Merge branch 'master' into core-updates

39 files changed, 1463 insertions, 448 deletions

diff --git a/gnu/local.mk b/gnu/local.mk
index df86b94e86..adccab313e 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -301,6 +301,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/pumpio.scm			\
   %D%/packages/pretty-print.scm			\
   %D%/packages/protobuf.scm			\
+  %D%/packages/psyc.scm                         \
   %D%/packages/pv.scm				\
   %D%/packages/python.scm			\
   %D%/packages/qemu.scm				\
@@ -593,7 +594,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/hdf-eos5-fix-szip.patch			\
   %D%/packages/patches/hdf-eos5-fortrantests.patch		\
   %D%/packages/patches/higan-remove-march-native-flag.patch	\
-  %D%/packages/patches/hop-bigloo-4.0b.patch			\
   %D%/packages/patches/hop-linker-flags.patch			\
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
   %D%/packages/patches/hypre-doc-tables.patch			\
@@ -619,7 +619,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/kobodeluxe-graphics-window-signed-char.patch	\
   %D%/packages/patches/laby-make-install.patch			\
   %D%/packages/patches/ldc-disable-tests.patch			\
-  %D%/packages/patches/lftp-dont-save-unknown-host-fingerprint.patch \
   %D%/packages/patches/liba52-enable-pic.patch			\
   %D%/packages/patches/liba52-link-with-libm.patch		\
   %D%/packages/patches/liba52-set-soname.patch			\
@@ -672,6 +671,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libwmf-CVE-2015-4696.patch		\
   %D%/packages/patches/libxslt-generated-ids.patch		\
   %D%/packages/patches/linux-pam-no-setfsuid.patch		\
+  %D%/packages/patches/linux-libre-4.1-CVE-2016-5195.patch	\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/llvm-for-extempore.patch			\
   %D%/packages/patches/lm-sensors-hwmon-attrs.patch		\
@@ -713,6 +713,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ninja-tests.patch			\
   %D%/packages/patches/ninja-zero-mtime.patch			\
   %D%/packages/patches/node-9077.patch				\
+  %D%/packages/patches/notmuch-emacs-25-compatibility-fix.patch	\
   %D%/packages/patches/nss-pkgconfig.patch			\
   %D%/packages/patches/nvi-assume-preserve-path.patch		\
   %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
@@ -725,6 +726,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/openjpeg-CVE-2016-5157.patch		\
   %D%/packages/patches/openjpeg-CVE-2016-7163.patch		\
   %D%/packages/patches/openjpeg-use-after-free-fix.patch	\
+  %D%/packages/patches/openssh-memory-exhaustion.patch		\
   %D%/packages/patches/openssl-runpath.patch			\
   %D%/packages/patches/openssl-1.1.0-c-rehash-in.patch		\
   %D%/packages/patches/openssl-c-rehash-in.patch		\
@@ -815,6 +817,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/slim-session.patch			\
   %D%/packages/patches/slim-config.patch			\
   %D%/packages/patches/slim-sigusr1.patch			\
+  %D%/packages/patches/slim-reset.patch				\
+  %D%/packages/patches/slim-login.patch				\
   %D%/packages/patches/slock-CVE-2016-6866.patch		\
   %D%/packages/patches/slurm-configure-remove-nonfree-contribs.patch \
   %D%/packages/patches/soprano-find-clucene.patch		\
diff --git a/gnu/packages/algebra.scm b/gnu/packages/algebra.scm
index 32f23597ae..8e9695da51 100644
--- a/gnu/packages/algebra.scm
+++ b/gnu/packages/algebra.scm
@@ -202,7 +202,7 @@ GP2C, the GP to C compiler, translates GP scripts to PARI programs.")
 (define-public giac-xcas
   (package
     (name "giac-xcas")
-    (version "1.2.2-81")
+    (version "1.2.2-95")
     (source (origin
               (method url-fetch)
               ;; "~parisse/giac" is not used because the maintainer regularly
@@ -214,7 +214,7 @@ GP2C, the GP to C compiler, translates GP scripts to PARI programs.")
                                   "source/giac_" version ".tar.gz"))
               (sha256
                (base32
-                "0jwlx8b97zkly9gcbdfbj4mzyn21dbg1kgpw7j7vqs380jryzgfs"))))
+                "1zyaz5pgj7w6ka4qxic4kmbcqcikpn8ry3jvhi2kd72hwa0v65y2"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index 811da498cc..db32b6f1ae 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -351,8 +351,24 @@ tools (analyzer, mono/stereo tools, crossovers).")
                (base32
                 "0qm3ak07vc1l3f5c3c2lq9gkfknlxwn8ks03cysw1pk8hj7dwnv6"))))
     (build-system cmake-build-system)
-    ;; There are no tests
-    (arguments `(#:tests? #f))
+    (arguments
+     `(#:tests? #f ; There are no tests
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'remove-compiler-flags
+           (lambda _
+             (substitute* '("src/casynth/CMakeLists.txt"
+                            "src/cheapdist/CMakeLists.txt"
+                            "src/duffer/CMakeLists.txt"
+                            "src/envfollower/CMakeLists.txt"
+                            "src/ewham/CMakeLists.txt"
+                            "src/hip2b/CMakeLists.txt"
+                            "src/lushlife/CMakeLists.txt"
+                            "src/powercut/CMakeLists.txt"
+                            "src/powerup/CMakeLists.txt"
+                            "src/stuck/CMakeLists.txt")
+                          (("-msse2 -mfpmath=sse") ""))
+             #t)))))
     (inputs
      `(("cairo" ,cairo)
        ("fftwf" ,fftwf)
@@ -965,6 +981,16 @@ from a simple noise gate to modulation effects like flanger, phaser or
 auto-wah.")
     (license license:gpl2+)))
 
+(define-public guitarix-lv2
+  (package (inherit guitarix)
+    (name "guitarix-lv2")
+    (arguments
+     (substitute-keyword-arguments (package-arguments guitarix)
+       ((#:configure-flags flags)
+        `(cons "--lv2-only" ,flags))))
+    (inputs
+     (alist-delete "webkitgtk/gtk+-2" (package-inputs guitarix)))))
+
 (define-public rakarrack
   (package
     (name "rakarrack")
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index ffd7ef4c3e..a617bae7ea 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -419,7 +419,10 @@ detection, and lossless compression.")
                   delete-file (find-files "borg" "^(c|h|p).*\\.c$")))))
     (build-system python-build-system)
     (arguments
-     `(#:phases
+     `(#:modules ((srfi srfi-26) ; for cut
+                  (guix build utils)
+                  (guix build python-build-system))
+       #:phases
        (modify-phases %standard-phases
          (add-after 'unpack 'set-env
            (lambda* (#:key inputs #:allow-other-keys)
@@ -452,7 +455,12 @@ detection, and lossless compression.")
          (add-after 'install 'install-doc
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out (assoc-ref outputs "out"))
-                    (man (string-append out "/share/man/man1")))
+                    (man (string-append out "/share/man/man1"))
+                    (misc (string-append out "/share/borg/misc")))
+               (for-each (cut install-file <> misc)
+                         '("docs/misc/create_chunker-params.txt"
+                           "docs/misc/internals-picture.txt"
+                           "docs/misc/prune-example.txt"))
                (and
                  (zero? (system* "python3" "setup.py" "build_ext" "--inplace"))
                  (zero? (system* "make" "-C" "docs" "man"))
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 3fe7b5f3ae..d0b8056179 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -5936,6 +5936,54 @@ Bioconductor PDF and HTML documents.  Package vignettes illustrate use and
 functionality.")
     (license license:artistic2.0)))
 
+(define-public r-bioccheck
+  (package
+    (name "r-bioccheck")
+    (version "1.10.0")
+    (source (origin
+              (method url-fetch)
+              (uri (bioconductor-uri "BiocCheck" version))
+              (sha256
+               (base32
+                "1rfy37xg1nc2cmgbclvzsi7sgmdcdjiahsx9crgx3yaw7kxgiack"))))
+    (properties
+     `((upstream-name . "BiocCheck")))
+    (build-system r-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         ;; This package can be used by calling BiocCheck(<package>) from
+         ;; within R, or by running R CMD BiocCheck <package>.  This phase
+         ;; makes sure the latter works.  For this to work, the BiocCheck
+         ;; script must be somewhere on the PATH (not the R bin directory).
+         (add-after 'install 'install-bioccheck-subcommand
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (dest-dir (string-append out "/bin"))
+                    (script-dir
+                     (string-append out "/site-library/BiocCheck/script/")))
+               (mkdir-p dest-dir)
+               (symlink (string-append script-dir "/checkBadDeps.R")
+                        (string-append dest-dir "/checkBadDeps.R"))
+               (symlink (string-append script-dir "/BiocCheck")
+                        (string-append dest-dir "/BiocCheck")))
+             #t)))))
+    (native-inputs
+     `(("which" ,which)))
+    (propagated-inputs
+     `(("r-graph" ,r-graph)
+       ("r-knitr" ,r-knitr)
+       ("r-httr" ,r-httr)
+       ("r-optparse" ,r-optparse)
+       ("r-devtools" ,r-devtools)
+       ("r-biocinstaller" ,r-biocinstaller)
+       ("r-biocviews" ,r-biocviews)))
+    (home-page "http://bioconductor.org/packages/BiocCheck")
+    (synopsis "Executes Bioconductor-specific package checks")
+    (description "This package contains tools to perform additional quality
+checks on R packages that are to be submitted to the Bioconductor repository.")
+    (license license:artistic2.0)))
+
 (define-public r-getopt
   (package
     (name "r-getopt")
diff --git a/gnu/packages/bittorrent.scm b/gnu/packages/bittorrent.scm
index b1daf02bf9..73ae70329b 100644
--- a/gnu/packages/bittorrent.scm
+++ b/gnu/packages/bittorrent.scm
@@ -207,7 +207,7 @@ interface, for the Transmission BitTorrent daemon.")
 (define-public aria2
   (package
     (name "aria2")
-    (version "1.27.1")
+    (version "1.28.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/tatsuhiro-t/aria2/"
@@ -215,7 +215,7 @@ interface, for the Transmission BitTorrent daemon.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "023g22yn91pnvv7jvx43gl4x5rszn31sc9crgkxgsb3067pjg5n0"))))
+                "1w3jblfxqg30n3ndh2wrbhbddcg92lrgcx438qiwzamrayjjb8g0"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags (list "--enable-libaria2"
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 6504641977..b6c8604a23 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -842,7 +842,7 @@ human-readable output.")
 (define-public lrzip
   (package
     (name "lrzip")
-    (version "0.630")
+    (version "0.631")
     (source
      (origin
        (method url-fetch)
@@ -850,7 +850,7 @@ human-readable output.")
              "http://ck.kolivas.org/apps/lrzip/lrzip-" version ".tar.bz2"))
        (sha256
         (base32
-         "01ykxliqw4cavx9f2gawxfa9wf52cjy1qx28cnkrh6i3lfzzcq94"))))
+         "0mb449vmmwpkalq732jdyginvql57nxyd31sszb108yps1lf448d"))))
     (build-system gnu-build-system)
     (native-inputs
      `(;; nasm is only required when building for 32-bit x86 platforms
diff --git a/gnu/packages/disk.scm b/gnu/packages/disk.scm
index e75eb081ed..4afd2c2df3 100644
--- a/gnu/packages/disk.scm
+++ b/gnu/packages/disk.scm
@@ -258,14 +258,14 @@ and can dramatically shorten the lifespan of the drive if left unchecked.")
 (define-public gparted
   (package
     (name "gparted")
-    (version "0.26.1")
+    (version "0.27.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://sourceforge/gparted/gparted/gparted-"
                            version "/gparted-" version ".tar.gz"))
        (sha256
-        (base32 "1h9d6x335wxpm49yphzm9n1hbh2hcg0p2rphv76mrvsss91bcm1g"))))
+        (base32 "1gg7k63jd6128mmzciwqmgixqhyqnninimaqyvjbx1hv0q6gd310"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ; Tests require a network connection.
diff --git a/gnu/packages/display-managers.scm b/gnu/packages/display-managers.scm
index 1371bb5f39..0eca94550b 100644
--- a/gnu/packages/display-managers.scm
+++ b/gnu/packages/display-managers.scm
@@ -199,6 +199,8 @@ create smooth, animated user interfaces.")
 	     (sha256
 	      (base32 "1pqhk22jb4aja4hkrm7rjgbgzjyh7i4zswdgf5nw862l2znzxpi1"))
              (patches (search-patches "slim-config.patch"
+                                      "slim-reset.patch"
+                                      "slim-login.patch"
                                       "slim-session.patch"
                                       "slim-sigusr1.patch"))))
     (build-system cmake-build-system)
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 6e9c181b21..10be825e68 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -1197,6 +1197,28 @@ and stored in memory.")
     (description "This package provides a modern list API library for Emacs.")
     (license license:gpl3+)))
 
