Merge branch 'master' into core-updates

78 files changed, 2290 insertions, 2381 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index b925485be5..6b4b06f46d 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -147,6 +147,7 @@ Package Management
 * Invoking guix gc::            Running the garbage collector.
 * Invoking guix pull::          Fetching the latest Guix and distribution.
 * Channels::                    Customizing the package collection.
+* Inferiors::                   Interacting with another revision of Guix.
 * Invoking guix describe::      Display information about your Guix revision.
 * Invoking guix pack::          Creating software bundles.
 * Invoking guix archive::       Exporting and importing store files.
@@ -1699,6 +1700,7 @@ guix package -i emacs-guix
 * Invoking guix gc::            Running the garbage collector.
 * Invoking guix pull::          Fetching the latest Guix and distribution.
 * Channels::                    Customizing the package collection.
+* Inferiors::                   Interacting with another revision of Guix.
 * Invoking guix describe::      Display information about your Guix revision.
 * Invoking guix pack::          Creating software bundles.
 * Invoking guix archive::       Exporting and importing store files.
@@ -3053,6 +3055,135 @@ package it defines.
 This gives you super powers, allowing you to track the provenance of binary
 artifacts with very fine grain, and to reproduce software environments at
 will---some sort of ``meta reproducibility'' capabilities, if you will.
+@xref{Inferiors}, for another way to take advantage of these super powers.
+
+@node Inferiors
+@section Inferiors
+
+@c TODO: Remove this once we're more confident about API stability.
+@quotation Note
+The functionality described here is a ``technology preview'' as of version
+@value{VERSION}.  As such, the interface is subject to change.
+@end quotation
+
+@cindex inferiors
+@cindex composition of Guix revisions
+Sometimes you might need to mix packages from the revision of Guix you're
+currently running with packages available in a different revision of Guix.
+Guix @dfn{inferiors} allow you to achieve that by composing different Guix
+revisions in arbitrary ways.
+
+@cindex inferior packages
+Technically, an ``inferior'' is essentially a separate Guix process connected
+to your main Guix process through a REPL (@pxref{Invoking guix repl}).  The
+@code{(guix inferior)} module allows you to create inferiors and to
+communicate with them.  It also provides a high-level interface to browse and
+manipulate the packages that an inferior provides---@dfn{inferior packages}.
+
+When combined with channels (@pxref{Channels}), inferiors provide a simple way
+to interact with a separate revision of Guix.  For example, let's assume you
+want to install in your profile the current @code{guile} package, along with
+the @code{guile-json} as it existed in an older revision of Guix---perhaps
+because the newer @code{guile-json} has an incompatible API and you want to
+run your code against the old API@.  To do that, you could write a manifest for
+use by @code{guix package --manifest} (@pxref{Invoking guix package}); in that
+manifest, you would create an inferior for that old Guix revision you care
+about, and you would look up the @code{guile-json} package in the inferior:
+
+@lisp
+(use-modules (guix inferior) (guix channels)
+             (srfi srfi-1))   ;for 'first'
+
+(define channels
+  ;; This is the old revision from which we want to
+  ;; extract guile-json.
+  (list (channel
+         (name 'guix)
+         (url "https://git.savannah.gnu.org/git/guix.git")
+         (commit
+          "65956ad3526ba09e1f7a40722c96c6ef7c0936fe"))))
+
+(define inferior
+  ;; An inferior representing the above revision.
+  (inferior-for-channels channels))
+
+;; Now create a manifest with the current "guile" package
+;; and the old "guile-json" package.
+(packages->manifest
+ (list (first (lookup-inferior-packages inferior "guile-json"))
+       (specification->package "guile")))
+@end lisp
+
+On its first run, @command{guix package --manifest} might have to build the
+channel you specified before it can create the inferior; subsequent runs will
+be much faster because the Guix revision will be cached.
+
+The @code{(guix inferior)} module provides the following procedures to open an
+inferior:
+
+@deffn {Scheme Procedure} inferior-for-channels @var{channels} @
+   [#:cache-directory] [#:ttl]
+Return an inferior for @var{channels}, a list of channels.  Use the cache at
+@var{cache-directory}, where entries can be reclaimed after @var{ttl} seconds.
+This procedure opens a new connection to the build daemon.
+
+As a side effect, this procedure may build or substitute binaries for
+@var{channels}, which can take time.
+@end deffn
+
+@deffn {Scheme Procedure} open-inferior @var{directory} @
+  [#:command "bin/guix"]
+Open the inferior Guix in @var{directory}, running
+@code{@var{directory}/@var{command} repl} or equivalent.  Return @code{#f} if
+the inferior could not be launched.
+@end deffn
+
+@cindex inferior packages
+The procedures listed below allow you to obtain and manipulate inferior
+packages.
+
+@deffn {Scheme Procedure} inferior-packages @var{inferior}
+Return the list of packages known to @var{inferior}.
+@end deffn
+
+@deffn {Scheme Procedure} lookup-inferior-packages @var{inferior} @var{name} @
+   [@var{version}]
+Return the sorted list of inferior packages matching @var{name} in
+@var{inferior}, with highest version numbers first.  If @var{version} is true,
+return only packages with a version number prefixed by @var{version}.
+@end deffn
+
+@deffn {Scheme Procedure} inferior-package? @var{obj}
+Return true if @var{obj} is an inferior package.
+@end deffn
+
+@deffn {Scheme Procedure} inferior-package-name @var{package}
+@deffnx {Scheme Procedure} inferior-package-version @var{package}
+@deffnx {Scheme Procedure} inferior-package-synopsis @var{package}
+@deffnx {Scheme Procedure} inferior-package-description @var{package}
+@deffnx {Scheme Procedure} inferior-package-home-page @var{package}
+@deffnx {Scheme Procedure} inferior-package-location @var{package}
+@deffnx {Scheme Procedure} inferior-package-inputs @var{package}
+@deffnx {Scheme Procedure} inferior-package-native-inputs @var{package}
+@deffnx {Scheme Procedure} inferior-package-propagated-inputs @var{package}
+@deffnx {Scheme Procedure} inferior-package-transitive-propagated-inputs @var{package}
+@deffnx {Scheme Procedure} inferior-package-native-search-paths @var{package}
+@deffnx {Scheme Procedure} inferior-package-transitive-native-search-paths @var{package}
+@deffnx {Scheme Procedure} inferior-package-search-paths @var{package}
+These procedures are the counterpart of package record accessors
+(@pxref{package Reference}).  Most of them work by querying the inferior
+@var{package} comes from, so the inferior must still be live when you call
+these procedures.
+@end deffn
+
+Inferior packages can be used transparently like any other package or
+file-like object in G-expressions (@pxref{G-Expressions}).  They are also
+transparently handled by the @code{packages->manifest} procedure, which is
+commonly use in manifests (@pxref{Invoking guix package, the
+@option{--manifest} option of @command{guix package}}).  Thus you can insert
+an inferior package pretty much anywhere you would insert a regular package:
+in manifests, in the @code{packages} field of your @code{operating-system}
+declaration, and so on.
 
 @node Invoking guix describe
 @section Invoking @command{guix describe}
@@ -16757,6 +16888,86 @@ body of a named location block cannot contain location blocks.
 @end table
 @end deftp
 
+@subsubheading Varnish Cache
+@cindex Varnish
+Varnish is a fast cache server that sits in between web applications
+and end users.  It proxies requests from clients and caches the
+accessed URLs such that multiple requests for the same resource only
+creates one request to the back-end.
+
+@defvr {Scheme Variable} varnish-service-type
+Service type for the Varnish daemon.
+@end defvr
+
+@deftp {Data Type} varnish-configuration
+Data type representing the @code{varnish} service configuration.
+This type has the following parameters:
+
+@table @asis
+@item @code{package} (default: @code{varnish})
+The Varnish package to use.
+
+@item @code{name} (default: @code{"default"})
+A name for this Varnish instance.  Varnish will create a directory in
+@file{/var/varnish/} with this name and keep temporary files there.  If
+the name starts with a forward slash, it is interpreted as an absolute
+directory name.
+
+Pass the @code{-n} argument to other Varnish programs to connect to the
+named instance, e.g. @command{varnishncsa -n default}.
+
+@item @code{backend} (default: @code{"localhost:8080"})
+The backend to use.  This option has no effect if @code{vcl} is set.
+
+@item @code{vcl} (default: #f)
+The @dfn{VCL} (Varnish Configuration Language) program to run.  If this
+is @code{#f}, Varnish will proxy @code{backend} using the default
+configuration.  Otherwise this must be a file-like object with valid
+VCL syntax.
+
+@c Varnish does not support HTTPS, so keep this URL to avoid confusion.
+For example, to mirror @url{http://www.gnu.org,www.gnu.org} with VCL you
+can do something along these lines:
+
+@example
+(define %gnu-mirror
+  (plain-file
+   "gnu.vcl"
+   "vcl 4.1;
+backend gnu @{ .host = "www.gnu.org"; @}"))
+
+(operating-system
+  ...
+  (services (cons (service varnish-service-type
+                           (varnish-configuration
+                            (listen '(":80"))
+                            (vcl %gnu-mirror)))
+                  %base-services)))
+@end example
+
+The configuration of an already running Varnish instance can be inspected
+and changed using the @command{varnishadm} program.
+
+Consult the @url{https://varnish-cache.org/docs/,Varnish User Guide} and
+@url{https://book.varnish-software.com/4.0/,Varnish Book} for
+comprehensive documentation on Varnish and its configuration language.
+
+@item @code{listen} (default: @code{'("localhost:80")})
+List of addresses Varnish will listen on.
+
+@item @code{storage} (default: @code{'("malloc,128m")})
+List of storage backends that will be available in VCL.
+
+@item @code{parameters} (default: @code{'()})
+List of run-time parameters in the form @code{'(("parameter" . "value"))}.
+
+@item @code{extra-options} (default: @code{'()})
+Additional arguments to pass to the @command{varnishd} process.
+
+@end table
+@end deftp
+
+@subsubheading FastCGI
 @cindex fastcgi
 @cindex fcgiwrap
 FastCGI is an interface between the front-end and the back-end of a web
diff --git a/gnu/local.mk b/gnu/local.mk
index c10894cb5d..9dbb259721 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -808,14 +808,12 @@ dist_patch_DATA =						\
   %D%/packages/patches/hdf-eos5-remove-gctp.patch		\
   %D%/packages/patches/hdf-eos5-fix-szip.patch			\
   %D%/packages/patches/hdf-eos5-fortrantests.patch		\
-  %D%/packages/patches/hmmer-remove-cpu-specificity.patch	\
   %D%/packages/patches/higan-remove-march-native-flag.patch	\
   %D%/packages/patches/hubbub-sort-entities.patch		\
   %D%/packages/patches/hurd-fix-eth-multiplexer-dependency.patch        \
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
   %D%/packages/patches/icecat-avoid-bundled-libraries.patch	\
-  %D%/packages/patches/icecat-bug-1413868-pt1.patch		\
-  %D%/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch	\
+  %D%/packages/patches/icecat-CVE-2018-12383.patch		\
   %D%/packages/patches/icecat-use-system-graphite2.patch	\
   %D%/packages/patches/icecat-use-system-harfbuzz.patch		\
   %D%/packages/patches/icedtea-6-hotspot-gcc-segfault-workaround.patch  \
@@ -918,6 +916,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/libutils-remove-damaging-includes.patch	\
   %D%/packages/patches/libvdpau-va-gl-unbundle.patch		\
   %D%/packages/patches/libvpx-CVE-2016-2818.patch		\
+  %D%/packages/patches/libvpx-use-after-free-in-postproc.patch	\
   %D%/packages/patches/libxslt-generated-ids.patch		\
   %D%/packages/patches/libxt-guix-search-paths.patch		\
   %D%/packages/patches/lierolibre-check-unaligned-access.patch	\
@@ -1114,7 +1113,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/reptyr-fix-gcc-7.patch			\
   %D%/packages/patches/ripperx-missing-file.patch		\
   %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
-  %D%/packages/patches/rsem-makefile.patch			\
   %D%/packages/patches/rtags-separate-rct.patch			\
   %D%/packages/patches/racket-store-checksum-override.patch	\
   %D%/packages/patches/ruby-rubygems-276-for-ruby24.patch	\
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index e7e34ab97f..8f504cafef 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -869,7 +869,7 @@ over ssh connections.")
 (define-public rename
   (package
     (name "rename")
-    (version "0.35")
+    (version "1.00")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -877,8 +877,24 @@ over ssh connections.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "052iqmn7ya3w1nadpiyavmr3rx566r0lbflx94y8b5wx9q5c16rq"))))
+                "03yhf8nmqsb0zyliv501fdvwlp589jqfn44yqkrflmpzrbik3zxl"))))
     (build-system perl-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'find-itself
+           ;; Fix run-time 'Can't locate File/Rename.pm in @INC' failure.
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin")))
+               (with-directory-excursion bin
+                 (for-each
+                  (lambda (program)
+                    (wrap-program program
+                      `("PERL5LIB" ":" prefix
+                        (,(string-append out "/lib/perl5/site_perl")))))
+                  (find-files "." ".*")))
+               #t))))))
     (native-inputs
      `(("perl-module-build" ,perl-module-build)
        ("perl-test-pod" ,perl-test-pod)
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index 42ba2d3a7e..bcb4c1dfc8 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -2015,14 +2015,14 @@ and ALSA.")
 (define-public qjackctl
   (package
     (name "qjackctl")
-    (version "0.5.3")
+    (version "0.5.4")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/qjackctl/qjackctl/"
                                   version "/qjackctl-" version ".tar.gz"))
               (sha256
                (base32
-                "0x08af8m5l8qy9av3dlldsg58ny9nc69h1s4i6hqkvj24jwy6fw1"))))
+                "0qr71nb93gkz5q53nfcl5g168z173wc6s8w1yjs3rfn3m4hg0bcq"))))
     (build-system gnu-build-system)
     (arguments
      '(#:tests? #f))                    ; no check target
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 67f24a6170..e74abf005f 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -2936,18 +2936,15 @@ indexing scheme is called a @dfn{Hierarchical Graph FM index} (HGFM).")
 (define-public hmmer
   (package
     (name "hmmer")
-    (version "3.1b2")
+    (version "3.2.1")
     (source
      (origin
        (method url-fetch)
        (uri (string-append
-             "http://eddylab.org/software/hmmer"
-             (version-major version) "/"
-             version "/hmmer-" version ".tar.gz"))
+             "http://eddylab.org/software/hmmer/hmmer-" version ".tar.gz"))
        (sha256
         (base32
-         "0djmgc0pfli0jilfx8hql1axhwhqxqb8rxg2r5rg07aw73sfs5nx"))
-       (patches (search-patches "hmmer-remove-cpu-specificity.patch"))))
+         "171bivy6xhgjsz5nv53n81pc3frnwz29ylblawk2bv46szwjjqd5"))))
     (build-system gnu-build-system)
     (native-inputs `(("perl" ,perl)))
     (home-page "http://hmmer.org/")
@@ -2957,12 +2954,10 @@ indexing scheme is called a @dfn{Hierarchical Graph FM index} (HGFM).")
 sequences, and for making protein sequence alignments.  It implements methods
 using probabilistic models called profile hidden Markov models (profile
 HMMs).")
-    (license (list license:gpl3+
-                   ;; The bundled library 'easel' is distributed
-                   ;; under The Janelia Farm Software License.
-                   (license:non-copyleft
-                    "file://easel/LICENSE"
-                    "See easel/LICENSE in the distribution.")))))
+    ;; hmmer uses non-portable SSE intrinsics so building fails on other
+    ;; platforms.
+    (supported-systems '("x86_64-linux" "i686-linux"))
+    (license license:bsd-3)))
 
