"
+           "https://www.mirbsd.org/MirOS-Licence.htm"
+           "MirOS License"))
+
 (define mpl1.0
   (license "MPL 1.0"
            "http://www.mozilla.org/MPL/1.0/"
diff --git a/guix/profiles.scm b/guix/profiles.scm
index 85c1722d62..b3732f61ed 100644
--- a/guix/profiles.scm
+++ b/guix/profiles.scm
@@ -1313,40 +1313,6 @@ are cross-built for TARGET."
 (define (generation-numbers profile)
   "Return the sorted list of generation numbers of PROFILE, or '(0) if no
 former profiles were found."
-  (define* (scandir name #:optional (select? (const #t))
-                    (entry<? (@ (ice-9 i18n) string-locale<?)))
-    ;; XXX: Bug-fix version introduced in Guile v2.0.6-62-g139ce19.
-    (define (enter? dir stat result)
-      (and stat (string=? dir name)))
-
-    (define (visit basename result)
-      (if (select? basename)
-          (cons basename result)
-          result))
-
-    (define (leaf name stat result)
-      (and result
-           (visit (basename name) result)))
-
-    (define (down name stat result)
-      (visit "." '()))
-
-    (define (up name stat result)
-      (visit ".." result))
-
-    (define (skip name stat result)
-      ;; All the sub-directories are skipped.
-      (visit (basename name) result))
-
-    (define (error name* stat errno result)
-      (if (string=? name name*)             ; top-level NAME is unreadable
-          result
-          (visit (basename name*) result)))
-
-    (and=> (file-system-fold enter? leaf down up skip error #f name lstat)
-           (lambda (files)
-             (sort files entry<?))))
-
   (match (scandir (dirname profile)
                   (cute regexp-exec (profile-regexp profile) <>))
     (#f                                         ; no profile directory
diff --git a/guix/scripts/environment.scm b/guix/scripts/environment.scm
index 0abc509a35..95ba199d97 100644
--- a/guix/scripts/environment.scm
+++ b/guix/scripts/environment.scm
@@ -313,9 +313,7 @@ in OPTS."
                            #:dry-run? dry-run?)
       (if dry-run?
           (return #f)
-          (mbegin %store-monad
-            (set-build-options-from-command-line* opts)
-            (built-derivations derivations))))))
+          (built-derivations derivations)))))
 
 (define (inputs->profile-derivation inputs system bootstrap?)
   "Return the derivation for a profile consisting of INPUTS for SYSTEM.
@@ -580,6 +578,8 @@ message if any test fails."
       (when container? (assert-container-features))
 
       (with-store store
+        (set-build-options-from-command-line store opts)
+
         ;; Use the bootstrap Guile when requested.
         (parameterize ((%graft? (assoc-ref opts 'graft?))
                        (%guile-for-build
@@ -588,7 +588,6 @@ message if any test fails."
                          (if bootstrap?
                              %bootstrap-guile
                              (canonical-package guile-2.0)))))
-          (set-build-options-from-command-line store opts)
           (run-with-store store
             ;; Containers need a Bourne shell at /bin/sh.
             (mlet* %store-monad ((bash       (environment-bash container?
diff --git a/guix/scripts/package.scm b/guix/scripts/package.scm
index 58da3113a0..8da7a3fd3a 100644
--- a/guix/scripts/package.scm
+++ b/guix/scripts/package.scm
@@ -84,12 +84,16 @@
   "If PROFILE is %USER-PROFILE-DIRECTORY, return %CURRENT-PROFILE.  Otherwise
 return PROFILE unchanged.  The goal is to treat '-p ~/.guix-profile' as if
 '-p' was omitted."                           ; see <http://bugs.gnu.org/17939>
-  (if (and %user-profile-directory
-           (string=? (canonicalize-path (dirname profile))
-                     (dirname %user-profile-directory))
-           (string=? (basename profile) (basename %user-profile-directory)))
-      %current-profile
-      profile))
+
+  ;; Trim trailing slashes so that the basename comparison below works as
+  ;; intended.
+  (let ((profile (string-trim-right profile #\/)))
+    (if (and %user-profile-directory
+             (string=? (canonicalize-path (dirname profile))
+                       (dirname %user-profile-directory))
+             (string=? (basename profile) (basename %user-profile-directory)))
+        %current-profile
+        profile)))
 
