Merge branch 'master' into staging

126 files changed, 6137 insertions, 2354 deletions

diff --git a/gnu/bootloader/grub.scm b/gnu/bootloader/grub.scm
index a9f0875f36..96e53c5c2b 100644
--- a/gnu/bootloader/grub.scm
+++ b/gnu/bootloader/grub.scm
@@ -30,7 +30,7 @@
   #:use-module (gnu artwork)
   #:use-module (gnu system)
   #:use-module (gnu bootloader)
-  #:use-module (gnu system file-systems)
+  #:use-module (gnu system uuid)
   #:autoload   (gnu packages bootloaders) (grub)
   #:autoload   (gnu packages compression) (gzip)
   #:autoload   (gnu packages gtk) (guile-cairo guile-rsvg)
@@ -300,7 +300,7 @@ code."
       (match device
         ;; Preferably refer to DEVICE by its UUID or label.  This is more
         ;; efficient and less ambiguous, see <http://bugs.gnu.org/22281>.
-        ((? bytevector? uuid)
+        ((? uuid? uuid)
          (format #f "search --fs-uuid --set ~a"
                  (uuid->string device)))
         ((? string? label)
diff --git a/gnu/build/file-systems.scm b/gnu/build/file-systems.scm
index 203fbdfffb..32885f1d2e 100644
--- a/gnu/build/file-systems.scm
+++ b/gnu/build/file-systems.scm
@@ -19,6 +19,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu build file-systems)
+  #:use-module (gnu system uuid)
   #:use-module (guix build utils)
   #:use-module (guix build bournish)
   #:use-module (guix build syscalls)
@@ -26,8 +27,6 @@
   #:use-module (rnrs bytevectors)
   #:use-module (ice-9 match)
   #:use-module (ice-9 rdelim)
-  #:use-module (ice-9 format)
-  #:use-module (ice-9 regex)
   #:use-module (system foreign)
   #:autoload   (system repl repl) (start-repl)
   #:use-module (srfi srfi-1)
@@ -41,15 +40,6 @@
             find-partition-by-luks-uuid
             canonicalize-device-spec
 
-            uuid->string
-            string->uuid
-            string->iso9660-uuid
-            string->ext2-uuid
-            string->ext3-uuid
-            string->ext4-uuid
-            string->btrfs-uuid
-            iso9660-uuid->string
-
             bind-mount
 
             mount-flags->bit-mask
@@ -95,20 +85,6 @@ takes a bytevector and returns #t when it's a valid superblock."
                      (and (magic? block)
                           block)))))))))
 
-(define (sub-bytevector bv start size)
-  "Return a copy of the SIZE bytes of BV starting from offset START."
-  (let ((result (make-bytevector size)))
-    (bytevector-copy! bv start result 0 size)
-    result))
-
-(define (latin1->string bv terminator)
-  "Return a string of BV, a latin1 bytevector, or #f.  TERMINATOR is a predicate
-that takes a number and returns #t when a termination character is found."
-    (let ((bytes (take-while (negate terminator) (bytevector->u8-list bv))))
-      (if (null? bytes)
-          #f
-          (list->string (map integer->char bytes)))))
-
 (define null-terminated-latin1->string
   (cut latin1->string <> zero?))
 
@@ -196,10 +172,6 @@ if DEVICE does not contain a btrfs file system."
 
 ;; <http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-107.pdf>.
 
-(define-syntax %fat32-endianness
-  ;; Endianness of fat file systems.
-  (identifier-syntax (endianness little)))
-
 (define (fat32-superblock? sblock)
   "Return #t when SBLOCK is a fat32 superblock."
   (bytevector=? (sub-bytevector sblock 82 8)
@@ -214,12 +186,6 @@ if DEVICE does not contain a btrfs file system."
   "Return the Volume ID of a fat superblock SBLOCK as a 4-byte bytevector."
   (sub-bytevector sblock 67 4))
 
-(define (fat32-uuid->string uuid)
-  "Convert fat32 UUID, a 4-byte bytevector, to its string representation."
-  (let ((high  (bytevector-uint-ref uuid 0 %fat32-endianness 2))
-        (low (bytevector-uint-ref uuid 2 %fat32-endianness 2)))
-    (format #f "~:@(~x-~x~)" low high)))
-
 (define (fat32-superblock-volume-name sblock)
   "Return the volume name of SBLOCK as a string of at most 11 characters, or
 #f if SBLOCK has no volume name.  The volume name is a latin1 string.
@@ -241,27 +207,6 @@ Trailing spaces are trimmed."
 
 ;; <http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-119.pdf>.
 
-(define %iso9660-uuid-rx
-  ;;                   Y                m                d                H                M                S                ss
-  (make-regexp "^([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})$"))
-
-(define (string->iso9660-uuid str)
-  "Parse STR as a ISO9660 UUID (which is really a timestamp - see /dev/disk/by-uuid).
-Return its contents as a 16-byte bytevector.  Return #f if STR is not a valid
-ISO9660 UUID representation."
-  (and=> (regexp-exec %iso9660-uuid-rx str)
-         (lambda (match)
-           (letrec-syntax ((match-numerals
-                            (syntax-rules ()
-                              ((_ index (name rest ...) body)
-                               (let ((name (match:substring match index)))
-                                 (match-numerals (+ 1 index) (rest ...) body)))
-                              ((_ index () body)
-                               body))))
-            (match-numerals 1 (year month day hour minute second hundredths)
-              (string->utf8 (string-append year month day
-                                           hour minute second hundredths)))))))
-
 (define (iso9660-superblock? sblock)
   "Return #t when SBLOCK is an iso9660 volume descriptor."
   (bytevector=? (sub-bytevector sblock 1 6)
@@ -308,20 +253,6 @@ SBLOCK as a bytevector.  If that's not set, returns the creation time."
                    modification-time)))
     (sub-bytevector time 0 16))) ; strips GMT offset.
 
-(define (iso9660-uuid->string uuid)
-  "Given an UUID bytevector, return its timestamp string."
-  (define (digits->string bytes)
-    (latin1->string bytes (lambda (c) #f)))
-  (let* ((year (sub-bytevector uuid 0 4))
-         (month (sub-bytevector uuid 4 2))
-         (day (sub-bytevector uuid 6 2))
-         (hour (sub-bytevector uuid 8 2))
-         (minute (sub-bytevector uuid 10 2))
-         (second (sub-bytevector uuid 12 2))
-         (hundredths (sub-bytevector uuid 14 2))
-         (parts (list year month day hour minute second hundredths)))
-    (string-append (string-join (map digits->string parts) "-"))))
-
 (define (iso9660-superblock-volume-name sblock)
   "Return the volume name of SBLOCK as a string.  The volume name is an ASCII
 string.  Trailing spaces are trimmed."
@@ -509,65 +440,6 @@ were found."
   (find-partition luks-partition-uuid-predicate))
 
 
-;;;
-;;; UUIDs.
-;;;
-
-(define-syntax %network-byte-order
-  (identifier-syntax (endianness big)))
-
-(define (uuid->string uuid)
-  "Convert UUID, a 16-byte bytevector, to its string representation, something
-like \"6b700d61-5550-48a1-874c-a3d86998990e\"."
-  ;; See <https://tools.ietf.org/html/rfc4122>.
-  (let ((time-low  (bytevector-uint-ref uuid 0 %network-byte-order 4))
-        (time-mid  (bytevector-uint-ref uuid 4 %network-byte-order 2))
-        (time-hi   (bytevector-uint-ref uuid 6 %network-byte-order 2))
-        (clock-seq (bytevector-uint-ref uuid 8 %network-byte-order 2))
-        (node      (bytevector-uint-ref uuid 10 %network-byte-order 6)))
-    (format #f "~8,'0x-~4,'0x-~4,'0x-~4,'0x-~12,'0x"
-            time-low time-mid time-hi clock-seq node)))
-
-(define %uuid-rx
-  ;; The regexp of a UUID.
-  (make-regexp "^([[:xdigit:]]{8})-([[:xdigit:]]{4})-([[:xdigit:]]{4})-([[:xdigit:]]{4})-([[:xdigit:]]{12})$"))
-
-(define (string->uuid str)
-  "Parse STR as a DCE UUID (see <https://tools.ietf.org/html/rfc4122>) and
-return its contents as a 16-byte bytevector.  Return #f if STR is not a valid
-UUID representation."
-  (and=> (regexp-exec %uuid-rx str)
-         (lambda (match)
-           (letrec-syntax ((hex->number
-                            (syntax-rules ()
-                              ((_ index)
-                               (string->number (match:substring match index)
-                                               16))))
-                           (put!
-                            (syntax-rules ()
-                              ((_ bv index (number len) rest ...)
-                               (begin
-                                 (bytevector-uint-set! bv index number
-                                                       (endianness big) len)
-                                 (put! bv (+ index len) rest ...)))
-                              ((_ bv index)
-                               bv))))
-             (let ((time-low  (hex->number 1))
-                   (time-mid  (hex->number 2))
-                   (time-hi   (hex->number 3))
-                   (clock-seq (hex->number 4))
-                   (node      (hex->number 5))
-                   (uuid      (make-bytevector 16)))
-               (put! uuid 0
-                     (time-low 4) (time-mid 2) (time-hi 2)
-                     (clock-seq 2) (node 6)))))))
-
-(define string->ext2-uuid string->uuid)
-(define string->ext3-uuid string->uuid)
-(define string->ext4-uuid string->uuid)
-(define string->btrfs-uuid string->uuid)
-
-
 (define* (canonicalize-device-spec spec #:optional (title 'any))
   "Return the device name corresponding to SPEC.  TITLE is a symbol, one of
 the following:
diff --git a/gnu/build/marionette.scm b/gnu/build/marionette.scm
index f35f0fbca1..7554a710a0 100644
--- a/gnu/build/marionette.scm
+++ b/gnu/build/marionette.scm
@@ -165,13 +165,14 @@ QEMU monitor and to the guest's backdoor REPL."
      (newline repl)
      (read repl))))
 
-(define* (wait-for-file file marionette #:key (timeout 10))
-  "Wait until FILE exists in MARIONETTE; 'read' its content and return it.  If
+(define* (wait-for-file file marionette
+                        #:key (timeout 10) (read 'read))
+  "Wait until FILE exists in MARIONETTE; READ its content and return it.  If
 FILE has not shown up after TIMEOUT seconds, raise an error."
   (match (marionette-eval
           `(let loop ((i ,timeout))
              (cond ((file-exists? ,file)
-                    (cons 'success (call-with-input-file ,file read)))
+                    (cons 'success (call-with-input-file ,file ,read)))
                    ((> i 0)
                     (sleep 1)
                     (loop (- i 1)))
diff --git a/gnu/build/vm.scm b/gnu/build/vm.scm
index 727494ad93..6da4fa654e 100644
--- a/gnu/build/vm.scm
+++ b/gnu/build/vm.scm
@@ -26,7 +26,7 @@
   #:use-module (guix build syscalls)
   #:use-module (gnu build linux-boot)
   #:use-module (gnu build install)
-  #:use-module (gnu build file-systems)
+  #:use-module (gnu system uuid)
   #:use-module (guix records)
   #:use-module ((guix combinators) #:select (fold2))
   #:use-module (ice-9 format)
@@ -163,6 +163,7 @@ the #:references-graphs parameter of 'derivation'."
   (size        partition-size)
   (file-system partition-file-system (default "ext4"))
   (label       partition-label (default #f))
+  (uuid        partition-uuid (default #f))
   (flags       partition-flags (default '()))
   (initializer partition-initializer (default (const #t))))
 
@@ -236,22 +237,26 @@ actual /dev name based on DEVICE."
 (define MS_BIND 4096)                             ; <sys/mounts.h> again!
 
 (define* (create-ext-file-system partition type
-                                 #:key label)
+                                 #:key label uuid)
   "Create an ext-family filesystem of TYPE on PARTITION.  If LABEL is true,
-use that as the volume name."
+use that as the volume name.  If UUID is true, use it as the partition UUID."
   (format #t "creating ~a partition...\n" type)
   (unless (zero? (apply system* (string-append "mkfs." type)
                         "-F" partition
-                        (if label
-                            `("-L" ,label)
-                            '())))
+                        `(,@(if label
+                                `("-L" ,label)
+                                '())
+                          ,@(if uuid
+                                `("-U" ,(uuid->string uuid))
+                                '()))))
     (error "failed to create partition")))
 
 (define* (create-fat-file-system partition
-                                 #:key label)
+                                 #:key label uuid)
   "Create a FAT filesystem on PARTITION.  The number of File Allocation Tables
 will be determined based on filesystem size.  If LABEL is true, use that as the
 volume name."
+  ;; FIXME: UUID is ignored!
   (format #t "creating FAT partition...\n")
   (unless (zero? (apply system* "mkfs.fat" partition
                         (if label
@@ -260,13 +265,13 @@ volume name."
     (error "failed to create FAT partition")))
 
 (define* (format-partition partition type
-                           #:key label)
+                           #:key label uuid)
   "Create a file system TYPE on PARTITION.  If LABEL is true, use that as the
 volume name."
   (cond ((string-prefix? "ext" type)
-         (create-ext-file-system partition type #:label label))
+         (create-ext-file-system partition type #:label label #:uuid uuid))
         ((or (string-prefix? "fat" type) (string= "vfat" type))
-         (create-fat-file-system partition #:label label))
+         (create-fat-file-system partition #:label label #:uuid uuid))
         (else (error "Unsupported file system."))))
 
 (define (initialize-partition partition)
@@ -275,7 +280,8 @@ it, run its initializer, and unmount it."
   (let ((target "/fs"))
    (format-partition (partition-device partition)
                      (partition-file-system partition)
-                     #:label (partition-label partition))
+                     #:label (partition-label partition)
+                     #:uuid (partition-uuid partition))
    (mkdir-p target)
    (mount (partition-device partition) target
           (partition-file-system partition))
@@ -366,18 +372,39 @@ SYSTEM-DIRECTORY is the name of the directory of the 'system' derivation."
       (error "failed to create GRUB EFI image"))))
 
 (define* (make-iso9660-image grub config-file os-drv target
-                             #:key (volume-id "GuixSD_image") (volume-uuid #f))
+                             #:key (volume-id "GuixSD_image") (volume-uuid #f)
+                             register-closures? (closures '()))
   "Given a GRUB package, creates an iso image as TARGET, using CONFIG-FILE as
 GRUB configuration and OS-DRV as the stuff in it."
-  (let ((grub-mkrescue (string-append grub "/bin/grub-mkrescue")))
+  (let ((grub-mkrescue (string-append grub "/bin/grub-mkrescue"))
+        (target-store  (string-append "/tmp/root" (%store-directory))))
     (mkdir-p "/tmp/root/var/run")
     (mkdir-p "/tmp/root/run")
+    (mkdir-p "/tmp/root/mnt")
+
+    (mkdir-p target-store)
+    (mount (%store-directory) target-store "" MS_BIND)
+
+    (when register-closures?
+      (display "registering closures...\n")
+      (for-each (lambda (closure)
+                  (register-closure
+                   "/tmp/root"
+                   (string-append "/xchg/" closure)
+                   ;; XXX: Using deduplication causes cross device link errors.
+                   #:deduplicate? #f))
+                closures))
+
     (unless (zero? (apply system*
                           `(,grub-mkrescue "-o" ,target
                             ,(string-append "boot/grub/grub.cfg=" config-file)
                             ,(string-append "gnu/store=" os-drv "/..")
                             "var=/tmp/root/var"
                             "run=/tmp/root/run"
+                            ;; /mnt is used as part of the installation
+                            ;; process, as the mount point for the target
+                            ;; filesystem, so create it.
+                            "mnt=/tmp/root/mnt"
                             "--"
                             ;; Store two copies of the headers.
                             ;; The resulting ISO-9660 image has a DOS MBR and
diff --git a/gnu/local.mk b/gnu/local.mk
index 26ecd068e5..3bdab4f886 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -88,6 +88,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/chez.scm				\
   %D%/packages/ci.scm				\
   %D%/packages/cmake.scm			\
+  %D%/packages/cobol.scm			\
   %D%/packages/code.scm				\
   %D%/packages/commencement.scm			\
   %D%/packages/compression.scm			\
@@ -363,6 +364,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/shells.scm			\
   %D%/packages/shellutils.scm			\
   %D%/packages/simh.scm				\
+  %D%/packages/simulation.scm			\
   %D%/packages/skarnet.scm			\
   %D%/packages/skribilo.scm			\
   %D%/packages/slang.scm			\
@@ -468,6 +470,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/system/nss.scm				\
   %D%/system/pam.scm				\
   %D%/system/shadow.scm				\
+  %D%/system/uuid.scm				\
   %D%/system/vm.scm				\
 						\
   %D%/build/activation.scm			\
@@ -487,6 +490,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/tests/audio.scm				\
   %D%/tests/base.scm				\
   %D%/tests/databases.scm			\
+  %D%/tests/desktop.scm				\
   %D%/tests/dict.scm				\
   %D%/tests/nfs.scm				\
   %D%/tests/install.scm				\
@@ -534,9 +538,9 @@ dist_patch_DATA =						\
   %D%/packages/patches/binutils-ld-new-dtags.patch		\
   %D%/packages/patches/binutils-loongson-workaround.patch	\
   %D%/packages/patches/blast+-fix-makefile.patch		\
+  %D%/packages/patches/bluez-CVE-2017-1000250.patch		\
   %D%/packages/patches/byobu-writable-status.patch		\
   %D%/packages/patches/cairo-CVE-2016-9082.patch			\
-  %D%/packages/patches/calibre-drop-unrar.patch			\
   %D%/packages/patches/calibre-no-updates-dialog.patch		\
   %D%/packages/patches/calibre-use-packaged-feedparser.patch	\
   %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
@@ -546,6 +550,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/ceph-disable-unittest-throttle.patch	\
   %D%/packages/patches/ceph-skip-collect-sys-info-test.patch	\
   %D%/packages/patches/ceph-skip-unittest_blockdev.patch	\
+  %D%/packages/patches/python-acme-dont-use-openssl-rand.patch	\
   %D%/packages/patches/chicken-CVE-2017-6949.patch		\
   %D%/packages/patches/chicken-CVE-2017-11343.patch		\
   %D%/packages/patches/chmlib-inttypes.patch			\
@@ -567,7 +572,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/crawl-upgrade-saves.patch		\
   %D%/packages/patches/crda-optional-gcrypt.patch		\
   %D%/packages/patches/crossmap-allow-system-pysam.patch	\
-  %D%/packages/patches/csound-header-ordering.patch		\
   %D%/packages/patches/clucene-contribs-lib.patch               \
   %D%/packages/patches/curl-bounds-check.patch			\
   %D%/packages/patches/cursynth-wave-rand.patch			\
@@ -590,6 +594,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
   %D%/packages/patches/emacs-scheme-complete-scheme-r5rs-info.patch	\
   %D%/packages/patches/emacs-source-date-epoch.patch		\
+  %D%/packages/patches/emacs-unsafe-enriched-mode-translations.patch	\
   %D%/packages/patches/erlang-man-path.patch			\
   %D%/packages/patches/eudev-rules-directory.patch		\
   %D%/packages/patches/evilwm-lost-focus-bug.patch		\
@@ -603,6 +608,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/fasthenry-spFactor.patch			\
   %D%/packages/patches/fcgi-2.4.0-gcc44-fixes.patch		\
   %D%/packages/patches/fcgi-2.4.0-poll.patch			\
+  %D%/packages/patches/file-CVE-2017-1000249.patch		\
   %D%/packages/patches/findutils-localstatedir.patch		\
   %D%/packages/patches/findutils-gnulib-multi-core.patch	\
   %D%/packages/patches/findutils-test-xargs.patch		\
@@ -610,6 +616,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/fltk-shared-lib-defines.patch		\
   %D%/packages/patches/fltk-xfont-on-demand.patch		\
   %D%/packages/patches/fontforge-svg-modtime.patch		\
+  %D%/packages/patches/foomatic-filters-CVE-2015-8327.patch	\
+  %D%/packages/patches/foomatic-filters-CVE-2015-8560.patch	\
   %D%/packages/patches/freeimage-CVE-2015-0852.patch		\
   %D%/packages/patches/freeimage-CVE-2016-5684.patch		\
   %D%/packages/patches/freeimage-fix-build-with-gcc-5.patch	\
@@ -672,11 +680,14 @@ dist_patch_DATA =						\
   %D%/packages/patches/gobject-introspection-absolute-shlib-path.patch \
   %D%/packages/patches/gobject-introspection-cc.patch		\
   %D%/packages/patches/gobject-introspection-girepository.patch	\
+  %D%/packages/patches/graphicsmagick-CVE-2017-11403+CVE-2017-14103.patch	\
   %D%/packages/patches/graphicsmagick-CVE-2017-12935.patch	\
   %D%/packages/patches/graphicsmagick-CVE-2017-12936.patch	\
   %D%/packages/patches/graphicsmagick-CVE-2017-12937.patch	\
   %D%/packages/patches/graphicsmagick-CVE-2017-13775.patch	\
   %D%/packages/patches/graphicsmagick-CVE-2017-13776+CVE-2017-13777.patch	\
+  %D%/packages/patches/graphicsmagick-CVE-2017-14042.patch	\
+  %D%/packages/patches/graphicsmagick-CVE-2017-14165.patch	\
   %D%/packages/patches/graphite2-ffloat-store.patch		\
   %D%/packages/patches/grep-gnulib-lock.patch                   \
   %D%/packages/patches/grep-timing-sensitive-test.patch		\
@@ -713,6 +724,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/heimdal-CVE-2017-11103.patch		\
   %D%/packages/patches/hmmer-remove-cpu-specificity.patch	\
   %D%/packages/patches/higan-remove-march-native-flag.patch	\
+  %D%/packages/patches/httpd-CVE-2017-9798.patch		\
   %D%/packages/patches/hubbub-sort-entities.patch		\
   %D%/packages/patches/hurd-fix-eth-multiplexer-dependency.patch        \
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
@@ -752,6 +764,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/liba52-link-with-libm.patch		\
   %D%/packages/patches/liba52-set-soname.patch			\
   %D%/packages/patches/liba52-use-mtune-not-mcpu.patch		\
+  %D%/packages/patches/libarchive-CVE-2017-14166.patch		\
   %D%/packages/patches/libbase-fix-includes.patch		\
   %D%/packages/patches/libbase-use-own-logging.patch		\
   %D%/packages/patches/libbonobo-activation-test-race.patch	\
@@ -812,7 +825,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/libxslt-generated-ids.patch		\
   %D%/packages/patches/libxslt-CVE-2016-4738.patch		\
   %D%/packages/patches/libxt-guix-search-paths.patch		\
-  %D%/packages/patches/libzip-CVE-2017-12858.patch		\
   %D%/packages/patches/lierolibre-check-unaligned-access.patch	\
   %D%/packages/patches/lierolibre-is-free-software.patch	\
   %D%/packages/patches/lierolibre-newer-libconfig.patch		\
@@ -845,6 +857,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/mcrypt-CVE-2012-4527.patch			\
   %D%/packages/patches/mesa-skip-disk-cache-test.patch		\
   %D%/packages/patches/mesa-wayland-egl-symbols-check-mips.patch	\
+  %D%/packages/patches/meson-for-build-rpath.patch		\
   %D%/packages/patches/metabat-fix-compilation.patch		\
   %D%/packages/patches/mhash-keygen-test-segfault.patch		\
   %D%/packages/patches/mingw-w64-5.0rc2-gcc-4.9.3.patch		\
@@ -869,6 +882,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/netsurf-y2038-tests.patch		\
   %D%/packages/patches/netsurf-longer-test-timeout.patch	\
   %D%/packages/patches/newsbeuter-CVE-2017-12904.patch		\
+  %D%/packages/patches/newsbeuter-CVE-2017-14500.patch		\
   %D%/packages/patches/ngircd-handle-zombies.patch		\
   %D%/packages/patches/ninja-zero-mtime.patch			\
   %D%/packages/patches/nss-increase-test-timeout.patch		\
@@ -885,9 +899,13 @@ dist_patch_DATA =						\
   %D%/packages/patches/ola-readdir-r.patch			\
   %D%/packages/patches/openscenegraph-ffmpeg3.patch             \
   %D%/packages/patches/openexr-missing-samples.patch		\
+  %D%/packages/patches/openfoam-4.1-cleanup.patch			\
   %D%/packages/patches/openjpeg-CVE-2017-12982.patch		\
   %D%/packages/patches/openjpeg-CVE-2017-14040.patch		\
   %D%/packages/patches/openjpeg-CVE-2017-14041.patch		\
+  %D%/packages/patches/openjpeg-CVE-2017-14151.patch		\
+  %D%/packages/patches/openjpeg-CVE-2017-14152.patch		\
+  %D%/packages/patches/openjpeg-CVE-2017-14164.patch		\
   %D%/packages/patches/openldap-CVE-2017-9287.patch		\
   %D%/packages/patches/openocd-nrf52.patch			\
   %D%/packages/patches/openssl-runpath.patch			\
@@ -976,6 +994,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \
   %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch	\
   %D%/packages/patches/python2-subprocess32-disable-input-test.patch	\
+  %D%/packages/patches/qemu-CVE-2017-13711.patch		\
+  %D%/packages/patches/qemu-CVE-2017-14167.patch		\
   %D%/packages/patches/qt4-ldflags.patch			\
   %D%/packages/patches/qtscript-disable-tests.patch		\
   %D%/packages/patches/quagga-reproducible-build.patch          \
@@ -994,10 +1014,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/rsem-makefile.patch			\
   %D%/packages/patches/ruby-concurrent-ignore-broken-test.patch	\
   %D%/packages/patches/ruby-concurrent-test-arm.patch		\
-  %D%/packages/patches/ruby-rubygems-2612-ruby24.patch		\
-  %D%/packages/patches/ruby-rubygems-2613-ruby24.patch		\
-  %D%/packages/patches/ruby-2.2.7-rubygems-2613-ruby22.patch	\
-  %D%/packages/patches/ruby-2.3.4-rubygems-2613-ruby23.patch	\
   %D%/packages/patches/ruby-rack-ignore-failing-test.patch      \
   %D%/packages/patches/ruby-tzinfo-data-ignore-broken-test.patch\
   %D%/packages/patches/rxvt-unicode-escape-sequences.patch	\
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index ea71de6f57..8e98174f47 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -661,14 +661,14 @@ network statistics collection, security monitoring, network debugging, etc.")
 (define-public tcpdump
   (package
     (name "tcpdump")
-    (version "4.9.1")
+    (version "4.9.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://www.tcpdump.org/release/tcpdump-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1wyqbg7bkmgqyslf1ns0xx9fcqi66hvcfm9nf77rl15jvvs8qi7r"))))
+                "0ygy0layzqaj838r5xd613iraz09wlfgpyh7pc6cwclql8v3b2vr"))))
     (build-system gnu-build-system)
     (inputs `(("libpcap" ,libpcap)
               ("openssl" ,openssl)))
@@ -818,7 +818,7 @@ system administrator.")
 (define-public sudo
   (package
     (name "sudo")
-    (version "1.8.20p2")
+    (version "1.8.21p2")
     (source (origin
               (method url-fetch)
               (uri
@@ -828,7 +828,7 @@ system administrator.")
                                     version ".tar.gz")))
               (sha256
                (base32
-                "1na5likm1srnd1g5sjx7b0543sczw0yppacyqsazfdg9b48awhmx"))
+                "0s33szq6q59v5s377l4v6ybsdy7pfq6sz7y364j4x09ssdn79ibl"))
               (modules '((guix build utils)))
               (snippet
                '(delete-file-recursively "lib/zlib"))))
@@ -871,7 +871,8 @@ system administrator.")
                 "$(TMPDIR)/dummy")
                (("\\$\\(DESTDIR\\)\\$\\(vardir\\)")
                 ;; Don't try to create /var/db/sudo.
-                "$(TMPDIR)/dummy")))))
+                "$(TMPDIR)/dummy"))
+             #t)))
 
        ;; XXX: The 'testsudoers' test series expects user 'root' to exist, but
        ;; the chroot's /etc/passwd doesn't have it.  Turn off the tests.
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index e27c13bed4..1b7950cf00 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -568,23 +568,17 @@ emulation (valve, tape), bit fiddling (decimator, pointer-cast), etc.")
 (define-public csound
   (package
     (name "csound")
-    (version "6.05")
+    (version "6.09.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "mirror://sourceforge/csound/csound6/Csound"
-                    version "/Csound" version ".tar.gz"))
+                    "https://github.com/csound/csound/archive/"
+                    version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0a1sni6lr7qpwywpggbkp0ia3h9bwwgf9i87gsag8ra2h30v82hd"))
-              (patches (search-patches "csound-header-ordering.patch"))))
+                "0f67vyy3r29hn26qkkcwnizrnzzy8p7gmg3say5q3wjhxns3b5yl"))))
     (build-system cmake-build-system)
-    (arguments
-     ;; Work around this error on x86_64 with libc 2.22+:
-     ;;    libmvec.so.1: error adding symbols: DSO missing from command line
-     (if (string-prefix? "x86_64" (or (%current-target-system) (%current-system)))
-         '(#:configure-flags '("-DCMAKE_EXE_LINKER_FLAGS=-lmvec"))
-         '()))
     (inputs
      `(("alsa-lib" ,alsa-lib)
        ("boost" ,boost)
diff --git a/gnu/packages/backup.scm b/gnu/packages/backup.scm
index eca69bebed..006d00ef0c 100644
--- a/gnu/packages/backup.scm
+++ b/gnu/packages/backup.scm
@@ -184,6 +184,7 @@ backups (called chunks) to allow easy burning to CD/DVD.")
 (define-public libarchive
   (package
     (name "libarchive")
+    (replacement libarchive-3.3.2)
     (version "3.3.1")
     (source
      (origin
@@ -239,19 +240,19 @@ archive.  In particular, note that there is currently no built-in support for
 random access nor for in-place modification.")
     (license license:bsd-2)))
 
-(define libarchive-3.3.1
+(define libarchive-3.3.2
   (package
     (inherit libarchive)
-    (name "libarchive")
-    (version "3.3.1")
+    (version "3.3.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://libarchive.org/downloads/libarchive-"
                            version ".tar.gz"))
+       (patches (search-patches "libarchive-CVE-2017-14166.patch"))
        (sha256
         (base32
-         "1rr40hxlm9vy5z2zb5w7pyfkgd1a4s061qapm83s19accb8mpji9"))))))
+         "1km0mzfl6in7l5vz9kl09a88ajx562rw93ng9h2jqavrailvsbgd"))))))
 
 (define-public rdup
   (package
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index 1ccff1fcf5..972ffeeecb 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -394,6 +394,7 @@ change.  GNU make offers many powerful extensions over the standard utility.")
 
 (define-public binutils
   (package
+   (replacement binutils/fixed)
    (name "binutils")
    (version "2.28")
    (source (origin
@@ -435,6 +436,19 @@ included.")
    (license gpl3+)
    (home-page "https://www.gnu.org/software/binutils/")))
 
+(define binutils/fixed
+  (package
+    (inherit binutils)
+    ;; 2.28.1 is two characters longer than 2.28, so grafting fails due to
+    ;; mismatched lengths of filenames, so we have to force  it to the same length.
+    (version "2281")
+    (source
+      (origin (inherit (package-source binutils))
+              (uri "mirror://gnu/binutils/binutils-2.28.1.tar.bz2")
+              (sha256
+               (base32
+                "1sj234nd05cdgga1r36zalvvdkvpfbr12g5mir2n8i1dwsdrj939"))))))
+
 (define* (make-ld-wrapper name #:key
                           (target (const #f))
                           binutils
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 5e8eef4e1c..33b58f44bc 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -4486,7 +4486,7 @@ distribution, coverage uniformity, strand specificity, etc.")
                        "Data2DB"
                        "PCL2Bin")))
            (modify-phases %standard-phases
-             (add-after 'unpack 'bootstrap
+             (add-before 'configure 'bootstrap
                (lambda _
                  (zero? (system* "bash" "gen_auto"))))
              (add-after 'build 'build-additional-tools
@@ -6137,6 +6137,29 @@ data.  It is derived from the UCSC hg19 genome and based on the \"knownGene\"
 track.  The database is exposed as a @code{TxDb} object.")
     (license license:artistic2.0)))
 
+(define-public r-sparql
+  (package
+  (name "r-sparql")
+  (version "1.16")
+  (source (origin
+           (method url-fetch)
+           (uri (cran-uri "SPARQL" version))
+           (sha256
+            (base32
+             "0gak1q06yyhdmcxb2n3v0h9gr1vqd0viqji52wpw211qp6r6dcrc"))))
+  (properties `((upstream-name . "SPARQL")))
+  (build-system r-build-system)
+  (propagated-inputs
+   `(("r-rcurl" ,r-rcurl)
+     ("r-xml" ,r-xml)))
+  (home-page "http://cran.r-project.org/web/packages/SPARQL")
+  (synopsis "SPARQL client for R")
+  (description "This package provides an interface to use SPARQL to pose
+SELECT or UPDATE queries to an end-point.")
+  ;; The only license indication is found in the DESCRIPTION file,
+  ;; which states GPL-3.  So we cannot assume GPLv3+.
+  (license license:gpl3)))
+
 (define-public vsearch
   (package
     (name "vsearch")
@@ -8001,7 +8024,7 @@ paired-end data.")
 (define-public r-rcas
   (package
     (name "r-rcas")
-    (version "1.3.3")
+    (version "1.3.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/BIMSBbioinfo/RCAS/archive/v"
@@ -8009,7 +8032,7 @@ paired-end data.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "19mk7vkbngmch54kzcxb52161ljfchhjsaanza8iwv5h98sjj66d"))))
+                "1qgc7vi6fpzl440yg7jhiycg5q336kd4pxqzx10yx2zcq3bq3msg"))))
     (build-system r-build-system)
     (native-inputs
      `(("r-knitr" ,r-knitr)
@@ -8030,6 +8053,7 @@ paired-end data.")
        ("r-bsgenome-dmelanogaster-ucsc-dm3" ,r-bsgenome-dmelanogaster-ucsc-dm3)
        ("r-topgo" ,r-topgo)
        ("r-dt" ,r-dt)
+       ("r-pbapply" ,r-pbapply)
        ("r-plotly" ,r-plotly)
        ("r-plotrix" ,r-plotrix)
        ("r-motifrg" ,r-motifrg)
diff --git a/gnu/packages/bootloaders.scm b/gnu/packages/bootloaders.scm
index f66d0bb3f4..613537a5d1 100644
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@@ -395,3 +395,72 @@ also initializes the boards (RAM etc).")
 
 (define-public u-boot-odroid-c2
   (make-u-boot-package "odroid-c2" "aarch64-linux-gnu"))
+
+(define-public os-prober
+  (package
+    (name "os-prober")
+    (version "1.76")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://debian/pool/main/o/os-prober/os-prober_"
+                           version ".tar.xz"))
+       (sha256
+        (base32
+         "1vb45i76bqivlghrq7m3n07qfmmq4wxrkplqx8gywj011rhq19fk"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:modules ((guix build gnu-build-system)
+                  (guix build utils)
+                  (ice-9 regex)   ; for string-match
+                  (srfi srfi-26)) ; for cut
+       #:make-flags (list "CC=gcc")
+       #:tests? #f ; no tests
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* (find-files ".")
+               (("/usr") (assoc-ref outputs "out")))
+             (substitute* (find-files "." "50mounted-tests$")
+               (("mkdir") "mkdir -p"))
+             #t))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (define (find-files-non-recursive directory)
+               (find-files directory
+                           (lambda (file stat)
+                             (string-match (string-append "^" directory "/[^/]*$")
+                                           file))
+                           #:directories? #t))
+
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin"))
+                    (lib (string-append out "/lib"))
+                    (share (string-append out "/share")))
+               (for-each (cut install-file <> bin)
+                         (list "linux-boot-prober" "os-prober"))
+               (install-file "newns" (string-append lib "/os-prober"))
+               (install-file "common.sh" (string-append share "/os-prober"))
+               (install-file "os-probes/mounted/powerpc/20macosx"
+                             (string-append lib "/os-probes/mounted"))
+               (for-each
+                (lambda (directory)
+                  (for-each
+                   (lambda (file)
+                     (let ((destination (string-append lib "/" directory
+                                                       "/" (basename file))))
+                       (mkdir-p (dirname destination))
+                       (copy-recursively file destination)))
+                   (append (find-files-non-recursive (string-append directory "/common"))
+                           (find-files-non-recursive (string-append directory "/x86")))))
+                (list "os-probes" "os-probes/mounted" "os-probes/init"
+                      "linux-boot-probes" "linux-boot-probes/mounted"))
+               #t))))))
+    (home-page "https://joeyh.name/code/os-prober")
+    (synopsis "Detect other operating systems")
+    (description "os-prober probes disks on the system for other operating
+systems so that they can be added to the bootloader.  It also works out how to
+boot existing GNU/Linux systems and detects what distribution is installed in
+order to add a suitable bootloader menu entry.")
+    (license license:gpl2+)))
diff --git a/gnu/packages/build-tools.scm b/gnu/packages/build-tools.scm
index 353c9c8efb..c535f52400 100644
--- a/gnu/packages/build-tools.scm
+++ b/gnu/packages/build-tools.scm
@@ -70,7 +70,7 @@ makes a few sacrifices to acquire fast full and incremental build times.")
 (define-public meson
   (package
     (name "meson")
-    (version "0.41.1")
+    (version "0.42.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/mesonbuild/meson/"
@@ -78,9 +78,10 @@ makes a few sacrifices to acquire fast full and incremental build times.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "12ygjh1dxi8z06nl704rfb6zj0m2zjqp279nymfgzfgy5zq032d4"))))
+                "0vyp9rkymzzzilhnf04ryszslyp9a0y0wf4agyijd4w5lcnqlcbc"))))
     (build-system python-build-system)
     (inputs `(("ninja", ninja)))
+    (propagated-inputs `(("python" ,python)))
     (home-page "https://mesonbuild.com/")
     (synopsis "Build system designed to be fast and user-friendly")
     (description
@@ -92,6 +93,24 @@ files}, are written in a custom domain-specific language (DSL) that resembles
 Python.")
     (license license:asl2.0)))
 
+(define-public meson-for-build
+  (package
+    (inherit meson)
+    (name "meson-for-build")
+    (version "0.42.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/mesonbuild/meson/"
+                                  "archive/" version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0vyp9rkymzzzilhnf04ryszslyp9a0y0wf4agyijd4w5lcnqlcbc"))
+              (patches (search-patches "meson-for-build-rpath.patch"))))
+
+    ;; People should probably install "meson", not "meson-for-build".
+    (properties `((hidden? . #t)))))
+
 (define-public premake4
   (package
     (name "premake")
diff --git a/gnu/packages/cdrom.scm b/gnu/packages/cdrom.scm
index 704e8ad36d..2f708f0c0b 100644
--- a/gnu/packages/cdrom.scm
+++ b/gnu/packages/cdrom.scm
@@ -147,14 +147,14 @@ libcdio.")
 (define-public xorriso
   (package
     (name "xorriso")
-    (version "1.4.6")
+    (version "1.4.8")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/xorriso/xorriso-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "112p0ghwzxrcjbsir1n2jxhq103ckrw93wzvd55qqvzfgs674vsj"))))
+               "10c44yr3dpmwxa7rf23mwfsy1bahny3jpcg9ig0xjv090jg0d0pc"))))
     (build-system gnu-build-system)
     (inputs
      `(("acl" ,acl)
diff --git a/gnu/packages/certs.scm b/gnu/packages/certs.scm
index 31ffa54d87..6c2ea4c6ec 100644
--- a/gnu/packages/certs.scm
+++ b/gnu/packages/certs.scm
@@ -74,7 +74,7 @@
 (define-public nss-certs
   (package
     (name "nss-certs")
-    (version "3.32")
+    (version "3.33")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -85,7 +85,7 @@
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "0dfkgvah0ji8b8lpxyy2w0b3lyz5ldmryii4z7j2bfwnrj0z7iim"))))
+                "1r44qa4j7sri50mxxbnrpm6fxprwrhv76whi7bfq73j06syxmw4q"))))
     (build-system gnu-build-system)
     (outputs '("out"))
     (native-inputs
diff --git a/gnu/packages/check.scm b/gnu/packages/check.scm
index f978ef3055..4d9090397f 100644
--- a/gnu/packages/check.scm
+++ b/gnu/packages/check.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox.org>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2017 Kei Kebreau <kkebreau@posteo.net>
+;;; Copyright © 2017 ng0 <ng0@infotropique.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -269,3 +270,26 @@ normally do not detect.  The goal is to detect only real errors in the code
 discovery, death tests, assertions, parameterized tests and XML test report
 generation.")
     (license bsd-3)))
+
+(define-public cpputest
+  (package
+    (name "cpputest")
+    (version "3.8")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/cpputest/cpputest/releases/download/v"
+                           version "/cpputest-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0mk48xd3klyqi7wf3f4wn4zqxxzmvrhhl32r25jzrixzl72wq7f8"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("googletest" ,googletest)))
+    (home-page "https://cpputest.github.io/")
+    (synopsis "Unit testing and mocking framework for C/C++")
+    (description
+     "CppUTest is a C/C++ based unit xUnit test framework.  It is written in
+C++ but is used in C and C++ projects and frequently used in embedded systems
+but it works for any C/C++ project.")
+    (license bsd-3)))
diff --git a/gnu/packages/ci.scm b/gnu/packages/ci.scm
index c449754be8..78d6e9514f 100644
--- a/gnu/packages/ci.scm
+++ b/gnu/packages/ci.scm
@@ -187,8 +187,8 @@ their dependencies.")
       (license l:gpl3+))))
 
 (define-public cuirass
-  (let ((commit "6f85bc04f31ae5853ceaa0bb3e1dedfe8412a189")
-        (revision "7"))
+  (let ((commit "87ad259dba7de38b6e3ab954cd7b2f655358d877")
+        (revision "8"))
     (package
       (name "cuirass")
       (version (string-append "0.0.1-" revision "." (string-take commit 7)))
@@ -200,7 +200,7 @@ their dependencies.")
                 (file-name (string-append name "-" version))
                 (sha256
                  (base32
-                  "1dglsa23z21m1s70420ar73qmg39fvdvwlz9xjz6lfp5s9mgzx15"))))
+                  "127pvbxbh6b6ar43cdgia9qpzzpldq4wm3igsxb1ycxfsdqnjrnz"))))
       (build-system gnu-build-system)
       (arguments
        '(#:modules ((guix build utils)
@@ -216,7 +216,12 @@ their dependencies.")
                (substitute* "Makefile.am"
                  (("tests/repo.scm \\\\") "\\"))
                #t))
-           (add-after 'disable-repo-tests 'bootstrap
+           (add-after 'disable-repo-tests 'patch-/bin/sh
+             (lambda _
+               (substitute* "build-aux/git-version-gen"
+                 (("#!/bin/sh") (string-append "#!" (which "sh"))))
+               #t))
+           (add-after 'patch-/bin/sh 'bootstrap
              (lambda _ (zero? (system* "sh" "bootstrap"))))
            (add-after 'install 'wrap-program
              (lambda* (#:key inputs outputs #:allow-other-keys)
diff --git a/gnu/packages/cobol.scm b/gnu/packages/cobol.scm
new file mode 100644
index 0000000000..f8f35928a7
--- /dev/null
+++ b/gnu/packages/cobol.scm
@@ -0,0 +1,59 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages cobol)
+  #:use-module (gnu packages)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix licenses)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (gnu packages databases)
+  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages ncurses))
+
+(define-public gnucobol
+  (package
+    (name "gnucobol")
+    (version "2.2")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append
+               "mirror://gnu/gnucobol/gnucobol-"
+               version ".tar.xz"))
+        (sha256
+         (base32
+          "1814s1n95xax2dz938cf4fkcp0q94nkj1gjbdblbzpk9q92zq66w"))))
+    (arguments
+     '(#:configure-flags (list (string-append "LDFLAGS=-Wl,-rpath="
+                                              (assoc-ref %outputs "out")
+                                              "/lib"))))
+    (inputs
+     `(("bdb" ,bdb)
+       ("gmp" ,gmp)
+       ("ncurses" ,ncurses)))
+    (build-system gnu-build-system)
+    (home-page "https://savannah.gnu.org/projects/gnucobol/")
+    (synopsis "A modern COBOL compiler")
+    (description "GnuCOBOL is a free, modern COBOL compiler.  GnuCOBOL
+implements a substantial part of the COBOL 85, COBOL 2002 and COBOL 2014
+standards and X/Open COBOL, as well as many extensions included in other
+COBOL compilers (IBM COBOL, MicroFocus COBOL, ACUCOBOL-GT and others).
+GnuCOBOL translates COBOL into C and compiles the translated code using
+a native C compiler.")
+    (license gpl3+)))
diff --git a/gnu/packages/code.scm b/gnu/packages/code.scm
index fa9e19db7d..6e04739f62 100644
--- a/gnu/packages/code.scm
+++ b/gnu/packages/code.scm
@@ -193,16 +193,16 @@ COCOMO model or user-provided parameters.")
 (define-public cloc
   (package
     (name "cloc")
-    (version "1.72")
+    (version "1.74")
     (source
      (origin
        (method url-fetch)
        (uri (string-append
-             "https://github.com/AlDanial/cloc/releases/download/v" version
+             "https://github.com/AlDanial/cloc/releases/download/" version
              "/cloc-" version ".tar.gz"))
        (sha256
         (base32
-         "1gl7bxb4bi6pms0zzl133pzpfypvz57hk2cw7yf6rvs8b48kilnz"))))
+         "0rq5xfiln1wlv3yr9mg18ax4gskbss786iqaf0v45iv6awyl5b2m"))))
     (build-system gnu-build-system)
     (inputs
      `(("coreutils" ,coreutils)
@@ -241,7 +241,7 @@ of source code in many programming languages.  Given two versions of a code
 base, cloc can compute differences in blank, comment, and source lines.
 
 cloc contains code from David Wheeler's SLOCCount.  Compared to SLOCCount,
-cloc can handle a greater variety of programming langauges.")
+cloc can handle a greater variety of programming languages.")
     (license license:gpl2+)))
 
 (define-public the-silver-searcher
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 2b67881ede..ec7677814f 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015, 2017 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -112,8 +113,7 @@
 
 (define file-boot0
   (package-with-bootstrap-guile
-   (package-with-explicit-inputs (package
-                                   (inherit file)
+   (package-with-explicit-inputs (package/inherit file
                                    (name "file-boot0"))
                                  `(("make" ,gnu-make-boot0)
                                    ,@%bootstrap-inputs)
@@ -140,7 +140,7 @@
 
 (define binutils-boot0
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (name "binutils-cross-boot0")
      (arguments
       `(#:guile ,%bootstrap-guile
@@ -668,7 +668,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
 
 (define binutils-final
   (package-with-bootstrap-guile
-   (package (inherit binutils)
+   (package/inherit binutils
      (arguments
       `(#:guile ,%bootstrap-guile
         #:implicit-inputs? #f
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index b6cbfee584..c96c51a346 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -1542,22 +1542,24 @@ manipulate, read, and write Zip archive files.")
 (define-public libzip
   (package
     (name "libzip")
-    (version "1.2.0")
+    (version "1.3.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "https://nih.at/libzip/libzip-" version ".tar.gz"))
-              (patches (search-patches "libzip-CVE-2017-12858.patch"))
+                    "https://nih.at/libzip/libzip-" version ".tar.xz"))
               (sha256
                (base32
-                "17vxj2ffsxwh8lkc6801ppmwj15jp8q58rin76znxfbx88789ybc"))))
+                "0wykw0q9dwdzx0gssi2dpgckx9ggr2spzc1amjnff6wi6kz6x4xa"))))
     (arguments
-     `(#:phases
+     '(#:phases
        (modify-phases %standard-phases
-         (add-before 'configure 'patch-perl
+         (add-after 'build 'remove-failing-tests
+           ;; These tests are known to fail on 32-bit architectures.
+           ;; see thread: https://nih.at/listarchive/libzip-discuss/msg00713.html
            (lambda _
-             (substitute* "regress/runtest.in"
-               (("/usr/bin/env perl") (which "perl"))))))))
+             (substitute* "regress/Makefile"
+               (("encryption-nonrandom") "#encryption-nonrandom"))
+             #t)))))
     (native-inputs
      `(("perl" ,perl)))
     (inputs
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 80335c4686..409894e5d6 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -23,6 +23,7 @@
   #:use-module (guix utils)
   #:use-module (guix build-system r)
   #:use-module (gnu packages gcc)
+  #:use-module (gnu packages machine-learning)
   #:use-module (gnu packages maths)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages statistics)
@@ -851,14 +852,14 @@ data).  Weighted versions of MLE, MME and QME are available.")
 (define-public r-energy
   (package
     (name "r-energy")
-    (version "1.7-0")
+    (version "1.7-2")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "energy" version))
        (sha256
         (base32
-         "1g4hqi6mgsnd1w4q7dd2m40ljh2jdmvad91ksbq9fscnrqpvji1x"))))
+         "19c7bgjnm4ggf7w5mk64c5shkma3sa9wc8x117iqv7pk1bvvyy3p"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-boot" ,r-boot)
@@ -928,3 +929,288 @@ sampling from populations, given the observed tie pattern.  Except for Steel's
 test and the JT test it also combines these tests across several blocks of
 samples.")
     (license license:gpl2+)))
+
+(define-public r-cvst
+  (package
+    (name "r-cvst")
+    (version "0.2-1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "CVST" version))
+       (sha256
+        (base32
+         "17xacyi8cf37rr2xswx96qy7pwkaqq394awdlswykz3qlyzx4zx2"))))
+    (properties `((upstream-name . "CVST")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-kernlab" ,r-kernlab)
+       ("r-matrix" ,r-matrix)))
+    (home-page "http://cran.r-project.org/web/packages/CVST")
+    (synopsis "Fast cross-validation via sequential testing")
+    (description
+     "This package implements the fast cross-validation via sequential
+testing (CVST) procedure.  CVST is an improved cross-validation procedure
+which uses non-parametric testing coupled with sequential analysis to
+determine the best parameter set on linearly increasing subsets of the data.
+Additionally to the CVST the package contains an implementation of the
+ordinary k-fold cross-validation with a flexible and powerful set of helper
+objects and methods to handle the overall model selection process.  The
+implementations of the Cochran's Q test with permutations and the sequential
+testing framework of Wald are generic and can therefore also be used in other
+contexts.")
+    (license license:gpl2+)))
+
+(define-public r-lava
+  (package
+    (name "r-lava")
+    (version "1.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "lava" version))
+       (sha256
+        (base32
+         "0x6s7x111x87a4rh5nbk7vw6j4iq40i1c21w0j795h28rgyc7zc2"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-numderiv" ,r-numderiv)
+       ("r-survival" ,r-survival)))
+    (home-page "https://github.com/kkholst/lava")
+    (synopsis "Latent variable models")
+    (description
+     "This package provides tools for the estimation and simulation of latent
+variable models.")
+    (license license:gpl3)))
+
+(define-public r-drr
+  (package
+    (name "r-drr")
+    (version "0.0.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "DRR" version))
+       (sha256
+        (base32
+         "1scfwp6ry6apxzqjclsmn2frxp9qfw6zxsxn5w0j0q3sz42hz1h2"))))
+    (properties `((upstream-name . "DRR")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-cvst" ,r-cvst)
+       ("r-kernlab" ,r-kernlab)
+       ("r-matrix" ,r-matrix)))
+    (home-page "http://cran.r-project.org/web/packages/DRR")
+    (synopsis "Dimensionality reduction via regression")
+    (description
+     "This package provides an implementation of dimensionality reduction via
+regression using Kernel Ridge Regression.")
+    (license license:gpl3)))
+
+(define-public r-prodlim
+  (package
+    (name "r-prodlim")
+    (version "1.6.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "prodlim" version))
+       (sha256
+        (base32
+         "0m51rkivx1zr6whdqwj66jpnkmp4385m06kkha3dp8qqf4jna9iz"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-kernsmooth" ,r-kernsmooth)
+       ("r-lava" ,r-lava)
+       ("r-rcpp" ,r-rcpp)
+       ("r-survival" ,r-survival)))
+    (home-page "http://cran.r-project.org/web/packages/prodlim")
+    (synopsis "Product-limit estimation for censored event history analysis")
+    (description
+     "This package provides a fast and user-friendly implementation of
+nonparametric estimators for censored event history (survival) analysis with
+the Kaplan-Meier and Aalen-Johansen methods.")
+    (license license:gpl2+)))
+
+(define-public r-dimred
+  (package
+    (name "r-dimred")
+    (version "0.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "dimRed" version))
+       (sha256
+        (base32
+         "0fasca5fsbrxdwv30hch7vb9snb844l7l8p5fjf239dq45xfy37v"))))
+    (properties `((upstream-name . "dimRed")))
+    (build-system r-build-system)
+    (propagated-inputs `(("r-drr" ,r-drr)))
+    (home-page "https://github.com/gdkrmr/dimRed")
+    (synopsis "Framework for dimensionality reduction")
+    (description
+     "This package provides a collection of dimensionality reduction
+techniques from R packages and provides a common interface for calling the
+methods.")
+    (license license:gpl3)))
+
+(define-public r-timedate
+  (package
+    (name "r-timedate")
+    (version "3012.100")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "timeDate" version))
+       (sha256
+        (base32
+         "0cn4h23y2y2bbg62qgm79xx4cvfla5xbpmi9hbdvkvpmm5yfyqk2"))))
+    (properties `((upstream-name . "timeDate")))
+    (build-system r-build-system)
+    (home-page "https://www.rmetrics.org")
+    (synopsis "Chronological and calendar objects")
+    (description
+     "This package provides an environment for teaching \"Financial
+Engineering and Computational Finance\" and for managing chronological and
+calendar objects.")
+    (license license:gpl2+)))
+
+(define-public r-ddalpha
+  (package
+    (name "r-ddalpha")
+    (version "1.2.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "ddalpha" version))
+       (sha256
+        (base32
+         "0nsd515x6bap1qpfyx141hyldmpmyasnhv0f8s9dj6zcklp89af4"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-bh" ,r-bh)
+       ("r-class" ,r-class)
+       ("r-mass" ,r-mass)
+       ("r-rcpp" ,r-rcpp)
+       ("r-robustbase" ,r-robustbase)))
+    (home-page "http://cran.r-project.org/web/packages/ddalpha")
+    (synopsis "Depth-Based classification and calculation of data depth")
+    (description
+     "This package contains procedures for depth-based supervised learning,
+which are entirely non-parametric, in particular the DDalpha-procedure (Lange,
+Mosler and Mozharovskyi, 2014).  The training data sample is transformed by a
+statistical depth function to a compact low-dimensional space, where the final
+classification is done.  It also offers an extension to functional data and
+routines for calculating certain notions of statistical depth functions.  50
+multivariate and 5 functional classification problems are included.")
+    (license license:gpl2)))
+
+(define-public r-gower
+  (package
+    (name "r-gower")
+    (version "0.1.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "gower" version))
+       (sha256
+        (base32
+         "1mbrj1lam3jfbby2j32shmmj5cn09zx3rkxbamq7q8sdg39b54gb"))))
+    (build-system r-build-system)
+    (native-inputs
+     `(("r-knitr" ,r-knitr)))
+    (home-page "https://github.com/markvanderloo/gower")
+    (synopsis "Gower's distance")
+    (description
+     "This package provides tools to compute Gower's distance (or similarity)
+coefficient between records, and to compute the top-n matches between records.
+Core algorithms are executed in parallel on systems supporting OpenMP.")
+    (license license:gpl3)))
+
+(define-public r-rcpproll
+  (package
+    (name "r-rcpproll")
+    (version "0.2.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "RcppRoll" version))
+       (sha256
+        (base32
+         "19xzvxym8zbighndygkq4imfwc0abh4hqyq3qrr8aakyd096iisi"))))
+    (properties `((upstream-name . "RcppRoll")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-rcpp" ,r-rcpp)))
+    (home-page "http://cran.r-project.org/web/packages/RcppRoll")
+    (synopsis "Efficient rolling and windowed operations")
+    (description
+     "This package provides fast and efficient routines for common rolling /
+windowed operations.  Routines for the efficient computation of windowed mean,
+median, sum, product, minimum, maximum, standard deviation and variance are
+provided.")
+    (license license:gpl2+)))
+
+(define-public r-ipred
+  (package
+    (name "r-ipred")
+    (version "0.9-6")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "ipred" version))
+       (sha256
+        (base32
+         "1vrw1pqcpnc04x1r2h9grdfm6bivs358sww5gg90jwlvxcw69lxq"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-class" ,r-class)
+       ("r-mass" ,r-mass)
+       ("r-nnet" ,r-nnet)
+       ("r-prodlim" ,r-prodlim)
+       ("r-rpart" ,r-rpart)
+       ("r-survival" ,r-survival)))
+    (home-page "http://cran.r-project.org/web/packages/ipred")
+    (synopsis "Improved predictors")
+    (description
+     "This package provides improved predictive models by indirect
+classification and bagging for classification, regression and survival
+problems as well as resampling based estimators of prediction error.")
+    (license license:gpl2+)))
+
+(define-public r-recipes
+  (package
+    (name "r-recipes")
+    (version "0.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "recipes" version))
+       (sha256
+        (base32
+         "0rydk403qihxmcv3zz323r3ywk4g1v7ibvj452rxhm0z22sqk9kb"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-ddalpha" ,r-ddalpha)
+       ("r-dimred" ,r-dimred)
+       ("r-dplyr" ,r-dplyr)
+       ("r-gower" ,r-gower)
+       ("r-ipred" ,r-ipred)
+       ("r-lubridate" ,r-lubridate)
+       ("r-magrittr" ,r-magrittr)
+       ("r-purrr" ,r-purrr)
+       ("r-rcpproll" ,r-rcpproll)
+       ("r-rlang" ,r-rlang)
+       ("r-tibble" ,r-tibble)
+       ("r-tidyselect" ,r-tidyselect)
+       ("r-timedate" ,r-timedate)))
+    (home-page "https://github.com/topepo/recipes")
+    (synopsis "Preprocessing tools to create design matrices")
+    (description
+     "Recipes is an extensible framework to create and preprocess design
+matrices.  Recipes consist of one or more data manipulation and analysis
+\"steps\".  Statistical parameters for the steps can be estimated from an
+initial data set and then applied to other data sets.  The resulting design
+matrices can then be used as inputs into statistical or machine learning
+models.")
+    (license license:gpl2)))
diff --git a/gnu/packages/crypto.scm b/gnu/packages/crypto.scm
index 1783ae0945..6b28030dff 100644
--- a/gnu/packages/crypto.scm
+++ b/gnu/packages/crypto.scm
@@ -78,6 +78,37 @@ communication, encryption, decryption, signatures, etc.")
     (license license:isc)
     (home-page "http://libsodium.org")))
 
+(define-public libmd
+  (package
+    (name "libmd")
+    (version "0.0.0")
+    (source (origin
+            (method url-fetch)
+            (uri (string-append
+                  "https://archive.hadrons.org/software/libmd/libmd-"
+                  version
+                  ".tar.xz"))
+            (sha256
+             (base32
+              "121s73pgbqsnmy6xblbrkj9y44c5zzzpf2hcmh6zvcvg4dk26gzx"))))
+    (build-system gnu-build-system)
+    (synopsis "Message Digest functions from BSD systems")
+    (description
+     "The currently provided message digest algorithms are:
+@itemize
+@item MD2
+@item MD4
+@item MD5
+@item RIPEMD-160
+@item SHA-1
+@item SHA-2 (SHA-256, SHA-384 and SHA-512)
+@end itemize")
+    (license (list license:bsd-3
+                   license:bsd-2
+                   license:isc
+                   license:public-domain))
+    (home-page "https://www.hadrons.org/software/libmd/")))
+
 (define-public signify
   (package
     (name "signify")
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index 0ecfd288c4..452f670090 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -27,10 +27,14 @@
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
+  #:use-module (gnu packages algebra)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages avahi)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages groff)
   #:use-module (gnu packages libusb)
-  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages perl)
+  #:use-module (gnu packages pretty-print)
   #:use-module (gnu packages python)
   #:use-module (gnu packages scanner)
   #:use-module (gnu packages image)
@@ -479,3 +483,119 @@ device-specific programs to convert and print many types of files.")
               ;; TODO: Make hp-setup find python-dbus.
               ("python-dbus" ,python-dbus)))
     (native-inputs `(("pkg-config" ,pkg-config)))))
+
+(define-public foomatic-filters
+  (package
+    (name "foomatic-filters")
+    (version "4.0.12")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "http://www.openprinting.org/download/foomatic/"
+                    name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "17w26r15094j4fqifa7f7i7jad4gsy9zdlq69kffrykcw31qx3q8"))
+              (patches
+               (search-patches "foomatic-filters-CVE-2015-8327.patch"
+                               "foomatic-filters-CVE-2015-8560.patch"))))
+    (build-system gnu-build-system)
+    (home-page
+     "https://wiki.linuxfoundation.org/openprinting/database/foomatic")
+    (native-inputs
+     `(("perl" ,perl)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("dbus" ,dbus)
+       ("a2ps" ,a2ps)))
+    (arguments
+     '( ;; Specify the installation directories.
+       #:configure-flags (list (string-append "ac_cv_path_CUPS_BACKENDS="
+                                              (assoc-ref %outputs "out")
+                                              "/lib/cups/backend")
+                               (string-append "ac_cv_path_CUPS_FILTERS="
+                                              (assoc-ref %outputs "out")
+                                              "/lib/cups/filter")
+                               (string-append "ac_cv_path_PPR_INTERFACES="
+                                              (assoc-ref %outputs "out")
+                                              "/lib/ppr/interfaces")
+                               (string-append "ac_cv_path_PPR_LIB="
+                                              (assoc-ref %outputs "out")
+                                              "/lib/ppr/lib")
+
+                               ;; For some reason these are misdiagnosed.
+                               "ac_cv_func_malloc_0_nonnull=yes"
+                               "ac_cv_func_realloc_0_nonnull=yes")
+       #:test-target "tests"))
+    (synopsis "Convert PostScript to the printer's native format")
+    (description
+     "This package contains filter scripts used by the printer spoolers to
+convert the incoming PostScript data into the printer's native format using a
+printer/driver specific, but spooler-independent PPD file.")
+    (license license:gpl2+)))
+
+(define-public foo2zjs
+  (package
+    ;; The tarball is called "foo2zjs", but the web page talks about
+    ;; "foo2xqx".  Go figure!
+    (name "foo2zjs")
+    (version "201709")
+    (source (origin
+              (method url-fetch)
+              ;; XXX: This is an unversioned URL!
+              (uri "http://foo2zjs.rkkda.com/foo2zjs.tar.gz")
+              (sha256
+               (base32
+                "0amjj3jr6s6h7crzxyx11v31sj0blz7k5c2vycz4gn8cxlmk3c7w"))))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (replace 'configure
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (substitute* (find-files "." "^Makefile$")
+                        ;; Set the installation directory.
+                        (("^PREFIX[[:blank:]]*=.*$")
+                         (string-append "PREFIX = "
+                                        (assoc-ref outputs "out")
+                                        "\n"))
+                        (("^UDEVBIN[[:blank:]]*=.*$")
+                         "UDEVBIN = $(PREFIX)/bin\n")
+                        ;; Don't try to chown/chgrp the installed files.
+                        (("-oroot")
+                         "")
+                        (("-glp")
+                         "")
+                        ;; Placate the dependency checks.
+                        (("/usr/include/stdio.h")
+                         "/etc/passwd")
+                        (("/usr/")
+                         "$(PREFIX)/")
+                        ;; Ensure fixed timestamps in man pages.
+                        (("^MODTIME[[:blank:]]*=.*$")
+                         "MODTIME = echo Thu Jan 01 01:00:00 1970\n"))
+                      #t))
+                  (add-after 'install 'remove-pdf
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      ;; Remove 'manual.pdf' which is (1) useless (it's a
+                      ;; concatenation of man pages), and (2) not
+                      ;; bit-reproducible due to <https://bugs.gnu.org/27593>.
+                      (let ((out (assoc-ref outputs "out")))
+                        (for-each delete-file
+                                  (find-files out "^manual\\.pdf$"))
+                        #t))))
+       #:parallel-build? #f                       ;broken makefile
+       #:tests? #f                                ;no tests
+       #:make-flags '("CC=gcc")))
+    (inputs
+     `(("ghostscript" ,ghostscript)
+       ("foomatic-filters" ,foomatic-filters)))   ;for 'foomatic-rip'
+    (native-inputs
+     `(("bc" ,bc)
+       ("groff" ,groff)))
+    (home-page "http://foo2xqx.rkkda.com/")
+    (synopsis "Printer driver for XQX stream protocol")
+    (description
+     "This package provides a printer driver notably for the ZJS and XQX
+protocols, which cover printers made by Konica, HP (LaserJet), Oki, Samsung,
+and more.  See @file{README} for details.")
+    (license license:gpl2+)))
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index c6a9ff5bd6..6ce58985ea 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -5,7 +5,7 @@
 ;;; Copyright © 2014, 2016 David Thompson <davet@gnu.org>
 ;;; Copyright © 2014, 2015, 2016 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
+;;; Copyright © 2015, 2016 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 ng0 <contact.ng0@cryptolab.net>
@@ -18,6 +18,7 @@
 ;;; Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Alex Vong <alexvong1995@gmail.com>
+;;; Copyright © 2017 Ben Woodcroft <donttrustben@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,6 +53,7 @@
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages time)
   #:use-module (gnu packages jemalloc)
   #:use-module (gnu packages language)
   #:use-module (gnu packages libevent)
@@ -1621,3 +1623,56 @@ Memory-Mapped Database} (LMDB), a high-performance key-value store.")
 