 (define-public htseq
   (package
@@ -4800,66 +4795,79 @@ phylogenies.")
 (define-public rsem
   (package
     (name "rsem")
-    (version "1.2.20")
+    (version "1.3.1")
     (source
      (origin
-       (method url-fetch)
-       (uri
-        (string-append "http://deweylab.biostat.wisc.edu/rsem/src/rsem-"
-                       version ".tar.gz"))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/deweylab/RSEM.git")
+             (commit (string-append "v" version))))
        (sha256
-        (base32 "0nzdc0j0hjllhsd5f2xli95dafm3nawskigs140xzvjk67xh0r9q"))
-       (patches (search-patches "rsem-makefile.patch"))
+        (base32 "1jlq11d1p8qp64w75yj8cnbbd1a93viq10pzsbwal7vdn8fg13j1"))
+       (file-name (git-file-name name version))
        (modules '((guix build utils)))
        (snippet
         '(begin
-           ;; remove bundled copy of boost
+           ;; remove bundled copy of boost and samtools
            (delete-file-recursively "boost")
+           (delete-file-recursively "samtools-1.3")
            #t))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f ;no "check" target
+       #:make-flags
+       (list (string-append "BOOST="
+                            (assoc-ref %build-inputs "boost")
+                            "/include/")
+             (string-append "SAMHEADERS="
+                            (assoc-ref %build-inputs "htslib")
+                            "/include/htslib/sam.h")
+             (string-append "SAMLIBS="
+                            (assoc-ref %build-inputs "htslib")
+                            "/lib/libhts.a"))
        #:phases
        (modify-phases %standard-phases
          ;; No "configure" script.
          ;; Do not build bundled samtools library.
          (replace 'configure
-                  (lambda _
-                    (substitute* "Makefile"
-                      (("^all : sam/libbam.a") "all : "))
-                    #t))
+           (lambda _
+             (substitute* "Makefile"
+               (("^all : \\$\\(PROGRAMS\\).*") "all: $(PROGRAMS)\n")
+               (("^\\$\\(SAMLIBS\\).*") ""))
+             #t))
          (replace 'install
-                  (lambda* (#:key outputs #:allow-other-keys)
-                    (let* ((out (string-append (assoc-ref outputs "out")))
-                           (bin (string-append out "/bin/"))
-                           (perl (string-append out "/lib/perl5/site_perl")))
-                      (mkdir-p bin)
-                      (mkdir-p perl)
-                      (for-each (lambda (file)
-                                  (install-file file bin))
-                                (find-files "." "rsem-.*"))
-                      (install-file "rsem_perl_utils.pm" perl))
-                    #t))
-         (add-after
-          'install 'wrap-program
-          (lambda* (#:key outputs #:allow-other-keys)
-            (let ((out (assoc-ref outputs "out")))
-              (for-each (lambda (prog)
-                          (wrap-program (string-append out "/bin/" prog)
-                            `("PERL5LIB" ":" prefix
-                              (,(string-append out "/lib/perl5/site_perl")))))
-                        '("rsem-plot-transcript-wiggles"
-                          "rsem-calculate-expression"
-                          "rsem-generate-ngvector"
-                          "rsem-run-ebseq"
-                          "rsem-prepare-reference")))
-            #t)))))
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (string-append (assoc-ref outputs "out")))
+                    (bin (string-append out "/bin/"))
+                    (perl (string-append out "/lib/perl5/site_perl")))
+               (mkdir-p bin)
+               (mkdir-p perl)
+               (for-each (lambda (file)
+                           (install-file file bin))
+                         (find-files "." "rsem-.*"))
+               (install-file "rsem_perl_utils.pm" perl))
+             #t))
+         (add-after 'install 'wrap-program
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (for-each (lambda (prog)
+                           (wrap-program (string-append out "/bin/" prog)
+                             `("PERL5LIB" ":" prefix
+                               (,(string-append out "/lib/perl5/site_perl")))))
+                         '("rsem-calculate-expression"
+                           "rsem-control-fdr"
+                           "rsem-generate-data-matrix"
+                           "rsem-generate-ngvector"
+                           "rsem-plot-transcript-wiggles"
+                           "rsem-prepare-reference"
+                           "rsem-run-ebseq"
+                           "rsem-run-prsem-testing-procedure")))
+             #t)))))
     (inputs
      `(("boost" ,boost)
-       ("ncurses" ,ncurses)
        ("r-minimal" ,r-minimal)
        ("perl" ,perl)
-       ("samtools" ,samtools-0.1)
+       ("htslib" ,htslib-1.3)
        ("zlib" ,zlib)))
     (home-page "http://deweylab.biostat.wisc.edu/rsem/")
     (synopsis "Estimate gene expression levels from RNA-Seq data")
@@ -13723,3 +13731,141 @@ juicer) and single-resolution or multi-resolution @code{.cool} files (for
 cooler).  Both @code{hic} and @code{cool} files describe Hi-C contact
 matrices.")
     (license license:expat)))
+
+(define-public r-pore
+  (package
+    (name "r-pore")
+    (version "0.24")
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append "mirror://sourceforge/rpore/" version
+                       "/poRe_" version ".tar.gz"))
+       (sha256
+        (base32 "0pih9nljbv8g4x8rkk29i7aqq681b782r5s5ynp4nw9yzqnmmksv"))))
+    (properties `((upstream-name . "poRe")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-bit64" ,r-bit64)
+       ("r-data-table" ,r-data-table)
+       ("r-rhdf5" ,r-rhdf5)
+       ("r-shiny" ,r-shiny)
+       ("r-svdialogs" ,r-svdialogs)))
+    (home-page "https://sourceforge.net/projects/rpore/")
+    (synopsis "Visualize Nanopore sequencing data")
+    (description
+     "This package provides graphical user interfaces to organize and visualize Nanopore
+sequencing data.")
+    ;; This is free software but the license variant is unclear:
+    ;; <https://github.com/mw55309/poRe_docs/issues/10>.
+    (license license:bsd-3)))
+
+(define-public r-xbioc
+  (let ((revision "1")
+        (commit "f798c187e376fd1ba27abd559f47bbae7e3e466b"))
+    (package
+      (name "r-xbioc")
+      (version (git-version "0.1.15" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/renozao/xbioc.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "03hffh2f6z71y6l6dqpa5cql3hdaw7zigdi8sm2dzgx379k9rgrr"))))
+      (build-system r-build-system)
+      (propagated-inputs
+       `(("r-annotationdbi" ,r-annotationdbi)
+         ("r-assertthat" ,r-assertthat)
+         ("r-biobase" ,r-biobase)
+         ("r-biocinstaller" ,r-biocinstaller)
+         ("r-digest" ,r-digest)
+         ("r-pkgmaker" ,r-pkgmaker)
+         ("r-plyr" ,r-plyr)
+         ("r-reshape2" ,r-reshape2)
+         ("r-stringr" ,r-stringr)))
+      (home-page "https://github.com/renozao/xbioc/")
+      (synopsis "Extra base functions for Bioconductor")
+      (description "This package provides extra utility functions to perform
+common tasks in the analysis of omics data, leveraging and enhancing features
+provided by Bioconductor packages.")
+      (license license:gpl3+))))
+
+(define-public r-cssam
+  (let ((revision "1")
+        (commit "9ec58c982fa551af0d80b1a266890d92954833f2"))
+    (package
+      (name "r-cssam")
+      (version (git-version "1.4" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/shenorrLab/csSAM.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "128syf9v39gk0z3ip000qpsjbg6l1siyq6c8b0hz41dzg5achyb3"))))
+      (build-system r-build-system)
+      (propagated-inputs
+       `(("r-formula" ,r-formula)
+         ("r-ggplot2" ,r-ggplot2)
+         ("r-pkgmaker" ,r-pkgmaker)
+         ("r-plyr" ,r-plyr)
+         ("r-rngtools" ,r-rngtools)
+         ("r-scales" ,r-scales)))
+      (home-page "https://github.com/shenorrLab/csSAM/")
+      (synopsis "Cell type-specific statistical analysis of microarray")
+      (description "This package implements the method csSAM that computes
+cell-specific differential expression from measured cell proportions using
+SAM.")
+      ;; Any version
+      (license license:lgpl2.1+))))
+
+(define-public r-bseqsc
+  (let ((revision "1")
+        (commit "fef3f3e38dcf3df37103348b5780937982b43b98"))
+    (package
+      (name "r-bseqsc")
+      (version (git-version "1.0" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/shenorrLab/bseqsc.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1prw13wa20f7wlc3gkkls66n1kxz8d28qrb8icfqdwdnnv8w5qg8"))))
+      (build-system r-build-system)
+      (propagated-inputs
+       `(("r-abind" ,r-abind)
+         ("r-annotationdbi" ,r-annotationdbi)
+         ("r-biobase" ,r-biobase)
+         ("r-cssam" ,r-cssam)
+         ("r-dplyr" ,r-dplyr)
+         ("r-e1071" ,r-e1071)
+         ("r-edger" ,r-edger)
+         ("r-ggplot2" ,r-ggplot2)
+         ("r-nmf" ,r-nmf)
+         ("r-openxlsx" ,r-openxlsx)
+         ("r-pkgmaker" ,r-pkgmaker)
+         ("r-plyr" ,r-plyr)
+         ("r-preprocesscore" ,r-preprocesscore)
+         ("r-rngtools" ,r-rngtools)
+         ("r-scales" ,r-scales)
+         ("r-stringr" ,r-stringr)
+         ("r-xbioc" ,r-xbioc)))
+      (home-page "https://github.com/shenorrLab/bseqsc")
+      (synopsis "Deconvolution of bulk sequencing experiments using single cell data")
+      (description "BSeq-sc is a bioinformatics analysis pipeline that
+leverages single-cell sequencing data to estimate cell type proportion and
+cell type-specific gene expression differences from RNA-seq data from bulk
+tissue samples.  This is a companion package to the publication \"A
+single-cell transcriptomic map of the human and mouse pancreas reveals inter-
+and intra-cell population structure.\" Baron et al. Cell Systems (2016)
+@url{https://www.ncbi.nlm.nih.gov/pubmed/27667365}.")
+      (license license:gpl2+))))
diff --git a/gnu/packages/bittorrent.scm b/gnu/packages/bittorrent.scm
index 3937fac745..59fbd6906b 100644
--- a/gnu/packages/bittorrent.scm
+++ b/gnu/packages/bittorrent.scm
@@ -409,7 +409,7 @@ desktops.")
 (define-public qbittorrent
   (package
     (name "qbittorrent")
-    (version "4.0.4")
+    (version "4.1.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -418,7 +418,7 @@ desktops.")
               (file-name (string-append name "-release-" version ".tar.gz"))
               (sha256
                (base32
-                "145r4lv7rqdhrm5znn3ndxsfdf579n46zvj7c53c422am8ir5xhp"))))
+                "00zrpnwanq9f7maky2z4wnzw08xy902s77scm2gcvxxxankr4j92"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -434,7 +434,7 @@ desktops.")
      `(("boost" ,boost)
        ("libtorrent-rasterbar" ,libtorrent-rasterbar)
        ("openssl" ,openssl)
-       ("python" ,python)
+       ("python" ,python-wrapper)
        ("qtbase" ,qtbase)
        ("qtsvg" ,qtsvg)
        ("zlib" ,zlib)))
diff --git a/gnu/packages/check.scm b/gnu/packages/check.scm
index 1373f17865..2868f72cf9 100644
--- a/gnu/packages/check.scm
+++ b/gnu/packages/check.scm
@@ -1920,14 +1920,14 @@ create data based on random numbers and yet remain repeatable.")
 (define-public python-nose-timer
   (package
     (name "python-nose-timer")
-    (version "0.7.2")
+    (version "0.7.3")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "nose-timer" version))
         (sha256
           (base32
-            "0ywg223p528014z5s0vzck74r4xyw3kvcp2casfnc85dkvir1zj7"))))
+            "0hfz5aqnhf493i9kyb6prm4zm8vx7wmfsyg3nvsnh24lzh2kwx44"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-nose" ,python-nose)
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 5519b85d0b..58e9ad09c7 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -5875,3 +5875,23 @@ score in order to detect blood doping.  The package also contains functions to
 calculate other scores used in anti-doping programs, such as the ratio of
 hemoglobin to reticulocytes (OFF-score), as well as example data.")
     (license license:gpl2+)))
+
+(define-public r-parmigene
+  (package
+    (name "r-parmigene")
+    (version "1.0.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "parmigene" version))
+       (sha256
+        (base32
+         "1fsm6pkr17jcbzkj1hbn91jf890fviqk1lq6ls8pihsdgah1zb4d"))))
+    (build-system r-build-system)
+    (home-page "https://cran.r-project.org/web/packages/parmigene/")
+    (synopsis "Mutual information estimation for gene network reconstruction")
+    (description
+     "This package provides a parallel estimation of the mutual information
+based on entropy estimates from k-nearest neighbors distances and algorithms
+for the reconstruction of gene regulatory networks.")
+    (license license:agpl3+)))
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 4a7aaf7519..b6e5012677 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -1457,15 +1457,15 @@ columns, primary keys, unique constraints and relationships.")
 (define-public perl-dbd-mysql
   (package
     (name "perl-dbd-mysql")
-    (version "4.047")
+    (version "4.048")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "mirror://cpan/authors/id/C/CA/CAPTTOFU/"
+       (uri (string-append "mirror://cpan/authors/id/M/MI/MICHIELB/"
                            "DBD-mysql-" version ".tar.gz"))
        (sha256
         (base32
-         "0idizgr0hr7sj92fbdlb3gv6cva15jkpaq28wrdw4j4p7awx2mls"))))
+         "1zqmch6c9gq06z90mkmk1skajk2kaggriw19ym5w04l7wv5gydqp"))))
     (build-system perl-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/debian.scm b/gnu/packages/debian.scm
index 1974672fb6..5ea263149e 100644
--- a/gnu/packages/debian.scm
+++ b/gnu/packages/debian.scm
@@ -1,6 +1,9 @@
+;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
+;;; This file is part of GNU Guix.
+;;;
 ;;; GNU Guix is free software; you can redistribute it and/or modify it
 ;;; under the terms of the GNU General Public License as published by
 ;;; the Free Software Foundation; either version 3 of the License, or (at
@@ -71,7 +74,7 @@ contains the archive keys used for that.")
 (define-public ubuntu-keyring
   (package
     (name "ubuntu-keyring")
-    (version "2018.02.28")
+    (version "2018.09.18.1")
     (source
       (origin
         (method url-fetch)
@@ -79,7 +82,7 @@ contains the archive keys used for that.")
                             "+files/" name "_" version ".tar.gz"))
         (sha256
          (base32
-          "1zj3012cz7rlx9pm39wnwa0lmi1h38n6bkgbz81vnmcsvqsc9a3a"))))
+          "0csx2n62rj9rxjv4y8qhby7l9rbybfwrb0406pc2cjr7f2yk91af"))))
     (build-system trivial-build-system)
     (arguments
      `(#:modules ((guix build utils))
diff --git a/gnu/packages/education.scm b/gnu/packages/education.scm
index 52dde26f44..8b02adc182 100644
--- a/gnu/packages/education.scm
+++ b/gnu/packages/education.scm
@@ -243,7 +243,7 @@ easy.")
 (define-public snap
   (package
     (name "snap")
-    (version "4.2.1.3")
+    (version "4.2.1.4")
     (source
      (origin
        (method git-fetch)
@@ -253,7 +253,7 @@ easy.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "0n32hg8rx6alk5j58l76gzmicrg1bp7jagz5mh1zrg7591aicjal"))))
+         "0yc0w0cdhvi0nwqqrann2v3y0n7shxh7irgixqvlavp4k49d7aqj"))))
     (build-system trivial-build-system)
     (arguments
      `(#:modules ((guix build utils))
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 9b3a90bd33..f29040c372 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -118,6 +118,7 @@
   #:use-module (gnu packages gnupg)
   #:use-module (gnu packages video)
   #:use-module (gnu packages haskell)
+  #:use-module (gnu packages wordnet)
   #:use-module (guix utils)
   #:use-module (srfi srfi-1)
   #:use-module (ice-9 match))
@@ -334,9 +335,9 @@ editor (without an X toolkit)" )
 ;;; Emacs hacking.
 ;;;
 
-(define-public geiser
+(define-public emacs-geiser
   (package
-    (name "geiser")
+    (name "emacs-geiser")
     (version "0.10")
     (source (origin
              (method url-fetch)
@@ -369,7 +370,10 @@ implementation, Emacs and, ultimately, the schemer, giving them access to live
 metadata.")
     (license license:bsd-3)))
 
-(define-public paredit
+(define-public geiser
+  (deprecated-package "geiser" emacs-geiser))
+
+(define-public emacs-paredit
   (package
     (name "emacs-paredit")
     (version "24")
@@ -394,6 +398,9 @@ for those who may want transient periods of unbalanced parentheses, such as
 when typing parentheses directly or commenting out code line by line.")
     (license license:gpl3+)))
 
+(define-public paredit
+  (deprecated-package "paredit" emacs-paredit))
+
 (define-public git-modes
   (package
     (name "emacs-git-modes")
@@ -443,9 +450,9 @@ For remote processes a substitute is provided, which communicates with Emacs
 on stdout instead of using a socket as the Emacsclient does.")
     (license license:gpl3+)))
 
-(define-public magit
+(define-public emacs-magit
   (package
-    (name "magit")
+    (name "emacs-magit")
     (version "2.13.0")
     (source (origin
              (method url-fetch)
@@ -511,9 +518,12 @@ cherry picking, reverting, merging, rebasing, and other common Git
 operations.")
     (license license:gpl3+)))
 
-(define-public magit-svn
+(define-public magit
+  (deprecated-package "magit" emacs-magit))
+
+(define-public emacs-magit-svn
   (package
-    (name "magit-svn")
+    (name "emacs-magit-svn")
     (version "2.2.0")
     (source (origin
               (method url-fetch)
@@ -530,7 +540,7 @@ operations.")
                      ("gzip" ,gzip)))
     (propagated-inputs `(("dash" ,emacs-dash)
                          ("with-editor" ,emacs-with-editor)
-                         ("magit" ,magit)))
+                         ("magit" ,emacs-magit)))
     (arguments
      `(#:modules ((guix build utils)
                   (guix build emacs-utils))
@@ -576,6 +586,9 @@ operations.")
 support for Git-SVN.")
     (license license:gpl3+)))
 
+(define-public magit-svn
+  (deprecated-package "magit-svn" emacs-magit-svn))
+
 (define-public emacs-magit-popup
   (package
     (name "emacs-magit-popup")
@@ -640,9 +653,9 @@ Gitlab APIs from Emacs packages.  It abstracts access to API resources using
 only a handful of functions that are not resource-specific.")
     (license license:gpl3+)))
 
-(define-public haskell-mode
+(define-public emacs-haskell-mode
   (package
-    (name "haskell-mode")
+    (name "emacs-haskell-mode")
     (version "16.1")
     (source (origin
               (method url-fetch)
@@ -730,7 +743,10 @@ only a handful of functions that are not resource-specific.")
 programs.")
     (license license:gpl3+)))
 
-(define-public flycheck
+(define-public haskell-mode
+  (deprecated-package "haskell-mode" emacs-haskell-mode))
+
+(define-public emacs-flycheck
   (package
     (name "emacs-flycheck")
     (version "31")
@@ -766,6 +782,9 @@ different tools.  It highlights errors and warnings inline in the buffer, and
 provides an optional IDE-like error list.")
     (license license:gpl3+)))                     ;+GFDLv1.3+ for the manual
 
+(define-public flycheck
+  (deprecated-package "flycheck" emacs-flycheck))
+
 
 ;;;
 ;;; Web browsing.
@@ -909,7 +928,7 @@ provides an optional IDE-like error list.")
 ;;; Multimedia.
 ;;;
 
-(define-public emms
+(define-public emacs-emms
   (package
     (name "emacs-emms")
     (version "5.0")
@@ -1047,9 +1066,12 @@ light user interface.")
     (home-page "https://www.gnu.org/software/emms/")
     (license license:gpl3+)))
 
+(define-public emms
+  (deprecated-package "emacs-emms" emacs-emms))
+
 (define-public emacs-emms-player-mpv
   ;; A new mpv backend is included in Emms from 5.0.
-  (deprecated-package "emacs-emms-player-mpv" emms))
+  (deprecated-package "emacs-emms-player-mpv" emacs-emms))
 
 (define-public emacs-emms-mode-line-cycle
   (package
@@ -1079,9 +1101,9 @@ within a specified width.  It is useful for displaying long track titles.")
 ;;; Miscellaneous.
 ;;;
 
-(define-public bbdb
+(define-public emacs-bbdb
   (package
-    (name "bbdb")
+    (name "emacs-bbdb")
     (version "3.1.2")
     (source (origin
               (method url-fetch)
@@ -1120,6 +1142,9 @@ like.  It can be linked with various Emacs mail clients (Message and Mail
 mode, Rmail, Gnus, MH-E, and VM).  BBDB is fully customizable.")
     (license license:gpl3+)))
 
+(define-public bbdb
+  (deprecated-package "bbdb" emacs-bbdb))
+
 (define-public emacs-aggressive-indent
   (package
     (name "emacs-aggressive-indent")
@@ -1720,7 +1745,7 @@ type, for example: packages, buffers, files, etc.")
      `(("guile" ,guile-2.2)
        ("guix" ,guix)))
     (propagated-inputs
-     `(("geiser" ,geiser)
+     `(("geiser" ,emacs-geiser)
        ("guile-gcrypt" ,guile-gcrypt)
        ("dash" ,emacs-dash)
        ("bui" ,emacs-bui)
@@ -2376,7 +2401,7 @@ in Lisp modes.")
                 "1k0sm552iawi49v4zis6dbb81d1rzgky9v0dpv7nj31gnb7bmy7k"))))
     (build-system emacs-build-system)
     (native-inputs
-     `(("ert-runner" ,ert-runner)))
+     `(("ert-runner" ,emacs-ert-runner)))
     (arguments
      `(#:tests? #t
        #:test-command '("ert-runner")))
@@ -2662,7 +2687,7 @@ framework for Emacs Lisp to be used with @code{ert}.")
     (native-inputs
      `(("emacs-ert-expectations" ,emacs-ert-expectations)
        ("emacs-undercover" ,emacs-undercover)
-       ("ert-runner" ,ert-runner)))
+       ("ert-runner" ,emacs-ert-runner)))
     (synopsis "Simple asynchronous functions for Emacs Lisp")
     (description
      "The @code{deferred.el} library provides support for asynchronous tasks.
@@ -2671,7 +2696,7 @@ The API is almost the same as that of
 for asynchronous tasks.")
     (license license:gpl3+)))
 
-(define-public butler
+(define-public emacs-butler
   (package
     (name "emacs-butler")
     (version "0.2.4")
@@ -2697,6 +2722,9 @@ view the build status of those servers' build jobs, and possibly to trigger
 build jobs.")
     (license license:gpl3+)))
 
