Merge branch 'master' into core-updates

27 files changed, 924 insertions, 629 deletions

diff --git a/gnu/packages/patches/arb-ldconfig.patch b/gnu/packages/patches/arb-ldconfig.patch
deleted file mode 100644
index 478ec5a6f0..0000000000
--- a/gnu/packages/patches/arb-ldconfig.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -u -r arb-2.8.1.orig/configure arb-2.8.1/configure
---- arb-2.8.1.orig/configure	2015-12-31 17:30:01.000000000 +0100
-+++ arb-2.8.1/configure	2016-01-20 16:41:41.336726596 +0100
-@@ -647,6 +647,7 @@
- echo "ARB_SHARED=$SHARED" >> Makefile
- echo "ARB_LIB=$ARB_LIB" >> Makefile
- echo "ARB_LIBNAME=$ARB_LIBNAME" >> Makefile
-+echo "ARB_MAJOR=$ARB_MAJOR" >> Makefile
- echo "ARB_SOLIB=$ARB_SOLIB" >> Makefile
- echo "EXEEXT=$EXEEXT" >> Makefile
- echo "PREFIX=$PREFIX" >> Makefile
-diff -u -r arb-2.8.1.orig/Makefile.in arb-2.8.1/Makefile.in
---- arb-2.8.1.orig/Makefile.in	2015-12-31 17:30:01.000000000 +0100
-+++ arb-2.8.1/Makefile.in	2016-01-20 16:30:32.575298517 +0100
-@@ -101,6 +101,7 @@
- 		$(LDCONFIG) -n "$(CURDIR)"; \
- 	fi
- 	ln -sf "$(ARB_LIB)" "$(ARB_LIBNAME)"; \
-+	ln -sf "$(ARB_LIB)" "$(ARB_LIBNAME).$(ARB_MAJOR)"; \
- 
- libarb.a: $(OBJS) $(LIB_SOURCES) $(EXT_SOURCES) $(HEADERS) $(EXT_HEADERS) | build build/interfaces
- 	$(AT)$(foreach ext, $(EXTENSIONS), $(foreach dir, $(patsubst $(ext)/%.h, %, $(wildcard $(ext)/*.h)), mkdir -p build/$(dir); BUILD_DIR=$(CURDIR)/build/$(dir); export BUILD_DIR; MOD_DIR=$(dir); export MOD_DIR; $(MAKE) -f $(CURDIR)/Makefile.subdirs -C $(ext)/$(dir) static || exit $$?;))
diff --git a/gnu/packages/patches/gnupg-2.1-fix-Y2038-test-failure.patch b/gnu/packages/patches/gnupg-2.1-fix-Y2038-test-failure.patch
new file mode 100644
index 0000000000..b3a198c499
--- /dev/null
+++ b/gnu/packages/patches/gnupg-2.1-fix-Y2038-test-failure.patch
@@ -0,0 +1,67 @@
+Fix a Y2038 test failure on systems where time_t is a signed 32-bit value:
+
+https://bugs.gnupg.org/gnupg/issue2988
+
+Patch copied from upstream source repository:
+
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=de3838372ae3cdecbd83eea2c53c8e2656d93052
+
+From de3838372ae3cdecbd83eea2c53c8e2656d93052 Mon Sep 17 00:00:00 2001
+From: Justus Winter <justus@g10code.com>
+Date: Tue, 7 Mar 2017 12:18:59 +0100
+Subject: [PATCH] tests: Avoid overflowing signed 32 bit time_t.
+
+* tests/openpgp/quick-key-manipulation.scm: Use expiration times in
+the year 2038 instead of 2105 to avoid overflowing 32 bit time_t.
+time_t is used internally to parse the expiraton time from the iso
+timestamp.
+
+GnuPG-bug-id: 2988
+Signed-off-by: Justus Winter <justus@g10code.com>
+---
+ tests/openpgp/quick-key-manipulation.scm | 15 +++++++++++----
+ 1 file changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
+index 10f0bfe21..08ef62613 100755
+--- a/tests/openpgp/quick-key-manipulation.scm
++++ b/tests/openpgp/quick-key-manipulation.scm
+@@ -125,8 +125,13 @@
+    (default default never)
+    (rsa "sign auth encr" "seconds=600") ;; GPGME uses this
+    (rsa "auth,encr" "2") ;; "without a letter, days is assumed"
+-   (rsa "sign" "2105-01-01") ;; "last year GnuPG can represent is 2105"
+-   (rsa "sign" "21050101T115500") ;; "last year GnuPG can represent is 2105"
++   ;; Sadly, the timestamp is truncated by the use of time_t on
++   ;; systems where time_t is a signed 32 bit value.
++   (rsa "sign" "2038-01-01")      ;; unix millennium
++   (rsa "sign" "20380101T115500") ;; unix millennium
++   ;; Once fixed, we can use later timestamps:
++   ;; (rsa "sign" "2105-01-01")      ;; "last year GnuPG can represent is 2105"
++   ;; (rsa "sign" "21050101T115500") ;; "last year GnuPG can represent is 2105"
+    (rsa sign "2d")
+    (rsa1024 sign "2w")
+    (rsa2048 encr "2m")
+@@ -157,7 +162,8 @@
+   (lambda (subkey)
+     (assert (= 1 (:alg subkey)))
+     (assert (string-contains? (:cap subkey) "s"))
+-    (assert (time-matches? 4260207600 ;; 2105-01-01
++    (assert (time-matches? 2145916800    ;; 2038-01-01
++			   ;; 4260207600 ;; 2105-01-01
+ 			   (string->number (:expire subkey))
+ 			   ;; This is off by 12h, but I guess it just
+ 			   ;; choses the middle of the day.
+@@ -165,7 +171,8 @@
+   (lambda (subkey)
+     (assert (= 1 (:alg subkey)))
+     (assert (string-contains? (:cap subkey) "s"))
+-    (assert (time-matches? 4260254100 ;; UTC 2105-01-01 11:55:00
++    (assert (time-matches? 2145959700    ;; UTC 2038-01-01 11:55:00
++			   ;; 4260254100 ;; UTC 2105-01-01 11:55:00
+ 			   (string->number (:expire subkey))
+ 			   (minutes->seconds 5))))
+   (lambda (subkey)
+-- 
+2.12.0
+
diff --git a/gnu/packages/patches/gst-plugins-base-fix-test-on-32bit.patch b/gnu/packages/patches/gst-plugins-base-fix-test-on-32bit.patch
deleted file mode 100644
index 4c6c7ed06e..0000000000
--- a/gnu/packages/patches/gst-plugins-base-fix-test-on-32bit.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-This fixes a test failure on i686.
-
-Patch copied from upstream source repository:
-
-https://cgit.freedesktop.org/gstreamer/gst-plugins-base/commit/?id=5e2e111627871c566ffc6607eda8f4ef4699d040
-
-From 5e2e111627871c566ffc6607eda8f4ef4699d040 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
-Date: Thu, 2 Feb 2017 14:56:39 +0200
-Subject: [PATCH] multifdsink: Make sure to use a 64 bit integer for the
- units-max property
-
----
- tests/check/elements/multifdsink.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tests/check/elements/multifdsink.c b/tests/check/elements/multifdsink.c
-index af138cc92..951b1b9fa 100644
---- a/tests/check/elements/multifdsink.c
-+++ b/tests/check/elements/multifdsink.c
-@@ -869,7 +869,7 @@ GST_START_TEST (test_client_kick)
-   gint i, initial_buffers = 3, num_buffers = 0;
- 
-   sink = setup_multifdsink ();
--  g_object_set (sink, "units-max", initial_buffers, NULL);
-+  g_object_set (sink, "units-max", (gint64) initial_buffers, NULL);
- 
-   fail_if (pipe (pfd1) == -1);
-   fail_if (pipe (pfd2) == -1);
--- 
-2.11.0
-
diff --git a/gnu/packages/patches/jacal-fix-texinfo.patch b/gnu/packages/patches/jacal-fix-texinfo.patch
new file mode 100644
index 0000000000..83e44a3164
--- /dev/null
+++ b/gnu/packages/patches/jacal-fix-texinfo.patch
@@ -0,0 +1,92 @@
+Fix the broken Texinfo in the Jacal package documentation
+
+--- jacal/jacal.texi,orig	2017-02-23 20:35:55.303980444 +0100
++++ jacal/jacal.texi	2017-02-23 20:53:14.539024674 +0100
+@@ -343,7 +343,7 @@
+ 
+ With the standard input grammar, the precedence of @samp{-} as a prefix
+ behaves strangely.  @code{a^-b*c} becomes @code{a^(-b*c)} while
+-@code{@result{a^b*c} (a^b)*c}.
++@code{a^b*c @result{} (a^b)*c}.
+ 
+ Using @code{divide} to divide a polynomial by an integer does not work.
+ 
+@@ -675,8 +675,9 @@
+ e1: ---------
+         a
+ @end example
++@end deffn
+ 
+-@deffnx Command suchthat var exp
++@deffn Command suchthat var exp
+ 
+ If an expression rather than an equation is given to @code{suchthat}, it
+ is as though the equation @code{@var{exp}=0} was given.
+@@ -688,8 +689,9 @@
+ e2: ---------
+         a
+ @end example
++@end deffn
+ 
+-@deffnx Operator | var exp_or_eqn