 (define-public python2-lmdb
   (package-with-python2 python-lmdb))
+
+(define-public python-orator
+  (package
+    (name "python-orator")
+    (version "0.9.7")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "orator" version))
+              (sha256
+               (base32
+                "14r58z64fdp76ixnvmi4lni762b405ynmsx6chr1qihs3yl9zn6c"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'loosen-dependencies
+           ;; Tests are not actually run since they are not included with the
+           ;; distributed package, but dependencies are checked.
+           (lambda _
+             (substitute* "setup.py"
+               ((",<.*'") "'")
+               (("flexmock==0.9.7") "flexmock")
+               ;; The pytest-mock package is out of date, so we remove minimum
+               ;; version requirement.
+               (("pytest-mock.*'") "pytest-mock'"))
+             #t)))))
+    (native-inputs
+     `(("python-pytest-mock" ,python-pytest-mock)
+       ("python-pytest" ,python-pytest-3.0)
+       ("python-flexmock" ,python-flexmock)))
+    (propagated-inputs
+     `(("python-backpack" ,python-backpack)
+       ("python-blinker" ,python-blinker)
+       ("python-cleo" ,python-cleo)
+       ("python-faker" ,python-faker)
+       ("python-inflection" ,python-inflection)
+       ("python-lazy-object-proxy" ,python-lazy-object-proxy)
+       ("python-pendulum" ,python-pendulum)
+       ("python-pyaml" ,python-pyaml)
+       ("python-pygments" ,python-pygments)
+       ("python-simplejson" ,python-simplejson)
+       ("python-six" ,python-six)
+       ("python-wrapt" ,python-wrapt)))
+    (home-page "https://orator-orm.com/")
+    (synopsis "ActiveRecord ORM for Python")
+    (description
+     "Orator provides a simple ActiveRecord-like Object Relational Mapping
+implementation for Python.")
+    (license license:expat)
+    (properties `((python2-variant . ,(delay python2-orator))))))
+
+(define-public python2-orator
+  (package-with-python2 (strip-python2-variant python-orator)))
diff --git a/gnu/packages/disk.scm b/gnu/packages/disk.scm
index 49bbbfa92f..463dd3e768 100644
--- a/gnu/packages/disk.scm
+++ b/gnu/packages/disk.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2016 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2016, 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Hartmut Goebel <h.goebel@crazy-compilers.com>
+;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,6 +31,7 @@
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial)
+  #:use-module (guix build-system python)
   #:use-module (gnu packages)
   #:use-module (gnu packages base)
   #:use-module (gnu packages docbook)
@@ -353,6 +355,25 @@ permit managing file systems not included in libparted.")
     ;; The home page says GPLv2, but the source code says GPLv2+.
     (license license:gpl2+)))
 
+(define-public pydf
+  (package
+    (name "pydf")
+    (version "12")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pydf" version))
+       (sha256
+        (base32
+         "0f8ly8xyp93i2hm9c0qjqd4y86nz73axw2f09z01mszwmg1sfivz"))))
+  (build-system python-build-system)
+  (home-page "http://kassiopeia.juls.savba.sk/~garabik/software/pydf/")
+  (synopsis "Colourised @command{df} clone")
+  (description "All-singing, all-dancing, fully colourised @command{df} clone
+written in Python.  It displays the amount of disk space available on the
+mounted filesystems, using different colours for different types of file
+systems.  Output format is completely customizable.")
+  (license license:public-domain)))
 
 (define-public f3
   (package
diff --git a/gnu/packages/django.scm b/gnu/packages/django.scm
index 356586e1bc..c70c074938 100644
--- a/gnu/packages/django.scm
+++ b/gnu/packages/django.scm
@@ -31,13 +31,13 @@
 (define-public python-django
   (package
     (name "python-django")
-    (version "1.10.7")
+    (version "1.10.8")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "Django" version))
               (sha256
                (base32
-                "1f5hnn2dzfr5szk4yc47bs4kk2nmrayjcvgpqi2s4l13pjfpfgar"))))
+                "1fwqqh2zbcy9dy0lnvk338s11llnnfz2k56bf84w0wv56ayq7vyl"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/ebook.scm b/gnu/packages/ebook.scm
index 38abf47c87..4bcaa0abfe 100644
--- a/gnu/packages/ebook.scm
+++ b/gnu/packages/ebook.scm
@@ -72,7 +72,7 @@
 (define-public calibre
   (package
     (name "calibre")
-    (version "3.0.0")
+    (version "3.6.0")
     (source
       (origin
         (method url-fetch)
@@ -81,21 +81,19 @@
                             version ".tar.xz"))
         (sha256
          (base32
-          "1zhk7bvgr973dd18x4wp48kzai29qqqi5qcy72sxc4wcbk2sbnkw"))
+          "0vp2nds4b5xbchsh1rpc1q7093gd26dnw7mgbnax97dcchvlc4sc"))
         ;; Remove non-free or doubtful code, see
         ;; https://lists.gnu.org/archive/html/guix-devel/2015-02/msg00478.html
         (modules '((guix build utils)))
         (snippet
           '(begin
             (delete-file-recursively "src/calibre/ebooks/markdown")
-            (delete-file-recursively "src/unrar")
             (delete-file "src/odf/thumbnail.py")
             (delete-file-recursively "resources/fonts/liberation")
             (substitute* (find-files "." "\\.py")
               (("calibre\\.ebooks\\.markdown") "markdown"))
             #t))
-        (patches (search-patches "calibre-drop-unrar.patch"
-                                 "calibre-use-packaged-feedparser.patch"
+        (patches (search-patches "calibre-use-packaged-feedparser.patch"
                                  "calibre-no-updates-dialog.patch"))))
     (build-system python-build-system)
     (native-inputs
@@ -129,6 +127,7 @@
        ("python2-dbus" ,python2-dbus)
        ("python2-dnspython" ,python2-dnspython)
        ("python2-feedparser" ,python2-feedparser)
+       ("python2-html5-parser" ,python2-html5-parser)
        ("python2-lxml" ,python2-lxml)
        ("python2-markdown" ,python2-markdown)
        ("python2-mechanize" ,python2-mechanize)
@@ -140,6 +139,9 @@
        ("python2-pyqt" ,python2-pyqt)
        ("python2-sip" ,python2-sip)
        ("python2-regex" ,python2-regex)
+       ;; python2-unrardll is needed for decompressing RAR files.
+       ;; A program called 'pdf2html' is needed for reading PDF books
+       ;; in the web interface.
        ("sqlite" ,sqlite)))
     (arguments
      `(#:python ,python-2
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index b23363796a..91c6c8c41c 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -59,6 +59,7 @@
   #:use-module (guix build-system trivial)
   #:use-module (gnu packages)
   #:use-module (gnu packages audio)
+  #:use-module (gnu packages bash)
   #:use-module (gnu packages code)
   #:use-module (gnu packages guile)
   #:use-module (gnu packages gtk)
@@ -112,7 +113,8 @@
                "1ykkq0xl28ljdg61bm6gzy04ww86ajms98gix72qg6cpr6a53dar"))
              (patches (search-patches "emacs-exec-path.patch"
                                       "emacs-fix-scheme-indent-function.patch"
-                                      "emacs-source-date-epoch.patch"))
+                                      "emacs-source-date-epoch.patch"
+                                      "emacs-unsafe-enriched-mode-translations.patch"))
              (modules '((guix build utils)))
              (snippet
               ;; Delete the bundled byte-compiled elisp files and
@@ -840,6 +842,7 @@ provides an optional IDE-like error list.")
          (replace 'configure
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let ((out     (assoc-ref outputs "out"))
+                   (flac    (assoc-ref inputs "flac"))
                    (vorbis  (assoc-ref inputs "vorbis-tools"))
                    (alsa    (assoc-ref inputs "alsa-utils"))
                    (mpg321  (assoc-ref inputs "mpg321"))
@@ -862,6 +865,9 @@ provides an optional IDE-like error list.")
                  (substitute* "emms-player-simple.el"
                    (("\"ogg123\"")
                     (string-append "\"" vorbis "/bin/ogg123\"")))
+                 (substitute* "emms-player-simple.el"
+                   (("\"mpg321\"")
+                    (string-append "\"" mpg321 "/bin/mpg321\"")))
                  (emacs-substitute-variables "emms-info-ogginfo.el"
                    ("emms-info-ogginfo-program-name"
                     (string-append vorbis "/bin/ogginfo")))
@@ -871,6 +877,11 @@ provides an optional IDE-like error list.")
                  (emacs-substitute-variables "emms-info-mp3info.el"
                    ("emms-info-mp3info-program-name"
                     (string-append mp3info "/bin/mp3info")))
+                 (emacs-substitute-variables "emms-info-metaflac.el"
+                   ("emms-info-metaflac-program-name"
+                    (string-append flac "/bin/metaflac")))
+                 (emacs-substitute-variables "emms-source-file.el"
+                   ("emms-source-file-gnu-find" (which "find")))
                  (substitute* "emms-volume-amixer.el"
                    (("\"amixer\"")
                     (string-append "\"" alsa "/bin/amixer\"")))
@@ -896,6 +907,7 @@ provides an optional IDE-like error list.")
     (native-inputs `(("emacs" ,emacs-minimal)    ;for (guix build emacs-utils)
                      ("texinfo" ,texinfo)))
     (inputs `(("alsa-utils" ,alsa-utils)
+              ("flac" ,flac)            ;for metaflac
               ("vorbis-tools" ,vorbis-tools)
               ("mpg321" ,mpg321)
               ("taglib" ,taglib)
@@ -1193,6 +1205,26 @@ Using emacs-direnv means that programs started from Emacs will use the
 environment set through Direnv.")
     (license license:gpl3+)))
 
+(define-public emacs-go-mode
+  (package
+    (name "emacs-go-mode")
+    (version "1.5.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/dominikh/go-mode.el/"
+                                  "archive/v" version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1adngbjyb8qnwg7n6r2y31djw9j6qf3b9fi63zd85035q7x4ljnm"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/dominikh/go-mode.el")
+    (synopsis "Go mode for Emacs")
+    (description
+     "This package provides go-mode, an Emacs mode for working with software
+written in the Go programming language.")
+    (license license:bsd-3)))
+
 (define-public emacs-google-maps
   (package
     (name "emacs-google-maps")
@@ -1629,6 +1661,36 @@ display and behaviour is easily customisable.")
 of files under Git version control from within Emacs.")
     (license license:gpl3+)))
 
+(define-public emacs-minitest
+  (package
+    (name "emacs-minitest")
+    (version "0.8.0")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append
+                   "https://github.com/arthurnn/minitest-emacs/archive/v"
+                   version ".tar.gz"))
+             (file-name (string-append name "-" version ".tar.gz"))
+             (sha256
+              (base32
+               "1dsb7kzvs1x6g4sgqmq73jqacb7wzm0wfkiq5m9dqdzq8mppgiqs"))))
+    (build-system emacs-build-system)
+    (arguments
+     '(#:include (cons "^snippets\\/minitest-mode\\/" %default-include)
+       #:exclude (delete "^[^/]*tests?\\.el$" %default-exclude)))
+    (propagated-inputs
+     `(("emacs-dash" ,emacs-dash)
+       ("emacs-f" ,emacs-f)))
+    (home-page "https://github.com/arthurnn/minitest-emacs")
+    (synopsis "Emacs minitest mode")
+    (description
+     "The minitest mode provides commands to run the tests for the current
+file or line, as well as rerunning the previous tests, or all the tests for a
+project.
+
+This package also includes relevant snippets for yasnippet.")
+    (license license:expat)))
+
 (define-public emacs-el-mock
   (package
     (name "emacs-el-mock")
@@ -1917,6 +1979,7 @@ serve files and directory listings.")
     (propagated-inputs
      `(("emacs-simple-httpd" ,emacs-simple-httpd)
        ("emacs-js2-mode" ,emacs-js2-mode)))
+    (arguments '(#:include '("\\.el$" "\\.js$" "\\.html$")))
     (home-page "https://github.com/skeeto/skewer-mode")
     (synopsis "Live web development in Emacs")
     (description
@@ -1968,6 +2031,31 @@ tables.")
 mode-line.")
     (license license:gpl2+)))
 
+(define-public emacs-rspec
+  (package
+    (name "emacs-rspec")
+    (version "1.11")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/pezra/rspec-mode/"
+                           "archive/v" version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1j0a7ms5516nlg60qfyn730pfxys6acm0rgyxh5xfkpi6jafgpvw"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/pezra/rspec-mode")
+    (synopsis "Provides a rspec mode for working with RSpec")
+    (description
+     "The Emacs RSpec mode provides keybindings for Ruby source files, e.g. to
+verify the spec associated with the current buffer, or entire project, as well
+as moving between the spec files, and coresponding code files.
+
+Also included are keybindings for spec files and Dired buffers, as well as
+snippets for yasnippet.")
+    (license license:gpl3+)))
+
 (define-public emacs-smart-mode-line
   (package
     (name "emacs-smart-mode-line")
@@ -3159,22 +3247,25 @@ E-Prime forbids the use of the \"to be\" form to strengthen your writing.")
                 "0w7mbbajn377gdmvnd21mpyr368b2ia46gq6cb99y4y5rspf9pcg"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:tests? #f ; There is no test suite.
-       #:make-flags (list (string-append "PREFIX=" %output)
-                          (string-append "LISPDIR=" %output
-                                         "/share/emacs/site-lisp/guix.d/ess"))
-       #:phases
-       (modify-phases %standard-phases
-         (delete 'configure)
-         (add-before 'build 'more-shebang-patching
-           (lambda* (#:key inputs #:allow-other-keys)
-             (substitute* "Makeconf"
-               (("SHELL = /bin/sh")
-                (string-append "SHELL = " (which "sh"))))))
-         ;; FIXME: the texlive-union insists on regenerating fonts.  It stores
-         ;; them in HOME, so it needs to be writeable.
-         (add-before 'build 'set-HOME
-           (lambda _ (setenv "HOME" "/tmp") #t)))))
+     (let ((base-directory "/share/emacs/site-lisp/guix.d/ess"))
+       `(#:tests? #f ; There is no test suite.
+         #:make-flags (list (string-append "PREFIX=" %output)
+                            (string-append "ETCDIR=" %output "/"
+                                           ,base-directory "/etc")
+                            (string-append "LISPDIR=" %output "/"
+                                           ,base-directory))
+         #:phases
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (add-before 'build 'more-shebang-patching
+             (lambda* (#:key inputs #:allow-other-keys)
+               (substitute* "Makeconf"
+                 (("SHELL = /bin/sh")
+                  (string-append "SHELL = " (which "sh"))))))
+           ;; FIXME: the texlive-union insists on regenerating fonts.  It stores
+           ;; them in HOME, so it needs to be writeable.
+           (add-before 'build 'set-HOME
+             (lambda _ (setenv "HOME" "/tmp") #t))))))
     (inputs
      `(("emacs" ,emacs-minimal)
        ("r-minimal" ,r-minimal)))
@@ -3239,7 +3330,7 @@ strings, and code folding.")
 (define-public emacs-markdown-mode
   (package
     (name "emacs-markdown-mode")
-    (version "2.2")
+    (version "2.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://raw.githubusercontent.com/jrblevin"
@@ -3248,7 +3339,7 @@ strings, and code folding.")
               (file-name (string-append "markdown-mode-" version ".el"))
               (sha256
                (base32
-                "04isd2sdnms9acpmkd6n7b7y7j0x2kank2kry0zwbxs3bwdavgav"))))
+                "152whyrq3dqlqy5wv4mdd94kmal19hs5kwaxjcp2gp2r97lsmdmi"))))
     (build-system emacs-build-system)
     (home-page "http://jblevins.org/projects/markdown-mode/")
     (synopsis "Emacs Major mode for Markdown files")
@@ -3490,6 +3581,27 @@ Dust.js, React/JSX, Angularjs, ejs, etc.")
     (home-page "http://web-mode.org/")
     (license license:gpl3+)))
 
+(define-public emacs-wgrep
+  (package
+    (name "emacs-wgrep")
+    (version "2.1.10")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/mhayashi1120/Emacs-wgrep/archive/"
+                    version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1r2bpypar70xg6dsx12x1k74f39ww930rday7rgqpyknzsx1k4l1"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/mhayashi1120/Emacs-wgrep")
+    (synopsis "Edit a grep buffer and apply those changes to the files")
+    (description
+     "Emacs wgrep allows you to edit a grep buffer and apply those changes to
+the file buffer.")
+    (license license:gpl3+)))
+
 (define-public emacs-helm
   (package
     (name "emacs-helm")
@@ -3764,14 +3876,14 @@ passive voice.")
 (define-public emacs-org
   (package
     (name "emacs-org")
-    (version "20170828")
+    (version "20170917")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://elpa.gnu.org/packages/org-"
                                   version ".tar"))
               (sha256
                (base32
-                "0frjwgjyy7rwb7si57h6nd1p35a4gcd1dc0aka19kn8r59hbi08p"))))
+                "0qyis5ph3h99zn9kx7sgraddz41c1cf6yjkwi4im6ikwxk9x8cgc"))))
     (build-system emacs-build-system)
     (home-page "http://orgmode.org/")
     (synopsis "Outline-based notes management and organizer")
@@ -5521,7 +5633,39 @@ It supports dired buffers and opens them in tree mode at destination.")
     (synopsis "Quickly generate linear ranges in Emacs")
     (description
      "The main command of the @code{tiny} extension for Emacs is @code{tiny-expand}.
-It iss meant to quickly generate linear ranges, e.g. 5, 6, 7, 8.  Some elisp
+It is meant to quickly generate linear ranges, e.g. 5, 6, 7, 8.  Some elisp
 proficiency is an advantage, since you can transform your numeric range with
 an elisp expression.")
   (license license:gpl3+)))
+
+(define-public emacs-bash-completion
+  (package
+   (name "emacs-bash-completion")
+   (version "2.0.0")
+   (source
+    (origin
+      (method url-fetch)
+      (uri (string-append
+            "https://github.com/szermatt/emacs-bash-completion/archive/v"
+            version ".tar.gz"))
+      (file-name (string-append name "-" version ".tar.gz"))
+      (sha256
+       (base32
+        "0mkci4a1fy8z4cmry8mx5vsx4f16a8r454slnh7lqzidnhfi63hj"))))
+   (inputs `(("bash" ,bash)))
+   (build-system emacs-build-system)
+   (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'install 'configure
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let ((bash (assoc-ref inputs "bash")))
+               (emacs-substitute-variables "bash-completion.el"
+                 ("bash-completion-prog" (string-append bash "/bin/bash"))))
+             #t)))))
+   (home-page "https://github.com/szermatt/emacs-bash-completion")
+   (synopsis "BASH completion for the shell buffer")
+   (description
+    "@code{bash-completion} defines dynamic completion hooks for shell-mode
+and shell-command prompts that are based on bash completion.")
+   (license license:gpl2+)))
diff --git a/gnu/packages/enlightenment.scm b/gnu/packages/enlightenment.scm
index 9f2abb702a..e1265cfcf7 100644
--- a/gnu/packages/enlightenment.scm
+++ b/gnu/packages/enlightenment.scm
@@ -59,7 +59,7 @@
 (define-public efl
   (package
     (name "efl")
-    (version "1.20.3")
+    (version "1.20.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -67,7 +67,7 @@
                     version ".tar.xz"))
               (sha256
                (base32
-                "148i8awjdrqzd0xqfc6q4qvhhs46jl15nx7n2nii7lrwzx502wqj"))))
+                "1jxha61gsil6hs9zb72zsyh3gmdipvfnlc9v3palb2bm0b23aq9i"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -149,6 +149,16 @@
                            "--enable-drm")
        #:phases
        (modify-phases %standard-phases
+         ;; If we don't hardcode the location of libcurl.so then we
+         ;; have to wrap the outputs of efl's dependencies in curl.
+         (add-after 'unpack 'hardcode-libcurl-location
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let* ((curl (assoc-ref inputs "curl"))
+                    (lib  (string-append curl "/lib/")))
+               (substitute* "src/lib/ecore_con/ecore_con_url_curl.c"
+                 (("libcurl.so.?" libcurl) ; libcurl.so.[45]
+                  (string-append lib libcurl)))
+               #t)))
          (add-after 'unpack 'set-home-directory
            ;; FATAL: Cannot create run dir '/homeless-shelter/.run' - errno=2
            (lambda _ (setenv "HOME" "/tmp") #t)))))
@@ -165,7 +175,7 @@ removable devices or support for multimedia.")
 (define-public terminology
   (package
     (name "terminology")
-    (version "1.1.0")
+    (version "1.1.1")
     (source (origin
               (method url-fetch)
               (uri
@@ -173,7 +183,7 @@ removable devices or support for multimedia.")
                               "terminology/terminology-" version ".tar.xz"))
               (sha256
                (base32
-                "13rl1k22yf8qrpzdm5nh6ij641fibadr2ww1r7rnz7mbhzj3d4gb"))
+                "05ncxvzb9rzkyjvd95hzn8lswqdwr8cix6rd54nqn9559jibh4ns"))
               (modules '((guix build utils)))
               ;; Remove the bundled fonts.
               ;; TODO: Remove bundled lz4.
diff --git a/gnu/packages/file.scm b/gnu/packages/file.scm
index 050e6715b1..3bc8e1dcfe 100644
--- a/gnu/packages/file.scm
+++ b/gnu/packages/file.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -27,7 +27,8 @@
 
 (define-public file
   (package
-   (name "file")
+    (replacement file/fixed)
+    (name "file")
     (version "5.30")
     (source (origin
               (method url-fetch)
@@ -51,3 +52,9 @@ of the file.")
    (license bsd-2)
    (home-page "http://www.darwinsys.com/file/")))
 
+(define file/fixed
+  (package
+    (inherit file)
+    (source (origin
+              (inherit (package-source file))
+              (patches (search-patches "file-CVE-2017-1000249.patch"))))))
diff --git a/gnu/packages/finance.scm b/gnu/packages/finance.scm
index 6d6844fa75..06b8f1c5ba 100644
--- a/gnu/packages/finance.scm
+++ b/gnu/packages/finance.scm
@@ -1,9 +1,10 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015, 2016 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
+;;; Copyright © 2017 Theodoros Foradis <theodoros@foradis.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -29,11 +30,16 @@
  #:use-module (guix build-system python)
  #:use-module (gnu packages base)
  #:use-module (gnu packages boost)
+ #:use-module (gnu packages check)
  #:use-module (gnu packages databases)
+ #:use-module (gnu packages documentation)
+ #:use-module (gnu packages dns)
  #:use-module (gnu packages emacs)
+ #:use-module (gnu packages graphviz)
  #:use-module (gnu packages groff)
  #:use-module (gnu packages libedit)
  #:use-module (gnu packages libevent)
+ #:use-module (gnu packages libunwind)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages multiprecision)
  #:use-module (gnu packages pkg-config)
@@ -44,6 +50,8 @@
  #:use-module (gnu packages textutils)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages upnp)
+ #:use-module (gnu packages web)
+ #:use-module (gnu packages xml)
  #:use-module (gnu packages gnuzilla))
 
 (define-public bitcoin-core
@@ -292,3 +300,181 @@ protocol.  It supports Simple Payment Verification (SPV) and deterministic key
 generation from a seed.  Your secret keys are encrypted and are never sent to
 other machines/servers.  Electrum does not download the Bitcoin blockchain.")
     (license license:expat)))
+
+(define-public monero
+  ;; This package bundles easylogging++ and lmdb.
+  ;; The bundled easylogging++ is modified, and the changes will not be upstreamed.
+  ;; The devs deem the lmdb driver too critical a consenus component, to use
+  ;; the system's dynamically linked library.
+  (package
+    (name "monero")
+    (version "0.11.0.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/monero-project/monero/archive/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           ;; Delete bundled dependencies.
+           (for-each
+            delete-file-recursively
+            '("external/miniupnpc" "external/rapidjson"
+              "external/unbound"))
+           #t))
+       (sha256
+        (base32
+         "083w40a553c0r3i18020jcrv5s0b64vx3d8xrn9nwkb2237ighlk"))))
+    (build-system cmake-build-system)
+    (native-inputs
+     `(("doxygen" ,doxygen)
+       ("googletest" ,googletest)
+       ("graphviz" ,graphviz)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("bind" ,isc-bind)
+       ("boost" ,boost)
+       ("expat" ,expat)
+       ("libunwind" ,libunwind)
+       ("lmdb" ,lmdb)
+       ("miniupnpc" ,miniupnpc)
+       ("openssl" ,openssl)
+       ("rapidjson" ,rapidjson)
+       ("unbound" ,unbound)))
+    (arguments
+     `(#:out-of-source? #t
+       #:configure-flags '("-DBUILD_TESTS=ON"
+                           ,@(if (string=? "aarch64-linux" (%current-system))
+                                 '("-DARCH=armv8-a")
+                                 '())
+                           "-DBUILD_GUI_DEPS=ON")
+       #:phases
+       (modify-phases %standard-phases
+         ;; tests/core_tests need a valid HOME
+         (add-before 'configure 'set-home
+           (lambda _
+             (setenv "HOME" (getcwd))
+             #t))
+         (add-after 'set-home 'fix-wallet-path-for-unit-tests
+           (lambda _
+             (substitute* "tests/unit_tests/serialization.cpp"
+               (("\\.\\./\\.\\./\\.\\./\\.\\./") "../../"))
+             #t))
+         (add-after 'fix-wallet-path-for-unit-tests 'change-log-path
+           (lambda _
+             (substitute* "contrib/epee/src/mlog.cpp"
+               (("epee::string_tools::get_current_module_folder\\(\\)")
+                "\".bitmonero\""))
+             (substitute* "contrib/epee/src/mlog.cpp"
+               (("return \\(") "return ((std::string(getenv(\"HOME\"))) / "))
+             #t))
+         (replace 'check
+           (lambda _
+             (zero?
+              (system* "make" "ARGS=-E 'unit_tests|libwallet_api_tests'"
+                       "test"))))
+         ;; The excluded unit tests need network access
+         (add-after 'check 'unit-tests
+           (lambda _
+             (let ((excluded-unit-tests
+                    (string-join
+                     '("AddressFromURL.Success"
+                       "AddressFromURL.Failure"
+                       "DNSResolver.IPv4Success"
+                       "DNSResolver.DNSSECSuccess"
+                       "DNSResolver.DNSSECFailure"
+                       "DNSResolver.GetTXTRecord")
+                     ":")))
+               (zero?
+                (system* "tests/unit_tests/unit_tests"
+                         (string-append "--gtest_filter=-"
+                                        excluded-unit-tests))))))
+         (add-after 'install 'install-blockchain-import-export
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin")))
+               (install-file "bin/monero-blockchain-import" bin)
+               (install-file "bin/monero-blockchain-export" bin)))))))
+    (home-page "https://getmonero.org/")
+    (synopsis "Command-line interface to the Monero currency")
+    (description
+     "Monero is a secure, private, untraceable currency.  This package provides the
+Monero command line client and daemon.")
+    (license license:bsd-3)))
+
+(define-public monero-core
+  (package
+    (name "monero-core")
+    (version "0.11.0.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/monero-project/monero-core/archive/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0hnrkgwb1sva67pcjym2gvb4zifp2s849dfbnjzbxk3yczpcyqzg"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("doxygen" ,doxygen)
+       ("graphviz" ,graphviz)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("boost" ,boost)
+       ("libunwind" ,libunwind)
+       ("openssl" ,openssl)
+       ("qt" ,qt)
+       ("unbound" ,unbound)))
+    (propagated-inputs
+     `(("monero" ,monero)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (delete 'check)
+         (add-before 'build 'fix-makefile-vars
+           (lambda _
+             (substitute* "src/zxcvbn-c/makefile"
+               (("\\?=") "="))
+             #t))
+         (add-after 'fix-makefile-vars 'fix-library-paths
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "monero-wallet-gui.pro"
+               (("-L/usr/local/lib") "")
+               (("-L/usr/local/opt/openssl/lib")
+                (string-append "-L"
+                               (assoc-ref inputs "openssl")
+                               "/lib"))
+               (("-L/usr/local/opt/boost/lib")
+                (string-append "-L"
+                               (assoc-ref inputs "boost")
+                               "/lib")))
+             #t))
+         (add-after 'fix-library-paths 'fix-monerod-path
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "src/daemon/DaemonManager.cpp"
+               (("QApplication::applicationDirPath\\(\\) \\+ \"/monerod")
+                (string-append "\""(assoc-ref inputs "monero")
+                               "/bin/monerod")))
+             #t))
+         (replace 'build
+           (lambda _
+             (zero? (system* "./build.sh"))))
+         (add-after 'build 'fix-install-path
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* "build/Makefile"
+               (("/opt/monero-wallet-gui")
+                (assoc-ref outputs "out")))
+             #t))
+         (add-before 'install 'change-dir
+           (lambda _
+             (chdir "build"))))))
+    (home-page "https://getmonero.org/")
+    (synopsis "Graphical user interface for the Monero currency")
+    (description
+     "Monero is a secure, private, untraceable currency.  This package provides the
+Monero GUI client.")
+    (license license:bsd-3)))
diff --git a/gnu/packages/freedesktop.scm b/gnu/packages/freedesktop.scm
index a304c15334..84fa104038 100644
--- a/gnu/packages/freedesktop.scm
+++ b/gnu/packages/freedesktop.scm
@@ -204,14 +204,14 @@ the freedesktop.org XDG Base Directory specification.")
 (define-public elogind
   (package
     (name "elogind")
-    (version "219.14")
+    (version "232.4")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://wingolog.org/pub/" name "/"
-                                  name "-" version ".tar.xz"))
+              (uri (string-append "https://github.com/elogind/elogind/"
+                                  "archive/v" version ".tar.gz"))
               (sha256
                (base32
-                "1jckc4wx199n1q4r4fv43ibjs6nlq91s39w9r78ilk1z383m1hcx"))
+                "1qcxian48z2dj5gfmp7brrngdydqf2jm00f4rjr5sy1myh8fy931"))
               (modules '((guix build utils)))
               (snippet
                '(begin
@@ -222,25 +222,58 @@ the freedesktop.org XDG Base Directory specification.")
                     (("XSLTPROC_FLAGS = ") "XSLTPROC_FLAGS = --novalid"))))))
     (build-system gnu-build-system)
     (arguments
-     `(#:configure-flags
-       (list (string-append "--with-libcap="
-                            (assoc-ref %build-inputs "libcap"))
-             (string-append "--with-udevrulesdir="
+     `(#:tests? #f ;FIXME: "make check" in the "po" directory fails.
+       #:configure-flags
+       (list (string-append "--with-udevrulesdir="
+                            (assoc-ref %outputs "out")
+                            "/lib/udev/rules.d")
+
+             ;; Let elogind be its own cgroup controller, rather than relying
+             ;; on systemd or OpenRC.  By default, 'configure' makes an
+             ;; incorrect guess.
+             "--with-cgroup-controller=elogind"
+
+             (string-append "--with-rootprefix="
+                            (assoc-ref %outputs "out"))
+             (string-append "--with-rootlibexecdir="
                             (assoc-ref %outputs "out")
-                            "/lib/udev/rules.d"))
+                            "/libexec/elogind")
+             ;; These are needed to ensure that lto linking works.
+             "RANLIB=gcc-ranlib"
+             "AR=gcc-ar"
+             "NM=gcc-nm")
        #:make-flags '("PKTTYAGENT=/run/current-system/profile/bin/pkttyagent")
-       #:phases (modify-phases %standard-phases
-                  (add-before 'build 'fix-service-file
-                    (lambda* (#:key outputs #:allow-other-keys)
-                      ;; Fix the file name of the 'elogind' binary in the D-Bus
-                      ;; '.service' file.
-                      (substitute* "src/login/org.freedesktop.login1.service"
-                        (("^Exec=.*")
-                         (string-append "Exec=" (assoc-ref %outputs "out")
-                                        "/libexec/elogind/elogind\n"))))))))
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'autogen
+           (lambda _
+             (and (zero? (system* "intltoolize" "--force" "--automake"))
+                  (zero? (system* "autoreconf" "-vif")))))
+         (add-before 'build 'fix-service-file
+           (lambda* (#:key outputs #:allow-other-keys)
+             ;; Fix the file name of the 'elogind' binary in the D-Bus
+             ;; '.service' file.
+             (substitute* "src/login/org.freedesktop.login1.service"
+               (("^Exec=.*")
+                (string-append "Exec=" (assoc-ref %outputs "out")
+                               "/libexec/elogind/elogind\n")))))
+         (add-after 'install 'add-libcap-to-search-path
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             ;; Add a missing '-L' for libcap in libelogind.la.  See
+             ;; <https://lists.gnu.org/archive/html/guix-devel/2017-09/msg00084.html>.
+             (let ((libcap (assoc-ref inputs "libcap"))
+                   (out    (assoc-ref outputs "out")))
+               (substitute* (string-append out "/lib/libelogind.la")
+                 (("-lcap")
+                  (string-append "-L" libcap "/lib -lcap")))
+               #t))))))
     (native-inputs
-     `(("intltool" ,intltool)
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("libtool" ,libtool)
+       ("intltool" ,intltool)
        ("gettext" ,gettext-minimal)
+       ("python" ,python)
        ("docbook-xsl" ,docbook-xsl)
        ("docbook-xml" ,docbook-xml)
        ("xsltproc" ,libxslt)
@@ -260,7 +293,7 @@ the freedesktop.org XDG Base Directory specification.")
        ("dbus" ,dbus)
        ("eudev" ,eudev)
        ("acl" ,acl)))           ;to add individual users to ACLs on /dev nodes
-    (home-page "https://github.com/wingo/elogind")
+    (home-page "https://github.com/elogind/elogind")
     (synopsis "User, seat, and session management service")
     (description "Elogind is the systemd project's \"logind\" service,
 extracted out as a separate project.  Elogind integrates with PAM to provide
diff --git a/gnu/packages/ftp.scm b/gnu/packages/ftp.scm
index 63a4054617..ab8828ed85 100644
--- a/gnu/packages/ftp.scm
+++ b/gnu/packages/ftp.scm
@@ -46,7 +46,7 @@
 (define-public lftp
   (package
     (name "lftp")
-    (version "4.7.8")
+    (version "4.8.1")
     (source (origin
               (method url-fetch)
               ;; See https://lftp.tech/get.html for mirrors.
@@ -58,7 +58,7 @@
                                         "ftp/lftp/lftp-" version ".tar.xz")))
               (sha256
                (base32
-                "19ijsmbb5589vg5ga355ys3075z6s2x2h0bdbga343hfqmnid2pi"))))
+                "09vvwn5w3n8ahx57b7n6qvg1abnw9w7mm4d8p381pliab6jxlw77"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/game-development.scm b/gnu/packages/game-development.scm
index c8869a4944..5633456d44 100644
--- a/gnu/packages/game-development.scm
+++ b/gnu/packages/game-development.scm
@@ -10,6 +10,7 @@
 ;;; Copyright © 2016, 2017 Julian Graham <joolean@gmail.com>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
+;;; Copyright © 2017 Peter Mikkelsen <petermikkelsen10@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -73,7 +74,8 @@
   #:use-module (gnu packages xiph)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages mp3)
-  #:use-module (gnu packages xml))
+  #:use-module (gnu packages xml)
+  #:use-module (gnu packages tls))
 
 (define-public bullet
   (package
@@ -1019,3 +1021,107 @@ with its own editor, called OpenMW-CS which allows the user to edit or create
 their own original games.")
     (home-page "https://openmw.org")
     (license license:gpl3)))
+
+(define-public godot
+  (package
+    (name "godot")
+    (version "2.1.4")
+    (source (origin
+              (method url-fetch)
+              (uri
+               (string-append "https://github.com/godotengine/godot/archive/"
+                              version "-stable.tar.gz"))
+              (file-name (string-append name "-" version))
+              (sha256
+               (base32 "1mz89nafc1m7srbqvy7iagxrxmqvf5hbqi7i0lwaapkx6q0kpkq7"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ; There are no tests
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (add-after 'unpack 'scons-use-env
+           (lambda _
+             ;; Scons does not use the environment variables by default,
+             ;; but this substitution makes it do so.
+             (substitute* "SConstruct"
+               (("env_base = Environment\\(tools=custom_tools\\)")
+                (string-append
+                 "env_base = Environment(tools=custom_tools)\n"
+                 "env_base = Environment(ENV=os.environ)")))
+             #t))
+         (replace 'build
+           (lambda _
+             (zero? (system*
+                     "scons"
+                     "platform=x11"
+                     ;; Avoid using many of the bundled libs.
+                     ;; Note: These options can be found in the SConstruct file.
+                     "builtin_freetype=no"
+                     "builtin_glew=no"
+                     "builtin_libmpdec=no"
+                     "builtin_libogg=no"
+                     "builtin_libpng=no"
+                     "builtin_libtheora=no"
+                     "builtin_libvorbis=no"
+                     "builtin_libwebp=no"
+                     "builtin_openssl=no"
+                     "builtin_opus=no"
+                     "builtin_zlib=no"))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin")))
+               (with-directory-excursion "bin"
+                 (if (file-exists? "godot.x11.tools.64")
+                     (rename-file "godot.x11.tools.64" "godot")
+                     (rename-file "godot.x11.tools.32" "godot"))
+                 (install-file "godot" bin)))))
+         (add-after 'install 'install-godot-desktop
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (desktop (string-append out "/share/applications"))
+                    (icon-dir (string-append out "/share/pixmaps")))
+               (mkdir-p desktop)
+               (mkdir-p icon-dir)
+               (rename-file "icon.png" "godot.png")
+               (install-file "godot.png" icon-dir)
+               (with-output-to-file
+                   (string-append desktop "/godot.desktop")
+                 (lambda _
+                   (format #t
+                           "[Desktop Entry]~@
+                           Name=godot~@
+                           Comment=The godot game engine~@
+                           Exec=~a/bin/godot~@
+                           TryExec=~@*~a/bin/godot~@
+                           Icon=godot~@
+                           Type=Application~%"
+                           out)))
+               #t))))))
+    (native-inputs `(("pkg-config" ,pkg-config)
+                     ("scons" ,scons)))
+    (inputs `(("alsa-lib" ,alsa-lib)
+              ("freetype" ,freetype)
+              ("glew" ,glew)
+              ("glu" ,glu)
+              ("libtheora" ,libtheora)
+              ("libvorbis" ,libvorbis)
+              ("libwebp" ,libwebp)
+              ("libx11" ,libx11)
+              ("libxcursor" ,libxcursor)
+              ("libxinerama" ,libxinerama)
+              ("libxrandr" ,libxrandr)
+              ("mesa" ,mesa)
+              ("openssl" ,openssl)
+              ("opusfile" ,opusfile)
+              ("pulseaudio" ,pulseaudio)
+              ("python2" ,python-2)))
+    (home-page "https://godotengine.org/")
+    (synopsis "Advanced 2D and 3D game engine")
+    (description
+     "Godot is an advanced multi-platform game engine written in C++.  If
+features design tools such as a visual editor, can import 3D models and
+provide high-quality 3D rendering, it contains an animation editor, and can be
+scripted in a Python-like language.")
+    (license license:expat)))
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index da4d66ce36..7870d4513f 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -150,8 +150,6 @@ where the OS part is overloaded to denote a specific ABI---into GCC
       (inputs `(("gmp" ,gmp)
                 ("mpfr" ,mpfr)
                 ("mpc" ,mpc)
-                ("isl" ,isl)
-                ("cloog" ,cloog)
                 ("libelf" ,libelf)
                 ("zlib" ,zlib)))
 
@@ -354,10 +352,14 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "08yggr18v373a1ihj0rg2vd6psnic42b518xcgp3r9k81xz1xyr2"))
               (patches (search-patches "gcc-arm-link-spec-fix.patch"))))
-    (supported-systems %supported-systems)))
+    (supported-systems %supported-systems)
+    (inputs
+     `(("isl" ,isl-0.11)
+       ("cloog" ,cloog)
+       ,@(package-inputs gcc-4.7)))))
 
 (define-public gcc-4.9
-  (package (inherit gcc-4.7)
+  (package (inherit gcc-4.8)
     (version "4.9.4")
     (source (origin
               (method url-fetch)
@@ -368,8 +370,7 @@ Go.  It also includes runtime support libraries for these languages.")
                 "14l06m7nvcvb0igkbip58x59w3nq6315k6jcz3wr9ch1rn9d44bc"))
               (patches (search-patches "gcc-arm-bug-71399.patch"
                                        "gcc-libvtv-runpath.patch"))))
-    (native-inputs `(("texinfo" ,texinfo)))
-    (supported-systems %supported-systems)))
+    (native-inputs `(("texinfo" ,texinfo)))))
 
 (define-public gcc-5
   ;; Note: GCC >= 5 ships with .info files but 'make install' fails to install
@@ -389,6 +390,10 @@ Go.  It also includes runtime support libraries for these languages.")
                                        "gcc-5.0-libvtv-runpath.patch"
                                        "gcc-5-source-date-epoch-1.patch"
                                        "gcc-5-source-date-epoch-2.patch"))))))
+    ;; TODO: gcc-5 doesn't need cloog.
+    ;;(inputs
+    ;; `(("isl" ,isl)
+    ;;   ,@(package-inputs gcc-4.7)))))
 
 (define-public gcc-6
   (package
@@ -402,7 +407,11 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "1m0lr7938lw5d773dkvwld90hjlcq2282517d1gwvrfzmwgg42w5"))
               (patches (search-patches "gcc-strmov-store-file-names.patch"
-                                       "gcc-5.0-libvtv-runpath.patch"))))))
+                                       "gcc-5.0-libvtv-runpath.patch"))))
+    (inputs
+     `(("isl" ,isl)
+       ,@(package-inputs gcc-4.7)))))
+
 (define-public gcc-7
   (package
     (inherit gcc-6)
@@ -415,7 +424,11 @@ Go.  It also includes runtime support libraries for these languages.")
                (base32
                 "16j7i0888j2f1yp9l0nhji6cq65dy6y4nwy8868a8njbzzwavxqw"))
               (patches (search-patches "gcc-strmov-store-file-names.patch"
-                                       "gcc-5.0-libvtv-runpath.patch"))))))
+                                       "gcc-5.0-libvtv-runpath.patch"))))
+    (description
+     "GCC is the GNU Compiler Collection.  It provides compiler front-ends
+for several languages, including C, C++, Objective-C, Fortran, Ada, and Go.
+It also includes runtime support libraries for these languages.")))
 