+(define-public butler
+  (deprecated-package "emacs-butler" emacs-butler))
+
 (define-public emacs-company
   (package
     (name "emacs-company")
@@ -2822,7 +2850,7 @@ completion candidate when using the Company text completion framework.")
 simultaneous cursors.")
     (license license:gpl3+)))
 
-(define-public typo
+(define-public emacs-typo
   (package
     (name "emacs-typo")
     (version "1.1")
@@ -2846,6 +2874,9 @@ automatically inserts a Unicode opening or closing quotation mark, depending
 on context.")
     (license license:gpl3+)))
 
+(define-public typo
+  (deprecated-package "emacs-typo" emacs-typo))
+
 (define-public emacs-scheme-complete
   (let ((commit "9b5cf224bf2a5994bc6d5b152ff487517f1a9bb5"))
     (package
@@ -3981,7 +4012,7 @@ state and will work even without lispy being enabled.")
     (native-inputs
      `(("emacs-dash" ,emacs-dash)
        ("emacs-s" ,emacs-s)
-       ("ert-runner" ,ert-runner)))
+       ("ert-runner" ,emacs-ert-runner)))
     (arguments
      `(#:tests? #t
        #:test-command '("ert-runner")))
@@ -4353,7 +4384,7 @@ indentation and filling of comments and C preprocessor fontification.")
     (propagated-inputs
      `(("emacs-dash" ,emacs-dash)
        ("emacs-s" ,emacs-s)
-       ("emacs-flycheck" ,flycheck)
+       ("emacs-flycheck" ,emacs-flycheck)
        ("emacs-typescript-mode" ,emacs-typescript-mode)))
     (home-page "https://github.com/ananthakumaran/tide")
     (synopsis "Typescript IDE for Emacs")
@@ -4518,7 +4549,7 @@ provide the historic behavior of @code{flet}, as well as
      `(#:tests? #t
        #:test-command '("ert-runner")))
     (native-inputs
-     `(("ert-runner" ,ert-runner)))
+     `(("ert-runner" ,emacs-ert-runner)))
     (propagated-inputs
      `(("emacs-el-x" ,emacs-el-x)))
     (home-page "https://github.com/sigma/mocker.el")
@@ -4584,7 +4615,7 @@ functions to assist in reviewing changes on files.")
        #:tests? #t
        #:test-command '("ert-runner")))
     (native-inputs
-     `(("ert-runner" ,ert-runner)
+     `(("ert-runner" ,emacs-ert-runner)
        ("emacs-mocker" ,emacs-mocker)))
     (home-page "https://github.com/jorgenschaefer/pyvenv")
     (synopsis "Virtualenv minor mode for Emacs")
@@ -4669,7 +4700,7 @@ indentation (space indentation only).
        ("pyvenv" ,emacs-pyvenv)
        ("s" ,emacs-s)))
     (native-inputs
-     `(("ert-runner" ,ert-runner)
+     `(("ert-runner" ,emacs-ert-runner)
        ("emacs-f" ,emacs-f)
        ("python" ,python-wrapper)
        ("python-autopep8" ,python-autopep8)
@@ -5252,7 +5283,7 @@ distribution, primarily targeting Clojure users")
 (define-public emacs-orgalist
   (package
     (name "emacs-orgalist")
-    (version "1.8")
+    (version "1.9")
     (source
      (origin
        (method url-fetch)
@@ -5260,7 +5291,7 @@ distribution, primarily targeting Clojure users")
                            "orgalist-" version ".el"))
        (sha256
         (base32
-         "1wqwnmn08i0qkxm8b2iclvf6cydcn68h1p3h7r1kig2bdn5b8948"))))
+         "1rmmcyiiqkq54hn74nhzxzl4nvd902hv6gq341jwhrm7yiagffi6"))))
     (build-system emacs-build-system)
     (home-page "http://elpa.gnu.org/packages/orgalist.html")
     (synopsis "Manage Org-like lists in non-Org buffers")
@@ -5318,14 +5349,14 @@ passive voice.")
     (name "emacs-org")
     ;; emacs-org-contrib inherits from this package.  Please update its sha256
     ;; checksum as well.
-    (version "9.1.13")
+    (version "9.1.14")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://elpa.gnu.org/packages/org-"
                                   version ".tar"))
               (sha256
                (base32
-                "1vx0n32gvrgy2bl2b4pvxf00cywxwm57gi46f2b2zlrnmd5n85pr"))))
+                "17vd9hig26rqv90l6y92hc2i0x29g44lsdsp0xd4m53s8r3zdikz"))))
     (build-system emacs-build-system)
     (home-page "https://orgmode.org/")
     (synopsis "Outline-based notes management and organizer")
@@ -5507,14 +5538,15 @@ extensibility.")
 (define-public m17n-db
   (package
     (name "m17n-db")
-    (version "1.7.0")
+    (version "1.8.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/m17n/m17n-db-"
                            version ".tar.gz"))
        (sha256
-        (base32 "1w08hnsbknrcjlzp42c99bgwc9hzsnf5m4apdv0dacql2s09zfm2"))))
+        (base32
+         "0vfw7z9i2s9np6nmx1d4dlsywm044rkaqarn7akffmb6bf1j6zv5"))))
     (build-system gnu-build-system)
     (inputs
      `(("gettext" ,gettext-minimal)))
@@ -5541,14 +5573,15 @@ This package contains the library database.")
 (define-public m17n-lib
   (package
     (name "m17n-lib")
-    (version "1.7.0")
+    (version "1.8.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/m17n/m17n-lib-"
                            version ".tar.gz"))
        (sha256
-        (base32 "10yv730i25g1rpzv6q49m6xn4p8fjm7jdwvik2h70sn8w3hm7f4f"))))
+        (base32
+         "0jp61y09xqj10mclpip48qlfhniw8gwy8b28cbzxy8hq8pkwmfkq"))))
     (build-system gnu-build-system)
     (inputs
      `(("fribidi" ,fribidi)
@@ -6931,9 +6964,9 @@ Emacs.")
 
 ;; Tests for ert-runner have a circular dependency with ecukes, and therefore
 ;; cannot be run
-(define-public ert-runner
+(define-public emacs-ert-runner
   (package
-    (name "ert-runner")
+    (name "emacs-ert-runner")
     (version "0.7.0")
     (source
      (origin
@@ -6976,6 +7009,9 @@ using ERT.  It assumes a certain test structure setup and can therefore make
 running tests easier.")
     (license license:gpl3+)))
 
+(define-public ert-runner
+  (deprecated-package "ert-runner" emacs-ert-runner))
+
 (define-public emacs-disable-mouse
   (package
     (name "emacs-disable-mouse")
@@ -7019,7 +7055,7 @@ running a customisable handler command (@code{ignore} by default). ")
     (native-inputs
      `(("emacs-dash" ,emacs-dash)
        ("emacs-shut-up" ,emacs-shut-up)
-       ("ert-runner" ,ert-runner)))
+       ("ert-runner" ,emacs-ert-runner)))
     (arguments
      `(#:tests? #t
        #:test-command '("ert-runner")))
@@ -7250,7 +7286,7 @@ settings).")
                 "1a4b0lsmwq84qfx51c5xy4fryhb1ysld4fhgw2vr37izf53379sb"))))
     (build-system emacs-build-system)
     (native-inputs
-     `(("ert-runner" ,ert-runner)))
+     `(("ert-runner" ,emacs-ert-runner)))
     (arguments
      `(#:tests? #t
        #:test-command '("ert-runner" "tests")))
@@ -7506,7 +7542,7 @@ Idris.")
      `(("emacs-f" ,emacs-f)
        ("emacs-s" ,emacs-s)))
     (native-inputs
-     `(("ert-runner" ,ert-runner)))
+     `(("ert-runner" ,emacs-ert-runner)))
     (arguments
      `(#:tests? #t
        #:test-command '("ert-runner")))
@@ -7976,9 +8012,9 @@ supports multiple backends such as @code{vlc}, @code{mpg123},
 @code{afplay}.")
     (license license:gpl2+)))
 
-(define-public groovy-emacs-modes
+(define-public emacs-groovy-modes
   (package
-    (name "groovy-emacs-modes")
+    (name "emacs-groovy-modes")
     (version "2.0")
     (source (origin
               (method url-fetch)
@@ -8000,7 +8036,10 @@ Groovy source files, REPL integration with run-groovy and Grails project
 navigation with the grails mode.")
     (license license:gpl3+)))
 
-(define-public org-tree-slide
+(define-public groovy-emacs-modes
+  (deprecated-package "groovy-emacs-modes" emacs-groovy-modes))
+
+(define-public emacs-org-tree-slide
   (let ((commit "dff8f1a4a64c8dd0a1fde0b0131e2fe186747134")
         (revision "0"))
     (package
@@ -8022,6 +8061,9 @@ navigation with the grails mode.")
 @kbd{C-<} to jump to the next and previous slide.")
       (license license:gpl3+))))
 
+(define-public org-tree-slide
+  (deprecated-package "emacs-org-tree-slide" emacs-org-tree-slide))
+
 (define-public emacs-scratch-el
   (let ((commit "2cdf2b841ce7a0987093f65b0cc431947549f897")
         (revision "1"))
@@ -8394,7 +8436,7 @@ close, copy, cut, paste, undo, redo.")
 (define-public emacs-password-store
   (package
     (name "emacs-password-store")
-    (version "1.7.2")
+    (version "1.7.3")
     (source (origin
               (method url-fetch)
               (uri
@@ -8402,7 +8444,7 @@ close, copy, cut, paste, undo, redo.")
                               "password-store-" version ".tar.xz"))
               (sha256
                (base32
-                "1sl0d7nc85c6c2bmmmyb8rpmn47vhkj831l153mjlkawjvhwas27"))))
+                "1x53k5dn3cdmvy8m4fqdld4hji5n676ksl0ql4armkmsds26av1b"))))
     (build-system emacs-build-system)
     (arguments
      `(#:phases
@@ -10094,7 +10136,7 @@ time is being spent during Emacs startup in order to optimize startup time.")
 
 (define-public emacs-emms-player-simple-mpv
   ;; A new mpv backend is included in Emms from 5.0.
-  (deprecated-package "emacs-emms-player-simple-mpv" emms))
+  (deprecated-package "emacs-emms-player-simple-mpv" emacs-emms))
 
 (define-public emacs-magit-org-todos-el
   (let ((commit "df206287737b9671f2e36ae7b1474ebbe9940d2a"))
@@ -10112,7 +10154,7 @@ time is being spent during Emacs startup in order to optimize startup time.")
           (base32
            "0kdp7k7jnnrkhsg0xh1c3h7iz0vgi120gf5xwl1hxy61avivnxrn"))))
       (propagated-inputs
-       `(("magit" ,magit)))
+       `(("magit" ,emacs-magit)))
       (build-system emacs-build-system)
       (home-page "https://github.com/danielma/magit-org-todos.el")
       (synopsis "Get todo.org into Emacs Magit status")
@@ -10951,7 +10993,7 @@ through the symbol: @command{this-fn}.")
      `(("emacs-el-mock" ,emacs-el-mock)
        ("emacs-noflet" ,emacs-noflet)
        ("emacs-undercover" ,emacs-undercover)
-       ("ert-runner" ,ert-runner)))
+       ("ert-runner" ,emacs-ert-runner)))
     (propagated-inputs
      `(("emacs-f" ,emacs-f)
        ("emacs-popup" ,emacs-popup)))
@@ -11138,7 +11180,7 @@ Org-mode file, and citations of Zotero items in Pandoc Markdown files.")
       (build-system emacs-build-system)
       (propagated-inputs
        `(("emacs-evil" ,emacs-evil)
-         ("magit" ,magit)))
+         ("magit" ,emacs-magit)))
       (home-page
        "https://github.com/emacs-evil/evil-magit")
       (synopsis "Evil-based key bindings for Magit")
@@ -11411,7 +11453,7 @@ you searched for and execute it, or view its documentation.")
       (build-system emacs-build-system)
       (propagated-inputs
        `(("emacs-helm" ,emacs-helm)
-         ("emacs-emms" ,emms)))
+         ("emacs-emms" ,emacs-emms)))
       (home-page
        "https://github.com/emacs-helm/helm-emms")
       (synopsis "Emms for Helm")
@@ -11466,7 +11508,7 @@ See @code{helm-exwm-switch-browser} for an example.")
       (build-system emacs-build-system)
       (propagated-inputs
        `(("emacs-dash" ,emacs-dash)
-         ("emacs-flycheck" ,flycheck)
+         ("emacs-flycheck" ,emacs-flycheck)
          ("emacs-helm" ,emacs-helm)))
       (home-page "https://github.com/yasuyk/helm-flycheck")
       (synopsis "Show Flycheck errors with Helm")
@@ -11705,8 +11747,8 @@ file.")
       (synopsis
        "Show a complete thread in a single buffer")
       (description
-       "This package offers an alternate view to mu4e e-mail display.  It
-shows all e-mails of a thread in a single view, where each correspondant has
+       "This package offers an alternate view to mu4e's e-mail display.  It
+shows all e-mails of a thread in a single view, where each correspondent has
 their own face.  Threads can be displayed linearly (in which case e-mails are
 displayed in chronological order) or as an Org document where the node tree
 maps the thread tree.")
@@ -12028,7 +12070,7 @@ buffers – other modes on the TODO list).
        ("emacs-dash" ,emacs-dash)
        ("emacs-f" ,emacs-f)
        ("emacs-hl-todo" ,emacs-hl-todo)
-       ("magit" ,magit)
+       ("magit" ,emacs-magit)
        ("emacs-pcre2el" ,emacs-pcre2el)
        ("emacs-s" ,emacs-s)))
     (home-page "https://github.com/alphapapa/magit-todos")
@@ -12197,3 +12239,41 @@ wrapper around all Imagemagick commands with descriptions, autocompletion (for
 some commands) and hints displayed in prompt using @command{eimp.el} to
 execute its commands and resize images.")
       (license license:gpl3+))))
+
+(define-public emacs-synosaurus
+  (let ((commit "8bf95b935976ec0a1964cf175ed57cc5f6f93bdb"))
+    (package
+      (name "emacs-synosaurus")
+      (version (git-version "0.1.0" "1" commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/hpdeifel/synosaurus")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "15by9jccab6kyplxa6k0glzaivxkqdigl33gl2qi2cvy6f2q7gva"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("wordnet" ,wordnet)))
+      (arguments
+       `(#:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'configure
+             (lambda* (#:key inputs outputs #:allow-other-keys)
+               (let ((wn (assoc-ref inputs "wordnet")))
+                 ;; .el is read-only in git.
+                 (chmod "synosaurus-wordnet.el" #o644)
+                 ;; Specify the absolute file names of the various
+                 ;; programs so that everything works out-of-the-box.
+                 (emacs-substitute-variables
+                     "synosaurus-wordnet.el"
+                   ("wordnet-command"
+                    (string-append wn "/bin/wn")))))))))
+      (home-page "https://github.com/hpdeifel/synosaurus")
+      (synopsis "Extensible thesaurus mode for Emacs")
+      (description "Synosaurus is a thesaurus fontend for Emacs with pluggable
+backends, including the @command{wordnet} offline backend.")
+      (license license:gpl3+))))
diff --git a/gnu/packages/enchant.scm b/gnu/packages/enchant.scm
index 8b2796d0e2..0392a709e2 100644
--- a/gnu/packages/enchant.scm
+++ b/gnu/packages/enchant.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 Marek Benc <merkur32@gmail.com>
+;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -19,34 +20,41 @@
 (define-module (gnu packages enchant)
   #:use-module (gnu packages)
   #:use-module (gnu packages aspell)
+  #:use-module (gnu packages check)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages pkg-config)
   #:use-module (guix packages)
   #:use-module (guix download)
   #:use-module (guix build-system gnu)
-  #:use-module (guix licenses))
+  #:use-module (guix licenses)
+  #:use-module (srfi srfi-1))
 