+(define-public emacs-d-mode
+  (package
+    (name "emacs-d-mode")
+    (version "2.0.8")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/Emacs-D-Mode-Maintainers/Emacs-D-Mode/"
+                    "archive/" version ".tar.gz"))
+              (sha256
+               (base32
+                "0knpgi55jm09282aqf8pv55zillpnpzf9f4sgm6gwsmvxf17xaw0"))))
+    (build-system emacs-build-system)
+    (propagated-inputs
+     `(("emacs-undercover" ,emacs-undercover)))
+    (home-page "https://github.com/Emacs-D-Mode-Maintainers/Emacs-D-Mode")
+    (synopsis "Emacs major mode for editing D code")
+    (description "This package provides an Emacs major mode for highlighting
+code written in the D programming language.  This mode is currently known to
+work with Emacs 24 and 25.")
+    (license license:gpl2+)))
+
 (define-public emacs-undo-tree
   (package
     (name "emacs-undo-tree")
diff --git a/gnu/packages/ftp.scm b/gnu/packages/ftp.scm
index 4c2d893c17..a11265532a 100644
--- a/gnu/packages/ftp.scm
+++ b/gnu/packages/ftp.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2016 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,18 +34,16 @@
 (define-public lftp
   (package
     (name "lftp")
-    (version "4.6.1")
+    (version "4.7.3")
     (source (origin
               (method url-fetch)
-              (uri (list (string-append "http://lftp.yar.ru/ftp/lftp-"
+              (uri (list (string-append "https://lftp.yar.ru/ftp/lftp-"
                                         version ".tar.xz")
-                         (string-append "http://lftp.yar.ru/ftp/old/lftp-"
+                         (string-append "https://lftp.yar.ru/ftp/old/lftp-"
                                         version ".tar.xz")))
               (sha256
                (base32
-                "1grmp8zg7cjgjinz66mrh53whigkqzl90nlxj05hapnhk3ns3vni"))
-              (patches (search-patches
-                        "lftp-dont-save-unknown-host-fingerprint.patch"))))
+                "0z4flhqvq9w9md1348jdw0lnk0dlljyicz8597inl6jcvjf2a8iv"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -52,7 +51,19 @@
      `(("zlib" ,zlib)
        ("readline" ,readline)
        ("gnutls" ,gnutls)))
-    (home-page "http://lftp.yar.ru/")
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ;; Disable tests that require network access, which is most of them.
+         (add-before 'check 'disable-impure-tests
+                     (lambda _
+                       (substitute* "tests/Makefile"
+                         (("(ftp-cls-l|ftp-list|http-get)\\$\\(EXEEXT\\)") "")
+                         (("lftp-https-get ") "")))))
+       #:configure-flags
+       (list (string-append "--with-readline="
+                            (assoc-ref %build-inputs "readline")))))
+    (home-page "https://lftp.yar.ru/")
     (synopsis "Command-line file transfer program")
     (description
      "LFTP is a sophisticated FTP/HTTP client, and a file transfer program
@@ -89,18 +100,18 @@ reliability in mind.")
                      "free software"))))))
     (build-system gnu-build-system)
     (arguments
-     '(#:phases (alist-replace
-                 'configure
-                 (lambda* (#:key outputs #:allow-other-keys)
-                   ;; This is an old 'configure' script that doesn't
-                   ;; understand variables passed as arguments.
-                   (let ((out (assoc-ref outputs "out")))
-                     (setenv "CONFIG_SHELL" (which "sh"))
-                     (setenv "SHELL" (which "sh"))
-                     (zero? (system* "./configure"
-                                     (string-append "--prefix=" out)))))
-                 %standard-phases)
-       #:tests? #f))                              ;there are no tests
+     '(#:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+                  (lambda* (#:key outputs #:allow-other-keys)
+                    ;; This is an old 'configure' script that doesn't
+                    ;; understand variables passed as arguments.
+                    (let ((out (assoc-ref outputs "out")))
+                      (setenv "CONFIG_SHELL" (which "sh"))
+                      (setenv "SHELL" (which "sh"))
+                      (zero? (system* "./configure"
+                                      (string-append "--prefix=" out)))))))
+                #:tests? #f))           ;there are no tests
     (inputs `(("ncurses" ,ncurses)))
     (home-page "http://www.ncftp.com/ncftp/")
     (synopsis "Command-line File Transfer Protocol (FTP) client")
@@ -128,18 +139,18 @@ FTP browser, as well as non-interactive commands such as 'ncftpput' and
         (patches (search-patches "weex-vacopy.patch"))))
     (build-system gnu-build-system)
     (arguments
-      `(#:phases
-        (alist-replace 'configure
-          ;; configure does not work followed by both "SHELL=..." and
-          ;; "CONFIG_SHELL=..."; set environment variables instead
-          (lambda* (#:key outputs #:allow-other-keys)
-            (let* ((out (assoc-ref outputs "out"))
-                  (bash (which "bash")))
-              (setenv "SHELL" bash)
-              (setenv "CONFIG_SHELL" bash)
-              (zero? (system* bash "./configure"
-                              (string-append "--prefix=" out)))))
-          %standard-phases)))
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+                  ;; configure does not work followed by both "SHELL=..." and
+                  ;; "CONFIG_SHELL=..."; set environment variables instead
+                  (lambda* (#:key outputs #:allow-other-keys)
+                    (let* ((out (assoc-ref outputs "out"))
+                           (bash (which "bash")))
+                      (setenv "SHELL" bash)
+                      (setenv "CONFIG_SHELL" bash)
+                      (zero? (system* bash "./configure"
+                                      (string-append "--prefix=" out)))))))))
     (home-page "http://weex.sourceforge.net/")
     (synopsis "Non-interactive client for FTP synchronization")
     (description
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index 259e616ab2..bffbe14647 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -970,6 +970,81 @@ This game is based on the GPL version of the famous game TuxRacer.")
     (home-page "http://sourceforge.net/projects/extremetuxracer/")
     (license license:gpl2+)))
 
+(define-public supertuxkart
+  (package
+    (name "supertuxkart")
+    (version "0.9.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://sourceforge/supertuxkart/SuperTuxKart/"
+                           version "/supertuxkart-" version "-src.tar.xz"))
+       (sha256
+        (base32
+         "10l2ljmd7mv8f9ylarqmxxryicdnph2qkm3g5maxnsm2k2q0n20b"))
+       (modules '((guix build utils)))
+       (snippet
+        ;; Delete bundled library sources
+        '(begin
+           ;; FIXME: try to unbundle enet, and angelscript
+           (for-each delete-file-recursively
+                     '("lib/zlib"
+                       "lib/libpng"
+                       "lib/jpeglib"
+                       "lib/glew"
+                       "lib/wiiuse"))
+           (substitute* "CMakeLists.txt"
+             ;; Supertuxkart uses modified versions of the Irrlicht engine
+             ;; and the bullet library.  The developers gave an explanation here:
+             ;; http://forum.freegamedev.net/viewtopic.php?f=17&t=3906
+             (("add_subdirectory\\(.*/(glew|zlib)\"\\)") ""))
+           #t))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:tests? #f ; no check target
+       #:configure-flags
+       (list "-DUSE_WIIUSE=0"
+             ;; Do not use the bundled zlib
+             "-DNO_IRR_COMPILE_WITH_ZLIB_=TRUE"
+             ;; Irrlicht returns an integer instead of a boolean
+             "-DCMAKE_C_FLAGS=-fpermissive")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'unbundle
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "CMakeLists.txt"
+               (("glew")
+                (string-append (assoc-ref inputs "glew")
+                               "/lib/libGLEW.a"))
+               (("include_directories\\(\"\\$\\{PROJECT_SOURCE_DIR\\}/lib/glew/include\"\\)")
+                (string-append "include_directories(\""
+                               (assoc-ref inputs "glew")
+                               "/include\")")))
+             #t)))))
+    (inputs
+     `(("glew" ,glew)
+       ("zlib" ,zlib)
+       ("openal" ,openal)
+       ("libvorbis" ,libvorbis)
+       ("freetype" ,freetype)
+       ("fribidi" ,fribidi)
+       ("mesa" ,mesa)
+       ("libx11" ,libx11)
+       ("libxrandr" ,libxrandr)
+       ("curl" ,curl)
+       ;; The following input is needed to build the bundled and modified
+       ;; version of irrlicht.
+       ("libjpeg" ,libjpeg)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "http://supertuxkart.net")
+    (synopsis "3D kart racing game")
+    (description "SuperTuxKart is a 3D kart racing game, with a focus on
+having fun over realism.  You can play with up to 4 friends on one PC, racing
+against each other or just trying to beat the computer; single-player mode is
+also available.")
+    (license license:gpl3+)))
+
 (define-public gnujump
   (package
     (name "gnujump")
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 85cf4c2139..10a77f001d 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -5622,3 +5622,67 @@ is suitable as a default application in a Desktop environment.")
 and customizable.  Xpad consists of independent pad windows, each is
 basically a text box in which notes can be written.")
     (license license:gpl3+)))
+
+(define-public gucharmap
+  (package
+    (name "gucharmap")
+    (version "3.18.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://gnome/sources/" name "/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0c1q9w5vql0vvg6g0knxfnv4ap19fg5cdrwndi1cj9lsym92c78j"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("desktop-file-utils" ,desktop-file-utils)
+       ("glib:bin" ,glib "bin") ; for glib-compile-resources.
+       ("gobject-introspection" ,gobject-introspection)
+       ("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("gtk+" ,gtk+)
+       ("xmllint" ,libxml2)))
+    (home-page "https://wiki.gnome.org/Apps/Gucharmap")
+    (synopsis "Unicode character picker and font browser")
+    (description
+     "This program allows you to browse through all the available Unicode
+characters and categories for the installed fonts, and to examine their
+detailed properties.  It is an easy way to find the character you might
+only know by its Unicode name or code point.")
+    (license license:gpl3+)))
+
+(define-public bluefish
+  (package
+    (name "bluefish")
+    (version "2.2.9")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://www.bennewitz.com/bluefish/stable/source/"
+                           name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1vnl6raxbvc4hacg3pr6sqyjh707d304dhk5nyhlp7m0m1y3j756"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("desktop-file-utils" ,desktop-file-utils)
+       ("intltool" ,intltool)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("enchant" ,enchant)
+       ("gtk+" ,gtk+)
+       ("python" ,python-2)
+       ("xmllint" ,libxml2)
+       ("gucharmap" ,gucharmap)))
+    (home-page "http://bluefish.openoffice.nl")
+    (synopsis "Web development studio")
+    (description
+     "Bluefish is an editor targeted towards programmers and web developers,
+with many options to write web sites, scripts and other code.
+Bluefish supports many programming and markup languages.")
+    (license license:gpl3+)))
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 9b81f69c5d..c38270afcb 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -200,7 +200,7 @@ sequential processes (CSP) concurrent programming features added.")
   (package
     (inherit go-1.4)
     (name "go")
-    (version "1.7.1")
+    (version "1.7.3")
     (source
      (origin
        (method url-fetch)
@@ -208,7 +208,7 @@ sequential processes (CSP) concurrent programming features added.")
                            name version ".src.tar.gz"))
        (sha256
         (base32
-         "1ls2shd8ha2dhigz8kf4j15p1l5rvfxn9jyh4rgrkdw17c9kz11b"))))
+         "0i7gy5d8j6186a6x07cnj3r7mpfg3964q8byslx0p6x04w00lhvr"))))
     (arguments
      (substitute-keyword-arguments (package-arguments go-1.4)
        ((#:phases phases)
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 691a7fe22e..21f37a10ff 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -401,22 +401,21 @@ many readers as needed).")
 (define-public guile-ncurses
   (package
     (name "guile-ncurses")
-    (version "1.7")
+    (version "2.0")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/guile-ncurses/guile-ncurses-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "153vv75gb7l62sp3666rc97i63rnaqbx2rjar7d9b5w81fhwv4r5"))))
+               "0avqa7iiqpw0wgj9ga5ffxka4znrhpx1bv3bb2ah7mnylap91sfw"))))
     (build-system gnu-build-system)
     (inputs `(("ncurses" ,ncurses)
               ("guile" ,guile-2.0)))
+    (native-inputs `(("pkg-config" ,pkg-config)))
     (arguments
      '(#:configure-flags (list "--with-ncursesw"  ; Unicode support
-                               (string-append "--with-guilesitedir="
-                                              (assoc-ref %outputs "out")
-                                              "/share/guile/site/2.0"))
+                               "--with-gnu-filesystem-hierarchy")
        #:phases
        (modify-phases %standard-phases
          (add-after 'install 'post-install
@@ -426,7 +425,7 @@ many readers as needed).")
                     (files (find-files dir ".scm")))
                (substitute* files
                  (("\"libguile-ncurses\"")
-                  (format #f "\"~a/lib/libguile-ncurses\""
+                  (format #f "\"~a/lib/guile/2.0/libguile-ncurses\""
                           out)))))))))
     (home-page "http://www.gnu.org/software/guile-ncurses/")
     (synopsis "Guile bindings to ncurses")
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 5017a21256..286708cb1d 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -770,15 +770,17 @@ convert, manipulate, filter and display a wide variety of image formats.")
 (define-public jasper
   (package
     (name "jasper")
-    (version "1.900.5")
+    (version "1.900.13")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.ece.uvic.ca/~frodo/jasper"
                                   "/software/jasper-" version ".tar.gz"))
               (sha256
                (base32
-                "1fvy4ngc6064g128q4484qpinsn05y9qw6lrccc4czhalla2w26m"))))
+                "0nmy5248gar057s94a30fssvq70m3jy4vdrfcispvn01ih33fa19"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:make-flags '("CFLAGS=-std=c99"))) ; 1.900.13 added c++ style comments
     (synopsis "JPEG-2000 library")
     (description "The JasPer Project is an initiative to provide a reference
 implementation of the codec specified in the JPEG-2000 Part-1 standard (i.e.,
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 53baa21fdd..0279e91464 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -219,7 +219,8 @@ for ARCH and optionally VARIANT, or #f if there is no such configuration."
                            (extra-version #f)
                            (configuration-file #f)
                            (defconfig "defconfig")
-                           (extra-options %default-extra-linux-options))
+                           (extra-options %default-extra-linux-options)
+                           (patches (list %boot-logo-patch)))
   (package
     (name (if extra-version
               (string-append "linux-libre-" extra-version)
@@ -229,7 +230,7 @@ for ARCH and optionally VARIANT, or #f if there is no such configuration."
               (method url-fetch)
               (uri (linux-libre-urls version))
               (sha256 (base32 hash))
-              (patches (list %boot-logo-patch))))
+              (patches patches)))
     (supported-systems supported-systems)
     (build-system gnu-build-system)
     (native-inputs
@@ -322,14 +323,14 @@ It has been modified to remove all non-free binary blobs.")
 (define %intel-compatible-systems '("x86_64-linux" "i686-linux"))
 