 ;; Note: When changing the default gcc version, update
 ;;       the gcc-toolchain-* definitions and the gfortran definition
@@ -581,7 +594,34 @@ as the 'native-search-paths' field."
                      (variable "LIBRARY_PATH")
                      (files '("lib" "lib64"))))))
 
-(define-public gcc-objc gcc-objc-4.9)
+(define-public gcc-objc-5
+  (custom-gcc gcc-5 "gcc-objc" '("objc")
+              (list (search-path-specification
+                     (variable "OBJC_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc-6
+  (custom-gcc gcc-6 "gcc-objc" '("objc")
+              (list (search-path-specification
+                     (variable "OBJC_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc-7
+  (custom-gcc gcc-7 "gcc-objc" '("objc")
+              (list (search-path-specification
+                     (variable "OBJC_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc gcc-objc-5)
 
 (define-public gcc-objc++-4.8
   (custom-gcc gcc-4.8 "gcc-objc++" '("obj-c++")
@@ -601,7 +641,34 @@ as the 'native-search-paths' field."
                      (variable "LIBRARY_PATH")
                      (files '("lib" "lib64"))))))
 
-(define-public gcc-objc++ gcc-objc++-4.9)
+(define-public gcc-objc++-5
+  (custom-gcc gcc-5 "gcc-objc++" '("obj-c++")
+              (list (search-path-specification
+                     (variable "OBJCPLUS_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc++-6
+  (custom-gcc gcc-6 "gcc-objc++" '("obj-c++")
+              (list (search-path-specification
+                     (variable "OBJCPLUS_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc++-7
+  (custom-gcc gcc-7 "gcc-objc++" '("obj-c++")
+              (list (search-path-specification
+                     (variable "OBJCPLUS_INCLUDE_PATH")
+                     (files '("include")))
+                    (search-path-specification
+                     (variable "LIBRARY_PATH")
+                     (files '("lib" "lib64"))))))
+
+(define-public gcc-objc++ gcc-objc++-5)
 
 (define (make-libstdc++-doc gcc)
   "Return a package with the libstdc++ documentation for GCC."
@@ -661,7 +728,7 @@ as the 'native-search-paths' field."
 (define-public isl
   (package
     (name "isl")
-    (version "0.11.1")
+    (version "0.18")
     (source (origin
              (method url-fetch)
              (uri (list (string-append
@@ -672,8 +739,7 @@ as the 'native-search-paths' field."
                                        name "-" version ".tar.gz")))
              (sha256
               (base32
-               "13d9cqa5rzhbjq0xf0b2dyxag7pqa72xj9dhsa03m8ccr1a4npq9"))
-             (patches (search-patches "isl-0.11.1-aarch64-support.patch"))))
+               "06ybml6llhi4i56q90jnimbcgk1lpcdwhy9nxdxra2hxz3bhz2vb"))))
     (build-system gnu-build-system)
     (inputs `(("gmp" ,gmp)))
     (home-page "http://isl.gforge.inria.fr/")
@@ -691,6 +757,24 @@ reduction, transitive closures on maps (which may encode infinite graphs),
 dependence analysis and bounds on piecewise step-polynomials.")
     (license lgpl2.1+)))
 
+(define-public isl-0.11
+  (package
+    (inherit isl)
+    (name "isl")
+    (version "0.11.1")
+    (source (origin
+             (method url-fetch)
+             (uri (list (string-append
+                         "http://isl.gforge.inria.fr/isl-"
+                         version
+                         ".tar.bz2")
+                        (string-append %gcc-infrastructure
+                                       name "-" version ".tar.gz")))
+             (sha256
+              (base32
+               "13d9cqa5rzhbjq0xf0b2dyxag7pqa72xj9dhsa03m8ccr1a4npq9"))
+             (patches (search-patches "isl-0.11.1-aarch64-support.patch"))))))
+
 (define-public cloog
   (package
     (name "cloog")
@@ -710,7 +794,7 @@ dependence analysis and bounds on piecewise step-polynomials.")
       (file-name (string-append name "-" version ".tar.gz"))))
     (build-system gnu-build-system)
     (inputs `(("gmp" ,gmp)
-              ("isl" ,isl)))
+              ("isl" ,isl-0.11)))
     (arguments '(#:configure-flags '("--with-isl=system")))
     (home-page "http://www.cloog.org/")
     (synopsis "Library to generate code for scanning Z-polyhedra")
diff --git a/gnu/packages/gdb.scm b/gnu/packages/gdb.scm
index 77a3376a02..e09b55eb2b 100644
--- a/gnu/packages/gdb.scm
+++ b/gnu/packages/gdb.scm
@@ -37,14 +37,14 @@
 (define-public gdb
   (package
     (name "gdb")
-    (version "8.0")
+    (version "8.0.1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/gdb/gdb-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "1vplyf8v70yn0rdqjx6awl9nmfbwaj5ynwwjxwa71rhp97z4z8pn"))))
+               "1qwmcbaxf0jc7yjl0fimgcfj2yqcrl6h7azgs1d838kbwf9mzg9x"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ; FIXME "make check" fails on single-processor systems.
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index efb998764d..252cf670d2 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -19,7 +19,7 @@
 ;;; Copyright © 2016 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Alex Griffin <a@ajgrf.com>
-;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
+;;; Copyright © 2016, 2017 ng0 <ng0@infotropique.org>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
 ;;; Copyright © 2016, 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
@@ -765,7 +765,7 @@ on the GNOME Desktop with a single simple application.")
 (define-public gsettings-desktop-schemas
   (package
     (name "gsettings-desktop-schemas")
-    (version "3.24.0")
+    (version "3.24.1")
     (source
      (origin
       (method url-fetch)
@@ -774,7 +774,7 @@ on the GNOME Desktop with a single simple application.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "145vpcljy4660cnk8zk91qf7ywa7hqfl5hhw025gy8hxcqzklmzn"))))
+        "19zfqy58missq5cck13ip8j824hb9whqg2c4cr6hgrlxkwqgm8vn"))))
     (build-system gnu-build-system)
     (inputs
      `(("glib" ,glib)))
@@ -932,7 +932,7 @@ database is translated at Transifex.")
 (define-public hicolor-icon-theme
   (package
     (name "hicolor-icon-theme")
-    (version "0.15")
+    (version "0.17")
     (source
      (origin
       (method url-fetch)
@@ -940,7 +940,7 @@ database is translated at Transifex.")
                           "hicolor-icon-theme-" version ".tar.xz"))
       (sha256
        (base32
-        "1k1kf2c5zbqh31nglc3nxs9j6wr083k9kjyql8p22ccc671mmi4w"))))
+        "1n59i3al3zx6p90ff0l43gzpzmlqnzm6hf5cryxqrlbi48sq8x1i"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f)) ; no check target
@@ -987,7 +987,7 @@ some form of information without getting in the user's way.")
 (define-public libpeas
   (package
     (name "libpeas")
-    (version "1.20.0")
+    (version "1.22.0")
     (source
      (origin
       (method url-fetch)
@@ -996,12 +996,11 @@ some form of information without getting in the user's way.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0m6k6fcrx40n92nc1cy3z72vs1ja49sb58dj3fjp40605pzgz4pk"))))
+        "0qm908kisyjzjxvygdl18hjqxvvgkq9w0phs2g55pck277sw0bsv"))))
     (build-system gnu-build-system)
     (inputs
      `(("gtk+" ,gtk+)
        ("glade" ,glade3)
-       ("libxml2" ,libxml2) ; XXX: required by gladeui-2.0.pc
        ("python" ,python)
        ("python-pygobject" ,python-pygobject)))
     (native-inputs
@@ -2647,7 +2646,7 @@ floating in an ocean using only your brain and a little bit of luck.")
 (define-public gnome-sudoku
   (package
     (name "gnome-sudoku")
-    (version "3.24.0")
+    (version "3.26.0")
     (source
      (origin
        (method url-fetch)
@@ -2656,7 +2655,7 @@ floating in an ocean using only your brain and a little bit of luck.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1mw5ykk7wr0r9770jj5270f07rjws0pmpjs0b1fywj4li13r98h4"))))
+         "186k2axryn3ic8blc9ddnvyrqqf88khg2hlisfa1n4wp784wfx47"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -2989,7 +2988,7 @@ services for numerous locations.")
 (define-public gnome-settings-daemon
   (package
     (name "gnome-settings-daemon")
-    (version "3.24.2")
+    (version "3.24.3")
     (source
      (origin
        (method url-fetch)
@@ -2998,7 +2997,7 @@ services for numerous locations.")
                            name "-" version ".tar.xz"))
        (sha256
         (base32
-         "1jnw920zn4cadhgmcv2q5ylzqhwm1rmrhf3a14q8mvp38hkdgaaa"))))
+         "14w5jhpq02mbcxvn41qcj3cjfqdr3sgzl96c6glwpdrjphw61i38"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      `(;; Color management test can't reach the colord system service.
@@ -3331,7 +3330,7 @@ GL based interactive canvas library.")
 (define-public libchamplain
   (package
     (name "libchamplain")
-    (version "0.12.15")
+    (version "0.12.16")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3339,7 +3338,7 @@ GL based interactive canvas library.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "0x5qa1aw1y59lzkmf4j4szspn49341a87vcja4ydgxny1chilwjl"))))
+                "13chvc2n074i0jw5jlb8i7cysda4yqx58ca6y3mrlrl9g37k2zja"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--enable-vala")))
     (native-inputs
@@ -3399,7 +3398,7 @@ queries upon that data.")
 (define-public libgnome-games-support
   (package
     (name "libgnome-games-support")
-    (version "1.2.2")
+    (version "1.2.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3407,7 +3406,7 @@ queries upon that data.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "04qbgcgmc01sinhbqdljiny8q868l01nkdawj8wrnqnd1i8czvsg"))))
+                "1vwad7kqy7yd6wqyr71nq0blh7m53r3lz6ya16dmh942kd0w48v1"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -3435,7 +3434,7 @@ GNOME Games, but it may be used by others.")
 (define-public gnome-klotski
   (package
     (name "gnome-klotski")
-    (version "3.22.1")
+    (version "3.22.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -3443,7 +3442,7 @@ GNOME Games, but it may be used by others.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "04ragvrz29sydi2kf1zk2aimi3b3hn34jrndfd2lx6h8l45anq3q"))))
+                "16hd6yk01rhb4pj8m01fyn72wykf41d72gsms81q0n4zm5bm1a4h"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("desktop-file-utils" ,desktop-file-utils)
@@ -4087,7 +4086,7 @@ a secret password store, an adblocker, and a modern UI.")
 (define-public epiphany
   (package
     (name "epiphany")
-    (version "3.24.3")
+    (version "3.24.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4095,7 +4094,7 @@ a secret password store, an adblocker, and a modern UI.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0m51cclpnb7lxk8w526rriyb2bi3aj17fbcvikhkg7qd65v1dxgy"))))
+                "1jg59s98aljf603w24r5a3cr4fw6z88gc0warqy1946iprjgdw0m"))))
     (build-system glib-or-gtk-build-system)
     (arguments
      ;; FIXME: tests run under Xvfb, but fail with:
@@ -4719,7 +4718,6 @@ to display dialog boxes from the commandline and shell scripts.")
        ("cairo" ,cairo)
        ("gdk-pixbuf" ,gdk-pixbuf)
        ("glib" ,glib)
-       ("glib" ,glib)
        ("gtk+" ,gtk+)
        ("json-glib" ,json-glib)
        ("libinput" ,libinput)
@@ -4760,7 +4758,7 @@ window manager.")
 (define-public gnome-online-accounts
   (package
     (name "gnome-online-accounts")
-    (version "3.24.2")
+    (version "3.24.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -4768,7 +4766,7 @@ window manager.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1fmgywfcvlb5sa0slxxlg80gafiaal8vnq6h5lcybqa12lnxa2mp"))))
+                "0m1qf2ffxzmwxa157lrvh3507d5gr3lg4kvj653zhcihjpmmhbi5"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("glib:bin" ,glib "bin") ; for glib-compile-schemas, etc.
@@ -4923,7 +4921,7 @@ users.")
 (define-public network-manager
   (package
     (name "network-manager")
-    (version "1.8.0")
+    (version "1.8.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/NetworkManager/"
@@ -4931,7 +4929,7 @@ users.")
                                   "NetworkManager-" version ".tar.xz"))
               (sha256
                (base32
-                "17pn7kzilyl0qk525gp9xnbz4x0ssrdmgk1lvw95pyfd6rm5qnps"))
+                "1x0vzxvrck0snga2n3pc7g74m20zz74cr4r8gfspl8sckv6yz9bi"))
               (snippet
               '(begin
                  (use-modules (guix build utils))
@@ -5546,7 +5544,7 @@ easy, safe, and automatic.")
 (define-public tracker
   (package
     (name "tracker")
-    (version "1.12.2")
+    (version "1.12.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -5554,7 +5552,7 @@ easy, safe, and automatic.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1zdzh8l5ahi906i40i4pqw2cs1hwrl6l9a7fp344a3idk3pl5szb"))))
+                "1mpq418lzba7fad0w0m3bnxvz3khf461b5zya8zmq5n1g0w99ki3"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("gnome-common" ,gnome-common)
@@ -6066,7 +6064,7 @@ GNOME Shell appearance and extension, etc.")
 (define-public gnome-shell-extensions
   (package
     (name "gnome-shell-extensions")
-    (version "3.24.2")
+    (version "3.24.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -6074,7 +6072,7 @@ GNOME Shell appearance and extension, etc.")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "10sg87wml5cmyk90pybnr6r942ba7173sl7yplhj2sfggp0wc74s"))))
+                "0y8anpp9ymp0lxn15w63ra6zxxf8nvbl48xqkvqdjzida73fyz9w"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--enable-extensions=all")))
@@ -6422,7 +6420,7 @@ only know by its Unicode name or code point.")
 (define-public bluefish
   (package
     (name "bluefish")
-    (version "2.2.9")
+    (version "2.2.10")
     (source
      (origin
        (method url-fetch)
@@ -6430,7 +6428,7 @@ only know by its Unicode name or code point.")
                            name "-" version ".tar.gz"))
        (sha256
         (base32
-         "1vnl6raxbvc4hacg3pr6sqyjh707d304dhk5nyhlp7m0m1y3j756"))))
+         "1jw4has7lbp77lqmzvnnjmqcf0lacjfnka873lkkwdyrpzc4c1q4"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("desktop-file-utils" ,desktop-file-utils)
@@ -6754,3 +6752,92 @@ Lollypop plays audio formats such as mp3, mp4, ogg and flac and gets information
 from artists and tracks from the web.  It also fetches cover artworks
 automatically and it can stream songs from online music services and charts.")
     (license license:gpl3+)))
+
+(define-public gnome-video-effects
+  (package
+    (name "gnome-video-effects")
+    (version "0.4.3")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnome/sources/" name "/"
+                                  (version-major+minor version) "/" name "-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "06c2f1kihyhawap1s3zg5w7q7fypsybkp7xry4hxkdz4mpsy0zjs"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:out-of-source? #f))
+    (native-inputs
+     `(("glib:bin" ,glib "bin")
+       ("intltool" ,intltool)
+       ("gettext" ,gettext-minimal)
+       ("pkg-config" ,pkg-config)))
+    (home-page "https://wiki.gnome.org/Projects/GnomeVideoEffects")
+    (synopsis "Video effects for Cheese and other GNOME applications")
+    (description
+     "A collection of GStreamer video filters and effects to be used in
+photo-booth-like software, such as Cheese.")
+    (license license:gpl2+)))
+
+(define-public cheese
+  (package
+    (name "cheese")
+    (version "3.24.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnome/sources/" name "/"
+                                  (version-major+minor version) "/" name "-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "0wpks2lnr8va9wxgmj26dwmhlcb3vamhpxkqi8xaan6q25635l16"))))
+    (arguments
+     ;; Tests require GDK.
+     `(#:tests? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'install 'skip-gtk-update-icon-cache
+           (lambda _
+             ;; Don't create 'icon-theme.cache'
+             (substitute* "Makefile"
+               (("gtk-update-icon-cache") (which "true")))
+             #t))
+         (add-after 'install 'wrap-cheese
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let ((out             (assoc-ref outputs "out"))
+                   (gst-plugin-path (getenv "GST_PLUGIN_SYSTEM_PATH")))
+               (wrap-program (string-append out "/bin/cheese")
+                 `("GST_PLUGIN_SYSTEM_PATH" ":" prefix (,gst-plugin-path))))
+             #t)))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("glib:bin" ,glib "bin")
+       ("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("libxml2" ,libxml2)
+       ("pkg-config" ,pkg-config)
+       ("vala" ,vala)))
+    (propagated-inputs
+     `(("gnome-video-effects" ,gnome-video-effects)))
+    (inputs
+     `(("clutter" ,clutter)
+       ("clutter-gst" ,clutter-gst)
+       ("clutter-gtk" ,clutter-gtk)
+       ("gdk-pixbuf" ,gdk-pixbuf)
+       ("glib" ,glib)
+       ("gnome-desktop" ,gnome-desktop)
+       ("gobject-introspection" ,gobject-introspection)
+       ("gstreamer" ,gstreamer)
+       ("gst-plugins-base" ,gst-plugins-base)
+       ("gst-plugins-bad" ,gst-plugins-bad)
+       ("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libx11" ,libx11)
+       ("libxtst" ,libxtst)))
+    (home-page "https://wiki.gnome.org/Apps/Cheese")
+    (synopsis "Webcam photo booth software for GNOME")
+    (description
+     "Cheese uses your webcam to take photos and videos.  Cheese can also
+apply fancy special effects and lets you share the fun with others.")
+    (license license:gpl2+)))
diff --git a/gnu/packages/gnupg.scm b/gnu/packages/gnupg.scm
index d6f0722f6e..c6af5caa49 100644
--- a/gnu/packages/gnupg.scm
+++ b/gnu/packages/gnupg.scm
@@ -32,7 +32,10 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
   #:use-module (gnu packages adns)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
   #:use-module (gnu packages curl)
+  #:use-module (gnu packages crypto)
   #:use-module (gnu packages openldap)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pth)
@@ -53,6 +56,7 @@
   #:use-module (guix download)
   #:use-module (guix git-download)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system perl)
   #:use-module (guix build-system python))
 
 (define-public libgpg-error
@@ -216,14 +220,14 @@ compatible to GNU Pth.")
 (define-public gnupg
   (package
     (name "gnupg")
-    (version "2.2.0")
+    (version "2.2.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnupg/gnupg/gnupg-" version
                                   ".tar.bz2"))
               (sha256
                (base32
-                "1rj538kp3wsdq7rhl8sy1wpwhlsbxcch0cwk64kgz8gpw05lllfl"))))
+                "1yv2pwf3vhv9dpbf51fnm0wy03va1cg5r7qaz7rg75cwbgb0rmrl"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)))
@@ -535,6 +539,43 @@ and signature functionality from Python programs.")
 (define-public python2-gnupg
   (package-with-python2 python-gnupg))
 
+(define-public perl-gnupg-interface
+  (package
+    (name "perl-gnupg-interface")
+    (version "0.52")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/A/AL/ALEXMV/GnuPG-Interface-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "0dgx8yhdsmhkazcrz14n4flrk1afv7azgl003hl4arxvi1d9yyi4"))))
+    (build-system perl-build-system)
+    (arguments
+     '(;; Result: FAIL
+       ;; Failed 10/20 test programs. 21/52 subtests failed.
+       #:tests? #f))
+    (native-inputs
+     `(("perl-module-install" ,perl-module-install)
+       ("which" ,which)))
+    (inputs
+     `(("gnupg" ,gnupg)))
+    (propagated-inputs
+     `(("perl-moo" ,perl-moo)
+       ("perl-moox-late" ,perl-moox-late)
+       ("perl-moox-handlesvia" ,perl-moox-handlesvia)))
+    (home-page "http://search.cpan.org/~alexmv/GnuPG-Interface/")
+    (synopsis "Perl interface to GnuPG")
+    (description
+     "@code{GnuPG::Interface} and its associated modules are designed to
+provide an object-oriented method for interacting with GnuPG, being able to
+perform functions such as but not limited to encrypting, signing, decryption,
+verification, and key-listing parsing.")
+    (license license:perl-license)))
+
 (define-public pius
   (package
    (name "pius")
@@ -579,38 +620,48 @@ PGP keysigning parties.")
 (define-public signing-party
   (package
    (name "signing-party")
-   (version "1.1.4")
+   (version "2.6")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://debian/pool/main/s/signing-party/"
                                 "signing-party_" version ".orig.tar.gz"))
             (sha256 (base32
-                     "188gp0prbh8qs29lq3pbf0qibfd6jq4fk7i0pfrybl8aahvm84rx"))))
+                     "1n5bpcfpl9vg1xp6r1jhbyahrgdyxp05b5pria1rh4m0qnv8sifr"))))
    (build-system gnu-build-system)
-   (inputs `(("perl" ,perl)))
+   (native-inputs
+    `(("autoconf" ,(autoconf-wrapper))
+      ("automake" ,automake)))
+   (inputs `(("perl" ,perl)
+             ("perl-text-template" ,perl-text-template)
+             ("perl-mime-tools" ,perl-mime-tools)
+             ("perl-gnupg-interface" ,perl-gnupg-interface)
+             ("perl-net-idn-encode" ,perl-net-idn-encode)
+             ("libmd" ,libmd)))
    (arguments
     `(#:tests? #f
       #:phases
       (modify-phases %standard-phases
-        (add-after 'unpack 'remove-spurious-links
-          (lambda _ (delete-file "keyanalyze/pgpring/depcomp")))
+        (add-before 'configure 'change-directory
+          (lambda _
+            ;; The build system in the unpack phase changes to a less useful
+            ;; subdirectory, so move up one level
+            (chdir (dirname (getcwd)))))
         (replace 'configure
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
               (substitute* "keyanalyze/Makefile"
                 (("LDLIBS") (string-append "CC=" (which "gcc") "\nLDLIBS")))
               (substitute* "keyanalyze/Makefile"
-                (("./configure") (string-append "./configure --prefix=" out)))
-              (substitute* "keyanalyze/pgpring/configure"
-                (("/bin/sh") (which "sh")))
-              (substitute* "gpgwrap/Makefile"
+                (("\\./configure") (string-append "./configure --prefix=" out)))
+              (substitute* "gpgwrap/src/Makefile"
                 (("\\} clean")
                  (string-append "} clean\ninstall:\n\tinstall -D bin/gpgwrap "
                                 out "/bin/gpgwrap\n")))
               (substitute* '("gpgsigs/Makefile" "keyanalyze/Makefile"
                              "keylookup/Makefile" "sig2dot/Makefile"
                              "springgraph/Makefile")
-                           (("/usr") out)))))
+                (("/usr") out))
+              (setenv "CONFIG_SHELL" (which "sh")))))
         (replace 'install
           (lambda* (#:key outputs #:allow-other-keys #:rest args)
             (let ((out (assoc-ref outputs "out"))
@@ -635,7 +686,13 @@ PGP keysigning parties.")
                 '("caff.1" "pgp-clean.1" "pgp-fixkey.1" "gpgdir.1"
                   "gpg-key2ps.1" "gpglist.1" "gpg-mailkeys.1"
                   "gpgparticipants.1" "gpgsigs.1" "gpgwrap.1"
-                  "process_keys.1" "pgpring.1" "keyanalyze.1"))))))))
+                  "process_keys.1" "pgpring.1" "keyanalyze.1")))))
+        (add-after 'install 'wrap-programs
+          (lambda* (#:key outputs #:allow-other-keys)
+            (let* ((out (assoc-ref outputs "out")))
+              (wrap-program
+                  (string-append out "/bin/caff")
+                `("PERL5LIB" ":" prefix (,(getenv "PERL5LIB"))))))))))
    (synopsis "Collection of scripts for simplifying gnupg key signing")
    (description
     "Signing-party is a collection for all kinds of PGP/GnuPG related things,
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index a17ec41186..fd7a8a9e4d 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -249,7 +249,7 @@ in C/C++.")
 (define-public nspr
   (package
     (name "nspr")
-    (version "4.16")
+    (version "4.17")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -257,7 +257,7 @@ in C/C++.")
                    version "/src/nspr-" version ".tar.gz"))
              (sha256
               (base32
-               "1l9wlnb9y0bzicv448jjl9kssqn044dc2qrkwzp4ll35fvch4ccv"))))
+               "158hdn285dsb5rys8wl1wi32dd1axwhqq0r8fwny4aj157m0l2jr"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)))
@@ -281,7 +281,7 @@ in the Mozilla clients.")
 (define-public nss
   (package
     (name "nss")
-    (version "3.32")
+    (version "3.33")
     (source (origin
               (method url-fetch)
               (uri (let ((version-with-underscores
@@ -292,7 +292,7 @@ in the Mozilla clients.")
                       "nss-" version ".tar.gz")))
               (sha256
                (base32
-                "0dfkgvah0ji8b8lpxyy2w0b3lyz5ldmryii4z7j2bfwnrj0z7iim"))
+                "1r44qa4j7sri50mxxbnrpm6fxprwrhv76whi7bfq73j06syxmw4q"))
               ;; Create nss.pc and nss-config.
               (patches (search-patches "nss-pkgconfig.patch"
                                        "nss-increase-test-timeout.patch"))))
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index f84cc27836..2a52c4c697 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -6,6 +6,7 @@
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2017 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
+;;; Copyright © 2017 Ben Woodcroft <donttrustben@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -28,6 +29,7 @@
   #:use-module (guix packages)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system cmake)
+  #:use-module (guix build-system python)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
   #:use-module (gnu packages algebra)
@@ -70,14 +72,14 @@
 (define-public blender
   (package
     (name "blender")
-    (version "2.78a")
+    (version "2.79")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://download.blender.org/source/"
+              (uri (string-append "https://download.blender.org/source/"
                                   "blender-" version ".tar.gz"))
               (sha256
                (base32
-                "1byf1klrvm8fdw2libx7wldz2i6lblp9nih6y58ydh00paqi8jh1"))))
+                "16f84mdzkmwjmqahjj64kbyk4kagdj4mcr8qjazs1952d7kh7pm9"))))
     (build-system cmake-build-system)
     (arguments
      `(;; Test files are very large and not included in the release tarball.
@@ -134,7 +136,7 @@
        ("openal" ,openal)
        ("python" ,python-wrapper)
        ("zlib" ,zlib)))
-    (home-page "http://blender.org/")
+    (home-page "https://blender.org/")
     (synopsis "3D graphics creation suite")
     (description
      "Blender is a 3D graphics creation suite.  It supports the entirety of
@@ -654,3 +656,33 @@ and understanding different BRDFs (and other component functions).")
 It supports sub-pixel resolutions and anti-aliasing.  It is also library for
 rendering SVG graphics.")
     (license license:gpl2+)))
+
+(define-public python-pastel
+  (package
+    (name "python-pastel")
+    (version "0.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pastel" version))
+       (sha256
+        (base32
+         "1hqbm934n5yjwn31aq8h7shrr0rcy326wrqfc856vyn0gr0sy21i"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)))
+    (home-page "https://github.com/sdispater/pastel")
+    (synopsis "Library to colorize strings in your terminal")
+    (description "Pastel is a simple library to help you colorize strings in
+your terminal.  It comes bundled with predefined styles:
+@enumerate
+@item info: green
+@item comment: yellow
+@item question: black on cyan
+@item error: white on red
+@end enumerate
+")
+    (license license:expat)))
+
+(define-public python2-pastel
+  (package-with-python2 python-pastel))
diff --git a/gnu/packages/gstreamer.scm b/gnu/packages/gstreamer.scm
index 6e43dc9918..bc8f75ba12 100644
--- a/gnu/packages/gstreamer.scm
+++ b/gnu/packages/gstreamer.scm
@@ -98,7 +98,7 @@ arrays of data.")
 (define-public gstreamer
   (package
     (name "gstreamer")
-    (version "1.12.2")
+    (version "1.12.3")
     (source
      (origin
       (method url-fetch)
@@ -107,7 +107,7 @@ arrays of data.")
             version ".tar.xz"))
       (sha256
        (base32
-        "1fllz7n58lavyy4nh64xc7izd4ffhl12a2ff0yg4z67al8wkzplz"))))
+        "0vi1g8rmmsnd630ds3jwv2iph46ll8y07fzf04mz15q88j9g926k"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -146,7 +146,7 @@ This package provides the core library and elements.")
 (define-public gst-plugins-base
   (package
     (name "gst-plugins-base")
-    (version "1.12.2")
+    (version "1.12.3")
     (source
      (origin
       (method url-fetch)
@@ -154,7 +154,7 @@ This package provides the core library and elements.")
                           name "-" version ".tar.xz"))
       (sha256
        (base32
-        "0x86a7aph0y6gyq178plvwvbbyhkfb3hf0gadx9sk5z1mzixqrsh"))))
+        "19ffwdch7m777ragmwpy6prqmfb742ym1n3ki40s0zyki627plyk"))))
     (build-system gnu-build-system)
     (outputs '("out" "doc"))
     (propagated-inputs
@@ -201,7 +201,7 @@ for the GStreamer multimedia library.")
 (define-public gst-plugins-good
   (package
     (name "gst-plugins-good")
-    (version "1.12.2")
+    (version "1.12.3")
     (source
      (origin
       (method url-fetch)
@@ -210,7 +210,7 @@ for the GStreamer multimedia library.")
             name "-" version ".tar.xz"))
       (sha256
        (base32
-        "15pfw54fsh9s9xwrnbap4z4njwgqdfvq52k562d2hc5b11rfx4am"))))
+        "00sznj1sl97fqpn6j8ngps04clvxp8h8yhw6lvszx4b855wz9rqk"))))
     (build-system gnu-build-system)
     (inputs
      `(("aalib" ,aalib)
@@ -260,14 +260,14 @@ developers consider to have good quality code and correct functionality.")
 (define-public gst-plugins-bad
   (package
     (name "gst-plugins-bad")
-    (version "1.12.2")
+    (version "1.12.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://gstreamer.freedesktop.org/src/"
                                   name "/" name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0dwyq03g2m0p16dwx8q5qvjn5x9ia72h21sf87mp97gmwkfpwb4w"))))
+                "1v5z3i5ha20gmbb3r9dwsaaspv5fm1jfzlzwlzqx1gjj31v5kl1n"))))
     (outputs '("out" "doc"))
     (build-system gnu-build-system)
     (arguments
@@ -345,7 +345,7 @@ par compared to the rest.")
 (define-public gst-plugins-ugly
   (package
     (name "gst-plugins-ugly")
-    (version "1.12.2")
+    (version "1.12.3")
     (source
      (origin
        (method url-fetch)
@@ -353,7 +353,7 @@ par compared to the rest.")
                            name "/" name "-" version ".tar.xz"))
        (sha256
         (base32
-         "0rplyp1qk359c97ig9i2vc1v34g92khd8dslwfipva1ypwmr9hqw"))))
+         "0lh00rg26iy5lr5al23lxsyncjqkgzph1bzkrgp8x9sfr62ab378"))))
     (build-system gnu-build-system)
     (inputs
      `(("gst-plugins-base" ,gst-plugins-base)
@@ -384,7 +384,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
 (define-public gst-libav
   (package
     (name "gst-libav")
-    (version "1.12.2")
+    (version "1.12.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -392,7 +392,7 @@ distribution problems in some jurisdictions, e.g. due to patent threats.")
                     name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1crdahkjm23byg1awcrjkmgfbalfpvvac7h7whm6b2r1pfwkbdsv"))))
+                "0l4nc6ikdx49l7bdrk3bd9p3pzry8a328r22zg48gyzpnv5ghph1"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--with-system-libav")
@@ -422,7 +422,7 @@ compression formats through the use of the libav library.")
 (define-public python-gst
   (package
     (name "python-gst")
-    (version "1.12.2")
+    (version "1.12.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -430,7 +430,7 @@ compression formats through the use of the libav library.")
                     "gst-python-" version ".tar.xz"))
               (sha256
                (base32
-                "0iwy0v2k27wd3957ich6j5f0f04b0wb2mb175ypf2lx68snk5k7l"))))
+                "19rb06x2m7103zwfm0plxx95gb8bp01ng04h4q9k6ii9q7g2kxf3"))))
     (build-system gnu-build-system)
     (arguments
      ;; XXX: Factorize python-sitedir with python-build-system.
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 9de7c5b721..0d3da63ca6 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -379,7 +379,7 @@ printing and other features typical of a source code editor.")
 (define-public gtksourceview
  (package
    (name "gtksourceview")
-   (version "3.24.2")
+   (version "3.24.4")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnome/sources/" name "/"
@@ -387,7 +387,7 @@ printing and other features typical of a source code editor.")
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-               "17xqrnh2v9gba57ij2m9kngxwh19fzsqkx1rfasnv4zaqvqqhv69"))))
+               "14x738xrz9q8qz13xd7dys748ryxyq2srbqyaa9r7n47h2av2zr0"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases
@@ -428,6 +428,7 @@ highlighting and other features typical of a source code editor.")
   (package
    (name "gdk-pixbuf")
    (version "2.36.9")
+   (replacement gdk-pixbuf-2.36.10)
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -482,6 +483,7 @@ in the GNOME project.")
 (define-public gdk-pixbuf+svg
   (package (inherit gdk-pixbuf)
     (name "gdk-pixbuf+svg")
+    (replacement gdk-pixbuf+svg-2.36.10)
     (inputs
      `(("librsvg" ,librsvg)
        ,@(package-inputs gdk-pixbuf)))
@@ -505,6 +507,26 @@ in the GNOME project.")
     (synopsis
      "GNOME image loading and manipulation library, with SVG support")))
 
+;; Graft replacement packages to fix these vulnerabilities.
+;; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2862
+;; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2870
+;; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6311
+(define-public gdk-pixbuf-2.36.10
+  (package (inherit gdk-pixbuf)
+           (version "2.36.A")
+           (source (origin
+                     (method url-fetch)
+                     (uri (string-append "mirror://gnome/sources/gdk-pixbuf/2.36/"
+                                         "gdk-pixbuf-2.36.10.tar.xz"))
+                     (sha256
+                      (base32
+                       "1klsjkdbashd8yb8xjsc9ff3bz32n2id5s79nrrmqiw9df4zmxpq"))))))
+
+(define-public gdk-pixbuf+svg-2.36.10
+  (package (inherit gdk-pixbuf+svg)
+           (version "2.36.A")
+           (source (origin (inherit (package-source gdk-pixbuf-2.36.10))))))
+
 (define-public at-spi2-core
   (package
    (name "at-spi2-core")
diff --git a/gnu/packages/image-viewers.scm b/gnu/packages/image-viewers.scm
index f82d4baf24..dfb68488ee 100644
--- a/gnu/packages/image-viewers.scm
+++ b/gnu/packages/image-viewers.scm
@@ -54,7 +54,7 @@
 (define-public feh
   (package
     (name "feh")
-    (version "2.19.3")
+    (version "2.20")
     (home-page "https://feh.finalrewind.org/")
     (source (origin
               (method url-fetch)
@@ -62,7 +62,7 @@
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "1l3yvv0l0ggwlfyhk84p2g9mrqvzqrg1fgalf88kzppvb9jppjay"))))
+                "02vhdv16nf4kjna4inpbfy4k3p40bhl7xpc4kh4xvily14146l2b"))))
     (build-system gnu-build-system)
     (arguments
       '(#:phases (alist-delete 'configure %standard-phases)
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 5d062b107b..e525c75693 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -522,7 +522,10 @@ work.")
           "0yvfghxwfm3dcqr9krkw63pcd76hzkknc3fh7bh11s8qlvjvrpbg"))
         (patches (search-patches "openjpeg-CVE-2017-12982.patch"
                                  "openjpeg-CVE-2017-14040.patch"
-                                 "openjpeg-CVE-2017-14041.patch"))))
+                                 "openjpeg-CVE-2017-14041.patch"
+                                 "openjpeg-CVE-2017-14151.patch"
+                                 "openjpeg-CVE-2017-14152.patch"
+                                 "openjpeg-CVE-2017-14164.patch"))))
     (build-system cmake-build-system)
     (arguments
       ;; Trying to run `$ make check' results in a no rule fault.
@@ -931,7 +934,7 @@ convert, manipulate, filter and display a wide variety of image formats.")
 (define-public jasper
   (package
     (name "jasper")
-    (version "2.0.13")
+    (version "2.0.14")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/mdadams/jasper/archive/"
@@ -939,7 +942,7 @@ convert, manipulate, filter and display a wide variety of image formats.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "090cyqcvqp4y12nc57gvcbrk3ap1rnnixd4qj90sx0pw3fs1615m"))))
+                "0yx9y5y0g6jv142vnqp50j3k8k5yqznz3smrblv192wgfbm6w9l5"))))
     (build-system cmake-build-system)
     (inputs `(("libjpeg" ,libjpeg)))
     (synopsis "JPEG-2000 library")
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index 57ac7fda97..5f3e3ad96d 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -46,14 +46,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.9-9")
+    (version "6.9.9-12")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "0p7jz55zry5r1lv34ymx536fqymvy3iwzwy0kvj53mlmsaad7vjr"))))
+               "10k63nb1wi5fq1xg1wkjfw7ph46ysy8rndgp18knj2zr06zjjrc5"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
@@ -178,11 +178,14 @@ script.")
                (base32
                 "122zgs96dqrys62mnh8x5yvfff6km4d3yrnvaxzg3mg5sprib87v"))
               (patches
-               (search-patches "graphicsmagick-CVE-2017-12935.patch"
+               (search-patches "graphicsmagick-CVE-2017-11403+CVE-2017-14103.patch"
+                               "graphicsmagick-CVE-2017-12935.patch"
                                "graphicsmagick-CVE-2017-12936.patch"
                                "graphicsmagick-CVE-2017-12937.patch"
                                "graphicsmagick-CVE-2017-13775.patch"
-                               "graphicsmagick-CVE-2017-13776+CVE-2017-13777.patch"))))
+                               "graphicsmagick-CVE-2017-13776+CVE-2017-13777.patch"
+                               "graphicsmagick-CVE-2017-14042.patch"
+                               "graphicsmagick-CVE-2017-14165.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index f361697b2b..806f13ab89 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -1628,6 +1628,10 @@ IcedTea build harness.")
                    (copy-recursively "openjdk.build/docs" doc)
                    (copy-recursively "openjdk.build/images/j2re-image" jre)
                    (copy-recursively "openjdk.build/images/j2sdk-image" jdk)
+                   ;; Install the nss.cfg file to JRE to enable SSL/TLS
+                   ;; support via NSS.
+                   (copy-file (string-append jdk "/jre/lib/security/nss.cfg")
+                              (string-append jre "/lib/security/nss.cfg"))
                    #t)))))))
       (native-inputs
        `(("jdk" ,icedtea-7 "jdk")
diff --git a/gnu/packages/libffcall.scm b/gnu/packages/libffcall.scm
index a8b4135caf..84fd1a833f 100644
--- a/gnu/packages/libffcall.scm
+++ b/gnu/packages/libffcall.scm
@@ -27,7 +27,7 @@
 (define-public libffcall
    (package
     (name "libffcall")
-    (version "1.13")
+    (version "2.0")
     (source
      (origin
        (method url-fetch)
@@ -35,7 +35,7 @@
              "mirror://gnu/libffcall/libffcall-" version ".tar.gz"))
        (sha256
         (base32
-         "1rxwkfr0p7vdv6q6x8nmn13611nsq0lnk9cspqdpzxdvgmqcw1qp"))))
+         "0v0rh3vawb8z5q40fs3kr2f9zp06n2fq4rr2ww4562nr96sd5aj1"))))
     (build-system gnu-build-system)
     (arguments `(#:parallel-build? #f))
     (synopsis "Foreign function calls from interpreters")
diff --git a/gnu/packages/libidn.scm b/gnu/packages/libidn.scm
index fc91fe263e..dfb1be6c4f 100644
--- a/gnu/packages/libidn.scm
+++ b/gnu/packages/libidn.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2012 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2017 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -55,6 +56,7 @@ Java libraries.")
   (package
     (name "libidn2")
     (version "2.0.2")
+    (replacement libidn2-2.0.4)
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/libidn/" name "-" version
@@ -76,3 +78,16 @@ library.")
     ;; The command-line tool 'idn2' is GPL3+, while the library is dual-licensed
     ;; GPL2+ or LGPL3+.
     (license (list gpl2+ gpl3+ lgpl3+))))
+
+(define-public libidn2-2.0.4
+  (package
+    (inherit libidn2)
+    (name "libidn2")
+    (version "2.0.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/libidn/" name "-" version
+                                  ".tar.lz"))
+              (sha256
+               (base32
+                "00f2fyw5kwr9is3cdn5h9arzxp0lnvg0z9bb9zyfs0dq81gaqim4"))))))
diff --git a/gnu/packages/libreoffice.scm b/gnu/packages/libreoffice.scm
index d1e2e2e6e3..0b1e729592 100644
--- a/gnu/packages/libreoffice.scm
+++ b/gnu/packages/libreoffice.scm
@@ -6,6 +6,7 @@
 ;;; Copyright © 2017 Thomas Danckaert <post@thomasdanckaert.be>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Andy Wingo <wingo@igalia.com>
+;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,12 +25,14 @@
 
 (define-module (gnu packages libreoffice)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system trivial)
   #:use-module (guix download)
   #:use-module ((guix licenses)
                 #:select (gpl2+ lgpl2.1+ lgpl3+ mpl1.1 mpl2.0
                           non-copyleft x11-style))
   #:use-module (guix packages)
   #:use-module (guix utils)
+  #:use-module (ice-9 match)
   #:use-module (gnu packages)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
@@ -719,6 +722,9 @@ Zoner Draw version 4 and 5.")
          (add-after 'unpack 'bootstrap
            (lambda _
              (zero? (system* "autoreconf" "-vfi")))))))
+    (native-search-paths (list (search-path-specification
+                                (variable "DICPATH")
+                                (files '("share/hunspell")))))
     (home-page "https://hunspell.github.io/")
     (synopsis "Spell checker")
     (description "Hunspell is a spell checker and morphological analyzer
@@ -727,6 +733,78 @@ word compounding or character encoding.")
     ;; Triple license, including "mpl1.1 or later".
     (license (list mpl1.1 gpl2+ lgpl2.1+))))
 
+(define (dicollecte-french-dictionary variant synopsis)
+  ;; Return a French dictionary package from dicollecte.org, for the given
+  ;; VARIANT.
+  (package
+    (name (match variant
+            ("classique" "hunspell-dict-fr")
+            (_ (string-append "hunspell-dict-fr-" variant))))
+    (version "6.1")
+    (source (origin
+              (uri (string-append
+                    "http://www.dicollecte.org/download/fr/hunspell-french-dictionaries-v"
+                    version ".zip"))
+              (method url-fetch)
+              (sha256
+               (base32
+                "0w2hzh36wj3lsj2yd4mh7z7547dg452sywj79vnzx27csclwqshc"))))
+    (build-system trivial-build-system)
+    (native-inputs `(("unzip" ,unzip)))
+    (arguments
+     `(#:modules ((guix build utils))
+       #:builder (begin
+                   (use-modules (guix build utils)
+                                (srfi srfi-26))
+
+                   (let* ((out      (assoc-ref %outputs "out"))
+                          (hunspell (string-append out "/share/hunspell"))
+                          (myspell  (string-append out "/share/myspell"))
+                          (doc      (string-append out "/share/doc/"
+                                                   ,name))
+                          (unzip    (assoc-ref %build-inputs "unzip")))
+                     (system* (string-append unzip "/bin/unzip")
+                              (assoc-ref %build-inputs "source"))
+                     (for-each (cut install-file <> hunspell)
+                               (find-files "."
+                                           ,(string-append variant
+                                                           "\\.(dic|aff)$")))
+                     (mkdir-p myspell)
+                     (symlink hunspell (string-append myspell "/dicts"))
+                     (for-each (cut install-file <> doc)
+                               (find-files "." "\\.(txt|org|md)$"))
+                     #t))))
+    (synopsis synopsis)
+    (description
+     "This package provides a dictionary for the Hunspell spell-checking
+library.")
+    (home-page "https://www.dicollecte.org/home.php?prj=fr")
+    (license mpl2.0)))
+
+(define-syntax define-french-dictionary
+  (syntax-rules (synopsis)
+    ((_ name variant (synopsis text))
+     (define-public name
+       (dicollecte-french-dictionary variant text)))))
+
+(define-french-dictionary hunspell-dict-fr-classique
+  "classique"
+  ;; TRANSLATORS: In French, this is "Français classique".
+  (synopsis "Hunspell dictionary for ``classic'' French (recommended)"))
+
+(define-french-dictionary hunspell-dict-fr-moderne
+  "moderne"
+  ;; TRANSLATORS: In French, this is "Français moderne".
+  (synopsis "Hunspell dictionary for ``modern'' French"))
+
+(define-french-dictionary hunspell-dict-fr-réforme-1990
+  "reforme1990"
+  (synopsis "Hunspell dictionary for the post @dfn{1990 réforme} French"))
+
+(define-french-dictionary hunspell-dict-fr-toutes-variantes
+  "toutesvariantes"
+  (synopsis "Hunspell dictionary for all variants of French"))
+
 (define-public hyphen
   (package
     (name "hyphen")
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 01e895f4af..4be6f5ed08 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -367,8 +367,8 @@ It has been modified to remove all non-free binary blobs.")
 
 (define %intel-compatible-systems '("x86_64-linux" "i686-linux"))
 
-(define %linux-libre-version "4.13")
-(define %linux-libre-hash "07mxcya7ml1v34pbg4mjh1sq80r3b4dsxbcs41fm50jnhq7p1w4v")
+(define %linux-libre-version "4.13.2")
+(define %linux-libre-hash "166yy7nah2h2ffxqgb92nfwrvihna3kvdx4ryppf34gmybmmfw36")
 
 (define-public linux-libre
   (make-linux-libre %linux-libre-version
@@ -377,14 +377,14 @@ It has been modified to remove all non-free binary blobs.")
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.9
-  (make-linux-libre "4.9.47"
-                    "0gkmznb168m90zhyn9xg9420k64ba7bmyg70gazfr80y47w6jpdw"
+  (make-linux-libre "4.9.50"
+                    "1igjb2qr4znvz9p5ix18lbiv8bkfgn7lprn92gdyff4g4r4kzh72"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.4
-  (make-linux-libre "4.4.86"
-                    "0zm283262k63c5sa3l2lg8lqdjmgzym60qf3kvfva21xqswzcpas"
+  (make-linux-libre "4.4.88"
+                    "0ds5jxh8p7f8yk55i1xbvz0xmgp4nc7g1xka23c4mcbal2v9v5b2"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
@@ -392,7 +392,17 @@ It has been modified to remove all non-free binary blobs.")
   (make-linux-libre "4.1.43"
                     "0ycqmvczj7lm7czilnwpyp14n2lzilyx7m43rsq1qdm2m5rp4q2w"
                     %intel-compatible-systems
-                    #:configuration-file kernel-config))
+                    #:configuration-file kernel-config
+                    #:patches
+                    (list %boot-logo-patch
+                          (origin
+                            (method url-fetch)
+                            (uri "\
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/patch/?id=4a01092a5fa819397484fe2b50e9518356858156")
+                            (file-name "linux-libre-4.4-CVE-2017-1000251.patch")
+                            (sha256
+                             (base32
+                              "0zmkw9zvzpwy2ihiyfrw6mrf8qzv77cm23lxadr20qvzqlc1xzb3"))))))
 
 (define-public linux-libre-arm-generic
   (make-linux-libre %linux-libre-version
@@ -861,14 +871,14 @@ Zerofree requires the file system to be unmounted or mounted read-only.")
 (define-public strace
   (package
     (name "strace")
-    (version "4.18")
+    (version "4.19")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/strace/strace/" version
                                  "/strace-" version ".tar.xz"))
              (sha256
               (base32
-               "026agy9nq238nx3ynhmi8h3vx96yra4xacfsm2ybs9k23ry8ibc9"))))
+               "10bjh2mrkvx41fk60b2iqv5b5k4r7a3qdsx04iyg904jqb3fp4vw"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -1132,7 +1142,7 @@ that the Ethernet protocol is much simpler than the IP protocol.")
 (define-public iproute
   (package
     (name "iproute2")
-    (version "4.12.0")
+    (version "4.13.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -1140,7 +1150,7 @@ that the Ethernet protocol is much simpler than the IP protocol.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "0zdxdsxyaazl85xhwskvsmpyzwf5qp21cvjsi1lw3xnrc914q2if"))))
+                "0l2w84cwr54gaw3cbxijf614l76hx8mgcz57v81rwl68z3nq3yww"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f                                ; no test suite
@@ -1173,23 +1183,14 @@ that the Ethernet protocol is much simpler than the IP protocol.")
     (synopsis
      "Utilities for controlling TCP/IP networking and traffic in Linux")
     (description
-     "Iproute2 is a collection of utilities for controlling TCP/IP
-networking and traffic with the Linux kernel.
+     "Iproute2 is a collection of utilities for controlling TCP/IP networking
+and traffic with the Linux kernel.  The most important of these are
+@command{ip}, which configures IPv4 and IPv6, and @command{tc} for traffic
+control.
 
 Most network configuration manuals still refer to ifconfig and route as the
 primary network configuration tools, but ifconfig is known to behave
-inadequately in modern network environments.  They should be deprecated, but
-most distros still include them.  Most network configuration systems make use
-of ifconfig and thus provide a limited feature set.  The /etc/net project aims
-to support most modern network technologies, as it doesn't use ifconfig and
-allows a system administrator to make use of all iproute2 features, including
-traffic control.
-
-iproute2 is usually shipped in a package called iproute or iproute2 and
-consists of several tools, of which the most important are @command{ip} and
-@command{tc}.  @command{ip} controls IPv4 and IPv6 configuration and
-@command{tc} stands for traffic control.  Both tools print detailed usage
-messages and are accompanied by a set of manpages.")
+inadequately in modern network environments, and both should be deprecated.")
     (license license:gpl2+)))
 
 ;; There are two packages for net-tools. The first, net-tools, is more recent
@@ -3022,6 +3023,7 @@ Bluetooth audio output devices like headphones or loudspeakers.")
   (package
     (name "bluez")
     (version "5.46")
+    (replacement bluez/fixed)
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -3083,6 +3085,20 @@ Bluetooth audio output devices like headphones or loudspeakers.")
 is flexible, efficient and uses a modular implementation.")
     (license license:gpl2+)))
 
+(define bluez/fixed
+  (package
+    (inherit bluez)
+    (version "5.46")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://kernel.org/linux/bluetooth/bluez-"
+                    version ".tar.xz"))
+              (sha256
+               (base32
+                "0a4fj343bdqsfyv12hmj9nym0ilsf0bvm54a4apbiby16ww3vayx"))
+              (patches (search-patches "bluez-CVE-2017-1000250.patch"))))))
+
 (define-public fuse-exfat
   (package
     (name "fuse-exfat")
@@ -3155,7 +3171,7 @@ and copy/paste text in the console and in xterm.")
 (define-public btrfs-progs
   (package
     (name "btrfs-progs")
-    (version "4.12")
+    (version "4.13")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://kernel.org/linux/kernel/"
@@ -3163,7 +3179,7 @@ and copy/paste text in the console and in xterm.")
                                   "btrfs-progs-v" version ".tar.xz"))
               (sha256
                (base32
-                "1kif8xw2dbyc70ygkp0wyq4x96p1mkwdv4430f99qllx9b410xwi"))))
+                "17m67jm29phfvkmd72lxb1z9nymn9a9pqnja8zfb1mvflsqwbz3m"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "static"))      ; static versions of the binaries in "out"
@@ -3171,6 +3187,12 @@ and copy/paste text in the console and in xterm.")
      '(#:phases (modify-phases %standard-phases
                  (add-after 'build 'build-static
                    (lambda _ (zero? (system* "make" "static"))))
+                 (add-after 'install 'install-bash-completion
+                   (lambda* (#:key outputs #:allow-other-keys)
+                     (install-file "btrfs-completion"
+                                   (string-append (assoc-ref outputs "out")
+                                                  "/etc/bash_completion.d"))
+                     #t))
                  (add-after 'install 'install-static
                    (let ((staticbin (string-append (assoc-ref %outputs "static")
                                                   "/bin")))
@@ -3194,6 +3216,7 @@ and copy/paste text in the console and in xterm.")
                      ("libxml2" ,libxml2)
                      ("docbook-xsl" ,docbook-xsl)
                      ;; For tests.
+                     ("acl" ,acl)
                      ("which" ,which)))
     (home-page "https://btrfs.wiki.kernel.org/")
     (synopsis "Create and manage btrfs copy-on-write file systems")
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index 2a759c3d2e..8c376b1e45 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -265,7 +265,7 @@ operating systems.")
   (package
     (inherit mutt)
     (name "neomutt")
-    (version "20170714")
+    (version "20170912")
     (source
      (origin
        (method url-fetch)
@@ -273,7 +273,7 @@ operating systems.")
                            "/archive/" name "-" version ".tar.gz"))
        (sha256
         (base32
-         "10x3sxai773n0gfqpi904ci1qvngymcbc2didswrm92wz4h8km20"))))
+         "0mv60kii933hq52mhwrcz29diaajbs5ryqibgsvdvfyvx27i43cz"))))
     (inputs
      `(("cyrus-sasl" ,cyrus-sasl)
        ("gdbm" ,gdbm)
@@ -667,14 +667,14 @@ invoking @command{notifymuch} from the post-new hook.")
 (define-public notmuch
   (package
     (name "notmuch")
-    (version "0.25")
+    (version "0.25.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://notmuchmail.org/releases/notmuch-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "02z6d87ip1hkipz8d7w0sfklg8dd5fd5vlgp768640ixg0gqvlk5"))))
+                "0c98hzwc60nb6kd15y0fl2ji3yfmr9k6v8ps0h3ihr3vkgn0kgxl"))))
     (build-system gnu-build-system)
     (arguments
      '(#:make-flags (list "V=1") ; Verbose test output.
@@ -727,45 +727,51 @@ ing, and tagging large collections of email messages.")
     (license gpl3+)))
 
 (define-public notmuch-addrlookup-c
-  (package
-    (name "notmuch-addrlookup-c")
-    (version "7")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/aperezdc/" name "/archive/v"
-                    version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0rslg2ifgyhl6asv3yr1f62m9xjfcinv7i6qb07h2k217jqlmrri"))))
-    (build-system gnu-build-system)
-    (arguments
-     '(#:tests? #f ; no tests
-       #:make-flags (list "CC=gcc"
-                          (string-append "PREFIX="
-                                         (assoc-ref %outputs "out")))
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  ;; Remove vim code completion config, it's not needed to
-                  ;; build (or be patched).
-                  (add-before 'patch-source-shebangs 'delete-ycm-file
-                              (lambda _ (delete-file ".ycm_extra_conf.py")))
-                  (replace 'install
-                           (lambda* (#:key outputs #:allow-other-keys)
-                             (let ((bin (string-append
-                                         (assoc-ref outputs "out") "/bin")))
-                               (install-file "notmuch-addrlookup" bin)))))))
-    (native-inputs
-     `(("pkg-config" ,pkg-config)))
-    (inputs
-     `(("glib" ,glib)
-       ("notmuch" ,notmuch)))
-    (home-page "https://github.com/aperezdc/notmuch-addrlookup-c")
-    (synopsis "Address lookup tool for Notmuch")
-    (description "This is an address lookup tool using a Notmuch database,
+  ;; This commit includes a compatibility fix for notmuch-0.25, and is not
+  ;; currently part of any release.  Please update this package when
+  ;; notmuch-addrlookup-c-9 is released.
+  (let ((commit "88f156d04990a71c6ad6fc2757b537b44e3c4d00")
+        (revision "1"))          ;Guix package revision
+    (package
+      (name "notmuch-addrlookup-c")
+      (version (string-append "8-" revision "."
+                              (string-take commit 7)))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/aperezdc/notmuch-addrlookup-c.git")
+                      (commit commit)))
+                (file-name (string-append name "-" version "-checkout"))
+                (sha256
+                 (base32
+                  "0v0wzs7qzy4n1hbql8s10qrwgalcxdzbxf8pj6cii1pv2jwmkxbm"))))
+      (build-system gnu-build-system)
+      (arguments
+       '(#:tests? #f ; no tests
+         #:make-flags (list "CC=gcc"
+                            (string-append "PREFIX="
+                                           (assoc-ref %outputs "out")))
+         #:phases (modify-phases %standard-phases
+                    (delete 'configure)
+                    ;; Remove vim code completion config, it's not needed to
+                    ;; build (or be patched).
+                    (add-before 'patch-source-shebangs 'delete-ycm-file
+                                (lambda _ (delete-file ".ycm_extra_conf.py")))
+                    (replace 'install
+                             (lambda* (#:key outputs #:allow-other-keys)
+                               (let ((bin (string-append
+                                           (assoc-ref outputs "out") "/bin")))
+                                 (install-file "notmuch-addrlookup" bin)))))))
+      (native-inputs
+       `(("pkg-config" ,pkg-config)))
+      (inputs
+       `(("glib" ,glib)
+         ("notmuch" ,notmuch)))
+      (home-page "https://github.com/aperezdc/notmuch-addrlookup-c")
+      (synopsis "Address lookup tool for Notmuch")
+      (description "This is an address lookup tool using a Notmuch database,
 useful for email address completion.")
-    (license license:expat)))
+      (license license:expat))))
 
 (define-public python-notmuch
   (package
diff --git a/gnu/packages/man.scm b/gnu/packages/man.scm
index 4eefafbe12..60076f0f1a 100644
--- a/gnu/packages/man.scm
+++ b/gnu/packages/man.scm
@@ -138,7 +138,7 @@ the traditional flat-text whatis databases.")
 (define-public man-pages
   (package
     (name "man-pages")
-    (version "4.12")
+    (version "4.13")
     (source (origin
               (method url-fetch)
               (uri
@@ -151,7 +151,7 @@ the traditional flat-text whatis databases.")
                     "man-pages-" version ".tar.xz")))
               (sha256
                (base32
-                "14z0zcwm0m98fk2m2b3pvr8rs2sb602mg8f7wwb4xl7yj7cpjvbg"))))
+                "1gri0rm9i3a6w5dvsmwawhwzywl5x80dwq05d2v8l92knv2hbh6m"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (alist-delete 'configure %standard-phases)
diff --git a/gnu/packages/markup.scm b/gnu/packages/markup.scm
index 121e6cdbf4..667f8b0a94 100644
--- a/gnu/packages/markup.scm
+++ b/gnu/packages/markup.scm
@@ -26,7 +26,9 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial)
   #:use-module (guix build-system cmake)
+  #:use-module (guix build-system perl)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages python)
   #:use-module (gnu packages web))
@@ -102,6 +104,92 @@ convert it to structurally valid XHTML (or HTML).")
     (license (non-copyleft "file://License.text"
                            "See License.text in the distribution."))))
 