++@deffn Operator | var exp_or_eqn
+ 
+ An alternative infix notation is also available for @code{suchthat}.
+ 
+@@ -857,8 +859,9 @@
+ 
+ Returns the degree of polynomial or equation @var{poly} in variable
+ @var{var}.
++@end deffn
+ 
+-@deffnx Operator degree poly
++@deffn Operator degree poly
+ 
+ Returns the total-degree, the degree of its highest degree monomial,
+ of polynomial or equation @var{poly}.
+@@ -1016,10 +1019,12 @@
+ Returns @var{poly1} reduced with respect to @var{poly2} (or @var{eqn})
+ and @var{var}.  If @var{poly2} is univariate, the third argument is not
+ needed.
++@end deffn
+ 
+-@deffnx Command mod poly1 n
++@deffn Command mod poly1 n
+ Returns @var{poly1} with all the coefficients taken modulo @var{n}.
+-@deffnx Command mod poly1
++@end deffn
++@deffn Command mod poly1
+ Returns @var{poly1} with all the coefficients taken modulo the
+ current modulus.
+ 
+@@ -1220,8 +1225,9 @@
+ e1: -1 2  3 5
+ @end group
+ @end example
++@end deffn
+ 
+-@deffnx Command factor polyratio
++@deffn Command factor polyratio
+ Given a univariate ratio of polynomials @var{polyratio}, returns a
+ matrix of factors and exponents.
+ 
+@@ -2028,7 +2034,7 @@
+ formed from the pair-wise products of components of the inputs.  For
+ example, for the input tensors @code{x[a,b]} and @code{y[c]}
+ @example
+-@result{z:tmult(x,y);} z[a,b,c] = x[a,b]*y[c]
++z:tmult(x,y); @result{} z[a,b,c] = x[a,b]*y[c]
+ @end example
+ 
+ With an additional argument, @code{tmult} will produce the inner product
+@@ -2464,8 +2470,9 @@
+ If you do not wish to return to Jacal but really want to terminate the
+ session and return to the operating system, then after typing
+ @code{qed();}, type @code{(slib:exit)} or use @code{quit}.
++@end deffn
+ 
+-@deffnx Command quit
++@deffn Command quit
+ Exit directly from Jacal to the operating system.  You will not be able
+ to continue your Jacal session.
+ 
diff --git a/gnu/packages/patches/kio-CVE-2017-6410.patch b/gnu/packages/patches/kio-CVE-2017-6410.patch
new file mode 100644
index 0000000000..748636f806
--- /dev/null
+++ b/gnu/packages/patches/kio-CVE-2017-6410.patch
@@ -0,0 +1,53 @@
+Fix CVE-2017-6410, "Information Leak when accessing https when using a
+malicious PAC file":
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6410
+https://www.kde.org/info/security/advisory-20170228-1.txt
+
+Patch copied from upstream source repository:
+
+https://cgit.kde.org/kio.git/commit/?id=f9d0cb47cf94e209f6171ac0e8d774e68156a6e4
+
+From f9d0cb47cf94e209f6171ac0e8d774e68156a6e4 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Tue, 28 Feb 2017 19:00:48 +0100
+Subject: Sanitize URLs before passing them to FindProxyForURL
+
+Remove user/password information
+For https: remove path and query
+
+Thanks to safebreach.com for reporting the problem
+
+CCMAIL: yoni.fridburg@safebreach.com
+CCMAIL: amit.klein@safebreach.com
+CCMAIL: itzik.kotler@safebreach.com
+---
+ src/kpac/script.cpp | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/src/kpac/script.cpp b/src/kpac/script.cpp
+index a0235f7..2485c54 100644
+--- a/src/kpac/script.cpp
++++ b/src/kpac/script.cpp
+@@ -754,9 +754,16 @@ QString Script::evaluate(const QUrl &url)
+         }
+     }
+ 
++    QUrl cleanUrl = url;
++    cleanUrl.setUserInfo(QString());
++    if (cleanUrl.scheme() == QLatin1String("https")) {
++        cleanUrl.setPath(QString());
++        cleanUrl.setQuery(QString());
++    }
++
+     QScriptValueList args;
+-    args << url.url();
+-    args << url.host();
++    args << cleanUrl.url();
++    args << cleanUrl.host();
+ 
+     QScriptValue result = func.call(QScriptValue(), args);
+     if (result.isError()) {
+-- 
+cgit v0.11.2
+
diff --git a/gnu/packages/patches/libssh-0.6.5-CVE-2016-0739.patch b/gnu/packages/patches/libssh-0.6.5-CVE-2016-0739.patch
deleted file mode 100644
index a5fdd7ffff..0000000000
--- a/gnu/packages/patches/libssh-0.6.5-CVE-2016-0739.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-Fix CVE-2016-0739 (Weak Diffie-Hellman secret generation in
-dh_generate_x() and dh_generate_y()).
-
-"Due to a byte/bit confusion, the DH secret was too short. This file was
-completely reworked and will be commited in a future version."
-Source:
-https://git.libssh.org/projects/libssh.git/commit/?id=f8d0026c65fc8a55748ae481758e2cf376c26c86
-
-This patch was created by upstream for libssh-0.7.3, but applied without
-modification to libssh-0.6.3 by Debian. In Guix, we apply it without
-modification to libssh-0.6.5.
-
-References:
-https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-0739
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0739
-https://security-tracker.debian.org/tracker/CVE-2016-0739
-
----
- src/dh.c | 22 +++++++++++++++++-----
- 1 file changed, 17 insertions(+), 5 deletions(-)
-
-diff --git a/src/dh.c b/src/dh.c
-index e489a1d..d27b66e 100644
---- a/src/dh.c
-+++ b/src/dh.c
-@@ -227,15 +227,21 @@ void ssh_crypto_finalize(void) {
- }
- 
- int dh_generate_x(ssh_session session) {
-+  int keysize;
-+  if (session->next_crypto->kex_type == SSH_KEX_DH_GROUP1_SHA1) {
-+    keysize = 1023;
-+  } else {
-+    keysize = 2047;
-+  }
-   session->next_crypto->x = bignum_new();
-   if (session->next_crypto->x == NULL) {
-     return -1;
-   }
- 
- #ifdef HAVE_LIBGCRYPT
--  bignum_rand(session->next_crypto->x, 128);
-+  bignum_rand(session->next_crypto->x, keysize);
- #elif defined HAVE_LIBCRYPTO
--  bignum_rand(session->next_crypto->x, 128, 0, -1);
-+  bignum_rand(session->next_crypto->x, keysize, -1, 0);
- #endif
- 
-   /* not harder than this */
-@@ -248,15 +254,21 @@ int dh_generate_x(ssh_session session) {
- 
- /* used by server */
- int dh_generate_y(ssh_session session) {
--    session->next_crypto->y = bignum_new();
-+  int keysize;
-+  if (session->next_crypto->kex_type == SSH_KEX_DH_GROUP1_SHA1) {
-+    keysize = 1023;
-+  } else {
-+    keysize = 2047;
-+  }
-+  session->next_crypto->y = bignum_new();
-   if (session->next_crypto->y == NULL) {
-     return -1;
-   }
- 
- #ifdef HAVE_LIBGCRYPT
--  bignum_rand(session->next_crypto->y, 128);
-+  bignum_rand(session->next_crypto->y, keysize);
- #elif defined HAVE_LIBCRYPTO
--  bignum_rand(session->next_crypto->y, 128, 0, -1);
-+  bignum_rand(session->next_crypto->y, keysize, -1, 0);
- #endif
- 
-   /* not harder than this */
--- 
-cgit v0.12
-
diff --git a/gnu/packages/patches/matplotlib-setupext-tk.patch b/gnu/packages/patches/matplotlib-setupext-tk.patch
deleted file mode 100644
index 37c3d686e0..0000000000
--- a/gnu/packages/patches/matplotlib-setupext-tk.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Use 'pkg-config' instead of heuristics to find 'tk' flags.
-
---- matplotlib-1.4.3/setupext.py.orig	2015-12-01 14:21:19.554417453 +0100
-+++ matplotlib-1.4.3/setupext.py	2015-12-02 10:39:47.282363530 +0100
-@@ -1457,7 +1457,7 @@
-             p = subprocess.Popen(
-                 '. %s ; eval echo ${%s}' % (file, varname),
-                 shell=True,
--                executable="/bin/sh",
-+                executable="sh",
-                 stdout=subprocess.PIPE)