 (define-public linux-libre
-  (make-linux-libre "4.8.2"
-                    "111v014j9b2zgyhv8f0aka5lmyc3imdc5yag7azw6hv3vjqqkn67"
+  (make-linux-libre "4.8.4"
+                    "06fb2b1y7w0ixq4savn3hddp326mmzmg3400dpr8lyg919bwck3x"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.4
-  (make-linux-libre "4.4.25"
-                    "1a677h8vvjkbzqwnklqnjvhq33lwig5z453dwi125zzzvawgr463"
+  (make-linux-libre "4.4.27"
+                    "07g0y8zbspw8d65386llcsnqlbv2s24dxvvbwm9kwm87rk3vin1r"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
@@ -337,11 +338,14 @@ It has been modified to remove all non-free binary blobs.")
   (make-linux-libre "4.1.34"
                     "0dajsb363p9lgga22ml8gp9k9lxd8mvrzxk9y3h9c6hpzfcmqdqr"
                     %intel-compatible-systems
-                    #:configuration-file kernel-config))
+                    #:configuration-file kernel-config
+                    #:patches (list %boot-logo-patch
+                                    (search-patch
+                                     "linux-libre-4.1-CVE-2016-5195.patch"))))
 
 ;; Avoid rebuilding kernel variants when there is a minor version bump.
-(define %linux-libre-version "4.8.2")
-(define %linux-libre-hash "111v014j9b2zgyhv8f0aka5lmyc3imdc5yag7azw6hv3vjqqkn67")
+(define %linux-libre-version "4.8.4")
+(define %linux-libre-hash "06fb2b1y7w0ixq4savn3hddp326mmzmg3400dpr8lyg919bwck3x")
 
 (define-public linux-libre-arm-generic
   (make-linux-libre %linux-libre-version
@@ -2974,14 +2978,14 @@ the default @code{nsswitch} and the experimental @code{umich_ldap}.")
 (define-public mcelog
   (package
     (name "mcelog")
-    (version "142")
+    (version "143")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://git.kernel.org/cgit/utils/cpu/mce/"
                                   "mcelog.git/snapshot/v" version ".tar.gz"))
               (sha256
                (base32
-                "15a9hllwj32l1zh7x4swx8985x6nqrplvxjyfdsqysxw2pk6pixr"))
+                "1mn5i1d6ybfxqgr6smlpxcx1wb53h0r2rp90ild7919b9yqxpk0x"))
               (file-name (string-append name "-" version ".tar.gz"))
               (modules '((guix build utils)))
               (snippet
@@ -3040,3 +3044,28 @@ of flash storage.")
       (list license:gpl2 ; Almost everything is gpl2 or gpl2+
             license:mpl1.1 ; All ftl* files
             license:expat)))) ; libiniparser
+
+(define-public libseccomp
+  (package
+    (name "libseccomp")
+    (version "2.3.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/seccomp/libseccomp/"
+                                  "releases/download/v" version
+                                  "/libseccomp-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0asnlkzqms520r0dra08dzcz5hh6hs7lkajfw9wij3vrd0hxsnzz"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("which" ,which)))
+    (synopsis "Interface to Linux's seccomp syscall filtering mechanism")
+    (description "The libseccomp library provides an easy to use, platform
+independent, interface to the Linux Kernel's syscall filtering mechanism.  The
+libseccomp API is designed to abstract away the underlying BPF based syscall
+filter language and present a more conventional function-call based filtering
+interface that should be familiar to, and easily adopted by, application
+developers.")
+    (home-page "https://github.com/seccomp/libseccomp")
+    (license license:lgpl2.1)))
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index 0be0929e92..eee7d1831f 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -15,7 +15,7 @@
 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox.org>
 ;;; Copyright © 2016 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2016 Troy Sankey <sankeytms@gmail.com>
-;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
+;;; Copyright © 2016 ng0 <ngillmann@runbox.com>
 ;;; Copyright © 2016 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2016 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
@@ -76,7 +76,9 @@
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages gdb)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages samba)
+  #:use-module (gnu packages screen)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages networking)
   #:use-module (gnu packages web)
@@ -192,14 +194,14 @@ aliasing facilities to work just as they would on normal mail.")
 (define-public mutt
   (package
     (name "mutt")
-    (version "1.7.0")
+    (version "1.7.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp.mutt.org/pub/mutt/mutt-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "0idkamdiwj9fgqaz1vzkfg78cnmkzp74skv0ibw2xjfq6ds9hghx"))
+               "1pyns0xw52s4yma1a93pdcl4dirs55q2m1hd7w1r11nlhf7giip9"))
              (patches (search-patches "mutt-store-references.patch"))))
     (build-system gnu-build-system)
     (inputs
@@ -499,19 +501,27 @@ invoking @command{notifymuch} from the post-new hook.")
 (define-public notmuch
   (package
     (name "notmuch")
-    (version "0.22.1")
+    (version "0.23")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://notmuchmail.org/releases/notmuch-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0jwpda3q023dn3sp41n8648951i7iagfv8zzpriv7hpkjivlafg7"))))
+                "1f51l34rdhjf8lvafrwybkxdsdwx8k9397m7qxd8rdg2irjmpry5"))
+              (patches
+               ;; Remove this for the next release. See this thread for context:
+               ;; https://notmuchmail.org/pipermail/notmuch/2016/023227.html
+               (search-patches "notmuch-emacs-25-compatibility-fix.patch"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:tests? #f ; FIXME: 694 tests; 170 fail and 100 are skipped
-                   ; with perl input: 50 fail and 100 are skipped
+     '(#:make-flags (list "V=1") ; Verbose test output.
        #:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'patch-notmuch-lib.el
+                    (lambda _
+                      (substitute* "emacs/notmuch-lib.el"
+                        (("/bin/sh") (which "sh")))
+                      #t))
                   (replace 'configure
                     (lambda* (#:key outputs #:allow-other-keys)
                       (setenv "CC" "gcc")
@@ -519,21 +529,35 @@ invoking @command{notifymuch} from the post-new hook.")
 
                       (let ((out (assoc-ref outputs "out")))
                         (zero? (system* "./configure"
-                                        (string-append "--prefix=" out)))))))))
+                                        (string-append "--prefix=" out))))))
+                  (add-before 'check 'prepare-test-environment
+                    (lambda _
+                      (setenv "TEST_CC" "gcc")
+                      ;; Patch various inline shell invocations.
+                      (substitute* (find-files "test" "\\.sh$")
+                        (("/bin/sh") (which "sh")))
+                      #t)))))
     (native-inputs
      `(("bash-completion" ,bash-completion)
-       ("emacs" ,emacs-minimal)
+       ("emacs" ,emacs-no-x) ; Minimal lacks libxml, needed for some tests.
        ("pkg-config" ,pkg-config)
        ("python" ,python-2)
        ("python-docutils" ,python2-docutils)
-       ("python-sphinx" ,python2-sphinx)))
+       ("python-sphinx" ,python2-sphinx)
+
+       ;; The following are required for tests only.
+       ("which" ,which)
+       ("dtach" ,dtach)
+       ("gnupg" ,gnupg)
+       ("man" ,man-db)
+       ("perl" ,perl)))
     (inputs
      `(("glib" ,glib)
        ("gmime" ,gmime)
        ("talloc" ,talloc)
        ("xapian" ,xapian)
        ("zlib" ,zlib)))
-    (home-page "http://notmuchmail.org/")
+    (home-page "https://notmuchmail.org/")
     (synopsis "Thread-based email index, search, and tagging")
     (description
      "Notmuch is a command-line based program for indexing, searching, read-
@@ -584,7 +608,7 @@ useful for email address completion.")
 (define-public python-notmuch
   (package
     (name "python-notmuch")
-    (version "0.22.1")
+    (version (package-version notmuch))
     ;; Notmuch python bindings are now unavailable on pypi.  The
     ;; bindings are distributed via the notmuch release tarball.
     (source (package-source notmuch))
@@ -606,7 +630,7 @@ useful for email address completion.")
                  (("libnotmuch\\.so\\.")
                   (string-append notmuch "/lib/libnotmuch.so.")))
                #t))))))
-    (home-page "http://notmuchmail.org/")
+    (home-page (package-home-page notmuch))
     (synopsis "Python bindings of the Notmuch mail indexing library")
     (description
      "This package provides Python bindings to use the Notmuch mail indexing
@@ -1664,3 +1688,35 @@ e-mails with other systems speaking the SMTP protocol.")
      "This package provides extra tables, filters, and various other addons
 for OpenSMTPD to extend its functionality.")
     (home-page "https://www.opensmtpd.org")))
+
+(define-public python-mailmanclient
+  (package
+    (name "python-mailmanclient")
+    (version "1.0.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "mailmanclient" version))
+       (sha256
+        (base32
+         "1cfjh45fgbsax5hjj2inq9nk33dhdvh63xhysc8dhnqidgqgm8c5"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:tests? #f)) ; Requires mailman running
+    (inputs
+     `(("python-six" ,python-six)
+       ("python-httplib2" ,python-httplib2)))
+    (home-page "https://launchpad.net/mailman.client")
+    (synopsis "Python bindings for the Mailman 3 REST API")
+    (description
+     "The mailmanclient library provides official Python bindings for
+the GNU Mailman 3 REST API.")
+    (properties `((python2-variant . ,(delay python2-mailmanclient))))
+    (license lgpl3+)))
+
+(define-public python2-mailmanclient
+  (let ((base (package-with-python2
+               (strip-python2-variant python-mailmanclient))))
+    (package (inherit base)
+      (native-inputs
+       `(("python2-setuptools" ,python2-setuptools))))))
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index 1b7352fc10..d2df69d1e5 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -183,6 +183,17 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                 (inputs (if (%current-target-system)
                             `(("bash" ,static-bash))
                             '()))))
+	(tar (package (inherit tar)
+	       (arguments
+		'(#:phases (modify-phases %standard-phases
+			     (add-before 'build 'set-shell-file-name
+			       (lambda _
+				 ;; Do not use "/bin/sh" to run programs; see
+                                 ;; <http://lists.gnu.org/archive/html/guix-devel/2016-09/msg02272.html>.
+				 (substitute* "src/system.c"
+				   (("/bin/sh") "sh")
+				   (("execv ") "execvp "))
+				 #t)))))))
         (finalize (compose static-package
                            package-with-relocatable-glibc)))
     `(,@(map (match-lambda
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 73a9a23efd..ceef896a13 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -25,6 +25,7 @@
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
   #:use-module (gnu packages gcc)
+  #:use-module (gnu packages boost)
   #:use-module (gnu packages cdrom)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages gettext)
@@ -38,6 +39,7 @@
   #:use-module (gnu packages xiph)
   #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages linux)               ;alsa-lib
+  #:use-module (gnu packages video)               ;ffmpeg
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
@@ -287,14 +289,14 @@ This package contains the binary.")
 (define-public mpg123
   (package
     (name "mpg123")
-    (version "1.22.4")
+    (version "1.23.8")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/mpg123/mpg123/" version
                                   "/mpg123-" version ".tar.bz2"))
               (sha256
                (base32
-                "1lj0xv0b6sgqsbhx10dg60cnzgz98i76gxy51kqh11hka0pf0sah"))))
+                "13ngfzk84k4ks7ymanmq8f6707yrybra5h0mk3ir6mdnxk4068yy"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--with-default-audio=pulse")))
     (native-inputs `(("pkg-config" ,pkg-config)))
@@ -311,14 +313,14 @@ command-line tool as well as a C library, libmpg123.")
 (define-public mpg321
   (package
     (name "mpg321")
-    (version "0.3.1")
+    (version "0.3.2")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/mpg321/mpg321/"
                                  version "/mpg321-" version ".tar.gz"))
              (sha256
               (base32
-               "0yamsqvj15nsxxnjs9mgyslzx7krgsfk3q1hk3g6l8w9bbbj770b"))))
+               "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--disable-alsa")))
     (inputs
@@ -482,3 +484,31 @@ to write your own applications or plugins that are callable from the
 command-line tool.")
     (home-page "http://eyed3.nicfit.net/")
     (license license:gpl2+)))
+
+(define-public chromaprint
+  (package
+    (name "chromaprint")
+    (version "1.3.2")
+    (source (origin
+      (method url-fetch)
+      (uri (string-append
+            "https://bitbucket.org/acoustid/chromaprint/downloads/"
+            "chromaprint-" version ".tar.gz"))
+      (sha256
+       (base32 "0lln8dh33gslb9cbmd1hcv33pr6jxdwipd8m8gbsyhksiq6r1by3"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:tests? #f ; tests require googletest *sources*
+       ;;#:configure-flags '("-DBUILD_TESTS=ON") ; for building the tests
+       #:test-target "check"))
+    (inputs
+     ;; requires one of FFmpeg (prefered), FFTW3 or vDSP
+     ;; use the same ffmpeg version as for acoustid-fingerprinter
+     `(("ffmpeg" ,ffmpeg)
+       ("boots" ,boost)))
+    (home-page "https://acoustid.org/chromaprint")
+    (synopsis "Audio fingerprinting library")
+    (description "Chromaprint is a library for calculating audio
+fingerprints which are used by the Acoustid service.  Its main purpose
+is to provide an accurate identifier for record tracks.")
+    (license license:lgpl2.1+)))
diff --git a/gnu/packages/music.scm b/gnu/packages/music.scm
index bbae98532d..e0708a7008 100644
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@@ -838,6 +838,46 @@ your own lessons.")
 Editor.  It is compatible with Power Tab Editor 1.7 and Guitar Pro.")
     (license license:gpl3+)))
 