 (define-public enchant
   (package
     (name "enchant")
-    (version "1.6.0")
-    (source
-      (origin
-        (method url-fetch)
-        (uri
-          (string-append "http://www.abisource.com/downloads/" name "/" version
-                         "/" name "-" version ".tar.gz"))
-        (sha256
-          (base32 "0zq9yw1xzk8k9s6x83n1f9srzcwdavzazn3haln4nhp9wxxrxb1g"))))
-
+    (version "2.2.3")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/AbiWord/enchant/releases"
+                                  "/download/v" version "/enchant-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0v87p1ls0gym95qirijpclk650sjbkcjjl6ssk059zswcwaykn5b"))))
     (build-system gnu-build-system)
+    (arguments
+     '(#:configure-flags '("--disable-static"
+                           ;; Tests require a relocatable build.
+                           "--enable-relocatable")))
     (inputs
-      `(("aspell" ,aspell)    ;; Currently, the only supported backend in Guix
-        ("glib" ,glib)))      ;; is aspell. (This information might be old)
+     `(("aspell" ,aspell)))   ;; Currently, the only supported backend in Guix
+    (propagated-inputs        ;; is aspell. (This information might be old)
+     ;; Required by enchant.pc.
+     `(("glib" ,glib)))
     (native-inputs
      `(("glib:bin" ,glib "bin")
-       ("pkg-config" ,pkg-config)))
-
+       ("pkg-config" ,pkg-config)
+       ("unittest-cpp" ,unittest-cpp)))
     (synopsis "Multi-backend spell-checking library wrapper")
     (description
       "On the surface, Enchant appears to be a generic spell checking library.
@@ -57,5 +65,23 @@ Enchant steps in to provide uniformity and conformity on top of these libraries,
 and implement certain features that may be lacking in any individual provider
 library.  Everything should \"just work\" for any and every definition of \"just
 working\".")
-    (home-page "http://www.abisource.com/projects/enchant")
+    (home-page "https://abiword.github.io/enchant/")
     (license lgpl2.1+)))
+
+;; Some packages are not ready for the 2.x API yet, so we keep this version
+;; around.  The library and executables of Enchant 2 have been designed not to
+;; conflict with 1.x, so it's OK if both end up in the same profile.
+(define-public enchant-1.6
+  (package
+    (inherit enchant)
+    (version "1.6.0")
+    (arguments '(#:configure-flags '("--disable-static")))
+    (native-inputs (alist-delete "unittest-cpp"
+                                 (package-native-inputs enchant)))
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "http://www.abisource.com/downloads/enchant/"
+                                  version "/enchant-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0zq9yw1xzk8k9s6x83n1f9srzcwdavzazn3haln4nhp9wxxrxb1g"))))))
diff --git a/gnu/packages/fcitx.scm b/gnu/packages/fcitx.scm
index bcd5f12dd1..b05d9b7146 100644
--- a/gnu/packages/fcitx.scm
+++ b/gnu/packages/fcitx.scm
@@ -75,7 +75,7 @@
        ("pkg-config" ,pkg-config)))
     (inputs
      `(("dbus"             ,dbus)
-       ("enchant"          ,enchant)
+       ("enchant"          ,enchant-1.6)
        ("gettext"          ,gettext-minimal)
        ("gtk2"             ,gtk+-2)
        ("gtk3"             ,gtk+)
diff --git a/gnu/packages/ftp.scm b/gnu/packages/ftp.scm
index d3f3ef711c..faf9f5dd10 100644
--- a/gnu/packages/ftp.scm
+++ b/gnu/packages/ftp.scm
@@ -170,15 +170,15 @@ as required.")
 (define-public libfilezilla
   (package
     (name "libfilezilla")
-    (version "0.13.1")
+    (version "0.13.2")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "http://download.filezilla-project.org/"
+       (uri (string-append "https://download.filezilla-project.org/"
                            name "/" name "-" version ".tar.bz2"))
        (sha256
         (base32
-         "0347zkapp0wrhfm1yzw7wa1v3lww65ch176scifxn8f9068f1ixb"))))
+         "0z9cqscca4w94j9npgcknrrw8gfwn5ids903042fczlr977j0i19"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("cppunit" ,cppunit)
@@ -207,16 +207,14 @@ output.
 (define-public filezilla
   (package
     (name "filezilla")
-    (version "3.31.0")
+    (version "3.37.1")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "https://sourceforge.net/projects/" name
-                           "/files/FileZilla_Client/" version
-                           "/FileZilla_" version "_src" ".tar.bz2"))
+       (uri (string-append "https://download.filezilla-project.org/client/"
+                           "FileZilla_" version "_src.tar.bz2"))
        (sha256
-        (base32
-         "1rfysb8dil35a7bzj2kw0mzzkys39d7yn6ipsbk8l6rkwfvnii8l"))))
+        (base32 "1bbxlm8gc0r5jing8xmkdbhj5a1qfbjn8varhny3mrk1am4m7s7l"))))
     (build-system gnu-build-system)
     (arguments
       ;; Don't let filezilla phone home to check for updates.
diff --git a/gnu/packages/gl.scm b/gnu/packages/gl.scm
index 067b41b476..03c8b497b8 100644
--- a/gnu/packages/gl.scm
+++ b/gnu/packages/gl.scm
@@ -725,7 +725,7 @@ mixed vector/bitmap output.")
 (define-public virtualgl
   (package
     (name "virtualgl")
-    (version "2.5.2")
+    (version "2.6")
     (source
      (origin
        (method url-fetch)
@@ -734,16 +734,17 @@ mixed vector/bitmap output.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "0rnid3hwrry9d5d4m7sygq00xxx976rgk00a3557m9r5kxbmy476"))))
+         "1ck1d0w19cgyqvrb9mdlj6l5db90xf18yln71kdninlqxvpgj6h7"))))
     (arguments
-     `(#:tests? #f ;; no tests are available
+     `(#:tests? #f                      ; no tests are available
        #:configure-flags (list
-                           (string-append "-DCMAKE_INSTALL_LIBDIR="
-                                          (assoc-ref %outputs "out") "/lib")
-                           "-DVGL_USESSL=1"))) ;; use OpenSSL
+                          (string-append "-DCMAKE_INSTALL_LIBDIR="
+                                         (assoc-ref %outputs "out") "/lib")
+                          "-DVGL_USESSL=1"))) ; use OpenSSL
     (build-system cmake-build-system)
     (inputs `(("glu" ,glu)
               ("libjpeg-turbo" ,libjpeg-turbo)
+              ("libxtst" ,libxtst)
               ("mesa" ,mesa)
               ("openssl" ,openssl)))
     (native-inputs `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 98ead71e34..86989f9dc9 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -115,6 +115,8 @@
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages pulseaudio)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages python-crypto)
+  #:use-module (gnu packages python-web)
   #:use-module (gnu packages rdesktop)
   #:use-module (gnu packages scanner)
   #:use-module (gnu packages selinux)
@@ -4094,35 +4096,27 @@ work and the interface is well tested.")
 (define-public eolie
   (package
     (name "eolie")
-    (version "0.9.15")
+    (version "0.9.37")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://github.com/gnumdk/eolie/"
-                                  "releases/download/" version
-                                  "/eolie-" version ".tar.xz"))
+              (uri (string-append "https://gitlab.gnome.org/World/eolie/"
+                                  "uploads/4341cb428b7a45670308ee3fb3fa07dd/"
+                                  "eolie-" version ".tar.xz"))
               (sha256
                (base32
-                "0glydxp1xh85gfidk1l9miqn6qxdbvvk5s3iy0pjlv8nrs3263jd"))))
-    (build-system glib-or-gtk-build-system)
+                "126m0nwwy3lqv7z8aj9hiwangih03b1nlkg3xja9p7wbf7zcvp2n"))))
+    (build-system meson-build-system)
     (arguments
-     `(#:phases
+     `(#:glib-or-gtk? #t
+       #:phases
        (modify-phases %standard-phases
-         (delete 'configure)
-         (replace 'build
-           (lambda* (#:key outputs #:allow-other-keys)
-             (zero? (system* "meson" "build"
-                             "--prefix" (assoc-ref outputs "out")))))
-         (replace 'check
-           (lambda _ (zero? (system* "ninja" "-C" "build" "test"))))
-         (replace 'install
-           (lambda* (#:key outputs #:allow-other-keys)
-             (zero? (system* "ninja" "-C" "build" "install"))))
          (add-after 'wrap 'wrap-more
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let* ((out  (assoc-ref outputs "out"))
                     ;; These libraries must be on LD_LIBRARY_PATH.
                     (libs '("gtkspell3" "webkitgtk" "libsoup" "libsecret"
                             "atk" "gtk+" "gsettings-desktop-schemas"
+                            "gcc:lib" ; needed b/c webkitgtk is built with gcc-7
                             "gobject-introspection"))
                     (path (string-join
                            (map (lambda (lib)
@@ -4135,12 +4129,12 @@ work and the interface is well tested.")
                  `("GI_TYPELIB_PATH" = (,(getenv "GI_TYPELIB_PATH")))))
              #t)))))
     (native-inputs
-     `(("intltool" ,intltool)
+     `(("gcc:lib" ,gcc-7 "lib") ; needed because webkitgtk is built with gcc-7
+       ("intltool" ,intltool)
        ("itstool" ,itstool)
        ("pkg-config" ,pkg-config)
-       ("meson" ,meson-for-build)
-       ("ninja" ,ninja)
        ("python" ,python)
+       ("glib:bin" ,glib "bin")
        ("gtk+" ,gtk+ "bin")))
     (inputs
      `(("gobject-introspection" ,gobject-introspection)
@@ -4150,12 +4144,14 @@ work and the interface is well tested.")
        ("atk" ,atk)    ; propagated by gtk+, but we need it in LD_LIBRARY_PATH
        ("python" ,python-wrapper)
        ("python-dateutil" ,python-dateutil)
+       ("python-pyfxa" ,python-pyfxa)
        ("python-pygobject" ,python-pygobject)
        ("python-pycairo" ,python-pycairo)
+       ("python-pycrypto" ,python-pycrypto)
        ("libsecret" ,libsecret)
        ("gtkspell3" ,gtkspell3)
        ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
-       ("webkitgtk" ,webkitgtk)))
+       ("webkitgtk" ,webkitgtk-2.22)))
     (home-page "https://wiki.gnome.org/Apps/Eolie")
     (synopsis "Web browser for GNOME")
     (description
@@ -4193,6 +4189,7 @@ a secret password store, an adblocker, and a modern UI.")
      `(("dconf" ,dconf)))
     (native-inputs
      `(("desktop-file-utils" ,desktop-file-utils) ; for update-desktop-database
+       ("gcc" ,gcc-7)  ; needed because webkitgtk-2.22 is compiled with gcc-7
        ("glib:bin" ,glib "bin") ; for glib-mkenums
        ("gtk+:bin" ,gtk+ "bin") ; for gtk-update-icon-cache
        ("intltool" ,intltool)
@@ -4213,7 +4210,7 @@ a secret password store, an adblocker, and a modern UI.")
        ("libxslt" ,libxslt)
        ("nettle" ,nettle) ; for hogweed
        ("sqlite" ,sqlite)
-       ("webkitgtk" ,webkitgtk)))
+       ("webkitgtk" ,webkitgtk-2.22)))
     (home-page "https://wiki.gnome.org/Apps/Web")
     (synopsis "GNOME web browser")
     (description
@@ -6936,7 +6933,7 @@ that support the Assistive Technology Service Provider Interface (AT-SPI).")
 (define-public gspell
   (package
     (name "gspell")
-    (version "1.4.2")
+    (version "1.8.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -6944,7 +6941,7 @@ that support the Assistive Technology Service Provider Interface (AT-SPI).")
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1683vyyfq3q0ph665jj6id8hnlyid4qxzmqiwpv97gmz8zksg6x5"))
+                "1rdv873ixhwr15jwgc2z6k6y0hj353fqnwsy7zkh0c30qwiiv6l1"))
               (patches (search-patches "gspell-dash-test.patch"))))
     (build-system glib-or-gtk-build-system)
     (arguments
@@ -6978,7 +6975,7 @@ that support the Assistive Technology Service Provider Interface (AT-SPI).")
        ("aspell-dict-en" ,aspell-dict-en)
        ("xorg-server" ,xorg-server)))
     (propagated-inputs
-     `(("enchant" ,enchant)))           ; enchant.pc is required by gspell-1.pc
+     `(("enchant" ,enchant)))            ;enchant.pc is required by gspell-1.pc
     (home-page "https://wiki.gnome.org/Projects/gspell")
     (synopsis "GNOME's alternative spell checker")
     (description
@@ -7230,7 +7227,7 @@ mp3, Ogg Vorbis and FLAC")
     (license license:gpl2+)))
 
 (define-public workrave
-  (let ((commit "v1_10_20"))
+  (let ((commit "v1_10_21"))
     (package
       (name "workrave")
       (version (string-map (match-lambda
@@ -7242,18 +7239,11 @@ mp3, Ogg Vorbis and FLAC")
                 (uri (git-reference
                       (url "https://github.com/rcaelers/workrave.git")
                       (commit commit)))
-                (file-name (string-append name "-" version "-checkout"))
+                (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "099a87zkrkmsgfz9isrfm89dh545x52891jh6qxmn19h6wwsi941"))))
+                  "150qca8c552fakjlzkgarsxgp87l1xcwn19svqsa9d0cygqxjgia"))))
       (build-system glib-or-gtk-build-system)
-      (arguments
-       `(#:phases
-         (modify-phases %standard-phases
-           (add-after 'unpack 'autogen
-             (lambda _
-               (invoke "sh" "autogen.sh")
-               #t)))))
       (propagated-inputs `(("glib" ,glib)
                            ("gtk+" ,gtk+)
                            ("gdk-pixbuf" ,gdk-pixbuf)
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index 77a74a0ec4..653cee93d5 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -35,6 +35,7 @@
   #:use-module (guix git-download)
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system cargo)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages base)
   #:use-module (gnu packages databases)
@@ -58,6 +59,7 @@
   #:use-module (gnu packages xorg)
   #:use-module (gnu packages gl)
   #:use-module (gnu packages assembly)
+  #:use-module (gnu packages rust)
   #:use-module (gnu packages icu4c)
   #:use-module (gnu packages video)
   #:use-module (gnu packages xdisorg)
@@ -467,10 +469,10 @@ security standards.")
     (license license:mpl2.0)))
 