-             result = p.communicate()[0]
-             return result.decode('ascii')
-@@ -1601,8 +1601,19 @@
-             #      of distros.
- 
-             # Query Tcl/Tk system for library paths and version string
-+            def getoutput(s):
-+                ret = os.popen(s).read().strip()
-+                return ret
-             try:
--                tcl_lib_dir, tk_lib_dir, tk_ver = self.query_tcltk()
-+                pkg_config_libs = getoutput('pkg-config --libs-only-L tk').split()
-+                # drop '-L' part of strings
-+                pkg_config_libs = [s[2:] for s in pkg_config_libs]
-+                pkg_config_ver = getoutput('pkg-config --modversion tk')
-+                tk_ver = re.match(r"(\d+.\d+)[\d.]*", pkg_config_ver).group(1)
-+                tcl_lib_dir = next(s for s in pkg_config_libs
-+                                   if re.match(r".*-tcl-.*", s)) + '/tcl' + tk_ver
-+                tk_lib_dir = next(s for s in pkg_config_libs
-+                                  if re.match(r".*-tk-.*", s)) + '/tk' + tk_ver
-             except:
-                 tk_ver = ''
-                 result = self.hardcoded_tcl_config()
diff --git a/gnu/packages/patches/mupdf-CVE-2017-5896.patch b/gnu/packages/patches/mupdf-CVE-2017-5896.patch
new file mode 100644
index 0000000000..1537ecc896
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2017-5896.patch
@@ -0,0 +1,63 @@
+Fix CVE-2017-5896:
+
+https://bugs.ghostscript.com/show_bug.cgi?id=697515
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5896
+http://www.openwall.com/lists/oss-security/2017/02/10/1
+https://security-tracker.debian.org/tracker/CVE-2017-5896
+https://blogs.gentoo.org/ago/2017/02/09/mupdf-use-after-free-in-fz_subsample_pixmap-pixmap-c/
+
+Patch lifted from upstream source repository:
+
+http://git.ghostscript.com/?p=mupdf.git;h=2c4e5867ee699b1081527bc6c6ea0e99a35a5c27
+
+From 2c4e5867ee699b1081527bc6c6ea0e99a35a5c27 Mon Sep 17 00:00:00 2001
+From: Robin Watts <Robin.Watts@artifex.com>
+Date: Thu, 9 Feb 2017 07:12:16 -0800
+Subject: [PATCH] bug 697515: Fix out of bounds read in fz_subsample_pixmap
+
+Pointer arithmetic for final special case was going wrong.
+---
+ source/fitz/pixmap.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c
+index a8317127..f1291dc2 100644
+--- a/source/fitz/pixmap.c
++++ b/source/fitz/pixmap.c
+@@ -1104,6 +1104,7 @@ fz_subsample_pixmap_ARM(unsigned char *ptr, int w, int h, int f, int factor,
+ 	"@STACK:r1,<9>,factor,n,fwd,back,back2,fwd2,divX,back4,fwd4,fwd3,divY,back5,divXY\n"
+ 	"ldr	r4, [r13,#4*22]		@ r4 = divXY			\n"
+ 	"ldr	r5, [r13,#4*11]		@ for (nn = n; nn > 0; n--) {	\n"
++	"ldr	r8, [r13,#4*17]		@ r8 = back4			\n"
+ 	"18:				@				\n"
+ 	"mov	r14,#0			@ r14= v = 0			\n"
+ 	"sub	r5, r5, r1, LSL #8	@ for (xx = x; xx > 0; x--) {	\n"
+@@ -1120,7 +1121,7 @@ fz_subsample_pixmap_ARM(unsigned char *ptr, int w, int h, int f, int factor,
+ 	"mul	r14,r4, r14		@ r14= v *= divX		\n"
+ 	"mov	r14,r14,LSR #16		@ r14= v >>= 16			\n"
+ 	"strb	r14,[r9], #1		@ *d++ = r14			\n"
+-	"sub	r0, r0, r8		@ s -= back2			\n"
++	"sub	r0, r0, r8		@ s -= back4			\n"
+ 	"subs	r5, r5, #1		@ n--				\n"
+ 	"bgt	18b			@ }				\n"
+ 	"21:				@				\n"
+@@ -1249,6 +1250,7 @@ fz_subsample_pixmap(fz_context *ctx, fz_pixmap *tile, int factor)
+ 		x += f;
+ 		if (x > 0)
+ 		{
++			int back4 = x * n - 1;
+ 			div = x * y;
+ 			for (nn = n; nn > 0; nn--)
+ 			{
+@@ -1263,7 +1265,7 @@ fz_subsample_pixmap(fz_context *ctx, fz_pixmap *tile, int factor)
+ 					s -= back5;
+ 				}
+ 				*d++ = v / div;
+-				s -= back2;
++				s -= back4;
+ 			}
+ 		}
+ 	}
+-- 
+2.12.0
+
diff --git a/gnu/packages/patches/mupdf-CVE-2017-5991.patch b/gnu/packages/patches/mupdf-CVE-2017-5991.patch
new file mode 100644
index 0000000000..1fa6dc3466
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2017-5991.patch
@@ -0,0 +1,101 @@
+Fix CVE-2017-5991:
+
+https://bugs.ghostscript.com/show_bug.cgi?id=697500
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5991
+https://security-tracker.debian.org/tracker/CVE-2017-5991
+
+Patch lifted from upstream source repository:
+
+http://git.ghostscript.com/?p=mupdf.git;h=1912de5f08e90af1d9d0a9791f58ba3afdb9d465
+
+From 1912de5f08e90af1d9d0a9791f58ba3afdb9d465 Mon Sep 17 00:00:00 2001
+From: Robin Watts <robin.watts@artifex.com>
+Date: Thu, 9 Feb 2017 15:49:15 +0000
+Subject: [PATCH] Bug 697500: Fix NULL ptr access.
+
+Cope better with errors during rendering - avoid letting the
+gstate stack get out of sync.
+
+This avoids us ever getting into the situation of popping
+a clip when we should be popping a mask or a group. This was
+causing an unexpected case in the painting.
+---
+ source/pdf/pdf-op-run.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/source/pdf/pdf-op-run.c b/source/pdf/pdf-op-run.c
+index a3ea895d..f1eac8d3 100644
+--- a/source/pdf/pdf-op-run.c
++++ b/source/pdf/pdf-op-run.c
+@@ -1213,6 +1213,7 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
+ 	pdf_run_processor *pr = (pdf_run_processor *)proc;
+ 	pdf_gstate *gstate = NULL;
+ 	int oldtop = 0;
++	int oldbot = -1;
+ 	fz_matrix local_transform = *transform;
+ 	softmask_save softmask = { NULL };
+ 	int gparent_save;
+@@ -1232,16 +1233,17 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
+ 	fz_var(cleanup_state);
+ 	fz_var(gstate);
+ 	fz_var(oldtop);
++	fz_var(oldbot);
+ 
+ 	gparent_save = pr->gparent;
+ 	pr->gparent = pr->gtop;
++	oldtop = pr->gtop;
+ 
+ 	fz_try(ctx)
+ 	{
+ 		pdf_gsave(ctx, pr);
+ 
+ 		gstate = pr->gstate + pr->gtop;
+-		oldtop = pr->gtop;
+ 
+ 		pdf_xobject_bbox(ctx, xobj, &xobj_bbox);
+ 		pdf_xobject_matrix(ctx, xobj, &xobj_matrix);
+@@ -1302,12 +1304,25 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
+ 
+ 		doc = pdf_get_bound_document(ctx, xobj->obj);
+ 
++		oldbot = pr->gbot;
++		pr->gbot = pr->gtop;
++
+ 		pdf_process_contents(ctx, (pdf_processor*)pr, doc, resources, xobj->obj, NULL);
+ 	}
+ 	fz_always(ctx)
+ 	{
++		/* Undo any gstate mismatches due to the pdf_process_contents call */
++		if (oldbot != -1)
++		{
++			while (pr->gtop > pr->gbot)
++			{
++				pdf_grestore(ctx, pr);
++			}
++			pr->gbot = oldbot;
++		}
++
+ 		if (cleanup_state >= 3)
+-			pdf_grestore(ctx, pr); /* Remove the clippath */
++			pdf_grestore(ctx, pr); /* Remove the state we pushed for the clippath */
+ 
+ 		/* wrap up transparency stacks */
+ 		if (transparency)
+@@ -1341,13 +1356,8 @@ pdf_run_xobject(fz_context *ctx, pdf_run_processor *proc, pdf_xobject *xobj, pdf
+ 		pr->gstate[pr->gparent].ctm = gparent_save_ctm;
+ 		pr->gparent = gparent_save;
+ 
+-		if (gstate)
+-		{
+-			while (oldtop < pr->gtop)
+-				pdf_grestore(ctx, pr);
+-
++		while (oldtop < pr->gtop)
+ 			pdf_grestore(ctx, pr);
+-		}
+ 
+ 		pdf_unmark_obj(ctx, xobj->obj);
+ 	}
+-- 
+2.12.0
+
diff --git a/gnu/packages/patches/nss-pkgconfig.patch b/gnu/packages/patches/nss-pkgconfig.patch
index e611f69bea..a33e05fcf2 100644
--- a/gnu/packages/patches/nss-pkgconfig.patch
+++ b/gnu/packages/patches/nss-pkgconfig.patch
@@ -221,5 +221,5 @@ Later adapted to apply cleanly to nss-3.21.
  