+(define-public discount
+  (package
+    (name "discount")
+    (version "2.2.2")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append
+                   "http://www.pell.portland.or.us/~orc/Code/"
+                   name "/" name "-" version ".tar.bz2"))
+             (file-name (string-append name "-" version ".tar.gz"))
+             (sha256
+              (base32
+               "0r4gjyk1ngx47zhb25q0gkjm3bz2m5x8ngrk6rim3y1y3rricygc"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:test-target "test"
+       #:make-flags (list
+                     (string-append "LFLAGS=-L. -Wl,-rpath="
+                                    (assoc-ref %outputs "out") "/lib"))
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'set-AC_PATH
+           (lambda _
+             ;; The default value is not suitable, so override using an
+             ;; environment variable. This just affects the build, and not the
+             ;; resulting store item.
+             (setenv "AC_PATH" (getenv "PATH"))
+             #t))
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (setenv "CC" "gcc")
+             (zero? (system*
+                     "./configure.sh"
+                     (string-append "--prefix=" (assoc-ref outputs "out"))
+                     "--shared")))))))
+    (synopsis "Markdown processing library, written in C")
+    (description
+     "Discount is a markdown implementation, written in C.  It provides a
+@command{markdown} command, and a library.")
+    (home-page "http://www.pell.portland.or.us/~orc/Code/discount/")
+    (license bsd-3)))
+
+(define-public perl-text-markdown-discount
+  (package
+    (name "perl-text-markdown-discount")
+    (version "0.11")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/S/SE/SEKIMURA/Text-Markdown-Discount-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1xx7v3wnla7m6wa3h33whxw3vvincaicg4yra1b9wbzf2aix9rnw"))
+       (patches
+        (search-patches "perl-text-markdown-discount-use-system-markdown.patch"))))
+    (build-system perl-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'build 'set-ldflags
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "Makefile"
+               (("OTHERLDFLAGS = ")
+                (string-append
+                      "OTHERLDFLAGS = -lmarkdown -Wl,-rpath="
+                      (assoc-ref inputs "discount")
+                      "/lib"))))))))
+    (inputs
+     `(("discount" ,discount)))
+    (home-page
+     "http://search.cpan.org/dist/Text-Markdown-Discount")
+    (synopsis
+     "Fast function for converting Markdown to HTML using Discount")
+    (description
+     "Text::Markdown::Discount is a Perl extension to the Discount markdown
+implementation.
+
+@example
+  use Text::Markdown::Discount;
+  my $html = markdown($text)
+@end example")
+    (license perl-license)))
+
 (define-public cmark
   (package
     (name "cmark")
diff --git a/gnu/packages/mate.scm b/gnu/packages/mate.scm
index c64e26124d..91489ba91b 100644
--- a/gnu/packages/mate.scm
+++ b/gnu/packages/mate.scm
@@ -24,15 +24,30 @@
   #:use-module (guix download)
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system glib-or-gtk)
+  #:use-module (guix build-system trivial)
   #:use-module (gnu packages)
   #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages freedesktop)
+  #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages fonts)
+  #:use-module (gnu packages libcanberra)
+  #:use-module (gnu packages linux)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gtk)
+  #:use-module (gnu packages gettext)
   #:use-module (gnu packages gnome)
+  #:use-module (gnu packages docbook)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages xorg)
+  #:use-module (gnu packages documentation)
   #:use-module (gnu packages xdisorg)
   #:use-module (gnu packages base)
   #:use-module (gnu packages xml)
+  #:use-module (gnu packages photo)
+  #:use-module (gnu packages polkit)
+  #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages python))
 
 (define-public mate-icon-theme
@@ -165,6 +180,183 @@ desktop and the mate-about program.")
 the MATE desktop environment.")
     (license license:lgpl2.1+)))
 
+(define-public mate-terminal
+  (package
+    (name "mate-terminal")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1zihm609d2d9cw53ry385whshjl1dnkifpk41g1ddm9f58hv4da1"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("gobject-introspection" ,gobject-introspection)
+       ("libxml2" ,libxml2)
+       ("yelp-tools" ,yelp-tools)))
+    (inputs
+     `(("dconf" ,dconf)
+       ("gtk+" ,gtk+)
+       ("libice" ,libice)
+       ("libsm" ,libsm)
+       ("libx11" ,libx11)
+       ("mate-desktop" ,mate-desktop)
+       ("pango" ,pango)
+       ("vte" ,vte)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "MATE Terminal Emulator")
+    (description
+     "MATE Terminal is a terminal emulation application that you can
+use to access a shell.  With it, you can run any application that
+is designed to run on VT102, VT220, and xterm terminals.
+MATE Terminal also has the ability to use multiple terminals
+in a single window (tabs) and supports management of different
+configurations (profiles).")
+    (license license:gpl3)))
+
+(define-public mate-session-manager
+  (package
+    (name "mate-session-manager")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0i0xq6041x2qmb26x9bawx0qpfkgjn6x9w3phnm9s7rc4s0z20ll"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("xtrans" ,xtrans)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("gtk+" ,gtk+)
+       ("dbus-glib" ,dbus-glib)
+       ("libsm" ,libsm)
+       ("mate-desktop" ,mate-desktop)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Session manager for MATE")
+    (description
+     "Mate-session contains the MATE session manager, as well as a
+configuration program to choose applications starting on login.")
+    (license license:gpl2)))
+
+(define-public mate-settings-daemon
+  (package
+    (name "mate-settings-daemon")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "07b2jkxqv07njdrgkdck93d872p6lch1lrvi7ydnpicspg3rfid6"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("cairo" ,cairo)
+       ("dbus" ,dbus)
+       ("dbus-glib" ,dbus-glib)
+       ("dconf" ,dconf)
+       ("fontconfig" ,fontconfig)
+       ("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libmatekbd" ,libmatekbd)
+       ("libmatemixer" ,libmatemixer)
+       ("libnotify" ,libnotify)
+       ("libx11" ,libx11)
+       ("libxext" ,libxext)
+       ("libxi" ,libxi)
+       ("libxklavier" ,libxklavier)
+       ("mate-desktop" ,mate-desktop)
+       ("nss" ,nss)
+       ("polkit" ,polkit)
+       ("startup-notification" ,startup-notification)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Settings Daemon for MATE")
+    (description
+     "Mate-settings-daemon is a fork of gnome-settings-daemon.")
+    (license (list license:lgpl2.1 license:gpl2))))
+
+(define-public libmatemixer
+  (package
+    (name "libmatemixer")
+    (version "1.18.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "09vyxnlnalws318gsafdfi5c6jwpp92pbafn1ddlqqds23ihk4mr"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("glib" ,glib)
+       ("pulseaudio" ,pulseaudio)
+       ("alsa-lib" ,alsa-lib)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Mixer library for the MATE desktop")
+    (description
+     "Libmatemixer is a mixer library for MATE desktop.  It provides an abstract
+API allowing access to mixer functionality available in the PulseAudio and ALSA
+sound systems.")
+    (license license:lgpl2.1)))
+
+(define-public libmatekbd
+  (package
+    (name "libmatekbd")
+    (version "1.18.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "030bl18qbjm7l92bp1bhs7v82bp8j3mv7c1j1a4gd89iz4611pq3"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("cairo" ,cairo)
+       ("gdk-pixbuf" ,gdk-pixbuf+svg)
+       ("glib" ,glib)
+       ("gtk+" ,gtk+)
+       ("libx11" ,libx11)
+       ("libxklavier" ,libxklavier)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "MATE keyboard configuration library")
+    (description
+     "Libmatekbd is a keyboard configuration library for the
+MATE desktop environment.")
+    (license license:lgpl2.1)))
+
 (define-public mate-menus
   (package
     (name "mate-menus")
@@ -205,3 +397,415 @@ the MATE desktop environment.")
 specification, the MATE menu layout configuration files, .directory files and
 assorted menu related utility programs.")
     (license (list license:gpl2+ license:lgpl2.0+))))
+
+(define-public mate-applets
+  (package
+    (name "mate-applets")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1nplr8i1mxbxd7pqhcy8j69v25nsp5dk9fq7ffrmjmp39lrf3fh5"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("libxslt" ,libxslt)
+       ("yelp-tools" ,yelp-tools)
+       ("scrollkeeper" ,scrollkeeper)
+       ("gettext" ,gettext-minimal)
+       ("docbook-xml" ,docbook-xml)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("atk" ,atk)
+       ("dbus" ,dbus)
+       ("dbus-glib" ,dbus-glib)
+       ("glib" ,glib)
+       ("gucharmap" ,gucharmap)
+       ("gtk+" ,gtk+)
+       ("gtksourceview" ,gtksourceview)
+       ("libgtop" ,libgtop)
+       ("libmateweather" ,libmateweather)
+       ("libnotify" ,libnotify)
+       ("libx11" ,libx11)
+       ("libxml2" ,libxml2)
+       ("libwnck" ,libwnck)
+       ("mate-panel" ,mate-panel)
+       ("pango" ,pango)
+       ("polkit" ,polkit) ; either polkit or setuid
+       ("python" ,python-2)
+       ("upower" ,upower)
+       ("wireless-tools" ,wireless-tools)))
+    (propagated-inputs
+     `(("python-pygobject" ,python-pygobject)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Various applets for the MATE Panel")
+    (description
+     "Mate-applets includes various small applications for Mate-panel:
+
+@enumerate
+@item accessx-status: indicates keyboard accessibility settings,
+including the current state of the keyboard, if those features are in use.
+@item Battstat: monitors the power subsystem on a laptop.
+@item Character palette: provides a convenient way to access
+non-standard characters, such as accented characters,
+mathematical symbols, special symbols, and punctuation marks.
+@item MATE CPUFreq Applet: CPU frequency scaling monitor
+@item Drivemount: lets you mount and unmount drives and file systems.
+@item Geyes: pair of eyes which follow the mouse pointer around the screen.
+@item Keyboard layout switcher: lets you assign different keyboard
+layouts for different locales.
+@item Modem Monitor: monitors the modem.
+@item Invest: downloads current stock quotes from the Internet and
+displays the quotes in a scrolling display in the applet. The
+applet downloads the stock information from Yahoo! Finance.
+@item System monitor: CPU, memory, network, swap file and resource.
+@item Trash: lets you drag items to the trash folder.
+@item Weather report: downloads weather information from the
+U.S National Weather Service (NWS) servers, including the
+Interactive Weather Information Network (IWIN).
+@end enumerate\n")
+    (license (list license:gpl2+ license:lgpl2.0+ license:gpl3+))))
+
+(define-public mate-media
+  (package
+    (name "mate-media")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1l0j71d07898wb6ily09sj1xczwrmcw13wyhxwns7sxw592nwi04"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("gettext" ,gettext-minimal)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("cairo" ,cairo)
+       ("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libmatemixer" ,libmatemixer)
+       ("libxml2" ,libxml2)
+       ("mate-applets" ,mate-applets)
+       ("mate-desktop" ,mate-desktop)
+       ("mate-panel" ,mate-panel)
+       ("pango" ,pango)
+       ("startup-notification" ,startup-notification)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Multimedia related programs for the MATE desktop")
+    (description
+     "Mate-media includes the MATE media tools for MATE, including
+mate-volume-control, a MATE volume control application and applet.")
+    (license (list license:gpl2+ license:lgpl2.0+ license:fdl1.1+))))
+
+(define-public mate-panel
+  (package
+    (name "mate-panel")
+    (version "1.18.4")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "1n565ff1n7jrfx223i3cl3m69wjda506nvbn8gra7m1jwdfzpbw1"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:configure-flags
+       (list (string-append "--with-zoneinfo-dir="
+                            (assoc-ref %build-inputs "tzdata")
+                            "/share/zoneinfo")
+             "--with-in-process-applets=all")
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'fix-timezone-path
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let* ((tzdata (assoc-ref inputs "tzdata")))
+               (substitute* "applets/clock/system-timezone.h"
+                 (("/usr/share/lib/zoneinfo/tab")
+                  (string-append tzdata "/share/zoneinfo/zone.tab"))
+                 (("/usr/share/zoneinfo")
+                  (string-append tzdata "/share/zoneinfo"))))
+             #t))
+         (add-after 'unpack 'fix-introspection-install-dir
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (substitute* '("configure")
+                 (("`\\$PKG_CONFIG --variable=girdir gobject-introspection-1.0`")
+                  (string-append "\"" out "/share/gir-1.0/\""))
+                 (("\\$\\(\\$PKG_CONFIG --variable=typelibdir gobject-introspection-1.0\\)")
+                  (string-append out "/lib/girepository-1.0/")))
+               #t))))))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("xtrans" ,xtrans)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("dconf" ,dconf)
+       ("cairo" ,cairo)
+       ("dbus-glib" ,dbus-glib)
+       ("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libice" ,libice)
+       ("libmateweather" ,libmateweather)
+       ("librsvg" ,librsvg)
+       ("libsm" ,libsm)
+       ("libx11" ,libx11)
+       ("libxau" ,libxau)
+       ("libxml2" ,libxml2)
+       ("libxrandr" ,libxrandr)
+       ("libwnck" ,libwnck)
+       ("mate-desktop" ,mate-desktop)
+       ("mate-menus" ,mate-menus)
+       ("pango" ,pango)
+       ("tzdata" ,tzdata)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Panel for MATE")
+    (description
+     "Mate-panel contains the MATE panel, the libmate-panel-applet library and
+several applets.  The applets supplied here include the Workspace Switcher,
+the Window List, the Window Selector, the Notification Area, the Clock and the
+infamous 'Wanda the Fish'.")
+    (license (list license:gpl2+ license:lgpl2.0+))))
+
+(define-public caja
+  (package
+    (name "caja")
+    (version "1.18.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0mljqcx7k8p27854zm7qzzn8ca6hs7hva9p43hp4p507z52caqmm"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:configure-flags '("--disable-update-mimedb")
+       #:tests? #f ; tests fail even with display set
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'pre-check
+           (lambda _
+             ;; Tests require a running X server.
+             (system "Xvfb :1 &")
+             (setenv "DISPLAY" ":1")
+             ;; For the missing /etc/machine-id.
+             (setenv "DBUS_FATAL_WARNINGS" "0")
+             #t)))))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("glib:bin" ,glib "bin")
+       ("xorg-server" ,xorg-server)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("exempi" ,exempi)
+       ("gtk+" ,gtk+)
+       ("gvfs" ,gvfs)
+       ("libexif" ,libexif)
+       ("libnotify" ,libnotify)
+       ("libsm" ,libsm)
+       ("libxml2" ,libxml2)
+       ("mate-desktop" ,mate-desktop)
+       ("startup-notification" ,startup-notification)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "File manager for the MATE desktop")
+    (description
+     "Caja is the official file manager for the MATE desktop.
+It allows for browsing directories, as well as previewing files and launching
+applications associated with them.  Caja is also responsible for handling the
+icons on the MATE desktop.  It works on local and remote filesystems.")
+    ;; There is a note about a TRADEMARKS_NOTICE file in COPYING which
+    ;; does not exist. It is safe to assume that this is of no concern
+    ;; for us.
+    (license license:gpl2+)))
+
+(define-public mate-control-center
+  (package
+    (name "mate-control-center")
+    (version "1.18.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0flnn0h8f5aqyccwrlv7qxchvr3kqmlfdga6wq28d55zkpv5m7dl"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("yelp-tools" ,yelp-tools)
+       ("desktop-file-utils" ,desktop-file-utils)
+       ("kbproto" ,kbproto)
+       ("randrproto" ,randrproto)
+       ("renderproto" ,renderproto)
+       ("scrnsaverproto" ,scrnsaverproto)
+       ("xextpro" ,xextproto)
+       ("xproto" ,xproto)
+       ("xmodmap" ,xmodmap)
+       ("gobject-introspection" ,gobject-introspection)))
+    (inputs
+     `(("atk" ,atk)
+       ("cairo" ,cairo)
+       ("caja" ,caja)
+       ("dconf" ,dconf)
+       ("dbus" ,dbus)
+       ("dbus-glib" ,dbus-glib)
+       ("fontconfig" ,fontconfig)
+       ("freetype" ,freetype)
+       ("glib" ,glib)
+       ("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libmatekbd" ,libmatekbd)
+       ("libx11" ,libx11)
+       ("libxcursor" ,libxcursor)
+       ("libxext" ,libxext)
+       ("libxi" ,libxi)
+       ("libxklavier" ,libxklavier)
+       ("libxml2" ,libxml2)
+       ("libxrandr" ,libxrandr)
+       ("libxrender" ,libxrender)
+       ("libxscrnsaver" ,libxscrnsaver)
+       ("marco" ,marco)
+       ("mate-desktop" ,mate-desktop)
+       ("mate-menus" ,mate-menus)
+       ("mate-settings-daemon" ,mate-settings-daemon)
+       ("pango" ,pango)
+       ("startup-notification" ,startup-notification)))
+    (propagated-inputs
+     `(("gdk-pixbuf" ,gdk-pixbuf+svg) ; mate-slab.pc
+       ("librsvg" ,librsvg))) ; mate-slab.pc
+    (home-page "https://mate-desktop.org/")
+    (synopsis "MATE Desktop configuration tool")
+    (description
+     "MATE control center is MATE's main interface for configuration
+of various aspects of your desktop.")
+    (license license:gpl2+)))
+
+(define-public marco
+  (package
+    (name "marco")
+    (version "1.18.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://pub.mate-desktop.org/releases/"
+                           (version-major+minor version) "/"
+                           name "-" version ".tar.xz"))
+       (sha256
+        (base32
+         "0lwbp9wyd66hl5d7g272l8g3k1pb9s4s2p9fb04750a58w87d8k5"))))
+    (build-system glib-or-gtk-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("intltool" ,intltool)
+       ("itstool" ,itstool)
+       ("glib" ,glib)
+       ("gobject-introspection" ,gobject-introspection)
+       ("libxft" ,libxft)
+       ("libxml2" ,libxml2)
+       ("zenity" ,zenity)))
+    (inputs
+     `(("gtk+" ,gtk+)
+       ("libcanberra" ,libcanberra)
+       ("libgtop" ,libgtop)
+       ("libice" ,libice)
+       ("libsm" ,libsm)
+       ("libx11" ,libx11)
+       ("libxcomposite" ,libxcomposite)
+       ("libxcursor" ,libxcursor)
+       ("libxdamage" ,libxdamage)
+       ("libxext" ,libxext)
+       ("libxfixes" ,libxfixes)
+       ("libxinerama" ,libxinerama)
+       ("libxrandr" ,libxrandr)
+       ("libxrender" ,libxrender)
+       ("mate-desktop" ,mate-desktop)
+       ("pango" ,pango)
+       ("startup-notification" ,startup-notification)))
+    (home-page "https://mate-desktop.org/")
+    (synopsis "Window manager for the MATE desktop")
+    (description
+     "Marco is a minimal X window manager that uses GTK+ for drawing
+window frames.  It is aimed at non-technical users and is designed to integrate
+well with the MATE desktop.  It lacks some features that may be expected by
+some users; these users may want to investigate other available window managers
+for use with MATE or as a standalone window manager.")
+    (license license:gpl2+)))
+
+(define-public mate
+  (package
+    (name "mate")
+    (version (package-version mate-desktop))
+    (source #f)
+    (build-system trivial-build-system)
+    (arguments
+     `(#:modules ((guix build union))
+       #:builder
+       (begin
+         (use-modules (ice-9 match)
+                      (guix build union))
+         (match %build-inputs
+           (((names . directories) ...)
+            (union-build (assoc-ref %outputs "out")
+                         directories))))))
+    (inputs
+     ;; TODO: Add more packages
+     `(("at-spi2-core"              ,at-spi2-core)
+       ("caja"                      ,caja)
+       ("dbus"                      ,dbus)
+       ("dconf"                     ,dconf)
+       ("desktop-file-utils"        ,desktop-file-utils)
+       ("font-cantarell"            ,font-cantarell)
+       ("glib-networking"           ,glib-networking)
+       ("gnome-keyring"             ,gnome-keyring)
+       ("gvfs"                      ,gvfs)
+       ("libmatekbd"                ,libmatekbd)
+       ("libmateweather"            ,libmateweather)
+       ("libmatemixer"              ,libmatemixer)
+       ("marco"                     ,marco)
+       ("mate-session-manager"      ,mate-session-manager)
+       ("mate-settings-daemon"      ,mate-settings-daemon)
+       ("mate-desktop"              ,mate-desktop)
+       ("mate-terminal"             ,mate-terminal)
+       ("mate-themes"               ,mate-themes)
+       ("mate-icon-theme"           ,mate-icon-theme)
+       ("mate-menu"                 ,mate-menus)
+       ("mate-panel"                ,mate-panel)
+       ("mate-control-center"       ,mate-control-center)
+       ("mate-media"                ,mate-media)
+       ("mate-applets"              ,mate-applets)
+       ("pinentry-gnome3"           ,pinentry-gnome3)
+       ("pulseaudio"                ,pulseaudio)
+       ("shared-mime-info"          ,shared-mime-info)
+       ("yelp"                      ,yelp)
+       ("zenity"                    ,zenity)))
+    (synopsis "The MATE desktop environment")
+    (home-page "https://mate-desktop.org/")
+    (description
+     "The MATE Desktop Environment is the continuation of GNOME 2.  It provides
+an intuitive and attractive desktop environment using traditional metaphors for
+GNU/Linux systems.  MATE is under active development to add support for new
+technologies while preserving a traditional desktop experience.")
+    (license license:gpl2+)))
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index d48c31f5e3..f326f6af72 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -2516,6 +2516,92 @@ parts of it.")
      "OpenBLAS is a BLAS library forked from the GotoBLAS2-1.13 BSD version.")
     (license license:bsd-3)))
 
+(define* (make-blis implementation #:optional substitutable?)
+  "Return a BLIS package with the given IMPLEMENTATION (see config/ in the
+source tree for a list of implementations.)
+
+SUBSTITUTABLE? determines whether the package is made available as a
+substitute.
+
+Currently the specialization must be selected at configure-time, but work is
+underway to allow BLIS to select the right optimized kernels at run time:
+<https://github.com/flame/blis/issues/129>."
+  (package
+    (name (if (string=? implementation "reference")
+              "blis"
+              (string-append "blis-" implementation)))
+    (version "0.2.2")
+    (home-page "https://github.com/flame/blis")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference (url home-page) (commit version)))
+              (sha256
+               (base32
+                "1wr79a50nm4abhw8w3sn96nmwp5mrzifcigk7khw9qcgyyyqayfh"))
+              (file-name (git-file-name "blis" version))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:test-target "test"
+
+       #:substitutable? ,substitutable?
+
+       #:phases (modify-phases %standard-phases
+                  (replace 'configure
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      ;; This is a home-made 'configure' script.
+                      (let ((out (assoc-ref outputs "out")))
+                        (zero? (system* "./configure" "-p" out
+                                        "-d" "opt"
+                                        "--disable-static"
+                                        "--enable-shared"
+                                        "--enable-threading=openmp"
+
+                                        ,implementation)))))
+                  (add-before 'check 'show-test-output
+                    (lambda _
+                      ;; By default "make check" is silent.  Make it verbose.
+                      (system "tail -F output.testsuite &")
+                      #t)))))
+    (synopsis "High-performance basic linear algebra (BLAS) routines")
+    (description
+     "BLIS is a portable software framework for instantiating high-performance
+BLAS-like dense linear algebra libraries.  The framework was designed to
+isolate essential kernels of computation that, when optimized, immediately
+enable optimized implementations of most of its commonly used and
+computationally intensive operations.  While BLIS exports a new BLAS-like API,
+it also includes a BLAS compatibility layer which gives application developers
+access to BLIS implementations via traditional BLAS routine calls.")
+    (license license:bsd-3)))
+
+(define-public blis
+  ;; This is the "reference" implementation, which is the non-optimized but
+  ;; portable variant (no assembly).
+  (make-blis "reference" #t))
+
+(define ignorance blis)
+
+(define-syntax-rule (blis/x86_64 processor)
+  "Expand to a package specialized for PROCESSOR."
+  (package
+    (inherit (make-blis processor))
+    (supported-systems '("x86_64-linux"))))
+
+(define-public blis-sandybridge
+  ;; BLIS specialized for Sandy Bridge processors (launched 2011):
+  ;; <http://ark.intel.com/products/codename/29900/Sandy-Bridge>.
+  (blis/x86_64 "sandybridge"))
+
+(define-public blis-haswell
+  ;; BLIS specialized for Haswell processors (launched 2013):
+  ;; <http://ark.intel.com/products/codename/42174/Haswell>.
+  (blis/x86_64 "haswell"))
+
+(define-public blis-knl
+  ;; BLIS specialized for Knights Landing processor (launched 2016):
+  ;; <http://ark.intel.com/products/series/92650/Intel-Xeon-Phi-x200-Product-Family>.
+  (blis/x86_64 "knl"))
+
+
 (define-public openlibm
   (package
     (name "openlibm")
diff --git a/gnu/packages/mes.scm b/gnu/packages/mes.scm
index 39f9765320..f71339da23 100644
--- a/gnu/packages/mes.scm
+++ b/gnu/packages/mes.scm
@@ -34,14 +34,15 @@
 (define-public nyacc
   (package
     (name "nyacc")
-    (version "0.80.3")
+    (version "0.82.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://savannah/nyacc/"
                                   name "-" version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0sdvkahnz6k9i4kf1i1ljl20220n3wk3gy6zmz0ggbbdgg4mfka0"))))
+                "1ll0mjivhxpj3r81w4a8p4bclr3byzp38ig1j11jvwnbl6lawgj7"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("guile" ,guile-2.2)))
@@ -57,7 +58,7 @@ extensive examples, including parsers for the Javascript and C99 languages.")
   (let ((triplet "i686-unknown-linux-gnu"))
     (package
       (name "mes")
-      (version "0.9")
+      (version "0.10")
       (source (origin
                 (method url-fetch)
                 (uri (string-append "https://gitlab.com/janneke/mes"
@@ -66,7 +67,7 @@ extensive examples, including parsers for the Javascript and C99 languages.")
                 (file-name (string-append name "-" version ".tar.gz"))
                 (sha256
                  (base32
-                  "0ph0fvabpb7zhbk4zpacbp7m4b142ds17dq5dzn00m7dz8farw9r"))))
+                  "0djmhnvha8phxgb4msysnjmy1nnllb08bnw4xhdayq8ppi4zdmcv"))))
       (build-system gnu-build-system)
       (supported-systems '("i686-linux" "x86_64-linux"))
       (propagated-inputs
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 9330179f96..f030e5b18e 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -295,7 +295,7 @@ This package contains the binary.")
 (define-public mpg123
   (package
     (name "mpg123")
-    (version "1.25.4")
+    (version "1.25.6")
     (source (origin
               (method url-fetch)
               (uri (list (string-append "mirror://sourceforge/mpg123/mpg123/"
@@ -305,7 +305,7 @@ This package contains the binary.")
                           version ".tar.bz2")))
               (sha256
                (base32
-                "1rxknrnl3ji5hi5rbckpzhbl1k5r8i53kcys4xdgg0xbi8765dfd"))))
+                "13jsbh1gwypjksim2fxlblj5wc2driwm4igrkcnbr6bpp34mh10g"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--with-default-audio=pulse")))
     (native-inputs `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/mpi.scm b/gnu/packages/mpi.scm
index 93157e2692..517f912417 100644
--- a/gnu/packages/mpi.scm
+++ b/gnu/packages/mpi.scm
@@ -42,7 +42,7 @@
 (define-public hwloc
   (package
     (name "hwloc")
-    (version "1.11.7")
+    (version "1.11.8")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.open-mpi.org/software/hwloc/v"
@@ -50,7 +50,7 @@
                                   "/downloads/hwloc-" version ".tar.bz2"))
               (sha256
                (base32
-                "0acph1mf7588hfx8ds26ncr6nw5fd9x92adm11fwin7f93i10sdb"))))
+                "0karxv4r1r8sa7ki5aamlxdvyvz0bvzq4gdhq0yi5nc4a0k11vzc"))))
     (build-system gnu-build-system)
     (outputs '("out"           ;'lstopo' & co., depends on Cairo, libx11, etc.
                "lib"           ;small closure
@@ -132,9 +132,7 @@ bind processes, and much more.")
      `(("pkg-config" ,pkg-config)
        ("perl" ,perl)))
     (arguments
-     `(#:configure-flags `("--enable-builtin-atomics"
-
-                           "--enable-mpi-ext=affinity" ;cr doesn't work
+     `(#:configure-flags `("--enable-mpi-ext=affinity" ;cr doesn't work
                            "--enable-memchecker"
                            "--with-sge"
 
@@ -148,16 +146,21 @@ bind processes, and much more.")
                                            (assoc-ref %build-inputs "hwloc")))
        #:phases (modify-phases %standard-phases
                   (add-before 'build 'remove-absolute
-                    ;; Remove compiler absolute file names (OPAL_FC_ABSOLUTE
-                    ;; etc.) to reduce the closure size.  See
-                    ;; <https://lists.gnu.org/archive/html/guix-devel/2017-07/msg00388.html>
-                    ;; and
-                    ;; <https://www.mail-archive.com/users@lists.open-mpi.org//msg31397.html>.
                     (lambda _
+                      ;; Remove compiler absolute file names (OPAL_FC_ABSOLUTE
+                      ;; etc.) to reduce the closure size.  See
+                      ;; <https://lists.gnu.org/archive/html/guix-devel/2017-07/msg00388.html>
+                      ;; and
+                      ;; <https://www.mail-archive.com/users@lists.open-mpi.org//msg31397.html>.
                       (substitute* '("orte/tools/orte-info/param.c"
                                      "oshmem/tools/oshmem_info/param.c"
                                      "ompi/tools/ompi_info/param.c")
                         (("_ABSOLUTE") ""))
+                      ;; Avoid valgrind (which pulls in gdb etc.).
+                      (substitute*
+                          '("./ompi/mca/io/romio/src/io_romio_component.c")
+                        (("MCA_io_romio_COMPLETE_CONFIGURE_FLAGS")
+                         "\"[elided to reduce closure]\""))
                       #t))
                   (add-before 'build 'scrub-timestamps ;reproducibility
                     (lambda _
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index a6c97e618e..9f7792dff7 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -78,8 +78,8 @@
   ;; Note: the 'update-guix-package.scm' script expects this definition to
   ;; start precisely like this.
   (let ((version "0.13.0")
-        (commit "228a3982df157847554abc9d0831d687264d8ebd")
-        (revision 5))
+        (commit "a9468b422b6df2349a3f4d1451c9302c3d77011b")
+        (revision 6))
     (package
       (name "guix")
 