 (define (user-friendly-profile profile)
   "Return either ~/.guix-profile if that's what PROFILE refers to, directly or
@@ -709,9 +713,12 @@ processed, #f otherwise."
                (raise (condition (&profile-not-found-error
                                   (profile profile)))))
               ((string-null? pattern)
-               (list-generation display-profile-content
-                                (car (profile-generations profile)))
-               (diff-profiles profile (profile-generations profile)))
+               (match (profile-generations profile)
+                 (()
+                  #t)
+                 ((first rest ...)
+                  (list-generation display-profile-content first)
+                  (diff-profiles profile (cons first rest)))))
               ((matching-generations pattern profile)
                =>
                (lambda (numbers)
diff --git a/guix/scripts/publish.scm b/guix/scripts/publish.scm
index a7e3e6d629..ade3c49a54 100644
--- a/guix/scripts/publish.scm
+++ b/guix/scripts/publish.scm
@@ -385,6 +385,24 @@ at a time."
                     (string-suffix? ".narinfo" file)))
       '()))
 
+(define (nar-expiration-time ttl)
+  "Return the narinfo expiration time (in seconds since the Epoch).  The
+expiration time is +inf.0 when passed an item that is still in the store; in
+other cases, it is the last-access time of the item plus TTL.
+
+This policy allows us to keep cached nars that correspond to valid store
+items.  Failing that, we could eventually have to recompute them and return
+404 in the meantime."
+  (let ((expiration-time (file-expiration-time ttl)))
+    (lambda (file)
+      (let ((item (string-append (%store-prefix) "/"
+                                 (basename file ".narinfo"))))
+        ;; Note: We don't need to use 'valid-path?' here because FILE would
+        ;; not exist if ITEM were not valid in the first place.
+        (if (file-exists? item)
+            +inf.0
+            (expiration-time file))))))
+
 (define* (render-narinfo/cached store request hash
                                 #:key ttl (compression %no-compression)
                                 (nar-path "nar")
@@ -417,7 +435,8 @@ requested using POOL."
                      (display (call-with-input-file cached
                                 read-string)
                               port))))
-          ((valid-path? store item)
+          ((and (file-exists? item)        ;cheaper than the 'valid-path?' RPC
+                (valid-path? store item))
            ;; Nothing in cache: bake the narinfo and nar in the background and
            ;; return 404.
            (eventually pool
@@ -435,7 +454,7 @@ requested using POOL."
                  (maybe-remove-expired-cache-entries cache
                                                      narinfo-files
                                                      #:entry-expiration
-                                                     (file-expiration-time ttl)
+                                                     (nar-expiration-time ttl)
                                                      #:delete-entry delete-entry
                                                      #:cleanup-period ttl))))
            (not-found request
@@ -565,13 +584,13 @@ has the given HASH of type ALGO."
                                " speaking.  Welcome!")))
                          port)))))
 
-(define extract-narinfo-hash
-  (let ((regexp (make-regexp "^([a-df-np-sv-z0-9]{32}).narinfo$")))
-    (lambda (str)
-      "Return the hash within the narinfo resource string STR, or false if STR
+(define (extract-narinfo-hash str)
+  "Return the hash within the narinfo resource string STR, or false if STR
 is invalid."
-      (and=> (regexp-exec regexp str)
-             (cut match:substring <> 1)))))
+  (and (string-suffix? ".narinfo" str)
+       (let ((base (string-drop-right str 8)))
+         (and (string-every %nix-base32-charset base)
+              base))))
 
 (define (get-request? request)
   "Return #t if REQUEST uses the GET method."
diff --git a/guix/scripts/size.scm b/guix/scripts/size.scm
index 52f7cdd972..1e54d3f218 100644
--- a/guix/scripts/size.scm
+++ b/guix/scripts/size.scm
@@ -77,8 +77,22 @@ if ITEM is not in the store."
              (leave (G_ "no available substitute information for '~a'~%")
                     item)))))))
 