  RELEASE = nss
  
--DIRS = coreconf lib cmd external_tests
-+DIRS = coreconf lib cmd external_tests config
+-DIRS = coreconf lib cmd gtests
++DIRS = coreconf lib cmd gtests config
diff --git a/gnu/packages/patches/pcre2-CVE-2016-3191.patch b/gnu/packages/patches/pcre2-CVE-2016-3191.patch
deleted file mode 100644
index 80f9d3d4f1..0000000000
--- a/gnu/packages/patches/pcre2-CVE-2016-3191.patch
+++ /dev/null
@@ -1,179 +0,0 @@
-Fixes CVE-2016-3191 (remote execution of arbitrary code or denial of
-service (stack-based buffer overflow) via a crafted regular expression).
-
-See <https://bugzilla.redhat.com/show_bug.cgi?id=1311503>.
-
-This is svn r489 at <svn://vcs.exim.org/pcre2/code>, omitting the
-changes to 'testdata/testoutput8-16-4', which does not exist in the
-source tarball.
-
-git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@489 6239d852-aaf2-0410-a92c-79f79f948069
----
- ChangeLog                 |  4 ++++
- src/pcre2_compile.c       | 16 ++++++++++++++--
- testdata/testinput8       |  2 ++
- testdata/testoutput8-16-2 |  3 +++
- testdata/testoutput8-16-3 |  3 +++
- testdata/testoutput8-16-4 |  3 +++
- testdata/testoutput8-32-2 |  3 +++
- testdata/testoutput8-32-3 |  3 +++
- testdata/testoutput8-32-4 |  3 +++
- testdata/testoutput8-8-2  |  3 +++
- testdata/testoutput8-8-3  |  3 +++
- testdata/testoutput8-8-4  |  3 +++
- 12 files changed, 47 insertions(+), 2 deletions(-)
-
-diff --git a/ChangeLog b/ChangeLog
-index 3ce0207..65e333e 100644
---- a/ChangeLog
-+++ b/ChangeLog
-@@ -58,6 +58,10 @@ some head-scratching the next time this happens.
- assertion, caused pcre2test to output a very large number of spaces when the 
- callout was taken, making the program appearing to loop.
- 
-+12. A pattern that included (*ACCEPT) in the middle of a sufficiently deeply 
-+nested set of parentheses of sufficient size caused an overflow of the 
-+compiling workspace (which was diagnosed, but of course is not desirable).
-+
- 
- Version 10.21 12-January-2016
- -----------------------------
-diff --git a/src/pcre2_compile.c b/src/pcre2_compile.c
-index e33d620..887fbfd 100644
---- a/src/pcre2_compile.c
-+++ b/src/pcre2_compile.c
-@@ -5901,10 +5901,22 @@ for (;; ptr++)
-               goto FAILED;
-               }
-             cb->had_accept = TRUE;
-+            
-+            /* In the first pass, just accumulate the length required;
-+            otherwise hitting (*ACCEPT) inside many nested parentheses can
-+            cause workspace overflow. */
-+              
-             for (oc = cb->open_caps; oc != NULL; oc = oc->next)
-               {
--              *code++ = OP_CLOSE;
--              PUT2INC(code, 0, oc->number);
-+              if (lengthptr != NULL)
-+                {
-+                *lengthptr += CU2BYTES(1) + IMM2_SIZE; 
-+                }
-+              else
-+                {       
-+                *code++ = OP_CLOSE;
-+                PUT2INC(code, 0, oc->number);
-+                } 
-               }
-             setverb = *code++ =
-               (cb->assert_depth > 0)? OP_ASSERT_ACCEPT : OP_ACCEPT;
-diff --git a/testdata/testinput8 b/testdata/testinput8
-index ca3b1b9..7e2a1f0 100644
---- a/testdata/testinput8
-+++ b/testdata/testinput8
-@@ -182,4 +182,6 @@
- 
- /((?1)(?2)(?3)(?4)(?5)(?6)(?7)(?8)(?9)(?9)(?8)(?7)(?6)(?5)(?4)(?3)(?2)(?1)(?0)){2,}()()()()()()()()()/debug
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-16-2 b/testdata/testoutput8-16-2
-index 05669bb..a5e8dec 100644
---- a/testdata/testoutput8-16-2
-+++ b/testdata/testoutput8-16-2
-@@ -1027,4 +1027,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 186 at offset 490: regular expression is too complicated
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-16-3 b/testdata/testoutput8-16-3
-index 31884e1..36133b3 100644
---- a/testdata/testoutput8-16-3
-+++ b/testdata/testoutput8-16-3
-@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-32-2 b/testdata/testoutput8-32-2
-index babd0c7..99c4fad 100644
---- a/testdata/testoutput8-32-2
-+++ b/testdata/testoutput8-32-2
-@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-32-3 b/testdata/testoutput8-32-3
-index babd0c7..99c4fad 100644
---- a/testdata/testoutput8-32-3
-+++ b/testdata/testoutput8-32-3
-@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-32-4 b/testdata/testoutput8-32-4
-index babd0c7..99c4fad 100644
---- a/testdata/testoutput8-32-4
-+++ b/testdata/testoutput8-32-4
-@@ -1023,4 +1023,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-8-2 b/testdata/testoutput8-8-2
-index 6a9aa0a..6dc1f42 100644
---- a/testdata/testoutput8-8-2
-+++ b/testdata/testoutput8-8-2
-@@ -1026,4 +1026,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-8-3 b/testdata/testoutput8-8-3
-index 2fe1168..ae14946 100644
---- a/testdata/testoutput8-8-3
-+++ b/testdata/testoutput8-8-3
-@@ -1024,4 +1024,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
-diff --git a/testdata/testoutput8-8-4 b/testdata/testoutput8-8-4
-index 91993b2..6c79956 100644
---- a/testdata/testoutput8-8-4
-+++ b/testdata/testoutput8-8-4
-@@ -1022,4 +1022,7 @@ Capturing subpattern count = 10
- May match empty string
- Subject length lower bound = 0
- 
-+/([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00]([00](*ACCEPT)/
-+Failed: error 114 at offset 509: missing closing parenthesis
-+
- # End of testinput8
--- 
-2.8.3
-
diff --git a/gnu/packages/patches/python-dendropy-fix-tests.patch b/gnu/packages/patches/python-dendropy-fix-tests.patch
new file mode 100644
index 0000000000..30ab618ff1
--- /dev/null
+++ b/gnu/packages/patches/python-dendropy-fix-tests.patch
@@ -0,0 +1,41 @@
+This patch fixes two test failures.  It was downloaded from:
+https://github.com/jeetsukumaran/DendroPy/commit/93f984bba7a6c588a28ca87f4e557ce283809453
+
+From 93f984bba7a6c588a28ca87f4e557ce283809453 Mon Sep 17 00:00:00 2001
+From: jeetsukumaran <jeetsukumaran@gmail.com>
+Date: Tue, 21 Feb 2017 16:41:01 -0500
+Subject: [PATCH] Update to Python 3 container and iteration semantics
+
+---
+ dendropy/dataio/newickreader.py | 3 ++-
+ dendropy/datamodel/treemodel.py | 3 +++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/dendropy/dataio/newickreader.py b/dendropy/dataio/newickreader.py
+index 6dcf3c5..f978729 100644
+--- a/dendropy/dataio/newickreader.py
++++ b/dendropy/dataio/newickreader.py
+@@ -303,7 +303,8 @@ def tree_iter(self,
+                     taxon_symbol_map_fn=taxon_symbol_mapper.require_taxon_for_symbol)
+             yield tree
+             if tree is None:
+-                raise StopIteration
++                # raise StopIteration
++                return
+ 
+     def _read(self,
+             stream,
+diff --git a/dendropy/datamodel/treemodel.py b/dendropy/datamodel/treemodel.py
+index 0ecfe31..73146f0 100644
+--- a/dendropy/datamodel/treemodel.py
++++ b/dendropy/datamodel/treemodel.py
+@@ -772,6 +772,9 @@ def __hash__(self):
+     def __eq__(self, other):
+         return self is other
+ 
++    def __lt__(self, other):
++        return id(self) < id(other)
++
+     ###########################################################################
+     ### Basic Structure
+ 
diff --git a/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch b/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch
new file mode 100644
index 0000000000..cb60896fad
--- /dev/null
+++ b/gnu/packages/patches/python-fake-factory-fix-build-32bit.patch
@@ -0,0 +1,36 @@
+These tests fail on 32-bit due to an overflow.
+
+Upstream bug URL: https://github.com/joke2k/faker/issues/408
+
+diff --git a/faker/tests/__init__.py b/faker/tests/__init__.py
+index 6026772..58b6b83 100644
+--- a/faker/tests/__init__.py
++++ b/faker/tests/__init__.py
+@@ -384,7 +384,6 @@ class FactoryTestCase(unittest.TestCase):
+         provider = Provider
+         # test century
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_century(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
+-        self.assertTrue(self._datetime_to_time(provider.date_time_this_century(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
+         # test decade
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
+@@ -413,8 +412,6 @@ class FactoryTestCase(unittest.TestCase):
+ 
+         # ensure all methods provide timezone aware datetimes
+         with self.assertRaises(TypeError):
+-            provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now()
+-        with self.assertRaises(TypeError):
+             provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now()
+         with self.assertRaises(TypeError):
+             provider.date_time_this_year(after_now=False, tzinfo=utc) <= datetime.datetime.now()
+@@ -423,7 +420,6 @@ class FactoryTestCase(unittest.TestCase):
+ 
+         # test century
+         self.assertTrue(provider.date_time_this_century(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
+-        self.assertTrue(provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
+         # test decade
+         self.assertTrue(provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
+         self.assertTrue(provider.date_time_this_decade(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
+-- 
+2.11.1
+
diff --git a/gnu/packages/patches/python-faker-fix-build-32bit.patch b/gnu/packages/patches/python-faker-fix-build-32bit.patch
new file mode 100644
index 0000000000..466b289012
--- /dev/null
+++ b/gnu/packages/patches/python-faker-fix-build-32bit.patch
@@ -0,0 +1,36 @@
+These tests fail on 32-bit due to an overflow.
+
+Upstream bug URL: https://github.com/joke2k/faker/issues/408
+
+diff --git a/tests/__init__.py b/tests/__init__.py
+index 6026772..58b6b83 100644
+--- a/tests/__init__.py
++++ b/tests/__init__.py
+@@ -384,7 +384,6 @@ class FactoryTestCase(unittest.TestCase):
+         provider = Provider
+         # test century
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_century(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