@@ -95,7 +95,7 @@
                       (commit commit)))
                 (sha256
                  (base32
-                  "1gnc1w9kby7db9jih4xwrhrv0j57zy09lmr85gbmcqna6bx3wypw"))
+                  "0bv323yp657x0a2aa2z5pp5541hjqmn908kh9jqlbdw5gpx9vg3d"))
                 (file-name (string-append "guix-" version "-checkout"))))
       (build-system gnu-build-system)
       (arguments
diff --git a/gnu/packages/password-utils.scm b/gnu/packages/password-utils.scm
index bde1ea8544..52689a71d5 100644
--- a/gnu/packages/password-utils.scm
+++ b/gnu/packages/password-utils.scm
@@ -11,6 +11,7 @@
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Jelle Licht <jlicht@fsfe.org>
+;;; Copyright © 2017 Eric Bavier <bavier@member.fsf.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -41,10 +42,13 @@
   #:use-module (gnu packages freedesktop)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages guile)
+  #:use-module (gnu packages kerberos)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages man)
+  #:use-module (gnu packages multiprecision)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -480,3 +484,97 @@ use pass, the standard unix password manager, as the credential backend for
 your git repositories.  This is achieved by explicitly defining mappings
 between hosts and entries in the password store.")
     (license license:lgpl3+)))
+
+(define-public john-the-ripper-jumbo
+  (let ((official-version "1.8.0")
+        (jumbo-version "1"))
+    (package
+      (name "john-the-ripper-jumbo")
+      (version (string-append official-version "-" jumbo-version))
+      (source
+       (origin
+         (method url-fetch)
+         (uri (string-append "http://www.openwall.com/john/j/john-"
+                             official-version "-jumbo-" jumbo-version ".tar.xz"))
+         (sha256
+          (base32
+           "08q92sfdvkz47rx6qjn7qv57cmlpy7i7rgddapq5384mb413vjds"))
+         (patches
+          (list (origin
+                  (method url-fetch)
+                  (uri (string-append "https://github.com/magnumripper/"
+                                      "JohnTheRipper/commit/"
+                                      "e2e868db3e153b3f959e119a51703d4afb99c624.patch"))
+                  (file-name "john-the-ripper-jumbo-gcc5-inline.patch")
+                  (sha256
+                   (base32
+                    "1shvcf1y2097115mxhzdkm64dr106a8zr6pqjqyh171q5ng5vfra")))
+                (origin
+                  (method url-fetch)
+                  (uri (string-append "https://github.com/magnumripper/"
+                                      "JohnTheRipper/commit/"
+                                      "480e95b0e449863be3e1a5b0bc634a67df28b618.patch"))
+                  (file-name "john-the-ripper-jumbo-non-x86.patch")
+                  (sha256
+                   (base32
+                    "1ffd9dvhk0sb6ss8dv5yalh01lz30i7rilqilf2xv68gax2hyjqx")))))))
+      (build-system gnu-build-system)
+      (inputs
+       `(("gmp" ,gmp)
+         ("krb5" ,mit-krb5)
+         ("libpcap" ,libpcap)
+         ("nss" ,nss)
+         ("openssl" ,openssl)
+         ("zlib" ,zlib)))
+      (arguments
+       `(#:configure-flags
+         (list (string-append
+                "CFLAGS=-O2 -g "
+                "-DJOHN_SYSTEMWIDE=1 "
+                "-DJOHN_SYSTEMWIDE_EXEC='\"" %output "/libexec/john\"' "
+                "-DJOHN_SYSTEMWIDE_HOME='\"" %output "/share/john\"'")
+               ;; For now, do not test for instruction set in configure, and
+               ;; do not pass '-march=native' to gcc:
+               "--disable-native-tests"
+               "--disable-native-macro")
+         #:tests? #f ;tests try to create '.john' in the build user's $HOME
+         #:phases
+         (modify-phases %standard-phases
+           (add-before 'configure 'chdir-src
+             (lambda _ (chdir "src")))
+           (replace 'install
+             (lambda _
+               (let ((bindir (string-append %output "/bin"))
+                     (docdir (string-append %output "/share/doc/john"))
+                     (execdir (string-append %output "/libexec/john"))
+                     (homedir (string-append %output "/share/john"))
+                     (install-file-to (lambda (dir)
+                                        (lambda (f) (install-file f dir))))
+                     (symlink? (lambda (_ s) (eq? (stat:type s) 'symlink))))
+                 (with-directory-excursion "../run"
+                   (for-each (install-file-to execdir)
+                             (cons* "mailer" "benchmark-unify"
+                                    (find-files "." ".*\\.(py|rb|pl)")))
+                   (for-each (install-file-to homedir)
+                             (append (find-files "." "(stats|dictionary.*)")
+                                     (find-files "." "(.*\\.chr|.*\\.lst)")
+                                     (find-files "." ".*\\.conf")))
+                   (for-each (install-file-to bindir)
+                             '("tgtsnarf" "genmkvpwd" "mkvcalcproba"
+                               "raw2dyna" "luks2john" "vncpcap2john"
+                               "uaf2john" "calc_stat" "wpapcap2john"
+                               "cprepair" "relbench"  "SIPdump" "john"))
+                   (for-each (lambda (f) ;install symlinked aliases
+                               (symlink "john"
+                                        (string-append bindir "/" (basename f))))
+                             (find-files "." symlink?)))
+                 (copy-recursively "../doc" docdir)
+                 #t))))))
+      (home-page "http://www.openwall.com/john/")
+      (synopsis "Password cracker")
+      (description "John the Ripper is a fast password cracker.  Its primary
+purpose is to detect weak Unix passwords.  Besides several @code{crypt}
+password hash types most commonly found on various Unix systems, supported out
+of the box are Windows LM hashes, plus lots of other hashes and ciphers.  This
+is the community-enhanced, \"jumbo\" version of John the Ripper.")
+      (license license:gpl2+))))
diff --git a/gnu/packages/patches/bluez-CVE-2017-1000250.patch b/gnu/packages/patches/bluez-CVE-2017-1000250.patch
new file mode 100644
index 0000000000..81f209d7b2
--- /dev/null
+++ b/gnu/packages/patches/bluez-CVE-2017-1000250.patch
@@ -0,0 +1,42 @@
+Description: CVE-2017-1000250: information disclosure vulnerability in service_search_attr_req
+Origin: vendor
+Bug-Debian: https://bugs.debian.org/875633
+Bug-RedHat: https://bugzilla.redhat.com/show_bug.cgi?id=1489446
+Bug-SuSE: https://bugzilla.suse.com/show_bug.cgi?id=1057342
+Forwarded: no
+Author: Armis Security <security@armis.com>
+Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
+Last-Update: 2017-09-13
+
+--- a/src/sdpd-request.c
++++ b/src/sdpd-request.c
+@@ -918,15 +918,20 @@ static int service_search_attr_req(sdp_r
+ 		/* continuation State exists -> get from cache */
+ 		sdp_buf_t *pCache = sdp_get_cached_rsp(cstate);
+ 		if (pCache) {
+-			uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
+-			pResponse = pCache->data;
+-			memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
+-			buf->data_size += sent;
+-			cstate->cStateValue.maxBytesSent += sent;
+-			if (cstate->cStateValue.maxBytesSent == pCache->data_size)
+-				cstate_size = sdp_set_cstate_pdu(buf, NULL);
+-			else
+-				cstate_size = sdp_set_cstate_pdu(buf, cstate);
++			if (cstate->cStateValue.maxBytesSent >= pCache->data_size) {
++				status = SDP_INVALID_CSTATE;
++				SDPDBG("Got bad cstate with invalid size");
++			} else {
++				uint16_t sent = MIN(max, pCache->data_size - cstate->cStateValue.maxBytesSent);
++				pResponse = pCache->data;
++				memcpy(buf->data, pResponse + cstate->cStateValue.maxBytesSent, sent);
++				buf->data_size += sent;
++				cstate->cStateValue.maxBytesSent += sent;
++				if (cstate->cStateValue.maxBytesSent == pCache->data_size)
++					cstate_size = sdp_set_cstate_pdu(buf, NULL);
++				else
++					cstate_size = sdp_set_cstate_pdu(buf, cstate);
++			}
+ 		} else {
+ 			status = SDP_INVALID_CSTATE;
+ 			SDPDBG("Non-null continuation state, but null cache buffer");
diff --git a/gnu/packages/patches/calibre-drop-unrar.patch b/gnu/packages/patches/calibre-drop-unrar.patch
deleted file mode 100644
index adf977b183..0000000000
--- a/gnu/packages/patches/calibre-drop-unrar.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-Recreated old debian patch on the latest calibre version
-
-From 6764e4c211e50d4f4633dbabfba7cbc3089c51dc Mon Sep 17 00:00:00 2001
-From: Brendan Tildesley <brendan.tildesley@openmailbox.org>
-Date: Sat, 13 May 2017 21:12:12 +1000
-Subject: [PATCH] Remove unrar extension
-
----
- setup/extensions.json                  | 11 -----------
- src/calibre/ebooks/metadata/archive.py |  2 +-
- 2 files changed, 1 insertion(+), 12 deletions(-)
-
-diff --git a/setup/extensions.json b/setup/extensions.json
-index 1f6d1fb5fd..127390450f 100644
---- a/setup/extensions.json
-+++ b/setup/extensions.json
-@@ -211,16 +211,5 @@
-         "sources": "calibre/devices/mtp/unix/devices.c calibre/devices/mtp/unix/libmtp.c",
-         "headers": "calibre/devices/mtp/unix/devices.h calibre/devices/mtp/unix/upstream/music-players.h calibre/devices/mtp/unix/upstream/device-flags.h",
-         "libraries": "mtp"
--    },
--    {
--        "name": "unrar",
--        "sources": "unrar/rar.cpp unrar/strlist.cpp unrar/strfn.cpp unrar/pathfn.cpp unrar/savepos.cpp unrar/smallfn.cpp unrar/global.cpp unrar/file.cpp unrar/filefn.cpp unrar/filcreat.cpp unrar/archive.cpp unrar/arcread.cpp unrar/unicode.cpp unrar/system.cpp unrar/isnt.cpp unrar/crypt.cpp unrar/crc.cpp unrar/rawread.cpp unrar/encname.cpp unrar/resource.cpp unrar/match.cpp unrar/timefn.cpp unrar/rdwrfn.cpp unrar/consio.cpp unrar/options.cpp unrar/ulinks.cpp unrar/errhnd.cpp unrar/rarvm.cpp unrar/secpassword.cpp unrar/rijndael.cpp unrar/getbits.cpp unrar/sha1.cpp unrar/extinfo.cpp unrar/extract.cpp unrar/volume.cpp unrar/list.cpp unrar/find.cpp unrar/unpack.cpp unrar/cmddata.cpp unrar/filestr.cpp unrar/scantree.cpp calibre/utils/unrar.cpp",
--        "inc_dirs": "unrar",
--        "defines": "SILENT RARDLL UNRAR _FILE_OFFSET_BITS=64 _LARGEFILE_SOURCE",
--        "windows_defines": "SILENT RARDLL UNRAR",
--        "haiku_defines": "LITTLE_ENDIAN SILENT RARDLL UNRAR _FILE_OFFSET_BITS=64 _LARGEFILE_SOURCE _BSD_SOURCE",
--        "haiku_libraries": "bsd",
--        "optimize_level": 2,
--        "windows_libraries": "User32 Advapi32 kernel32 Shell32"
-     }
- ]
-diff --git a/src/calibre/ebooks/metadata/archive.py b/src/calibre/ebooks/metadata/archive.py
-index f5c0b7bed3..32257dcdae 100644
---- a/src/calibre/ebooks/metadata/archive.py
-+++ b/src/calibre/ebooks/metadata/archive.py
-@@ -44,7 +44,7 @@ class ArchiveExtract(FileTypePlugin):
-     description = _('Extract common e-book formats from archive files '
-         '(ZIP/RAR). Also try to autodetect if they are actually '
-         'CBZ/CBR files.')
--    file_types = set(['zip', 'rar'])
-+    file_types = set(['zip'])
-     supported_platforms = ['windows', 'osx', 'linux']
-     on_import = True
- 
--- 
-2.12.2
-
diff --git a/gnu/packages/patches/csound-header-ordering.patch b/gnu/packages/patches/csound-header-ordering.patch
deleted file mode 100644
index 3640d123dd..0000000000
--- a/gnu/packages/patches/csound-header-ordering.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Prevent compilation issues with boost-1.60.0.
-
-Reported upstream at https://github.com/csound/csound/issues/570
-
---- Csound6.05/Opcodes/chua/ChuaOscillator.cpp	2015-04-25 14:06:22.995646234 -0500
-+++ Csound6.05/Opcodes/chua/ChuaOscillator.cpp	2015-12-21 10:31:58.182362640 -0600
-@@ -117,11 +117,12 @@
- //     d = sys_variables(12);
- //     gnor = a*(x.^3) + b*(x.^2) + c*x + d;
- 
--#include <OpcodeBase.hpp>
- #include <boost/numeric/ublas/vector.hpp>
- using namespace boost::numeric;
- #include <cmath>
- 
-+#include <OpcodeBase.hpp>
-+
- #undef CS_KSMPS
- #define CS_KSMPS     (opds.insdshead->ksmps)
- 
diff --git a/gnu/packages/patches/emacs-unsafe-enriched-mode-translations.patch b/gnu/packages/patches/emacs-unsafe-enriched-mode-translations.patch
new file mode 100644
index 0000000000..7e45d30129
--- /dev/null
+++ b/gnu/packages/patches/emacs-unsafe-enriched-mode-translations.patch
@@ -0,0 +1,85 @@
+This patch fixes a remote code execution vulnerability reported here:
+
+  https://bugs.gnu.org/28350
+  http://www.openwall.com/lists/oss-security/2017/09/11/1
+
+From 9ad0fcc54442a9a01d41be19880250783426db70 Mon Sep 17 00:00:00 2001
+From: Lars Ingebrigtsen <larsi@gnus.org>
+Date: Fri, 8 Sep 2017 20:23:31 -0700
+Subject: Remove unsafe enriched mode translations
+
+* lisp/gnus/mm-view.el (mm-inline-text):
+Do not worry about enriched or richtext type.
+* lisp/textmodes/enriched.el (enriched-translations):
+Remove translations for FUNCTION, display (Bug#28350).
+(enriched-handle-display-prop, enriched-decode-display-prop): Remove.
+---
+ lisp/gnus/mm-view.el       |  4 ----
+ lisp/textmodes/enriched.el | 32 --------------------------------
+ 2 files changed, 36 deletions(-)
+
+diff --git a/lisp/gnus/mm-view.el b/lisp/gnus/mm-view.el
+index e5859d0..77ad271 100644
+--- a/lisp/gnus/mm-view.el
++++ b/lisp/gnus/mm-view.el
+@@ -383,10 +383,6 @@
+ 	(goto-char (point-max))))
+     (save-restriction
+       (narrow-to-region b (point))
+-      (when (member type '("enriched" "richtext"))
+-        (set-text-properties (point-min) (point-max) nil)
+-	(ignore-errors
+-	  (enriched-decode (point-min) (point-max))))
+       (mm-handle-set-undisplayer
+        handle
+        `(lambda ()
+diff --git a/lisp/textmodes/enriched.el b/lisp/textmodes/enriched.el
+index beb6c6d..a8f0d38 100644
+--- a/lisp/textmodes/enriched.el
++++ b/lisp/textmodes/enriched.el
+@@ -117,12 +117,7 @@ expression, which is evaluated to get the string to insert.")
+ 		   (full        "flushboth")
+ 		   (center      "center"))
+     (PARAMETER     (t           "param")) ; Argument of preceding annotation
+-    ;; The following are not part of the standard:
+-    (FUNCTION      (enriched-decode-foreground "x-color")
+-		   (enriched-decode-background "x-bg-color")
+-		   (enriched-decode-display-prop "x-display"))
+     (read-only     (t           "x-read-only"))
+-    (display	   (nil		enriched-handle-display-prop))
+     (unknown       (nil         format-annotate-value))
+ ;   (font-size     (2           "bigger")       ; unimplemented
+ ;		   (-2          "smaller"))
+@@ -477,32 +472,5 @@ Return value is \(begin end name positive-p), or nil if none was found."
+     (message "Warning: no color specified for <x-bg-color>")
+     nil))
+ 
+-;;; Handling the `display' property.
+-
+-
+-(defun enriched-handle-display-prop (old new)
+-  "Return a list of annotations for a change in the `display' property.
+-OLD is the old value of the property, NEW is the new value.  Value
+-is a list `(CLOSE OPEN)', where CLOSE is a list of annotations to
+-close and OPEN a list of annotations to open.  Each of these lists
+-has the form `(ANNOTATION PARAM ...)'."
+-  (let ((annotation "x-display")
+-	(param (prin1-to-string (or old new))))
+-    (if (null old)
+-        (cons nil (list (list annotation param)))
+-      (cons (list (list annotation param)) nil))))
+-
+-(defun enriched-decode-display-prop (start end &optional param)
+-  "Decode a `display' property for text between START and END.
+-PARAM is a `<param>' found for the property.
+-Value is a list `(START END SYMBOL VALUE)' with START and END denoting
+-the range of text to assign text property SYMBOL with value VALUE."
+-  (let ((prop (when (stringp param)
+-		(condition-case ()
+-		    (car (read-from-string param))
+-		  (error nil)))))
+-    (unless prop
+-      (message "Warning: invalid <x-display> parameter %s" param))
+-    (list start end 'display prop)))
+ 
+ ;;; enriched.el ends here
diff --git a/gnu/packages/patches/file-CVE-2017-1000249.patch b/gnu/packages/patches/file-CVE-2017-1000249.patch
new file mode 100644
index 0000000000..505acf1592
--- /dev/null
+++ b/gnu/packages/patches/file-CVE-2017-1000249.patch
@@ -0,0 +1,27 @@
+https://github.com/file/file/commit/35c94dc6acc418f1ad7f6241a6680e5327495793.patch
+http://openwall.com/lists/oss-security/2017/09/05/3
+
+The patch is minorly modified to apply to file-5.30
+
+From 35c94dc6acc418f1ad7f6241a6680e5327495793 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sun, 27 Aug 2017 07:55:02 +0000
+Subject: [PATCH] Fix always true condition (Thomas Jarosch)
+
+---
+ src/readelf.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/readelf.c b/src/readelf.c
+index 81451827..5f425c97 100644
+--- a/src/readelf.c
++++ b/src/readelf.c
+@@ -511,7 +511,7 @@ do_bid_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
+     size_t noff, size_t doff, int *flags)
+ {
+ 	if (namesz == 4 && strcmp((char *)&nbuf[noff], "GNU") == 0 &&
+-	    type == NT_GNU_BUILD_ID && (descsz >= 4 || descsz <= 20)) {
++	    type == NT_GNU_BUILD_ID && (descsz >= 4 && descsz <= 20)) {
+ 		uint8_t desc[20];
+ 		const char *btype;
+ 		uint32_t i;
diff --git a/gnu/packages/patches/foomatic-filters-CVE-2015-8327.patch b/gnu/packages/patches/foomatic-filters-CVE-2015-8327.patch
new file mode 100644
index 0000000000..d9f0cc1212
--- /dev/null
+++ b/gnu/packages/patches/foomatic-filters-CVE-2015-8327.patch
@@ -0,0 +1,14 @@
+Fix for <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2015-8327>.
+
+--- a/util.c	2014-06-20 19:26:18 +0000
++++ b/util.c	2015-10-30 15:45:03 +0000
+@@ -31,7 +31,7 @@
+ #include <assert.h>
+ 
+ 
+-const char* shellescapes = "|<>&!$\'\"#*?()[]{}";
++const char* shellescapes = "|<>&!$\'\"`#*?()[]{}";
+ 
+ const char * temp_dir()
+ {
+
diff --git a/gnu/packages/patches/foomatic-filters-CVE-2015-8560.patch b/gnu/packages/patches/foomatic-filters-CVE-2015-8560.patch
new file mode 100644
index 0000000000..d3c3024220
--- /dev/null
+++ b/gnu/packages/patches/foomatic-filters-CVE-2015-8560.patch
@@ -0,0 +1,13 @@
+Fix for <https://nvd.nist.gov/vuln/detail?vulnId=CVE-2015-8560>.
+
+--- a/util.c	2015-10-30 15:45:03 +0000
++++ b/util.c	2015-12-12 23:27:21 +0000
+@@ -31,7 +31,7 @@
+ #include <assert.h>
+ 
+ 
+-const char* shellescapes = "|<>&!$\'\"`#*?()[]{}";
++const char* shellescapes = "|;<>&!$\'\"`#*?()[]{}";
+ 
+ const char * temp_dir()
+ {
diff --git a/gnu/packages/patches/graphicsmagick-CVE-2017-11403+CVE-2017-14103.patch b/gnu/packages/patches/graphicsmagick-CVE-2017-11403+CVE-2017-14103.patch
new file mode 100644
index 0000000000..dbcaea1343
--- /dev/null
+++ b/gnu/packages/patches/graphicsmagick-CVE-2017-11403+CVE-2017-14103.patch
@@ -0,0 +1,137 @@
+http://www.openwall.com/lists/oss-security/2017/09/01/6
+
+CVE-2017-11403:
+http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37
+
+CVE-2017-14103:
+http://hg.code.sf.net/p/graphicsmagick/code/rev/98721124e51f
+
+some changes were made to make the patch apply
+
+# HG changeset patch
+# User Glenn Randers-Pehrson <glennrp+bmo@gmail.com>
+# Date 1503875721 14400
+# Node ID 98721124e51fd5ec0c6fba64bce2e218869632d2
+# Parent  f0f2ea85a2930f3b6dcd72352719adb9660f2aad
+Attempt to fix Issue 440.
+
+diff -ru a/coders/png.c b/coders/png.c
+--- a/coders/png.c	1969-12-31 19:00:00.000000000 -0500
++++ b/coders/png.c	2017-09-10 11:31:56.543194173 -0400
+@@ -3106,7 +3106,9 @@
+       if (length > PNG_MAX_UINT || count == 0)
+         {
+           DestroyJNGInfo(color_image_info,alpha_image_info);
+-          ThrowReaderException(CorruptImageError,CorruptImage,image);
++          (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++              "chunk length (%lu) > PNG_MAX_UINT",length);
++          return ((Image*)NULL);
+         }
+
+       chunk=(unsigned char *) NULL;
+@@ -3117,13 +3119,16 @@
+           if (chunk == (unsigned char *) NULL)
+             {
+               DestroyJNGInfo(color_image_info,alpha_image_info);
+-              ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+-                                   image);
++              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                  "    Could not allocate chunk memory");
++              return ((Image*)NULL);
+             }
+           if (ReadBlob(image,length,chunk) < length)
+             {
+               DestroyJNGInfo(color_image_info,alpha_image_info);
+-              ThrowReaderException(CorruptImageError,CorruptImage,image);
++              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                  "    chunk reading was incomplete");
++              return ((Image*)NULL);
+             }
+           p=chunk;
+         }
+@@ -3198,7 +3203,7 @@
+                   jng_width, jng_height);
+               MagickFreeMemory(chunk);
+               DestroyJNGInfo(color_image_info,alpha_image_info);
+-              ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
++              return ((Image *)NULL);
+             }
+
+           /* Temporarily set width and height resources to match JHDR */
+@@ -3233,8 +3238,9 @@
+           if (color_image == (Image *) NULL)
+             {
+               DestroyJNGInfo(color_image_info,alpha_image_info);
+-              ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,
+-                                   image);
++              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                  "    could not open color_image blob");
++              return ((Image *)NULL);
+             }
+           if (logging)
+             (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+@@ -3245,7 +3251,9 @@
+           if (status == MagickFalse)
+             {
+               DestroyJNGInfo(color_image_info,alpha_image_info);
+-              ThrowReaderException(CoderError,UnableToOpenBlob,color_image);
++              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                  "    could not open color_image blob");
++              return ((Image *)NULL);
+             }
+
+           if (!image_info->ping && jng_color_type >= 12)
+@@ -3255,17 +3263,18 @@
+               if (alpha_image_info == (ImageInfo *) NULL)
+                 {
+                   DestroyJNGInfo(color_image_info,alpha_image_info);
+-                  ThrowReaderException(ResourceLimitError,
+-                                       MemoryAllocationFailed, image);
++                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                      "    could not allocate alpha_image_info",length);
++                  return ((Image *)NULL);
+                 }
+               GetImageInfo(alpha_image_info);
+               alpha_image=AllocateImage(alpha_image_info);
+               if (alpha_image == (Image *) NULL)
+                 {
+                   DestroyJNGInfo(color_image_info,alpha_image_info);
+-                  ThrowReaderException(ResourceLimitError,
+-                                       MemoryAllocationFailed,
+-                                       alpha_image);
++                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                      "    could not allocate alpha_image");
++                  return ((Image *)NULL);
+                 }
+               if (logging)
+                 (void) LogMagickEvent(CoderEvent,GetMagickModule(),
+@@ -3277,7 +3286,9 @@
+                 {
+                   DestroyJNGInfo(color_image_info,alpha_image_info);
+                   DestroyImage(alpha_image);
+-                  ThrowReaderException(CoderError,UnableToOpenBlob,image);
++                  (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                      "    could not allocate alpha_image blob");
++                  return ((Image *)NULL);
+                 }
+               if (jng_alpha_compression_method == 0)
+                 {
+@@ -3613,6 +3624,8 @@
+               alpha_image = (Image *)NULL;
+               DestroyImageInfo(alpha_image_info);
+               alpha_image_info = (ImageInfo *)NULL;
++              (void) LogMagickEvent(CoderEvent,GetMagickModule(),
++                  " Destroy the JNG image");
+               DestroyImage(jng_image);
+               jng_image = (Image *)NULL;
+             }
+@@ -5146,8 +5159,8 @@
+
+       if (image == (Image *) NULL)
+         {
+-          DestroyImageList(previous);
+           CloseBlob(previous);
++          DestroyImageList(previous);
+           MngInfoFreeStruct(mng_info,&have_mng_structure);
+           return((Image *) NULL);
+         }
diff --git a/gnu/packages/patches/graphicsmagick-CVE-2017-14042.patch b/gnu/packages/patches/graphicsmagick-CVE-2017-14042.patch
new file mode 100644
index 0000000000..46f6b032c7
--- /dev/null
+++ b/gnu/packages/patches/graphicsmagick-CVE-2017-14042.patch
@@ -0,0 +1,80 @@
+http://openwall.com/lists/oss-security/2017/08/28/5
+http://hg.code.sf.net/p/graphicsmagick/code/rev/3bbf7a13643d
+
+some changes were made to make the patch apply
+
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1503268616 18000
+# Node ID 3bbf7a13643df3be76b0e19088a6cc632eea2072
+# Parent  83a5b946180835f260bcb91e3d06327a8e2577e3
+PNM: For binary formats, verify sufficient backing file data before memory request.
+
+diff -r 83a5b9461808 -r 3bbf7a13643d coders/pnm.c
+--- a/coders/pnm.c	Sun Aug 20 17:31:35 2017 -0500
++++ b/coders/pnm.c	Sun Aug 20 17:36:56 2017 -0500
+@@ -569,7 +569,7 @@
+           (void) LogMagickEvent(CoderEvent,GetMagickModule(),"Colors: %u",
+                                 image->colors);
+         }
+-      number_pixels=image->columns*image->rows;
++      number_pixels=MagickArraySize(image->columns,image->rows);
+       if (number_pixels == 0)
+         ThrowReaderException(CorruptImageError,NegativeOrZeroImageSize,image);
+       if (image->storage_class == PseudoClass)
+@@ -858,14 +858,14 @@
+		if (1 == bits_per_sample)
+		  {
+		    /* PBM */
+-		    bytes_per_row=((image->columns+7) >> 3);
++		    bytes_per_row=((image->columns+7U) >> 3);
+		    import_options.grayscale_miniswhite=MagickTrue;
+		    quantum_type=GrayQuantum;
+		  }
+		else
+		  {
+		    /* PGM & XV_332 */
+-		    bytes_per_row=((bits_per_sample+7)/8)*image->columns;
++		    bytes_per_row=MagickArraySize(((bits_per_sample+7U)/8U),image->columns);
+		    if (XV_332_Format == format)
+		      {
+			quantum_type=IndexQuantum;
+@@ -878,7 +878,8 @@
+	      }
+	    else
+	      {
+-		bytes_per_row=(((bits_per_sample+7)/8)*samples_per_pixel)*image->columns;
++		bytes_per_row=MagickArraySize((((bits_per_sample+7)/8)*samples_per_pixel),
++                                              image->columns);
+		if (3 == samples_per_pixel)
+		  {
+		    /* PPM */
+@@ -915,6 +916,28 @@
+		    is_monochrome=MagickFalse;
+		  }
+	      }
++
++            /* Validate file size before allocating memory */
++            if (BlobIsSeekable(image))
++              {
++                const magick_off_t file_size = GetBlobSize(image);
++                const magick_off_t current_offset = TellBlob(image);
++                if ((file_size > 0) &&
++                    (current_offset > 0) &&
++                    (file_size > current_offset))
++                  {
++                    const magick_off_t remaining = file_size-current_offset;
++                    const magick_off_t needed = (magick_off_t) image->rows *
++                      (magick_off_t) bytes_per_row;
++                    if ((remaining < (magick_off_t) bytes_per_row) ||
++                        (remaining < needed))
++                      {
++                        ThrowException(exception,CorruptImageError,UnexpectedEndOfFile,
++                                       image->filename);
++                        break;
++                      }
++                  }
++              }
+
+             scanline_set=AllocateThreadViewDataArray(image,exception,bytes_per_row,1);
+             if (scanline_set == (ThreadViewDataSet *) NULL)
diff --git a/gnu/packages/patches/graphicsmagick-CVE-2017-14165.patch b/gnu/packages/patches/graphicsmagick-CVE-2017-14165.patch
new file mode 100644
index 0000000000..1f55d90d38
--- /dev/null
+++ b/gnu/packages/patches/graphicsmagick-CVE-2017-14165.patch
@@ -0,0 +1,72 @@
+http://hg.code.sf.net/p/graphicsmagick/code/raw-rev/493da54370aa
+http://openwall.com/lists/oss-security/2017/09/06/4
+
+some changes were made to make the patch apply
+
+# HG changeset patch
+# User Bob Friesenhahn <bfriesen@GraphicsMagick.org>
+# Date 1503257388 18000
+# Node ID 493da54370aa42cb430c52a69eb75db0001a5589
+# Parent  f8724674907902b7bc37c04f252fe30fbdd88e6f
+SUN: Verify that file header data length, and file length are sufficient for claimed image dimensions.
+
+diff -r f87246749079 -r 493da54370aa coders/sun.c
+--- a/coders/sun.c	Sun Aug 20 12:21:03 2017 +0200
++++ b/coders/sun.c	Sun Aug 20 14:29:48 2017 -0500
+@@ -498,6 +498,12 @@
+     if (sun_info.depth < 8)
+       image->depth=sun_info.depth;
+ 
++    if (image_info->ping)
++      {
++        CloseBlob(image);
++        return(image);
++      }
++
+     /*
+       Compute bytes per line and bytes per image for an unencoded
+       image.
+@@ -522,15 +528,37 @@
+       if (bytes_per_image > sun_info.length)
+         ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
+ 
+-    if (image_info->ping)
+-      {
+-        CloseBlob(image);
+-        return(image);
+-      }
+     if (sun_info.type == RT_ENCODED)
+       sun_data_length=(size_t) sun_info.length;
+     else
+       sun_data_length=bytes_per_image;
++
++    /*
++      Verify that data length claimed by header is supported by file size
++    */
++    if (sun_info.type == RT_ENCODED)
++      {
++        if (sun_data_length < bytes_per_image/255U)
++          {
++            ThrowReaderException(CorruptImageError,ImproperImageHeader,image);
++          }
++      }
++    if (BlobIsSeekable(image))
++      {
++        const magick_off_t file_size = GetBlobSize(image);
++        const magick_off_t current_offset = TellBlob(image);
++        if ((file_size > 0) &&
++            (current_offset > 0) &&
++            (file_size > current_offset))
++        {
++          const magick_off_t remaining = file_size-current_offset;
++          if (remaining < (magick_off_t) sun_data_length)
++            {
++              ThrowReaderException(CorruptImageError,UnexpectedEndOfFile,image);
++            }
++        }
++      }
++
+     sun_data=MagickAllocateMemory(unsigned char *,sun_data_length);
+     if (sun_data == (unsigned char *) NULL)
+       ThrowReaderException(ResourceLimitError,MemoryAllocationFailed,image);
+
diff --git a/gnu/packages/patches/httpd-CVE-2017-9798.patch b/gnu/packages/patches/httpd-CVE-2017-9798.patch
new file mode 100644
index 0000000000..8391a3db4a
--- /dev/null
+++ b/gnu/packages/patches/httpd-CVE-2017-9798.patch
@@ -0,0 +1,22 @@
+Fixes "options bleed", aka. CVE-2017-9798:
+
+  https://nvd.nist.gov/vuln/detail/CVE-2017-9798
+  https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
+
+From <https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch>.
+
+--- a/server/core.c	2017/08/16 16:50:29	1805223
++++ b/server/core.c	2017/09/08 13:13:11	1807754
+@@ -2266,6 +2266,12 @@
+             /* method has not been registered yet, but resource restriction
+              * is always checked before method handling, so register it.
+              */
++            if (cmd->pool == cmd->temp_pool) {
++                /* In .htaccess, we can't globally register new methods. */
++                return apr_psprintf(cmd->pool, "Could not register method '%s' "
++                                   "for %s from .htaccess configuration",
++                                    method, cmd->cmd->name);
++            }
+             methnum = ap_method_register(cmd->pool,
+                                          apr_pstrdup(cmd->pool, method));
+         }
diff --git a/gnu/packages/patches/libarchive-CVE-2017-14166.patch b/gnu/packages/patches/libarchive-CVE-2017-14166.patch
new file mode 100644
index 0000000000..a122848440
--- /dev/null
+++ b/gnu/packages/patches/libarchive-CVE-2017-14166.patch
@@ -0,0 +1,45 @@
+Fix CVE-2017-14166:
+
+https://github.com/libarchive/libarchive/issues/935
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14166
+
+Patch copied from upstream source repository:
+
+https://github.com/libarchive/libarchive/commit/fa7438a0ff4033e4741c807394a9af6207940d71
+
+From fa7438a0ff4033e4741c807394a9af6207940d71 Mon Sep 17 00:00:00 2001
+From: Joerg Sonnenberger <joerg@bec.de>
+Date: Tue, 5 Sep 2017 18:12:19 +0200
+Subject: [PATCH] Do something sensible for empty strings to make fuzzers
+ happy.
+
+---
+ libarchive/archive_read_support_format_xar.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/libarchive/archive_read_support_format_xar.c b/libarchive/archive_read_support_format_xar.c
+index 7a22beb9d..93eeacc5e 100644
+--- a/libarchive/archive_read_support_format_xar.c
++++ b/libarchive/archive_read_support_format_xar.c
+@@ -1040,6 +1040,9 @@ atol10(const char *p, size_t char_cnt)
+ 	uint64_t l;
+ 	int digit;
+ 
++	if (char_cnt == 0)
++		return (0);
++
+ 	l = 0;
+ 	digit = *p - '0';
+ 	while (digit >= 0 && digit < 10  && char_cnt-- > 0) {
+@@ -1054,7 +1057,10 @@ atol8(const char *p, size_t char_cnt)
+ {
+ 	int64_t l;
+ 	int digit;
+-        
++
++	if (char_cnt == 0)
++		return (0);
++
+ 	l = 0;
+ 	while (char_cnt-- > 0) {
+ 		if (*p >= '0' && *p <= '7')
diff --git a/gnu/packages/patches/libzip-CVE-2017-12858.patch b/gnu/packages/patches/libzip-CVE-2017-12858.patch
deleted file mode 100644
index 8125173f95..0000000000
--- a/gnu/packages/patches/libzip-CVE-2017-12858.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Fix CVE-2017-12858:
-
-http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12858
-
-Patch copied from upstream source repository:
-
-https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796
-
-From 2217022b7d1142738656d891e00b3d2d9179b796 Mon Sep 17 00:00:00 2001
-From: Thomas Klausner <tk@giga.or.at>
-Date: Mon, 14 Aug 2017 10:55:44 +0200
-Subject: [PATCH] Fix double free().
-
-Found by Brian 'geeknik' Carpenter using AFL.
----
- THANKS           | 1 +
- lib/zip_dirent.c | 3 ---
- 2 files changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/THANKS b/THANKS
-index be0cca9..a80ee1d 100644
---- a/THANKS
-+++ b/THANKS
-@@ -12,6 +12,7 @@ BALATON Zoltan <balaton@eik.bme.hu>
- Benjamin Gilbert <bgilbert@backtick.net>
- Boaz Stolk <bstolk@aweta.nl>
- Bogdan <bogiebog@gmail.com>
-+Brian 'geeknik' Carpenter <geeknik@protonmail.ch>
- Chris Nehren <cnehren+libzip@pobox.com>
- Coverity <info@coverity.com>
- Dane Springmeyer <dane.springmeyer@gmail.com>
-diff --git a/lib/zip_dirent.c b/lib/zip_dirent.c
-index a369900..e5a7cc9 100644
---- a/lib/zip_dirent.c
-+++ b/lib/zip_dirent.c
-@@ -579,9 +579,6 @@ _zip_dirent_read(zip_dirent_t *zde, zip_source_t *src, zip_buffer_t *buffer, boo
-     }
- 
-     if (!_zip_dirent_process_winzip_aes(zde, error)) {
--	if (!from_buffer) {
--	    _zip_buffer_free(buffer);
--	}
- 	return -1;
-     }
- 
diff --git a/gnu/packages/patches/meson-for-build-rpath.patch b/gnu/packages/patches/meson-for-build-rpath.patch
new file mode 100644
index 0000000000..4e20c9aed3
--- /dev/null
+++ b/gnu/packages/patches/meson-for-build-rpath.patch
@@ -0,0 +1,24 @@
+This patch removes a part of meson that clears the rpath upon installation.
+This will only be applied to a special version of meson, used for the
+meson-build-system.
+
+Patch by Peter Mikkelsen <petermikkelsen10@gmail.com>
+
+--- meson-0.42.0/mesonbuild/scripts/meson_install.py.orig	2017-09-09 01:49:39.147374148 +0200
++++ meson-0.42.0/mesonbuild/scripts/meson_install.py	2017-09-09 01:51:01.209134717 +0200
+@@ -345,15 +345,6 @@
+                     print("Symlink creation does not work on this platform. "
+                           "Skipping all symlinking.")
+                     printed_symlink_error = True
+-        if is_elf_platform() and os.path.isfile(outname):
+-            try:
+-                e = depfixer.Elf(outname, False)
+-                e.fix_rpath(install_rpath)
+-            except SystemExit as e:
+-                if isinstance(e.code, int) and e.code == 0:
+-                    pass
+-                else:
+-                    raise
+
+ def run(args):
+     global install_log_file
diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch b/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
new file mode 100644
index 0000000000..449105e42a
--- /dev/null
+++ b/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch
@@ -0,0 +1,43 @@
+https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14500
+
+From 26f5a4350f3ab5507bb8727051c87bb04660f333 Mon Sep 17 00:00:00 2001
+From: Alexander Batischev <eual.jp@gmail.com>
+Date: Sat, 16 Sep 2017 19:31:43 +0300
+Subject: [PATCH] Work around shell code in podcast names (#598)
+
+---
+ src/pb_controller.cpp | 6 +++---
+ src/queueloader.cpp   | 2 +-
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp
+index 09b5e897..213216cd 100644
+--- a/src/pb_controller.cpp
++++ b/src/pb_controller.cpp
+@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) {
+ 	if (player == "")
+ 		return;
+ 	cmdline.append(player);
+-	cmdline.append(" \"");
+-	cmdline.append(utils::replace_all(file,"\"", "\\\""));
+-	cmdline.append("\"");
++	cmdline.append(" \'");
++	cmdline.append(utils::replace_all(file,"'", "%27"));
++	cmdline.append("\'");
+ 	stfl::reset();
+ 	LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str());
+ 	::system(cmdline.c_str());
+diff --git a/src/queueloader.cpp b/src/queueloader.cpp
+index c1dabdd8..ae725e04 100644
+--- a/src/queueloader.cpp
++++ b/src/queueloader.cpp
+@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) {
+ 		strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t));
+ 		fn.append(lbuf);
+ 	} else {
+-		fn.append(base);
++		fn.append(utils::replace_all(base, "'", "%27"));
+ 	}
+ 	return fn;
+ }
diff --git a/gnu/packages/patches/openfoam-4.1-cleanup.patch b/gnu/packages/patches/openfoam-4.1-cleanup.patch
new file mode 100644
index 0000000000..37effa5c9c
--- /dev/null
+++ b/gnu/packages/patches/openfoam-4.1-cleanup.patch
@@ -0,0 +1,243 @@
+# This patch removes all need for the ThirdParty files of OpenFOAM.
+
+# Derived from EasyBuild patch by Ward Poelmans <wpoely86@gmail.com>.
+# Modified for GNU Guix by Paul Garlick <pgarlick@tourbillion-technology.com>.
+
+diff -ur OpenFOAM-4.x-version-4.1.org/applications/utilities/mesh/manipulation/setSet/Allwmake OpenFOAM-4.x-version-4.1/applications/utilities/mesh/manipulation/setSet/Allwmake
+--- OpenFOAM-4.x-version-4.1.org/applications/utilities/mesh/manipulation/setSet/Allwmake
++++ OpenFOAM-4.x-version-4.1/applications/utilities/mesh/manipulation/setSet/Allwmake
+@@ -9,7 +9,7 @@
+ #
+ # use readline if available
+ #
+-if [ -f /usr/include/readline/readline.h ]
++if true
+ then
+     echo "Found <readline/readline.h>  --  enabling readline support."
+     export COMP_FLAGS="-DHAS_READLINE"
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/bashrc OpenFOAM-4.x-version-4.1/etc/bashrc
+--- OpenFOAM-4.x-version-4.1.org/etc/bashrc
++++ OpenFOAM-4.x-version-4.1/etc/bashrc
+@@ -43,8 +43,10 @@
+ # Please set to the appropriate path if the default is not correct.
+ #
+ [ $BASH_SOURCE ] && \
+-export FOAM_INST_DIR=$(cd ${BASH_SOURCE%/*/*/*} && pwd -P) || \
++export FOAM_INST_DIR=$(cd $(dirname $BASH_SOURCE)/../.. && pwd -P) || \
+ export FOAM_INST_DIR=$HOME/$WM_PROJECT
++# For GNU Guix: set initially for build then re-set at runtime
++#
+ # export FOAM_INST_DIR=~$WM_PROJECT
+ # export FOAM_INST_DIR=/opt/$WM_PROJECT
+ # export FOAM_INST_DIR=/usr/local/$WM_PROJECT
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/config.sh/CGAL OpenFOAM-4.x-version-4.1/etc/config.sh/CGAL
+--- OpenFOAM-4.x-version-4.1.org/etc/config.sh/CGAL
++++ OpenFOAM-4.x-version-4.1/etc/config.sh/CGAL
+@@ -36,37 +36,7 @@
+ #
+ #------------------------------------------------------------------------------
+
+-boost_version=boost-system
+-cgal_version=cgal-system
+-#cgal_version=CGAL-4.8
+-
+-if [ -z "$SOURCE_CGAL_VERSIONS_ONLY" ]
+-then
+-
+-    common_path=$WM_THIRD_PARTY_DIR/platforms/$WM_ARCH$WM_COMPILER
+-
+-    export BOOST_ARCH_PATH=$common_path/$boost_version
+-    export CGAL_ARCH_PATH=$common_path/$cgal_version
+-
+-    if [ "$FOAM_VERBOSE" -a "$PS1" ]
+-    then
+-        echo "Using CGAL and boost" 1>&2
+-        echo "    $cgal_version at $CGAL_ARCH_PATH" 1>&2
+-        echo "    $boost_version at $BOOST_ARCH_PATH" 1>&2
+-    fi
+-
+-    if [ -d "$CGAL_ARCH_PATH" -a "$cgal_version" != "cgal-system" ]
+-    then
+-        _foamAddLib $CGAL_ARCH_PATH/lib
+-    fi
+-
+-    if [ -d "$BOOST_ARCH_PATH" -a "$boost_version" != "boost-system" ]
+-    then
+-        _foamAddLib $BOOST_ARCH_PATH/lib
+-    fi
+-
+-    unset boost_version cgal_version common_path
+-
+-fi
++export CGAL_ARCH_PATH=$CGAL_ROOT
++export BOOST_ARCH_PATH=$BOOST_ROOT
+
+ #------------------------------------------------------------------------------
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/config.sh/gperftools OpenFOAM-4.x-version-4.1/etc/config.sh/gperftools
+--- OpenFOAM-4.x-version-4.1.org/etc/config.sh/gperftools
++++ OpenFOAM-4.x-version-4.1/etc/config.sh/gperftools
+@@ -29,13 +29,5 @@
+ #
+ #------------------------------------------------------------------------------
+
+-version=svn
+-gperftools_install=$WM_THIRD_PARTY_DIR/platforms/$WM_ARCH$WM_COMPILER
+-
+-GPERFTOOLS_VERSION=gperftools-$version
+-GPERFTOOLS_ARCH_PATH=$gperftools_install/$GPERFTOOLS_VERSION
+-
+-export PATH=$GPERFTOOLS_ARCH_PATH/bin:$PATH
+-export LD_LIBRARY_PATH=$GPERFTOOLS_ARCH_PATH/lib:$LD_LIBRARY_PATH
+
+ #------------------------------------------------------------------------------
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/config.sh/metis OpenFOAM-4.x-version-4.1/etc/config.sh/metis
+--- OpenFOAM-4.x-version-4.1.org/etc/config.sh/metis
++++ OpenFOAM-4.x-version-4.1/etc/config.sh/metis
+@@ -34,7 +34,7 @@
+ #
+ #------------------------------------------------------------------------------
+
+-export METIS_VERSION=metis-5.1.0
+-export METIS_ARCH_PATH=$WM_THIRD_PARTY_DIR/platforms/$WM_ARCH$WM_COMPILER$WM_PRECISION_OPTION$WM_LABEL_OPTION/$METIS_VERSION
++export METIS_VERSION=metis-$METISVERSION
++export METIS_ARCH_PATH=$METIS_ROOT
+
+ #------------------------------------------------------------------------------
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/config.sh/scotch OpenFOAM-4.x-version-4.1/etc/config.sh/scotch
+--- OpenFOAM-4.x-version-4.1.org/etc/config.sh/scotch
++++ OpenFOAM-4.x-version-4.1/etc/config.sh/scotch
+@@ -37,7 +37,7 @@
+ #
+ #------------------------------------------------------------------------------
+
+-export SCOTCH_VERSION=scotch_6.0.3
+-export SCOTCH_ARCH_PATH=$WM_THIRD_PARTY_DIR/platforms/$WM_ARCH$WM_COMPILER$WM_PRECISION_OPTION$WM_LABEL_OPTION/$SCOTCH_VERSION
++export SCOTCH_VERSION=scotch_$SCOTCHVERSION
++export SCOTCH_ARCH_PATH=$SCOTCH_ROOT
+
+ #------------------------------------------------------------------------------
+diff -ur OpenFOAM-4.x-version-4.1.org/etc/config.sh/settings OpenFOAM-4.x-version-4.1/etc/config.sh/settings
+--- OpenFOAM-4.x-version-4.1.org/etc/config.sh/settings
++++ OpenFOAM-4.x-version-4.1/etc/config.sh/settings
+@@ -279,6 +279,9 @@
+     ;;
+ system)
+     # Use system compiler
++    # Use system GMP and MPFR packages
++    export GMP_ARCH_PATH=$GMP_ROOT
++    export MPFR_ARCH_PATH=$MPFR_ROOT
+     ;;
+ *)
+     echo "Warn: WM_COMPILER_TYPE='$WM_COMPILER_TYPE' is unsupported" 1>&2
+diff -ur OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/ptscotchDecomp/Make/options OpenFOAM-4.x-version-4.1/src/parallel/decompose/ptscotchDecomp/Make/options
+--- OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/ptscotchDecomp/Make/options
++++ OpenFOAM-4.x-version-4.1/src/parallel/decompose/ptscotchDecomp/Make/options
+@@ -5,8 +5,7 @@
+     $(PFLAGS) $(PINC) \
+     -I$(SCOTCH_ROOT)/include \
+     -I$(SCOTCH_ARCH_PATH)/include/$(FOAM_MPI) \
+-    -I/usr/include/scotch \
+     -I../decompositionMethods/lnInclude
+
+ LIB_LIBS = \
+-    -L$(SCOTCH_ROOT)/lib -L$(FOAM_EXT_LIBBIN)/$(FOAM_MPI) -lptscotch -lptscotcherrexit -lscotch ${LINK_FLAGS} -lrt
++    -L$(SCOTCH_ROOT)/lib -L$(MPI_ARCH_PATH)/lib -lptscotch -lptscotcherrexit -lscotch ${LINK_FLAGS} -lrt
+diff -ur OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/scotchDecomp/Make/options OpenFOAM-4.x-version-4.1/src/parallel/decompose/scotchDecomp/Make/options
+--- OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/scotchDecomp/Make/options
++++ OpenFOAM-4.x-version-4.1/src/parallel/decompose/scotchDecomp/Make/options
+@@ -9,8 +9,7 @@
+     $(PFLAGS) $(PINC) \
+     -I$(SCOTCH_ROOT)/include \
+     -I$(SCOTCH_ARCH_PATH)/include \
+-    -I/usr/include/scotch \
+     -I../decompositionMethods/lnInclude
+
+ LIB_LIBS = \
+-    -L$(SCOTCH_ROOT)/lib -L$(FOAM_EXT_LIBBIN) -lscotch -lscotcherrexit -lrt
++    -L$(SCOTCH_ROOT)/lib -lscotch -lscotcherrexit -lrt
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/makefiles/general OpenFOAM-4.x-version-4.1/wmake/makefiles/general
+--- OpenFOAM-4.x-version-4.1.org/wmake/makefiles/general
++++ OpenFOAM-4.x-version-4.1/wmake/makefiles/general
+@@ -33,7 +33,6 @@
+ # The Makefile uses a POSIX shell
+ #------------------------------------------------------------------------------
+ 
+-SHELL           = /bin/sh
+ 
+ 
+ #------------------------------------------------------------------------------
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/wmake OpenFOAM-4.x-version-4.1/wmake/wmake
+--- OpenFOAM-4.x-version-4.1.org/wmake/wmake
++++ OpenFOAM-4.x-version-4.1/wmake/wmake
+@@ -163,7 +163,7 @@
+ then
+     if [ "$WM_NCOMPPROCS" -gt 1 -a ! "$MAKEFLAGS" ]
+     then
+-        lockDir=$HOME/.$WM_PROJECT/.wmake
++        lockDir=$(cd $(dirname $BASH_SOURCE)/../.. && pwd -P)/.$WM_PROJECT/.wmake
+ 
+         if [ -d $lockDir ]
+         then
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/wmakeScheduler OpenFOAM-4.x-version-4.1/wmake/wmakeScheduler
+--- OpenFOAM-4.x-version-4.1.org/wmake/wmakeScheduler
++++ OpenFOAM-4.x-version-4.1/wmake/wmakeScheduler
+@@ -53,7 +53,7 @@
+ # csh sets HOST, bash sets HOSTNAME
+ : ${HOST:=$HOSTNAME}
+ 
+-lockDir=$HOME/.$WM_PROJECT/.wmake
++lockDir=$(cd $(dirname $BASH_SOURCE)/../.. && pwd -P)/.$WM_PROJECT/.wmake
+ 
+ # Fallback - 1 core on current host
+ : ${WM_HOSTS:=$HOST:1}
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/wmakeSchedulerUptime OpenFOAM-4.x-version-4.1/wmake/wmakeSchedulerUptime
+--- OpenFOAM-4.x-version-4.1.org/wmake/wmakeSchedulerUptime
++++ OpenFOAM-4.x-version-4.1/wmake/wmakeSchedulerUptime
+@@ -53,7 +53,7 @@
+ # csh sets HOST, bash sets HOSTNAME
+ : ${HOST:=$HOSTNAME}
+ 
+-lockDir=$HOME/.$WM_PROJECT/.wmake
++lockDir=$(cd $(dirname $BASH_SOURCE)/../.. && pwd -P)/.$WM_PROJECT/.wmake
+ # Fallback - 1 core on current host
+ : ${WM_HOSTS:=$HOST:1}
+ 
+diff -ur OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/metisDecomp/metisDecomp.C OpenFOAM-4.x-version-4.1/src/parallel/decompose/metisDecomp/metisDecomp.C
+--- OpenFOAM-4.x-version-4.1.org/src/parallel/decompose/metisDecomp/metisDecomp.C
++++ OpenFOAM-4.x-version-4.1/src/parallel/decompose/metisDecomp/metisDecomp.C
+@@ -67,7 +67,7 @@
+ 
+     // Processor weights initialised with no size, only used if specified in
+     // a file
+-    Field<scalar> processorWeights;
++    Field<floatScalar> processorWeights;
+ 
+     // Cell weights (so on the vertices of the dual)
+     List<label> cellWeights;
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/rules/General/CGAL OpenFOAM-4.x-version-4.1/wmake/rules/General/CGAL
+--- OpenFOAM-4.x-version-4.1.org/wmake/rules/General/CGAL
++++ OpenFOAM-4.x-version-4.1/wmake/rules/General/CGAL
+@@ -6,9 +6,10 @@
+     -I/usr/include
+ 
+ CGAL_LIBS = \
+-    -L$(MPFR_ARCH_PATH)/lib$(WM_COMPILER_LIB_ARCH) \
+-    -L$(GMP_ARCH_PATH)/lib$(WM_COMPILER_LIB_ARCH) \
++    -L$(MPFR_ARCH_PATH)/lib \
++    -L$(GMP_ARCH_PATH)/lib \
+     -L$(BOOST_ARCH_PATH)/lib \
+     -L$(CGAL_ARCH_PATH)/lib \
+     -lCGAL \
++    -lgmp \
+     -lmpfr
+diff -ur OpenFOAM-4.x-version-4.1.org/wmake/rules/linux64Gcc/c++ OpenFOAM-4.x-version-4.1/wmake/rules/linux64Gcc/c++
+--- OpenFOAM-4.x-version-4.1.org/wmake/rules/linux64Gcc/c++
++++ OpenFOAM-4.x-version-4.1/wmake/rules/linux64Gcc/c++
+@@ -20,5 +20,5 @@
+
+ LINK_LIBS   = $(c++DBUG)
+
+-LINKLIBSO   = $(CC) $(c++FLAGS) -shared -Xlinker --add-needed -Xlinker --no-as-needed
+-LINKEXE     = $(CC) $(c++FLAGS) -Xlinker --add-needed -Xlinker --no-as-needed
++LINKLIBSO   = $(CC) $(c++FLAGS) $(LDFLAGS) -shared -Xlinker --add-needed -Xlinker --no-as-needed
++LINKEXE     = $(CC) $(c++FLAGS) $(LDFLAGS) -Xlinker --add-needed -Xlinker --no-as-needed
diff --git a/gnu/packages/patches/openjpeg-CVE-2017-14151.patch b/gnu/packages/patches/openjpeg-CVE-2017-14151.patch
new file mode 100644
index 0000000000..4fcf6af6db
--- /dev/null
+++ b/gnu/packages/patches/openjpeg-CVE-2017-14151.patch
@@ -0,0 +1,46 @@
+https://github.com/uclouvain/openjpeg/commit/afb308b9ccbe129608c9205cf3bb39bbefad90b9.patch
+http://openwall.com/lists/oss-security/2017/09/06/1
+
+From afb308b9ccbe129608c9205cf3bb39bbefad90b9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Mon, 14 Aug 2017 17:20:37 +0200
+Subject: [PATCH] Encoder: grow buffer size in
+ opj_tcd_code_block_enc_allocate_data() to avoid write heap buffer overflow in
+ opj_mqc_flush (#982)
+
+---
+ src/lib/openjp2/tcd.c                   | 7 +++++--
+ tests/nonregression/test_suite.ctest.in | 2 ++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/openjp2/tcd.c b/src/lib/openjp2/tcd.c
+index 301c7213e..53cdcf64d 100644
+--- a/src/lib/openjp2/tcd.c
++++ b/src/lib/openjp2/tcd.c
+@@ -1187,8 +1187,11 @@ static OPJ_BOOL opj_tcd_code_block_enc_allocate_data(opj_tcd_cblk_enc_t *
+ {
+     OPJ_UINT32 l_data_size;
+ 
+-    /* The +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
+-    l_data_size = 1 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
++    /* +1 is needed for https://github.com/uclouvain/openjpeg/issues/835 */
++    /* and actually +2 required for https://github.com/uclouvain/openjpeg/issues/982 */
++    /* TODO: is there a theoretical upper-bound for the compressed code */
++    /* block size ? */
++    l_data_size = 2 + (OPJ_UINT32)((p_code_block->x1 - p_code_block->x0) *
+                                    (p_code_block->y1 - p_code_block->y0) * (OPJ_INT32)sizeof(OPJ_UINT32));
+ 
+     if (l_data_size > p_code_block->data_size) {
+diff --git a/tests/nonregression/test_suite.ctest.in b/tests/nonregression/test_suite.ctest.in
+index aaf40d7d0..ffd964c2a 100644
+--- a/tests/nonregression/test_suite.ctest.in
++++ b/tests/nonregression/test_suite.ctest.in
+@@ -169,6 +169,8 @@ opj_compress -i @INPUT_NR_PATH@/Bretagne2.ppm -o @TEMP_PATH@/Bretagne2_empty_ban
+ # Same rate as Bretagne2_4.j2k
+ opj_compress -i @INPUT_NR_PATH@/Bretagne2.ppm -o @TEMP_PATH@/Bretagne2_empty_band_r800.j2k -t 2591,1943 -n 2 -r 800
+ 
++opj_compress -i @INPUT_NR_PATH@/issue982.bmp -o @TEMP_PATH@/issue982.j2k -n 1
++
+ # DECODER TEST SUITE
+ opj_decompress -i  @INPUT_NR_PATH@/Bretagne2.j2k -o @TEMP_PATH@/Bretagne2.j2k.pgx
+ opj_decompress -i  @INPUT_NR_PATH@/_00042.j2k -o @TEMP_PATH@/_00042.j2k.pgx
diff --git a/gnu/packages/patches/openjpeg-CVE-2017-14152.patch b/gnu/packages/patches/openjpeg-CVE-2017-14152.patch
new file mode 100644
index 0000000000..6c083be123
--- /dev/null
+++ b/gnu/packages/patches/openjpeg-CVE-2017-14152.patch
@@ -0,0 +1,38 @@
+https://github.com/uclouvain/openjpeg/commit/4241ae6fbbf1de9658764a80944dc8108f2b4154.patch
+http://openwall.com/lists/oss-security/2017/09/06/2
+
+From 4241ae6fbbf1de9658764a80944dc8108f2b4154 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Tue, 15 Aug 2017 11:55:58 +0200
+Subject: [PATCH] Fix assertion in debug mode / heap-based buffer overflow in
+ opj_write_bytes_LE for Cinema profiles with numresolutions = 1 (#985)
+
+---
+ src/lib/openjp2/j2k.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index a2521ebbc..54b490a8c 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -6573,10 +6573,16 @@ static void opj_j2k_set_cinema_parameters(opj_cparameters_t *parameters,
+ 
+     /* Precincts */
+     parameters->csty |= 0x01;
+-    parameters->res_spec = parameters->numresolution - 1;
+-    for (i = 0; i < parameters->res_spec; i++) {
+-        parameters->prcw_init[i] = 256;
+-        parameters->prch_init[i] = 256;
++    if (parameters->numresolution == 1) {
++        parameters->res_spec = 1;
++        parameters->prcw_init[0] = 128;
++        parameters->prch_init[0] = 128;
++    } else {
++        parameters->res_spec = parameters->numresolution - 1;
++        for (i = 0; i < parameters->res_spec; i++) {
++            parameters->prcw_init[i] = 256;
++            parameters->prch_init[i] = 256;
++        }
+     }
+ 
+     /* The progression order shall be CPRL */
diff --git a/gnu/packages/patches/openjpeg-CVE-2017-14164.patch b/gnu/packages/patches/openjpeg-CVE-2017-14164.patch
new file mode 100644
index 0000000000..2bfc5a6a85
--- /dev/null
+++ b/gnu/packages/patches/openjpeg-CVE-2017-14164.patch
@@ -0,0 +1,89 @@
+https://github.com/uclouvain/openjpeg/commit/dcac91b8c72f743bda7dbfa9032356bc8110098a.patch
+http://openwall.com/lists/oss-security/2017/09/06/3
+
+From dcac91b8c72f743bda7dbfa9032356bc8110098a Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Wed, 16 Aug 2017 17:09:10 +0200
+Subject: [PATCH] opj_j2k_write_sot(): fix potential write heap buffer overflow
+ (#991)
+
+---
+ src/lib/openjp2/j2k.c | 25 ++++++++++++++++++++-----
+ 1 file changed, 20 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/openjp2/j2k.c b/src/lib/openjp2/j2k.c
+index 54b490a8c..16915452e 100644
+--- a/src/lib/openjp2/j2k.c
++++ b/src/lib/openjp2/j2k.c
+@@ -832,13 +832,15 @@ static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,
+  * Writes the SOT marker (Start of tile-part)
+  *
+  * @param       p_j2k            J2K codec.
+- * @param       p_data           FIXME DOC
+- * @param       p_data_written   FIXME DOC
++ * @param       p_data           Output buffer
++ * @param       p_total_data_size Output buffer size
++ * @param       p_data_written   Number of bytes written into stream
+  * @param       p_stream         the stream to write data to.
+  * @param       p_manager        the user event manager.
+ */
+ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
+                                   OPJ_BYTE * p_data,
++                                  OPJ_UINT32 p_total_data_size,
+                                   OPJ_UINT32 * p_data_written,
+                                   const opj_stream_private_t *p_stream,
+                                   opj_event_mgr_t * p_manager);
+@@ -4201,6 +4203,7 @@ static OPJ_BOOL opj_j2k_write_tlm(opj_j2k_t *p_j2k,
+ 
+ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
+                                   OPJ_BYTE * p_data,
++                                  OPJ_UINT32 p_total_data_size,
+                                   OPJ_UINT32 * p_data_written,
+                                   const opj_stream_private_t *p_stream,
+                                   opj_event_mgr_t * p_manager
+@@ -4214,6 +4217,12 @@ static OPJ_BOOL opj_j2k_write_sot(opj_j2k_t *p_j2k,
+     OPJ_UNUSED(p_stream);
+     OPJ_UNUSED(p_manager);
+ 
++    if (p_total_data_size < 12) {
++        opj_event_msg(p_manager, EVT_ERROR,
++                      "Not enough bytes in output buffer to write SOT marker\n");
++        return OPJ_FALSE;
++    }
++
+     opj_write_bytes(p_data, J2K_MS_SOT,
+                     2);                                 /* SOT */
+     p_data += 2;
+@@ -11480,7 +11489,8 @@ static OPJ_BOOL opj_j2k_write_first_tile_part(opj_j2k_t *p_j2k,
+ 
+     l_current_nb_bytes_written = 0;
+     l_begin_data = p_data;
+-    if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
++    if (! opj_j2k_write_sot(p_j2k, p_data, p_total_data_size,
++                            &l_current_nb_bytes_written, p_stream,
+                             p_manager)) {
+         return OPJ_FALSE;
+     }
+@@ -11572,7 +11582,10 @@ static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,
+         l_part_tile_size = 0;
+         l_begin_data = p_data;
+ 
+-        if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
++        if (! opj_j2k_write_sot(p_j2k, p_data,
++                                p_total_data_size,
++                                &l_current_nb_bytes_written,
++                                p_stream,
+                                 p_manager)) {
+             return OPJ_FALSE;
+         }
+@@ -11615,7 +11628,9 @@ static OPJ_BOOL opj_j2k_write_all_tile_parts(opj_j2k_t *p_j2k,
+             l_part_tile_size = 0;
+             l_begin_data = p_data;
+ 
+-            if (! opj_j2k_write_sot(p_j2k, p_data, &l_current_nb_bytes_written, p_stream,
++            if (! opj_j2k_write_sot(p_j2k, p_data,
++                                    p_total_data_size,
++                                    &l_current_nb_bytes_written, p_stream,
+                                     p_manager)) {
+                 return OPJ_FALSE;
+             }
diff --git a/gnu/packages/patches/perl-text-markdown-discount-use-system-markdown.patch b/gnu/packages/patches/perl-text-markdown-discount-use-system-markdown.patch
new file mode 100644
index 0000000000..e0df632a04
--- /dev/null
+++ b/gnu/packages/patches/perl-text-markdown-discount-use-system-markdown.patch
@@ -0,0 +1,32 @@
+Description: Use the markdown library provided by the libmarkdown2 package.
+Author: Alessandro Ghedini <al3xbio@gmail.com>
+Origin: vendor
+Forwarded: not-needed
+Last-Update: 2012-01-01
+
+--- a/Makefile.PL
++++ b/Makefile.PL
+@@ -57,12 +57,6 @@
+ 
+ 
+ 
+-sub MY::postamble {
+-    return sprintf('
+-$(MYEXTLIB):
+-	%s
+-', qq{( cd $extdir; CC='cc -fPIC' sh configure.sh; make )\n});
+-}
+ 
+ WriteMakefile(
+     NAME              => 'Text::Markdown::Discount',
+@@ -71,8 +65,6 @@
+     ($] >= 5.005 ?
+       (ABSTRACT_FROM  => 'lib/Text/Markdown/Discount.pm',
+        AUTHOR         => 'Masayoshi Sekimura <sekimura@cpan.org>') : ()),
+-    LIBS               => '-L' . $extdir,
+-    INC               => '-I. -I' . $extdir,
+-    MYEXTLIB          => $myextlib,
+-    clean             => { FILES => $clean_files },
++    LIBS               => '-lmarkdown',
++    INC               => '-I.',
+ );
diff --git a/gnu/packages/patches/python-acme-dont-use-openssl-rand.patch b/gnu/packages/patches/python-acme-dont-use-openssl-rand.patch
new file mode 100644
index 0000000000..78920629c0
--- /dev/null
+++ b/gnu/packages/patches/python-acme-dont-use-openssl-rand.patch
@@ -0,0 +1,28 @@
+Fix build with PyOpenSSL > 17.2.0.
+
+See <https://github.com/certbot/certbot/issues/5111>.
+
+Patch copied from upstream source repository:
+https://github.com/certbot/certbot/commit/f6be07da74c664b57ac8c053585f919c79f9af44
+
+diff --git a/acme/crypto_util.py b/acme/crypto_util.py
+index de15284c03..b8fba03488 100644
+--- a/acme/crypto_util.py
++++ b/acme/crypto_util.py
+@@ -2,6 +2,7 @@
+ import binascii
+ import contextlib
+ import logging
++import os
+ import re
+ import socket
+ import sys
+@@ -243,7 +244,7 @@ def gen_ss_cert(key, domains, not_before=None,
+     """
+     assert domains, "Must provide one or more hostnames for the cert."
+     cert = OpenSSL.crypto.X509()
+-    cert.set_serial_number(int(binascii.hexlify(OpenSSL.rand.bytes(16)), 16))
++    cert.set_serial_number(int(binascii.hexlify(os.urandom(16)), 16))
+     cert.set_version(2)
+ 
+     extensions = [
diff --git a/gnu/packages/patches/qemu-CVE-2017-13711.patch b/gnu/packages/patches/qemu-CVE-2017-13711.patch
new file mode 100644
index 0000000000..4070115419
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-13711.patch
@@ -0,0 +1,89 @@
+Fix CVE-2017-13711:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13711
+
+Patch copied from upstream source repository:
+
+https://git.qemu.org/?p=qemu.git;a=commitdiff;h=1201d308519f1e915866d7583d5136d03cc1d384
+
+From 1201d308519f1e915866d7583d5136d03cc1d384 Mon Sep 17 00:00:00 2001
+From: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Date: Fri, 25 Aug 2017 01:35:53 +0200
+Subject: [PATCH] slirp: fix clearing ifq_so from pending packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The if_fastq and if_batchq contain not only packets, but queues of packets
+for the same socket. When sofree frees a socket, it thus has to clear ifq_so
+from all the packets from the queues, not only the first.
+
+Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ slirp/socket.c | 39 +++++++++++++++++++++++----------------
+ 1 file changed, 23 insertions(+), 16 deletions(-)
+
+diff --git a/slirp/socket.c b/slirp/socket.c
+index ecec0295a9..cb7b5b608d 100644
+--- a/slirp/socket.c
++++ b/slirp/socket.c
+@@ -59,6 +59,27 @@ socreate(Slirp *slirp)
+   return(so);
+ }
+ 
++/*
++ * Remove references to so from the given message queue.
++ */
++static void
++soqfree(struct socket *so, struct quehead *qh)
++{
++    struct mbuf *ifq;
++
++    for (ifq = (struct mbuf *) qh->qh_link;
++             (struct quehead *) ifq != qh;
++             ifq = ifq->ifq_next) {
++        if (ifq->ifq_so == so) {
++            struct mbuf *ifm;
++            ifq->ifq_so = NULL;
++            for (ifm = ifq->ifs_next; ifm != ifq; ifm = ifm->ifs_next) {
++                ifm->ifq_so = NULL;
++            }
++        }
++    }
++}
++
+ /*
+  * remque and free a socket, clobber cache
+  */
+@@ -66,23 +87,9 @@ void
+ sofree(struct socket *so)
+ {
+   Slirp *slirp = so->slirp;
+-  struct mbuf *ifm;
+ 
+-  for (ifm = (struct mbuf *) slirp->if_fastq.qh_link;
+-       (struct quehead *) ifm != &slirp->if_fastq;
+-       ifm = ifm->ifq_next) {
+-    if (ifm->ifq_so == so) {
+-      ifm->ifq_so = NULL;
+-    }
+-  }
+-
+-  for (ifm = (struct mbuf *) slirp->if_batchq.qh_link;
+-       (struct quehead *) ifm != &slirp->if_batchq;
+-       ifm = ifm->ifq_next) {
+-    if (ifm->ifq_so == so) {
+-      ifm->ifq_so = NULL;
+-    }
+-  }
++  soqfree(so, &slirp->if_fastq);
++  soqfree(so, &slirp->if_batchq);
+ 
+   if (so->so_emu==EMU_RSH && so->extra) {
+ 	sofree(so->extra);
+-- 
+2.14.1
+
diff --git a/gnu/packages/patches/qemu-CVE-2017-14167.patch b/gnu/packages/patches/qemu-CVE-2017-14167.patch
new file mode 100644
index 0000000000..a6007ac082
--- /dev/null
+++ b/gnu/packages/patches/qemu-CVE-2017-14167.patch
@@ -0,0 +1,69 @@
+Fix CVE-2017-14167:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14167
+http://seclists.org/oss-sec/2017/q3/407
+
+Patch copied from upstream development mailing list:
+
+https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01483.html
+
+From: Prasad J Pandit <address@hidden>
+
+While loading kernel via multiboot-v1 image, (flags & 0x00010000)
+indicates that multiboot header contains valid addresses to load
+the kernel image. These addresses are used to compute kernel
+size and kernel text offset in the OS image. Validate these
+address values to avoid an OOB access issue.
+
+This is CVE-2017-14167.
+
+Reported-by: Thomas Garnier <address@hidden>
+Signed-off-by: Prasad J Pandit <address@hidden>
+---
+ hw/i386/multiboot.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+Update: add CVE-ID to the commit message.
+
+diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
+index 6001f4caa2..c7b70c91d5 100644
+--- a/hw/i386/multiboot.c
++++ b/hw/i386/multiboot.c
+@@ -221,15 +221,34 @@ int load_multiboot(FWCfgState *fw_cfg,
+         uint32_t mh_header_addr = ldl_p(header+i+12);
+         uint32_t mh_load_end_addr = ldl_p(header+i+20);
+         uint32_t mh_bss_end_addr = ldl_p(header+i+24);
++
+         mh_load_addr = ldl_p(header+i+16);
++        if (mh_header_addr < mh_load_addr) {
++            fprintf(stderr, "invalid mh_load_addr address\n");
++            exit(1);
++        }
++
+         uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
+         uint32_t mb_load_size = 0;
+         mh_entry_addr = ldl_p(header+i+28);
+ 
+         if (mh_load_end_addr) {
++            if (mh_bss_end_addr < mh_load_addr) {
++                fprintf(stderr, "invalid mh_bss_end_addr address\n");
++                exit(1);
++            }
+             mb_kernel_size = mh_bss_end_addr - mh_load_addr;
++
++            if (mh_load_end_addr < mh_load_addr) {
++                fprintf(stderr, "invalid mh_load_end_addr address\n");
++                exit(1);
++            }
+             mb_load_size = mh_load_end_addr - mh_load_addr;
+         } else {
++            if (kernel_file_size < mb_kernel_text_offset) {
++                fprintf(stderr, "invalid kernel_file_size\n");
++                exit(1);
++            }
+             mb_kernel_size = kernel_file_size - mb_kernel_text_offset;
+             mb_load_size = mb_kernel_size;
+         }
+-- 
+2.13.5
+
diff --git a/gnu/packages/patches/ruby-2.2.7-rubygems-2613-ruby22.patch b/gnu/packages/patches/ruby-2.2.7-rubygems-2613-ruby22.patch
deleted file mode 100644
index d68b836c71..0000000000
--- a/gnu/packages/patches/ruby-2.2.7-rubygems-2613-ruby22.patch
+++ /dev/null
@@ -1,355 +0,0 @@
-diff --git lib/rubygems.rb lib/rubygems.rb
-index f48496aa31..0e1855b148 100644
---- ruby-2.2.7/lib/rubygems.rb
-+++ ruby-2.2.7/lib/rubygems.rb
-@@ -9,7 +9,7 @@ require 'rbconfig'
- require 'thread'
- 
- module Gem
--  VERSION = '2.4.5.2'
-+  VERSION = '2.4.5.3'
- end
- 
- # Must be first since it unloads the prelude from 1.9.2
-diff --git lib/rubygems/commands/query_command.rb lib/rubygems/commands/query_command.rb
-index 432250e033..44364cfab2 100644
---- ruby-2.2.7/lib/rubygems/commands/query_command.rb
-+++ ruby-2.2.7/lib/rubygems/commands/query_command.rb
-@@ -218,7 +218,7 @@ is too hard to use.
-         end
-       end
- 
--      output << make_entry(matching_tuples, platforms)
-+      output << clean_text(make_entry(matching_tuples, platforms))
-     end
-   end
- 
-@@ -336,7 +336,8 @@ is too hard to use.
-   end
- 
-   def spec_summary entry, spec
--    entry << "\n\n" << format_text(spec.summary, 68, 4)
-+    summary = truncate_text(spec.summary, "the summary for #{spec.full_name}")
-+    entry << "\n\n" << format_text(summary, 68, 4)
-   end
- 
- end
-diff --git lib/rubygems/installer.rb lib/rubygems/installer.rb
-index 10fc1a34a5..a27569fe2e 100644
---- ruby-2.2.7/lib/rubygems/installer.rb
-+++ ruby-2.2.7/lib/rubygems/installer.rb
-@@ -646,6 +646,11 @@ class Gem::Installer
-       unpack or File.writable?(gem_home)
-   end
- 
-+  def verify_spec_name
-+    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
-+    raise Gem::InstallError, "#{spec} has an invalid name"
-+  end
-+
-   ##
-   # Return the text for an application file.
- 
-@@ -771,6 +776,8 @@ TEXT
- 
-     ensure_loadable_spec
- 
-+    verify_spec_name
-+
-     if options[:install_as_default]
-       Gem.ensure_default_gem_subdirectories gem_home
-     else
-diff --git lib/rubygems/remote_fetcher.rb lib/rubygems/remote_fetcher.rb
-index b1f6dd17fc..2b9d61c0a1 100644
---- ruby-2.2.7/lib/rubygems/remote_fetcher.rb
-+++ ruby-2.2.7/lib/rubygems/remote_fetcher.rb
-@@ -96,7 +96,7 @@ class Gem::RemoteFetcher
-     else
-       target = res.target.to_s.strip
- 
--      if /\.#{Regexp.quote(host)}\z/ =~ target
-+      if URI("http://" + target).host.end_with?(".#{host}")
-         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
-       end
- 
-diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
-index ab1cd92270..faca837128 100644
---- ruby-2.2.7/lib/rubygems/specification.rb
-+++ ruby-2.2.7/lib/rubygems/specification.rb
-@@ -106,6 +106,8 @@ class Gem::Specification < Gem::BasicSpecification
- 
-   private_constant :LOAD_CACHE if defined? private_constant
- 
-+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:
-+
-   # :startdoc:
- 
-   ##
-@@ -2477,9 +2479,15 @@ class Gem::Specification < Gem::BasicSpecification
-       end
-     end
- 
--    unless String === name then
-+    if !name.is_a?(String) then
-       raise Gem::InvalidSpecificationException,
--            "invalid value for attribute name: \"#{name.inspect}\""
-+            "invalid value for attribute name: \"#{name.inspect}\" must be a string"
-+    elsif name !~ /[a-zA-Z]/ then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} must include at least one letter"
-+    elsif name !~ VALID_NAME_PATTERN then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"
-     end
- 
-     if raw_require_paths.empty? then
-diff --git lib/rubygems/text.rb lib/rubygems/text.rb
-index 5c9287ad2e..86a722ffc0 100644
---- ruby-2.2.7/lib/rubygems/text.rb
-+++ ruby-2.2.7/lib/rubygems/text.rb
-@@ -5,13 +5,26 @@ require 'rubygems'
- 
- module Gem::Text
- 
-+  ##
-+  # Remove any non-printable characters and make the text suitable for
-+  # printing.
-+  def clean_text(text)
-+    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)
-+  end
-+
-+  def truncate_text(text, description, max_length = 100_000)
-+    raise ArgumentError, "max_length must be positive" unless max_length > 0
-+    return text if text.size <= max_length
-+    "Truncating #{description} to #{max_length.to_s.reverse.gsub(/...(?=.)/,'\&,').reverse} characters:\n" + text[0, max_length]
-+  end
-+
-   ##
-   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+
-   # characters
- 
-   def format_text(text, wrap, indent=0)
-     result = []
--    work = text.dup
-+    work = clean_text(text)
- 
-     while work.length > wrap do
-       if work =~ /^(.{0,#{wrap}})[ \n]/ then
-diff --git test/rubygems/test_gem_commands_query_command.rb test/rubygems/test_gem_commands_query_command.rb
-index 43fa82571d..ccd2621874 100644
---- ruby-2.2.7/test/rubygems/test_gem_commands_query_command.rb
-+++ ruby-2.2.7/test/rubygems/test_gem_commands_query_command.rb
-@@ -147,6 +147,86 @@ a (2)
-     This is a lot of text. This is a lot of text. This is a lot of text.
-     This is a lot of text.
- 
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_cleans_text
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 4
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    This is a lot of text. This is a lot of text. This is a lot of text.
-+    This is a lot of text.
-+
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_truncates_summary
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 10_000
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    Truncating the summary for a-2 to 100,000 characters:
-+#{"    This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449}    This is a lot of te
-+
- pl (1)
-     Platform: i386-linux
-     Author: A User
-diff --git test/rubygems/test_gem_installer.rb test/rubygems/test_gem_installer.rb
-index 6f8012feb8..aba73af181 100644
---- ruby-2.2.7/test/rubygems/test_gem_installer.rb
-+++ ruby-2.2.7/test/rubygems/test_gem_installer.rb
-@@ -1214,6 +1214,26 @@ gem 'other', version
-     end
-   end
- 
-+  def test_pre_install_checks_malicious_name
-+    spec = util_spec '../malicious', '1'
-+    def spec.full_name # so the spec is buildable
-+      "malicious-1"
-+    end
-+    def spec.validate; end
-+
-+    util_build_gem spec
-+
-+    gem = File.join(@gemhome, 'cache', spec.file_name)
-+
-+    use_ui @ui do
-+      @installer = Gem::Installer.at gem
-+      e = assert_raises Gem::InstallError do
-+        @installer.pre_install_checks
-+      end
-+      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message
-+    end
-+  end
-+
-   def test_shebang
-     util_make_exec @spec, "#!/usr/bin/ruby"
- 
-diff --git test/rubygems/test_gem_remote_fetcher.rb test/rubygems/test_gem_remote_fetcher.rb
-index 63dd8feb38..ca4627810b 100644
---- ruby-2.2.7/test/rubygems/test_gem_remote_fetcher.rb
-+++ ruby-2.2.7/test/rubygems/test_gem_remote_fetcher.rb
-@@ -181,6 +181,21 @@ gems:
-     dns.verify
-   end
- 
-+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original_in_path
-+    uri = URI.parse "http://example.com/foo"
-+    target = MiniTest::Mock.new
-+    target.expect :target, "evil.com/a.example.com"
-+
-+    dns = MiniTest::Mock.new
-+    dns.expect :getresource, target, [String, Object]
-+
-+    fetch = Gem::RemoteFetcher.new nil, dns
-+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
-+
-+    target.verify
-+    dns.verify
-+  end
-+
-   def test_api_endpoint_ignores_trans_domain_values
-     uri = URI.parse "http://gems.example.com/foo"
-     target = MiniTest::Mock.new
-diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb
-index 3cadc55d5d..4f7076a03a 100644
---- ruby-2.2.7/test/rubygems/test_gem_specification.rb
-+++ ruby-2.2.7/test/rubygems/test_gem_specification.rb
-@@ -2610,7 +2610,37 @@ http://opensource.org/licenses/alphabetical
-       @a1.validate
-     end
- 
--    assert_equal 'invalid value for attribute name: ":json"', e.message
-+    assert_equal 'invalid value for attribute name: ":json" must be a string', e.message
-+
-+    @a1.name = []
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"[]\" must be a string", e.message
-+
-+    @a1.name = ""
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\" must include at least one letter", e.message
-+
-+    @a1.name = "12345"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"12345\" must include at least one letter", e.message
-+
-+    @a1.name = "../malicious"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"../malicious\" can only include letters, numbers, dashes, and underscores", e.message
-+
-+    @a1.name = "\ba\t"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\\ba\\t\" can only include letters, numbers, dashes, and underscores", e.message
-   end
- 
-   def test_validate_non_nil
-diff --git test/rubygems/test_gem_text.rb test/rubygems/test_gem_text.rb
-index e5cfc41e61..9b270b481b 100644
---- ruby-2.2.7/test/rubygems/test_gem_text.rb
-+++ ruby-2.2.7/test/rubygems/test_gem_text.rb
-@@ -35,6 +35,10 @@ Without the wrapping, the text might not look good in the RSS feed.
-     assert_equal expected, format_text(text, 78)
-   end
- 
-+  def test_format_removes_nonprintable_characters
-+    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)
-+  end
-+
-   def test_min3
-     assert_equal 1, min3(1, 1, 1)
-     assert_equal 1, min3(1, 1, 2)
-@@ -71,4 +75,11 @@ Without the wrapping, the text might not look good in the RSS feed.
-     assert_equal 7, levenshtein_distance("xxxxxxx", "ZenTest")
-     assert_equal 7, levenshtein_distance("zentest", "xxxxxxx")
-   end
-+
-+  def test_truncate_text
-+    assert_equal "abc", truncate_text("abc", "desc")
-+    assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2)
-+    s = "ab" * 500_001
-+    assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
-+  end
- end
diff --git a/gnu/packages/patches/ruby-2.3.4-rubygems-2613-ruby23.patch b/gnu/packages/patches/ruby-2.3.4-rubygems-2613-ruby23.patch
deleted file mode 100644
index 8f4758293e..0000000000
--- a/gnu/packages/patches/ruby-2.3.4-rubygems-2613-ruby23.patch
+++ /dev/null
@@ -1,355 +0,0 @@
-diff --git lib/rubygems.rb lib/rubygems.rb
-index 04031c765c..9c0219ce06 100644
---- ruby-2.3.4/lib/rubygems.rb
-+++ ruby-2.3.4/lib/rubygems.rb
-@@ -10,7 +10,7 @@
- require 'thread'
- 
- module Gem
--  VERSION = '2.5.2'
-+  VERSION = '2.5.2.1'
- end
- 
- # Must be first since it unloads the prelude from 1.9.2
-diff --git lib/rubygems/commands/query_command.rb lib/rubygems/commands/query_command.rb
-index d6196b44ed..61e9808860 100644
---- ruby-2.3.4/lib/rubygems/commands/query_command.rb
-+++ ruby-2.3.4/lib/rubygems/commands/query_command.rb
-@@ -226,7 +226,7 @@ def output_versions output, versions
-         end
-       end
- 
--      output << make_entry(matching_tuples, platforms)
-+      output << clean_text(make_entry(matching_tuples, platforms))
-     end
-   end
- 
-@@ -344,7 +344,8 @@ def spec_platforms entry, platforms
-   end
- 
-   def spec_summary entry, spec
--    entry << "\n\n" << format_text(spec.summary, 68, 4)
-+    summary = truncate_text(spec.summary, "the summary for #{spec.full_name}")
-+    entry << "\n\n" << format_text(summary, 68, 4)
-   end
- 
- end
-diff --git lib/rubygems/installer.rb lib/rubygems/installer.rb
-index 85358e0d1a..709b77d126 100644
---- ruby-2.3.4/lib/rubygems/installer.rb
-+++ ruby-2.3.4/lib/rubygems/installer.rb
-@@ -693,6 +693,11 @@ def verify_gem_home(unpack = false) # :nodoc:
-       unpack or File.writable?(gem_home)
-   end
- 
-+  def verify_spec_name
-+    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
-+    raise Gem::InstallError, "#{spec} has an invalid name"
-+  end
-+
-   ##
-   # Return the text for an application file.
- 
-@@ -812,6 +817,8 @@ def pre_install_checks
- 
-     ensure_loadable_spec
- 
-+    verify_spec_name
-+
-     if options[:install_as_default]
-       Gem.ensure_default_gem_subdirectories gem_home
-     else
-diff --git lib/rubygems/remote_fetcher.rb lib/rubygems/remote_fetcher.rb
-index fda1e067ef..254bebfadf 100644
---- ruby-2.3.4/lib/rubygems/remote_fetcher.rb
-+++ ruby-2.3.4/lib/rubygems/remote_fetcher.rb
-@@ -104,7 +104,7 @@ def api_endpoint(uri)
-     else
-       target = res.target.to_s.strip
- 
--      if /\.#{Regexp.quote(host)}\z/ =~ target
-+      if URI("http://" + target).host.end_with?(".#{host}")
-         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
-       end
- 
-diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
-index 8e2557cdb2..dd4fde1776 100644
---- ruby-2.3.4/lib/rubygems/specification.rb
-+++ ruby-2.3.4/lib/rubygems/specification.rb
-@@ -108,6 +108,8 @@ class Gem::Specification < Gem::BasicSpecification
- 
-   private_constant :LOAD_CACHE if defined? private_constant
- 
-+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:
-+
-   # :startdoc:
- 
-   ##
-@@ -2665,9 +2667,15 @@ def validate packaging = true
-       end
-     end
- 
--    unless String === name then
-+    if !name.is_a?(String) then
-       raise Gem::InvalidSpecificationException,
--            "invalid value for attribute name: \"#{name.inspect}\""
-+            "invalid value for attribute name: \"#{name.inspect}\" must be a string"
-+    elsif name !~ /[a-zA-Z]/ then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} must include at least one letter"
-+    elsif name !~ VALID_NAME_PATTERN then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"
-     end
- 
-     if raw_require_paths.empty? then
-diff --git lib/rubygems/text.rb lib/rubygems/text.rb
-index 732f1b99f2..b944b62c27 100644
---- ruby-2.3.4/lib/rubygems/text.rb
-+++ ruby-2.3.4/lib/rubygems/text.rb
-@@ -6,13 +6,26 @@
- 
- module Gem::Text
- 
-+  ##
-+  # Remove any non-printable characters and make the text suitable for
-+  # printing.
-+  def clean_text(text)
-+    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)
-+  end
-+
-+  def truncate_text(text, description, max_length = 100_000)
-+    raise ArgumentError, "max_length must be positive" unless max_length > 0
-+    return text if text.size <= max_length
-+    "Truncating #{description} to #{max_length.to_s.reverse.gsub(/...(?=.)/,'\&,').reverse} characters:\n" + text[0, max_length]
-+  end
-+
-   ##
-   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+
-   # characters
- 
-   def format_text(text, wrap, indent=0)
-     result = []
--    work = text.dup
-+    work = clean_text(text)
- 
-     while work.length > wrap do
-       if work =~ /^(.{0,#{wrap}})[ \n]/ then
-diff --git test/rubygems/test_gem_commands_query_command.rb test/rubygems/test_gem_commands_query_command.rb
-index 78c15a1770..9ec715492f 100644
---- ruby-2.3.4/test/rubygems/test_gem_commands_query_command.rb
-+++ ruby-2.3.4/test/rubygems/test_gem_commands_query_command.rb
-@@ -116,6 +116,86 @@ def test_execute_details
-     This is a lot of text. This is a lot of text. This is a lot of text.
-     This is a lot of text.
- 
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_cleans_text
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 4
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    This is a lot of text. This is a lot of text. This is a lot of text.
-+    This is a lot of text.
-+
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_truncates_summary
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 10_000
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    Truncating the summary for a-2 to 100,000 characters:
-+#{"    This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449}    This is a lot of te
-+
- pl (1)
-     Platform: i386-linux
-     Author: A User
-diff --git test/rubygems/test_gem_installer.rb test/rubygems/test_gem_installer.rb
-index 5ec71d0a01..1092a0c68f 100644
---- ruby-2.3.4/test/rubygems/test_gem_installer.rb
-+++ ruby-2.3.4/test/rubygems/test_gem_installer.rb
-@@ -1227,6 +1227,26 @@ def test_pre_install_checks_wrong_rubygems_version
-     end
-   end
- 
-+  def test_pre_install_checks_malicious_name
-+    spec = util_spec '../malicious', '1'
-+    def spec.full_name # so the spec is buildable
-+      "malicious-1"
-+    end
-+    def spec.validate; end
-+
-+    util_build_gem spec
-+
-+    gem = File.join(@gemhome, 'cache', spec.file_name)
-+
-+    use_ui @ui do
-+      @installer = Gem::Installer.at gem
-+      e = assert_raises Gem::InstallError do
-+        @installer.pre_install_checks
-+      end
-+      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message
-+    end
-+  end
-+
-   def test_shebang
-     util_make_exec @spec, "#!/usr/bin/ruby"
- 
-diff --git test/rubygems/test_gem_remote_fetcher.rb test/rubygems/test_gem_remote_fetcher.rb
-index 49b6b6656c..a3919c8ef2 100644
---- ruby-2.3.4/test/rubygems/test_gem_remote_fetcher.rb
-+++ ruby-2.3.4/test/rubygems/test_gem_remote_fetcher.rb
-@@ -253,6 +253,21 @@ def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
-     dns.verify
-   end
- 
-+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original_in_path
-+    uri = URI.parse "http://example.com/foo"
-+    target = MiniTest::Mock.new
-+    target.expect :target, "evil.com/a.example.com"
-+
-+    dns = MiniTest::Mock.new
-+    dns.expect :getresource, target, [String, Object]
-+
-+    fetch = Gem::RemoteFetcher.new nil, dns
-+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
-+
-+    target.verify
-+    dns.verify
-+  end
-+
-   def test_api_endpoint_timeout_warning
-     uri = URI.parse "http://gems.example.com/foo"
- 
-diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb
-index bc1c8d2ca7..9a49bbbf59 100644
---- ruby-2.3.4/test/rubygems/test_gem_specification.rb
-+++ ruby-2.3.4/test/rubygems/test_gem_specification.rb
-@@ -2974,7 +2974,37 @@ def test_validate_name
-       @a1.validate
-     end
- 
--    assert_equal 'invalid value for attribute name: ":json"', e.message
-+    assert_equal 'invalid value for attribute name: ":json" must be a string', e.message
-+
-+    @a1.name = []
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"[]\" must be a string", e.message
-+
-+    @a1.name = ""
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\" must include at least one letter", e.message
-+
-+    @a1.name = "12345"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"12345\" must include at least one letter", e.message
-+
-+    @a1.name = "../malicious"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"../malicious\" can only include letters, numbers, dashes, and underscores", e.message
-+
-+    @a1.name = "\ba\t"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\\ba\\t\" can only include letters, numbers, dashes, and underscores", e.message
-   end
- 
-   def test_validate_non_nil
-diff --git test/rubygems/test_gem_text.rb test/rubygems/test_gem_text.rb
-index a6e22e04da..04f3f605e8 100644
---- ruby-2.3.4/test/rubygems/test_gem_text.rb
-+++ ruby-2.3.4/test/rubygems/test_gem_text.rb
-@@ -36,6 +36,10 @@ def test_format_text_trailing # for two spaces after .
-     assert_equal expected, format_text(text, 78)
-   end
- 
-+  def test_format_removes_nonprintable_characters
-+    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)
-+  end
-+
-   def test_min3
-     assert_equal 1, min3(1, 1, 1)
-     assert_equal 1, min3(1, 1, 2)
-@@ -74,4 +78,11 @@ def test_levenshtein_distance_replace
-     assert_equal 7, levenshtein_distance("xxxxxxx", "ZenTest")
-     assert_equal 7, levenshtein_distance("zentest", "xxxxxxx")
-   end
-+
-+  def test_truncate_text
-+    assert_equal "abc", truncate_text("abc", "desc")
-+    assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2)
-+    s = "ab" * 500_001
-+    assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
-+  end
- end
diff --git a/gnu/packages/patches/ruby-rubygems-2612-ruby24.patch b/gnu/packages/patches/ruby-rubygems-2612-ruby24.patch
deleted file mode 100644
index 8ee32c0c6e..0000000000
--- a/gnu/packages/patches/ruby-rubygems-2612-ruby24.patch
+++ /dev/null
@@ -1,437 +0,0 @@
-diff --git lib/rubygems.rb lib/rubygems.rb
-index 5cd1a4c47a..bc5bf9b4c2 100644
---- ruby-2.4.1/lib/rubygems.rb
-+++ ruby-2.4.1/lib/rubygems.rb
-@@ -10,7 +10,7 @@
- require 'thread'
- 
- module Gem
--  VERSION = "2.6.11"
-+  VERSION = "2.6.12"
- end
- 
- # Must be first since it unloads the prelude from 1.9.2
-@@ -234,6 +234,7 @@ def self.needs
- 
-   def self.finish_resolve(request_set=Gem::RequestSet.new)
-     request_set.import Gem::Specification.unresolved_deps.values
-+    request_set.import Gem.loaded_specs.values.map {|s| Gem::Dependency.new(s.name, s.version) }
- 
-     request_set.resolve_current.each do |s|
-       s.full_spec.activate
-diff --git lib/rubygems/commands/open_command.rb lib/rubygems/commands/open_command.rb
-index a89b7421e3..059635e835 100644
---- ruby-2.4.1/lib/rubygems/commands/open_command.rb
-+++ ruby-2.4.1/lib/rubygems/commands/open_command.rb
-@@ -72,7 +72,7 @@ def open_editor path
-   end
- 
-   def spec_for name
--    spec = Gem::Specification.find_all_by_name(name, @version).last
-+    spec = Gem::Specification.find_all_by_name(name, @version).first
- 
-     return spec if spec
- 
-diff --git lib/rubygems/commands/query_command.rb lib/rubygems/commands/query_command.rb
-index f25d120b88..70f8127292 100644
---- ruby-2.4.1/lib/rubygems/commands/query_command.rb
-+++ ruby-2.4.1/lib/rubygems/commands/query_command.rb
-@@ -86,7 +86,7 @@ def execute
-       name = Array(options[:name])
-     else
-       args = options[:args].to_a
--      name = options[:exact] ? args : args.map{|arg| /#{arg}/i }
-+      name = options[:exact] ? args.map{|arg| /\A#{Regexp.escape(arg)}\Z/ } : args.map{|arg| /#{arg}/i }
-     end
- 
-     prerelease = options[:prerelease]
-diff --git lib/rubygems/commands/sources_command.rb lib/rubygems/commands/sources_command.rb
-index 9832afd214..7e46963a4c 100644
---- ruby-2.4.1/lib/rubygems/commands/sources_command.rb
-+++ ruby-2.4.1/lib/rubygems/commands/sources_command.rb
-@@ -44,7 +44,7 @@ def add_source source_uri # :nodoc:
-     source = Gem::Source.new source_uri
- 
-     begin
--      if Gem.sources.include? source_uri then
-+      if Gem.sources.include? source then
-         say "source #{source_uri} already present in the cache"
-       else
-         source.load_specs :released
-diff --git lib/rubygems/dependency_list.rb lib/rubygems/dependency_list.rb
-index 35fe7c4c1a..d8314eaf60 100644
---- ruby-2.4.1/lib/rubygems/dependency_list.rb
-+++ ruby-2.4.1/lib/rubygems/dependency_list.rb
-@@ -104,7 +104,7 @@ def find_name(full_name)
-   end
- 
-   def inspect # :nodoc:
--    "#<%s:0x%x %p>" % [self.class, object_id, map { |s| s.full_name }]
-+    "%s %p>" % [super[0..-2], map { |s| s.full_name }]
-   end
- 
-   ##
-diff --git lib/rubygems/installer.rb lib/rubygems/installer.rb
-index f4d3e728de..967543c2d1 100644
---- ruby-2.4.1/lib/rubygems/installer.rb
-+++ ruby-2.4.1/lib/rubygems/installer.rb
-@@ -214,7 +214,7 @@ def check_executable_overwrite filename # :nodoc:
- 
-       ruby_executable = true
-       existing = io.read.slice(%r{
--          ^(
-+          ^\s*(
-             gem \s |
-             load \s Gem\.bin_path\( |
-             load \s Gem\.activate_bin_path\(
-@@ -701,6 +701,8 @@ def verify_gem_home(unpack = false) # :nodoc:
-   # Return the text for an application file.
- 
-   def app_script_text(bin_file_name)
-+    # note that the `load` lines cannot be indented, as old RG versions match
-+    # against the beginning of the line
-     return <<-TEXT
- #{shebang bin_file_name}
- #
-@@ -723,7 +725,12 @@ def app_script_text(bin_file_name)
-   end
- end
- 
-+if Gem.respond_to?(:activate_bin_path)
- load Gem.activate_bin_path('#{spec.name}', '#{bin_file_name}', version)
-+else
-+gem #{spec.name.dump}, version
-+load Gem.bin_path(#{spec.name.dump}, #{bin_file_name.dump}, version)
-+end
- TEXT
-   end
- 
-diff --git lib/rubygems/platform.rb lib/rubygems/platform.rb
-index d22d91ae54..2dd9ed5782 100644
---- ruby-2.4.1/lib/rubygems/platform.rb
-+++ ruby-2.4.1/lib/rubygems/platform.rb
-@@ -112,7 +112,7 @@ def initialize(arch)
-   end
- 
-   def inspect
--    "#<%s:0x%x @cpu=%p, @os=%p, @version=%p>" % [self.class, object_id, *to_a]
-+    "%s @cpu=%p, @os=%p, @version=%p>" % [super[0..-2], *to_a]
-   end
- 
-   def to_a
-diff --git lib/rubygems/security.rb lib/rubygems/security.rb
-index 119d6d56f7..6963ca156f 100644
---- ruby-2.4.1/lib/rubygems/security.rb
-+++ ruby-2.4.1/lib/rubygems/security.rb
-@@ -455,7 +455,7 @@ def self.create_cert_self_signed subject, key, age = ONE_YEAR,
- 
-   ##
-   # Creates a new key pair of the specified +length+ and +algorithm+.  The
--  # default is a 2048 bit RSA key.
-+  # default is a 3072 bit RSA key.
- 
-   def self.create_key length = KEY_LENGTH, algorithm = KEY_ALGORITHM
-     algorithm.new length
-diff --git lib/rubygems/server.rb lib/rubygems/server.rb
-index 81df0e608e..df4eb566d3 100644
---- ruby-2.4.1/lib/rubygems/server.rb
-+++ ruby-2.4.1/lib/rubygems/server.rb
-@@ -657,7 +657,7 @@ def root(req, res)
-       "only_one_executable" => true,
-       "full_name" => "rubygems-#{Gem::VERSION}",
-       "has_deps" => false,
--      "homepage" => "http://docs.rubygems.org/",
-+      "homepage" => "http://guides.rubygems.org/",
-       "name" => 'rubygems',
-       "ri_installed" => true,
-       "summary" => "RubyGems itself",
-diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
-index a2f289d162..500f0af768 100644
---- ruby-2.4.1/lib/rubygems/specification.rb
-+++ ruby-2.4.1/lib/rubygems/specification.rb
-@@ -2105,7 +2105,7 @@ def inspect # :nodoc:
-     if $DEBUG
-       super
-     else
--      "#<#{self.class}:0x#{__id__.to_s(16)} #{full_name}>"
-+      "#{super[0..-2]} #{full_name}>"
-     end
-   end
- 
-diff --git lib/rubygems/test_case.rb lib/rubygems/test_case.rb
-index 86b68e1efb..4e48f1eb4c 100644
---- ruby-2.4.1/lib/rubygems/test_case.rb
-+++ ruby-2.4.1/lib/rubygems/test_case.rb
-@@ -484,7 +484,7 @@ def git_gem name = 'a', version = 1
- 
-       system @git, 'add', gemspec
-       system @git, 'commit', '-a', '-m', 'a non-empty commit message', '--quiet'
--      head = Gem::Util.popen('git', 'rev-parse', 'master').strip
-+      head = Gem::Util.popen(@git, 'rev-parse', 'master').strip
-     end
- 
-     return name, git_spec.version, directory, head
-@@ -1498,6 +1498,8 @@ def self.key_path key_name
- begin
-   gem 'rdoc'
-   require 'rdoc'
-+
-+  require 'rubygems/rdoc'
- rescue LoadError, Gem::LoadError
- end
- 
-@@ -1514,3 +1516,4 @@ def self.key_path key_name
- pid = $$
- END {tmpdirs.each {|dir| Dir.rmdir(dir)} if $$ == pid}
- Gem.clear_paths
-+Gem.loaded_specs.clear
-diff --git test/rubygems/test_gem.rb test/rubygems/test_gem.rb
-index a605f9cdfe..62b36dfd41 100644
---- ruby-2.4.1/test/rubygems/test_gem.rb
-+++ ruby-2.4.1/test/rubygems/test_gem.rb
-@@ -75,6 +75,29 @@ def test_self_finish_resolve_wtf
-     end
-   end
- 
-+  def test_self_finish_resolve_respects_loaded_specs
-+    save_loaded_features do
-+      a1 = new_spec "a", "1", "b" => "> 0"
-+      b1 = new_spec "b", "1", "c" => ">= 1"
-+      b2 = new_spec "b", "2", "c" => ">= 2"
-+      c1 = new_spec "c", "1"
-+      c2 = new_spec "c", "2"
-+
-+      install_specs c1, c2, b1, b2, a1
-+
-+      a1.activate
-+      c1.activate
-+
-+      assert_equal %w(a-1 c-1), loaded_spec_names
-+      assert_equal ["b (> 0)"], unresolved_names
-+
-+      Gem.finish_resolve
-+
-+      assert_equal %w(a-1 b-1 c-1), loaded_spec_names
-+      assert_equal [], unresolved_names
-+    end
-+  end
-+
-   def test_self_install
-     spec_fetcher do |f|
-       f.gem  'a', 1
-@@ -492,7 +515,7 @@ def test_self_find_files_with_gemfile
-     skip if RUBY_VERSION <= "1.8.7"
- 
-     cwd = File.expand_path("test/rubygems", @@project_dir)
--    $LOAD_PATH.unshift cwd
-+    actual_load_path = $LOAD_PATH.unshift(cwd).dup
- 
-     discover_path = File.join 'lib', 'sff', 'discover.rb'
- 
-@@ -518,12 +541,12 @@ def test_self_find_files_with_gemfile
-     expected = [
-       File.expand_path('test/rubygems/sff/discover.rb', @@project_dir),
-       File.join(foo1.full_gem_path, discover_path)
--    ]
-+    ].sort
- 
--    assert_equal expected, Gem.find_files('sff/discover')
--    assert_equal expected, Gem.find_files('sff/**.rb'), '[ruby-core:31730]'
-+    assert_equal expected, Gem.find_files('sff/discover').sort
-+    assert_equal expected, Gem.find_files('sff/**.rb').sort, '[ruby-core:31730]'
-   ensure
--    assert_equal cwd, $LOAD_PATH.shift unless RUBY_VERSION <= "1.8.7"
-+    assert_equal cwd, actual_load_path.shift unless RUBY_VERSION <= "1.8.7"
-   end
- 
-   def test_self_find_latest_files
-diff --git test/rubygems/test_gem_commands_open_command.rb test/rubygems/test_gem_commands_open_command.rb
-index 3ec38972e6..a96fa6ea23 100644
---- ruby-2.4.1/test/rubygems/test_gem_commands_open_command.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_commands_open_command.rb
-@@ -24,7 +24,8 @@ def test_execute
-     @cmd.options[:args] = %w[foo]
-     @cmd.options[:editor] = "#{Gem.ruby} -e0 --"
- 
--    spec = gem 'foo'
-+    gem 'foo', '1.0.0'
-+    spec = gem 'foo', '1.0.1'
-     mock = MiniTest::Mock.new
-     mock.expect(:call, true, [spec.full_gem_path])
- 
-diff --git test/rubygems/test_gem_commands_query_command.rb test/rubygems/test_gem_commands_query_command.rb
-index 223f205b2d..d8d682b136 100644
---- ruby-2.4.1/test/rubygems/test_gem_commands_query_command.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_commands_query_command.rb
-@@ -642,7 +642,7 @@ def test_execute_local_details
-     assert_equal expected, @ui.output
-   end
- 
--  def test_execute_exact
-+  def test_execute_exact_remote
-     spec_fetcher do |fetcher|
-       fetcher.spec 'coolgem-omg', 3
-       fetcher.spec 'coolgem', '4.2.1'
-@@ -665,6 +665,60 @@ def test_execute_exact
-     assert_equal expected, @ui.output
-   end
- 
-+  def test_execute_exact_local
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'coolgem-omg', 3
-+      fetcher.spec 'coolgem', '4.2.1'
-+      fetcher.spec 'wow_coolgem', 1
-+    end
-+
-+    @cmd.handle_options %w[--exact coolgem]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** LOCAL GEMS ***
-+
-+coolgem (4.2.1)
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+  end
-+
-+  def test_execute_exact_multiple
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'coolgem-omg', 3
-+      fetcher.spec 'coolgem', '4.2.1'
-+      fetcher.spec 'wow_coolgem', 1
-+
-+      fetcher.spec 'othergem-omg', 3
-+      fetcher.spec 'othergem', '1.2.3'
-+      fetcher.spec 'wow_othergem', 1
-+    end
-+
-+    @cmd.handle_options %w[--exact coolgem othergem]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** LOCAL GEMS ***
-+
-+coolgem (4.2.1)
-+
-+*** LOCAL GEMS ***
-+
-+othergem (1.2.3)
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+  end
-+
-   private
- 
-   def add_gems_to_fetcher
-diff --git test/rubygems/test_gem_commands_sources_command.rb test/rubygems/test_gem_commands_sources_command.rb
-index 014b4b4c12..d5b6d99419 100644
---- ruby-2.4.1/test/rubygems/test_gem_commands_sources_command.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_commands_sources_command.rb
-@@ -108,6 +108,58 @@ def test_execute_add_redundant_source
-     assert_equal '', @ui.error
-   end
- 
-+  def test_execute_add_redundant_source_trailing_slash
-+    # Remove pre-existing gem source (w/ slash)
-+    repo_with_slash = "http://gems.example.com/"
-+    @cmd.handle_options %W[--remove #{repo_with_slash}]
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+    source = Gem::Source.new repo_with_slash
-+    assert_equal false, Gem.sources.include?(source)
-+
-+    expected = <<-EOF
-+#{repo_with_slash} removed from sources
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+
-+    # Re-add pre-existing gem source (w/o slash)
-+    repo_without_slash = "http://gems.example.com"
-+    @cmd.handle_options %W[--add #{repo_without_slash}]
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+    source = Gem::Source.new repo_without_slash
-+    assert_equal true, Gem.sources.include?(source)
-+
-+    expected = <<-EOF
-+http://gems.example.com/ removed from sources
-+http://gems.example.com added to sources
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+
-+    # Re-add original gem source (w/ slash)
-+    @cmd.handle_options %W[--add #{repo_with_slash}]
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+    source = Gem::Source.new repo_with_slash
-+    assert_equal true, Gem.sources.include?(source)
-+
-+    expected = <<-EOF
-+http://gems.example.com/ removed from sources
-+http://gems.example.com added to sources
-+source http://gems.example.com/ already present in the cache
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error 
-+  end
-+
-   def test_execute_add_http_rubygems_org
-     http_rubygems_org = 'http://rubygems.org'
- 
-diff --git test/rubygems/test_gem_installer.rb test/rubygems/test_gem_installer.rb
-index 6ceb2c6dfc..882981d344 100644
---- ruby-2.4.1/test/rubygems/test_gem_installer.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_installer.rb
-@@ -62,7 +62,12 @@ def test_app_script_text
-   end
- end
- 
-+if Gem.respond_to?(:activate_bin_path)
- load Gem.activate_bin_path('a', 'executable', version)
-+else
-+gem "a", version
-+load Gem.bin_path("a", "executable", version)
-+end
-     EOF
- 
-     wrapper = @installer.app_script_text 'executable'
-diff --git test/rubygems/test_require.rb test/rubygems/test_require.rb
-index dd606e44d4..936f78fb2a 100644
---- ruby-2.4.1/test/rubygems/test_require.rb
-+++ ruby-2.4.1/test/rubygems/test_require.rb
-@@ -301,6 +301,17 @@ def test_default_gem_only
-     assert_equal %w(default-2.0.0.0), loaded_spec_names
-   end
- 
-+  def test_realworld_default_gem
-+    skip "no default gems on ruby < 2.0" unless RUBY_VERSION >= "2"
-+    cmd = <<-RUBY
-+      $stderr = $stdout
-+      require "json"
-+      puts Gem.loaded_specs["json"].default_gem?
-+    RUBY
-+    output = Gem::Util.popen(Gem.ruby, "-e", cmd).strip
-+    assert_equal "true", output
-+  end
-+
-   def test_default_gem_and_normal_gem
-     default_gem_spec = new_default_spec("default", "2.0.0.0",
-                                         nil, "default/gem.rb")
diff --git a/gnu/packages/patches/ruby-rubygems-2613-ruby24.patch b/gnu/packages/patches/ruby-rubygems-2613-ruby24.patch
deleted file mode 100644
index c253cc912d..0000000000
--- a/gnu/packages/patches/ruby-rubygems-2613-ruby24.patch
+++ /dev/null
@@ -1,355 +0,0 @@
-diff --git lib/rubygems.rb lib/rubygems.rb
-index bc5bf9b4c2..55aa85b8b2 100644
---- ruby-2.4.1/lib/rubygems.rb
-+++ ruby-2.4.1/lib/rubygems.rb
-@@ -10,7 +10,7 @@
- require 'thread'
- 
- module Gem
--  VERSION = "2.6.12"
-+  VERSION = "2.6.13"
- end
- 
- # Must be first since it unloads the prelude from 1.9.2
-diff --git lib/rubygems/commands/query_command.rb lib/rubygems/commands/query_command.rb
-index 70f8127292..44144203e0 100644
---- ruby-2.4.1/lib/rubygems/commands/query_command.rb
-+++ ruby-2.4.1/lib/rubygems/commands/query_command.rb
-@@ -226,7 +226,7 @@ def output_versions output, versions
-         end
-       end
- 
--      output << make_entry(matching_tuples, platforms)
-+      output << clean_text(make_entry(matching_tuples, platforms))
-     end
-   end
- 
-@@ -353,7 +353,8 @@ def spec_platforms entry, platforms
-   end
- 
-   def spec_summary entry, spec
--    entry << "\n\n" << format_text(spec.summary, 68, 4)
-+    summary = truncate_text(spec.summary, "the summary for #{spec.full_name}")
-+    entry << "\n\n" << format_text(summary, 68, 4)
-   end
- 
- end
-diff --git lib/rubygems/installer.rb lib/rubygems/installer.rb
-index 967543c2d1..6fd3399dd4 100644
---- ruby-2.4.1/lib/rubygems/installer.rb
-+++ ruby-2.4.1/lib/rubygems/installer.rb
-@@ -697,6 +697,11 @@ def verify_gem_home(unpack = false) # :nodoc:
-       unpack or File.writable?(gem_home)
-   end
- 
-+  def verify_spec_name
-+    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
-+    raise Gem::InstallError, "#{spec} has an invalid name"
-+  end
-+
-   ##
-   # Return the text for an application file.
- 
-@@ -823,6 +828,8 @@ def pre_install_checks
- 
-     ensure_loadable_spec
- 
-+    verify_spec_name
-+
-     if options[:install_as_default]
-       Gem.ensure_default_gem_subdirectories gem_home
-     else
-diff --git lib/rubygems/remote_fetcher.rb lib/rubygems/remote_fetcher.rb
-index e6a13d4b8c..8f0cf0b402 100644
---- ruby-2.4.1/lib/rubygems/remote_fetcher.rb
-+++ ruby-2.4.1/lib/rubygems/remote_fetcher.rb
-@@ -110,7 +110,7 @@ def api_endpoint(uri)
-     else
-       target = res.target.to_s.strip
- 
--      if /\.#{Regexp.quote(host)}\z/ =~ target
-+      if URI("http://" + target).host.end_with?(".#{host}")
-         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
-       end
- 
-diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
-index 500f0af768..88e320c05a 100644
---- ruby-2.4.1/lib/rubygems/specification.rb
-+++ ruby-2.4.1/lib/rubygems/specification.rb
-@@ -108,6 +108,8 @@ class Gem::Specification < Gem::BasicSpecification
- 
-   private_constant :LOAD_CACHE if defined? private_constant
- 
-+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:
-+
-   # :startdoc:
- 
-   ##
-@@ -2671,9 +2673,15 @@ def validate packaging = true
-       end
-     end
- 
--    unless String === name then
-+    if !name.is_a?(String) then
-       raise Gem::InvalidSpecificationException,
--            "invalid value for attribute name: \"#{name.inspect}\""
-+            "invalid value for attribute name: \"#{name.inspect}\" must be a string"
-+    elsif name !~ /[a-zA-Z]/ then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} must include at least one letter"
-+    elsif name !~ VALID_NAME_PATTERN then
-+      raise Gem::InvalidSpecificationException,
-+            "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"
-     end
- 
-     if raw_require_paths.empty? then
-diff --git lib/rubygems/text.rb lib/rubygems/text.rb
-index 732f1b99f2..b944b62c27 100644
---- ruby-2.4.1/lib/rubygems/text.rb
-+++ ruby-2.4.1/lib/rubygems/text.rb
-@@ -6,13 +6,26 @@
- 
- module Gem::Text
- 
-+  ##
-+  # Remove any non-printable characters and make the text suitable for
-+  # printing.
-+  def clean_text(text)
-+    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)
-+  end
-+
-+  def truncate_text(text, description, max_length = 100_000)
-+    raise ArgumentError, "max_length must be positive" unless max_length > 0
-+    return text if text.size <= max_length
-+    "Truncating #{description} to #{max_length.to_s.reverse.gsub(/...(?=.)/,'\&,').reverse} characters:\n" + text[0, max_length]
-+  end
-+
-   ##
-   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+
-   # characters
- 
-   def format_text(text, wrap, indent=0)
-     result = []
--    work = text.dup
-+    work = clean_text(text)
- 
-     while work.length > wrap do
-       if work =~ /^(.{0,#{wrap}})[ \n]/ then
-diff --git test/rubygems/test_gem_commands_query_command.rb test/rubygems/test_gem_commands_query_command.rb
-index d8d682b136..469223c6c0 100644
---- ruby-2.4.1/test/rubygems/test_gem_commands_query_command.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_commands_query_command.rb
-@@ -116,6 +116,86 @@ def test_execute_details
-     This is a lot of text. This is a lot of text. This is a lot of text.
-     This is a lot of text.
- 
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_cleans_text
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 4
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    This is a lot of text. This is a lot of text. This is a lot of text.
-+    This is a lot of text.
-+
-+pl (1)
-+    Platform: i386-linux
-+    Author: A User
-+    Homepage: http://example.com
-+
-+    this is a summary
-+    EOF
-+
-+    assert_equal expected, @ui.output
-+    assert_equal '', @ui.error
-+  end
-+
-+  def test_execute_details_truncates_summary
-+    spec_fetcher do |fetcher|
-+      fetcher.spec 'a', 2 do |s|
-+        s.summary = 'This is a lot of text. ' * 10_000
-+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
-+        s.homepage = "http://a.example.com/\x03"
-+      end
-+
-+      fetcher.legacy_platform
-+    end
-+
-+    @cmd.handle_options %w[-r -d]
-+
-+    use_ui @ui do
-+      @cmd.execute
-+    end
-+
-+    expected = <<-EOF
-+
-+*** REMOTE GEMS ***
-+
-+a (2)
-+    Authors: Abraham Lincoln ., . Hirohito
-+    Homepage: http://a.example.com/.
-+
-+    Truncating the summary for a-2 to 100,000 characters:
-+#{"    This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449}    This is a lot of te
-+
- pl (1)
-     Platform: i386-linux
-     Author: A User
-diff --git test/rubygems/test_gem_installer.rb test/rubygems/test_gem_installer.rb
-index 882981d344..dd049214fb 100644
---- ruby-2.4.1/test/rubygems/test_gem_installer.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_installer.rb
-@@ -1448,6 +1448,26 @@ def test_pre_install_checks_wrong_rubygems_version
-     end
-   end
- 
-+  def test_pre_install_checks_malicious_name
-+    spec = util_spec '../malicious', '1'
-+    def spec.full_name # so the spec is buildable
-+      "malicious-1"
-+    end
-+    def spec.validate; end
-+
-+    util_build_gem spec
-+
-+    gem = File.join(@gemhome, 'cache', spec.file_name)
-+
-+    use_ui @ui do
-+      @installer = Gem::Installer.at gem
-+      e = assert_raises Gem::InstallError do
-+        @installer.pre_install_checks
-+      end
-+      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message
-+    end
-+  end
-+
-   def test_shebang
-     util_make_exec @spec, "#!/usr/bin/ruby"
- 
-diff --git test/rubygems/test_gem_remote_fetcher.rb test/rubygems/test_gem_remote_fetcher.rb
-index cb994462cd..fbb7d89019 100644
---- ruby-2.4.1/test/rubygems/test_gem_remote_fetcher.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_remote_fetcher.rb
-@@ -241,6 +241,21 @@ def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
-     dns.verify
-   end
- 
-+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original_in_path
-+    uri = URI.parse "http://example.com/foo"
-+    target = MiniTest::Mock.new
-+    target.expect :target, "evil.com/a.example.com"
-+
-+    dns = MiniTest::Mock.new
-+    dns.expect :getresource, target, [String, Object]
-+
-+    fetch = Gem::RemoteFetcher.new nil, dns
-+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
-+
-+    target.verify
-+    dns.verify
-+  end
-+
-   def test_api_endpoint_timeout_warning
-     uri = URI.parse "http://gems.example.com/foo"
- 
-diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb
-index d43289d745..0fcc11e78f 100644
---- ruby-2.4.1/test/rubygems/test_gem_specification.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_specification.rb
-@@ -2985,7 +2985,37 @@ def test_validate_name
-       @a1.validate
-     end
- 
--    assert_equal 'invalid value for attribute name: ":json"', e.message
-+    assert_equal 'invalid value for attribute name: ":json" must be a string', e.message
-+
-+    @a1.name = []
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"[]\" must be a string", e.message
-+
-+    @a1.name = ""
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\" must include at least one letter", e.message
-+
-+    @a1.name = "12345"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"12345\" must include at least one letter", e.message
-+
-+    @a1.name = "../malicious"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"../malicious\" can only include letters, numbers, dashes, and underscores", e.message
-+
-+    @a1.name = "\ba\t"
-+    e = assert_raises Gem::InvalidSpecificationException do
-+      @a1.validate
-+    end
-+    assert_equal "invalid value for attribute name: \"\\ba\\t\" can only include letters, numbers, dashes, and underscores", e.message
-   end
- 
-   def test_validate_non_nil
-diff --git test/rubygems/test_gem_text.rb test/rubygems/test_gem_text.rb
-index a6e22e04da..04f3f605e8 100644
---- ruby-2.4.1/test/rubygems/test_gem_text.rb
-+++ ruby-2.4.1/test/rubygems/test_gem_text.rb
-@@ -36,6 +36,10 @@ def test_format_text_trailing # for two spaces after .
-     assert_equal expected, format_text(text, 78)
-   end
- 
-+  def test_format_removes_nonprintable_characters
-+    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)
-+  end
-+
-   def test_min3
-     assert_equal 1, min3(1, 1, 1)
-     assert_equal 1, min3(1, 1, 2)
-@@ -74,4 +78,11 @@ def test_levenshtein_distance_replace
-     assert_equal 7, levenshtein_distance("xxxxxxx", "ZenTest")
-     assert_equal 7, levenshtein_distance("zentest", "xxxxxxx")
-   end
-+
-+  def test_truncate_text
-+    assert_equal "abc", truncate_text("abc", "desc")
-+    assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2)
-+    s = "ab" * 500_001
-+    assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
-+  end
- end
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index 249f478f96..09d6798177 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -1311,6 +1311,34 @@ the context the subroutine would have seen if it were the last statement in
 the caller.")
     (license (package-license perl))))
 