-(define* (display-profile profile #:optional (port (current-output-port)))
-  "Display PROFILE, a list of PROFILE objects, to PORT."
+(define profile-closure<?
+  (match-lambda*
+    ((($ <profile> name1 self1 total1)
+      ($ <profile> name2 self2 total2))
+     (< total1 total2))))
+
+(define profile-self<?
+  (match-lambda*
+    ((($ <profile> name1 self1 total1)
+      ($ <profile> name2 self2 total2))
+     (< self1 self2))))
+
+(define* (display-profile profile #:optional (port (current-output-port))
+                          #:key (profile<? profile-closure<?))
+  "Display PROFILE, a list of PROFILE objects, to PORT.  Sort entries
+according to PROFILE<?."
   (define MiB (expt 2 20))
 
   (format port "~64a ~8a ~a\n"
@@ -89,11 +103,7 @@ if ITEM is not in the store."
                  (format port "~64a  ~6,1f  ~6,1f ~5,1f%\n"
                          name (/ total MiB) (/ self MiB)
                          (* 100. (/ self whole 1.)))))
-              (sort profile
-                    (match-lambda*
-                      ((($ <profile> name1 self1 total1)
-                        ($ <profile> name2 self2 total2))
-                       (> total1 total2)))))
+              (sort profile (negate profile<?)))
     (format port (G_ "total: ~,1f MiB~%") (/ whole MiB 1.))))
 
 (define display-profile*
@@ -224,6 +234,9 @@ Report the size of PACKAGE and its dependencies.\n"))
                          fetch substitute from URLS if they are authorized"))
   (display (G_ "
   -s, --system=SYSTEM    consider packages for SYSTEM--e.g., \"i686-linux\""))
+  ;; TRANSLATORS: "closure" and "self" must not be translated.
+  (display (G_ "
+      --sort=KEY         sort according to KEY--\"closure\" or \"self\""))
   (display (G_ "
   -m, --map-file=FILE    write to FILE a graphical map of disk usage"))
   (newline)
@@ -247,6 +260,15 @@ Report the size of PACKAGE and its dependencies.\n"))
                                      (string-tokenize arg)
                                      (alist-delete 'substitute-urls result))
                          rest)))
+        (option '("sort") #t #f
+                (lambda (opt name arg result . rest)
+                  (match arg
+                    ("closure"
+                     (alist-cons 'profile<? profile-closure<? result))
+                    ("self"
+                     (alist-cons 'profile<? profile-self<? result))
+                    (_
+                     (leave (G_ "~a: invalid sorting key~%") arg)))))
         (option '(#\m "map-file") #t #f
                 (lambda (opt name arg result)
                   (alist-cons 'map-file arg result)))
@@ -259,7 +281,8 @@ Report the size of PACKAGE and its dependencies.\n"))
                   (show-version-and-exit "guix size")))))
 
 (define %default-options
-  `((system . ,(%current-system))))
+  `((system . ,(%current-system))
+    (profile<? . ,profile-closure<?)))
 
 
 ;;;
@@ -273,6 +296,7 @@ Report the size of PACKAGE and its dependencies.\n"))
                                    (('argument . file) file)
                                    (_ #f))
                                  opts))
+           (profile<? (assoc-ref opts 'profile<?))
            (map-file (assoc-ref opts 'map-file))
            (system   (assoc-ref opts 'system))
            (urls     (assoc-ref opts 'substitute-urls)))
@@ -298,5 +322,6 @@ Report the size of PACKAGE and its dependencies.\n"))
                       (begin
                         (profile->page-map profile map-file)
                         (return #t))
-                      (display-profile* profile)))
+                      (display-profile* profile (current-output-port)
+                                        #:profile<? profile<?)))
                 #:system system)))))))))
diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
index 71f30030b6..35282f9027 100755
--- a/guix/scripts/substitute.scm
+++ b/guix/scripts/substitute.scm
@@ -47,6 +47,7 @@
   #:use-module (ice-9 format)
   #:use-module (ice-9 ftw)
   #:use-module (ice-9 binary-ports)
+  #:use-module (ice-9 vlist)
   #:use-module (rnrs bytevectors)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-9)
@@ -96,6 +97,13 @@
 ;;;
 ;;; Code:
 