+(define-public jalv-select
+  (package
+    (name "jalv-select")
+    (version "0.7")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/brummer10/jalv_select/"
+                                  "archive/V" version ".tar.gz"))
+              (sha256
+               (base32
+                "01y93l5c1f8za04a0y4b3v0nhsm1lhj6rny9xpdgd7jz6sl6w581"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags
+       (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (add-after 'unpack 'ignore-PATH
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "jalv.select.cpp"
+               (("echo \\$PATH | tr ':' '\\\n' | xargs ls")
+                (string-append "ls -1 " (assoc-ref inputs "jalv") "/bin")))
+             (substitute* "jalv.select.h"
+               (("gtkmm.h") "gtkmm-2.4/gtkmm.h"))
+             #t)))))
+    (inputs
+     `(("lilv" ,lilv)
+       ("lv2" ,lv2)
+       ("jalv" ,jalv)
+       ("gtkmm" ,gtkmm-2)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "https://github.com/brummer10/jalv_select")
+    (synopsis "GUI to select LV2 plugins and run them with jalv")
+    (description
+     "The jalv.select package provides a graphical user interface allowing
+users to select LV2 plugins and run them with jalv.")
+    (license license:public-domain)))
+
 (define-public synthv1
   (package
     (name "synthv1")
@@ -976,6 +1016,8 @@ Laurens Hammond and Don Leslie.")
                (base32
                 "1jzzmfwssklzw8fvvil04n8csc0zm99fnd9p2xa7c0xchg37lvhn"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:parallel-build? #f)) ; Race conditions cause build failures
     (inputs
      `(("rapicorn" ,rapicorn)
        ("guile" ,guile-1.8)
@@ -1362,53 +1404,6 @@ multiplatform realtime MIDI I/O library is also provided with various output
 backends, including ALSA, OSS, Network and FluidSynth.")
     (license license:gpl2+)))
 
-(define-public vmpk
-  (package
-    (name "vmpk")
-    (version "0.6.2a")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://sourceforge/vmpk/vmpk/"
-                                  (string-drop-right version 1)
-                                  "/vmpk-" version ".tar.bz2"))
-              (sha256
-               (base32
-                "0259iikvxnfdiifrh02g8xgcxikrkca4nhd3an8xzx0bd6bk8ifi"))))
-    (build-system cmake-build-system)
-    (arguments
-     `(#:tests? #f  ; no test target
-       #:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'fix-docbook
-           (lambda* (#:key inputs #:allow-other-keys)
-             (substitute* "cmake_admin/CreateManpages.cmake"
-               (("http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl")
-                (string-append (assoc-ref inputs "docbook-xsl")
-                               "/xml/xsl/docbook-xsl-"
-                               ,(package-version docbook-xsl)
-                               "/manpages/docbook.xsl")))
-             #t)))))
-    (inputs
-     `(("drumstick" ,drumstick)
-       ("qtbase" ,qtbase)
-       ("qtsvg" ,qtsvg)
-       ("qttools" ,qttools)
-       ("qtx11extras" ,qtx11extras)))
-    (native-inputs
-     `(("libxslt" ,libxslt) ;for xsltproc
-       ("docbook-xsl" ,docbook-xsl)
-       ("pkg-config" ,pkg-config)))
-    (home-page "http://vmpk.sourceforge.net")
-    (synopsis "Virtual MIDI piano keyboard")
-    (description
-     "Virtual MIDI Piano Keyboard is a MIDI events generator and receiver.  It
-doesn't produce any sound by itself, but can be used to drive a MIDI
-synthesizer (either hardware or software, internal or external).  You can use
-the computer's keyboard to play MIDI notes, and also the mouse.  You can use
-the Virtual MIDI Piano Keyboard to display the played MIDI notes from another
-instrument or MIDI file player.")
-    (license license:gpl3+)))
-
 (define-public zynaddsubfx
   (package
     (name "zynaddsubfx")
@@ -1646,6 +1641,55 @@ follows a traditional multi-track tape recorder control paradigm.")
 analogue-like user interface.")
     (license license:gpl2+)))
 