+-        self.assertTrue(self._datetime_to_time(provider.date_time_this_century(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
+         # test decade
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(after_now=False)) <= self._datetime_to_time(datetime.datetime.now()))
+         self.assertTrue(self._datetime_to_time(provider.date_time_this_decade(before_now=False, after_now=True)) >= self._datetime_to_time(datetime.datetime.now()))
+@@ -413,8 +412,6 @@ class FactoryTestCase(unittest.TestCase):
+ 
+         # ensure all methods provide timezone aware datetimes
+         with self.assertRaises(TypeError):
+-            provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now()
+-        with self.assertRaises(TypeError):
+             provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now()
+         with self.assertRaises(TypeError):
+             provider.date_time_this_year(after_now=False, tzinfo=utc) <= datetime.datetime.now()
+@@ -423,7 +420,6 @@ class FactoryTestCase(unittest.TestCase):
+ 
+         # test century
+         self.assertTrue(provider.date_time_this_century(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
+-        self.assertTrue(provider.date_time_this_century(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
+         # test decade
+         self.assertTrue(provider.date_time_this_decade(after_now=False, tzinfo=utc) <= datetime.datetime.now(utc))
+         self.assertTrue(provider.date_time_this_decade(before_now=False, after_now=True, tzinfo=utc) >= datetime.datetime.now(utc))
+-- 
+2.11.1
+
diff --git a/gnu/packages/patches/python-pandas-skip-failing-tests.patch b/gnu/packages/patches/python-pandas-skip-failing-tests.patch
new file mode 100644
index 0000000000..31fc912d00
--- /dev/null
+++ b/gnu/packages/patches/python-pandas-skip-failing-tests.patch
@@ -0,0 +1,59 @@
+These tests fail on 32bit architectures.
+
+Upstream bug URL: https://github.com/pandas-dev/pandas/issues/14866
+
+--- a/pandas/tests/test_base.py	2017-03-08 17:49:44.422282717 +0100
++++ b/pandas/tests/test_base.py	2017-03-08 17:50:59.476701799 +0100
+@@ -363,30 +363,6 @@
+                 self.assertFalse(result.iat[0])
+                 self.assertFalse(result.iat[1])
+ 
+-    def test_ndarray_compat_properties(self):
+-
+-        for o in self.objs:
+-
+-            # check that we work
+-            for p in ['shape', 'dtype', 'flags', 'T', 'strides', 'itemsize',
+-                      'nbytes']:
+-                self.assertIsNotNone(getattr(o, p, None))
+-            self.assertTrue(hasattr(o, 'base'))
+-
+-            # if we have a datetimelike dtype then needs a view to work
+-            # but the user is responsible for that
+-            try:
+-                self.assertIsNotNone(o.data)
+-            except ValueError:
+-                pass
+-
+-            self.assertRaises(ValueError, o.item)  # len > 1
+-            self.assertEqual(o.ndim, 1)
+-            self.assertEqual(o.size, len(o))
+-
+-        self.assertEqual(Index([1]).item(), 1)
+-        self.assertEqual(Series([1]).item(), 1)
+-
+     def test_ops(self):
+         for op in ['max', 'min']:
+             for o in self.objs:
+--- a/pandas/tools/tests/test_tile.py	2017-03-08 17:47:39.762261841 +0100
++++ b/pandas/tools/tests/test_tile.py	2017-03-08 17:48:26.831780495 +0100
+@@ -271,19 +271,6 @@
+                                     np.array([0, 0, 1, 1], dtype=np.int8))
+         tm.assert_numpy_array_equal(bins, np.array([0, 1.5, 3]))
+ 
+-    def test_single_bin(self):
+-        # issue 14652
+-        expected = Series([0, 0])
+-
+-        s = Series([9., 9.])
+-        result = cut(s, 1, labels=False)
+-        tm.assert_series_equal(result, expected)
+-
+-        s = Series([-9., -9.])
+-        result = cut(s, 1, labels=False)
+-        tm.assert_series_equal(result, expected)
+-
+-
+ def curpath():
+     pth, _ = os.path.split(os.path.abspath(__file__))
+     return pth
diff --git a/gnu/packages/patches/python-pbr-fix-man-page-support.patch b/gnu/packages/patches/python-pbr-fix-man-page-support.patch
new file mode 100644
index 0000000000..b9036f5b01
--- /dev/null
+++ b/gnu/packages/patches/python-pbr-fix-man-page-support.patch
@@ -0,0 +1,28 @@
+See: https://bugs.launchpad.net/oslosphinx/+bug/1661861
+diff -ur orig/pbr-1.10.0/pbr/builddoc.py pbr-1.10.0/pbr/builddoc.py
+--- orig/pbr-1.10.0/pbr/builddoc.py	2016-05-23 21:38:18.000000000 +0200
++++ pbr-1.10.0/pbr/builddoc.py	2017-02-18 14:01:37.424434317 +0100
+@@ -138,7 +138,8 @@
+             sphinx_config.init_values(warnings.warn)
+         else:
+             sphinx_config.init_values()
+-        if self.builder == 'man' and len(sphinx_config.man_pages) == 0:
++        if self.builder == 'man' and len(
++                getattr(sphinx_config, 'man_pages', '')) == 0:
+             return
+         app = application.Sphinx(
+             self.source_dir, self.config_dir,
+diff -ur orig/pbr-1.10.0/pbr/util.py pbr-1.10.0/pbr/util.py
+--- orig/pbr-1.10.0/pbr/util.py	2016-05-23 21:38:18.000000000 +0200
++++ pbr-1.10.0/pbr/util.py	2017-02-18 15:36:32.951196795 +0100
+@@ -211,7 +211,9 @@
+     parser.read(path)
+     config = {}
+     for section in parser.sections():
+-        config[section] = dict(parser.items(section))
++        config[section] = dict()
++        for k, value in parser.items(section):
++            config[section][k.replace('-', '_')] = value
+ 
+     # Run setup_hooks, if configured
+     setup_hooks = has_get_option(config, 'global', 'setup_hooks')
diff --git a/gnu/packages/patches/python-pygit2-disable-network-tests.patch b/gnu/packages/patches/python-pygit2-disable-network-tests.patch
new file mode 100644
index 0000000000..e46d244807
--- /dev/null
+++ b/gnu/packages/patches/python-pygit2-disable-network-tests.patch
@@ -0,0 +1,64 @@
+Disable tests trying to look up remote servers.
+
+diff --git a/test/test_credentials.py b/test/test_credentials.py
+index 92482d9..9a281e5 100644
+--- a/test/test_credentials.py
++++ b/test/test_credentials.py
+@@ -68,39 +68,5 @@ class CredentialCreateTest(utils.NoRepoTestCase):
+         self.assertEqual((username, None, None, None), cred.credential_tuple)
+ 
+ 
+-class CredentialCallback(utils.RepoTestCase):
+-    def test_callback(self):
+-        class MyCallbacks(pygit2.RemoteCallbacks):
+-            @staticmethod
+-            def credentials(url, username, allowed):
+-                self.assertTrue(allowed & GIT_CREDTYPE_USERPASS_PLAINTEXT)
+-                raise Exception("I don't know the password")
+-
+-        url = "https://github.com/github/github"
+-        remote = self.repo.create_remote("github", url)
+-
+-        self.assertRaises(Exception, lambda: remote.fetch(callbacks=MyCallbacks()))
+-
+-    def test_bad_cred_type(self):
+-        class MyCallbacks(pygit2.RemoteCallbacks):
+-            @staticmethod
+-            def credentials(url, username, allowed):
+-                self.assertTrue(allowed & GIT_CREDTYPE_USERPASS_PLAINTEXT)
+-                return Keypair("git", "foo.pub", "foo", "sekkrit")
+-
+-        url = "https://github.com/github/github"
+-        remote = self.repo.create_remote("github", url)
+-        self.assertRaises(TypeError, lambda: remote.fetch(callbacks=MyCallbacks()))
+-
+-class CallableCredentialTest(utils.RepoTestCase):
+-
+-    def test_user_pass(self):
+-        credentials = UserPass("libgit2", "libgit2")
+-        callbacks = pygit2.RemoteCallbacks(credentials=credentials)
+-
+-        url = "https://bitbucket.org/libgit2/testgitrepository.git"
+-        remote = self.repo.create_remote("bb", url)
+-        remote.fetch(callbacks=callbacks)
+-
+ if __name__ == '__main__':
+     unittest.main()
+diff --git a/test/test_repository.py b/test/test_repository.py
+index cfdf01e..c0d8de4 100644
+--- a/test/test_repository.py
++++ b/test/test_repository.py
+@@ -538,13 +538,6 @@ class CloneRepositoryTest(utils.NoRepoTestCase):
+         self.assertTrue('refs/remotes/custom_remote/master' in repo.listall_references())
+         self.assertIsNotNone(repo.remotes["custom_remote"])
+ 
+-    def test_clone_with_credentials(self):
+-        repo = clone_repository(
+-            "https://bitbucket.org/libgit2/testgitrepository.git",
+-            self._temp_dir, callbacks=pygit2.RemoteCallbacks(credentials=pygit2.UserPass("libgit2", "libgit2")))
+-
+-        self.assertFalse(repo.is_empty)
+-
+     def test_clone_with_checkout_branch(self):
+         # create a test case which isolates the remote
+         test_repo = clone_repository('./test/data/testrepo.git',
diff --git a/gnu/packages/patches/python-pyopenssl-skip-network-test.patch b/gnu/packages/patches/python-pyopenssl-skip-network-test.patch
new file mode 100644
index 0000000000..a24eaf69a0
--- /dev/null
+++ b/gnu/packages/patches/python-pyopenssl-skip-network-test.patch
@@ -0,0 +1,50 @@
+This test tries connecting to an external server which is not supported
+in the build environment. See discussion at:
+
+https://lists.gnu.org/archive/html/guix-devel/2016-12/msg00650.html
+
+diff --git a/tests/test_ssl.py b/tests/test_ssl.py
+index ee849fd..60048b8 100644
+--- a/tests/test_ssl.py
++++ b/tests/test_ssl.py
+@@ -1180,40 +1180,6 @@ class ContextTests(TestCase, _LoopbackMixin):
+             TypeError, context.load_verify_locations, None, None, None
+         )
+ 
+-    @pytest.mark.skipif(
+-        platform == "win32",
+-        reason="set_default_verify_paths appears not to work on Windows.  "
+-        "See LP#404343 and LP#404344."
+-    )
+-    def test_set_default_verify_paths(self):
+-        """
+-        :py:obj:`Context.set_default_verify_paths` causes the
+-        platform-specific CA certificate locations to be used for
+-        verification purposes.
+-        """
+-        # Testing this requires a server with a certificate signed by one
+-        # of the CAs in the platform CA location.  Getting one of those
+-        # costs money.  Fortunately (or unfortunately, depending on your