 (define (mozilla-patch file-name changeset hash)
-  "Return an origin for CHANGESET from the mozilla-esr52 repository."
+  "Return an origin for CHANGESET from the mozilla-esr60 repository."
   (origin
     (method url-fetch)
-    (uri (string-append "https://hg.mozilla.org/releases/mozilla-esr52/raw-rev/"
+    (uri (string-append "https://hg.mozilla.org/releases/mozilla-esr60/raw-rev/"
                         changeset))
     (sha256 (base32 hash))
     (file-name file-name)))
@@ -478,112 +480,27 @@ security standards.")
 (define-public icecat
   (package
     (name "icecat")
-    (version "52.6.0-gnu1")
+    (version "60.2.0-gnu1")
     (source
      (origin
       (method url-fetch)
+      ;; Temporary URL pending official release:
+      (uri "https://alpha.gnu.org/gnu/gnuzilla/60.2.0/icecat-60.2.0-gnu1.tar.bz2")
+      #;
       (uri (string-append "mirror://gnu/gnuzilla/"
                           (first (string-split version #\-))
                           "/" name "-" version ".tar.bz2"))
       (sha256
        (base32
-        "09fn54glqg1aa93hnz5zdcy07cps09dbni2b4200azh6nang630a"))
+        "0lqx7g79x15941rhjr3qsfwsny6vzc7d7abdmvjy6jjbqkqlc1zl"))
       (patches
        (list
         (search-patch "icecat-avoid-bundled-libraries.patch")
-        (search-patch "icecat-use-system-harfbuzz.patch")
-        (search-patch "icecat-use-system-graphite2.patch")
-        (mozilla-patch "icecat-bug-546387.patch"         "d13e3fefb76e" "1b760r0bg2ydbl585wlmajljh1nlisrwxvjws5b28a3sgjy01i6k")
-        (mozilla-patch "icecat-bug-1350152.patch"        "f822bda79c28" "1wf56169ca874shr6r7qx40s17h2gwj7ngmpyylrpmd1c6hipvsj")
-        (mozilla-patch "icecat-bug-1411708.patch"        "34c968767eb7" "0l2jy201ikj3m3h66mvlsj4y0ki7cpm7x7nnfygbwnfxg42s1sip")
-        (mozilla-patch "icecat-bug-1375217.patch"        "00fc630c9a46" "17pcprp452nslk6sac6sili0p74zh8w3g0v1wsdn0ikm9xmnphhv")
-        (mozilla-patch "icecat-CVE-2018-5145.patch"      "f0ec180993d2" "0jiazxcwki83wr00fyh2g518ynsd33p7nk65zk4d1682gn22lc8v")
-        (mozilla-patch "icecat-CVE-2018-5130.patch"      "a6a9e26688c1" "0cvizvilb4k422j2gzqcbakznvsffmk6n6xn1ayj5rgxfaizkkqk")
-        (mozilla-patch "icecat-CVE-2018-5125-pt1.patch"  "198ad052621e" "1721zx8hifdlflrhvw6hmkdgjbvsmxl9n84iji5qywhlp2krdk9r")
-        (mozilla-patch "icecat-bug-1426087.patch"        "391ea77ebfdb" "1fhkvd0z6mvdkj7m0d3jlj42rsdw5r4x122c1wb1i428228ifw6n")
-        (mozilla-patch "icecat-bug-1416307.patch"        "54f2f7f93b30" "1ncjir16mqya37wgf6fy2rqki3vl433c4grjr3fypmlig6xfgg1l")
-        (mozilla-patch "icecat-CVE-2018-5127.patch"      "2c4d7a59041b" "178c6gid89cvw52yqs43i6x6s5w0hslj0rfa2r8b4762ij3civ92")
-        (mozilla-patch "icecat-CVE-2018-5125-pt2.patch"  "f87ef3774d5e" "0payf3az2w93nzl5qknqx290jbxk8v39rwhdgq7wyd5f245dywxk")
-        (mozilla-patch "icecat-CVE-2018-5125-pt3.patch"  "ac743923f81d" "0msyr45xr1j5q4x6ah4r907pwjngyi0k6pp9y8ixk21cnwbzrdwx")
-        (mozilla-patch "icecat-CVE-2018-5129.patch"      "456913d7e8b5" "0fx0s06kxxj7g4hllinaskgh41z3k48zml6yqqzxx485qk3hdh9x")
-        (mozilla-patch "icecat-bug-1334465-pt1.patch"    "f95c5b881442" "0iaddhf65jd9cycj4bw0b207n2jiqkr4q84jifzyqn4ygs75wdqd")
-        (mozilla-patch "icecat-bug-1334465-pt2.patch"    "8a4265c8fb41" "1d9zfdbrlw9wzr84b7pj7lxgy487lsx0kfd89287hjk0al8m6vrw")
-        (mozilla-patch "icecat-bug-1398021.patch"        "28855df568d8" "1kmq836gniplxpjnvq8lhbcc1aqi56al628r1mzdy94b5yb0lis3")
-        (mozilla-patch "icecat-bug-1388020.patch"        "e8ab2736499b" "0n28vcd65rxsyq3z22rfcfksryfndhm1i3g6ah3akg11jnagqf5v")
-        (mozilla-patch "icecat-CVE-2018-5125-pt4.patch"  "014877bf17ea" "0hk90pnf7h7kvidji6ydvva1zpyraipn03pjhvprdqr7k2fqzmsz")
-        (mozilla-patch "icecat-CVE-2018-5125-pt5.patch"  "5b3a5de48912" "1ifya05rcd34ryp9zawdacihhkkf2m0xn2q8m8c6v78bvxj0mgig")
-        (mozilla-patch "icecat-CVE-2018-5144.patch"      "1df9b4404acd" "1sd59vsarfsbh3vlrzrqv6n1ni7vxdzm83j6s6g0fygl1h8kwijg")
-        (mozilla-patch "icecat-bug-1430173-pt1.patch"    "9124c3972e2b" "13ns5yy39yzfx7lrkv4rgwdz6s6q0z4i09wkbxdvnkfsz17cd17i")
-        (mozilla-patch "icecat-bug-1430173-pt2.patch"    "9f6dc031be51" "0bv2p98z5ahp3x9wxnhwxn87g21djvzzp7jy55ik90hqixsbhwdl")
-        (mozilla-patch "icecat-CVE-2018-5131.patch"      "3102fbb97b32" "0kg0183v92gxjb9255xjwhxyd6gl77l9c0civx3040k975fybwlp")
-        (mozilla-patch "icecat-CVE-2018-5125-pt6.patch"  "4904c0f4a645" "0lsq62ynksy1fbw0m87f1d741fyvrrp1vrznx5hx0l2p4g4frhv3")
-        (mozilla-patch "icecat-CVE-2018-5125-pt7.patch"  "16b8073d5c30" "1dv94qqah1wjd3bxjvrkmjbb2f95d3d11zpm8mggdk52il575bwl")
-        (mozilla-patch "icecat-bug-1442127-pt1.patch"    "f931f85b09da" "02s380w8a73g4w2wm810lbigh4z4rrlfy10ywwhv4lpkbk8xg7pr")
-        (mozilla-patch "icecat-bug-1442127-pt2.patch"    "da5792b70f30" "116k9qja5ir9b3laazasp43f5jx59qq72nknmq5bn5v1ixya9r4l")
-        (mozilla-patch "icecat-CVE-2018-5125-pt8.patch"  "62b831df8269" "109pn0hqn7s27580glv4z7qv1pmjzii9szvf3wkn97k5wybrzgkx")
-        (mozilla-patch "icecat-bug-1442504.patch"        "8954ce68a364" "0bl65zw82bwqg0mmcri94pxqq6ibff7y5rclkzapb081p6yvf73q")
-        (mozilla-patch "icecat-CVE-2018-5125-pt9.patch"  "8a16f439117c" "108iarql6z7h1r4rlzac6n6lrzs78x7kcdbfa0b5dbr5xc66jmgb")
-        (mozilla-patch "icecat-bug-1426603.patch"        "ca0b92ecedee" "0dc3mdl4a3hrq4j384zjavf3splj6blv4masign710hk7svlgbhq")
-        (mozilla-patch "icecat-CVE-2018-5146.patch"      "494e5d5278ba" "1yb4lxjw499ppwhk31vz0vzl0cfqvj9d4jwqag7ayj53ybwsqgjr")
-        (mozilla-patch "icecat-CVE-2018-5147.patch"      "5cd5586a2f48" "10s774pwvj6xfk3kk6ivnhp2acc8x9sqq6na8z47nkhgwl2712i5")
-        (mozilla-patch "icecat-CVE-2018-5148.patch"      "c3e447e07077" "0gmwy631f8ip4gr1mpbjk8bx1n1748wdls5zq4y8hpmpnq5g1wyx")
-        (mozilla-patch "icecat-CVE-2018-5178.patch"      "17201199b18d" "1d0hcim1fwh0bklwpmnal1mv9d9kmyif1m15aj1nqkf1n3x4xc37")
-        (mozilla-patch "icecat-bug-1361699.patch"        "a07d6c3ff262" "1z8mjg2487r8pxi0x951v6fwwr696q84f6hlzimc3r7bn5ds9r83")
-        (mozilla-patch "icecat-CVE-2018-5150-pt01.patch" "7127ccf8f88c" "0m4my7aflpp0wlqilr2m4axd7k2fyrs7jqdcz2rrz5pwivz1anvd")
-        (mozilla-patch "icecat-bug-1444231.patch"        "57bd35fa8618" "0pl6x5amc5x6nhwl7qnmnff3jjjxmbs8r365bfzj58g7q5ihqwvf")
-        (mozilla-patch "icecat-CVE-2018-5150-pt02.patch" "2f3e1ccf1661" "0azl8g81kpc0w2xpjpgm1154ll12g0a8n6i7bl3s9nnrk2i26n74")
-        (mozilla-patch "icecat-CVE-2018-5159.patch"      "8ff2c4d68e36" "0kz1rqhnz8ca4z20hnpcafidhsrwhnm0h2gmlgchni33h8pisr1f")
-        (mozilla-patch "icecat-CVE-2018-5154.patch"      "b8c430253efd" "1arjcaps9axhxh5ff84n9bydhhzrihn7hbq7v69nvqwqrjp3lgg9")
-        (mozilla-patch "icecat-CVE-2018-5155.patch"      "05cadfa3ac39" "0q0vh7vy7x0l8jp6376fn10qljfp4mnp4m9zfn90j4m19pfl86a0")
-        (mozilla-patch "icecat-CVE-2018-5168.patch"      "48a678d7cb81" "1yfh7kxxxvqck2hpn98pwag4splyc6c9brc5haq28fp8x9r9qvlk")
-        (mozilla-patch "icecat-CVE-2018-5150-pt03.patch" "112032576872" "1x1hxyggbxlnlj0n9cbp03hjnfvm6cq8nqj0jizrd8cfyd5aig8p")
-        (mozilla-patch "icecat-CVE-2018-5150-pt04.patch" "ad9a885b0df4" "1hrk1q9mk59jww55g4lqmaflznk87x3vvjn2mxfgfbbjs8l1cyz4")
-        (mozilla-patch "icecat-bug-1452416.patch"        "f89ab96a2532" "1dqchxdyznhgyxhfq0hm0vg1p597hjqflfzigc7j3s5vxf9rg2nv")
-        (mozilla-patch "icecat-CVE-2018-5150-pt05.patch" "af885a1bd293" "1wfpqhm2dp4fsx6zbrncngsqz7g2x09b625zcighixrbpvybyww3")
-        (mozilla-patch "icecat-CVE-2018-5150-pt06.patch" "666fc84ec72d" "0lml2wqd4yqidhi364x8r90f78397k2y0kq5z5bv8l8j4bhcnb9v")
-        (search-patch  "icecat-CVE-2018-5157-and-CVE-2018-5158.patch")
-        (mozilla-patch "icecat-CVE-2018-5150-pt07.patch" "1ab40761a856" "1kgwypy7k5b33jwkni4025za4kcnv5m6klsx4wsswlixmljmkbc7")
-        (mozilla-patch "icecat-bug-1453339.patch"        "0edb8dca7087" "0b30pipqryh311sc97rcmwnx9n8qdlbbz90b2hkybjnprmbhfxrm")
-        (mozilla-patch "icecat-CVE-2018-5150-pt08.patch" "134c728799c1" "16hbwx6fx1hrddsyjjbd3z954ql3pg348xs13h9riyblq8crzmam")
-        (mozilla-patch "icecat-CVE-2018-5150-pt09.patch" "14eab155eaa8" "0wr4xgblxzk4c2gvlnpl7ic1196mrhry1hgwdl1jivq0ji5cbvbd")
-        (mozilla-patch "icecat-bug-1452619.patch"        "2b75d55ccf0e" "1g87aybw6ggv6hyk385bplv0lx63n020gwyq0d6d4pqld48hsm1i")
-        (mozilla-patch "icecat-CVE-2018-5156-pt1.patch"  "89857f35df29" "0gzi47svrw5ajdlm3i12193psm702zx70x5h1rwp4gb7gxh4m4d9")
-        (mozilla-patch "icecat-CVE-2018-5150-pt10.patch" "3f2ec03c0405" "0w02952dlxd2gmwghck2nm4rjjmc5ylg62bw6m1rvi35kcr134lr")
-        (mozilla-patch "icecat-CVE-2018-5183.patch"      "f729bf78fb3a" "0xkj6jwxwdqkvb5c7wi16b8cm8qrnlrd3s9jnd46jg03iykrx56f")
-        (mozilla-patch "icecat-CVE-2018-5188-pt01.patch" "eb896089db47" "10lppk4x2d3pim71a36ky1dmg08rs5ckfiljwvfnr1cw6934qxl4")
-        (mozilla-patch "icecat-CVE-2018-5188-pt02.patch" "2374dca97bde" "0y1g55wvj44nzb1qfkl271jcf8s1ik8lcl1785z0zim4qzn7qkpa")
-        (mozilla-patch "icecat-CVE-2018-5188-pt03.patch" "70b6298e0c9e" "0n5jfy6c421dkybk8m18vd61y95zz0r64g1p1zlya3fps5knfaqi")
-        (mozilla-patch "icecat-CVE-2018-12365-pt1.patch" "4ef79fe9b3b7" "1c32z1ki1i6xj1nbb0xlxwqnmz48ikmy8dmp37rkjz8ssn04wgfg")
-        (mozilla-patch "icecat-CVE-2018-12365-pt2.patch" "9ad16112044a" "0ayya67sx7avcb8bplfdxb92l9g4mjrb1s3hby283llhqv0ikg9b")
-        (mozilla-patch "icecat-CVE-2018-12359.patch"     "11d8a87fb6d6" "1rkmdk18llw0x1jakix75hlhy0hpsmlminnflagbzrzjli81gwm1")
-        (mozilla-patch "icecat-CVE-2018-5188-pt04.patch" "407b10ad1273" "16qzsfirw045xag96f1qvpdlibm8lwdj9l1mlli4n1vz0db91v9q")
-        (mozilla-patch "icecat-CVE-2018-6126.patch"      "e76e2e481b17" "0hnx13msjy28n3bpa2c24kpzalam4bdk5gnp0f9k671l48rs9yb3")
-        (mozilla-patch "icecat-CVE-2018-5188-pt05.patch" "2c75bfcd465c" "1pjinj8qypafqm2fk68s3hzcbzcijn09qzrpcxvzq6bl1yfc1xfd")
-        (mozilla-patch "icecat-CVE-2018-5188-pt06.patch" "042f80f3befd" "0av918kin4bkrq7gnjz0h9w8kkq8rk9l93250lfl5kqrinza1gsk")
-        (mozilla-patch "icecat-CVE-2018-5188-pt07+bugs-1455071+1433642+1456604+1458320.patch"
-                                                         "bb0451c9c4a0" "1lhm1b2a7c6jwhzsg3c830hfhp17p8j9zbcmgchpb8c5jkc3vw0x")
-        (mozilla-patch "icecat-CVE-2018-5188-pt08.patch" "8189b262e3b9" "13rh86ddwmj1bhv3ibbil3sv5xbqq1c9v1czgbsna5hxxkzc1y3b")
-        (mozilla-patch "icecat-CVE-2018-5188-pt09.patch" "9f81ae3f6e1d" "05vfg8a8jrzd93n1wvncmvdmqgf9cgsl8ryxgjs3032gbbjkga7q")
-        (mozilla-patch "icecat-CVE-2018-12360.patch"     "face7a3dd5d7" "0jclw30mf693w8lrmvn0iankggj21nh4j3zh51q5363rj5xncdzx")
-        (mozilla-patch "icecat-CVE-2018-5188-pt10.patch" "7afb58c046c8" "1r0569r76712x7x1sw6xr0x06ilv6iw3fncb0f8r8b9mp6wrpx34")
-        (mozilla-patch "icecat-CVE-2018-12362-pt1.patch" "f1a745f8c42d" "11q73pb7a8f09xjzil4rhg5nr49zrnz1vb0prni0kqvrnppf5s40")
-        (mozilla-patch "icecat-CVE-2018-12362-pt2.patch" "1f9a430881cc" "0f79rv7njliqxx33z07n60b50jg0a596d1km7ayz2hivbl2d0168")
-        (mozilla-patch "icecat-CVE-2018-5188-pt11.patch" "28f4fc0a5141" "1a8f9z6c80in8ccj82ysdrcr2lqypp29l4acs50kwncm0c0b01zl")
-        (mozilla-patch "icecat-CVE-2018-12363.patch"     "ad5a53a1d2b1" "0rhl4r39ydb3lkfp5pkwvhhzqgfh33s9r7b7jccgkrx6f13xyq78")
-        (mozilla-patch "icecat-CVE-2018-5188-pt12.patch" "0ddfc03c0454" "1b0xw2kj9765lvpl8iwr3wwcz40bdfp3dp4y9f546a61qsi9q9d6")
-        (mozilla-patch "icecat-CVE-2018-5156-pt2.patch"  "dbf36189a364" "1awbyhy0r79i03sns2p0m78f9hb6c7kp4hwia2khx4qszlsr4j95")
-        (mozilla-patch "icecat-CVE-2018-5188-pt13.patch" "32509dfde003" "0cc3c92dgf5qynk093prq610c9x815l2fa24ddrw9czdzbwblsdq")
-        (mozilla-patch "icecat-bug-1462912.patch"        "f18535a212da" "0zkqz9il89f1s1yrp5c6hj6kysy2x02iy50vgwdj30lr56gkpzmk")
-        (mozilla-patch "icecat-CVE-2018-5188-pt14.patch" "e8e9e1ef79f2" "0dc8p6fsppq3bhbpmp41f8mjxbr31pvgpga0a73dqdaicq5ydgj4")
-        (search-patch  "icecat-bug-1413868-pt1.patch")
-        (mozilla-patch "icecat-CVE-2018-5188-pt15.patch" "9d4d31b2630d" "1lcbmsyi09kp80h1jgxj5l45zl24xn22h1lq7drbyjxsn1kggq4g")
-        (mozilla-patch "icecat-CVE-2018-12366-pt1.patch" "edf2c7dff493" "06xmyk7nm54cm9m6qc59wz8cxxfa5r25mf2xzdzy74iq5hwa1ac8")
-        (mozilla-patch "icecat-CVE-2018-5188-pt16.patch" "05549a4d1b80" "10q68cllshmmhlrbirm9h4gyc3ffrcpsxihfpcbxh90nv2h16jci")
-        (mozilla-patch "icecat-CVE-2018-12364.patch"     "67b2d8924841" "197riigbb6l30959pygr0zlv7vaims78dg1mh0pg33pa7cbna0ds")
-        (mozilla-patch "icecat-CVE-2018-12366-pt2.patch" "528d4d997bb3" "0f375i96a404dkn0fanmd9pgfj3wyrhjfc5dwslw2s44gwfjhljb")
-        (mozilla-patch "icecat-bug-1369771.patch"        "fab16ad7f256" "0kd8qm04sjgfgfg8yw3ivcxazb1d7v430g86chw4n64qybsh9ka3")
-        (mozilla-patch "icecat-CVE-2018-5188-pt17.patch" "068e249d02b4" "1iy9by1mg5qhp8502h31m8zm99aq2hx0c5n3hadd5pk11lfnq6ll")
-        (mozilla-patch "icecat-bug-1413868-pt2.patch"    "755067c14b06" "089dwqwzcdg1l6aimi0i65q4dgb2iny5h8yjx63h9zgv77n0700a")))
+        ;; FIXME (search-patch "icecat-use-system-harfbuzz.patch")
+        ;; FIXME (search-patch "icecat-use-system-graphite2.patch")
+        (mozilla-patch "icecat-CVE-2018-12385.patch"      "80a4a7ef2813" "1vgcbimpnfjqj934v0cryq1g13xac3wfmd4jyhcb5s60x8xyssf5")
+        (search-patch  "icecat-CVE-2018-12383.patch")
+        (mozilla-patch "icecat-bug-1489744.patch"         "6546ee839d30" "11mhvj77r789b428bfxqq5wdx8yr7lbrdjzr8qjj6fw197pldn51")))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -613,13 +530,13 @@ security standards.")
                       "modules/freetype2"
                       "modules/zlib"
                       "modules/libbz2"
-                      "ipc/chromium/src/third_party/libevent"
+                      ;; UNBUNDLE-ME "ipc/chromium/src/third_party/libevent"
                       "media/libjpeg"
                       "media/libvpx"
                       "security/nss"
-                      "gfx/cairo"
-                      "gfx/harfbuzz"
-                      "gfx/graphite2"
+                      ;; UNBUNDLE-ME "gfx/cairo"
+                      ;; UNBUNDLE-ME "gfx/harfbuzz"
+                      ;; UNBUNDLE-ME "gfx/graphite2"
                       "js/src/ctypes/libffi"
                       "db/sqlite3"))
           ;; Delete .pyc files, typically present in icecat source tarballs
@@ -633,29 +550,29 @@ security standards.")
     (inputs
      `(("alsa-lib" ,alsa-lib)
        ("bzip2" ,bzip2)
-       ("cairo" ,cairo)
+       ;; UNBUNDLE-ME ("cairo" ,cairo)
        ("cups" ,cups)
        ("dbus-glib" ,dbus-glib)
        ("gdk-pixbuf" ,gdk-pixbuf)
        ("glib" ,glib)
        ("gtk+" ,gtk+)
        ("gtk+-2" ,gtk+-2)
-       ("graphite2" ,graphite2)
+       ;; UNBUNDLE-ME ("graphite2" ,graphite2)
        ("pango" ,pango)
        ("freetype" ,freetype)
-       ("harfbuzz" ,harfbuzz)
+       ;; UNBUNDLE-ME ("harfbuzz" ,harfbuzz)
        ("hunspell" ,hunspell)
        ("libcanberra" ,libcanberra)
        ("libgnome" ,libgnome)
        ("libjpeg-turbo" ,libjpeg-turbo)
        ("libxft" ,libxft)
-       ("libevent" ,libevent-2.0)
+       ;; UNBUNDLE-ME ("libevent" ,libevent-2.0)
        ("libxinerama" ,libxinerama)
        ("libxscrnsaver" ,libxscrnsaver)
        ("libxcomposite" ,libxcomposite)
        ("libxt" ,libxt)
        ("libffi" ,libffi)
-       ("ffmpeg" ,ffmpeg-3.4)
+       ("ffmpeg" ,ffmpeg)
        ("libvpx" ,libvpx)
        ("icu4c" ,icu4c)
        ("pixman" ,pixman)
@@ -670,7 +587,9 @@ security standards.")
        ("zip" ,zip)
        ("zlib" ,zlib)))
     (native-inputs
-     `(("perl" ,perl)
+     `(("rust" ,rust)
+       ("cargo" ,rust "cargo")
+       ("perl" ,perl)
        ("python" ,python-2) ; Python 3 not supported
        ("python2-pysqlite" ,python2-pysqlite)
        ("yasm" ,yasm)
@@ -687,11 +606,12 @@ security standards.")
        ;; practice somehow.  See <http://hydra.gnu.org/build/378133>.
        #:validate-runpath? #f
 
+       #:imported-modules ,%cargo-build-system-modules ;for `generate-checksums'
+
        #:configure-flags '("--enable-default-toolkit=cairo-gtk3"
 
                            "--with-distribution-id=org.gnu"
 
-                           "--enable-gio"
                            "--enable-startup-notification"
                            "--enable-pulseaudio"
 
@@ -701,7 +621,9 @@ security standards.")
                            "--disable-maintenance-service"
                            "--disable-eme"
                            "--disable-gconf"
-                           "--disable-gnomeui"
+
+                           ;; Stylo requires LLVM/clang.  For now, disable it.
+                           "--disable-stylo"
 
                            ;; Building with debugging symbols takes ~5GiB, so
                            ;; disable it.
@@ -716,15 +638,15 @@ security standards.")
                            "--with-system-zlib"
                            "--with-system-bz2"
                            "--with-system-jpeg"        ; must be libjpeg-turbo
-                           "--with-system-libevent"
+                           ;; UNBUNDLE-ME "--with-system-libevent"
                            "--with-system-libvpx"
                            "--with-system-icu"
                            "--with-system-nspr"
                            "--with-system-nss"
-                           "--with-system-harfbuzz"
-                           "--with-system-graphite2"
+                           ;; UNBUNDLE-ME "--with-system-harfbuzz"
+                           ;; UNBUNDLE-ME "--with-system-graphite2"
                            "--enable-system-pixman"
-                           "--enable-system-cairo"
+                           ;; UNBUNDLE-ME "--enable-system-cairo"
                            "--enable-system-ffi"
                            "--enable-system-hunspell"
                            "--enable-system-sqlite"
@@ -774,6 +696,24 @@ security standards.")
     'avcodec', 'avutil', 'pulse' ]\n\n"
                               all)))
             #t))
+         (add-after 'patch-source-shebangs 'patch-cargo-checksums
+           (lambda* _
+             (use-modules (guix build cargo-build-system))
+             (let ((null-file "/dev/null")
+                   (null-hash "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"))
+               (substitute* '("Cargo.lock" "servo/Cargo.lock")
+                 (("(\"checksum .* = )\".*\"" all name)
+                  (string-append name "\"" null-hash "\"")))
+               (for-each
+                (lambda (filename)
+                  (delete-file filename)
+                  (let ((dir (dirname filename)))
+                    (display (string-append
+                              "patch-cargo-checksums: generate-checksums for "
+                              dir "\n"))
+                    (generate-checksums dir null-file)))
+                (find-files "third_party/rust" ".cargo-checksum.json")))
+             #t))
          (replace
           'configure
           ;; configure does not work followed by both "SHELL=..." and
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index fd4c362d36..bba03e77f2 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -12,6 +12,7 @@
 ;;; Copyright © 2018 Tomáš Čech <sleep_walker@gnu.org>
 ;;; Copyright © 2018 Pierre-Antoine Rouby <pierre-antoine.rouby@inria.fr>
 ;;; Copyright © 2018 Pierre Neidhardt <mail@ambrevar.xyz>
+;;; Copyright @ 2018 Katherine Cox-Buday <cox.katherine.e@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -499,6 +500,124 @@ in the style of communicating sequential processes (@dfn{CSP}).")
                  (setenv "HOME" "/tmp")
                  #t)))))))))
 