+(cond-expand
+  (guile-2.2
+   ;; Guile 2.2.2 has a bug whereby 'time-monotonic' objects have seconds and
+   ;; nanoseconds swapped (fixed in Guile commit 886ac3e).  Work around it.
+   (define time-monotonic time-tai))
+  (else #t))
+
 (define %narinfo-cache-directory
   ;; A local cache of narinfos, to avoid going to the network.  Most of the
   ;; time, 'guix substitute' is called by guix-daemon as root and stores its
@@ -593,15 +601,27 @@ if file doesn't exist, and the narinfo otherwise."
 (define (fetch-narinfos url paths)
   "Retrieve all the narinfos for PATHS from the cache at URL and return them."
   (define update-progress!
-    (let ((done 0))
+    (let ((done 0)
+          (total (length paths)))
       (lambda ()
         (display #\cr (current-error-port))
         (force-output (current-error-port))
         (format (current-error-port)
                 (G_ "updating list of substitutes from '~a'... ~5,1f%")
-                url (* 100. (/ done (length paths))))
+                url (* 100. (/ done total)))
         (set! done (+ 1 done)))))
 
+  (define hash-part->path
+    (let ((mapping (fold (lambda (path result)
+                           (vhash-cons (store-path-hash-part path) path
+                                       result))
+                         vlist-null
+                         paths)))
+      (lambda (hash)
+        (match (vhash-assoc hash mapping)
+          (#f #f)
+          ((_ . path) path)))))
+
   (define (handle-narinfo-response request response port result)
     (let* ((code   (response-code response))
            (len    (response-content-length response))
@@ -620,9 +640,7 @@ if file doesn't exist, and the narinfo otherwise."
             (if len
                 (get-bytevector-n port len)
                 (read-to-eof port))
-            (cache-narinfo! url
-                            (find (cut string-contains <> hash-part) paths)
-                            #f
+            (cache-narinfo! url (hash-part->path hash-part) #f
                             (if (= 404 code)
                                 ttl
                                 %narinfo-transient-error-ttl))
diff --git a/guix/scripts/system.scm b/guix/scripts/system.scm
index 65dd92e8b7..0fcb6a9b0f 100644
--- a/guix/scripts/system.scm
+++ b/guix/scripts/system.scm
@@ -579,8 +579,12 @@ PATTERN, a string.  When PATTERN is #f, display all the system generations."
                                                 (* 70 (expt 2 20)))
                                             #:mappings mappings))
     ((disk-image)
-     (system-disk-image os #:disk-image-size image-size
-                           #:file-system-type file-system-type))))
+     (system-disk-image os
+                        #:name (match file-system-type
+                                 ("iso9660" "image.iso")
+                                 (_         "disk-image"))
+                        #:disk-image-size image-size
+                        #:file-system-type file-system-type))))
 
 (define (maybe-suggest-running-guix-pull)
   "Suggest running 'guix pull' if this has never been done before."
diff --git a/guix/store.scm b/guix/store.scm
index a207d478e6..2563d26fa0 100644
--- a/guix/store.scm
+++ b/guix/store.scm
@@ -897,6 +897,7 @@ path."
                           #:key (select? true))
            ;; We don't use the 'operation' macro so we can pass SELECT? to
            ;; 'write-file'.
+           (record-operation 'add-to-store)
            (let ((port (nix-server-socket server)))
              (write-int (operation-id add-to-store) port)
              (write-string basename port)
@@ -1548,9 +1549,12 @@ valid inputs."
 (define (store-path-hash-part path)
   "Return the hash part of PATH as a base32 string, or #f if PATH is not a
 syntactically valid store path."
-  (let ((path-rx (store-regexp* (%store-prefix))))
-    (and=> (regexp-exec path-rx path)
-           (cut match:substring <> 1))))
+  (and (string-prefix? (%store-prefix) path)
+       (let ((base (string-drop path (+ 1 (string-length (%store-prefix))))))
+         (and (> (string-length base) 33)
+              (let ((hash (string-take base 32)))
+                (and (string-every %nix-base32-charset hash)
+                     hash))))))
 