+(define-public perl-convert-binhex
+  (package
+    (name "perl-convert-binhex")
+    (version "1.125")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/S/ST/STEPHEN/Convert-BinHex-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "15v3489k179cx0fz3lix79ssjid0nhhpf6c33swpxga6pss92dai"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-file-slurp" ,perl-file-slurp)
+       ("perl-test-most" ,perl-test-most)))
+    (home-page
+     "http://search.cpan.org/dist/Convert-BinHex")
+    (synopsis "Extract data from Macintosh BinHex files")
+    (description
+     "BinHex is a format for transporting files safely through electronic
+mail, as short-lined, 7-bit, semi-compressed data streams.  Ths module
+provides a means of converting those data streams back into into binary
+data.")
+    (license perl-license)))
+
 (define-public perl-cpan-meta-check
   (package
     (name "perl-cpan-meta-check")
@@ -1588,6 +1616,49 @@ on one page.  This results in wanting to page through various pages of data.
 The maths behind this is unfortunately fiddly, hence this module.")
     (license (package-license perl))))
 
+(define-public perl-data-perl
+  (package
+    (name "perl-data-perl")
+    (version "0.002009")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/M/MA/MATTP/Data-Perl-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "12vgqdjbfqf2qfg21x22wg88xnwxfbw2ki3qzcb3nb0chwjj4axn"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-deep" ,perl-test-deep)
+       ("perl-test-fatal" ,perl-test-fatal)
+       ("perl-test-output" ,perl-test-output)))
+    (inputs
+     `(("perl-class-method-modifiers"
+        ,perl-class-method-modifiers)
+       ("perl-module-runtime" ,perl-module-runtime)
+       ("perl-role-tiny" ,perl-role-tiny)
+       ("perl-strictures" ,perl-strictures)))
+    (propagated-inputs
+     `(("perl-list-moreutils" ,perl-list-moreutils)))
+    (home-page
+     "http://search.cpan.org/dist/Data-Perl")
+    (synopsis "Base classes wrapping fundamental Perl data types")
+    (description
+     "@code{Data::Perl} is a container class for the following classes:
+@itemize
+@item @code{Data::Perl::Collection::Hash}
+@item @code{Data::Perl::Collection::Array}
+@item @code{Data::Perl::String}
+@item @code{Data::Perl::Number}
+@item @code{Data::Perl::Counter}
+@item @code{Data::Perl::Bool}
+@item @code{Data::Perl::Code}
+@end itemize")
+    (license perl-license)))
+
 (define-public perl-data-stag
   (package
     (name "perl-data-stag")
@@ -2260,6 +2331,30 @@ whether a compiler is available.  It can test for a C99 compiler, or
 you can tell it to compile a C source file with optional linker flags.")
   (license (package-license perl))))
 
+(define-public perl-devel-cycle
+  (package
+    (name "perl-devel-cycle")
+    (version "1.12")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/L/LD/LDS/Devel-Cycle-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1hhb77kz3dys8yaik452j22cm3510zald2mpvfyv5clqv326aczx"))))
+    (build-system perl-build-system)
+    (home-page
+     "http://search.cpan.org/dist/Devel-Cycle")
+    (synopsis "Find memory cycles in objects")
+    (description
+     "@code{Devel::Cycle} This is a tool for finding circular references in
+objects and other types of references.  Because of Perl's reference-count
+based memory management, circular references will cause memory leaks.")
+    (license perl-license)))
+
 (define-public perl-devel-globaldestruction
   (package
     (name "perl-devel-globaldestruction")
@@ -4134,6 +4229,51 @@ implementation of these functions only serves as a fallback in case the C
 portions of this module couldn't be compiled on this machine.")
     (license (package-license perl))))
 
+(define-public perl-mailtools
+  (package
+    (name "perl-mailtools")
+    (version "2.19")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/M/MA/MARKOV/MailTools-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "06jykkv8mp484vzkmwd6dkicx029rl3ir5ljzrbap3paxw1dfzn1"))))
+    (build-system perl-build-system)
+    (propagated-inputs
+     `(("perl-timedate" ,perl-timedate)))
+    (home-page
+     "http://search.cpan.org/dist/MailTools")
+    (synopsis "Bundle of ancient email modules")
+    (description "MailTools contains the following modules:
+@table @asis
+@item Mail::Address
+Parse email address from a header line.
+@item Mail::Cap
+Interpret mailcap files: mappings of file-types to applications as used by
+many command-line email programs.
+@item Mail::Field
+Simplifies access to (some) email header fields.  Used by Mail::Header.
+@item Mail::Filter
+Process Mail::Internet messages.
+@item Mail::Header
+Collection of Mail::Field objects, representing the header of a Mail::Internet
+object.
+@item Mail::Internet
+Represents a single email message, with header and body.
+@item Mail::Mailer
+Send Mail::Internet emails via direct smtp or local MTA's.
+@item Mail::Send
+Build a Mail::Internet object, and then send it out using Mail::Mailer.
+@item Mail::Util
+\"Smart functions\" you should not depend on.
+@end table")
+    (license perl-license)))
+
 (define-public perl-memoize-expirelru
   (package
     (name "perl-memoize-expirelru")
@@ -4173,6 +4313,36 @@ the argument to the CACHESIZE parameter, will be cached.")
 MIME messages on Internet.")
     (license (package-license perl))))
 
+(define-public perl-mime-tools
+  (package
+    (name "perl-mime-tools")
+    (version "5.509")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/D/DS/DSKOLL/MIME-tools-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "0wv9rzx5j1wjm01c3dg48qk9wlbm6iyf91j536idk09xj869ymv4"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-deep" ,perl-test-deep)))
+    (inputs
+     `(("perl-convert-binhex" ,perl-convert-binhex)))
+    (propagated-inputs
+     `(("perl-mailtools" ,perl-mailtools)))
+    (home-page
+     "http://search.cpan.org/dist/MIME-tools")
+    (synopsis "Tools to manipulate MIME messages")
+    (description
+     "MIME-tools is a collection of Perl5 MIME:: modules for parsing,
+decoding, and generating single- or multipart (even nested multipart) MIME
+messages.")
+    (license perl-license)))
+
 (define-public perl-mime-types
   (package
     (name "perl-mime-types")
@@ -5073,6 +5243,109 @@ all coercions and constraints are inherited.")
 constraint with coercion to load the class.")
     (license (package-license perl))))
 
+(define-public perl-moox
+  (package
+    (name "perl-moox")
+    (version "0.101")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/G/GE/GETTY/MooX-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1m9jvrqcidiabdih211byadwnnkygafq54r2ljnf1akqdrjimy9g"))))
+    (build-system perl-build-system)
+    (inputs
+     `(("perl-data-optlist" ,perl-data-optlist)
+       ("perl-import-into" ,perl-import-into)
+       ("perl-module-runtime" ,perl-module-runtime)
+       ("perl-moo" ,perl-moo)))
+    (home-page "http://search.cpan.org/dist/MooX")
+    (synopsis
+     "Using Moo and MooX:: packages the most lazy way")
+    (description "Contains the MooX and MooX::Role packages.")
+    (license perl-license)))
+
+(define-public perl-moox-handlesvia
+  (package
+    (name "perl-moox-handlesvia")
+    (version "0.001008")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/M/MA/MATTP/MooX-HandlesVia-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "137yrjn2jmw4cj0fjdajnkjgqr5arnpq72kbm6w66xskncinz55h"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-moox-types-mooselike"
+        ,perl-moox-types-mooselike)
+       ("perl-test-exception" ,perl-test-exception)
+       ("perl-test-fatal" ,perl-test-fatal)))
+    (inputs
+     `(("perl-class-method-modifiers"
+        ,perl-class-method-modifiers)
+       ("perl-module-runtime" ,perl-module-runtime)
+       ("perl-moo" ,perl-moo)
+       ("perl-role-tiny" ,perl-role-tiny)))
+    (propagated-inputs
+     `(("perl-data-perl" ,perl-data-perl)))
+    (home-page
+     "http://search.cpan.org/dist/MooX-HandlesVia")
+    (synopsis "NativeTrait-like behavior for Moo")
+    (description
+     "@code{MooX::HandlesVia} is an extension of Moo's @code{handles}
+attribute functionality.  It provides a means of proxying functionality from
+an external class to the given atttribute.")
+    (license perl-license)))
+
+(define-public perl-moox-late
+  (package
+    (name "perl-moox-late")
+    (version "0.015")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/T/TO/TOBYINK/MooX-late-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1gzvd9zws3v09sh0xx6srmw4jwi22fnrya4zcsc8dykn62pjclqp"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-fatal" ,perl-test-fatal)
+       ("perl-test-requires" ,perl-test-requires)))
+    (inputs
+     `(("perl-moo" ,perl-moo)
+       ("perl-moox" ,perl-moox)
+       ("perl-moox-handlesvia" ,perl-moox-handlesvia)))
+    (propagated-inputs
+     `(("perl-type-tiny" ,perl-type-tiny)))
+    (home-page
+     "http://search.cpan.org/dist/MooX-late")
+    (synopsis "Easily translate Moose code to Moo")
+    (description
+     "MooX::late does the following:
+@enumerate
+@item Supports isa => $stringytype
+@item Supports does => $rolename
+@item Supports lazy_build => 1
+@item Exports blessed and confess functions to your namespace.
+@item Handles certain attribute traits
+Currently Hash, Array and Code are supported.  This feature requires
+MooX::HandlesVia.
+@end enumerate")
+    (license perl-license)))
+
 (define-public perl-moox-types-mooselike
   (package
     (name "perl-moox-types-mooselike")
@@ -5252,6 +5525,38 @@ cycle.  Functions called in the package itself will still be bound by their
 name, but they won't show up as methods on your class or instances.")
     (license (package-license perl))))
 
+(define-public perl-net-idn-encode
+  (package
+    (name "perl-net-idn-encode")
+    (version "2.400")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/C/CF/CFAERBER/Net-IDN-Encode-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "0a9knav5f9kjldrkxx1k47ivd3p23zkmi8aqgyhnxidhgasz1dlq"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-module-build" ,perl-module-build)
+       ("perl-test-nowarnings" ,perl-test-nowarnings)))
+    (home-page
+     "http://search.cpan.org/dist/Net-IDN-Encode")
+    (synopsis
+     "Internationalizing Domain Names in Applications (IDNA)")
+    (description
+     "Internationalized Domain Names (IDNs) use characters drawn from a large
+repertoire (Unicode), but IDNA allows the non-ASCII characters to be
+represented using only the ASCII characters already allowed in so-called host
+names today (letter-digit-hyphen, /[A-Z0-9-]/i).
+
+Use this module if you just want to convert domain names (or email addresses),
+using whatever IDNA standard is the best choice at the moment.")
+    (license perl-license)))
+
 (define-public perl-net-statsd
   (package
    (name "perl-net-statsd")
@@ -6775,6 +7080,61 @@ namespace::autoclean or namespace::clean and are therefore available to be
 called as methods, which usually isn't want you want.")
     (license (package-license perl))))
 
+(define-public perl-test-cpan-meta
+  (package
+    (name "perl-test-cpan-meta")
+    (version "0.25")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/B/BA/BARBIE/Test-CPAN-Meta-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1dcdbbdwdyhpldkhjzc9rvzlmb5jbil6fwh2x07nsfdwysf4ynzm"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-cpan-meta-json" ,perl-test-cpan-meta-json)
+       ("perl-test-pod" ,perl-test-pod)
+       ("perl-test-pod-coverage" ,perl-test-pod-coverage)))
+    (home-page
+     "http://search.cpan.org/dist/Test-CPAN-Meta")
+    (synopsis "Validate your CPAN META.yml files")
+    (description
+     "This module was written to ensure that a META.yml file meets the
+specification.")
+    (license artistic2.0)))
+
+(define-public perl-test-cpan-meta-json
+  (package
+    (name "perl-test-cpan-meta-json")
+    (version "0.16")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/B/BA/BARBIE/Test-CPAN-Meta-JSON-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1jg9ka50ixwq083wd4k12rhdjq87w0ihb34gd8jjn7gvvyd51b37"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-pod" ,perl-test-pod)
+       ("perl-test-pod-coverage" ,perl-test-pod-coverage)))
+    (inputs
+     `(("perl-json" ,perl-json)))
+    (home-page
+     "http://search.cpan.org/dist/Test-CPAN-Meta-JSON")
+    (synopsis "Validate your CPAN META.json files")
+    (description
+     "This module was written to ensure that a META.json file meets the
+specification.")
+    (license artistic2.0)))
+
 (define-public perl-test-deep
   (package
     (name "perl-test-deep")
@@ -6848,6 +7208,30 @@ modified or tested with this API, making it simple to test both individual
 files, as well as to verify that there are no missing or unknown files.")
     (license (package-license perl))))
 
+(define-public perl-test-eol
+  (package
+    (name "perl-test-eol")
+    (version "2.00")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/E/ET/ETHER/Test-EOL-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "0l3bxpsw0x7j9nclizcp53mnf9wny25dmg2iglfhzgnk0xfpwzwf"))))
+    (build-system perl-build-system)
+    (home-page
+     "http://search.cpan.org/dist/Test-EOL")
+    (synopsis
+     "Check the correct line endings in your project")
+    (description
+     "@code{Test::EOL} lets you check for the presence of trailing whitespace
+and/or windows line endings in your perl code.")
+    (license perl-license)))
+
 (define-public perl-test-exception
   (package
     (name "perl-test-exception")
@@ -7037,6 +7421,42 @@ file to find out which tests you want to run and the order in which you want to
 It constructs the right value for the build system to do the right thing.")
     (license (package-license perl))))
 
+(define-public perl-test-memory-cycle
+  (package
+    (name "perl-test-memory-cycle")
+    (version "1.06")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/P/PE/PETDANCE/Test-Memory-Cycle-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "00ijmgx1r3cxrcs1qa9rb2s4gbm3nsawd90drda89kb4r7yxslwx"))))
+    (build-system perl-build-system)
+    (inputs
+     `(("perl-padwalker" ,perl-padwalker)))
+    (propagated-inputs
+     `(("perl-devel-cycle" ,perl-devel-cycle)))
+    (home-page
+     "http://search.cpan.org/dist/Test-Memory-Cycle")
+    (synopsis
+     "Verifies code hasn't left circular references")
+    (description
+     "@code{Test::Memory::Cycle} is built on top of @code{Devel::Cycle} to
+give you an easy way to check for these circular references.
+
+@example
+use Test::Memory::Cycle;
+
+my $object = new MyObject;
+# Do stuff with the object.
+memory_cycle_ok( $object );
+@end example")
+    (license artistic2.0)))
+
 (define-public perl-test-mockobject
   (package
     (name "perl-test-mockobject")
@@ -7142,6 +7562,30 @@ with an error rather than skip.
 If used in a subtest, the remainder of the subtest will be skipped.")
     (license (package-license perl))))
 
+(define-public perl-test-notabs
+  (package
+    (name "perl-test-notabs")
+    (version "2.00")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/E/ET/ETHER/Test-NoTabs-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "127kpl1va267qar2ia4c22xb96jby2jqnda3sj5pjgmxg8si26cg"))))
+    (build-system perl-build-system)
+    (home-page
+     "http://search.cpan.org/dist/Test-NoTabs")
+    (synopsis
+     "Check the presence of tabs in your project")
+    (description
+     "@code{Test::NoTabs} lets you check the presence of tabs in your perl
+code.")
+    (license perl-license)))
+
 (define-public perl-test-nowarnings
   (package
     (name "perl-test-nowarnings")
@@ -7732,6 +8176,32 @@ algorism to indicate multiplication by 1000.")
     (description "Text::Table renders plaintext tables.")
     (license x11)))
 
+(define-public perl-text-template
+  (package
+    (name "perl-text-template")
+    (version "1.47")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/M/MS/MSCHOUT/Text-Template-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1z781cgz7wbn80lf3kqr2ad0pg6g1wlnim0822h8liw28k3l5msh"))))
+    (build-system perl-build-system)
+    (home-page
+     "http://search.cpan.org/dist/Text-Template")
+    (synopsis
+     "Expand template text with embedded Perl")
+    (description
+     "This is a library for generating letters, building HTML pages, or
+filling in templates generally.  A template is a piece of text that has little
+Perl programs embedded in it here and there.  When you fill in a template, you
+evaluate the little programs and replace them with their values.")
+    (license perl-license)))
+
 (define-public perl-text-unidecode
   (package
     (name "perl-text-unidecode")
@@ -8366,6 +8836,30 @@ neither visible nor modifiable from Perl space).")
 on the YAML 1.0 specification.")
     (license (package-license perl))))
 
+(define-public perl-yaml-libyaml
+  (package
+    (name "perl-yaml-libyaml")
+    (version "0.65")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/T/TI/TINITA/YAML-LibYAML-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "0izhvz8f29x1f50hhwfgm0iq1lz7apjjvg77lmky949jr07hnwfv"))))
+    (build-system perl-build-system)
+    (home-page
+     "http://search.cpan.org/dist/YAML-LibYAML")
+    (synopsis
+     "Perl YAML Serialization using XS and libyaml")
+    (description
+     "@code{YAML::XS} is a Perl XS binding to libyaml which offers Perl the
+best YAML support to date.")
+    (license perl-license)))
+
 (define-public perl-yaml-tiny
   (package
     (name "perl-yaml-tiny")
diff --git a/gnu/packages/photo.scm b/gnu/packages/photo.scm
index 2378acd975..f5e43af4f4 100644
--- a/gnu/packages/photo.scm
+++ b/gnu/packages/photo.scm
@@ -65,14 +65,14 @@
 (define-public libraw
   (package
     (name "libraw")
-    (version "0.18.2")
+    (version "0.18.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.libraw.org/data/LibRaw-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1imby9x88pjx4ad1frdi3bfb8dw90ccyj5pb6w3i6i0iijrnndnf"))))
+                "15qc7g5y1m6yi6w9ia79cd6yk0836z7lqw5yigl62n768qdr7x7a"))))
     (build-system gnu-build-system)
     (home-page "https://www.libraw.org")
     (synopsis "Raw image decoder")
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 346faf434c..223a308fb4 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -12,7 +12,7 @@
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
 ;;; Copyright © 2015, 2016 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015, 2016, 2017 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2015 Ben Woodcroft <donttrustben@gmail.com>
+;;; Copyright © 2015, 2017 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2015, 2016 Erik Edrosa <erik.edrosa@gmail.com>
 ;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2015 Kyle Meyer <kyle@kyleam.com>
@@ -80,6 +80,7 @@
   #:use-module (gnu packages gl)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages graphviz)
+  #:use-module (gnu packages graphics)
   #:use-module (gnu packages gstreamer)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages icu4c)
@@ -1249,6 +1250,33 @@ datetime module, available in Python 2.3+.")
 (define-public python2-parsedatetime
   (package-with-python2 python-parsedatetime))
 
+(define-public python-schedule
+  (package
+    (name "python-schedule")
+    (version "0.4.3")
+    (source
+     (origin
+      (method url-fetch)
+      (uri (pypi-uri "schedule" version))
+      (sha256
+       (base32
+        "0vplyjcbfrq50sphlwya749z8p2pcyi2nycw3518i0qpd9a6189i"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)
+       ("python-mock" ,python-mock)))
+    (home-page "https://github.com/dbader/schedule")
+    (synopsis "Schedule periodic function calls in Python")
+    (description
+     "Schedule is an in-process scheduler for periodic jobs that uses the
+builder pattern for configuration.  Schedule lets you run Python functions (or
+any other callable) periodically at pre-determined intervals using a simple,
+human-friendly syntax.")
+    (license license:expat)))
+
+(define-public python2-schedule
+  (package-with-python2 python-schedule))
+
 (define-public python-pandas
   (package
     (name "python-pandas")
@@ -2836,14 +2864,14 @@ somewhat intelligeble.")
 (define-public python-pyjwt
   (package
     (name "python-pyjwt")
-    (version "1.5.2")
+    (version "1.5.3")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "PyJWT" version))
        (sha256
         (base32
-         "0pvr3iymab7v2qz74ann760z7qahqgqszxz5iqqbaqv4z2zz0y8i"))
+         "1rxsg14i33vm2i6lz0my628108c81k43v10n4h3p0gx62xdyf2sh"))
        (modules '((guix build utils)))
        (snippet
         '(begin
@@ -3188,14 +3216,14 @@ reStructuredText.")
 (define-public python-pygments
   (package
     (name "python-pygments")
-    (version "2.1.3")
+    (version "2.2.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "Pygments" version))
        (sha256
         (base32
-         "10axnp2wpjnq9g8wg53fx0c70dfxqrz498jyz8mrdx9a3flwir48"))))
+         "1k78qdvir1yb1c634nkv6rbga8wv4289xarghmsbbvzhvr311bnv"))))
     (build-system python-build-system)
     (arguments
      ;; FIXME: Tests require sphinx, which depends on this.
@@ -5976,6 +6004,37 @@ and written in Python.")
 (define-public python2-html5lib-0.9
   (package-with-python2 python-html5lib-0.9))
 
+(define-public python-html5-parser
+  (package
+    (name "python-html5-parser")
+    (version "0.4.4")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "html5-parser" version))
+              (sha256
+               (base32
+                "1d8sxhl41ffh7qlk7wlsy17xw6slzx5v1yna9s72wx5qrpaa3wxr"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("libxml2" ,libxml2)))
+    (propagated-inputs
+     `(("python-lxml" ,python-lxml)
+       ("python-beautifulsoup4" ,python-beautifulsoup4)))
+    (home-page "https://html5-parser.readthedocs.io")
+    (synopsis "Fast C-based HTML5 parsing for Python")
+    (description "This package provides a fast implementation of the HTML5
+parsing spec for Python.  Parsing is done in C using a variant of the gumbo
+parser.  The gumbo parse tree is then transformed into an lxml tree, also in
+C, yielding parse times that can be a thirtieth of the html5lib parse times.")
+    ;; src/as-python-tree.[c|h] are licensed GPL3.  The other files
+    ;; indicate ASL2.0, including the LICENSE file for the whole project.
+    (license (list license:asl2.0 license:gpl3))))
+
+(define-public python2-html5-parser
+  (package-with-python2 python-html5-parser))
+
 (define-public python-webencodings
   (package
     (name "python-webencodings")
@@ -6206,6 +6265,16 @@ implementation of D-Bus.")
     (arguments
      `(#:phases
        (modify-phases %standard-phases
+         (replace 'build
+           (lambda _
+             (zero?
+              (system* "python" "setup.py" "build" "--enable-all-extensions"))))
+         (add-after 'build 'build-test-helper
+           (lambda _
+             (zero?
+              (system
+               (string-append "gcc -fPIC -shared -o ./testextension.sqlext "
+                              "-I. -Isqlite3 src/testextension.c") ))))
          (delete 'check)
          (add-after 'install 'check
            (lambda* (#:key inputs outputs #:allow-other-keys)
@@ -6225,14 +6294,14 @@ translate the complete SQLite API into Python.")
 (define-public python-lxml
   (package
     (name "python-lxml")
-    (version "3.6.0")
+    (version "3.8.0")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "lxml" version))
         (sha256
          (base32
-          "1pvbmiy2m7jwv493kilbghhj2pkh8wy1na3ji350vhzhlwlclx4w"))))
+          "15nvf6n285n282682qyw3wihsncb0x5amdhyi4b83bfa2nz74vvk"))))
     (build-system python-build-system)
     (inputs
       `(("libxml2" ,libxml2)
@@ -7911,14 +7980,14 @@ message digests and key derivation functions.")
 (define-public python-pyopenssl
   (package
     (name "python-pyopenssl")
-    (version "17.2.0")
+    (version "17.3.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyOpenSSL" version))
        (sha256
         (base32
-         "0d283g4zi0hr9papd24mjl70mi15gyzq6fx618rizi87dgipqqax"))))
+         "0xkc1wfnpg6abzllivg3ylhc63npjdy1v81f4kc08bm8cj80nqr9"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
@@ -9855,14 +9924,14 @@ Pytest but stripped of Pytest specific details.")
 (define-public python-tox
   (package
    (name "python-tox")
-   (version "2.3.1")
+   (version "2.8.0")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "tox" version))
      (sha256
       (base32
-       "1vj73ar4rimq3fwy5r2z3jv4g9qbh8rmpmncsc00g0k310acqzxz"))))
+       "00lrql2cfzhb712v70inac6mrgdv8s8fmvz7qpggkk623hkm2pgc"))))
    (build-system python-build-system)
    (arguments
     ;; FIXME: Tests require pytest-timeout, which itself requires
@@ -9874,7 +9943,8 @@ Pytest but stripped of Pytest specific details.")
       ("python-virtualenv" ,python-virtualenv)))
    (native-inputs
     `(; FIXME: Missing: ("python-pytest-timeout" ,python-pytest-timeout)
-      ("python-pytest" ,python-pytest)))  ; >= 2.3.5
+      ("python-pytest" ,python-pytest)  ; >= 2.3.5
+      ("python-setuptools-scm" ,python-setuptools-scm)))
    (home-page "http://tox.testrun.org/")
    (synopsis "Virtualenv-based automation of test activities")
    (description "Tox is a generic virtualenv management and test command line
@@ -9914,14 +9984,14 @@ document.")
 (define-public python-botocore
   (package
    (name "python-botocore")
-   (version "1.5.26")
+   (version "1.7.9")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "botocore" version))
      (sha256
       (base32
-       "1b7l48hr88galrrc5q6k21z3sdadzxc87ppzs7k9fz4p1w8bfnvb"))))
+       "02b1bw25r1wdjs5yppb1h9igf11wj092biriv2yg8hzp5r0wrkmg"))))
    (build-system python-build-system)
    (arguments
     ;; FIXME: Many tests are failing.
@@ -9948,14 +10018,14 @@ interface to the Amazon Web Services (AWS) API.")
 (define-public awscli
   (package
    (name "awscli")
-   (version "1.11.63")
+   (version "1.11.151")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri name version))
      (sha256
       (base32
-       "1r8aqv8w27k76lcsfk83w6qw9lz8gk2ibzwacp5wjhpp2gik911m"))))
+       "0h6rirbfy0f9cxm7ikll0kr720dircfmxf2vslmhn4n325831wsp"))))
    (build-system python-build-system)
    (propagated-inputs
     `(("python-colorama" ,python-colorama)
@@ -11914,20 +11984,22 @@ Wikipedia code samples at
 (define-public python-cleo
   (package
     (name "python-cleo")
-    (version "0.4.1")
+    (version "0.6.1")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "cleo" version))
               (sha256
                (base32
-                "1k2dcl6mqpn5bljyl6w42rqyd9mb3y9kh2mg7m2x3kfjwvg0rpva"))))
+                "0q1cf0szr0d54am4pypzwdnm74zpladdsinad94c2fz5i06fdpf7"))))
     (build-system python-build-system)
     (native-inputs
      `(;; For testing
        ("python-mock" ,python-mock)
+       ("python-pytest-mock" ,python-pytest-mock)
        ("python-pytest" ,python-pytest)))
     (propagated-inputs
-     `(("python-psutil" ,python-psutil)
+     `(("python-backpack" ,python-backpack)
+       ("python-pastel" ,python-pastel)
        ("python-pylev" ,python-pylev)))
     (home-page "https://github.com/sdispater/cleo")
     (synopsis "Command-line arguments library for Python")
@@ -12088,13 +12160,13 @@ addresses, and phone numbers.")
 (define-public python-pyaml
   (package
     (name "python-pyaml")
-    (version "15.8.2")
+    (version "17.7.2")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "pyaml" version))
               (sha256
                (base32
-                "1f5m28vkh4ksq3d80d8mmd2z8wxvc3mgy2pmrv2751dm2xgznm4w"))))
+                "132grrw0ajq4nrappi3ldbkb952k7yn9b6c7csi2rmvzm1g6ppp2"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-unidecode" ,python-unidecode)))
@@ -12110,6 +12182,32 @@ YAML-serialized data.")
 (define-public python2-pyaml
   (package-with-python2 python-pyaml))
 
+(define-public python-backpack
+  (package
+    (name "python-backpack")
+    (version "0.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "backpack" version))
+       (sha256
+        (base32
+         "14rq1mvm0jda90lcx9gyyby9dvq4x3js2cmxvd6vl4686ixwyqh1"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)
+       ("python-nose" ,python-nose)))
+    (propagated-inputs
+     `(("python-simplejson" ,python-simplejson)))
+    (home-page "https://github.com/sdispater/backpack")
+    (synopsis "Utilities for working with Python collections")
+    (description "Backpack provides some useful utilities for working with
+collections of data.")
+    (license license:expat)))
+
+(define-public python2-backpack
+  (package-with-python2 python-backpack))
+
 (define-public python-flexmock
   (package
     (name "python-flexmock")
@@ -12131,44 +12229,6 @@ mocks, stubs and fakes.")
 (define-public python2-flexmock
   (package-with-python2 python-flexmock))
 
-(define-public python-orator
-  (package
-    (name "python-orator")
-    (version "0.8.2")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "orator" version))
-              (sha256
-               (base32
-                "1li49irsqha17nrda4nsb48biyy0rarp9pphf0jpqwm5zr8hv569"))))
-    (build-system python-build-system)
-    (arguments '(#:tests? #f)) ; no tests
-    (propagated-inputs
-     `(("python-arrow" ,python-arrow)
-       ("python-blinker" ,python-blinker)
-       ("python-cleo" ,python-cleo)
-       ("python-faker" ,python-faker)
-       ("python-inflection" ,python-inflection)
-       ("python-lazy-object-proxy" ,python-lazy-object-proxy)
-       ("python-pyaml" ,python-pyaml)
-       ("python-simplejson" ,python-simplejson)
-       ("python-wrapt" ,python-wrapt)))
-    (home-page "https://orator-orm.com/")
-    (synopsis "ActiveRecord ORM for Python")
-    (description
-     "Orator provides a simple ActiveRecord-like Object Relational Mapping
-implementation for Python.")
-    (license license:expat)
-    (properties `((python2-variant . ,(delay python2-orator))))))
-
-(define-public python2-orator
-  (let ((base (package-with-python2 (strip-python2-variant python-orator))))
-    (package
-      (inherit base)
-      (propagated-inputs
-       `(("python2-ipaddress" ,python2-ipaddress)
-         ,@(package-propagated-inputs base))))))
-
 (define-public python-prompt-toolkit
  (package
   (name "python-prompt-toolkit")
@@ -13169,16 +13229,40 @@ replay them during future tests.  It is designed to work with python-requests.")
 (define-public python2-betamax
   (package-with-python2 python-betamax))
 
+(define-public python-betamax-matchers
+  (package
+    (name "python-betamax-matchers")
+    (version "0.4.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "betamax-matchers" version))
+       (sha256
+        (base32
+         "07qpwjyq2i2aqhz5iwghnj4pqr2ys5n45v1vmpcfx9r5mhwrsq43"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-betamax" ,python-betamax)
+       ("python-requests-toolbelt" ,python-requests-toolbelt)))
+    (home-page "https://github.com/sigmavirus24/betamax_matchers")
+    (synopsis "VCR imitation for python-requests")
+    (description "@code{betamax-matchers} provides a set of Matchers for
+Betamax.")
+    (license license:asl2.0)))
+
+(define-public python2-betamax-matchers
+  (package-with-python2 python-betamax-matchers))
+
 (define-public python-s3transfer
   (package
     (name "python-s3transfer")
-    (version "0.1.10")
+    (version "0.1.11")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "s3transfer" version))
               (sha256
                (base32
-                "1h8g9bknvxflxkpbnxyfxmk8pvgykbbk9ljdvhqh6z4vjc2926ms"))))
+                "0yfrfnf404cxzn3iswibqjxklsl0b1lwgqiml6pwiqj79a7zbwbn"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -16195,3 +16279,24 @@ ECB and OFB).")
 