+(define-public go-1.11
+  (package
+    (inherit go-1.10)
+    (name "go")
+    (version "1.11")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://storage.googleapis.com/golang/"
+                           name version ".src.tar.gz"))
+       (sha256
+        (base32
+         "1ysj04jzds6xa8kdflkdsgyv3mg9fdn90zdf78g4g6p4bwpy3hdg"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments go-1.10)
+       ((#:phases phases)
+        `(modify-phases ,phases
+           (replace 'prebuild
+             (lambda* (#:key inputs outputs #:allow-other-keys)
+               (let* ((gcclib (string-append (assoc-ref inputs "gcc:lib") "/lib"))
+                      (ld (string-append (assoc-ref inputs "libc") "/lib"))
+                      (loader (car (find-files ld "^ld-linux.+")))
+                      (net-base (assoc-ref inputs "net-base"))
+                      (tzdata-path
+                       (string-append (assoc-ref inputs "tzdata") "/share/zoneinfo"))
+                      (output (assoc-ref outputs "out")))
+
+                 (for-each delete-file
+                           ;; Removing net/ tests, which fail when attempting to access
+                           ;; network resources not present in the build container.
+                           '("net/listen_test.go"
+                             "net/parse_test.go"
+                             "net/cgo_unix_test.go"
+                             ;; A side affect of these test scripts is testing
+                             ;; cgo. Attempts at using cgo flags and
+                             ;; directives with these scripts as specified
+                             ;; here (https://golang.org/cmd/cgo/) have not
+                             ;; worked. The tests continue to state that they
+                             ;; can not find crt1.o despite being present.
+                             "cmd/go/testdata/script/list_compiled_imports.txt"
+                             "cmd/go/testdata/script/mod_case_cgo.txt"
+                             ;; https://github.com/golang/go/issues/24884
+                             "os/user/user_test.go"))
+
+                 (substitute* "os/os_test.go"
+                   (("/usr/bin") (getcwd))
+                   (("/bin/pwd") (which "pwd"))
+                   (("/bin/sh") (which "sh")))
+
+                 (substitute* "cmd/vendor/golang.org/x/sys/unix/syscall_unix_test.go"
+                   (("/usr/bin") "/tmp"))
+
+                 ;; Add libgcc to runpath
+                 (substitute* "cmd/link/internal/ld/lib.go"
+                   (("!rpath.set") "true"))
+                 (substitute* "cmd/go/internal/work/gccgo.go"
+                   (("cgoldflags := \\[\\]string\\{\\}")
+                    (string-append "cgoldflags := []string{"
+                                   "\"-rpath=" gcclib "\""
+                                   "}"))
+                   (("\"-lgcc_s\", ")
+                    (string-append
+                     "\"-Wl,-rpath=" gcclib "\", \"-lgcc_s\", ")))
+                 (substitute* "cmd/go/internal/work/gc.go"
+                   (("ldflags = setextld\\(ldflags, compiler\\)")
+                    (string-append
+                     "ldflags = setextld(ldflags, compiler)\n"
+                     "ldflags = append(ldflags, \"-r\")\n"
+                     "ldflags = append(ldflags, \"" gcclib "\")\n")))
+
+                 ;; Disable failing tests: these tests attempt to access
+                 ;; commands or network resources which are neither available
+                 ;; nor necessary for the build to succeed.
+                 (for-each
+                  (match-lambda
+                    ((file regex)
+                     (substitute* file
+                       ((regex all before test_name)
+                        (string-append before "Disabled" test_name)))))
+                  '(("net/net_test.go" "(.+)(TestShutdownUnix.+)")
+                    ("net/dial_test.go" "(.+)(TestDialTimeout.+)")
+                    ("os/os_test.go" "(.+)(TestHostname.+)")
+                    ("time/format_test.go" "(.+)(TestParseInSydney.+)")
+                    ("time/format_test.go" "(.+)(TestParseInLocation.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestEcho.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestCommandRelativeName.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestCatStdin.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestCatGoodAndBadFile.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestExitStatus.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestPipes.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestStdinClose.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestIgnorePipeErrorOnSuccess.+)")
+                    ("syscall/syscall_unix_test.go" "(.+)(TestPassFD\\(.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestExtraFiles/areturn.+)")
+                    ("cmd/go/go_test.go" "(.+)(TestCoverageWithCgo.+)")
+                    ("cmd/go/go_test.go" "(.+)(TestTwoPkgConfigs.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestOutputStderrCapture.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestExtraFiles.+)")
+                    ("os/exec/exec_test.go" "(.+)(TestExtraFilesRace.+)")
+                    ("net/lookup_test.go" "(.+)(TestLookupPort.+)")
+                    ("syscall/exec_linux_test.go"
+                     "(.+)(TestCloneNEWUSERAndRemapNoRootDisableSetgroups.+)")))
+
+                 ;; fix shebang for testar script
+                 ;; note the target script is generated at build time.
+                 (substitute* "../misc/cgo/testcarchive/carchive_test.go"
+                   (("#!/usr/bin/env") (string-append "#!" (which "env"))))
+
+                 (substitute* "net/lookup_unix.go"
+                   (("/etc/protocols") (string-append net-base "/etc/protocols")))
+                 (substitute* "net/port_unix.go"
+                   (("/etc/services") (string-append net-base "/etc/services")))
+                 (substitute* "time/zoneinfo_unix.go"
+                   (("/usr/share/zoneinfo/") tzdata-path))
+                 (substitute* (find-files "cmd" "\\.go")
+                   (("/lib(64)?/ld-linux.*\\.so\\.[0-9]") loader))
+                 #t)))))))))
+
 (define-public go go-1.9)
 
 (define-public go-github-com-alsm-ioprogress
diff --git a/gnu/packages/gprolog.scm b/gnu/packages/gprolog.scm
index b27b080ca7..166bf33294 100644
--- a/gnu/packages/gprolog.scm
+++ b/gnu/packages/gprolog.scm
@@ -27,15 +27,18 @@
 (define-public gprolog
   (package
     (name "gprolog")
-    (version "1.4.4")
+    (version "1.4.5")
     (source
-     (origin
-      (method url-fetch)
-      (uri (string-append "mirror://gnu/gprolog/gprolog-" version
-                          ".tar.gz"))
-      (sha256
-       (base32
-        "13miyas47bmijmadm68cbvb21n4s156gjafz7kfx9brk9djfkh0q"))))
+      (origin
+        (method url-fetch)
+        ;; Recent versions are not hosted on the GNU mirrors.
+        (uri (list (string-append "http://gprolog.org/gprolog-" version
+                                  ".tar.gz")
+                   (string-append "mirror://gnu/gprolog/gprolog-" version
+                                  ".tar.gz")))
+        (sha256
+         (base32
+          "0z4cc42n3k6i35b8mr816iwsvrpxshw6d7dgz6s2h1hy0l7g1p5z"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index 9c2869c12b..58c742b825 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -406,7 +406,7 @@ visual effects work for film.")
 (define-public openscenegraph
   (package
     (name "openscenegraph")
-    (version "3.6.2")
+    (version "3.6.3")
     (source
      (origin
        (method git-fetch)
@@ -415,8 +415,8 @@ visual effects work for film.")
              (commit (string-append "OpenSceneGraph-" version))))
        (sha256
         (base32
-         "03jk6lclyd4biniaw04w7j0z1spkm69f1c19i37b8v9x3zv1p1id"))
-       (file-name (string-append name "-" version "-checkout"))))
+         "0h32z15sa8sbq276j0iib0n707m8bs4p5ji9z2ah411446paad9q"))
+       (file-name (git-file-name name version))))
     (properties
      `((upstream-name . "OpenSceneGraph")))
     (build-system cmake-build-system)
@@ -437,8 +437,6 @@ visual effects work for film.")
        ("jasper" ,jasper)
        ("librsvg" ,librsvg)
        ("libxrandr" ,libxrandr)
-       ("pth" ,pth)
-       ("qtbase" ,qtbase)
        ("ffmpeg" ,ffmpeg)
        ("mesa" ,mesa)))
     (synopsis "High performance real-time graphics toolkit")
diff --git a/gnu/packages/graphviz.scm b/gnu/packages/graphviz.scm
index 09f46fab84..569923d4e0 100644
--- a/gnu/packages/graphviz.scm
+++ b/gnu/packages/graphviz.scm
@@ -220,17 +220,18 @@ be used either as a standalone application, or as a python library.")
 (define-public python-pydot
   (package
     (name "python-pydot")
-    (version "1.2.3")
+    (version "1.2.4")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pydot" version))
        (sha256
         (base32
-         "00imlz0033dygb9gdag1xr0cybn33gk5jsdi9ffbszzr97rd7dgd"))))
+         "1dhy4jpp646jslh2yks6klwwbaxcs905byyny880gl1iap8y5llj"))))
     (build-system python-build-system)
-    ;; FIXME: No tests in PyPi release tarball.
-    (arguments '(#:tests? #f))
+    (native-inputs
+     ;; For tests.
+     `(("python-chardet" ,python-chardet)))
     (propagated-inputs
      `(("python-pyparsing" ,python-pyparsing)))
     (home-page "https://github.com/erocarrera/pydot")
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 5eb03a0186..d65eb547ad 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -1579,12 +1579,11 @@ glass artworks done by Venicians glass blowers.")
      `(("intltool" ,intltool)
        ("pkg-config" ,pkg-config)))
     (inputs
-     `(("enchant" ,enchant)
-       ("gobject-introspection" ,gobject-introspection)
+     `(("gobject-introspection" ,gobject-introspection)
        ("gtk+" ,gtk+)
        ("pango" ,pango)))
     (propagated-inputs
-     `(("enchant" ,enchant))) ; gtkspell3-3.0.pc refers to it.
+     `(("enchant" ,enchant-1.6)))          ;gtkspell3-3.0.pc refers to it
     (home-page "http://gtkspell.sourceforge.net")
     (synopsis "Spell-checking addon for GTK's TextView widget")
     (description
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 0333c25255..39d1ebe681 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -286,7 +286,45 @@ without requiring the source code to be rewritten.")
                                                 ;  when heavily loaded)
 
 (define-public guile-next
-  (deprecated-package "guile-next" guile-2.2))
+  ;; This is the upcoming Guile 3.0, with JIT support.
+  (let ((commit "a74b4a45fab1a78e34954bce5f031e8a9765f827")
+        (revision "0"))
+    (package
+      (inherit guile-2.2)
+      (name "guile-next")
+      (version (git-version "2.99" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://git.savannah.gnu.org/git/guile.git")
+                      (commit commit)))
+                (sha256
+                 (base32
+                  "0kq6mabv7j4gdlwmpz3iaddv98sc7awkl2358sg8j50sg10yw8nx"))
+                (file-name (git-file-name name version))))
+      (native-inputs
+       `(("autoconf", autoconf)
+         ("automake" ,automake)
+         ("libtool" ,libtool)
+         ("gettext" ,gnu-gettext)
+         ("texinfo" ,texinfo)
+         ("flex" ,flex)
+         ,@(package-native-inputs guile-2.2)))
+      (arguments
+       (substitute-keyword-arguments (package-arguments guile-2.2)
+         ((#:phases phases '%standard-phases)
+          ;; XXX: The default 'bootstrap' phase tries to execute the
+          ;; ./bootstrap directory.
+          `(modify-phases ,phases
+             (replace 'bootstrap
+               (lambda _
+                 (patch-shebang "build-aux/git-version-gen")
+                 (invoke "autoreconf" "-vfi")))
+             (add-before 'check 'skip-version-test
+               (lambda _
+                 ;; Remove this test that's bound to fail.
+                 (delete-file "test-suite/tests/version.test")
+                 #t)))))))))
 
 (define (make-guile-readline guile)
   (package
diff --git a/gnu/packages/haskell.scm b/gnu/packages/haskell.scm
index eb629cf138..6b774c358a 100644
--- a/gnu/packages/haskell.scm
+++ b/gnu/packages/haskell.scm
@@ -6729,7 +6729,7 @@ documents.")
 (define-public ghc-xml-conduit
   (package
     (name "ghc-xml-conduit")
-    (version "1.7.1.2")
+    (version "1.8.0.1")
     (source
      (origin
        (method url-fetch)
@@ -6737,11 +6737,12 @@ documents.")
                            "xml-conduit-" version ".tar.gz"))
        (sha256
         (base32
-         "0n4k0rq9j5cc9kdvj9xbx8gmiqlyk5x6pw8yxzw5wfsw7qkych2s"))))
+         "177gmyigxql1pn3ncz0r8annwv5cbxnihbgrrg1dhm4gmc9jy2wq"))))
     (build-system haskell-build-system)
     (inputs
      `(("ghc-conduit" ,ghc-conduit)
        ("ghc-conduit-extra" ,ghc-conduit-extra)
+       ("ghc-doctest" ,ghc-doctest)
        ("ghc-resourcet" ,ghc-resourcet)
        ("ghc-text" ,ghc-text)
        ("ghc-xml-types" ,ghc-xml-types)
@@ -6762,7 +6763,7 @@ the @code{conduit} package.")
 (define-public ghc-pandoc-citeproc
   (package
     (name "ghc-pandoc-citeproc")
-    (version "0.12.2.5")
+    (version "0.14.3.1")
     (source
      (origin
        (method url-fetch)
@@ -6771,7 +6772,7 @@ the @code{conduit} package.")
                            version ".tar.gz"))
        (sha256
         (base32
-         "1l58nbflcnlznc93qimkk7ghk2gv8kipf45zf88piqa2zys41yyx"))))
+         "0yj6rckwsc9vig40cm15ry0j3d01xpk04qma9n4byhal6v4b5h22"))))
     (build-system haskell-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/ibus.scm b/gnu/packages/ibus.scm
index 9f7e1f88b4..08fce5f6fb 100644
--- a/gnu/packages/ibus.scm
+++ b/gnu/packages/ibus.scm
@@ -44,7 +44,7 @@
 (define-public ibus
   (package
    (name "ibus")
-   (version "1.5.17")
+   (version "1.5.19")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://github.com/ibus/ibus/"
@@ -52,22 +52,29 @@
                                  version "/ibus-" version ".tar.gz"))
              (sha256
               (base32
-               "06fj7lawww5d5w73pk249191lvmpz7shlxfxia74bjkpb42shiq3"))))
+               "0a94bnpm24581317hdnihwr4cniriml10p4ffgxg14xhvaccfrjb"))))
    (build-system glib-or-gtk-build-system)
    (arguments
     `(#:tests? #f  ; tests fail because there's no connection to dbus
-      #:configure-flags '("--disable-emoji-dict" ; cannot find emoji.json path
+      #:configure-flags `("--disable-emoji-dict" ; cannot find emoji.json path
+                          "--disable-python2"
+                          "--enable-python-library"
+                          ,(string-append "--with-ucd-dir="
+                                          (getcwd) "/ucd")
                           "--enable-wayland")
       #:make-flags
       (list "CC=gcc"
             (string-append "pyoverridesdir="
                            (assoc-ref %outputs "out")
-                           "/lib/python2.7/site-packages/gi/overrides/")
-            (string-append "py2overridesdir="
-                           (assoc-ref %outputs "out")
-                           "/lib/python2.7/site-packages/gi/overrides/"))
+                           "/lib/python3.6/site-packages/gi/overrides/"))
       #:phases
       (modify-phases %standard-phases
+        (add-after 'unpack 'prepare-ucd-dir
+          (lambda* (#:key inputs #:allow-other-keys)
+            (mkdir-p "../ucd")
+            (symlink (assoc-ref inputs "unicode-blocks") "../ucd/Blocks.txt")
+            (symlink (assoc-ref inputs "unicode-nameslist") "../ucd/NamesList.txt")
+            #t))
         (add-before 'configure 'disable-dconf-update
           (lambda _
             (substitute* "data/dconf/Makefile.in"
@@ -117,11 +124,23 @@
       ("wayland" ,wayland)
       ("xmodmap" ,xmodmap)
       ("iso-codes" ,iso-codes)
-      ("pygobject2" ,python2-pygobject)
-      ("python2" ,python-2)))
+      ("pygobject2" ,python-pygobject)
+      ("python" ,python)))
    (native-inputs
     `(("glib" ,glib "bin") ; for glib-genmarshal
       ("gobject-introspection" ,gobject-introspection) ; for g-ir-compiler
+      ("unicode-nameslist"
+       ,(origin
+          (method url-fetch)
+          (uri "https://www.unicode.org/Public/UNIDATA/NamesList.txt")
+          (sha256
+           (base32 "0yr2h0nfqhirfi3bxl33z6cc94qqshlpgi06c25xh9754irqsgv8"))))
+      ("unicode-blocks"
+       ,(origin
+          (method url-fetch)
+          (uri "https://www.unicode.org/Public/UNIDATA/Blocks.txt")
+          (sha256
+           (base32 "0lnh9iazikpr548bd7nkaq9r3vfljfvz0rg2462prac8qxk7ni8b"))))
       ("vala" ,vala)
       ("pkg-config" ,pkg-config)))
    (native-search-paths
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 89c15a5fe8..1113df1ca6 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -1347,16 +1347,18 @@ medical image data, e.g. magnetic resonance image (MRI) and functional MRI
 (define-public libiptcdata
   (package
     (name "libiptcdata")
-    (version "1.0.4")
+    (version "1.0.5")
     (source (origin
               (method url-fetch)
-              (uri (string-append "mirror://sourceforge/" name "/" name "/"
-                                  version "/" name "-" version ".tar.gz"))
+              (uri (string-append "https://github.com/ianw/libiptcdata"
+                                  "/releases/download/release_"
+                                  (string-join (string-split version #\.) "_")
+                                  "/" name "-" version ".tar.gz"))
               (sha256
                (base32
-                "03pfvkmmx762iydq0q207x2028d275pbdysfsgpmrr0ywy63pxkr"))))
+                "17m2bscc76r1bymjgb44fbbfrdsjfqyb2ivg9wchyllm8pgx1560"))))
     (build-system gnu-build-system)
-    (home-page "http://libiptcdata.sourceforge.net/")
+    (home-page "https://github.com/ianw/libiptcdata")
     (synopsis "IPTC metadata manipulation library")
     (description
      "Libiptcdata is a C library for manipulating the International Press
diff --git a/gnu/packages/kodi.scm b/gnu/packages/kodi.scm
index 62a971a0a8..86ce914d53 100644
--- a/gnu/packages/kodi.scm
+++ b/gnu/packages/kodi.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -92,22 +93,22 @@
       (arguments
        '(#:phases
          (modify-phases %standard-phases
-           (delete 'configure) ; no configure script
+           (delete 'configure)          ; no configure script
            ;; There's no build system here, so we have to do it ourselves.
            (replace 'build
              (lambda _
-               (and (zero? (system* "g++" "-c" "guid.cpp" "-o" "guid.o"
-                                    "-std=c++11" "-DGUID_LIBUUID"))
-                    (zero? (system* "ar" "rvs" "libcrossguid.a" "guid.o")))))
+               (invoke "g++" "-c" "guid.cpp" "-o" "guid.o"
+                       "-std=c++11" "-DGUID_LIBUUID")
+               (invoke "ar" "rvs" "libcrossguid.a" "guid.o")))
            (replace 'check
              (lambda _
-               (and (zero? (system* "g++" "-c" "test.cpp" "-o" "test.o"
-                                    "-std=c++11"))
-                    (zero? (system* "g++" "-c" "testmain.cpp" "-o" "testmain.o"
-                                    "-std=c++11"))
-                    (zero? (system* "g++" "test.o" "guid.o" "testmain.o"
-                                    "-o" "test" "-luuid"))
-                    (zero? (system* (string-append (getcwd) "/test"))))))
+               (invoke "g++" "-c" "test.cpp" "-o" "test.o"
+                       "-std=c++11")
+               (invoke "g++" "-c" "testmain.cpp" "-o" "testmain.o"
+                       "-std=c++11")
+               (invoke "g++" "test.o" "guid.o" "testmain.o"
+                       "-o" "test" "-luuid")
+               (invoke (string-append (getcwd) "/test"))))
            (replace 'install
              (lambda* (#:key outputs #:allow-other-keys)
                (let ((out (assoc-ref outputs "out")))
@@ -294,7 +295,7 @@ generator library for C++.")
                            "lib/cpluff")))
                (every (lambda (third-party)
                         (with-directory-excursion third-party
-                          (zero? (system* "autoreconf" "-vif"))))
+                          (invoke "autoreconf" "-vif")))
                       dirs))))
          (add-after 'bootstrap-bundled-software 'patch-stuff
            (lambda* (#:key inputs #:allow-other-keys)
@@ -335,7 +336,7 @@ generator library for C++.")
              #t))
          (add-before 'check 'build-kodi-test
            (lambda _
-             (zero? (system* "make" "kodi-test")))))))
+             (invoke "make" "kodi-test"))))))
     ;; TODO: Add dependencies for:
     ;; - nfs
     ;; - cec
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 179c35e7ea..747bd37807 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -399,8 +399,8 @@ It has been modified to remove all non-free binary blobs.")
 ;; supports qemu "virt" machine and possibly a large number of ARM boards.
 ;; See : https://wiki.debian.org/DebianKernel/ARMMP.
 