 (define (log-file store file)
   "Return the build log file for FILE, or #f if none could be found.  FILE
diff --git a/nix/nix-daemon/nix-daemon.cc b/nix/nix-daemon/nix-daemon.cc
index 7d26b61354..deb7003d7e 100644
--- a/nix/nix-daemon/nix-daemon.cc
+++ b/nix/nix-daemon/nix-daemon.cc
@@ -436,7 +436,15 @@ static void performOp(bool trusted, unsigned int clientVersion,
         bool sign = readInt(from) == 1;
         startWork();
         TunnelSink sink(to);
-        store->exportPath(path, sign, sink);
+	try {
+	    store->exportPath(path, sign, sink);
+	}
+	catch (Error &e) {
+	    /* Flush SINK beforehand or its destructor will rightfully trigger
+	       an assertion failure.  */
+	    sink.flush();
+	    throw e;
+	}
         sink.flush();
         stopWork();
         writeInt(1, to);
diff --git a/po/packages/POTFILES.in b/po/packages/POTFILES.in
index 1eafdcb4b8..32d34d6456 100644
--- a/po/packages/POTFILES.in
+++ b/po/packages/POTFILES.in
@@ -40,7 +40,6 @@ gnu/packages/pdf.scm
 gnu/packages/pem.scm
 gnu/packages/perl.scm
 gnu/packages/photo.scm
-gnu/packages/qemu.scm
 gnu/packages/ratpoison.scm
 gnu/packages/readline.scm
 gnu/packages/scanner.scm
@@ -53,6 +52,7 @@ gnu/packages/tex.scm
 gnu/packages/texinfo.scm
 gnu/packages/textutils.scm
 gnu/packages/version-control.scm
+gnu/packages/virtualization.scm
 gnu/packages/webkit.scm
 gnu/packages/web.scm
 gnu/packages/wordnet.scm
diff --git a/tests/gexp.scm b/tests/gexp.scm
index cf88a9db80..5873abdd41 100644
--- a/tests/gexp.scm
+++ b/tests/gexp.scm
@@ -355,6 +355,14 @@
          (equal? (gexp->sexp* exp)                ;native
                  (gexp->sexp* exp "mips64el-linux")))))
 
+(test-assert "gexp list splicing + ungexp-splicing"
+  (let* ((inner (gexp (ungexp-native glibc)))
+         (exp   (gexp (list (ungexp-splicing (list inner))))))
+    (and (equal? `((,glibc "out")) (gexp-native-inputs exp))
+         (null? (gexp-inputs exp))
+         (equal? (gexp->sexp* exp)                ;native
+                 (gexp->sexp* exp "mips64el-linux")))))
+
 (test-equal "output list"
   2
   (let ((exp (gexp (begin (mkdir (ungexp output))
diff --git a/tests/syscalls.scm b/tests/syscalls.scm
index 8c048e6109..2b5c4c3be1 100644
--- a/tests/syscalls.scm
+++ b/tests/syscalls.scm
@@ -361,6 +361,16 @@
          (lambda args
            (system-error-errno args)))))
 
+(test-equal "loopback-network-interface-running?"
+  ENODEV
+  (and (network-interface-running? "lo")
+       (catch 'system-error
+         (lambda ()
+           (network-interface-running? "nonexistent")
+           #f)
+         (lambda args
+           (system-error-errno args)))))
+
 (test-skip (if (zero? (getuid)) 1 0))
 (test-assert "set-network-interface-flags"
   (let ((sock (socket AF_INET SOCK_STREAM 0)))