+(define-public mod-host
+  ;; The last release was in 2014 but since then more than 140 commits have
+  ;; been made.
+  (let ((commit "72aca771e3a4e3889641b9bab84985586c9bb926")
+        (revision "1"))
+    (package
+      (name "mod-host")
+      (version (string-append "0.10.6-" revision "." (string-take commit 9)))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/moddevices/mod-host")
+                      (commit commit)))
+                (sha256
+                 (base32
+                  "19szi8cy65jlchbrmbjbma03g6gxj9zyyp4dgw1k06r0cxbx82gq"))
+                (file-name (string-append name "-" version "-checkout"))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:tests? #f ; no tests included
+         #:make-flags
+         (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
+               "CC=gcc")
+         #:phases
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (add-after 'unpack 'fix-jack-installation-directory
+             (lambda _
+               ;; Do not attempt to install files to output of "jack" package.
+               (substitute* "Makefile"
+                 (("\\$\\(shell pkg-config --variable=libdir jack\\)")
+                  "lib"))
+               #t)))))
+      (inputs
+       `(("lilv" ,lilv)
+         ("fftw" ,fftw)
+         ("fftwf" ,fftwf)
+         ("lv2" ,lv2)
+         ("jack" ,jack-1)
+         ("readline" ,readline)))
+      (native-inputs
+       `(("pkg-config" ,pkg-config)
+         ("python" ,python-2)))
+      (home-page "https://github.com/moddevices/mod-host")
+      (synopsis "LV2 host for Jack controllable via socket or command line")
+      (description "mod-host is an LV2 plugin host for JACK, controllable via
+socket or command line.")
+      (license license:gpl3+))))
+
 (define-public pianobar
   (package
     (name "pianobar")
@@ -2353,3 +2397,37 @@ slow gear audio effect to produce volume swells."))))
       (synopsis "Wah emulation with switchless activation")
       (description "This package provides the LV2 plugin \"GxSwitchlessWah\",
 a simulation of an analog Wah pedal with switchless activation."))))
+
+(define-public mod-utilities
+  (let ((commit "7cdeeac26ae682730740105ece121d4dddb8ba3f")
+        (revision "1"))
+    (package
+      (name "mod-utilities")
+      (version (string-append "0-" revision "." (string-take commit 9)))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/moddevices/mod-utilities.git")
+                      (commit commit)))
+                (sha256
+                 (base32
+                  "1ilnkbrmwrszxvc21qlb86h29yz7cnc6rcp0jmna1y693ny2qhf4"))
+                (file-name (string-append name "-" version "-checkout"))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:tests? #f ; there are no tests
+         #:make-flags
+         (list (string-append "INSTALL_PATH="
+                              (assoc-ref %outputs "out")
+                              "/lib/lv2"))
+         #:phases
+         (modify-phases %standard-phases
+           (delete 'configure))))
+      (inputs
+       `(("lv2" ,lv2)))
+      (home-page "https://github.com/moddevices/mod-utilities")
+      (synopsis "LV2 utility plugins")
+      (description "This package provides LV2 audio utility plugins, such as
+filters, crossovers, simple gain plugins without zipper noise, switch box
+plugins, a switch trigger, a toggle switch, and a peakmeter.")
+      (license license:gpl2+))))
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index 6ff6ee9dbb..b79f4c2582 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -427,7 +427,7 @@ and up to 1 Mbit/s downstream.")
 (define-public wireshark
   (package
     (name "wireshark")
-    (version "2.2.0")
+    (version "2.2.1")
     (synopsis "Network traffic analyzer")
     (source
      (origin
@@ -436,7 +436,7 @@ and up to 1 Mbit/s downstream.")
                            version ".tar.bz2"))
        (sha256
         (base32
-         "010i7wpsv2231pwb1xdqs0xfwywi3514siidv6wnrfpw3rs7x156"))))
+         "0jciaqz119vmznd8mi4gq5dgwz7vn453cnm2086mxcy80jpj43lh"))))
     (build-system glib-or-gtk-build-system)
     (inputs `(("bison" ,bison)
               ("c-ares" ,c-ares)
diff --git a/gnu/packages/patches/hop-bigloo-4.0b.patch b/gnu/packages/patches/hop-bigloo-4.0b.patch
deleted file mode 100644
index 312bfdd117..0000000000
--- a/gnu/packages/patches/hop-bigloo-4.0b.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-Bigloo 4.0b removes `xml-attribute-encode', which leads to a build failure
-in Hop.
-
-This patch allows Hop to be compiled with Bigloo 4.0b.
-
-
-changeset:   3327:3515f7f1aef2
-branch:      2.4.x
-user:        Manuel Serrano <Manuel.Serrano@inria.fr>
-date:        Wed Jul 31 12:41:10 2013 +0200
-summary:     Fix serialization bug
-
-diff -r 7244c4d30ad4 -r 3515f7f1aef2 runtime/js_comp.scm
---- a/runtime/js_comp.scm	Fri Jul 19 08:28:13 2013 +0200
-+++ b/runtime/js_comp.scm	Wed Jul 31 12:41:10 2013 +0200
-@@ -143,10 +143,17 @@
-       (display "{ " op)
-       (display-seq fields op
- 	 (lambda (f op)
-+	    (let ((iv (class-field-info f)))
- 	    (display "'" op)
- 	    (display (class-field-name f) op)
- 	    (display "': " op)
--	    (compile ((class-field-accessor f) obj) op)))
-+	       (cond
-+		  ((and (pair? iv) (memq :client iv))
-+		   =>
-+		   (lambda (x)
-+		      (compile (when (pair? (cdr x)) (cadr x)) op)))
-+		  (else 
-+		   (compile ((class-field-accessor f) obj) op))))))
-       (display "}" op))
-    
-    (let ((klass (object-class obj)))
-diff -r 7244c4d30ad4 -r 3515f7f1aef2 runtime/xml.scm
---- a/runtime/xml.scm	Fri Jul 19 08:28:13 2013 +0200
-+++ b/runtime/xml.scm	Wed Jul 31 12:41:10 2013 +0200
-@@ -55,6 +55,7 @@
- 	    (generic xml-write-attribute ::obj ::obj ::output-port ::xml-backend)
- 	    (generic xml-write-expression ::obj ::output-port)
- 	    (xml-write-attributes ::pair-nil ::output-port ::xml-backend)
-+	    (xml-attribute-encode obj)
- 
- 	    (xml->string ::obj ::xml-backend)
- 	    
-@@ -613,6 +614,52 @@
- 	 (display ">" p))))
- 
- ;*---------------------------------------------------------------------*/
-+;*    xml-attribute-encode ...                                         */
-+;*---------------------------------------------------------------------*/
-+(define (xml-attribute-encode obj)
-+   (if (not (string? obj))
-+       obj
-+       (let ((ol (string-length obj)))
-+	  (define (count str ol)
-+	     (let loop ((i 0)
-+			(j 0))
-+		(if (=fx i ol)
-+		    j
-+		    (let ((c (string-ref str i)))
-+		       ;; attribute values should escape &#...
-+		       (if (or (char=? c #\') (char=? c #\&))
-+			   (loop (+fx i 1) (+fx j 5))
-+			   (loop (+fx i 1) (+fx j 1)))))))
-+	  (define (encode str ol nl)
-+	     (if (=fx nl ol)
-+		 obj
-+		 (let ((nstr (make-string nl)))
-+		    (let loop ((i 0)
-+			       (j 0))
-+		       (if (=fx j nl)
-+			   nstr
-+			   (let ((c (string-ref str i)))
-+			      (case c
-+				 ((#\')
-+				  (string-set! nstr j #\&)
-+				  (string-set! nstr (+fx j 1) #\#)
-+				  (string-set! nstr (+fx j 2) #\3)
-+				  (string-set! nstr (+fx j 3) #\9)
-+				  (string-set! nstr (+fx j 4) #\;)
-+				  (loop (+fx i 1) (+fx j 5)))
-+				 ((#\&)
-+				  (string-set! nstr j #\&)
-+				  (string-set! nstr (+fx j 1) #\#)
-+				  (string-set! nstr (+fx j 2) #\3)
-+				  (string-set! nstr (+fx j 3) #\8)
-+				  (string-set! nstr (+fx j 4) #\;)
-+				  (loop (+fx i 1) (+fx j 5)))
-+				 (else
-+				  (string-set! nstr j c)
-+				  (loop (+fx i 1) (+fx j 1))))))))))
-+	  (encode obj ol (count obj ol)))))
-+
-+;*---------------------------------------------------------------------*/
- ;*    xml-write-attributes ...                                         */
- ;*---------------------------------------------------------------------*/
- (define (xml-write-attributes attr p backend)
-diff -r 7244c4d30ad4 -r 3515f7f1aef2 share/hop-serialize.js
---- a/share/hop-serialize.js	Fri Jul 19 08:28:13 2013 +0200
-+++ b/share/hop-serialize.js	Wed Jul 31 12:41:10 2013 +0200
-@@ -942,7 +942,7 @@
- 	 case 0x2e /* . */: return null;
- 	 case 0x3c /* < */: return read_cnst();
-          case 0x22 /* " */: return read_string( s );
--         case 0x25 /* " */: return decodeURIComponent( read_string( s ) );
-+         case 0x25 /* % */: return decodeURIComponent( read_string( s ) );
-          case 0x55 /* U */: return read_string( s );
- 	 case 0x5b /* [ */: return read_vector( read_size( s ) );
- 	 case 0x28 /* ( */: return read_list( read_size( s ) );
-diff -r 7244c4d30ad4 -r 3515f7f1aef2 src/main.scm
---- a/src/main.scm	Fri Jul 19 08:28:13 2013 +0200
-+++ b/src/main.scm	Wed Jul 31 12:41:10 2013 +0200
-@@ -59,8 +59,6 @@
-    (for-each register-srfi! (cons 'hop-server (hop-srfis)))
-    ;; set the library load path
-    (bigloo-library-path-set! (hop-library-path))
--   ;; define the Hop macros
--   (hop-install-expanders!)
-    ;; setup the hop readers
-    (bigloo-load-reader-set! hop-read)
-    (bigloo-load-module-set!
diff --git a/gnu/packages/patches/lftp-dont-save-unknown-host-fingerprint.patch b/gnu/packages/patches/lftp-dont-save-unknown-host-fingerprint.patch
deleted file mode 100644
index e170d11308..0000000000
--- a/gnu/packages/patches/lftp-dont-save-unknown-host-fingerprint.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-Fixes "saves unknown host's fingerprint in known_hosts without any prompt".
-See:
-
-  https://github.com/lavv17/lftp/issues/116
-  https://bugs.debian.org/774769
-
-From bc7b476e782d77839765f56bbdb4cee9f36b54ec Mon Sep 17 00:00:00 2001
-From: "Alexander V. Lukyanov" <lavv17f@gmail.com>
-Date: Tue, 13 Jan 2015 15:33:54 +0300
-Subject: [PATCH] add settings fish:auto-confirm and sftp:auto-confirm
-
-New host keys are now not confirmed by default, this should improve security.
-Suggested by Marcin Szewczyk <Marcin.Szewczyk@wodny.org>
----
- doc/lftp.1        | 8 ++++++++
- src/SSH_Access.cc | 5 +++--
- src/resource.cc   | 2 ++
- 3 files changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/doc/lftp.1 b/doc/lftp.1
-index cabc1be..ed6c388 100644
---- a/doc/lftp.1
-+++ b/doc/lftp.1
-@@ -1384,6 +1384,10 @@ address family in dns:order.
- .BR file:charset \ (string)
- local character set. It is set from current locale initially.
- .TP
-+.BR fish:auto-confirm \ (boolean)
-+when true, lftp answers ``yes'' to all ssh questions, in particular to the
-+question about a new host key. Otherwise it answers ``no''.
-+.TP
- .BR fish:charset \ (string)
- the character set used by fish server in requests, replies and file listings.
- Default is empty which means the same as local.
-@@ -1952,6 +1956,10 @@ minimal chunk size to split the file to.
- save pget transfer status this often. Set to `never' to disable saving of the status file.
- The status is saved to a file with suffix \fI.lftp-pget-status\fP.
- .TP
-+.BR sftp:auto-confirm \ (boolean)
-+when true, lftp answers ``yes'' to all ssh questions, in particular to the
-+question about a new host key. Otherwise it answers ``no''.
-+.TP
- .BR sftp:charset \ (string)
- the character set used by SFTP server in file names and file listings.
- Default is empty which means the same as local. This setting is only used
-diff --git a/src/SSH_Access.cc b/src/SSH_Access.cc
-index 706fc6a..17c716d 100644
---- a/src/SSH_Access.cc
-+++ b/src/SSH_Access.cc
-@@ -72,8 +72,9 @@ int SSH_Access::HandleSSHMessage()
-       }
-       if(s>=y_len && !strncasecmp(b+s-y_len,y,y_len))
-       {
--	 pty_recv_buf->Put("yes\n");
--	 pty_send_buf->Put("yes\n");
-+	 const char *answer=QueryBool("auto-confirm",hostname)?"yes\n":"no\n";
-+	 pty_recv_buf->Put(answer);
-+	 pty_send_buf->Put(answer);
- 	 return m;
-       }
-       if(!received_greeting && recv_buf->Size()>0)
-diff --git a/src/resource.cc b/src/resource.cc
-index 91b2e60..3a5e8b9 100644
---- a/src/resource.cc
-+++ b/src/resource.cc
-@@ -339,6 +339,7 @@ static ResType lftp_vars[] = {
-    {"mirror:no-empty-dirs",	 "no",	  ResMgr::BoolValidate,ResMgr::NoClosure},
-    {"mirror:require-source",	 "no",	  ResMgr::BoolValidate,ResMgr::NoClosure},
- 
-+   {"sftp:auto-confirm",	 "no",	  ResMgr::BoolValidate,0},
-    {"sftp:max-packets-in-flight","16",	  ResMgr::UNumberValidate,0},
-    {"sftp:protocol-version",	 "6",	  ResMgr::UNumberValidate,0},
-    {"sftp:size-read",		 "32k",	  ResMgr::UNumberValidate,0},
-@@ -367,6 +368,7 @@ static ResType lftp_vars[] = {
-    {"dns:strict-dnssec",	 "no",	  ResMgr::BoolValidate,0},
- #endif
- 
-+   {"fish:auto-confirm",	 "no",	  ResMgr::BoolValidate,0},
-    {"fish:shell",		 "/bin/sh",0,0},
-    {"fish:connect-program",	 "ssh -a -x",0,0},
-    {"fish:charset",		 "",	  ResMgr::CharsetValidate,0},
diff --git a/gnu/packages/patches/linux-libre-4.1-CVE-2016-5195.patch b/gnu/packages/patches/linux-libre-4.1-CVE-2016-5195.patch
new file mode 100644
index 0000000000..37a41f61e4
--- /dev/null
+++ b/gnu/packages/patches/linux-libre-4.1-CVE-2016-5195.patch
@@ -0,0 +1,99 @@
+Fix CVE-2016-5195, a.k.a. Dirty COW.
+Backported to linux-libre-4.1.x by Mark H Weaver <mhw@netris.org>.
+
+From 18652320ea99913c95e7130d654be7f1da6b694f Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Thu, 13 Oct 2016 13:07:36 -0700
+Subject: [PATCH] mm: remove gup_flags FOLL_WRITE games from __get_user_pages()
+
+commit 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619 upstream.
+
+This is an ancient bug that was actually attempted to be fixed once
+(badly) by me eleven years ago in commit 4ceb5db9757a ("Fix
+get_user_pages() race for write access") but that was then undone due to
+problems on s390 by commit f33ea7f404e5 ("fix get_user_pages bug").
+
+In the meantime, the s390 situation has long been fixed, and we can now
+fix it by checking the pte_dirty() bit properly (and do it better).  The
+s390 dirty bit was implemented in abf09bed3cce ("s390/mm: implement
+software dirty bits") which made it into v3.9.  Earlier kernels will
+have to look at the page state itself.
+
+Also, the VM has become more scalable, and what used a purely
+theoretical race back then has become easier to trigger.
+
+To fix it, we introduce a new internal FOLL_COW flag to mark the "yes,
+we already did a COW" rather than play racy games with FOLL_WRITE that
+is very fundamental, and then use the pte dirty flag to validate that
+the FOLL_COW flag is still valid.
+
+Reported-and-tested-by: Phil "not Paul" Oester <kernel@linuxace.com>
+Acked-by: Hugh Dickins <hughd@google.com>
+Reviewed-by: Michal Hocko <mhocko@suse.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Nick Piggin <npiggin@gmail.com>
+Cc: Greg Thelen <gthelen@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/mm.h |  1 +
+ mm/gup.c           | 14 ++++++++++++--
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 6b85ec6..7cadf0a 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2064,6 +2064,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
+ #define FOLL_NUMA	0x200	/* force NUMA hinting page fault */
+ #define FOLL_MIGRATION	0x400	/* wait for page to replace migration entry */
+ #define FOLL_TRIED	0x800	/* a retry, previous pass started an IO */
++#define FOLL_COW	0x4000	/* internal GUP flag */
+ 
+ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
+ 			void *data);
+diff --git a/mm/gup.c b/mm/gup.c
+index 6297f6b..e6de9e7 100644
+--- a/mm/gup.c
++++ b/mm/gup.c
+@@ -32,6 +32,16 @@ static struct page *no_page_table(struct vm_area_struct *vma,
+ 	return NULL;
+ }
+ 
++/*
++ * FOLL_FORCE can write to even unwritable pte's, but only
++ * after we've gone through a COW cycle and they are dirty.
++ */
++static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
++{
++	return pte_write(pte) ||
++		((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
++}
++
+ static struct page *follow_page_pte(struct vm_area_struct *vma,
+ 		unsigned long address, pmd_t *pmd, unsigned int flags)
+ {
+@@ -66,7 +76,7 @@ retry:
+ 	}
+ 	if ((flags & FOLL_NUMA) && pte_protnone(pte))
+ 		goto no_page;
+-	if ((flags & FOLL_WRITE) && !pte_write(pte)) {
++	if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
+ 		pte_unmap_unlock(ptep, ptl);
+ 		return NULL;
+ 	}
+@@ -315,7 +325,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
+ 	 * reCOWed by userspace write).
+ 	 */
+ 	if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
+-		*flags &= ~FOLL_WRITE;
++	        *flags |= FOLL_COW;
+ 	return 0;
+ }
+ 
+-- 
+2.10.1
+
diff --git a/gnu/packages/patches/notmuch-emacs-25-compatibility-fix.patch b/gnu/packages/patches/notmuch-emacs-25-compatibility-fix.patch
new file mode 100644
index 0000000000..9ddfd4fe10
--- /dev/null
+++ b/gnu/packages/patches/notmuch-emacs-25-compatibility-fix.patch
@@ -0,0 +1,46 @@
+This fixes a test failure with emacs-25. Picked from
+https://git.notmuchmail.org/git?p=notmuch;a=commit;h=f575a346df09c82691bb9e7c462836d982fe31f7
+
+From f575a346df09c82691bb9e7c462836d982fe31f7 Mon Sep 17 00:00:00 2001
+From: David Bremner <david@tethera.net>
+Date: Sun, 9 Oct 2016 19:30:44 -0300
+Subject: [PATCH] emacs/show: force notmuch-show-buttonise-links to act on
+ lines
+
+This seems to fix a problem with emacs 25 creating partial buttons by
+calling n-s-b-l with a region that does not include the whole button.
+I'm not 100% sure it's legit to act outside the region passed by
+jit-lock, but goto-address-fontify-region (where I borrowed the code
+from) already does this, so this patch to not make things worse.
+---
+ emacs/notmuch-show.el | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/emacs/notmuch-show.el b/emacs/notmuch-show.el
+index 641398d..e7d16f8 100644
+--- a/emacs/notmuch-show.el
++++ b/emacs/notmuch-show.el
+@@ -1174,13 +1174,15 @@ This also turns id:\"<message id>\"-parts and mid: links into
+ buttons for a corresponding notmuch search."
+   (goto-address-fontify-region start end)
+   (save-excursion
+-    (let (links)
+-      (goto-char start)
+-      (while (re-search-forward notmuch-id-regexp end t)
++    (let (links
++	  (beg-line (progn (goto-char start) (line-beginning-position)))
++	  (end-line (progn (goto-char end) (line-end-position))))
++      (goto-char beg-line)
++      (while (re-search-forward notmuch-id-regexp end-line t)
+ 	(push (list (match-beginning 0) (match-end 0)
+ 		    (match-string-no-properties 0)) links))
+-      (goto-char start)
+-      (while (re-search-forward notmuch-mid-regexp end t)
++      (goto-char beg-line)
++      (while (re-search-forward notmuch-mid-regexp end-line t)
+ 	(let* ((mid-cid (match-string-no-properties 1))
+ 	       (mid (save-match-data
+ 		      (string-match "^[^/]*" mid-cid)
+-- 
+2.10.1
+
diff --git a/gnu/packages/patches/openssh-memory-exhaustion.patch b/gnu/packages/patches/openssh-memory-exhaustion.patch
new file mode 100644
index 0000000000..91fe294ca4
--- /dev/null
+++ b/gnu/packages/patches/openssh-memory-exhaustion.patch
@@ -0,0 +1,39 @@
+Fix a memory exhaustion bug in the key exchange, whereby an unauthenticated user
+could potentially consume 38400 MB of memory on the server:
+
+http://seclists.org/oss-sec/2016/q4/185
+
+Patch adapted from upstream source repository:
+
+https://github.com/openssh/openssh-portable/commit/ec165c392ca54317dbe3064a8c200de6531e89ad
+
+From ec165c392ca54317dbe3064a8c200de6531e89ad Mon Sep 17 00:00:00 2001
+From: "markus@openbsd.org" <markus@openbsd.org>
+Date: Mon, 10 Oct 2016 19:28:48 +0000
+Subject: [PATCH] upstream commit
+
+Unregister the KEXINIT handler after message has been
+received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause
+allocation of up to 128MB -- until the connection is closed. Reported by
+shilei-c at 360.cn
+
+Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05
+---
+ kex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kex.c b/kex.c
+index 3f97f8c..6a94bc5 100644
+--- a/kex.c
++++ b/kex.c
+@@ -481,6 +481,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
+ 	if (kex == NULL)
+ 		return SSH_ERR_INVALID_ARGUMENT;
+ 
++	ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL);
+ 	ptr = sshpkt_ptr(ssh, &dlen);
+ 	if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
+ 		return r;
+-- 
+2.10.1
+
diff --git a/gnu/packages/patches/slim-login.patch b/gnu/packages/patches/slim-login.patch
new file mode 100644
index 0000000000..515573c6fa
--- /dev/null
+++ b/gnu/packages/patches/slim-login.patch
@@ -0,0 +1,35 @@
+Display configurable login message after successful authentication.
+
+Patch by E. Bavier
+
+--- slim-1.3.6/panel.cpp.orig	1969-12-31 18:00:00.000000000 -0600
++++ slim-1.3.6/panel.cpp	2016-10-17 17:00:07.259649063 -0500
+@@ -260,6 +260,7 @@
+ 
+ void Panel::ClosePanel() {
+ 	XUngrabKeyboard(Dpy, CurrentTime);
++	XClearWindow(Dpy, Root);
+ 	XUnmapWindow(Dpy, Win);
+ 	XDestroyWindow(Dpy, Win);
+ 	XFlush(Dpy);
+--- slim-1.3.6/cfg.cpp.orig	2016-10-17 17:08:06.767666139 -0500
++++ slim-1.3.6/cfg.cpp	2016-10-17 17:06:53.115663516 -0500
+@@ -52,6 +52,7 @@
+ 	options.insert(option("lockfile","/var/run/slim.lock"));
+ 	options.insert(option("logfile","/var/log/slim.log"));
+ 	options.insert(option("authfile","/var/run/slim.auth"));
++	options.insert(option("login_msg","Logging in..."));
+ 	options.insert(option("shutdown_msg","The system is halting..."));
+ 	options.insert(option("reboot_msg","The system is rebooting..."));
+ 	options.insert(option("sessiondir",""));
+--- slim-1.3.6/app.cpp.orig	2016-10-17 17:08:41.731667384 -0500
++++ slim-1.3.6/app.cpp	2016-10-17 17:07:48.415665486 -0500
+@@ -520,6 +520,8 @@
+ 	struct passwd *pw;
+ 	pid_t pid;
+ 
++	LoginPanel->Message((char*)cfg->getOption("login_msg").c_str());
++
+ #ifdef USE_PAM
+ 	try{
+ 		pam.open_session();
diff --git a/gnu/packages/patches/slim-reset.patch b/gnu/packages/patches/slim-reset.patch
new file mode 100644
index 0000000000..eebee6b7b5
--- /dev/null
+++ b/gnu/packages/patches/slim-reset.patch
@@ -0,0 +1,33 @@
+Do not reset chosen session and maintain the session-choser dialog after a
+failed login attempt.
+
+Patch by E. Bavier
+
+--- slim-1.3.6/panel.cpp.orig	1969-12-31 18:00:00.000000000 -0600
++++ slim-1.3.6/panel.cpp	2016-10-17 17:00:07.259649063 -0500
+@@ -260,13 +260,12 @@
+ }
+ 
+ void Panel::ClearPanel() {
+-	session_name = "";
+-    session_exec = "";
+ 	Reset();
+ 	XClearWindow(Dpy, Root);
+ 	XClearWindow(Dpy, Win);
+ 	Cursor(SHOW);
+ 	ShowText();
++	ShowSession();
+ 	XFlush(Dpy);
+ }
+ 
+@@ -760,9 +760,7 @@
+         pair<string,string> ses = cfg->nextSession();
+         session_name = ses.first;
+         session_exec = ses.second;
+-        if (session_name.size() > 0) {
+-                ShowSession();
+-        }
++        ShowSession();
+  }
+ 
+ /* Display session type on the screen */
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index ac7ac49ac2..b80c7c4091 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -5822,7 +5822,7 @@ It constructs the right value for the build system to do the right thing.")
 (define-public perl-test-mockobject
   (package
     (name "perl-test-mockobject")
-    (version "1.20140408")
+    (version "1.20150527")
     (source
      (origin
        (method url-fetch)
@@ -5830,7 +5830,7 @@ It constructs the right value for the build system to do the right thing.")
                            "Test-MockObject-" version ".tar.gz"))
        (sha256
         (base32
-         "1anpf9l2wdriwaxw6pf76ghxkh4zm25n3wnhfqy1b439xqnhvzg5"))))
+         "160xvhbpwqjaff4fgckvldknldzcbn1z3jvyzybs7cqlj1x3bwdd"))))
     (build-system perl-build-system)
     (native-inputs
      `(("perl-test-exception" ,perl-test-exception)
diff --git a/gnu/packages/psyc.scm b/gnu/packages/psyc.scm
new file mode 100644
index 0000000000..57042946d5
--- /dev/null
+++ b/gnu/packages/psyc.scm
@@ -0,0 +1,145 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016 ng0 <ngillmann@runbox.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages psyc)
+  #:use-module (guix download)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix build-system perl)
+  #:use-module (guix build-system gnu)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages admin)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages perl)
+  #:use-module (gnu packages web))
+
+(define-public perl-net-psyc
+  (package
+    (name "perl-net-psyc")
+    (version "1.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://perlpsyc.psyc.eu/"
+                           "perlpsyc-" version ".zip"))
+       (file-name (string-append name "-" version ".zip"))
+       (sha256
+        (base32
+         "1lw6807qrbmvzbrjn1rna1dhir2k70xpcjvyjn45y35hav333a42"))
+       ;; psycmp3 currently depends on MP3::List and rxaudio (shareware),
+       ;; we can add it back when this is no longer the case.
+       (snippet '(delete-file "contrib/psycmp3"))))
+    (build-system perl-build-system)
+    (inputs
+     `(("perl-curses" ,perl-curses)
+       ("perl-io-socket-ssl" ,perl-io-socket-ssl)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure) ; No configure script
+         ;; There is a Makefile, but it does not install everything
+         ;; (leaves out psycion) and says
+         ;; "# Just to give you a rough idea". XXX: Fix it upstream.
+         (replace 'build
+           (lambda _
+             (zero? (system* "make" "manuals"))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (doc (string-append out "/share/doc/perl-net-psyc"))
+                    (man1 (string-append out "/share/man/man1"))
+                    (man3 (string-append out "/share/man/man3"))
+                    (bin (string-append out "/bin"))
+                    (libpsyc (string-append out "/lib/psyc/ion"))
+                    (libperl (string-append out "/lib/perl5/site_perl/"
+                                            ,(package-version perl))))
+
+               (copy-recursively "lib/perl5" libperl)
+               (copy-recursively "lib/psycion" libpsyc)
+               (copy-recursively "bin" bin)
+               (install-file "cgi/psycpager" (string-append doc "/cgi"))
+               (copy-recursively "contrib" (string-append doc "/contrib"))
+               (copy-recursively "hooks" (string-append doc "/hooks"))
+               (copy-recursively "sdj" (string-append doc "/sdj"))
+               (install-file "README.txt" doc)
+               (install-file "TODO.txt" doc)
+               (copy-recursively "share/man/man1" man1)
+               (copy-recursively "share/man/man3" man3)
+               #t)))
+         (add-after 'install 'wrap-programs
+           (lambda* (#:key outputs #:allow-other-keys)
+             ;; Make sure all executables in "bin" find the Perl modules
+             ;; provided by this package at runtime.
+             (let* ((out  (assoc-ref outputs "out"))
+                    (bin  (string-append out "/bin/"))
+                    (path (getenv "PERL5LIB")))
+               (for-each (lambda (file)
+                           (wrap-program file
+                             `("PERL5LIB" ":" prefix (,path))))
+                         (find-files bin "\\.*$"))
+               #t))))))
+    (description
+     "@code{Net::PSYC} with support for TCP, UDP, Event.pm, @code{IO::Select} and
+Gtk2 event loops.  This package includes 12 applications and additional scripts:
+psycion (a @uref{http://about.psyc.eu,PSYC} chat client), remotor (a control console
+for @uref{https://torproject.org,tor} router) and many more.")
+    (synopsis "Perl implementation of PSYC protocol")
+    (home-page "http://perlpsyc.psyc.eu/")
+    (license (list license:gpl2
+                   (package-license perl)
+                   ;; contrib/irssi-psyc.pl:
+                   license:public-domain
+                   ;; bin/psycplay states AGPL with no version:
+                   license:agpl3+))))
+
+(define-public libpsyc
+  (package
+    (name "libpsyc")
+    (version "20160913")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.psyced.org/files/"
+                                  name "-" version ".tar.xz"))
+              (sha256
+               (base32
+                "14q89fxap05ajkfn20rnhc6b1h4i3i2adyr7y6hs5zqwb2lcmc1p"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("perl" ,perl)
+       ("netcat" ,netcat)
+       ("procps" ,procps)))
+    (arguments
+     `(#:make-flags
+       (list "CC=gcc"
+             (string-append "PREFIX=" (assoc-ref %outputs "out")))
+       #:phases
+       (modify-phases %standard-phases
+         ;; The rust bindings are the only ones in use, the lpc bindings
+         ;; are in psyclpc.  The other bindings are not used by anything,
+         ;; the chances are high that the bindings do not even work,
+         ;; therefore we do not include them.
+         ;; TODO: Get a cargo build system in Guix.
+         (delete 'configure)))) ; no configure script
+    (home-page "http://about.psyc.eu/libpsyc")
+    (description
+     "@code{libpsyc} is a PSYC library in C which implements
+core aspects of PSYC, useful for all kinds of clients and servers
+including psyced.")
+    (synopsis "PSYC library in C")
+    (license license:agpl3+)))
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 559bdc69f0..929ea208f2 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -7832,14 +7832,14 @@ text.")
 (define-public python-rsa
   (package
    (name "python-rsa")
-   (version "3.2")
+   (version "3.4.2")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "rsa" version))
      (sha256
       (base32
-       "0xwp929g7lvb1sghxfpqlxvgg96qcwqdbhh27sjplx30n3xp3wrh"))))
+       "1dcxvszbikgzh99ybdc7jq0zb9wspy2ds8z9mjsqiyv3q884xpr5"))))
    (build-system python-build-system)
    (inputs
     `(("python-pyasn1" ,python-pyasn1)
@@ -7939,14 +7939,14 @@ document.")
 (define-public python-botocore
   (package
    (name "python-botocore")
-   (version "1.3.17")
+   (version "1.4.62")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "botocore" version))
      (sha256
       (base32
-       "08vpvdixx1c1lfv6vzjig68bpiir7wfyhzf49ysxgvhbprg5ra0w"))))
+       "1zxczlwqy9bl27d9bc5x99mb5mcsxm350240lp5nx7014xb311lj"))))
    (build-system python-build-system)
    (inputs
     `(("python-dateutil" ,python-dateutil-2)
@@ -7969,16 +7969,14 @@ interface to the Amazon Web Services (AWS) API.")
 (define-public awscli
   (package
    (name "awscli")
-   (version "1.9.17")
+   (version "1.11.5")
    (source
     (origin
      (method url-fetch)
-     (uri (string-append
-           "https://pypi.python.org/packages/source/a/awscli/awscli-"
-           version ".tar.gz"))
+     (uri (pypi-uri name version))
      (sha256
       (base32
-       "1nj7jqvlpq57hfhby1njsbf8303gapa3njc4dramr6p3ffzvfi2i"))))
+       "0lclasm0wnayd3b8zl9l91i32nbgrhh0ncf9lksss4cv0myfwmfg"))))
    (build-system python-build-system)
    (inputs
     `(("python-colorama" ,python-colorama)
@@ -7990,7 +7988,8 @@ interface to the Amazon Web Services (AWS) API.")
       ("python-sphinx" ,python-sphinx)
       ("python-tox" ,python-tox)
       ("python-wheel" ,python-wheel)
-      ("python-botocore" ,python-botocore)))
+      ("python-botocore" ,python-botocore)
+      ("python-s3transfer" ,python-s3transfer)))
    (home-page "http://aws.amazon.com/cli/")
    (synopsis "Command line client for AWS")
    (description "AWS CLI provides a unified command line interface to the
@@ -8963,6 +8962,42 @@ anymore.")
 (define-public python2-pathlib
   (package-with-python2 python-pathlib))
 