+-        # perspective), it's easy to think of a public server on the
+-        # internet which has such a certificate.  Connecting to the network
+-        # in a unit test is bad, but it's the only way I can think of to
+-        # really test this. -exarkun
+-
+-        # Arg, verisign.com doesn't speak anything newer than TLS 1.0
+-        context = Context(SSLv23_METHOD)
+-        context.set_default_verify_paths()
+-        context.set_verify(
+-            VERIFY_PEER,
+-            lambda conn, cert, errno, depth, preverify_ok: preverify_ok)
+-
+-        client = socket()
+-        client.connect(("encrypted.google.com", 443))
+-        clientSSL = Connection(context, client)
+-        clientSSL.set_connect_state()
+-        clientSSL.do_handshake()
+-        clientSSL.send(b"GET / HTTP/1.0\r\n\r\n")
+-        self.assertTrue(clientSSL.recv(1024))
+-
+     def test_set_default_verify_paths_signature(self):
+         """
+         :py:obj:`Context.set_default_verify_paths` takes no arguments and
diff --git a/gnu/packages/patches/python-statsmodels-fix-tests.patch b/gnu/packages/patches/python-statsmodels-fix-tests.patch
index 3315ddbd5f..f910b4b5a5 100644
--- a/gnu/packages/patches/python-statsmodels-fix-tests.patch
+++ b/gnu/packages/patches/python-statsmodels-fix-tests.patch
@@ -1,196 +1,28 @@
-This patch fixes a couple of test failures introduced by changes to the pandas
-package.  It was extracted from this pull request:
-
-https://github.com/statsmodels/statsmodels/pull/2675
-
-
-From c9ef60a7bc4407766ab9e9f12c8a6b89013046ee Mon Sep 17 00:00:00 2001
-From: Ralf Gommers <ralf.gommers@gmail.com>
-Date: Tue, 20 Oct 2015 07:34:11 +0200
-Subject: [PATCH 1/4] MAINT: fix use of old_behavior kw for numpy.correlate. 
- Was removed in 1.10.0
-
-Numpy PR that removed it: https://github.com/numpy/numpy/pull/5991
-
-Closes gh-2667.
----
- statsmodels/tsa/ar_model.py | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
-diff --git a/statsmodels/tsa/ar_model.py b/statsmodels/tsa/ar_model.py
-index 087a9e0..02984bd 100644
---- a/statsmodels/tsa/ar_model.py
-+++ b/statsmodels/tsa/ar_model.py
-@@ -261,10 +261,8 @@ def _presample_varcov(self, params):
- 
-         Vpinv = np.zeros((p, p), dtype=params.dtype)
-         for i in range(1, p1):
--            Vpinv[i-1, i-1:] = np.correlate(params0, params0[:i],
--                                            old_behavior=False)[:-1]
--            Vpinv[i-1, i-1:] -= np.correlate(params0[-i:], params0,
--                                             old_behavior=False)[:-1]
-+            Vpinv[i-1, i-1:] = np.correlate(params0, params0[:i],)[:-1]
-+            Vpinv[i-1, i-1:] -= np.correlate(params0[-i:], params0,)[:-1]
- 
-         Vpinv = Vpinv + Vpinv.T - np.diag(Vpinv.diagonal())
-         return Vpinv
-
-From f1dc8979b09bc1736149993f895943b3158ee2db Mon Sep 17 00:00:00 2001
-From: Ralf Gommers <ralf.gommers@gmail.com>
-Date: Wed, 21 Oct 2015 22:05:52 +0200
-Subject: [PATCH 2/4] MAINT: fix graphics module for changes in recent pandas
- versions.
-
----
- statsmodels/graphics/tests/test_mosaicplot.py | 2 +-
- statsmodels/graphics/tests/test_tsaplots.py   | 6 +++---
- statsmodels/graphics/tsaplots.py              | 2 +-
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/statsmodels/graphics/tests/test_mosaicplot.py b/statsmodels/graphics/tests/test_mosaicplot.py
-index cb9bbbe..e41020e 100644
---- a/statsmodels/graphics/tests/test_mosaicplot.py
-+++ b/statsmodels/graphics/tests/test_mosaicplot.py
-@@ -113,7 +113,7 @@ def test_mosaic():
-     # sort by the marriage quality and give meaningful name
-     # [rate_marriage, age, yrs_married, children,
-     # religious, educ, occupation, occupation_husb]
--    datas = datas.sort(['rate_marriage', 'religious'])
-+    datas = datas.sort_values(by=['rate_marriage', 'religious'])
-     num_to_desc = {1: 'awful', 2: 'bad', 3: 'intermediate',
-                       4: 'good', 5: 'wonderful'}
-     datas['rate_marriage'] = datas['rate_marriage'].map(num_to_desc)
-diff --git a/statsmodels/graphics/tests/test_tsaplots.py b/statsmodels/graphics/tests/test_tsaplots.py
-index 511f18f..365be82 100644
---- a/statsmodels/graphics/tests/test_tsaplots.py
-+++ b/statsmodels/graphics/tests/test_tsaplots.py
-@@ -1,4 +1,4 @@
--from statsmodels.compat.python import lmap, lzip, map
-+from statsmodels.compat.python import lmap, map
- import numpy as np
- import pandas as pd
- from numpy.testing import dec
-@@ -51,8 +51,8 @@ def test_plot_month():
-     dta = sm.datasets.elnino.load_pandas().data
-     dta['YEAR'] = dta.YEAR.astype(int).apply(str)
-     dta = dta.set_index('YEAR').T.unstack()
--    dates = lmap(lambda x : pd.datetools.parse('1 '+' '.join(x)),
--                                            dta.index.values)
-+    dates = lmap(lambda x : pd.datetools.parse_time_string('1 '+' '.join(x))[0],
-+                                                           dta.index.values)
- 
-     # test dates argument
-     fig = month_plot(dta.values, dates=dates, ylabel='el nino')
-diff --git a/statsmodels/graphics/tsaplots.py b/statsmodels/graphics/tsaplots.py
-index 3d04692..94626c9 100644
---- a/statsmodels/graphics/tsaplots.py
-+++ b/statsmodels/graphics/tsaplots.py
-@@ -200,7 +200,7 @@ def seasonal_plot(grouped_x, xticklabels, ylabel=None, ax=None):
-     ticks = []
-     for season, df in grouped_x:
-         df = df.copy() # or sort balks for series. may be better way
--        df.sort()
-+        df.sort_values(inplace=True)
-         nobs = len(df)
-         x_plot = np.arange(start, start + nobs)
-         ticks.append(x_plot.mean())
-
-From 4cfbef6af137629c6953f1f025d9cfc781874256 Mon Sep 17 00:00:00 2001
-From: Ralf Gommers <ralf.gommers@gmail.com>
-Date: Wed, 21 Oct 2015 22:15:25 +0200
-Subject: [PATCH 3/4] MAINT: work around pandas breaking backwards compat for
- pandas.version
-
----
- setup.py                     | 5 ++++-
- statsmodels/tools/testing.py | 6 ++----
- 2 files changed, 6 insertions(+), 5 deletions(-)
-
-diff --git a/setup.py b/setup.py
-index 0002840..74aefb8 100644
---- a/setup.py
-+++ b/setup.py
-@@ -134,7 +134,10 @@ def check_dependency_versions(min_versions):
-                               (spversion, min_versions['scipy']))
- 
-     try:
--        from pandas.version import short_version as pversion
-+        import pandas
-+        #FIXME: this will break for pandas 1.0.0.  Needs elaborate parsing now,
-+        # due to pandas removing version.short_version
-+        pversion = pandas.__version__[:6]
-     except ImportError:
-         install_requires.append('pandas')
-     else:
-diff --git a/statsmodels/tools/testing.py b/statsmodels/tools/testing.py
-index e207e44..643f79f 100644
---- a/statsmodels/tools/testing.py
-+++ b/statsmodels/tools/testing.py
-@@ -16,10 +16,8 @@ def strip_rc(version):
- 
- 
- def is_pandas_min_version(min_version):
--    '''check whether pandas is at least min_version
--    '''
--    from pandas.version import short_version as pversion
--    return StrictVersion(strip_rc(pversion)) >= min_version
-+    '''check whether pandas is at least min_version '''
-+    return StrictVersion((pandas.__version__[:6])) >= min_version
- 
- 
- # local copies, all unchanged
-
-From c894c3f4882d570efb517950069d83afa9794db8 Mon Sep 17 00:00:00 2001
-From: Ralf Gommers <ralf.gommers@gmail.com>
-Date: Mon, 26 Oct 2015 20:47:51 +0100
-Subject: [PATCH 4/4] BUG: fix use of Series.sort_values for older pandas.
-
-Some failing tests in the previous commits because older ``pandas`` versions
-don't have ``Series.sort_values``.  That method was only added in pandas 0.17,
-in https://github.com/pydata/pandas/pull/10726
----
- statsmodels/graphics/tests/test_mosaicplot.py | 6 +++++-
- statsmodels/graphics/tsaplots.py              | 6 +++++-
- 2 files changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/statsmodels/graphics/tests/test_mosaicplot.py b/statsmodels/graphics/tests/test_mosaicplot.py
-index e41020e..2a873e7 100644
---- a/statsmodels/graphics/tests/test_mosaicplot.py
-+++ b/statsmodels/graphics/tests/test_mosaicplot.py
-@@ -113,7 +113,11 @@ def test_mosaic():
-     # sort by the marriage quality and give meaningful name
-     # [rate_marriage, age, yrs_married, children,
-     # religious, educ, occupation, occupation_husb]
--    datas = datas.sort_values(by=['rate_marriage', 'religious'])
-+    if pandas.__version__ < '0.17.0':
-+        datas = datas.sort(['rate_marriage', 'religious'])
-+    else:
-+        datas = datas.sort_values(by=['rate_marriage', 'religious'])
-+
-     num_to_desc = {1: 'awful', 2: 'bad', 3: 'intermediate',
-                       4: 'good', 5: 'wonderful'}
-     datas['rate_marriage'] = datas['rate_marriage'].map(num_to_desc)
-diff --git a/statsmodels/graphics/tsaplots.py b/statsmodels/graphics/tsaplots.py
-index 94626c9..217724f 100644
---- a/statsmodels/graphics/tsaplots.py
-+++ b/statsmodels/graphics/tsaplots.py
-@@ -2,6 +2,7 @@
- 
- 
- import numpy as np
-+import pandas
- 
- from statsmodels.graphics import utils
- from statsmodels.tsa.stattools import acf, pacf
-@@ -200,7 +201,10 @@ def seasonal_plot(grouped_x, xticklabels, ylabel=None, ax=None):
-     ticks = []
-     for season, df in grouped_x:
-         df = df.copy() # or sort balks for series. may be better way
--        df.sort_values(inplace=True)
-+        if pandas.__version__ < '0.17.0':
-+            df.sort()
-+        else:
-+            df.sort_values(inplace=True)
-         nobs = len(df)
-         x_plot = np.arange(start, start + nobs)
-         ticks.append(x_plot.mean())
+This drops a test that fails with numpy 1.12.
+
+Upstream bug URL: https://github.com/statsmodels/statsmodels/issues/3541
+
+--- a/statsmodels/discrete/tests/test_discrete.py     2017-03-06 15:29:19.947343331 +0000
++++ b/statsmodels/discrete/tests/test_discrete.py     2017-03-06 15:29:37.759328845 +0000
+@@ -1329,21 +1329,6 @@
+         res = mod.fit(start_params=-np.ones(4), method='newton', disp=0)