-(define %linux-libre-version "4.18.8")
-(define %linux-libre-hash "163awpba1yd0x33xzj5dczimk4y96xc28syc4w2ad0qafgapng8l")
+(define %linux-libre-version "4.18.9")
+(define %linux-libre-hash "0wwmhnfvcsdlqhzwwwyz1x5a3ldjky6l0xir1pi6pysr0lak402x")
 
 (define %linux-libre-4.18-patches
   (list %boot-logo-patch
@@ -430,8 +430,8 @@ It has been modified to remove all non-free binary blobs.")
                     #:patches %linux-libre-4.18-patches
                     #:configuration-file kernel-config))
 
-(define %linux-libre-4.14-version "4.14.70")
-(define %linux-libre-4.14-hash "138v51m6k57wnvlf9c22dad0w819mfb8f95i6w99mlg69qpwdvag")
+(define %linux-libre-4.14-version "4.14.71")
+(define %linux-libre-4.14-hash "1akvykaccy7ikl8v04grwxvgs4z2rrs7drf2s85ysqwq79mdh3gq")
 
 (define-public linux-libre-4.14
   (make-linux-libre %linux-libre-4.14-version
@@ -440,14 +440,14 @@ It has been modified to remove all non-free binary blobs.")
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.9
-  (make-linux-libre "4.9.127"
-                    "0q7h5gnl3ikic0pvwrxp78pz56yvijhz6s84gb92xywi1v3dd8mh"
+  (make-linux-libre "4.9.128"
+                    "0lww23xcyyg0dwzrap5x9d700gy3lbxln55n6sqqkm7m89dkqwha"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.4
-  (make-linux-libre "4.4.156"
-                    "13j4jb4hifh3fah2ysy2425fakwqqdh2z23lf4i0frxa1xl974h2"
+  (make-linux-libre "4.4.157"
+                    "00bnfqwkr0jfdabmwx5qk5bqxn5vwnnzwqbm5rfg7lggii74kk54"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
diff --git a/gnu/packages/lxde.scm b/gnu/packages/lxde.scm
index 19938fa93c..c45beb8bbb 100644
--- a/gnu/packages/lxde.scm
+++ b/gnu/packages/lxde.scm
@@ -164,7 +164,7 @@ toolkit.  It allows users to monitor and control of running processes.")
 (define-public lxterminal
   (package
     (name "lxterminal")
-    (version "0.3.1")
+    (version "0.3.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/lxde/LXTerminal"
@@ -172,7 +172,7 @@ toolkit.  It allows users to monitor and control of running processes.")
                                   version "/" name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0jrc3m0hbxcmcgahwjlm46s2350gh80ggb6a90xy0h6xqa3z73fd"))))
+                "1124pghrhnx6q4391ri8nvi6bsmvbj1dx81an08mird8jf2b2rii"))))
     (build-system gnu-build-system)
     (inputs `(("gtk+" ,gtk+-2)
               ("vte"  ,vte/gtk+-2)))
diff --git a/gnu/packages/machine-learning.scm b/gnu/packages/machine-learning.scm
index 9aa61bd8f8..990a6c771a 100644
--- a/gnu/packages/machine-learning.scm
+++ b/gnu/packages/machine-learning.scm
@@ -750,7 +750,24 @@ data analysis.")
     (license license:bsd-3)))
 
 (define-public python2-scikit-learn
-  (package-with-python2 python-scikit-learn))
+  (let ((parent (package-with-python2 python-scikit-learn)))
+    (package (inherit parent)
+      (arguments
+       (substitute-keyword-arguments (package-arguments parent)
+         ((#:phases phases)
+          `(modify-phases ,phases
+             (replace 'check
+               (lambda _
+                 ;; Restrict OpenBLAS threads to prevent segfaults while testing!
+                 (setenv "OPENBLAS_NUM_THREADS" "1")
+                 ;; Some tests expect to be able to write to HOME.
+                 (setenv "HOME" "/tmp")
+                 ;; Disable tests that require network access
+                 (delete-file "sklearn/datasets/tests/test_kddcup99.py")
+                 (delete-file "sklearn/datasets/tests/test_mldata.py")
+                 (delete-file "sklearn/datasets/tests/test_rcv1.py")
+                 (invoke "pytest" "sklearn")
+                 #t)))))))))
 
 (define-public python-autograd
   (let* ((commit "442205dfefe407beffb33550846434baa90c4de7")
diff --git a/gnu/packages/mate.scm b/gnu/packages/mate.scm
index 88f64fdb66..5919c714ee 100644
--- a/gnu/packages/mate.scm
+++ b/gnu/packages/mate.scm
@@ -1411,7 +1411,7 @@ can be used as backgrounds in the MATE Desktop environment.")
     (inputs
      `(("atk" ,atk)
        ("cairo" ,cairo)
-       ("enchant" ,enchant)
+       ("enchant" ,enchant-1.6)
        ("glib" ,glib)
        ("gtk+" ,gtk+)
        ("gtksourceview" ,gtksourceview)
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index b00d1aa8f1..b8c1c8f951 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -814,8 +814,11 @@ incompatible with HDF5.")
                 (mkdir-p flib)
                 (mkdir-p finc)
                 (mkdir-p fex)
-                (rename-file (string-append bin "/h5fc")
-                             (string-append fbin "/h5fc"))
+                ;; Note: When built with --enable-parallel, the 'h5fc' file
+                ;; doesn't exist, hence this condition.
+                (when (file-exists? (string-append bin "/h5fc"))
+                  (rename-file (string-append bin "/h5fc")
+                               (string-append fbin "/h5fc")))
                 (for-each (lambda (file)
                             (rename-file file
                                          (string-append flib "/" (basename file))))
@@ -1034,10 +1037,13 @@ Swath).")
      `(("mpi" ,openmpi)
        ,@(package-inputs hdf5)))
     (arguments
-     (substitute-keyword-arguments `(#:configure-flags '("--enable-parallel")
-                                     ,@(package-arguments hdf5))
+     (substitute-keyword-arguments (package-arguments hdf5)
+       ((#:configure-flags flags)
+        ``("--enable-parallel" ,@(delete "--enable-cxx" ,flags)))
        ((#:phases phases)
         `(modify-phases ,phases
+           (add-after 'build 'mpi-setup
+             ,%openmpi-setup)
            (add-before 'check 'patch-tests
              (lambda _
                ;; OpenMPI's mpirun will exit with non-zero status if it
@@ -1396,6 +1402,13 @@ can solve two kinds of problems:
        ("less" ,less)
        ("ghostscript" ,ghostscript)
        ("gnuplot" ,gnuplot)))
+    ;; Octave code uses this variable to detect directories holding multiple CA
+    ;; certificates to verify peers with.  This is required for the networking
+    ;; functions that require encryption to work properly.
+    (native-search-paths
+     (list (search-path-specification
+            (variable "CURLOPT_CAPATH")
+            (files '("etc/ssl/certs")))))
     (arguments
      `(#:configure-flags
        (list (string-append "--with-shell="
diff --git a/gnu/packages/messaging.scm b/gnu/packages/messaging.scm
index 42a0847b7a..9b1aea788c 100644
--- a/gnu/packages/messaging.scm
+++ b/gnu/packages/messaging.scm
@@ -1135,7 +1135,7 @@ with several different talk daemons at the same time.")
 (define-public gloox
   (package
     (name "gloox")
-    (version "1.0.17")
+    (version "1.0.21")
     (source
      (origin
        (method url-fetch)
@@ -1143,7 +1143,7 @@ with several different talk daemons at the same time.")
                            version ".tar.bz2"))
        (sha256
         (base32
-         "09c01jr5nrm7f1ly42wg0pqqscmp48pv8y2fjx1vwbavjxdq59ri"))))
+         "1k57qgif1yii515m6jaqaibkdysfab6394bpawd2l67321f1a4rw"))))
     (build-system gnu-build-system)
     (inputs
      `(("libidn" ,libidn)
@@ -1472,15 +1472,16 @@ is also scriptable and extensible via Guile.")
 (define-public libmesode
   (package
     (name "libmesode")
-    (version "0.9.1")
+    (version "0.9.2")
     (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/boothj5/libmesode/archive/"
-                                  version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/boothj5/libmesode.git")
+                    (commit version)))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "0iaj56fkd5bjvqpvq3324ni895rmbj1akbfqipjydnghfwaym4z6"))))
+                "06f5nfaypvxrbsinxa1k2vrxrs7kqmg38g4wwwk5d63hpn1pj8ak"))))
     (build-system gnu-build-system)
     (inputs
      `(("expat" ,expat)
diff --git a/gnu/packages/nano.scm b/gnu/packages/nano.scm
index 9396588fc8..8f96b605a6 100644
--- a/gnu/packages/nano.scm
+++ b/gnu/packages/nano.scm
@@ -30,7 +30,7 @@
 (define-public nano
   (package
     (name "nano")
-    (version "3.0")
+    (version "3.1")
     (source
      (origin
       (method url-fetch)
@@ -38,7 +38,7 @@
                           version ".tar.xz"))
       (sha256
        (base32
-        "1868hg9s584fwjrh0fzdrixmxc2qhw520z4q5iv68kjiajivr9g0"))))
+        "17kinzyv6vwgyx2d0ym1kp65qbf7kxzwpyg21ic1rijv1aj2rh0l"))))
     (build-system gnu-build-system)
     (inputs
      `(("gettext" ,gettext-minimal)
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index abc616de3c..4800c2496b 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -87,6 +87,7 @@
   #:use-module (gnu packages perl-check)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages python-web)
   #:use-module (gnu packages qt)
   #:use-module (gnu packages readline)
   #:use-module (gnu packages ssh)
@@ -651,7 +652,7 @@ network frames.")
 (define-public fping
   (package
     (name "fping")
-    (version "4.0")
+    (version "4.1")
     (source
      (origin
        (method url-fetch)
@@ -659,9 +660,9 @@ network frames.")
                            version ".tar.gz"))
        (sha256
         (base32
-         "1kp81wchi79l8z8rrj602fpjrd8bi84y3i7fsaclzlwap5943sv7"))))
+         "0wxbvm480vij8dy4v1pi8f0c7010rx6bidg3qhsvkdf2ijhy4cr7"))))
     (build-system gnu-build-system)
-    (home-page "http://fping.org/")
+    (home-page "https://fping.org/")
     (synopsis "Send ICMP ECHO_REQUEST packets to network hosts")
     (description
      "fping is a ping like program which uses the Internet Control Message
@@ -673,6 +674,55 @@ send out a ping packet and move on to the next target in a round-robin
 fashion.")
     (license license:expat)))
 
+(define-public gandi.cli
+  (package
+    (name "gandi.cli")
+    (version "1.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri name version))
+       (sha256
+        (base32 "0vfzkw1avybjkf6fwqpf5m4kjz4c0qkkmj62f3jd0zx00vh5ly1d"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'embed-store-file-names
+           (lambda _
+             (substitute* (list "gandi/cli/modules/cert.py"
+                                "gandi/cli/tests/commands/test_certificate.py")
+               (("openssl") (which "openssl")))
+             #t))
+         (add-after 'install 'install-documentation
+           ;; The included man page may be outdated but we install it anyway,
+           ;; since it's mentioned in 'gandi --help' and better than nothing.
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out  (assoc-ref outputs "out"))
+                    (man1 (string-append out "/share/man/man1")))
+               (mkdir-p man1)
+               (with-output-to-file (string-append man1 "/gandi.1")
+                 (lambda _
+                   (invoke "rst2man.py" "gandicli.man.rst")))
+               #t))))))
+    (native-inputs
+     `(("python-docutils" ,python-docutils)   ; for rst2man.py
+       ("python-pytest-cov" ,python-pytest-cov)
+       ("python-tox" ,python-tox)))
+    (inputs
+     `(("openssl" ,openssl)
+       ("python-click" ,python-click)
+       ("python-ipy" ,python-ipy)
+       ("python-pyyaml" ,python-pyyaml)
+       ("python-requests" ,python-requests)))
+    (home-page "https://cli.gandi.net")
+    (synopsis "Command-line interface to the Gandi.net Web API")
+    (description
+     "This package provides a command-line client (@command{gandi}) to buy,
+manage, and delete Internet resources from Gandi.net such as domain names,
+virtual machines, and certificates.")
+    (license license:gpl3+)))
+
 (define-public httping
   (package
     (name "httping")
diff --git a/gnu/packages/node.scm b/gnu/packages/node.scm
index d1de7a536c..b525804bdb 100644
--- a/gnu/packages/node.scm
+++ b/gnu/packages/node.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Mike Gerwitz <mtg@gnu.org>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -86,6 +87,14 @@
        (modify-phases %standard-phases
          (add-before 'configure 'patch-files
            (lambda* (#:key inputs #:allow-other-keys)
+
+             ;; This phase is inherited by Node LTS, which does not have all
+             ;; the files listed here.  Use this helper for convenience.
+             (define (delete-if-exists file)
+               (if (file-exists? file)
+                   (delete-file file)
+                   '()))
+
              ;; Fix hardcoded /bin/sh references.
              (substitute* '("lib/child_process.js"
                             "lib/internal/v8_prof_polyfill.js"
@@ -103,7 +112,7 @@
 
              ;; FIXME: These tests depend on being able to install eslint.
              ;; See https://github.com/nodejs/node/issues/17098.
-             (for-each delete-file
+             (for-each delete-if-exists
                        '("test/parallel/test-eslint-alphabetize-errors.js"
                          "test/parallel/test-eslint-buffer-constructor.js"
                          "test/parallel/test-eslint-documented-errors.js"
@@ -111,7 +120,7 @@
 