+(define-public python2-pathlib2
+  (package
+    (name "python2-pathlib2")
+    (version "2.1.0")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "pathlib2" version))
+              (sha256
+               (base32
+                "0p050msg5c8d0kadv702jnfshaxrb0il765cpkgnhn6mq5hakcyy"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:python ,python-2))
+    (native-inputs
+     `(("python2-setuptools" ,python2-setuptools)
+       ("python2-six" ,python2-six)))
+    (home-page "http://pypi.python.org/pypi/pathlib2/")
+    (synopsis "Object-oriented file system paths - backport of standard
+pathlib module")
+    (description "The goal of pathlib2 is to provide a backport of standard
+pathlib module which tracks the standard library module, so all the newest
+features of the standard pathlib can be used also on older Python versions.
+
+Pathlib offers a set of classes to handle file system paths.  It offers the
+following advantages over using string objects:
+
+@enumerate
+@item No more cumbersome use of os and os.path functions.  Everything can
+be done easily through operators, attribute accesses, and method calls.
+@item Embodies the semantics of different path types.  For example,
+comparing Windows paths ignores casing.
+@item Well-defined semantics, eliminating any inconsistencies or
+ambiguities (forward vs. backward slashes, etc.).
+@end enumerate")
+    (license license:expat)))
+
 (define-public python-jellyfish
   (package
     (name "python-jellyfish")
@@ -11165,3 +11200,240 @@ replay them during future tests.  It is designed to work with python-requests.")
       (native-inputs
        `(("python2-setuptools" ,python2-setuptools)
          ,@(package-native-inputs base))))))
+
+(define-public python-s3transfer
+  (package
+    (name "python-s3transfer")
+    (version "0.1.8")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "s3transfer" version))
+              (sha256
+               (base32
+                "1jivjkp3xqif9gzr5fiq28jsskmh50vzzd7ldsb4rbyiw1iyv3hy"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-docutils" ,python-docutils)))
+    (inputs
+     `(("python-botocore" ,python-botocore)))
+    (synopsis "Amazon S3 Transfer Manager")
+    (description "S3transfer is a Python library for managing Amazon S3
+transfers.")
+    (home-page "https://github.com/boto/s3transfer")
+    (license license:asl2.0)
+    (properties `((python2-variant . ,(delay python2-s3transfer))))))
+
+(define-public python2-s3transfer
+  (let ((base (package-with-python2 (strip-python2-variant python-s3transfer))))
+    (package
+      (inherit base)
+      (native-inputs
+       `(("python2-futures" ,python2-futures)
+         ("python2-setuptools" ,python2-setuptools)
+         ,@(package-native-inputs base))))))
+
+(define-public python-setproctitle
+(package
+  (name "python-setproctitle")
+  (version "1.1.10")
+  (source
+    (origin
+      (method url-fetch)
+      (uri (pypi-uri "setproctitle" version))
+      (sha256
+        (base32
+          "163kplw9dcrw0lffq1bvli5yws3rngpnvrxrzdw89pbphjjvg0v2"))))
+  (build-system python-build-system)
+  (arguments
+   '(#:phases
+     (modify-phases %standard-phases
+        (add-before 'check 'patch-Makefile
+           ;; Stricly this is only required for the python2 variant.
+           ;; But adding a phase in an inherited package seems to be
+           ;; cumbersum. So we patch even for python3.
+           (lambda _
+             (let ((nose (assoc-ref %build-inputs "python2-nose")))
+               (when nose
+                 (substitute* "Makefile"
+                   (("\\$\\(PYTHON\\) [^ ]which nosetests[^ ] ")
+                    (string-append nose "/bin/nosetests "))))
+               #t)))
+        (replace 'check
+           (lambda _
+             (setenv "PYTHON" (or (which "python3") (which "python")))
+             (setenv "PYCONFIG" (or (which "python3-config")
+                                    (which "python-config")))
+             (setenv "CC" "gcc")
+             ;; No need to extend PYTHONPATH to find the built package, since
+             ;; the Makefile will build anyway
+             (zero? (system* "make" "check")))))))
+  (native-inputs
+   `(("procps" ,procps))) ; required for tests
+  (home-page
+    "https://github.com/dvarrazzo/py-setproctitle")
+  (synopsis
+   "Setproctitle implementation for Python to customize the process title")
+  (description "The library allows a process to change its title (as displayed
+by system tools such as ps and top).
+
+Changing the title is mostly useful in multi-process systems, for
+example when a master process is forked: changing the children's title
+allows to identify the task each process is busy with.  The technique
+is used by PostgreSQL and the OpenSSH Server for example.")
+  (license license:bsd-3)
+  (properties `((python2-variant . ,(delay python2-setproctitle))))))
+
+(define-public python2-setproctitle
+  (let ((base (package-with-python2
+               (strip-python2-variant python-setproctitle))))
+    (package
+      (inherit base)
+      (native-inputs `(("python2-nose" ,python2-nose)
+                       ,@(package-native-inputs base))))))
+
+(define-public python-validictory
+  (package
+    (name "python-validictory")
+    (version "1.0.1")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "validictory" version))
+      (sha256
+       (base32
+        "1zf1g9sw47xzp5f80bd94pb42j9yqv82lcrgcvdwr6nkaphfi37q"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'bootstrap
+           ;; Move the tests out of the package directory to avoid
+           ;; packaging them.
+           (lambda* _
+             (rename-file "validictory/tests" "tests")
+             (delete-file "tests/__init__.py")))
+         (replace 'check
+           (lambda _
+             ;; Extend PYTHONPATH so the built package will be found.
+             (setenv "PYTHONPATH"
+                     (string-append (getcwd) "/build/lib:"
+                                    (getenv "PYTHONPATH")))
+             (zero? (system* "py.test" "-vv" )))))))
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (home-page
+     "https://github.com/jamesturk/validictory")
+    (synopsis "General purpose Python data validator")
+    (description "It allows validation of arbitrary Python data structures.
+
+The schema format is based on the JSON Schema
+proposal (http://json-schema.org), so combined with json the library is also
+useful as a validator for JSON data.")
+  (license license:expat)
+  (properties `((python2-variant . ,(delay python2-validictory))))))
+
+(define-public python2-validictory
+  (let ((base (package-with-python2
+               (strip-python2-variant python-validictory))))
+    (package
+      (inherit base)
+      (native-inputs `(("python2-setuptools" ,python2-setuptools)
+                       ,@(package-native-inputs base))))))
+
+(define-public python-aniso8601
+  (package
+    (name "python-aniso8601")
+    (version "1.1.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "aniso8601" version))
+        (sha256
+          (base32
+            "1k5mjg9iqbjfslb5prrsfz7dhlvi6s35p1jxq8dm87w1b7dn5i2g"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-dateutil-2" ,python-dateutil-2)))
+    (home-page
+      "https://bitbucket.org/nielsenb/aniso8601")
+    (synopsis
+      "Python library for parsing ISO 8601 strings")
+    (description
+      "This package contains a library for parsing ISO 8601 datetime strings.")
+    (license license:bsd-3)))
+
+(define-public python-flask-restful
+  (package
+    (name "python-flask-restful")
+    (version "0.3.5")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "Flask-RESTful" version))
+        (sha256
+          (base32
+            "0hjcmdb56b7z4bkw848lxfkyrpnkwzmqn2dgnlv12mwvjpzsxr6c"))))
+    (build-system python-build-system)
+    (propagated-inputs
+      `(("python-aniso8601" ,python-aniso8601)
+        ("python-flask" ,python-flask)
+        ("python-pycrypto" ,python-pycrypto)
+        ("python-pytz" ,python-pytz)))
+    (native-inputs
+      `(;; Optional dependency of Flask. Tests need it.
+        ("python-blinker" ,python-blinker)
+        ("python-mock" ,python-mock) ; For tests
+        ("python-nose" ,python-nose) ; For tests
+        ("python-sphinx" ,python-sphinx)))
+    (home-page
+      "https://www.github.com/flask-restful/flask-restful/")
+    (synopsis
+      "Flask module for creating REST APIs")
+    (description
+      "This package contains a Flask module for creating REST APIs.")
+    (license license:bsd-3)))
+
+(define-public python-flask-basicauth
+  (package
+    (name "python-flask-basicauth")
+    (version "0.2.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "Flask-BasicAuth" version))
+        (sha256
+          (base32
+            "1zq1spkjr4sjdnalpp8wl242kdqyk6fhbnhr8hi4r4f0km4bspnz"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-flask" ,python-flask)))
+    (home-page
+      "https://github.com/jpvanhal/flask-basicauth")
+    (synopsis
+      "HTTP basic access authentication for Flask")
+    (description
+      "This package provides HTTP basic access authentication for Flask.")
+    (license license:bsd-3)))
+
+(define-public python-flask-sqlalchemy
+  (package
+    (name "python-flask-sqlalchemy")
+    (version "2.1")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "Flask-SQLAlchemy" version))
+        (sha256
+          (base32
+            "1i9ps5d5snih9xlqhrvmi3qfiygkmqzxh92n25kj4pf89kj4s965"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-flask" ,python-flask)
+       ("python-sqlalchemy" ,python-sqlalchemy)))
+    (home-page
+      "http://github.com/mitsuhiko/flask-sqlalchemy")
+    (synopsis
+      "Module adding SQLAlchemy support to your Flask application")
+    (description
+      "This package adds SQLAlchemy support to your Flask application.")
+    (license license:bsd-3)))
diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm
index 41a7bf5328..16b1b5586c 100644
--- a/gnu/packages/scheme.scm
+++ b/gnu/packages/scheme.scm
@@ -205,58 +205,57 @@ features an integrated Emacs-like editor and a large runtime library.")
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
-       #:phases (alist-replace
-                 'configure
-                 (lambda* (#:key outputs #:allow-other-keys)
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs #:allow-other-keys)
 