+     assert_(not res.mle_retvals['converged'])

+ 

+-def test_issue_339():

+-    # make sure MNLogit summary works for J != K.

+-    data = sm.datasets.anes96.load()

+-    exog = data.exog

+-    # leave out last exog column

+-    exog = exog[:,:-1]

+-    exog = sm.add_constant(exog, prepend=True)

+-    res1 = sm.MNLogit(data.endog, exog).fit(method="newton", disp=0)

+-    # strip the header from the test

+-    smry = "\n".join(res1.summary().as_text().split('\n')[9:])

+-    cur_dir = os.path.dirname(os.path.abspath(__file__))

+-    test_case_file = os.path.join(cur_dir, 'results', 'mn_logit_summary.txt')

+-    test_case = open(test_case_file, 'r').read()

+-    np.testing.assert_equal(smry, test_case[:-1])

+-

+ def test_issue_341():

+     data = sm.datasets.anes96.load()

+     exog = data.exog

diff --git a/gnu/packages/patches/python2-subprocess32-disable-input-test.patch b/gnu/packages/patches/python2-subprocess32-disable-input-test.patch
new file mode 100644
index 0000000000..05b4eef1ba
--- /dev/null
+++ b/gnu/packages/patches/python2-subprocess32-disable-input-test.patch
@@ -0,0 +1,18 @@
+This test tries to send a KeyboardInterrupt, which does
+not work in the build environment.
+
+--- a/test_subprocess32.py	2017-03-06 22:21:49.334045485 +0100
++++ b/test_subprocess32.py	2017-03-06 22:22:02.490439949 +0100
+@@ -1299,12 +1299,6 @@
+         getattr(p, method)(*args)
+         return p
+ 
+-    def test_send_signal(self):
+-        p = self._kill_process('send_signal', signal.SIGINT)
+-        _, stderr = p.communicate()
+-        self.assertIn('KeyboardInterrupt', stderr)
+-        self.assertNotEqual(p.wait(), 0)
+-
+     def test_kill(self):
+         p = self._kill_process('kill')
+         _, stderr = p.communicate()
diff --git a/gnu/packages/patches/screen-CVE-2017-5618.patch b/gnu/packages/patches/screen-CVE-2017-5618.patch
deleted file mode 100644
index 1b95e428c8..0000000000
--- a/gnu/packages/patches/screen-CVE-2017-5618.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-Fixes CVE-2017-5618 (privilege escalation via opening the logfile when
-screen is installed setuid root):
-
-https://savannah.gnu.org/bugs/?50142
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5618
-
-This patch reverts the upstream commit that introduced the bug:
-
-https://git.savannah.gnu.org/cgit/screen.git/commit/?id=5460f5d28c01a9a58e021eb1dffef2965e629d58
-
-From f55b0cc29a0ac2a1c54e8a5e886b7393edd4a76c Mon Sep 17 00:00:00 2001
-From: Leo Famulari <leo@famulari.name>
-Date: Sat, 11 Feb 2017 22:40:24 -0500
-Subject: [PATCH] Revert "adding permissions check for the logfile name"
-
-This reverts commit 5460f5d28c01a9a58e021eb1dffef2965e629d58.
----
- src/screen.c | 6 ------
- 1 file changed, 6 deletions(-)
-
-diff --git a/src/screen.c b/src/screen.c
-index 64650e9..283c305 100644
---- a/src/screen.c
-+++ b/src/screen.c
-@@ -673,12 +673,6 @@ int main(int ac, char** av)
-                 Panic(0, "-L: logfile name can not start with \"-\" symbol");
-               if (strlen(screenlogfile) > PATH_MAX)
-                 Panic(0, "-L: logfile name too long. (max. %d char)", PATH_MAX);
--
--              FILE *w_check;
--              if ((w_check = fopen(screenlogfile, "w")) == NULL)
--                Panic(0, "-L: logfile name access problem");
--              else
--                fclose(w_check);
-             }
-             nwin_options.Lflag = 1;
-             break;
--- 
-2.11.1
-
diff --git a/gnu/packages/patches/shadow-CVE-2017-2616.patch b/gnu/packages/patches/shadow-CVE-2017-2616.patch
new file mode 100644
index 0000000000..f88aac40bc
--- /dev/null
+++ b/gnu/packages/patches/shadow-CVE-2017-2616.patch
@@ -0,0 +1,72 @@
+Fix CVE-2017-2616:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2616
+http://seclists.org/oss-sec/2017/q1/490
+http://seclists.org/oss-sec/2017/q1/474
+
+Patch copied from upstream source repository:
+
+https://github.com/shadow-maint/shadow/commit/08fd4b69e84364677a10e519ccb25b71710ee686
+
+From 08fd4b69e84364677a10e519ccb25b71710ee686 Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Thu, 23 Feb 2017 09:47:29 -0600
+Subject: [PATCH] su: properly clear child PID
+
+If su is compiled with PAM support, it is possible for any local user
+to send SIGKILL to other processes with root privileges. There are
+only two conditions. First, the user must be able to perform su with
+a successful login. This does NOT have to be the root user, even using
+su with the same id is enough, e.g. "su $(whoami)". Second, SIGKILL
+can only be sent to processes which were executed after the su process.
+It is not possible to send SIGKILL to processes which were already
+running. I consider this as a security vulnerability, because I was
+able to write a proof of concept which unlocked a screen saver of
+another user this way.
+---
+ src/su.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/src/su.c b/src/su.c
+index f20d230..d86aa86 100644
+--- a/src/su.c
++++ b/src/su.c
+@@ -379,11 +379,13 @@ static void prepare_pam_close_session (void)
+ 				/* wake child when resumed */
+ 				kill (pid, SIGCONT);
+ 				stop = false;
++			} else {
++				pid_child = 0;
+ 			}
+ 		} while (!stop);
+ 	}
+ 
+-	if (0 != caught) {
++	if (0 != caught && 0 != pid_child) {
+ 		(void) fputs ("\n", stderr);
+ 		(void) fputs (_("Session terminated, terminating shell..."),
+ 		              stderr);
+@@ -393,9 +395,22 @@ static void prepare_pam_close_session (void)
+ 		snprintf (wait_msg, sizeof wait_msg, _(" ...waiting for child to terminate.\n"));
+ 
+ 		(void) signal (SIGALRM, kill_child);
++		(void) signal (SIGCHLD, catch_signals);
+ 		(void) alarm (2);
+ 
+-		(void) wait (&status);
++		sigemptyset (&ourset);
++		if ((sigaddset (&ourset, SIGALRM) != 0)
++		    || (sigprocmask (SIG_BLOCK, &ourset, NULL) != 0)) {
++			fprintf (stderr, _("%s: signal masking malfunction\n"), Prog);
++			kill_child (0);
++		} else {
++			while (0 == waitpid (pid_child, &status, WNOHANG)) {
++				sigsuspend (&ourset);
++			}
++			pid_child = 0;
++			(void) sigprocmask (SIG_UNBLOCK, &ourset, NULL);
++		}
++
+ 		(void) fputs (_(" ...terminated.\n"), stderr);
+ 	}
+ 
diff --git a/gnu/packages/patches/texlive-texmf-CVE-2016-10243.patch b/gnu/packages/patches/texlive-texmf-CVE-2016-10243.patch
new file mode 100644
index 0000000000..3a9ae993f6
--- /dev/null
+++ b/gnu/packages/patches/texlive-texmf-CVE-2016-10243.patch
@@ -0,0 +1,18 @@
+Fix CVE-2016-10243:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10243
+
+Patch adapted from upstream commit:
+
+https://www.tug.org/svn/texlive?view=revision&revision=42605
+
+--- trunk/Master/texmf-dist/web2c/texmf.cnf	2016/11/29 23:10:33	42604
++++ trunk/Master/texmf-dist/web2c/texmf.cnf	2016/11/29 23:27:53	42605
+@@ -568,7 +568,6 @@ extractbb,\