 (define-public python2-pyaes
   (package-with-python2 python-pyaes))
+
+(define-public python-uritemplate
+  (package
+    (name "python-uritemplate")
+    (version "3.0.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "uritemplate" version))
+       (sha256
+        (base32
+         "0781gm9g34wa0asc19dx81ng0nqq07igzv3bbvdqmz13pv7469n0"))))
+    (build-system python-build-system)
+    (home-page "https://uritemplate.readthedocs.org")
+    (synopsis "Library to deal with URI Templates")
+    (description "@code{uritemplate} provides Python library to deal with URI
+Templates.")
+    (license license:bsd-2)))
+
+(define-public python2-uritemplate
+  (package-with-python2 python-uritemplate))
diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 6251145f09..80d3bffd84 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -49,7 +49,7 @@
 (define-public ruby
   (package
     (name "ruby")
-    (replacement ruby-2.4.1)
+    (replacement ruby-2.4.2)
     (version "2.4.0")
     (source
      (origin
@@ -103,11 +103,11 @@ a focus on simplicity and productivity.")
     (home-page "https://ruby-lang.org")
     (license license:ruby)))
 
-(define-public ruby-2.4.1
+(define-public ruby-2.4.2
   (package
     (inherit ruby)
     (name "ruby")
-    (version "2.4.1")
+    (version "2.4.2")
     (source
      (origin
        (method url-fetch)
@@ -116,20 +116,17 @@ a focus on simplicity and productivity.")
                            "/ruby-" version ".tar.xz"))
        (sha256
         (base32
-         "0m763zf2v0jhrha3cx21g4dif6vc9gm714invs8h3sg35ncskj2g"))
+         "0dgp4ypk3smrsbh2c249n5pl6nqhpd2igq9484dbsh81sf08k2kl"))
        (modules '((guix build utils)))
        (snippet `(begin
                    ;; Remove bundled libffi
                    (delete-file-recursively "ext/fiddle/libffi-3.2.1")
-                   #t))
-       (patches
-        (search-patches "ruby-rubygems-2612-ruby24.patch"
-                        "ruby-rubygems-2613-ruby24.patch"))))))
+                   #t))))))
 
 (define-public ruby-2.3
   (package
     (inherit ruby)
-    (version "2.3.4")
+    (version "2.3.5")
     (source
      (origin
        (method url-fetch)
@@ -138,9 +135,8 @@ a focus on simplicity and productivity.")
                            "/ruby-" version ".tar.xz"))
        (sha256
         (base32
-         "132p5kc1sx97svbx04g40pz5pr7p8f6jlmnq5r2prlcz5q1xj71l"))
+         "1npzcnq5kh0f9y88w5gj4v6ln8csr91361k3r43dmhlhn6mpsfkx"))
        (modules '((guix build utils)))
-       (patches (search-patches "ruby-2.3.4-rubygems-2613-ruby23.patch"))
        (snippet `(begin
                    ;; Remove bundled libffi
                    (delete-file-recursively "ext/fiddle/libffi-3.2.1")
@@ -148,17 +144,16 @@ a focus on simplicity and productivity.")
 
 (define-public ruby-2.2
   (package (inherit ruby)
-    (version "2.2.7")
+    (version "2.2.8")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://cache.ruby-lang.org/pub/ruby/"
                            (version-major+minor version)
                            "/ruby-" version ".tar.xz"))
-       (patches (search-patches "ruby-2.2.7-rubygems-2613-ruby22.patch"))
        (sha256
         (base32
-         "0lyb7gnbbhs3a3v9grsjgbaixm20wxz6x3h0czyrxnj3cpp8lk13"))))))
+         "1c31slidv2bdnnir3qfmdjs193b5s2ycb9pnf1lc55kk0cazrsip"))))))
 
 (define-public ruby-2.1
   (package (inherit ruby)
@@ -2023,14 +2018,14 @@ extract comments.")
 (define-public ruby-coderay
   (package
     (name "ruby-coderay")
-    (version "1.1.1")
+    (version "1.1.2")
     (source
      (origin
        (method url-fetch)
        (uri (rubygems-uri "coderay" version))
        (sha256
         (base32
-         "1x6z923iwr1hi04k6kz5a6llrixflz8h5sskl9mhaaxy9jx2x93r"))))
+         "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y"))))
     (build-system ruby-build-system)
     (arguments
      '(#:tests? #f)) ; missing test files
@@ -2570,14 +2565,14 @@ you about the changes.")
 (define-public ruby-activesupport
   (package
     (name "ruby-activesupport")
-    (version "5.1.3")
+    (version "5.1.4")
     (source
      (origin
        (method url-fetch)
        (uri (rubygems-uri "activesupport" version))
        (sha256
         (base32
-         "16r18n6b1nlky0xx2lw8c1f15gr2vm34xz5g4byjcxf88m1s07xh"))))
+         "0sgf4rsfr7jcaqsx0wwzx4l4k9xsjlwv0mzl08pxiyp1qzyx8scr"))))
     (build-system ruby-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index 1fc4994ab3..85579b0c0f 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -149,14 +149,14 @@ anywhere.")
 (define-public samba
   (package
     (name "samba")
-    (version "4.6.7")
+    (version "4.6.8")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.samba.org/pub/samba/stable/"
                                  "samba-" version ".tar.gz"))
              (sha256
               (base32
-               "1ynxndfk45zkkylz3jsrx42a7kmm42jddk5bdhihyf88vs9l7wly"))))
+               "0pap686cl0j5c9v1v09krpqdk416x3851fbcap5ysp1zajrfw7aq"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/simulation.scm b/gnu/packages/simulation.scm
new file mode 100644
index 0000000000..cda6f3c567
--- /dev/null
+++ b/gnu/packages/simulation.scm
@@ -0,0 +1,212 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Paul Garlick <pgarlick@tourbillion-technology.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages simulation)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages bash)
+  #:use-module (gnu packages bison)
+  #:use-module (gnu packages boost)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages flex)
+  #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gcc)
+  #:use-module (gnu packages gl)
+  #:use-module (gnu packages graphics)
+  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages m4)
+  #:use-module (gnu packages maths)
+  #:use-module (gnu packages mpi)
+  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages readline)
+  #:use-module (gnu packages tls)
+  #:use-module (gnu packages version-control)
+  #:use-module (gnu packages xml)
+  #:use-module (gnu packages xorg)
+  #:use-module (guix download)
+  #:use-module (guix build utils)
+  #:use-module (guix build-system gnu)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix utils)
+  #:use-module (ice-9 ftw)
+  #:use-module (ice-9 regex)
+  #:use-module (srfi srfi-1))
+
+(define-public openfoam
+  (package
+    (name "openfoam")
+    (version "4.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "http://dl.openfoam.org/source/"
+             (string-map (lambda (x) (if (eq? x #\.) #\- x)) version)))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32 "0cgxh4h2hf50qbvvdg5miwc2nympb0nrv3md96vb3gbs9vk8vq9d"))
+       (patches (search-patches "openfoam-4.1-cleanup.patch"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("boost" ,boost)
+       ("cgal" ,cgal)
+       ("flex" ,flex)
+       ("git" ,git)
+       ("gmp" ,gmp)
+       ("libxt" ,libxt)
+       ("metis" ,metis)
+       ("mpfr" ,mpfr)
+       ("ncurses" ,ncurses)
+       ("readline" ,readline)
+       ("scotch" ,pt-scotch32)
+       ("zlib" ,zlib)))
+    (native-inputs
+     `(("bison" ,bison)))
+    (propagated-inputs
+     `(("gzip" ,gzip)
+       ("gnuplot" ,gnuplot)
+       ("openmpi" ,openmpi)))
+    (arguments
+     `( ;; Executable files and shared libraries are located in the 'platforms'
+       ;; subdirectory.
+       #:strip-directories (list (string-append
+                                  "lib/OpenFOAM-" ,version
+                                  "/platforms/linux64GccDPInt32Opt/bin")
+                                 (string-append
+                                  "lib/OpenFOAM-" ,version
+                                  "/platforms/linux64GccDPInt32Opt/lib"))
+       #:tests? #f                                ; no tests to run
+
+       #:modules ((ice-9 ftw)
+                  (ice-9 regex)
+                  (guix build gnu-build-system)
+                  (guix build utils))
+
+       #:phases (modify-phases %standard-phases
+                  (add-after 'unpack 'rename-build-directory
+                    (lambda _
+                      (chdir "..")
+                      ;; Use 'OpenFOAM-version' convention to match the file
+                      ;; name expectations in the build phase.
+                      (let ((unpack-dir (string-append
+                                         (getcwd) "/"
+                                         (list-ref (scandir (getcwd) (lambda (name)
+                                                                       (string-match "^OpenFOAM" name))) 0)))
+                            (build-dir (string-append
+                                        (getcwd) "/OpenFOAM-" ,version)))
+                        (rename-file unpack-dir build-dir) ; rename build directory
+                        (chdir (basename build-dir))) ; move to build directory
+                      #t))
+                  (delete 'configure)             ; no configure phase
+                  (replace 'build
+                    (lambda _
+                      (let ((libraries '("boost" "cgal" "gmp" "metis" "mpfr" "scotch")))
+                        ;; set variables to define store paths
+                        (for-each (lambda (library)
+                                    (setenv (string-append
+                                             (string-upcase library) "_ROOT")
+                                            (assoc-ref %build-inputs library))) libraries))
+                      ;; set variables to define package versions
+                      (setenv "SCOTCHVERSION" ,(package-version scotch))
+                      (setenv "METISVERSION" ,(package-version metis))
+                      ;; set variable to pass extra 'rpath' arguments to linker
+                      (setenv "LDFLAGS"
+                              (string-append
+                               "-Wl,"
+                               "-rpath=" %output "/lib/OpenFOAM-" ,version
+                               "/platforms/linux64GccDPInt32Opt/lib,"
+                               "-rpath=" %output "/lib/OpenFOAM-" ,version
+                               "/platforms/linux64GccDPInt32Opt/lib/dummy"))
+                      ;; compile OpenFOAM libraries and applications
+                      (zero? (system (format #f
+                                             "source ./etc/bashrc && ./Allwmake -j~a"
+                                             (parallel-job-count))))))
+                  (add-after 'build 'update-configuration-files
+                    (lambda _
+                      ;; record store paths and package versions in
+                      ;; configuration files
+                      (substitute* "etc/config.sh/CGAL"
+                        (("$BOOST_ROOT") (getenv "BOOST_ROOT")))
+                      (substitute* "etc/config.sh/CGAL"
+                        (("$CGAL_ROOT") (getenv "CGAL_ROOT")))
+                      (substitute* "etc/config.sh/metis"
+                        (("$METIS_ROOT") (getenv "METIS_ROOT")))
+                      (substitute* "etc/config.sh/metis"
+                        (("$METISVERSION") (getenv "METISVERSION")))
+                      (substitute* "etc/config.sh/scotch"
+                        (("$SCOTCH_ROOT") (getenv "SCOTCH_ROOT")))
+                      (substitute* "etc/config.sh/scotch"
+                        (("$SCOTCHVERSION") (getenv "SCOTCHVERSION")))
+                      (substitute* "etc/config.sh/settings"
+                        (("$GMP_ROOT") (getenv "GMP_ROOT")))
+                      (substitute* "etc/config.sh/settings"
+                        (("$MPFR_ROOT") (getenv "MPFR_ROOT")))
+                      ;; reset lockDir variable to refer to write-enabled
+                      ;; directory
+                      (substitute* "wmake/wmake"
+                        (("        lockDir=.*$")
+                         "        lockDir=$HOME/.$WM_PROJECT/.wmake\n"))
+                      (substitute* "wmake/wmakeScheduler"
+                        (("lockDir=.*$")
+                         "lockDir=$HOME/.$WM_PROJECT/.wmake\n"))
+                      (substitute* "wmake/wmakeSchedulerUptime"
+                        (("lockDir=.*$")
+                         "lockDir=$HOME/.$WM_PROJECT/.wmake\n"))
+                      #t))
+                  (replace 'install
+                    (lambda _
+                      ;; use 'OpenFOAM-version' convention
+                      (let ((install-dir (string-append
+                                          %output "/lib/OpenFOAM-" ,version)))
+                        (mkdir-p install-dir)     ; create install directory
+                        ;; move contents of build directory to install directory
+                        (copy-recursively "." install-dir))))
+                  (add-after 'install 'add-symbolic-link
+                    (lambda _
+                      ;; add symbolic link for standard 'bin' directory
+                      (symlink
+                       (string-append "./lib/OpenFOAM-" ,version
+                                      "/platforms/linux64GccDPInt32Opt/bin")
+                       (string-append %output "/bin"))
+                      #t)))))
+    ;; Note:
+    ;;  Tutorial files are installed read-only in /gnu/store.
+    ;;  To allow write permissions on files copied from the store a
+    ;;  'chmod' step is needed before running the applications.  For
+    ;;  example, from a user's login:
+    ;;  $ source $GUIX_PROFILE/lib/OpenFOAM-4.1/etc/bashrc
+    ;;  $ mkdir -p $FOAM_RUN
+    ;;  $ cd $FOAM_RUN
+    ;;  $ cp -r $FOAM_TUTORIALS/incompressible/simpleFoam/pitzdaily .
+    ;;  $ cd pitzdaily
+    ;;  $ chmod -R u+w .
+    ;;  $ blockMesh
+    (synopsis "Framework for numerical simulation of fluid flow")
+    (description "OpenFOAM provides a set of solvers and methods for tackling
+problems in the field of Computational Fluid Dynamics (CFD).  It is written in
+C++.  Governing equations such as the Navier-Stokes equations can be solved in
+integral form.  Physical processes such as phase change, droplet transport and
+chemical reaction can be modelled.  Numerical methods are included to deal with
+sharp gradients, such as those encountered in flows with shock waves and flows
+with gas/liquid interfaces.  Large problems may be split into smaller, connected
+problems for efficient solution on parallel systems.")
+    (license license:gpl3+)
+    (home-page "https://openfoam.org")))
diff --git a/gnu/packages/statistics.scm b/gnu/packages/statistics.scm
index df2d56212e..cf88dd2025 100644
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@@ -500,14 +500,14 @@ nonlinear mixed-effects models.")
 (define-public r-mgcv
   (package
    (name "r-mgcv")
-   (version "1.8-19")
+   (version "1.8-21")
    (source
     (origin
      (method url-fetch)
      (uri (cran-uri "mgcv" version))
      (sha256
       (base32
-       "18zpnqilc2586764j7smwbixxz5gzpkpz2gq8nwgidfkyqwrkc45"))))
+       "1vgjz4ihms9kch6fadh0hkzgwv34wzbdmdzm6392cql1mx06x0mi"))))
    (build-system r-build-system)
    (propagated-inputs
     `(("r-matrix" ,r-matrix)
@@ -1060,14 +1060,14 @@ aesthetic attributes.")
 (define-public r-gdtools
   (package
     (name "r-gdtools")
-    (version "0.1.5")
+    (version "0.1.6")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "gdtools" version))
        (sha256
         (base32
-         "09y9x09gri33ghhrvjjnj5k5rk0kdpsk3wq02cln8gmywd6728vk"))))
+         "103wnc8sq0iwcnj4j14hd420d2dqdyf13s3f25icsznrlyzdkhf5"))))
     (build-system r-build-system)
     (native-inputs
      `(("r-rcpp" ,r-rcpp)
@@ -1086,14 +1086,14 @@ and to generate base64 encoded string from raster matrix.")
 (define-public r-svglite
   (package
     (name "r-svglite")
-    (version "1.2.0")
+    (version "1.2.1")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "svglite" version))
        (sha256
         (base32
-         "1s1gvmlmmna5y4jsn9h6438pg5b86fl4nwfvkgm6n4h6ljfgqyx3"))))
+         "1bws3lc4hlhln11zd7lalhiyc43yk6c6vrzy41fkxk1dkjazfx51"))))
     (build-system r-build-system)
     (native-inputs  `(("r-rcpp" ,r-rcpp)))
     (propagated-inputs
@@ -1424,13 +1424,13 @@ you call it again with the same arguments it returns the pre-computed value.")
 (define-public r-crayon
   (package
     (name "r-crayon")
-    (version "1.3.2")
+    (version "1.3.4")
     (source (origin
               (method url-fetch)
               (uri (cran-uri "crayon" version))
               (sha256
                (base32
-                "0s2yam18slph7xsw4pyc9f92gdyf609r5w92yax69zh57kb7asws"))))
+                "0s7s6vc3ww8pzanpjisym4jjvwcc5pi2qg8srx7jqlz9j3wrnvpw"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-memoise" ,r-memoise)))
@@ -1552,13 +1552,13 @@ and printing capabilities than traditional data frames.")
 (define-public r-dplyr
   (package
     (name "r-dplyr")
-    (version "0.7.2")
+    (version "0.7.3")
     (source (origin
               (method url-fetch)
               (uri (cran-uri "dplyr" version))
               (sha256
                (base32
-                "0jpb32ca1c0mr660igna4yw4fmzydzfhxshd0g8wgmggkynx2qi2"))))
+                "0wz5vrcsxzmxpxvs1raz9kyfc7mq3591nadq4rb4hx4sc97ysrxf"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-assertthat" ,r-assertthat)
@@ -2208,17 +2208,17 @@ collation, and NAMESPACE files.")
 (define-public r-openssl
   (package
     (name "r-openssl")
-    (version "0.9.6")
+    (version "0.9.7")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "openssl" version))
        (sha256
         (base32
-         "0ffwllii8xl6sa2v66134g0fwaw1y3zn3mvaa4nrc120vv5d3mkd"))))
+         "178fcp9f245i0k9s2w45kbw0ml0r9pfc73ak8hvicw4jz639wzb9"))))
     (build-system r-build-system)
     (inputs
-     `(("openssl" ,openssl)))
+     `(("libressl" ,libressl)))
     (home-page "https://github.com/jeroenooms/openssl")
     (synopsis "Toolkit for encryption, signatures and certificates")
     (description
@@ -2289,13 +2289,13 @@ pure C implementation of the Git core methods.")
 (define-public r-rstudioapi
   (package
     (name "r-rstudioapi")
-    (version "0.6")
+    (version "0.7")
     (source (origin
               (method url-fetch)
               (uri (cran-uri "rstudioapi" version))
               (sha256
                (base32
-                "1zkvz72z6nw0xc8bhb21y5x1nk6avijs0w8n4vsbvw9sn76wc96s"))))
+                "133s75q2hr6jg28m1wvs96qrbc9c4vw87migwhkjqb88xxvbqhd5"))))
     (build-system r-build-system)
     (home-page "http://cran.r-project.org/web/packages/rstudioapi")
     (synopsis "Safely access the RStudio API")
@@ -2595,13 +2595,13 @@ variety of formats.")
 (define-public r-gridextra
   (package
     (name "r-gridextra")
-    (version "2.2.1")
+    (version "2.3")
     (source (origin
               (method url-fetch)
               (uri (cran-uri "gridExtra" version))
               (sha256
                (base32
-                "0638ihwl00j76ivaxxhxvi8z573lwy1jym3srr78mx6dbdd4bzj4"))))
+                "0fwfk3cdwxxim7nd55pn7m31bcaqj48y06j7an2k1v1pybk0rdl1"))))
     (properties `((upstream-name . "gridExtra")))
     (build-system r-build-system)
     (propagated-inputs
@@ -2769,13 +2769,13 @@ plotted and compared with the asymptotic curve.")
 (define-public r-lambda-r
   (package
     (name "r-lambda-r")
-    (version "1.1.9")
+    (version "1.2")
     (source (origin
               (method url-fetch)
               (uri (cran-uri "lambda.r" version))
               (sha256
                (base32
-                "1j6287iqvs3ill6r5g6ksf5809qp0l0nf20ib8266m1r09lc9j14"))))
+                "0vql32np716dpd0kjn7s7wgawd02ysgp2a5il4kb19nlw661ii3x"))))
     (properties `((upstream-name . "lambda.r")))
     (build-system r-build-system)
     (home-page "http://cran.r-project.org/web/packages/lambda.r")
@@ -3086,14 +3086,14 @@ analysis of large sparse or dense matrices.")
 (define-public r-glmnet
   (package
    (name "r-glmnet")
-   (version "2.0-10")
+   (version "2.0-12")
    (source
     (origin
      (method url-fetch)
      (uri (cran-uri "glmnet" version))
      (sha256
       (base32
-       "07n2hz4fvjyv0siai8z8wqwfj8d58i8n1vzf1ckdfzp4kxa3z08d"))))
+       "1f8j440xi3xq37gvddiq2v610cvpzpg34n43116kixw1zvikm5ra"))))
    (build-system r-build-system)
    (inputs
     `(("gfortran" ,gfortran)))
@@ -3586,14 +3586,14 @@ selection.")
 (define-public r-tidyr
   (package
     (name "r-tidyr")
-    (version "0.7.0")
+    (version "0.7.1")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "tidyr" version))
        (sha256
         (base32
-         "1lg0amx5hs37ajwjxz7ya50q4s28jcdj51kzl10s1x4l1akp7xls"))))
+         "18fii18f967xaw6swn0w744sncx37rfq6gd8d9dccrpyf8647hmr"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-dplyr" ,r-dplyr)
@@ -5141,24 +5141,25 @@ to Applied regression, Second Edition, Sage, 2011.")
 (define-public r-caret
   (package
     (name "r-caret")
-    (version "6.0-76")
+    (version "6.0-77")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "caret" version))
        (sha256
         (base32
-         "1w31xzpmj8p6r6s7s1vwnjxainq54bbh4cqm177ba0myv69hh8cc"))))
+         "05c504567s2nppzfgi36mhszbym2pr80nf50dgxcxfx030721v5y"))))
     (build-system r-build-system)
     (propagated-inputs
-     `(("r-car" ,r-car)
-       ("r-foreach" ,r-foreach)
+     `(("r-foreach" ,r-foreach)
        ("r-ggplot2" ,r-ggplot2)
        ("r-lattice" ,r-lattice)
        ("r-modelmetrics" ,r-modelmetrics)
        ("r-nlme" ,r-nlme)
        ("r-plyr" ,r-plyr)
-       ("r-reshape2" ,r-reshape2)))
+       ("r-recipes" ,r-recipes)
+       ("r-reshape2" ,r-reshape2)
+       ("r-withr" ,r-withr)))
     (home-page "https://github.com/topepo/caret")
     (synopsis "Classification and regression training")
     (description
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index a914d41c43..66e9c4eddb 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -35,14 +35,14 @@
 (define-public owncloud-client
   (package
     (name "owncloud-client")
-    (version "2.3.1")
+    (version "2.3.3")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://download.owncloud.com/desktop/stable/"
                            "owncloudclient-" version ".tar.xz"))
        (sha256
-        (base32 "051rky4rpm73flxxkhfdxqq23ncnk4ixhscbg74w82sa4d93f54k"))
+        (base32 "1r5ddln1wc9iyjizgqb104i0r6qhzsmm2wdnxfaif119cv0vphda"))
        (modules '((guix build utils)))
        (snippet
         '(begin
diff --git a/gnu/packages/syndication.scm b/gnu/packages/syndication.scm
index 80c45c396c..8ac0524fc6 100644
--- a/gnu/packages/syndication.scm
+++ b/gnu/packages/syndication.scm
@@ -1,4 +1,4 @@
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; GNU Guix is free software; you can redistribute it and/or modify it
 ;;; under the terms of the GNU General Public License as published by
@@ -38,7 +38,8 @@
         (method url-fetch)
         (uri (string-append "https://newsbeuter.org/downloads/newsbeuter-"
                             version ".tar.gz"))
-        (patches (search-patches "newsbeuter-CVE-2017-12904.patch"))
+        (patches (search-patches "newsbeuter-CVE-2017-12904.patch"
+                                 "newsbeuter-CVE-2017-14500.patch"))
         (sha256
          (base32
           "1j1x0hgwxz11dckk81ncalgylj5y5fgw5bcmp9qb5hq9kc0vza3l"))))
diff --git a/gnu/packages/terminals.scm b/gnu/packages/terminals.scm
index df093c293d..a9682b685c 100644
--- a/gnu/packages/terminals.scm
+++ b/gnu/packages/terminals.scm
@@ -3,7 +3,7 @@
 ;;; Copyright © 2016 Mckinley Olsen <mck.olsen@gmail.com>
 ;;; Copyright © 2016, 2017 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
-;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 José Miguel Sánchez García <jmi2k@openmailbox.org>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
diff --git a/gnu/packages/texinfo.scm b/gnu/packages/texinfo.scm
index 6ec2bb8e9b..8c33023bd0 100644
--- a/gnu/packages/texinfo.scm
+++ b/gnu/packages/texinfo.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2016 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;;
@@ -30,6 +30,7 @@
   #:use-module (gnu packages ncurses))
 
 (define-public texinfo
+  ;; TODO: Merge with 'texinfo-latest' on the next core-updates.
   (package
     (name "texinfo")
     (version "6.3")
@@ -62,6 +63,19 @@ their source and the command-line Info reader.  The emphasis of the language
 is on expressing the content semantically, avoiding physical markup commands.")
     (license gpl3+)))
 
+(define-public texinfo-latest
+  ;; TODO: Turn this into 'texinfo' on the next core-updates cycle.
+  (package (inherit texinfo)
+    (version "6.5")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/texinfo/texinfo-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "0qjzvbvnv9003xdrcpi3jp7y68j4hq2ciw9frh2hghh698zlnxvp"))))
+    (native-inputs '())))
+
 (define-public texinfo-5
   (package (inherit texinfo)
     (version "5.2")
diff --git a/gnu/packages/time.scm b/gnu/packages/time.scm
index ba54d1d00f..4d3da87174 100644
--- a/gnu/packages/time.scm
+++ b/gnu/packages/time.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017 Ben Woodcroft <donttrustben@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,7 +22,9 @@
   #:use-module (guix licenses)
   #:use-module (guix packages)
   #:use-module (guix download)
-  #:use-module (guix build-system gnu))
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system python)
+  #:use-module (gnu packages python))
 
 (define-public time
   (package
@@ -55,3 +58,57 @@
 program uses.  The display output of the program can be customized or saved
 to a file.")
     (license gpl2+)))
+
+(define-public python-pytzdata
+  (package
+    (name "python-pytzdata")
+    (version "2017.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pytzdata" version))
+       (sha256
+        (base32
+         "1c1az8spm2d3km6qhjy69y4dlj71p6984l48mizr83nh4f0ipld4"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)
+       ("python-nose" ,python-nose)))
+    (home-page "https://github.com/sdispater/pytzdata")
+    (synopsis "Timezone database for Python")
+    (description
+     "This library provides a timezone database for Python.")
+    (license expat)))
+
+(define-public python2-tzdata
+  (package-with-python2 python-pytzdata))
+
+(define-public python-pendulum
+  (package
+    (name "python-pendulum")
+    (version "1.2.4")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pendulum" version))
+       (sha256
+        (base32
+         "1fj36yxi2f4lzchzd8ny1qjl67dbypnk0gn8qwad2w78579m8m8z"))))
+    (build-system python-build-system)
+    (native-inputs
+     `(("python-pytest" ,python-pytest)
+       ("python-nose" ,python-nose)))
+    (propagated-inputs
+     `(("python-dateutil" ,python-dateutil)
+       ("python-pytzdata" ,python-pytzdata)
+       ("python-tzlocal" ,python-tzlocal)))
+    (home-page "https://github.com/sdispater/pendulum")
+    (synopsis "Alternate API for Python datetimes")
+    (description "Pendulum is a drop-in replacement for the standard
+@{datetime} class, providing an alternative API.  As it inherits from the
+standard @code{datetime} all @code{datetime} instances can be replaced by
+Pendulum instances.")
+    (license expat)))
+
+(define-public python2-pendulum
+  (package-with-python2 python-pendulum))
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index 4183dda3c6..add371ffa3 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -486,13 +486,14 @@ netcat implementation that supports TLS.")
   (package
     (name "python-acme")
     ;; Remember to update the hash of certbot when updating python-acme.
-    (version "0.17.0")
+    (version "0.18.1")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "acme" version))
-      (sha256
-       (base32
-        "0vmnv7qhdhl9qhq03v6zrcj1lsmpmpjb94s0xsc7piwqxfmf9jrw"))))
+              (patches (search-patches "python-acme-dont-use-openssl-rand.patch"))
+              (sha256
+               (base32
+                "0ry6vhfkhds28sg232hngwfnkqihsxv9r8w92c6nz45r7w56qk0y"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -529,9 +530,6 @@ netcat implementation that supports TLS.")
     (description "ACME protocol implementation in Python")
     (license license:asl2.0)))
 
-(define-public python2-acme
-  (package-with-python2 python-acme))
-
 (define-public certbot
   (package
     (name "certbot")
@@ -543,7 +541,7 @@ netcat implementation that supports TLS.")
               (uri (pypi-uri name version))
               (sha256
                (base32
-                "173619jkq4bg88f6i837z3pcjkrfabrvv8vrpyx18k9i7xnb5xa3"))))
+                "0k3bqfkjxyg0qivs4a6iz6gyqx8li4hgn8m268r72lxgq46ay2mf"))))
     (build-system python-build-system)
     (arguments
      `(,@(substitute-keyword-arguments (package-arguments python-acme)
diff --git a/gnu/packages/tor.scm b/gnu/packages/tor.scm
index 64acb44490..e2123557c1 100644
--- a/gnu/packages/tor.scm
+++ b/gnu/packages/tor.scm
@@ -44,14 +44,14 @@
 (define-public tor
   (package
     (name "tor")
-    (version "0.3.0.10")
+    (version "0.3.0.11")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://dist.torproject.org/tor-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "1cas30wk4bhcivi6l9dj7wwlz6pc2jj883x1vijax3b8l54nx3ls"))))
+               "1hjhxkkrx04ydiddhwb3z2xb0vkcwmn1x8jsdcp6kd6i1qa0fp1a"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags (list "--enable-gcc-hardening"
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 0dabb2daa0..235adef024 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -16,6 +16,7 @@
 ;;; Copyright © 2017 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2017 André <eu@euandre.org>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -677,6 +678,41 @@ subcommands helps automate some parts of the flow to make working with it a
 lot easier.")
     (license license:bsd-2)))
 
+(define-public stgit
+  (package
+    (name "stgit")
+    (version "0.18")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/ctmarinas/stgit/archive/v"
+                                  version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "19fk6vw3pgp2a98wpd4j3kyiyll5dy9bi4921wq1mrky0l53mj00"))))
+    (build-system python-build-system)
+    (inputs
+     `(("git" ,git)))
+    (arguments
+     `(#:python ,python-2
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda _
+             ;; two tests will fail -> disable them. TODO: fix the failing tests
+             (delete-file "t/t3300-edit.sh")
+             (delete-file "t/t7504-commit-msg-hook.sh")
+             (zero? (system* "make" "test")))))))
+    (home-page "http://procode.org/stgit/")
+    (synopsis "Stacked Git")
+    (description
+     "StGit is a command-line application that provides functionality similar
+to Quilt (i.e., pushing/popping patches to/from a stack), but using Git
+instead of @command{diff} and @command{patch}.  StGit stores its patches in a
+Git repository as normal Git commits, and provides a number of commands to
+manipulate them in various ways.")
+    (license license:gpl2)))
+
 (define-public git-test-sequence
   (let ((commit "48e5a2f5a13a5f30452647237e23362b459b9c76"))
     (package
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index 65e8e1965b..f58d9b9eca 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -584,14 +584,14 @@ standards (MPEG-2, MPEG-4 ASP/H.263, MPEG-4 AVC/H.264, and VC-1/VMW3).")
 (define-public ffmpeg
   (package
     (name "ffmpeg")
-    (version "3.3.3")
+    (version "3.3.4")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://ffmpeg.org/releases/ffmpeg-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "07is8msrhxr1dk6vgwa192k2pl2a0in1h9w8f9cknlvbvhn01afj"))))
+               "0mx9dvad3lkyhvsrblf280x2bz6dxajya1ylnspbdzldj0dpxfcq"))))
     (build-system gnu-build-system)
     (inputs
      `(("fontconfig" ,fontconfig)
@@ -974,7 +974,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
 (define-public mpv
   (package
     (name "mpv")
-    (version "0.26.0")
+    (version "0.27.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -982,7 +982,7 @@ SVCD, DVD, 3ivx, DivX 3/4/5, WMV and H.264 movies.")
                     ".tar.gz"))
               (sha256
                (base32
-                "0ihvnwrp24jjf43k1hvy8n8w4ipl4z7apjppd4i0y9jzilsyzwys"))
+                "1754371fkva8aqxgbm50jxyvij7mnysq0538bf6zghbmigqqn79l"))
               (file-name (string-append name "-" version ".tar.gz"))))
     (build-system waf-build-system)
     (native-inputs
@@ -1115,7 +1115,7 @@ access to mpv's powerful playback capabilities.")
 (define-public youtube-dl
   (package
     (name "youtube-dl")
-    (version "2017.09.02")
+    (version "2017.09.15")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://yt-dl.org/downloads/"
@@ -1123,7 +1123,7 @@ access to mpv's powerful playback capabilities.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1sfra8rfb7hkbgmw2n2s42fpkh0y7j9lyars7qda3rj34ai7r6k9"))))
+                "1kw8pqzvhbpyxcz2jb692j4cgzd3vmd81mra09xvpzkq974jkx7f"))))
     (build-system python-build-system)
     (arguments
      ;; The problem here is that the directory for the man page and completion
@@ -2254,10 +2254,11 @@ practically any type of media.")
        #:phases
        ;; build scripts not in root of archive
        (modify-phases %standard-phases
-         (add-before 'configure 'pre-configure
+         (add-after 'unpack 'change-to-build-dir
            (lambda _
-             (chdir "Project/GNU/Library")))
-         (add-after 'unpack 'autogen
+             (chdir "Project/GNU/Library")
+             #t))
+         (add-after 'change-to-build-dir 'autogen
            (lambda _
              (zero? (system* "sh" "autogen.sh")))))))
     (home-page "https://mediaarea.net/en/MediaInfo")
diff --git a/gnu/packages/virtualization.scm b/gnu/packages/virtualization.scm
index 32d10dcf82..8fd3230895 100644
--- a/gnu/packages/virtualization.scm
+++ b/gnu/packages/virtualization.scm
@@ -77,6 +77,8 @@
              (method url-fetch)
              (uri (string-append "https://download.qemu.org/qemu-"
                                  version ".tar.xz"))
+             (patches (search-patches "qemu-CVE-2017-13711.patch"
+                                      "qemu-CVE-2017-14167.patch"))
              (sha256
               (base32
                "0dgk7zcni41nf1jp84y0m6dk2nb4frnh571m8hkiv0m4hz4imn2m"))))
@@ -311,14 +313,14 @@ manage system or application containers.")
 (define-public libvirt
   (package
     (name "libvirt")
-    (version "3.6.0")
+    (version "3.7.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://libvirt.org/sources/libvirt-"
                                   version ".tar.xz"))
               (sha256
                (base32
-                "0gcyql5dp6j370kvik9hjhxirrg89m7l1q52yq0g75h7jpv9fb1s"))))
+                "1fk75cdzg59y9hnfdpdwv83fsc1yffy3lac4ch19zygfkqhcnysf"))))
     (build-system gnu-build-system)
     (arguments
      `(;; FAIL: virshtest
@@ -365,7 +367,6 @@ manage system or application containers.")
        ("gnutls" ,gnutls)
        ("dbus" ,dbus)
        ("qemu" ,qemu)
-       ("polkit" ,polkit)
        ("libpcap" ,libpcap)
        ("libnl" ,libnl)
        ("libuuid" ,util-linux)
@@ -373,8 +374,6 @@ manage system or application containers.")
        ("curl" ,curl)
        ("openssl" ,openssl)
        ("cyrus-sasl" ,cyrus-sasl)
-       ("perl" ,perl)
-       ("python" ,python-2)
        ("libyajl" ,libyajl)
        ("audit" ,audit)
        ("dmidecode" ,dmidecode)
@@ -383,7 +382,11 @@ manage system or application containers.")
        ("iproute" ,iproute)
        ("iptables" ,iptables)))
     (native-inputs
-     `(("pkg-config" ,pkg-config)))
+     `(("xsltproc" ,libxslt)
+       ("perl" ,perl)
+       ("pkg-config" ,pkg-config)
+       ("polkit" ,polkit)
+       ("python" ,python-2)))
     (home-page "https://libvirt.org")
     (synopsis "Simple API for virtualization")
     (description "Libvirt is a C toolkit to interact with the virtualization
@@ -426,7 +429,7 @@ to integrate other virtualization mechanisms if needed.")
        ("intltool" ,intltool)
        ("glib" ,glib "bin")
        ("vala" ,vala)))
-    (home-page "http://libvirt.org")
+    (home-page "https://libvirt.org")
     (synopsis "GLib wrapper around libvirt")
     (description "libvirt-glib wraps the libvirt library to provide a
 high-level object-oriented API better suited for glib-based applications, via
@@ -443,13 +446,13 @@ three libraries:
 (define-public python-libvirt
   (package
     (name "python-libvirt")
-    (version "3.4.0")
+    (version "3.7.0")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "libvirt-python" version))
               (sha256
                (base32
-                "04dma3979171p9yf0cg7m03shk038hc9vyfm9lb8z60qyn0pg9xg"))))
+                "0vy0ai8z88yhzqfk1n08z1gda5flrqxcw9lg1012b3zg125qljhy"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
@@ -469,7 +472,7 @@ three libraries:
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("python-nose" ,python-nose)))
-    (home-page "http://libvirt.org")
+    (home-page "https://libvirt.org")
     (synopsis "Python bindings to libvirt")
     (description "This package provides Python bindings to the libvirt
 virtualization library.")
diff --git a/gnu/packages/web-browsers.scm b/gnu/packages/web-browsers.scm
index 8de0cf1d56..3e91b4e89b 100644
--- a/gnu/packages/web-browsers.scm
+++ b/gnu/packages/web-browsers.scm
@@ -185,7 +185,7 @@ access.")
 (define-public qutebrowser
   (package
     (name "qutebrowser")
-    (version "0.10.1")
+    (version "0.11.0")
     (source
      (origin
        (method url-fetch)
@@ -194,7 +194,7 @@ access.")
                            "qutebrowser-" version ".tar.gz"))
        (sha256
         (base32
-         "05qryn56w2pbqhir4pl99idx7apx2xqw9f8wmbrhj59b1xgr3x2p"))))
+         "13ihx66jm1dd6vx8px7pm0kbzf2sf9x43hhivc1rp17kahnxxdyv"))))
     (build-system python-build-system)
     (native-inputs
      `(("asciidoc" ,asciidoc)))
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index ac65a85365..6c9316a401 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -76,9 +76,11 @@
   #:use-module (gnu packages java)
   #:use-module (gnu packages javascript)
   #:use-module (gnu packages image)
+  #:use-module (gnu packages imagemagick)
   #:use-module (gnu packages libidn)
   #:use-module (gnu packages libunistring)
   #:use-module (gnu packages lua)
+  #:use-module (gnu packages markup)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages base)
   #:use-module (gnu packages perl)
@@ -92,7 +94,8 @@
   #:use-module (gnu packages texinfo)
   #:use-module (gnu packages textutils)
   #:use-module (gnu packages tls)
-  #:use-module (gnu packages statistics))
+  #:use-module (gnu packages statistics)
+  #:use-module (gnu packages version-control))
 
 (define-public httpd
   (package
@@ -104,7 +107,8 @@
                                  version ".tar.bz2"))
              (sha256
               (base32
-               "0fn1778mxhf78np2d8qlycg1c2ak18rxax41plahasca4clc3z3i"))))
+               "0fn1778mxhf78np2d8qlycg1c2ak18rxax41plahasca4clc3z3i"))
+             (patches (search-patches "httpd-CVE-2017-9798.patch"))))
     (build-system gnu-build-system)
     (native-inputs `(("pcre" ,pcre "bin")))       ;for 'pcre-config'
     (inputs `(("apr" ,apr)
@@ -162,6 +166,7 @@ and its related documentation.")
              (let ((flags
                     (list (string-append "--prefix=" (assoc-ref outputs "out"))
                           "--with-http_ssl_module"
+                          "--with-http_v2_module"
                           "--with-pcre-jit"
                           "--with-debug"
                           ;; Even when not cross-building, we pass the
@@ -1912,6 +1917,33 @@ string generation and manipulation, and processing and preparing HTTP
 headers.")
     (license l:perl-license)))
 
+(define-public perl-cgi-session
+  (package
+    (name "perl-cgi-session")
+    (version "4.48")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/M/MA/MARKSTOS/CGI-Session-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1xsl2pz1jrh127pq0b01yffnj4mnp9nvkp88h5mndrscq9hn8xa6"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-module-build" ,perl-module-build)))
+    (inputs `(("perl-cgi" ,perl-cgi)))
+    (home-page
+     "http://search.cpan.org/dist/CGI-Session")
+    (synopsis
+     "Persistent session data in CGI applications")
+    (description
+     "@code{CGI::Session} provides modular session management system across
+HTTP requests.")
+    (license l:perl-license)))
+
 (define-public perl-cgi-simple
   (package
     (name "perl-cgi-simple")
@@ -2184,6 +2216,37 @@ composed of HTML::Element style components.")
 <form> ... </form> instance.")
     (license l:perl-license)))
 
+(define-public perl-html-scrubber
+  (package
+    (name "perl-html-scrubber")
+    (version "0.15")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://cpan/authors/id/N/NI/NIGELM/HTML-Scrubber-"
+             version
+             ".tar.gz"))
+       (sha256
+        (base32
+         "1m1f8gm2jry42zxja05dxp2ck7y66m7i8vc38nj6hccnwlby6cvi"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-module-build" ,perl-module-build)
+       ("perl-test-cpan-meta" ,perl-test-cpan-meta)
+       ("perl-test-eol" ,perl-test-eol)
+       ("perl-test-memory-cycle" ,perl-test-memory-cycle)
+       ("perl-test-notabs" ,perl-test-notabs)))
+    (inputs
+     `(("perl-html-parser" ,perl-html-parser)))
+    (home-page
+     "http://search.cpan.org/dist/HTML-Scrubber")
+    (synopsis
+     "Perl extension for scrubbing/sanitizing html")
+    (description
+     "@code{HTML::Scrubber} Perl extension for scrubbing/sanitizing HTML.")
+    (license l:perl-license)))
+
 (define-public perl-html-lint
   (package
     (name "perl-html-lint")
@@ -4010,6 +4073,74 @@ parse both valid and invalid web content.  It is developed as part of the
 NetSurf project.")
     (license l:expat)))
 
+(define-public ikiwiki
+  (package
+    (name "ikiwiki")
+    (version "3.20170111")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://snapshot.debian.org/archive/debian/"
+                           "20170111T215449Z/pool/main/i/ikiwiki/ikiwiki_"
+                           version ".tar.xz"))
+       (sha256
+        (base32
+         "00d7yzv426fvqbhvzyafddv7fa6b4j2647b0wi371wd5yjj9j3sz"))))
+    (build-system perl-build-system)
+    (arguments
+     `(;; Image tests fail
+       ;;
+       ;; Test Summary Report
+       ;; -------------------
+       ;; t/img.t                      (Wstat: 2304 Tests: 62 Failed: 9)
+       ;;   Failed tests:  21, 27-28, 30-35
+       ;;   Non-zero exit status: 9
+       #:tests? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'wrap-programs
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out  (assoc-ref outputs "out"))
+                    (bin  (string-append out "/bin/"))
+                    (path (getenv "PERL5LIB")))
+               (for-each (lambda (file)
+                           (wrap-program file
+                             `("PERL5LIB" ":" prefix (,path))))
+                         (find-files bin))
+               #t))))))
+    (native-inputs
+     `(("which" ,which)
+       ("perl-html-tagset" ,perl-html-tagset)
+       ("perl-timedate" ,perl-timedate)
+       ("perl-xml-sax" ,perl-xml-sax)
+       ("perl-xml-simple" ,perl-xml-simple)
+       ("gettext" ,gettext-minimal)
+       ("subversion" ,subversion)
+       ("git" ,git)
+       ("bazaar" ,bazaar)
+       ("cvs" ,cvs)
+       ("mercurial" ,mercurial)))
+    (inputs
+     `(("python" ,python-wrapper)
+       ("perl-cgi-session" ,perl-cgi-session)
+       ("perl-cgi-simple" ,perl-cgi-simple)
+       ("perl-json" ,perl-json)
+       ("perl-image-magick" ,perl-image-magick)
+       ("perl-uri" ,perl-uri)
+       ("perl-html-parser" ,perl-html-parser)
+       ("perl-uri" ,perl-uri)
+       ("perl-text-markdown-discount" ,perl-text-markdown-discount)
+       ("perl-html-scrubber" ,perl-html-scrubber)
+       ("perl-html-template" ,perl-html-template)
+       ("perl-yaml-libyaml" ,perl-yaml-libyaml)))
+    (home-page "https://ikiwiki.info/")
+    (synopsis "Wiki compiler, capable of generating HTML")
+    (description
+     "Ikiwiki is a wiki compiler, capable of generating a static set of web
+pages, but also incorporating dynamic features like a web based editor and
+commenting.")
+    (license l:gpl2+)))
+
 (define-public libwapcaplet
   (package
     (name "libwapcaplet")
diff --git a/gnu/packages/webkit.scm b/gnu/packages/webkit.scm
index 5ab27b49f5..7b4b306e8f 100644
--- a/gnu/packages/webkit.scm
+++ b/gnu/packages/webkit.scm
@@ -46,6 +46,7 @@
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
   #:use-module (gnu packages ruby)
+  #:use-module (gnu packages tls)
   #:use-module (gnu packages video)
   #:use-module (gnu packages xml)
   #:use-module (gnu packages xorg))
@@ -53,14 +54,14 @@
 (define-public webkitgtk
   (package
     (name "webkitgtk")
-    (version "2.16.6")
+    (version "2.18.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.webkitgtk.org/releases/"
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "08abxbhi2n1pfby9f2c20z8mpmbvbs2z7vf0p5ckq4jkz46na8zw"))))
+                "1383wlv98l8fwmhzy0fad82a44h5svm89c1kpa03wsp37mmf90xm"))))
     (build-system cmake-build-system)
     (arguments
      '(#:tests? #f ; no tests
@@ -69,7 +70,16 @@
                           "-DPORT=GTK"
                           (string-append ; uses lib64 by default
                            "-DLIB_INSTALL_DIR="
-                           (assoc-ref %outputs "out") "/lib"))
+                           (assoc-ref %outputs "out") "/lib")
+
+                          ;; XXX Adding GStreamer GL support would apparently
+                          ;; require adding gst-plugins-bad to the inputs,
+                          ;; which might entail a security risk as a result of
+                          ;; the plugins of dubious code quality that are
+                          ;; included.  More investigation is needed.  For
+                          ;; now, we explicitly disable it to prevent an error
+                          ;; at configuration time.
+                          "-DUSE_GSTREAMER_GL=OFF")
        #:phases
        (modify-phases %standard-phases
          (add-after
@@ -112,6 +122,7 @@
        ("libnotify" ,libnotify)
        ("libpng" ,libpng)
        ("libsecret" ,libsecret)
+       ("libtasn1" ,libtasn1)
        ("libwebp" ,libwebp)
        ("libxcomposite" ,libxcomposite)
        ("libxml2" ,libxml2)
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 96553c97b2..d889e602ed 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -867,13 +867,13 @@ parsing/saving.")
 (define-public python-pyxb
   (package
     (name "python-pyxb")
-    (version "1.2.5")
+    (version "1.2.6")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "PyXB" version))
               (sha256
                (base32
-                "0rzzwibfqa28gxgcxx4cybx1qcg0g6fand06ykj3gz7z5kp653sf"))))
+                "1d17pyixbfvjyi2lb0cfp0ch8wwdf44mmg3r5pwqhyyqs66z601a"))))
     (build-system python-build-system)
     (home-page "http://pyxb.sourceforge.net/")
     (synopsis "Python XML Schema Bindings")
@@ -1189,14 +1189,14 @@ libxls cannot write Excel files.")
 (define-public freexl
   (package
     (name "freexl")
-    (version "1.0.2")
+    (version "1.0.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://www.gaia-gis.it/gaia-sins/"
                                   name  "-" version ".tar.gz"))
               (sha256
                (base32
-                "17a0yrjb0gln7819j0vp7y25imhvwpil2b0rm44mwgzml0a4i6mk"))))
+                "09bwzqjc41cc8qw8qkw9wq58rg9nax8r3fg19iny5vmw1c0z23sh"))))
     (build-system gnu-build-system)
     (home-page "https://www.gaia-gis.it/fossil/freexl/index")
     (synopsis "Read Excel files")
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index b72153894a..57ba8a2db0 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -2418,7 +2418,7 @@ including most mice, keyboards, tablets and touchscreens.")
 (define-public xf86-input-libinput
   (package
     (name "xf86-input-libinput")
-    (version "0.25.1")
+    (version "0.26.0")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -2426,7 +2426,7 @@ including most mice, keyboards, tablets and touchscreens.")
                     name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "1q67hjd67ni1nq7kgxdrrdgkyhzaqvvn2vlnsiiq9w4y3icpv7s8"))))
+                "0yrqs88b7yn9nljwlxzn76jfmvf0sh939kzij5b2jvr2qa7mbjmb"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags
@@ -2646,7 +2646,7 @@ as USB mice.")
 (define-public xf86-video-ati
   (package
     (name "xf86-video-ati")
-    (version "7.9.0")
+    (version "7.10.0")
     (source
       (origin
         (method url-fetch)
@@ -2656,7 +2656,7 @@ as USB mice.")
                ".tar.bz2"))
         (sha256
           (base32
-            "0xcq0lncb5p4sas5866qpkjyp1v8ksalw7m1gmqb3brhccp8gb9w"))))
+            "0yafix56vkqglw243cwb94nv91vbjv12sqh29x1bap0hwd1dclgf"))))
     (build-system gnu-build-system)
     (inputs `(("mesa" ,mesa)
               ("xxf86driproto" ,xf86driproto)
@@ -2885,8 +2885,8 @@ X server.")
 
 
 (define-public xf86-video-intel
-  (let ((commit "2100efa105e8c9615eda867d39471d78e500b1bb")
-        (revision "7"))
+  (let ((commit "c89905754b929f0421db7ea6d60b8942ccdbd8af")
+        (revision "8"))
     (package
       (name "xf86-video-intel")
       (version (string-append "2.99.917-" revision "-"
@@ -2900,7 +2900,7 @@ X server.")
                (commit commit)))
          (sha256
           (base32
-           "15fg844msmixsvlxcd5wm2awmns652sxcxj2wmp6819lr32lc4ir"))
+           "1xiyxhlq88vvgjavhxdkk933b5q7vm4jn6db144a6sqzifwaj672"))
          (file-name (string-append name "-" version))))
       (build-system gnu-build-system)
       (inputs `(("mesa" ,mesa)
@@ -5073,8 +5073,21 @@ over Xlib, including:
          (base32
           "162s1v901djr57gxmmk4airk8hiwcz79dqyz72972x1lw1k82yk7"))
         (patches
-         (search-patches "xorg-server-CVE-2017-10971.patch"
-                         "xorg-server-CVE-2017-10972.patch"))))
+         (cons
+          ;; See:
+          ;;   https://lists.fedoraproject.org/archives/list/devel@lists.
+          ;;      fedoraproject.org/message/JU655YB7AM4OOEQ4MOMCRHJTYJ76VFOK/
+          (origin
+            (method url-fetch)
+            (uri (string-append
+                  "http://pkgs.fedoraproject.org/cgit/rpms/xorg-x11-server.git"
+                  "/plain/06_use-intel-only-on-pre-gen4.diff"))
+            (sha256
+             (base32
+              "0mm70y058r8s9y9jiv7q2myv0ycnaw3iqzm7d274410s0ik38w7q"))
+            (file-name "xorg-server-use-intel-only-on-pre-gen4.diff"))
+          (search-patches "xorg-server-CVE-2017-10971.patch"
+                          "xorg-server-CVE-2017-10972.patch")))))
     (build-system gnu-build-system)
     (propagated-inputs
       `(("dri2proto" ,dri2proto)
diff --git a/gnu/services.scm b/gnu/services.scm
index 8ef1ae7c77..2ebd701a59 100644
--- a/gnu/services.scm
+++ b/gnu/services.scm
@@ -23,6 +23,7 @@
   #:use-module (guix store)
   #:use-module (guix records)
   #:use-module (guix profiles)
+  #:use-module (guix discovery)
   #:use-module (guix sets)
   #:use-module (guix ui)
   #:use-module ((guix utils) #:select (source-properties->location))
@@ -49,6 +50,11 @@
             service-type-compose
             service-type-extend
             service-type-default-value
+            service-type-description
+            service-type-location
+
+            %service-type-path
+            fold-service-types
 
             service
             service?
@@ -145,7 +151,15 @@
 
   ;; Optional default value for instances of this type.
   (default-value service-type-default-value       ;Any
-                 (default &no-default-value)))
+                 (default &no-default-value))
+
+  ;; Meta-data.
+  (description  service-type-description          ;string
+                (default #f))
+  (location     service-type-location             ;<location>
+                (default (and=> (current-source-location)
+                                source-properties->location))
+                (innate)))
 
 (define (write-service-type type port)
   (format port "#<service-type ~a ~a>"
@@ -154,6 +168,27 @@
 
 (set-record-type-printer! <service-type> write-service-type)
 
+(define %distro-root-directory
+  ;; Absolute file name of the module hierarchy.
+  (dirname (search-path %load-path "guix.scm")))
+
+(define %service-type-path
+  ;; Search path for service types.
+  (make-parameter `((,%distro-root-directory . "gnu/services")
+                    (,%distro-root-directory . "gnu/system"))))
+
+(define* (fold-service-types proc seed
+                             #:optional
+                             (modules (all-modules (%service-type-path))))
+  "For each service type exported by one of MODULES, call (PROC RESULT).  SEED
+is used as the initial value of RESULT."
+  (fold-module-public-variables (lambda (object result)
+                                  (if (service-type? object)
+                                      (proc object result)
+                                      result))
+                                '()
+                                modules))
+
 ;; Services of a given type.
 (define-record-type <service>
   (make-service type value)
diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index 5001298ab3..10c8f1b6a3 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -29,6 +29,7 @@
   #:use-module (gnu services networking)
   #:use-module (gnu system pam)
   #:use-module (gnu system shadow)                ; 'user-account', etc.
+  #:use-module (gnu system uuid)
   #:use-module (gnu system file-systems)          ; 'file-system', etc.
   #:use-module (gnu system mapped-devices)
   #:use-module ((gnu system linux-initrd)
@@ -47,6 +48,7 @@
                 #:select (mount-flags->bit-mask))
   #:use-module (guix gexp)
   #:use-module (guix records)
+  #:use-module (guix modules)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-26)
   #:use-module (ice-9 match)
@@ -208,7 +210,10 @@
                  (list (service-extension etc-service-type
                                           file-systems->fstab)))
                 (compose concatenate)
-                (extend append)))
+                (extend append)
+                (description
+                 "Populate the @file{/etc/fstab} based on the given file
+system objects.")))
 