-                   (substitute* "configure"
-                     (("^shell=.*$")
-                      (string-append "shell=" (which "bash") "\n")))
+             (substitute* "configure"
+               (("^shell=.*$")
+                (string-append "shell=" (which "bash") "\n")))
 
-                   ;; Since libgc's pthread redirects are used, we end up
-                   ;; using libgc symbols, so we must link against it.
-                   ;; Reported on 2013-06-25.
-                   (substitute* "api/pthread/src/Makefile"
-                     (("^EXTRALIBS[[:blank:]]*=(.*)$" _ value)
-                      (string-append "EXTRALIBS = "
-                                     (string-trim-right value)
-                                     " -l$(GCLIB)_fth-$(RELEASE)"
-                                     " -Wl,-rpath=" (assoc-ref outputs "out")
-                                     "/lib/bigloo/" ,version)))
+             ;; Since libgc's pthread redirects are used, we end up
+             ;; using libgc symbols, so we must link against it.
+             ;; Reported on 2013-06-25.
+             (substitute* "api/pthread/src/Makefile"
+               (("^EXTRALIBS[[:blank:]]*=(.*)$" _ value)
+                (string-append "EXTRALIBS = "
+                               (string-trim-right value)
+                               " -l$(GCLIB)_fth-$(RELEASE)"
+                               " -Wl,-rpath=" (assoc-ref outputs "out")
+                               "/lib/bigloo/" ,version)))
 
-                   ;; Those variables are used by libgc's `configure'.
-                   (setenv "SHELL" (which "sh"))
-                   (setenv "CONFIG_SHELL" (which "sh"))
+             ;; Those variables are used by libgc's `configure'.
+             (setenv "SHELL" (which "sh"))
+             (setenv "CONFIG_SHELL" (which "sh"))
 
-                   ;; ... but they turned out to be overridden later, so work
-                   ;; around that.
-                   (substitute* (find-files "gc" "^configure-gc")
-                     (("sh=/bin/sh")
-                      (string-append "sh=" (which "sh"))))
+             ;; ... but they turned out to be overridden later, so work
+             ;; around that.
+             (substitute* (find-files "gc" "^configure-gc")
+               (("sh=/bin/sh")
+                (string-append "sh=" (which "sh"))))
 
-                   ;; The `configure' script doesn't understand options
-                   ;; of those of Autoconf.
-                   (let ((out (assoc-ref outputs "out")))
-                     (zero?
-                      (system* "./configure"
-                               (string-append "--prefix=" out)
-                               ;; FIXME: Currently fails, see
-                               ;; <http://article.gmane.org/gmane.lisp.scheme.bigloo/6126>.
-                               ;; "--customgc=no" ; use our libgc
-                               (string-append"--mv=" (which "mv"))
-                               (string-append "--rm=" (which "rm"))
-                               (string-append "--ldflags=-Wl,-rpath="
-                                              (assoc-ref outputs "out")
-                                              "/lib/bigloo/" ,version)))))
-                 (alist-cons-after
-                  'install 'install-emacs-modes
-                  (lambda* (#:key outputs #:allow-other-keys)
-                    (let* ((out (assoc-ref outputs "out"))
-                           (dir (string-append out "/share/emacs/site-lisp")))
-                      (zero? (system* "make" "-C" "bmacs" "all" "install"
-                                      (string-append "EMACSBRAND=emacs24")
-                                      (string-append "EMACSDIR=" dir)))))
-                  %standard-phases))))
+             ;; The `configure' script doesn't understand options
+             ;; of those of Autoconf.
+             (let ((out (assoc-ref outputs "out")))
+               (zero?
+                (system* "./configure"
+                         (string-append "--prefix=" out)
+                         ;; FIXME: Currently fails, see
+                         ;; <http://article.gmane.org/gmane.lisp.scheme.bigloo/6126>.
+                         ;; "--customgc=no" ; use our libgc
+                         (string-append"--mv=" (which "mv"))
+                         (string-append "--rm=" (which "rm"))
+                         (string-append "--ldflags=-Wl,-rpath="
+                                        (assoc-ref outputs "out")
+                                        "/lib/bigloo/" ,version))))))
+         (add-after 'install 'install-emacs-modes
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (dir (string-append out "/share/emacs/site-lisp")))
+               (zero? (system* "make" "-C" "bmacs" "all" "install"
+                               (string-append "EMACSBRAND=emacs24")
+                               (string-append "EMACSDIR=" dir)))))))))
     (inputs
      `(("emacs" ,emacs)                      ;UDE needs the X version of Emacs
 