+ gregorio,\
+ kpsewhich,\
+ makeindex,\
+-mpost,\
+ repstopdf,\
+ 
+ % we'd like to allow:
diff --git a/gnu/packages/patches/util-linux-CVE-2017-2616.patch b/gnu/packages/patches/util-linux-CVE-2017-2616.patch
new file mode 100644
index 0000000000..2c82fb06d2
--- /dev/null
+++ b/gnu/packages/patches/util-linux-CVE-2017-2616.patch
@@ -0,0 +1,65 @@
+Fix CVE-2017-2616:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2616
+http://seclists.org/oss-sec/2017/q1/474
+
+Patch copied from upstream source repository:
+
+https://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=dffab154d29a288aa171ff50263ecc8f2e14a891
+
+From b018571132cb8c9fece3d75ed240cc74cdb5f0f7 Mon Sep 17 00:00:00 2001
+From: Karel Zak <kzak@redhat.com>
+Date: Wed, 1 Feb 2017 11:58:09 +0100
+Subject: [PATCH] su: properly clear child PID
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported-by: Tobias Stöckmann <tobias@stoeckmann.org>
+Signed-off-by: Karel Zak <kzak@redhat.com>
+---
+ login-utils/su-common.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/login-utils/su-common.c b/login-utils/su-common.c
+index 0ea4e40bd..b1720f037 100644
+--- a/login-utils/su-common.c
++++ b/login-utils/su-common.c
+@@ -376,6 +376,9 @@ create_watching_parent (void)
+             }
+           else
+             status = WEXITSTATUS (status);
++
++	  /* child is gone, don't use the PID anymore */
++	  child = (pid_t) -1;
+         }
+       else if (caught_signal)
+         status = caught_signal + 128;
+@@ -385,7 +388,7 @@ create_watching_parent (void)
+   else
+     status = 1;
+ 
+-  if (caught_signal)
++  if (caught_signal && child != (pid_t)-1)
+     {
+       fprintf (stderr, _("\nSession terminated, killing shell..."));
+       kill (child, SIGTERM);
+@@ -395,9 +398,12 @@ create_watching_parent (void)
+ 
+   if (caught_signal)
+     {
+-      sleep (2);
+-      kill (child, SIGKILL);
+-      fprintf (stderr, _(" ...killed.\n"));
++      if (child != (pid_t)-1)
++	{
++	  sleep (2);
++	  kill (child, SIGKILL);
++	  fprintf (stderr, _(" ...killed.\n"));
++	}
+ 
+       /* Let's terminate itself with the received signal.
+        *
+-- 
+2.11.1
+
diff --git a/gnu/packages/patches/vdirsyncer-test-suite-slow-machines.patch b/gnu/packages/patches/vdirsyncer-test-suite-slow-machines.patch
deleted file mode 100644
index 03093e8330..0000000000
--- a/gnu/packages/patches/vdirsyncer-test-suite-slow-machines.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Fix test failures caused by some build machines running more slowly than
-expected, which manifest like this:
-
-------
->       raise FailedHealthCheck(message)
-E       hypothesis.errors.FailedHealthCheck: Data generation is extremely slow: Only produced 4 valid examples in 1.08 seconds (1 invalid ones and 0 exceeded maximum size). Try decreasing size of the data you're generating (with e.g.average_size or max_leaves parameters).
-E       See http://hypothesis.readthedocs.org/en/latest/healthchecks.html for more information about this. If you want to disable just this health check, add HealthCheck.too_slowto the suppress_health_check settings for this test.
-
-/gnu/store/b8d1r8bilvm3jkncgrpvmg3dni9cgcr1-python-hypothesis-3.1.0/lib/python3.5/site-packages/hypothesis/core.py:296: FailedHealthCheck
-------
-
-Patch copied from upstream source repository:
-
-https://github.com/pimutils/vdirsyncer/commit/10490a12f13f03495e0945eb9d45d7aed9ab0a6c
-
-From 10490a12f13f03495e0945eb9d45d7aed9ab0a6c Mon Sep 17 00:00:00 2001
-From: Markus Unterwaditzer <markus@unterwaditzer.net>
-Date: Sat, 18 Feb 2017 15:45:06 +0100
-Subject: [PATCH] Unconditionally disable HealthCheck.too_slow
-
----
- tests/conftest.py | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/tests/conftest.py b/tests/conftest.py
-index e0a07d5..3afd7cd 100644
---- a/tests/conftest.py
-+++ b/tests/conftest.py
-@@ -26,10 +26,12 @@ def benchmark():
- else:
-     del pytest_benchmark
- 
-+
-+settings.suppress_health_check = [HealthCheck.too_slow]
-+
- settings.register_profile("ci", settings(
-     max_examples=1000,
-     verbosity=Verbosity.verbose,
--    suppress_health_check=[HealthCheck.too_slow]
- ))
- settings.register_profile("deterministic", settings(
-     derandomize=True,
diff --git a/gnu/packages/patches/vim-CVE-2017-5953.patch b/gnu/packages/patches/vim-CVE-2017-5953.patch
index 7b66f1bf16..070f98c2cb 100644
--- a/gnu/packages/patches/vim-CVE-2017-5953.patch
+++ b/gnu/packages/patches/vim-CVE-2017-5953.patch
@@ -3,20 +3,28 @@ Fix CVE-2017-5953:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5953
 https://groups.google.com/forum/#!topic/vim_dev/t-3RSdEnrHY
 
-Patch adapted from upstream commit, correcting the transcription error
-in the bounds check:
+This change is adapted from the upstream source repository:
 
-https://github.com/vim/vim/commit/399c297aa93afe2c0a39e2a1b3f972aebba44c9d
+https://github.com/vim/vim/commit/6d3c8586fc81b022e9f06c611b9926108fb878c7
 
 diff --git a/src/spellfile.c b/src/spellfile.c
-index c7d87c6..8b1a3a6 100644
+index c7d87c6..00ef019 100644
 --- a/src/spellfile.c
 +++ b/src/spellfile.c
+@@ -1585,7 +1585,7 @@ spell_read_tree(
+     int		prefixtree,	/* TRUE for the prefix tree */
+     int		prefixcnt)	/* when "prefixtree" is TRUE: prefix count */
+ {
+-    int		len;
++    long	len;
+     int		idx;
+     char_u	*bp;
+     idx_T	*ip;
 @@ -1595,6 +1595,9 @@ spell_read_tree(
      len = get4c(fd);
      if (len < 0)
  	return SP_TRUNCERROR;
-+    if (len >= 0x3fffffff)
++    if (len >= LONG_MAX / (long)sizeof(int))
 +	/* Invalid length, multiply with sizeof(int) would overflow. */
 +	return SP_FORMERROR;
      if (len > 0)
diff --git a/gnu/packages/patches/wxwidgets-fix-windowGTK.patch b/gnu/packages/patches/wxwidgets-fix-windowGTK.patch
new file mode 100644
index 0000000000..1255835d01
--- /dev/null
+++ b/gnu/packages/patches/wxwidgets-fix-windowGTK.patch
@@ -0,0 +1,18 @@
+This patch allow Filezilla client to resize window.
+The patch was adapted from upstream source repository:
+'<http://trac.wxwidgets.org/changeset/4793e5b0a4e189e492287305859b278fed780080/git-wxWidgets>'
+
+--- a/src/gtk/toplevel.cpp	2014-10-06 16:33:44.000000000 -0500
++++ b/src/gtk/toplevel.cpp	2017-02-16 21:33:27.779907810 -0600
+@@ -1216,8 +1216,9 @@
+     int hints_mask = GDK_HINT_MIN_SIZE | GDK_HINT_MAX_SIZE;
+     hints.min_width = 1;
+     hints.min_height = 1;
+-    hints.max_width = INT_MAX;
+-    hints.max_height = INT_MAX;
++    // using INT_MAX for size will lead to integer overflow with HiDPI scaling
++    hints.max_width = INT_MAX / 16;
++    hints.max_height = INT_MAX / 16;    
+     const int decorSize_x = m_decorSize.left + m_decorSize.right;
+     const int decorSize_y = m_decorSize.top + m_decorSize.bottom;
+     if (minSize.x > decorSize_x)