 (define %root-file-system-shepherd-service
   (shepherd-service
@@ -276,18 +281,12 @@ FILE-SYSTEM."
   "Return the shepherd service for @var{file-system}, or @code{#f} if
 @var{file-system} is not auto-mounted upon boot."
   (let ((target  (file-system-mount-point file-system))
-        (device  (file-system-device file-system))
-        (type    (file-system-type file-system))
-        (title   (file-system-title file-system))
-        (flags   (file-system-flags file-system))
-        (options (file-system-options file-system))
-        (check?  (file-system-check? file-system))
         (create? (file-system-create-mount-point? file-system))
         (dependencies (file-system-dependencies file-system))
         (packages (file-system-packages (list file-system))))
     (and (file-system-mount? file-system)
-         (with-imported-modules '((gnu build file-systems)
-                                  (guix build bournish))
+         (with-imported-modules (source-module-closure
+                                 '((gnu build file-systems)))
            (shepherd-service
             (provision (list (file-system->shepherd-service-name file-system)))
             (requirement `(root-file-system
@@ -310,8 +309,7 @@ FILE-SYSTEM."
                                                                 '#$packages))))
                            (lambda ()
                              (mount-file-system
-                              `(#$device #$title #$target #$type #$flags
-                                         #$options #$check?)
+                              '#$(file-system->spec file-system)
                               #:root "/"))
                            (lambda ()
                              (setenv "PATH" $PATH)))
@@ -354,7 +352,10 @@ FILE-SYSTEM."
                        (service-extension fstab-service-type
                                           identity)))
                 (compose concatenate)
-                (extend append)))
+                (extend append)
+                (description
+                 "Provide Shepherd services to mount and unmount the given
+file systems, as well as corresponding @file{/etc/fstab} entries.")))
 
 (define user-unmount-service-type
   (shepherd-service-type
@@ -550,7 +551,11 @@ stopped before 'kill' is called."
   (service-type (name 'urandom-seed)
                 (extensions
                  (list (service-extension shepherd-root-service-type
-                                          urandom-seed-shepherd-service)))))
+                                          urandom-seed-shepherd-service)))
+                (description
+                 "Seed the @file{/dev/urandom} pseudo-random number
+generator (RNG) with the value recorded when the system was last shut
+down.")))
 
 (define (urandom-seed-service)
   (service urandom-seed-service-type #f))
@@ -618,7 +623,15 @@ to add @var{device} to the kernel's entropy pool.  The service will fail if
              (list `("environment"
                      ,(environment-variables->environment-file vars)))))))
    (compose concatenate)
-   (extend append)))
+   (extend append)
+   (description
+    "Populate @file{/etc/environment} with the specified environment
+variables.  The value of this service is a list of name/value pairs for
+environments variables, such as:
+
+@example
+'((\"TZ\" . \"Canada/Pacific\"))
+@end example\n")))
 
 (define (session-environment-service vars)
   "Return a service that builds the @file{/etc/environment}, which can be read
@@ -718,7 +731,15 @@ strings or string-valued gexps."
                  (list (service-extension shepherd-root-service-type
                                           console-font-shepherd-services)))
                 (compose concatenate)
-                (extend append)))
+                (extend append)
+                (description
+                 "Install the given fonts on the specified ttys (fonts are per
+virtual console on GNU/Linux).  The value of this service is a list of
+tty/font pairs like:
+
+@example
+'((\"tty1\" . \"LatGrkCyr-8x16\"))
+@end example\n")))
 
 (define* (console-font-service tty #:optional (font "LatGrkCyr-8x16"))
   "This procedure is deprecated in favor of @code{console-font-service-type}.
@@ -753,7 +774,10 @@ Return a service that sets up Unicode support in @var{tty} and loads
 (define login-service-type
   (service-type (name 'login)
                 (extensions (list (service-extension pam-root-service-type
-                                                     login-pam-service)))))
+                                                     login-pam-service)))
+                (description
+                 "Provide a console log-in service as specified by its
+configuration value, a @code{login-configuration} object.")))
 
 (define* (login-service #:optional (config (login-configuration)))
   "Return a service configure login according to @var{config}, which specifies
@@ -969,7 +993,10 @@ the message of the day, among other things."
 (define agetty-service-type
   (service-type (name 'agetty)
                 (extensions (list (service-extension shepherd-root-service-type
-                                                     agetty-shepherd-service)))))
+                                                     agetty-shepherd-service)))
+                (description
+                 "Provide console login using the @command{agetty}
+program.")))
 
 (define* (agetty-service config)
   "Return a service to run agetty according to @var{config}, which specifies
@@ -1020,7 +1047,10 @@ the tty to run, among other things."
 (define mingetty-service-type
   (service-type (name 'mingetty)
                 (extensions (list (service-extension shepherd-root-service-type
-                                                     mingetty-shepherd-service)))))
+                                                     mingetty-shepherd-service)))
+                (description
+                 "Provide console login using the @command{mingetty}
+program.")))
 
 (define* (mingetty-service config)
   "Return a service to run mingetty according to @var{config}, which specifies
@@ -1189,7 +1219,11 @@ the tty to run, among other things."
                            (inherit config)
                            (name-services (append
                                            (nscd-configuration-name-services config)
-                                           name-services)))))))
+                                           name-services)))))
+                (description
+                 "Runs libc's @dfn{name service cache daemon} (nscd) with the
+given configuration---an @code{<nscd-configuration>} object.  @xref{Name
+Service Switch}, for an example.")))
 
 (define* (nscd-service #:optional (config %nscd-default-configuration))
   "Return a service that runs libc's name service cache daemon (nscd) with the
@@ -1285,7 +1319,11 @@ information on the configuration file syntax."
      (extensions
       (list (service-extension etc-service-type security-limits)
             (service-extension pam-root-service-type
-                               (lambda _ (list pam-extension))))))))
+                               (lambda _ (list pam-extension)))))
+     (description
+      "Install the specified resource usage limits by populating
+@file{/etc/security/limits.conf} and using the @code{pam_limits}
+authentication module."))))
 
 (define* (pam-limits-service #:optional (limits '()))
   "Return a service that makes selected programs respect the list of
@@ -1461,7 +1499,9 @@ failed to register hydra.gnu.org public key: ~a~%" status))))))))
           (service-extension activation-service-type guix-activation)
           (service-extension profile-service-type
                              (compose list guix-configuration-guix))))
-   (default-value (guix-configuration))))
+   (default-value (guix-configuration))
+   (description
+    "Run the build daemon of GNU@tie{}Guix, aka. @command{guix-daemon}.")))
 
 (define* (guix-service #:optional (config %default-guix-configuration))
   "Return a service that runs the Guix build daemon according to
@@ -1559,7 +1599,10 @@ failed to register hydra.gnu.org public key: ~a~%" status))))))))
                                           (const %guix-publish-accounts))
                        (service-extension activation-service-type
                                           guix-publish-activation)))
-                (default-value (guix-publish-configuration))))
+                (default-value (guix-publish-configuration))
+                (description
+                 "Add a Shepherd service running @command{guix publish}, a
+command that allows you to share pre-built binaries with others over HTTP.")))
 
 (define* (guix-publish-service #:key (guix guix) (port 80) (host "localhost"))
   "Return a service that runs @command{guix publish} listening on @var{host}
@@ -1731,7 +1774,11 @@ item of @var{packages}."
                             (($ <udev-configuration> udev initial-rules)
                              (udev-configuration
                               (udev udev)
-                              (rules (append initial-rules rules)))))))))
+                              (rules (append initial-rules rules)))))))
+                (description
+                 "Run @command{udev}, which populates the @file{/dev}
+directory dynamically.  Get extra rules from the packages listed in the
+@code{rules} field of its value, @code{udev-configuration} object.")))
 
 (define* (udev-service #:key (udev eudev) (rules '()))
   "Run @var{udev}, which populates the @file{/dev} directory dynamically.  Get
@@ -1802,7 +1849,12 @@ extra rules from the packages listed in @var{rules}."
   (service-type (name 'gpm)
                 (extensions
                  (list (service-extension shepherd-root-service-type
-                                          gpm-shepherd-service)))))
+                                          gpm-shepherd-service)))
+                (description
+                 "Run GPM, the general-purpose mouse daemon, with the given
+command-line options.  GPM allows users to use the mouse in the console,
+notably to select, copy, and paste text.  The default options use the
+@code{ps2} protocol, which works for both USB and PS/2 mice.")))
 
 (define* (gpm-service #:key (gpm gpm)
                       (options '("-m" "/dev/input/mice" "-t" "ps2")))
diff --git a/gnu/services/cuirass.scm b/gnu/services/cuirass.scm
index 73a30b2402..2ad5952202 100644
--- a/gnu/services/cuirass.scm
+++ b/gnu/services/cuirass.scm
@@ -60,7 +60,7 @@
   (database         cuirass-configuration-database ;string (file-name)
                     (default "/var/run/cuirass/cuirass.db"))
   (port             cuirass-configuration-port ;integer (port)
-                    (default 8080))
+                    (default 8081))
   (specifications   cuirass-configuration-specifications)
                                   ;gexp that evaluates to specification-alist
   (use-substitutes? cuirass-configuration-use-substitutes? ;boolean
diff --git a/gnu/services/desktop.scm b/gnu/services/desktop.scm
index 98f1198f2f..527a3101cf 100644
--- a/gnu/services/desktop.scm
+++ b/gnu/services/desktop.scm
@@ -732,7 +732,8 @@ seats.)"
 
                        ;; We need /run/user, /run/systemd, etc.
                        (service-extension file-system-service-type
-                                          (const %elogind-file-systems))))))
+                                          (const %elogind-file-systems))))
+                (default-value (elogind-configuration))))
 
 (define* (elogind-service #:key (config (elogind-configuration)))
   "Return a service that runs the @command{elogind} login and seat management
diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm
index b45008de64..fbedaa5b35 100644
--- a/gnu/services/networking.scm
+++ b/gnu/services/networking.scm
@@ -253,7 +253,12 @@ fe80::1%lo0 apps.facebook.com\n")
                   (service-extension etc-service-type
                                      static-networking-etc-files)))
                 (compose concatenate)
-                (extend append)))
+                (extend append)
+                (description
+                 "Turn up the specified network interfaces upon startup,
+with the given IP address, gateway, netmask, and so on.  The value for
+services of this type is a list of @code{static-networking} objects, one per
+network interface.")))
 
 (define* (static-networking-service interface ip
                                     #:key
@@ -422,7 +427,11 @@ restrict -6 ::1\n"))
                        (service-extension account-service-type
                                           (const %ntp-accounts))
                        (service-extension activation-service-type
-                                          ntp-service-activation)))))
+                                          ntp-service-activation)))
+                (description
+                 "Run the @command{ntpd}, the Network Time Protocol (NTP)
+daemon of the @uref{http://www.ntp.org, Network Time Foundation}.  The daemon
+will keep the system clock synchronized with that of the given servers.")))
 
 (define* (ntp-service #:key (ntp ntp)
                       (servers %ntp-servers)
@@ -520,7 +529,11 @@ make an initial adjustment of more than 1,000 seconds."
              (inetd-configuration
               (inherit config)
               (entries (append (inetd-configuration-entries config)
-                               entries)))))))
+                               entries)))))
+   (description
+    "Start @command{inetd}, the @dfn{Internet superserver}.  It is responsible
+for listening on Internet sockets and spawning the corresponding services on
+demand.")))
 
 
 ;;;
@@ -671,7 +684,10 @@ HiddenServicePort ~a ~a~%"
                            (hidden-services
                             (append (tor-configuration-hidden-services config)
                                     services)))))
-                (default-value (tor-configuration))))
+                (default-value (tor-configuration))
+                (description
+                 "Run the @uref{https://torproject.org, Tor} anonymous
+networking daemon.")))
 
 (define* (tor-service #:optional
                       (config-file (plain-file "empty" ""))
@@ -691,7 +707,9 @@ and lines for hidden services added via @code{tor-hidden-service}.  Run
   ;; A type that extends Tor with hidden services.
   (service-type (name 'tor-hidden-service)
                 (extensions
-                 (list (service-extension tor-service-type list)))))
+                 (list (service-extension tor-service-type list)))
+                (description
+                 "Define a new Tor @dfn{hidden service}.")))
 
 (define (tor-hidden-service name mapping)
   "Define a new Tor @dfn{hidden service} called @var{name} and implementing
@@ -798,7 +816,10 @@ project's documentation} for more information."
                                           (const %bitlbee-accounts))
                        (service-extension activation-service-type
                                           (const %bitlbee-activation))))
-                (default-value (bitlbee-configuration))))
+                (default-value (bitlbee-configuration))
+                (description
+                 "Run @url{http://bitlbee.org,BitlBee}, a daemon that acts as
+a gateway between IRC and chat networks.")))
 
 (define* (bitlbee-service #:key (bitlbee bitlbee)
                           (interface "127.0.0.1") (port 6667)
@@ -862,7 +883,10 @@ configuration file."
                                           (const %wicd-activation))
 
                        ;; Add Wicd to the global profile.
-                       (service-extension profile-service-type list)))))
+                       (service-extension profile-service-type list)))
+                (description
+                 "Run @url{https://launchpad.net/wicd,Wicd}, a network
+management daemon that aims to simplify wired and wireless networking.")))
 
 (define* (wicd-service #:key (wicd wicd))
   "Return a service that runs @url{https://launchpad.net/wicd,Wicd}, a network
@@ -931,7 +955,11 @@ dns=" dns "
                                (const %network-manager-activation))
             ;; Add network-manager to the system profile.
             (service-extension profile-service-type config->package)))
-     (default-value (network-manager-configuration)))))
+     (default-value (network-manager-configuration))
+     (description
+      "Run @uref{https://wiki.gnome.org/Projects/NetworkManager,
+NetworkManager}, a network management daemon that aims to simplify wired and
+wireless networking."))))
 
 
 ;;;
@@ -985,7 +1013,10 @@ dns=" dns "
                                             connman-activation)
                          ;; Add connman to the system profile.
                          (service-extension profile-service-type
-                                            connman-package))))))
+                                            connman-package)))
+                  (description
+                   "Run @url{https://01.org/connman,Connman},
+a network connection manager."))))
 
 
 ;;;
@@ -1071,6 +1102,10 @@ dns=" dns "
           (service-extension profile-service-type
                              (compose list openvswitch-configuration-package))
           (service-extension shepherd-root-service-type
-                             openvswitch-shepherd-service)))))
+                             openvswitch-shepherd-service)))
+   (description
+    "Run @uref{http://www.openvswitch.org, Open vSwitch}, a multilayer virtual
+switch designed to enable massive network automation through programmatic
+extension.")))
 
 ;;; networking.scm ends here
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 18278502e4..4aa6fd501c 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -262,7 +262,7 @@ of index files."
 (define nginx-activation
   (match-lambda
     (($ <nginx-configuration> nginx log-directory run-directory server-blocks
-                              upstream-blocks config-file)
+                              upstream-blocks file)
      #~(begin
          (use-modules (guix build utils))
 
@@ -281,7 +281,7 @@ of index files."
          (mkdir-p (string-append #$run-directory "/logs"))
          ;; Check configuration file syntax.
          (system* (string-append #$nginx "/sbin/nginx")
-                  "-c" #$(or config-file
+                  "-c" #$(or file
                              (default-nginx-config nginx log-directory
                                run-directory server-blocks upstream-blocks))
                   "-t")))))
@@ -289,14 +289,14 @@ of index files."
 (define nginx-shepherd-service
   (match-lambda
     (($ <nginx-configuration> nginx log-directory run-directory server-blocks
-                              upstream-blocks config-file)
+                              upstream-blocks file)
      (let* ((nginx-binary (file-append nginx "/sbin/nginx"))
             (nginx-action
              (lambda args
                #~(lambda _
                    (zero?
                     (system* #$nginx-binary "-c"
-                             #$(or config-file
+                             #$(or file
                                    (default-nginx-config nginx log-directory
                                      run-directory server-blocks upstream-blocks))
                              #$@args))))))
diff --git a/gnu/services/xorg.scm b/gnu/services/xorg.scm
index 5a8ee6cd40..6200fa302a 100644
--- a/gnu/services/xorg.scm
+++ b/gnu/services/xorg.scm
@@ -135,6 +135,7 @@ Section \"Files\"
   ModulePath \"" xf86-input-mouse "/lib/xorg/modules/input\"
   ModulePath \"" xf86-input-synaptics "/lib/xorg/modules/input\"
   ModulePath \"" xorg-server "/lib/xorg/modules\"
+  ModulePath \"" xorg-server "/lib/xorg/modules/drivers\"
   ModulePath \"" xorg-server "/lib/xorg/modules/extensions\"
   ModulePath \"" xorg-server "/lib/xorg/modules/multimedia\"
 EndSection
diff --git a/gnu/system.scm b/gnu/system.scm
index 6b35e3c0c7..b6c087a031 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -54,6 +54,7 @@
   #:use-module (gnu system locale)
   #:use-module (gnu system pam)
   #:use-module (gnu system linux-initrd)
+  #:use-module (gnu system uuid)
   #:use-module (gnu system file-systems)
   #:use-module (gnu system mapped-devices)
   #:use-module (ice-9 match)
@@ -128,7 +129,14 @@
 (define (bootable-kernel-arguments kernel-arguments system.drv root-device)
   "Prepend extra arguments to KERNEL-ARGUMENTS that allow SYSTEM.DRV to be
 booted from ROOT-DEVICE"
-  (cons* (string-append "--root=" root-device)
+  (cons* (string-append "--root="
+                        (if (uuid? root-device)
+
+                            ;; Note: Always use the DCE format because that's
+                            ;; what (gnu build linux-boot) expects for the
+                            ;; '--root' kernel command-line option.
+                            (uuid->string (uuid-bytevector root-device) 'dce)
+                            root-device))
          #~(string-append "--system=" #$system.drv)
          #~(string-append "--load=" #$system.drv "/boot")
          kernel-arguments))
@@ -226,6 +234,15 @@ directly by the user."
 (define (read-boot-parameters port)
   "Read boot parameters from PORT and return the corresponding
 <boot-parameters> object or #f if the format is unrecognized."
+  (define device-sexp->device
+    (match-lambda
+      (('uuid (? symbol? type) (? bytevector? bv))
+       (bytevector->uuid bv type))
+      ((? bytevector? bv)                         ;old format
+       (bytevector->uuid bv 'dce))
+      ((? string? device)
+       device)))
+
   (match (read port)
     (('boot-parameters ('version 0)
                        ('label label) ('root-device root)
@@ -233,7 +250,7 @@ directly by the user."
                        rest ...)
      (boot-parameters
       (label label)
-      (root-device root)
+      (root-device (device-sexp->device root))
 
       (bootloader-name
        (match (assq 'bootloader-name rest)
@@ -261,8 +278,10 @@ directly by the user."
 
       (store-device
        (match (assq 'store rest)
+         (('store ('device #f) _ ...)
+          root-device)
          (('store ('device device) _ ...)
-          device)
+          (device-sexp->device device))
          (_                                       ;the old format
           ;; Root might be a device path like "/dev/sda1", which is not a
           ;; suitable GRUB device identifier.
@@ -289,16 +308,12 @@ The object has its kernel-arguments extended in order to make it bootable."
   (let* ((file (string-append system "/parameters"))
          (params (call-with-input-file file read-boot-parameters))
          (root (boot-parameters-root-device params))
-         (root-device (if (bytevector? root)
-                          (uuid->string root)
-                          root))
          (kernel-arguments (boot-parameters-kernel-arguments params)))
     (if params
       (boot-parameters
         (inherit params)
         (kernel-arguments (bootable-kernel-arguments kernel-arguments
-                                                     system
-                                                     root-device)))
+                                                     system root)))
       #f)))
 
 (define (boot-parameters->menu-entry conf)
@@ -597,6 +612,10 @@ fi
 # See <http://bugs.gnu.org/22650>.
 umask 022
 
+# Allow Hunspell-based applications (IceCat, LibreOffice, etc.) to
+# find dictionaries.
+export DICPATH=\"$HOME/.guix-profile/share/hunspell:/run/current-system/profile/share/hunspell\"
+
 # Allow GStreamer-based applications to find plugins.
 export GST_PLUGIN_PATH=\"$HOME/.guix-profile/lib/gstreamer-1.0\"
 
@@ -629,6 +648,11 @@ fi\n")))
        ("bashrc" ,#~#$bashrc)
        ("hosts" ,#~#$(or (operating-system-hosts-file os)
                          (default-/etc/hosts (operating-system-host-name os))))
+       ;; Write the operating-system-host-name to /etc/hostname to prevent
+       ;; NetworkManager from changing the system's hostname when connecting
+       ;; to certain networks.  Some discussion at
+       ;; https://lists.gnu.org/archive/html/help-guix/2017-09/msg00037.html
+       ("hostname" ,(plain-file "hostname" (operating-system-host-name os)))
        ("localtime" ,(file-append tzdata "/share/zoneinfo/"
                                   (operating-system-timezone os)))
        ("sudoers" ,(operating-system-sudoers-file os))))))
@@ -875,9 +899,7 @@ listed in OS.  The C library expects to find it under
   (mlet* %store-monad
       ((system      (operating-system-derivation os))
        (root-fs ->  (operating-system-root-file-system os))
-       (root-device -> (if (eq? 'uuid (file-system-title root-fs))
-                           (uuid->string (file-system-device root-fs))
-                           (file-system-device root-fs)))
+       (root-device -> (file-system-device root-fs))
        (params (operating-system-boot-parameters os system root-device))
        (entry -> (boot-parameters->menu-entry params))
        (bootloader-conf -> (operating-system-bootloader os)))
@@ -889,8 +911,7 @@ listed in OS.  The C library expects to find it under
   "Given FS, a <file-system> object, return a value suitable for use as the
 device in a <menu-entry>."
   (case (file-system-title fs)
-    ((uuid) (file-system-device fs))
-    ((label) (file-system-device fs))
+    ((uuid label device) (file-system-device fs))
     (else #f)))
 
 (define (operating-system-boot-parameters os system.drv root-device)
@@ -917,6 +938,14 @@ kernel arguments for that derivation to <boot-parameters>."
              (store-device (fs->boot-device store))
              (store-mount-point (file-system-mount-point store))))))
 
+(define (device->sexp device)
+  "Serialize DEVICE as an sexp (really, as an object with a read syntax.)"
+  (match device
+    ((? uuid? uuid)
+     `(uuid ,(uuid-type uuid) ,(uuid-bytevector uuid)))
+    (_
+     device)))
+
 (define* (operating-system-boot-parameters-file os #:optional (system.drv #f))
    "Return a file that describes the boot parameters of OS.  The primary use of
 this file is the reconstruction of GRUB menu entries for old configurations.
@@ -934,15 +963,28 @@ being stored into the \"parameters\" file)."
                  #~(boot-parameters
                     (version 0)
                     (label #$(boot-parameters-label params))
-                    (root-device #$(boot-parameters-root-device params))
+                    (root-device
+                     #$(device->sexp
+                        (boot-parameters-root-device params)))
                     (kernel #$(boot-parameters-kernel params))
                     (kernel-arguments
                      #$(boot-parameters-kernel-arguments params))
                     (initrd #$(boot-parameters-initrd params))
                     (bootloader-name #$(boot-parameters-bootloader-name params))
                     (store
-                     (device #$(boot-parameters-store-device params))
+                     (device
+                      #$(device->sexp (boot-parameters-store-device params)))
                      (mount-point #$(boot-parameters-store-mount-point params))))
                  #:set-load-path? #f)))
 
+(define-gexp-compiler (operating-system-compiler (os <operating-system>)
+                                                 system target)
+  ((store-lift
+    (lambda (store)
+      ;; XXX: This is not super elegant but we can't pass SYSTEM and TARGET to
+      ;; 'operating-system-derivation'.
+      (run-with-store store (operating-system-derivation os)
+                      #:system system
+                      #:target target)))))
+
 ;;; system.scm ends here
diff --git a/gnu/system/examples/bare-bones.tmpl b/gnu/system/examples/bare-bones.tmpl
index 459d241885..7e0c8fbee0 100644
--- a/gnu/system/examples/bare-bones.tmpl
+++ b/gnu/system/examples/bare-bones.tmpl
@@ -3,7 +3,7 @@
 
 (use-modules (gnu))
 (use-service-modules networking ssh)
-(use-package-modules admin)
+(use-package-modules screen ssh)
 
 (operating-system
   (host-name "komputilo")
@@ -40,7 +40,7 @@
                %base-user-accounts))
 
   ;; Globally-installed packages.
-  (packages (cons tcpdump %base-packages))
+  (packages (cons* screen openssh %base-packages))
 
   ;; Add services to the baseline: a DHCP client and
   ;; an SSH server.
diff --git a/gnu/system/file-systems.scm b/gnu/system/file-systems.scm
index bbac23fbdf..52f16676f5 100644
--- a/gnu/system/file-systems.scm
+++ b/gnu/system/file-systems.scm
@@ -20,9 +20,9 @@
   #:use-module (ice-9 match)
   #:use-module (srfi srfi-1)
   #:use-module (guix records)
-  #:use-module ((gnu build file-systems)
-                #:select (string->uuid uuid->string))
-  #:re-export (string->uuid
+  #:use-module (gnu system uuid)
+  #:re-export (uuid                               ;backward compatibility
+               string->uuid
                uuid->string)
   #:export (<file-system>
             file-system
@@ -44,7 +44,6 @@
             file-system->spec
             spec->file-system
             specification->file-system-mapping
-            uuid
 
             %fuse-control-file-system
             %binary-format-file-system
@@ -157,7 +156,10 @@ store--e.g., if FS is the root file system."
 initrd code."
   (match fs
     (($ <file-system> device title mount-point type flags options _ _ check?)
-     (list device title mount-point type flags options check?))))
+     (list (if (uuid? device)
+               (uuid-bytevector device)
+               device)
+           title mount-point type flags options check?))))
 
 (define (spec->file-system sexp)
   "Deserialize SEXP, a list, to the corresponding <file-system> object."
@@ -186,20 +188,6 @@ TARGET in the other system."
          (target spec)
          (writable? writable?)))))
 
-(define-syntax uuid
-  (lambda (s)
-    "Return the bytevector corresponding to the given UUID representation."
-    (syntax-case s ()
-      ((_ str)
-       (string? (syntax->datum #'str))
-       ;; A literal string: do the conversion at expansion time.
-       (let ((bv (string->uuid (syntax->datum #'str))))
-         (unless bv
-           (syntax-violation 'uuid "invalid UUID" s))
-         (datum->syntax #'str bv)))
-      ((_ str)
-       #'(string->uuid str)))))
-
 
 ;;;
 ;;; Common file systems.
diff --git a/gnu/system/install.scm b/gnu/system/install.scm
index 7f6ffe9582..eb362f91a8 100644
--- a/gnu/system/install.scm
+++ b/gnu/system/install.scm
@@ -31,6 +31,7 @@
   #:use-module (gnu packages bash)
   #:use-module (gnu packages bootloaders)
   #:use-module (gnu packages linux)
+  #:use-module (gnu packages ssh)
   #:use-module (gnu packages cryptsetup)
   #:use-module (gnu packages package-management)
   #:use-module (gnu packages disk)
@@ -214,6 +215,9 @@ You have been warned.  Thanks for being so brave.
                                                 (auto-login "root")
                                                 (login-pause? #t))))
 
+    (define bare-bones-os
+      (load "examples/bare-bones.tmpl"))
+
     (list (mingetty-service (mingetty-configuration
                              (tty "tty1")
                              (auto-login "root")))
@@ -283,7 +287,11 @@ You have been warned.  Thanks for being so brave.
           ;; connections to this system to work.
           (service special-files-service-type
                    `(("/bin/sh" ,(file-append (canonical-package bash)
-                                              "/bin/sh")))))))
+                                              "/bin/sh"))))
+
+          ;; Keep a reference to BARE-BONES-OS to make sure it can be
+          ;; installed without downloading/building anything.
+          (service gc-root-service-type (list bare-bones-os)))))
 
 (define %issue
   ;; Greeting.
@@ -337,9 +345,9 @@ Use Alt-F2 for documentation.
     (issue %issue)
     (services %installation-services)
 
-    ;; We don't need setuid programs so pass the empty list so we don't pull
-    ;; additional programs here.
-    (setuid-programs '())
+    ;; We don't need setuid programs, except for 'passwd', which can be handy
+    ;; if one is to allow remote SSH login to the machine being installed.
+    (setuid-programs (list (file-append shadow "/bin/passwd")))
 
     (pam-services
      ;; Explicitly allow for empty passwords.
@@ -352,6 +360,7 @@ Use Alt-F2 for documentation.
                      mdadm
                      dosfstools         ;mkfs.fat, for the UEFI boot partition
                      btrfs-progs
+                     openssh    ;we already have sshd, having ssh/scp can help
                      wireless-tools iw wpa-supplicant-minimal iproute
                      ;; XXX: We used to have GNU fdisk here, but as of version
                      ;; 2.0.0a, that pulls Guile 1.8, which takes unreasonable
diff --git a/gnu/system/mapped-devices.scm b/gnu/system/mapped-devices.scm
index 18b9f5b4b6..17cf6b7163 100644
--- a/gnu/system/mapped-devices.scm
+++ b/gnu/system/mapped-devices.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2017 Mark H Weaver <mhw@netris.org>
 ;;;
@@ -24,6 +24,7 @@
   #:use-module (guix modules)
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
+  #:use-module (gnu system uuid)
   #:autoload   (gnu packages cryptsetup) (cryptsetup-static)
   #:autoload   (gnu packages linux) (mdadm-static)
   #:use-module (srfi srfi-1)
@@ -99,7 +100,9 @@
 'cryptsetup'."
   (with-imported-modules (source-module-closure
                           '((gnu build file-systems)))
-    #~(let ((source #$source))
+    #~(let ((source #$(if (uuid? source)
+                          (uuid-bytevector source)
+                          source)))
         ;; XXX: 'use-modules' should be at the top level.
         (use-modules (rnrs bytevectors)           ;bytevector?
                      ((gnu build file-systems)
diff --git a/gnu/system/uuid.scm b/gnu/system/uuid.scm
new file mode 100644
index 0000000000..1dd6a11339
--- /dev/null
+++ b/gnu/system/uuid.scm
@@ -0,0 +1,265 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2016, 2017 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017 Danny Milosavljevic <dannym@scratchpost.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu system uuid)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-9)
+  #:use-module (rnrs bytevectors)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 vlist)
+  #:use-module (ice-9 regex)
+  #:use-module (ice-9 format)
+  #:export (uuid
+            uuid?
+            uuid-type
+            uuid-bytevector
+
+            bytevector->uuid
+
+            uuid->string
+            dce-uuid->string
+            string->uuid
+            string->dce-uuid
+            string->iso9660-uuid
+            string->ext2-uuid
+            string->ext3-uuid
+            string->ext4-uuid
+            string->btrfs-uuid
+            iso9660-uuid->string
+
+            ;; XXX: For lack of a better place.
+            sub-bytevector
+            latin1->string))
+
+
+;;;
+;;; Tools that lack a better place.
+;;;
+
+(define (sub-bytevector bv start size)
+  "Return a copy of the SIZE bytes of BV starting from offset START."
+  (let ((result (make-bytevector size)))
+    (bytevector-copy! bv start result 0 size)
+    result))
+
+(define (latin1->string bv terminator)
+  "Return a string of BV, a latin1 bytevector, or #f.  TERMINATOR is a predicate
+that takes a number and returns #t when a termination character is found."
+    (let ((bytes (take-while (negate terminator) (bytevector->u8-list bv))))
+      (if (null? bytes)
+          #f
+          (list->string (map integer->char bytes)))))
+
+
+;;;
+;;; DCE UUIDs.
+;;;
+
+(define-syntax %network-byte-order
+  (identifier-syntax (endianness big)))
+
+(define (dce-uuid->string uuid)
+  "Convert UUID, a 16-byte bytevector, to its string representation, something
+like \"6b700d61-5550-48a1-874c-a3d86998990e\"."
+  ;; See <https://tools.ietf.org/html/rfc4122>.
+  (let ((time-low  (bytevector-uint-ref uuid 0 %network-byte-order 4))
+        (time-mid  (bytevector-uint-ref uuid 4 %network-byte-order 2))
+        (time-hi   (bytevector-uint-ref uuid 6 %network-byte-order 2))
+        (clock-seq (bytevector-uint-ref uuid 8 %network-byte-order 2))
+        (node      (bytevector-uint-ref uuid 10 %network-byte-order 6)))
+    (format #f "~8,'0x-~4,'0x-~4,'0x-~4,'0x-~12,'0x"
+            time-low time-mid time-hi clock-seq node)))
+
+(define %uuid-rx
+  ;; The regexp of a UUID.
+  (make-regexp "^([[:xdigit:]]{8})-([[:xdigit:]]{4})-([[:xdigit:]]{4})-([[:xdigit:]]{4})-([[:xdigit:]]{12})$"))
+
+(define (string->dce-uuid str)
+  "Parse STR as a DCE UUID (see <https://tools.ietf.org/html/rfc4122>) and
+return its contents as a 16-byte bytevector.  Return #f if STR is not a valid
+UUID representation."
+  (and=> (regexp-exec %uuid-rx str)
+         (lambda (match)
+           (letrec-syntax ((hex->number
+                            (syntax-rules ()
+                              ((_ index)
+                               (string->number (match:substring match index)
+                                               16))))
+                           (put!
+                            (syntax-rules ()
+                              ((_ bv index (number len) rest ...)
+                               (begin
+                                 (bytevector-uint-set! bv index number
+                                                       (endianness big) len)
+                                 (put! bv (+ index len) rest ...)))
+                              ((_ bv index)
+                               bv))))
+             (let ((time-low  (hex->number 1))
+                   (time-mid  (hex->number 2))
+                   (time-hi   (hex->number 3))
+                   (clock-seq (hex->number 4))
+                   (node      (hex->number 5))
+                   (uuid      (make-bytevector 16)))
+               (put! uuid 0
+                     (time-low 4) (time-mid 2) (time-hi 2)
+                     (clock-seq 2) (node 6)))))))
+
+
+;;;
+;;; ISO-9660.
+;;;
+
+;; <http://www.ecma-international.org/publications/files/ECMA-ST/Ecma-119.pdf>.
+
+(define %iso9660-uuid-rx
+  ;;                   Y                m                d                H                M                S                ss
+  (make-regexp "^([[:digit:]]{4})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})-([[:digit:]]{2})$"))
+(define (string->iso9660-uuid str)
+  "Parse STR as a ISO9660 UUID (which is really a timestamp - see /dev/disk/by-uuid).
+Return its contents as a 16-byte bytevector.  Return #f if STR is not a valid
+ISO9660 UUID representation."
+  (and=> (regexp-exec %iso9660-uuid-rx str)
+         (lambda (match)
+           (letrec-syntax ((match-numerals
+                            (syntax-rules ()
+                              ((_ index (name rest ...) body)
+                               (let ((name (match:substring match index)))
+                                 (match-numerals (+ 1 index) (rest ...) body)))
+                              ((_ index () body)
+                               body))))
+            (match-numerals 1 (year month day hour minute second hundredths)
+              (string->utf8 (string-append year month day
+                                           hour minute second hundredths)))))))
+(define (iso9660-uuid->string uuid)
+  "Given an UUID bytevector, return its timestamp string."
+  (define (digits->string bytes)
+    (latin1->string bytes (lambda (c) #f)))
+  (let* ((year (sub-bytevector uuid 0 4))
+         (month (sub-bytevector uuid 4 2))
+         (day (sub-bytevector uuid 6 2))
+         (hour (sub-bytevector uuid 8 2))
+         (minute (sub-bytevector uuid 10 2))
+         (second (sub-bytevector uuid 12 2))
+         (hundredths (sub-bytevector uuid 14 2))
+         (parts (list year month day hour minute second hundredths)))
+    (string-append (string-join (map digits->string parts) "-"))))
+
+
+;;;
+;;; FAT32.
+;;;
+
+(define-syntax %fat32-endianness
+  ;; Endianness of FAT file systems.
+  (identifier-syntax (endianness little)))
+
+(define (fat32-uuid->string uuid)
+  "Convert fat32 UUID, a 4-byte bytevector, to its string representation."
+  (let ((high  (bytevector-uint-ref uuid 0 %fat32-endianness 2))
+        (low (bytevector-uint-ref uuid 2 %fat32-endianness 2)))
+    (format #f "~:@(~x-~x~)" low high)))
+
+
+;;;
+;;; Generic interface.
+;;;
+
+(define string->ext2-uuid string->dce-uuid)
+(define string->ext3-uuid string->dce-uuid)
+(define string->ext4-uuid string->dce-uuid)
+(define string->btrfs-uuid string->dce-uuid)
+
+(define-syntax vhashq
+  (syntax-rules (=>)
+    ((_)
+     vlist-null)
+    ((_ (key others ... => value) rest ...)
+     (vhash-consq key value
+                  (vhashq (others ... => value) rest ...)))
+    ((_ (=> value) rest ...)
+     (vhashq rest ...))))
+
+(define %uuid-parsers
+  (vhashq
+   ('dce 'ext2 'ext3 'ext4 'btrfs 'luks => string->dce-uuid)
+   ('iso9660 => string->iso9660-uuid)))
+
+(define %uuid-printers
+  (vhashq
+   ('dce 'ext2 'ext3 'ext4 'btrfs 'luks => dce-uuid->string)
+   ('iso9660 => iso9660-uuid->string)
+   ('fat32 'fat => fat32-uuid->string)))
+
+(define* (string->uuid str #:optional (type 'dce))
+  "Parse STR as a UUID of the given TYPE.  On success, return the
+corresponding bytevector; otherwise return #f."
+  (match (vhash-assq type %uuid-parsers)
+    (#f #f)
+    ((_ . (? procedure? parse)) (parse str))))
+
+;; High-level UUID representation that carries its type with it.
+;;
+;; This is necessary to serialize bytevectors with the right printer in some
+;; circumstances.  For instance, GRUB "search --fs-uuid" command compares the
+;; string representation of UUIDs, not the raw bytes; thus, when emitting a
+;; GRUB 'search' command, we need to procedure the right string representation
+;; (see <https://debbugs.gnu.org/cgi/bugreport.cgi?msg=52;att=0;bug=27735>).
+(define-record-type <uuid>
+  (make-uuid type bv)
+  uuid?
+  (type  uuid-type)                               ;'dce | 'iso9660 | ...
+  (bv    uuid-bytevector))
+
+(define* (bytevector->uuid bv #:optional (type 'dce))
+  "Return a UUID object make of BV and TYPE."
+  (make-uuid type bv))
+
+(define-syntax uuid
+  (lambda (s)
+    "Return the UUID object corresponding to the given UUID representation."
+    (syntax-case s (quote)
+      ((_ str (quote type))
+       (and (string? (syntax->datum #'str))
+            (identifier? #'type))
+       ;; A literal string: do the conversion at expansion time.
+       (let ((bv (string->uuid (syntax->datum #'str)
+                               (syntax->datum #'type))))
+         (unless bv
+           (syntax-violation 'uuid "invalid UUID" s))
+         #`(make-uuid 'type #,(datum->syntax s bv))))
+      ((_ str)
+       (string? (syntax->datum #'str))
+       #'(uuid str 'dce))
+      ((_ str)
+       #'(make-uuid 'dce (string->uuid str 'dce)))
+      ((_ str type)
+       #'(make-uuid type (string->uuid str type))))))
+
+(define uuid->string
+  ;; Convert the given bytevector or UUID object, to the corresponding UUID
+  ;; string representation.
+  (match-lambda*
+    (((? bytevector? bv))
+     (uuid->string bv 'dce))
+    (((? bytevector? bv) type)
+     (match (vhash-assq type %uuid-printers)
+       (#f #f)
+       ((_ . (? procedure? unparse)) (unparse bv))))
+    (((? uuid? uuid))
+     (uuid->string (uuid-bytevector uuid) (uuid-type uuid)))))
diff --git a/gnu/system/vm.scm b/gnu/system/vm.scm
index 4494af0031..78143e4f7a 100644
--- a/gnu/system/vm.scm
+++ b/gnu/system/vm.scm
@@ -57,9 +57,11 @@
   #:use-module (gnu system file-systems)
   #:use-module (gnu system)
   #:use-module (gnu services)
+  #:use-module (gnu system uuid)
 
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-26)
+  #:use-module (rnrs bytevectors)
   #:use-module (ice-9 match)
 
   #:export (expression->derivation-in-linux-vm
@@ -192,6 +194,7 @@ made available under the /xchg CIFS share."
                         os-drv
                         bootcfg-drv
                         bootloader
+                        register-closures?
                         (inputs '()))
   "Return a bootable, stand-alone iso9660 image.
 
@@ -207,8 +210,13 @@ INPUTS is a list of inputs (as for packages)."
          (let ((inputs
                 '#$(append (list qemu parted e2fsprogs dosfstools xorriso)
                            (map canonical-package
-                                (list sed grep coreutils findutils gawk))))
+                                (list sed grep coreutils findutils gawk))
+                           (if register-closures? (list guix) '())))
+
 
+               (graphs     '#$(match inputs
+                                   (((names . _) ...)
+                                    names)))
                ;; This variable is unused but allows us to add INPUTS-TO-COPY
                ;; as inputs.
                (to-register
@@ -222,8 +230,11 @@ INPUTS is a list of inputs (as for packages)."
                                #$bootcfg-drv
                                #$os-drv
                                "/xchg/guixsd.iso"
+                               #:register-closures? #$register-closures?
+                               #:closures graphs
                                #:volume-id #$file-system-label
-                               #:volume-uuid #$file-system-uuid)
+                               #:volume-uuid #$(and=> file-system-uuid
+                                                      uuid-bytevector))
            (reboot))))
    #:system system
    #:make-disk-image? #f
@@ -238,6 +249,7 @@ INPUTS is a list of inputs (as for packages)."
                      (disk-image-format "qcow2")
                      (file-system-type "ext4")
                      file-system-label
+                     file-system-uuid
                      os-drv
                      bootcfg-drv
                      bootloader
@@ -247,7 +259,10 @@ INPUTS is a list of inputs (as for packages)."
   "Return a bootable, stand-alone QEMU image of type DISK-IMAGE-FORMAT (e.g.,
 'qcow2' or 'raw'), with a root partition of type FILE-SYSTEM-TYPE.
 Optionally, FILE-SYSTEM-LABEL can be specified as the volume name for the root
-partition.  The returned image is a full disk image that runs OS-DERIVATION,
+partition; likewise FILE-SYSTEM-UUID, if true, specifies the UUID of the root
+partition (a UUID object).
+
+The returned image is a full disk image that runs OS-DERIVATION,
 with a GRUB installation that uses GRUB-CONFIGURATION as its configuration
 file (GRUB-CONFIGURATION must be the name of a file in the VM.)
 
@@ -297,6 +312,8 @@ the image."
                   (partitions (list (partition
                                      (size root-size)
                                      (label #$file-system-label)
+                                     (uuid #$(and=> file-system-uuid
+                                                    uuid-bytevector))
                                      (file-system #$file-system-type)
                                      (flags '(boot))
                                      (initializer initialize))
@@ -334,6 +351,35 @@ the image."
 ;;; VM and disk images.
 ;;;
 
+(define* (operating-system-uuid os #:optional (type 'dce))
+  "Compute UUID object with a deterministic \"UUID\" for OS, of the given
+TYPE (one of 'iso9660 or 'dce).  Return a UUID object."
+  (if (eq? type 'iso9660)
+      (let ((pad (compose (cut string-pad <> 2 #\0)
+                          number->string))
+            (h   (hash (operating-system-services os) 3600)))
+        (bytevector->uuid
+         (string->iso9660-uuid
+          (string-append "1970-01-01-"
+                         (pad (hash (operating-system-host-name os) 24)) "-"
+                         (pad (quotient h 60)) "-"
+                         (pad (modulo h 60)) "-"
+                         (pad (hash (operating-system-file-systems os) 100))))
+         'iso9660))
+      (bytevector->uuid
+       (uint-list->bytevector
+        (list (hash file-system-type
+                    (expt 2 32))
+              (hash (operating-system-host-name os)
+                    (expt 2 32))
+              (hash (operating-system-services os)
+                    (expt 2 32))
+              (hash (operating-system-file-systems os)
+                    (expt 2 32)))
+        (endianness little)
+        4)
+       type)))
+
 (define* (system-disk-image os
                             #:key
                             (name "disk-image")
@@ -350,12 +396,20 @@ to USB sticks meant to be read-only."
     (if (string=? "iso9660" file-system-type)
         string-upcase
         identity))
+
   (define root-label
-    ;; Volume name of the root file system.  Since we don't know which device
-    ;; will hold it, we use the volume name to find it (using the UUID would
-    ;; be even better, but somewhat less convenient.)
+    ;; Volume name of the root file system.
     (normalize-label "GuixSD_image"))
 
+  (define root-uuid
+    ;; UUID of the root file system, computed in a deterministic fashion.
+    ;; This is what we use to locate the root file system so it has to be
+    ;; different from the user's own file system UUIDs.
+    (operating-system-uuid os
+                           (if (string=? file-system-type "iso9660")
+                               'iso9660
+                               'dce)))
+
   (define file-systems-to-keep
     (remove (lambda (fs)
               (string=? (file-system-mount-point fs) "/"))
@@ -379,8 +433,8 @@ to USB sticks meant to be read-only."
               ;; Force our own root file system.
               (file-systems (cons (file-system
                                     (mount-point "/")
-                                    (device root-label)
-                                    (title 'label)
+                                    (device root-uuid)
+                                    (title 'uuid)
                                     (type file-system-type))
                                   file-systems-to-keep)))))
 
@@ -389,8 +443,9 @@ to USB sticks meant to be read-only."
       (if (string=? "iso9660" file-system-type)
           (iso9660-image #:name name
                          #:file-system-label root-label
-                         #:file-system-uuid #f
+                         #:file-system-uuid root-uuid
                          #:os-drv os-drv
+                         #:register-closures? #t
                          #:bootcfg-drv bootcfg
                          #:bootloader (bootloader-configuration-bootloader
                                         (operating-system-bootloader os))
@@ -403,11 +458,9 @@ to USB sticks meant to be read-only."
                                     (operating-system-bootloader os))
                       #:disk-image-size disk-image-size
                       #:disk-image-format "raw"
-                      #:file-system-type (if (string=? "iso9660"
-                                                       file-system-type)
-                                             "ext4"
-                                             file-system-type)
+                      #:file-system-type file-system-type
                       #:file-system-label root-label
+                      #:file-system-uuid root-uuid
                       #:copy-inputs? #t
                       #:register-closures? #t
                       #:inputs `(("system" ,os-drv)
diff --git a/gnu/tests/base.scm b/gnu/tests/base.scm
index 5b40d4514a..959da31a60 100644
--- a/gnu/tests/base.scm
+++ b/gnu/tests/base.scm
@@ -250,19 +250,8 @@ info --version")
 
               ;; It can take a while before the shell commands are executed.
               (marionette-eval '(use-modules (rnrs io ports)) marionette)
-              (marionette-eval
-               '(let loop ((i 0))
-                  (catch 'system-error
-                    (lambda ()
-                      (call-with-input-file "/root/logged-in"
-                        get-string-all))
-                    (lambda args
-                      (if (and (< i 15) (= ENOENT (system-error-errno args)))
-                          (begin
-                            (sleep 1)
-                            (loop (+ i 1)))
-                          (apply throw args)))))
-               marionette)))
+              (wait-for-file "/root/logged-in" marionette
+                             #:read 'get-string-all)))
 
           ;; There should be one utmpx entry for the user logged in on tty1.
           (test-equal "utmpx entry"
diff --git a/gnu/tests/desktop.scm b/gnu/tests/desktop.scm
new file mode 100644
index 0000000000..be64c4e7e5
--- /dev/null
+++ b/gnu/tests/desktop.scm
@@ -0,0 +1,105 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu tests desktop)
+  #:use-module (gnu tests)
+  #:use-module (gnu services)
+  #:use-module (gnu services dbus)
+  #:use-module (gnu services desktop)
+  #:use-module (gnu system vm)
+  #:use-module (guix gexp)
+  #:use-module (srfi srfi-1)
+  #:export (%test-elogind))
+
+
+;;;
+;;; Elogind.
+;;;
+
+(define (run-elogind-test vm)
+  (define test
+    (with-imported-modules '((gnu build marionette)
+                             (guix build syscalls))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (guix build syscalls)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette '(#$vm)))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "elogind")
+
+          ;; Log in as root on tty1, and check what 'loginctl' returns.
+          (test-equal "login on tty1"
+            '(("c1" "0" "root" "seat0" "/dev/tty1") ;session
+              ("seat0")                             ;seat
+              ("0" "root"))                         ;user
+
+            (begin
+              ;; Wait for tty1.
+              (marionette-eval
+               '(begin
+                  (use-modules (gnu services herd))
+                  (start-service 'term-tty1))
+               marionette)
+              (marionette-control "sendkey ctrl-alt-f1" marionette)
+
+              ;; Now we can type.
+              (marionette-type "root\n" marionette)
+              (marionette-type "loginctl list-users --no-legend > users\n"
+                               marionette)
+              (marionette-type "loginctl list-seats --no-legend > seats\n"
+                               marionette)
+              (marionette-type "loginctl list-sessions --no-legend > sessions\n"
+                               marionette)
+
+
+              ;; Read the three files.
+              (marionette-eval '(use-modules (rnrs io ports)) marionette)
+              (let ((guest-file (lambda (file)
+                                  (string-tokenize
+                                   (wait-for-file file marionette
+                                                  #:read 'get-string-all)))))
+                (list (guest-file "/root/sessions")
+                      (guest-file "/root/seats")
+                      (guest-file "/root/users")))))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "elogind" test))
+
+(define %test-elogind
+  (system-test
+   (name "elogind")
+   (description
+    "Test whether we can log in when elogind is enabled, and whether
+'loginctl' reports accurate user, session, and seat information.")
+   (value
+    (let ((os (marionette-operating-system
+               (simple-operating-system
+                (service elogind-service-type)
+                (service polkit-service-type)
+                (service dbus-root-service-type))
+               #:imported-modules '((gnu services herd)
+                                    (guix combinators)))))
+      (run-elogind-test (virtual-machine os))))))
diff --git a/gnu/tests/install.scm b/gnu/tests/install.scm
index 866bf885ce..49743860e5 100644
--- a/gnu/tests/install.scm
+++ b/gnu/tests/install.scm
@@ -37,6 +37,7 @@
   #:use-module (guix utils)
   #:export (%test-installed-os
             %test-installed-extlinux-os
+            %test-iso-image-installer
             %test-separate-store-os
             %test-separate-home-os
             %test-raid-root-os
@@ -196,6 +197,7 @@ reboot\n")
                              (kernel-arguments '("console=ttyS0")))
                            #:imported-modules '((gnu services herd)
                                                 (guix combinators))))
+                      (installation-disk-image-file-system-type "ext4")
                       (target-size (* 1200 MiB)))
   "Run SCRIPT (a shell script following the GuixSD installation procedure) in
 OS to install TARGET-OS.  Return a VM image of TARGET-SIZE bytes containing
@@ -213,7 +215,9 @@ packages defined in installation-os."
                        (image  (system-disk-image
                                 (operating-system-with-gc-roots
                                  os (list target))
-                                #:disk-image-size (* 1500 MiB))))
+                                #:disk-image-size (* 1500 MiB)
+                                #:file-system-type
+                                installation-disk-image-file-system-type)))
     (define install
       (with-imported-modules '((guix build utils)
                                (gnu build marionette))
@@ -229,16 +233,25 @@ packages defined in installation-os."
 
             (define marionette
               (make-marionette
-               (cons (which #$(qemu-command system))
-                     (cons* "-no-reboot" "-m" "800"
-                            "-drive"
-                            (string-append "file=" #$image
-                                           ",if=virtio,readonly")
-                            "-drive"
-                            (string-append "file=" #$output ",if=virtio")
-                            (if (file-exists? "/dev/kvm")
-                                '("-enable-kvm")
-                                '())))))
+               `(,(which #$(qemu-command system))
+                 "-no-reboot"
+                 "-m" "800"
+                 #$@(cond
+                     ((string=? "ext4" installation-disk-image-file-system-type)
+                      #~("-drive"
+                         ,(string-append "file=" #$image
+                                         ",if=virtio,readonly")))
+                     ((string=? "iso9660" installation-disk-image-file-system-type)
+                      #~("-cdrom" #$image))
+                     (else
+                      (error
+                       "unsupported installation-disk-image-file-system-type:"
+                       installation-disk-image-file-system-type)))
+                 "-drive"
+                 ,(string-append "file=" #$output ",if=virtio")
+                 ,@(if (file-exists? "/dev/kvm")
+                       '("-enable-kvm")
+                       '()))))
 
             (pk 'uname (marionette-eval '(uname) marionette))
 
@@ -314,6 +327,81 @@ per %test-installed-os, this test is expensive in terms of CPU and storage.")
 
 
 ;;;
+;;; Installation through an ISO image.
+;;;
+
+(define-os-with-source (%minimal-os-on-vda %minimal-os-on-vda-source)
+  ;; The OS we want to install.
+  (use-modules (gnu) (gnu tests) (srfi srfi-1))
+
+  (operating-system
+    (host-name "liberigilo")
+    (timezone "Europe/Paris")
+    (locale "en_US.UTF-8")
+
+    (bootloader (grub-configuration (target "/dev/vda")))
+    (kernel-arguments '("console=ttyS0"))
+    (file-systems (cons (file-system
+                          (device "my-root")
+                          (title 'label)
+                          (mount-point "/")
+                          (type "ext4"))
+                        %base-file-systems))
+    (users (cons (user-account
+                  (name "alice")
+                  (comment "Bob's sister")
+                  (group "users")
+                  (supplementary-groups '("wheel" "audio" "video"))
+                  (home-directory "/home/alice"))
+                 %base-user-accounts))
+    (services (cons (service marionette-service-type
+                             (marionette-configuration
+                              (imported-modules '((gnu services herd)
+                                                  (guix combinators)))))
+                    %base-services))))
+
+(define %simple-installation-script-for-/dev/vda
+  ;; Shell script of a simple installation.
+  "\
+. /etc/profile
+set -e -x
+guix --version
+
+export GUIX_BUILD_OPTIONS=--no-grafts
+guix build isc-dhcp
+parted --script /dev/vda mklabel gpt \\
+  mkpart primary ext2 1M 3M \\
+  mkpart primary ext2 3M 1G \\
+  set 1 boot on \\
+  set 1 bios_grub on
+mkfs.ext4 -L my-root /dev/vda2
+mount /dev/vda2 /mnt
+df -h /mnt
+herd start cow-store /mnt
+mkdir /mnt/etc
+cp /etc/target-config.scm /mnt/etc/config.scm
+guix system init /mnt/etc/config.scm /mnt --no-substitutes
+sync
+reboot\n")
+
+(define %test-iso-image-installer
+  (system-test
+   (name "iso-image-installer")
+   (description
+    "")
+   (value
+    (mlet* %store-monad ((image   (run-install
+                                   %minimal-os-on-vda
+                                   %minimal-os-on-vda-source
+                                   #:script
+                                   %simple-installation-script-for-/dev/vda
+                                   #:installation-disk-image-file-system-type
+                                   "iso9660"))
+                         (command (qemu-command/writable-image image)))
+      (run-basic-test %minimal-os-on-vda command name)))))
+
+
+;;;
 ;;; Separate /home.
 ;;;