@@ -283,32 +282,30 @@ Scheme and C programs and between Scheme and Java programs.")
 (define-public hop
   (package
     (name "hop")
-    (version "2.4.0")
+    (version "2.5.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ftp-sop.inria.fr/indes/fp/Hop/hop-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "1v2r4ga58kk1sx0frn8qa8ccmjpic9csqzpk499wc95y9c4b1wy3"))
-             (patches (search-patches "hop-bigloo-4.0b.patch"
-                                      "hop-linker-flags.patch"))))
+               "1bvp7pc71bln5yvfj87s8750c6l53wjl6f8m12v62q9926adhwys"))
+             (patches (search-patches "hop-linker-flags.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
-       (alist-replace
-        'configure
-        (lambda* (#:key outputs #:allow-other-keys)
-          (let ((out (assoc-ref outputs "out")))
-            (zero?
-             (system* "./configure"
-                      (string-append "--prefix=" out)
-                      (string-append "--blflags="
-                                     ;; user flags completely override useful
-                                     ;; default flags, so repeat them here.
-                                     "-copt \\$(CPICFLAGS) -L\\$(BUILDLIBDIR) "
-                                     "-ldopt -Wl,-rpath," out "/lib")))))
-        %standard-phases)
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (zero?
+                (system* "./configure"
+                         (string-append "--prefix=" out)
+                         (string-append "--blflags="
+                                        ;; user flags completely override useful
+                                        ;; default flags, so repeat them here.
+                                        "-copt \\$(CPICFLAGS) -L\\$(BUILDLIBDIR) "
+                                        "-ldopt -Wl,-rpath," out "/lib")))))))
        #:tests? #f))                                ; no test suite
     (inputs `(("avahi" ,avahi)
               ("bigloo" ,bigloo)
@@ -517,17 +514,17 @@ of libraries.")
 (define-public gambit-c
   (package
     (name "gambit-c")
-    (version "4.7.4")
+    (version "4.8.5")
     (source
      (origin
        (method url-fetch)
        (uri (string-append
              "http://www.iro.umontreal.ca/~gambit/download/gambit/v"
-             (version-major+minor version) "/source/gambc-v"
+             (version-major+minor version) "/source/gambit-v"
              (string-map (lambda (c) (if (char=? c #\.) #\_ c)) version)
              ".tgz"))
        (sha256
-        (base32 "0y2pklh4k65yrmxv63ass76xckrk9wqimbdad2gha35v2mi7blhs"))))
+        (base32 "0xwmqzqvk83xyjz48vp36p5vj1415rl3pi3xq7y8i3p8s409a98b"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags
@@ -535,16 +532,16 @@ of libraries.")
        ;; use >= 1 GB memory, but makes Gambit much faster.
        '("--enable-single-host")
        #:phases
-       (alist-cons-before
-        'check 'fix-tests
-        (lambda _
-          (substitute* '("tests/makefile")
-            ;; '-:' is how run-time options are set.  'tl' sets some terminal
-            ;; option, which makes it fail in our build environment.  It
-            ;; recommends using 'd-' as a solution, which sets the REPL
-            ;; interaction channel to stdin/stdout.
-            (("gsi -:tl") "gsi -:d-,tl")))
-        %standard-phases)))
+       (modify-phases %standard-phases
+         (add-before 'check 'fix-tests
+           (lambda _
+             (substitute* '("tests/makefile")
+               ;; '-:' is how run-time options are set.  'tl' sets some terminal
+               ;; option, which makes it fail in our build environment.  It
+               ;; recommends using 'd-' as a solution, which sets the REPL
+               ;; interaction channel to stdin/stdout.
+               (("gsi -:tl") "gsi -:d-,tl"))
+             #t)))))
     (home-page "http://www.iro.umontreal.ca/~gambit/")
     (synopsis "Efficient Scheme interpreter and compiler")
     (description
diff --git a/gnu/packages/search.scm b/gnu/packages/search.scm
index 9eb4039f84..5d7def5b2f 100644
--- a/gnu/packages/search.scm
+++ b/gnu/packages/search.scm
@@ -35,30 +35,38 @@
 (define-public xapian
   (package
     (name "xapian")
-    (version "1.2.21")
+    (version "1.4.0")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://oligarchy.co.uk/xapian/" version
+              (uri (string-append "https://oligarchy.co.uk/xapian/" version
                                   "/xapian-core-" version ".tar.xz"))
               (sha256
-               (base32 "0grd2s6gf8yzqwdaa50g57j9d81mxkrrpkyldm2shgyizdc8gx33"))))
+               (base32 "0xv4da5rmqqzkkkzx2v3jwh5hz5zxhd2b7m8x30fk99a25blyn0h"))))
     (build-system gnu-build-system)
     (inputs `(("zlib" ,zlib)
               ("util-linux" ,util-linux)))
     (arguments
-     `(#:phases (alist-cons-after
-                 'unpack 'patch-remotetcp-harness
-                 (lambda _
-                   (substitute* "tests/harness/backendmanager_remotetcp.cc"
-                     (("/bin/sh") (which "bash"))))
-                 %standard-phases)))
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           ;; As of Xapian 1.3.3, the TCP server implementation uses
+           ;; getaddrinfo(). This does not work in the build environment,
+           ;; so exclude those tests. See HACKING for the list of targets.
+           (lambda _
+             (zero? (system* "make"
+                             "check-inmemory"
+                             "check-remoteprog"
+                             ;"check-remotetcp"
+                             "check-multi"
+                             "check-glass"
+                             "check-chert")))))))
     (synopsis "Search Engine Library")
     (description
      "Xapian is a highly adaptable toolkit which allows developers to easily
 add advanced indexing and search facilities to their own applications.  It
 supports the Probabilistic Information Retrieval model and also supports a
 rich set of boolean query operators.")
-    (home-page "http://xapian.org/")
+    (home-page "https://xapian.org/")
     (license (list gpl2+ bsd-3 x11))))
 
 (define-public libtocc
diff --git a/gnu/packages/ssh.scm b/gnu/packages/ssh.scm
index 9fd1506dbd..af5aae1029 100644
--- a/gnu/packages/ssh.scm
+++ b/gnu/packages/ssh.scm
@@ -121,6 +121,7 @@ a server that supports the SSH-2 protocol.")
                                         tail)
                          (string-append "http://ftp2.fr.openbsd.org/pub/OpenBSD/OpenSSH/portable/"
                                         tail))))
+            (patches (search-patches "openssh-memory-exhaustion.patch"))
             (sha256 (base32
                      "1k5y1wi29d47cgizbryxrhc1fbjsba2x8l5mqfa9b9nadnd9iyrz"))))
    (build-system gnu-build-system)
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index cded1bf4d0..cdc9193c14 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -403,14 +403,14 @@ standards (MPEG-2, MPEG-4 ASP/H.263, MPEG-4 AVC/H.264, and VC-1/VMW3).")
 (define-public ffmpeg
   (package
     (name "ffmpeg")
-    (version "3.1.4")
+    (version "3.1.5")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://ffmpeg.org/releases/ffmpeg-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0nvb2k0maj5g8llfg47j8z5xpvp4q3g9pab2pp6vpjd5vmwb6358"))))
+               "16mqb1fs6ahqqv6a64dk4d8rp75ixdsipfzsz0vmc749yw2k3k29"))))
     (build-system gnu-build-system)
     (inputs
      `(("fontconfig" ,fontconfig)
@@ -792,7 +792,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
 (define-public mpv
   (package
     (name "mpv")
-    (version "0.20.0")
+    (version "0.21.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -800,7 +800,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
                     ".tar.gz"))
               (sha256
                (base32
-                "0mibhjg5skcwcfpg6dx7yi2gj14xawnq2jzmcfwq9knmvv9cjvpy"))
+                "1lwvvhldqrkp44zdm3wbi7qrsln13s8ympwwckqhwl4whp78wpyh"))
               (file-name (string-append name "-" version ".tar.gz"))))
     (build-system waf-build-system)
     (native-inputs
diff --git a/gnu/packages/vim.scm b/gnu/packages/vim.scm
index b1ee527c7a..4ee8c7d9fc 100644
--- a/gnu/packages/vim.scm
+++ b/gnu/packages/vim.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -23,11 +24,26 @@
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
+  #:use-module (gnu packages acl)
+  #:use-module (gnu packages admin) ; For GNU hostname
+  #:use-module (gnu packages attr)
+  #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gawk)
+  #:use-module (gnu packages gettext)
+  #:use-module (gnu packages glib)
+  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages image)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages lua)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages perl)
-  #:use-module (gnu packages admin) ; For GNU hostname
-  #:use-module (gnu packages shells))
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages ruby)
+  #:use-module (gnu packages shells)
+  #:use-module (gnu packages tcl)
+  #:use-module (gnu packages xdisorg)
+  #:use-module (gnu packages xorg))
 
 (define-public vim
   (package
@@ -79,3 +95,54 @@ that many consider it an entire IDE.  It's not just for programmers, though.
 Vim is perfect for all kinds of text editing, from composing email to editing
 configuration files.")
     (license license:vim)))
+
+(define-public vim-full
+  (package
+    (inherit vim)
+    (name "vim-full")
+    (arguments
+     `(#:configure-flags
+       (list (string-append "--with-lua-prefix="
+                            (assoc-ref %build-inputs "lua"))
+             "--with-features=huge"
+             "--enable-python3interp=yes"
+             "--enable-perlinterp=yes"
+             "--enable-rubyinterp=yes"
+             "--enable-tclinterp=yes"
+             "--enable-luainterp=yes"
+             "--enable-cscope"
+             "--enable-sniff"
+             "--enable-multibyte"
+             "--enable-xim"
+             "--disable-selinux"
+             "--enable-gui")
+       ,@(package-arguments vim)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("acl" ,acl)
+       ("atk" ,atk)
+       ("attr" ,attr)
+       ("cairo" ,cairo)
+       ("fontconfig" ,fontconfig)
+       ("freetype" ,freetype)
+       ("gdk-pixbuf" ,gdk-pixbuf)
+       ("gettext" ,gnu-gettext)
+       ("glib" ,glib)
+       ("gpm" ,gpm)
+       ("gtk" ,gtk+-2)
+       ("harfbuzz" ,harfbuzz)
+       ("libice" ,libice)
+       ("libpng" ,libpng)
+       ("libsm" ,libsm)
+       ("libx11" ,libx11)
+       ("libxdmcp" ,libxdmcp)
+       ("libxt" ,libxt)
+       ("libxpm" ,libxpm)
+       ("lua" ,lua)
+       ("pango" ,pango)
+       ("pixman" ,pixman)
+       ("python-3" ,python)
+       ("ruby" ,ruby)
+       ("tcl" ,tcl)
+       ,@(package-inputs vim)))))
diff --git a/gnu/packages/vpn.scm b/gnu/packages/vpn.scm
index 6449f0d57a..996ca7ae12 100644
--- a/gnu/packages/vpn.scm
+++ b/gnu/packages/vpn.scm
@@ -116,13 +116,13 @@ Only \"Universal TUN/TAP device driver support\" is needed in the kernel.")
 (define-public openconnect
   (package
    (name "openconnect")
-   (version "7.05")
+   (version "7.07")
    (source (origin
             (method url-fetch)
             (uri (string-append "ftp://ftp.infradead.org/pub/openconnect/"
                                 "openconnect-" version ".tar.gz"))
             (sha256 (base32
-                     "1i102yr8yp2ny587n6pd966443h1pqxyw5q0n5afq575046jj98g"))))
+                     "0rl33f1g42hxzqfv2a33gls8cb77q4w432xkims1dnfwhzagrv7k"))))
    (build-system gnu-build-system)
    (inputs
     `(("libxml2" ,libxml2)
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index 7495179f8e..df609da0de 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -265,11 +265,13 @@ Protocol (DHCP) client, on all the non-loopback network interfaces."
   ntp-configuration?
   (ntp      ntp-configuration-ntp
             (default ntp))
-  (servers  ntp-configuration-servers))
+  (servers  ntp-configuration-servers)
+  (allow-large-adjustment? ntp-allow-large-adjustment?
+                           (default #f)))
 
 (define ntp-shepherd-service
   (match-lambda
-    (($ <ntp-configuration> ntp servers)
+    (($ <ntp-configuration> ntp servers allow-large-adjustment?)
      (let ()
        ;; TODO: Add authentication support.
        (define config
@@ -296,7 +298,10 @@ restrict -6 ::1\n"))
               (requirement '(user-processes networking))
               (start #~(make-forkexec-constructor
                         (list (string-append #$ntp "/bin/ntpd") "-n"
-                              "-c" #$ntpd.conf "-u" "ntpd")))
+                              "-c" #$ntpd.conf "-u" "ntpd"
+                              #$@(if allow-large-adjustment?
+                                     '("-g")
+                                     '()))))
               (stop #~(make-kill-destructor))))))))
 
 (define %ntp-accounts
@@ -331,12 +336,18 @@ restrict -6 ::1\n"))
                                           ntp-service-activation)))))
 
 (define* (ntp-service #:key (ntp ntp)
-                      (servers %ntp-servers))
+                      (servers %ntp-servers)
+                      allow-large-adjustment?)
   "Return a service that runs the daemon from @var{ntp}, the
 @uref{http://www.ntp.org, Network Time Protocol package}.  The daemon will
-keep the system clock synchronized with that of @var{servers}."
+keep the system clock synchronized with that of @var{servers}.
+@var{allow-large-adjustment?} determines whether @command{ntpd} is allowed to
+make an initial adjustment of more than 1,000 seconds."
   (service ntp-service-type
-           (ntp-configuration (ntp ntp) (servers servers))))
+           (ntp-configuration (ntp ntp)
+                              (servers servers)
+                              (allow-large-adjustment?
+                               allow-large-adjustment?))))
 
 
 ;;;