              ;; FIXME: These tests fail in the build container, but they don't
              ;; seem to be indicative of real problems in practice.
-             (for-each delete-file
+             (for-each delete-if-exists
                        '("test/async-hooks/test-ttywrap.readstream.js"
                          "test/parallel/test-util-inspect.js"
                          "test/parallel/test-v8-serdes.js"
@@ -125,6 +134,14 @@
                          "test/sequential/test-child-process-emfile.js"
                          "test/sequential/test-benchmark-child-process.js"
                          "test/sequential/test-http-regr-gh-2928.js"))
+
+             ;; These tests have an expiry date: they depend on the validity of
+             ;; TLS certificates that are bundled with the source.  We want this
+             ;; package to be reproducible forever, so remove those.
+             ;; TODO: Regenerate certs instead.
+             (for-each delete-if-exists
+                       '("test/parallel/test-tls-passphrase.js"
+                         "test/parallel/test-tls-server-verify.js"))
              #t))
          (replace 'configure
            ;; Node's configure script is actually a python script, so we can't
@@ -180,3 +197,16 @@ devices.")
     (home-page "https://nodejs.org/")
     (license expat)
     (properties '((timeout . 3600))))) ; 1 h
+
+(define-public node-lts
+  (package
+    (inherit node)
+    (name "node-lts")
+    (version "8.12.0")
+    (source (origin
+              (inherit (package-source node))
+              (uri (string-append "https://nodejs.org/dist/v" version
+                                  "/node-v" version ".tar.xz"))
+              (sha256
+               (base32
+                "16j1rrxkhmvpcw689ndw1raql1gz4jqn7n82z55zn63c05cgz7as"))))))
diff --git a/gnu/packages/ocaml.scm b/gnu/packages/ocaml.scm
index 7859696406..0756aecd6d 100644
--- a/gnu/packages/ocaml.scm
+++ b/gnu/packages/ocaml.scm
@@ -65,6 +65,7 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system ocaml)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix svn-download)
@@ -1650,12 +1651,13 @@ lets the client choose the concrete timeline.")
     (version "0.5.5")
     (source
       (origin
-        (method url-fetch)
-        (uri (string-append "https://github.com/savonet/ocaml-ssl/archive/"
-                            version ".tar.gz"))
-        (file-name (string-append name "-" version ".tar.gz"))
+        (method git-fetch)
+        (uri (git-reference
+              (url "https://github.com/savonet/ocaml-ssl.git")
+              (commit version)))
+        (file-name (git-file-name name version))
         (sha256 (base32
-                  "15p7652cvzdrlqxc1af11mg07wasxr1fsaj44gcmmh6bmav7wfzq"))))
+                  "0fviq8xhp3qk7pmkl7knchywsipxgb7p0z489hj8qnf2sx8xzdmy"))))
     (build-system ocaml-build-system)
     (arguments `(#:tests? #f
                  #:make-flags (list "OCAMLFIND_LDCONF=ignore")
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index ae39870dd4..850223cd4c 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -293,6 +293,7 @@ servers from Python programs.")
        ("nspr" ,nspr)
        ("nss" ,nss)
        ("openldap" ,openldap)
+       ("openssl" ,openssl)             ; #included by net-snmp
        ("pcre" ,pcre)
        ("perl" ,perl)
        ("python" ,python)
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index 06c344e7af..d1ab2ad6da 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -566,13 +566,13 @@ transactions from C or Python.")
 (define-public diffoscope
   (package
     (name "diffoscope")
-    (version "100")
+    (version "102")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri name version))
               (sha256
                (base32
-                "0sh7g26i5ndpa8l7xq6rnijbi3jz5izjn0b98zcnm6wpgghszw48"))))
+                "0v2z98xx7n4viw12yq83flpb9ir5ahy1gn44pic0i3dam18xhcm6"))))
     (build-system python-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
diff --git a/gnu/packages/parallel.scm b/gnu/packages/parallel.scm
index ec1fae6470..3dba2b8c00 100644
--- a/gnu/packages/parallel.scm
+++ b/gnu/packages/parallel.scm
@@ -48,7 +48,7 @@
 (define-public parallel
   (package
     (name "parallel")
-    (version "20180822")
+    (version "20180922")
     (source
      (origin
       (method url-fetch)
@@ -56,7 +56,7 @@
                           version ".tar.bz2"))
       (sha256
        (base32
-        "0jjs7fpvdjjb5v0j39a6k7hq9h5ap3db1j7vg1r2dq4swk23h9bm"))))
+        "07q7lzway2qf8mx6fb4q45jmirsc8pw6rgv03ifrp32jw3q8w1za"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -66,7 +66,7 @@
              (for-each
               (lambda (file)
                 (substitute* file
-                  ;; Patch hard coded '/bin/sh' in the lin ending in:
+                  ;; Patch hard coded '/bin/sh' in the line ending in:
                   ;; $Global::shell = $ENV{'PARALLEL_SHELL'} ||
                   ;;  parent_shell($$) || $ENV{'SHELL'} || "/bin/sh";
                   (("/bin/sh\\\";\n$") (string-append (which "sh") "\";\n"))))
diff --git a/gnu/packages/patches/hmmer-remove-cpu-specificity.patch b/gnu/packages/patches/hmmer-remove-cpu-specificity.patch
deleted file mode 100644
index ba98db4d0e..0000000000
--- a/gnu/packages/patches/hmmer-remove-cpu-specificity.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-This patch removes compilation flags which make the build for the machine
-where compilation takes place, rendering the build not reproducible.
-
-diff --git a/configure b/configure
-index 8b6aaef..49a6afc 100755
---- a/configure
-+++ b/configure
-@@ -6125,14 +6125,6 @@ fi # guess arch
- 
- if test "x$ax_gcc_arch" != x -a "x$ax_gcc_arch" != xno; then
- for arch in $ax_gcc_arch; do
--  if test "x$acx_maxopt_portable" = xyes; then # if we require portable code
--    flags="-mtune=$arch"
--    # -mcpu=$arch and m$arch generate nonportable code on every arch except
--    # x86.  And some other arches (e.g. Alpha) don't accept -mtune.  Grrr.
--    case $host_cpu in i*86|x86_64*) flags="$flags -mcpu=$arch -m$arch";; esac
--  else
--    flags="-march=$arch -mcpu=$arch -m$arch"
--  fi
-   for flag in $flags; do
-     as_CACHEVAR=`$as_echo "ax_cv_check_cflags__$flag" | $as_tr_sh`
- { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts $flag" >&5
diff --git a/gnu/packages/patches/icecat-CVE-2018-12383.patch b/gnu/packages/patches/icecat-CVE-2018-12383.patch
new file mode 100644
index 0000000000..17ca0f3773
--- /dev/null
+++ b/gnu/packages/patches/icecat-CVE-2018-12383.patch
@@ -0,0 +1,103 @@
+Based on upstream changeset:
+  https://hg.mozilla.org/releases/mozilla-esr60/rev/300efdbc9fe1
+but with the git binary patch and related test changes omitted,
+and adapted to apply cleanly to GNU IceCat.
+
+# HG changeset patch
+# User David Keeler <dkeeler@mozilla.com>
+# Date 1531860660 25200
+# Node ID 300efdbc9fe1f9165428c7934861033935b5abfa
+# Parent  80a4a7ef281374dbb2afda8edac54665b14b9ef8
+Bug 1475775 - Clean up old NSS DB file after upgrade if necessary. r=franziskus, r=mattn, a=RyanVM
+
+Reviewers: franziskus, mattn
+
+Bug #: 1475775
+
+Differential Revision: https://phabricator.services.mozilla.com/D2202
+
+diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp
+--- a/security/manager/ssl/nsNSSComponent.cpp
++++ b/security/manager/ssl/nsNSSComponent.cpp
+@@ -1935,16 +1935,61 @@ AttemptToRenameBothPKCS11ModuleDBVersion
+   NS_NAMED_LITERAL_CSTRING(sqlModuleDBFilename, "pkcs11.txt");
+   nsresult rv = AttemptToRenamePKCS11ModuleDB(profilePath,
+                                               legacyModuleDBFilename);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+   return AttemptToRenamePKCS11ModuleDB(profilePath, sqlModuleDBFilename);
+ }
++
++// When we changed from the old dbm database format to the newer sqlite
++// implementation, the upgrade process left behind the existing files. Suppose a
++// user had not set a password for the old key3.db (which is about 99% of
++// users). After upgrading, both the old database and the new database are
++// unprotected. If the user then sets a password for the new database, the old
++// one will not be protected. In this scenario, we should probably just remove
++// the old database (it would only be relevant if the user downgraded to a
++// version of IceCat before 58, but we have to trade this off against the
++// user's old private keys being unexpectedly unprotected after setting a
++// password).
++// This was never an issue on Android because we always used the new
++// implementation.
++static void
++MaybeCleanUpOldNSSFiles(const nsACString& profilePath)
++{
++  UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
++  if (!slot) {
++    return;
++  }
++  // Unfortunately we can't now tell the difference between "there already was a
++  // password when the upgrade happened" and "there was not a password but then
++  // the user added one after upgrading".
++  bool hasPassword = PK11_NeedLogin(slot.get()) &&
++                     !PK11_NeedUserInit(slot.get());
++  if (!hasPassword) {
++    return;
++  }
++  nsCOMPtr<nsIFile> dbFile = do_CreateInstance("@mozilla.org/file/local;1");
++  if (!dbFile) {
++    return;
++  }
++  nsresult rv = dbFile->InitWithNativePath(profilePath);
++  if (NS_FAILED(rv)) {
++    return;
++  }
++  NS_NAMED_LITERAL_CSTRING(keyDBFilename, "key3.db");
++  rv = dbFile->AppendNative(keyDBFilename);
++  if (NS_FAILED(rv)) {
++    return;
++  }
++  // Since this isn't a directory, the `recursive` argument to `Remove` is
++  // irrelevant.
++  Unused << dbFile->Remove(false);
++}
+ #endif // ifndef ANDROID
+ 
+ // Given a profile directory, attempt to initialize NSS. If nocertdb is true,
+ // (or if we don't have a profile directory) simply initialize NSS in no DB mode
+ // and return. Otherwise, first attempt to initialize in read/write mode, and
+ // then read-only mode if that fails. If both attempts fail, we may be failing
+ // to initialize an NSS DB collection that has FIPS mode enabled. Attempt to
+ // ascertain if this is the case, and if so, rename the offending PKCS#11 module
+@@ -1966,16 +2011,19 @@ InitializeNSSWithFallbacks(const nsACStr
+ 
+   // Try read/write mode. If we're in safeMode, we won't load PKCS#11 modules.
+ #ifndef ANDROID
+   PRErrorCode savedPRErrorCode1;
+ #endif // ifndef ANDROID
+   SECStatus srv = ::mozilla::psm::InitializeNSS(profilePath, false, !safeMode);
+   if (srv == SECSuccess) {
+     MOZ_LOG(gPIPNSSLog, LogLevel::Debug, ("initialized NSS in r/w mode"));
++#ifndef ANDROID
++    MaybeCleanUpOldNSSFiles(profilePath);
++#endif // ifndef ANDROID
+     return NS_OK;
+   }
+ #ifndef ANDROID
+   savedPRErrorCode1 = PR_GetError();
+   PRErrorCode savedPRErrorCode2;
+ #endif // ifndef ANDROID
+   // That failed. Try read-only mode.
+   srv = ::mozilla::psm::InitializeNSS(profilePath, true, !safeMode);
diff --git a/gnu/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch b/gnu/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch
deleted file mode 100644
index b776640133..0000000000
--- a/gnu/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch
+++ /dev/null
@@ -1,441 +0,0 @@
-Based on <https://hg.mozilla.org/releases/mozilla-esr52/rev/608e76ec5ba2>
-Adapted to apply cleanly to GNU IceCat.
-
-# HG changeset patch
-# User Ryan VanderMeulen <ryanvm@gmail.com>
-# Date 1523630807 14400
-# Node ID 608e76ec5ba25cec2271d2b400c7bce2d4c5ef79
-# Parent  10b7f43b536f93151201d44d304c991aa9af5d0c
-Bug 1452075 - Backport some upstream pdf.js fixes to ESR52. r=bdahl, r=yury, a=RyanVM
-
-diff --git a/browser/extensions/pdfjs/content/PdfStreamConverter.jsm b/browser/extensions/pdfjs/content/PdfStreamConverter.jsm
---- a/browser/extensions/pdfjs/content/PdfStreamConverter.jsm
-+++ b/browser/extensions/pdfjs/content/PdfStreamConverter.jsm
-@@ -24,17 +24,18 @@ const Cc = Components.classes;
- const Ci = Components.interfaces;
- const Cr = Components.results;
- const Cu = Components.utils;
- // True only if this is the version of pdf.js that is included with icecat.
- const MOZ_CENTRAL = JSON.parse('true');
- const PDFJS_EVENT_ID = 'pdf.js.message';
- const PDF_CONTENT_TYPE = 'application/pdf';
- const PREF_PREFIX = 'pdfjs';
--const PDF_VIEWER_WEB_PAGE = 'resource://pdf.js/web/viewer.html';
-+const PDF_VIEWER_ORIGIN = "resource://pdf.js";
-+const PDF_VIEWER_WEB_PAGE = "resource://pdf.js/web/viewer.html";
- const MAX_NUMBER_OF_PREFS = 50;
- const MAX_STRING_PREF_LENGTH = 128;
- 
- Cu.import('resource://gre/modules/XPCOMUtils.jsm');
- Cu.import('resource://gre/modules/Services.jsm');
- Cu.import('resource://gre/modules/NetUtil.jsm');
- 
- XPCOMUtils.defineLazyModuleGetter(this, 'NetworkManager',
-@@ -105,21 +106,25 @@ function log(aMsg) {
-   if (!getBoolPref(PREF_PREFIX + '.pdfBugEnabled', false)) {
-     return;
-   }
-   var msg = 'PdfStreamConverter.js: ' + (aMsg.join ? aMsg.join('') : aMsg);
-   Services.console.logStringMessage(msg);
-   dump(msg + '\n');
- }
- 
--function getDOMWindow(aChannel) {
-+function getDOMWindow(aChannel, aPrincipal) {
-   var requestor = aChannel.notificationCallbacks ?
-                   aChannel.notificationCallbacks :
-                   aChannel.loadGroup.notificationCallbacks;
-   var win = requestor.getInterface(Components.interfaces.nsIDOMWindow);
-+  // Ensure the window wasn't navigated to something that is not PDF.js.
-+  if (!win.document.nodePrincipal.equals(aPrincipal)) {
-+    return null;
-+  }
-   return win;
- }
- 
- function getLocalizedStrings(path) {
-   var stringBundle = Cc['@mozilla.org/intl/stringbundle;1'].
-       getService(Ci.nsIStringBundleService).
-       createBundle('chrome://pdf.js/locale/' + path);
- 
-@@ -627,31 +632,31 @@ var RangedChromeActions = (function Rang
-       data = this.dataListener.readData();
- 
-       this.dataListener.onprogress = function (loaded, total) {
-         self.domWindow.postMessage({
-           pdfjsLoadAction: 'progressiveRead',
-           loaded: loaded,
-           total: total,
-           chunk: self.dataListener.readData()
--        }, '*');
-+        }, PDF_VIEWER_ORIGIN);
-       };
-       this.dataListener.oncomplete = function () {
-         self.dataListener = null;
-       };
-     }
- 
-     this.domWindow.postMessage({
-       pdfjsLoadAction: 'supportsRangedLoading',
-       rangeEnabled: this.rangeEnabled,
-       streamingEnabled: this.streamingEnabled,
-       pdfUrl: this.pdfUrl,
-       length: this.contentLength,
-       data: data
--    }, '*');
-+    }, PDF_VIEWER_ORIGIN);
- 
-     return true;
-   };
- 
-   proto.requestDataRange = function RangedChromeActions_requestDataRange(args) {
-     if (!this.rangeEnabled) {
-       return;
-     }
-@@ -663,23 +668,23 @@ var RangedChromeActions = (function Rang
-     // errors from chrome code for non-range requests, so this doesn't
-     // seem high-pri
-     this.networkManager.requestRange(begin, end, {
-       onDone: function RangedChromeActions_onDone(args) {
-         domWindow.postMessage({
-           pdfjsLoadAction: 'range',
-           begin: args.begin,
-           chunk: args.chunk
--        }, '*');
-+        }, PDF_VIEWER_ORIGIN);
-       },
-       onProgress: function RangedChromeActions_onProgress(evt) {
-         domWindow.postMessage({
-           pdfjsLoadAction: 'rangeProgress',
-           loaded: evt.loaded,
--        }, '*');
-+        }, PDF_VIEWER_ORIGIN);
-       }
-     });
-   };
- 
-   proto.abortLoading = function RangedChromeActions_abortLoading() {
-     this.networkManager.abortAllRequests();
-     if (this.originalRequest) {
-       this.originalRequest.cancel(Cr.NS_BINDING_ABORTED);
-@@ -718,26 +723,26 @@ var StandardChromeActions = (function St
-     var self = this;
- 
-     this.dataListener.onprogress = function ChromeActions_dataListenerProgress(
-                                       loaded, total) {
-       self.domWindow.postMessage({
-         pdfjsLoadAction: 'progress',
-         loaded: loaded,
-         total: total
--      }, '*');
-+      }, PDF_VIEWER_ORIGIN);
-     };
- 
-     this.dataListener.oncomplete =
-         function StandardChromeActions_dataListenerComplete(data, errorCode) {
-       self.domWindow.postMessage({
-         pdfjsLoadAction: 'complete',
-         data: data,
-         errorCode: errorCode
--      }, '*');
-+      }, PDF_VIEWER_ORIGIN);
- 
-       self.dataListener = null;
-       self.originalRequest = null;
-     };
- 
-     return true;
-   };
- 
-@@ -972,31 +977,35 @@ PdfStreamConverter.prototype = {
-     var proxy = {
-       onStartRequest: function(request, context) {
-         listener.onStartRequest(aRequest, aContext);
-       },
-       onDataAvailable: function(request, context, inputStream, offset, count) {
-         listener.onDataAvailable(aRequest, aContext, inputStream,
-                                  offset, count);
-       },
--      onStopRequest: function(request, context, statusCode) {
--        // We get the DOM window here instead of before the request since it
--        // may have changed during a redirect.
--        var domWindow = getDOMWindow(channel);
-+      onStopRequest(request, context, statusCode) {
-+        var domWindow = getDOMWindow(channel, resourcePrincipal);
-+        if (!Components.isSuccessCode(statusCode) || !domWindow) {
-+          // The request may have been aborted and the document may have been
-+          // replaced with something that is not PDF.js, abort attaching.
-+          listener.onStopRequest(aRequest, context, statusCode);
-+          return;
-+        }
-         var actions;
-         if (rangeRequest || streamRequest) {
-           actions = new RangedChromeActions(
-             domWindow, contentDispositionFilename, aRequest,
-             rangeRequest, streamRequest, dataListener);
-         } else {
-           actions = new StandardChromeActions(
-             domWindow, contentDispositionFilename, aRequest, dataListener);
-         }
-         var requestListener = new RequestListener(actions);
--        domWindow.addEventListener(PDFJS_EVENT_ID, function(event) {
-+        domWindow.document.addEventListener(PDFJS_EVENT_ID, function(event) {
-           requestListener.receive(event);
-         }, false, true);
-         if (actions.supportsIntegratedFind()) {
-           var findEventManager = new FindEventManager(domWindow);
-           findEventManager.bind();
-         }
-         listener.onStopRequest(aRequest, aContext, statusCode);
- 
-diff --git a/browser/extensions/pdfjs/content/build/pdf.worker.js b/browser/extensions/pdfjs/content/build/pdf.worker.js
---- a/browser/extensions/pdfjs/content/build/pdf.worker.js
-+++ b/browser/extensions/pdfjs/content/build/pdf.worker.js
-@@ -41648,16 +41648,32 @@
-       var error = sharedUtil.error;
-       var info = sharedUtil.info;
-       var isArray = sharedUtil.isArray;
-       var isBool = sharedUtil.isBool;
-       var isDict = corePrimitives.isDict;
-       var isStream = corePrimitives.isStream;
-       var PostScriptLexer = corePsParser.PostScriptLexer;
-       var PostScriptParser = corePsParser.PostScriptParser;
-+      function toNumberArray(arr) {
-+        if (!Array.isArray(arr)) {
-+          return null;
-+        }
-+        var length = arr.length;
-+        for (var i = 0; i < length; i++) {
-+          if (typeof arr[i] !== 'number') {
-+            var result = new Array(length);
-+            for (var j = 0; j < length; j++) {
-+              result[j] = +arr[j];
-+            }
-+            return result;
-+          }
-+        }
-+        return arr;
-+      }
-       var PDFFunction = function PDFFunctionClosure() {
-         var CONSTRUCT_SAMPLED = 0;
-         var CONSTRUCT_INTERPOLATED = 2;
-         var CONSTRUCT_STICHED = 3;
-         var CONSTRUCT_POSTSCRIPT = 4;
-         return {
-           getSampleArray: function PDFFunction_getSampleArray(size, outputSize, bps, str) {
-             var i, ii;
-@@ -41747,43 +41763,43 @@
-                 out[index] = [
-                   arr[i],
-                   arr[i + 1]
-                 ];
-                 ++index;
-               }
-               return out;
-             }
--            var domain = dict.getArray('Domain');
--            var range = dict.getArray('Range');
-+            var domain = toNumberArray(dict.getArray('Domain'));
-+            var range = toNumberArray(dict.getArray('Range'));
-             if (!domain || !range) {
-               error('No domain or range');
-             }
-             var inputSize = domain.length / 2;
-             var outputSize = range.length / 2;
-             domain = toMultiArray(domain);
-             range = toMultiArray(range);
--            var size = dict.get('Size');
-+            var size = toNumberArray(dict.get('Size'));
-             var bps = dict.get('BitsPerSample');
-             var order = dict.get('Order') || 1;
-             if (order !== 1) {
-               // No description how cubic spline interpolation works in PDF32000:2008
-               // As in poppler, ignoring order, linear interpolation may work as good
-               info('No support for cubic spline interpolation: ' + order);
-             }
--            var encode = dict.getArray('Encode');
-+            var encode = toNumberArray(dict.getArray('Encode'));
-             if (!encode) {
-               encode = [];
-               for (var i = 0; i < inputSize; ++i) {
--                encode.push(0);
--                encode.push(size[i] - 1);
--              }
--            }
--            encode = toMultiArray(encode);
--            var decode = dict.getArray('Decode');
-+                encode.push([0, size[i] - 1]);
-+              }
-+            } else {
-+              encode = toMultiArray(encode);
-+            }
-+            var decode = toNumberArray(dict.getArray('Decode'));
-             if (!decode) {
-               decode = range;
-             } else {
-               decode = toMultiArray(decode);
-             }
-             var samples = this.getSampleArray(size, outputSize, bps, str);
-             return [
-               CONSTRUCT_SAMPLED,
-@@ -41868,22 +41884,19 @@
-                 //                    Decode_2j, Decode_2j+1)
-                 rj = interpolate(rj, 0, 1, decode[j][0], decode[j][1]);
-                 // y_j = min(max(r_j, range_2j), range_2j+1)
-                 dest[destOffset + j] = Math.min(Math.max(rj, range[j][0]), range[j][1]);
-               }
-             };
-           },
-           constructInterpolated: function PDFFunction_constructInterpolated(str, dict) {
--            var c0 = dict.getArray('C0') || [0];
--            var c1 = dict.getArray('C1') || [1];
-+            var c0 = toNumberArray(dict.getArray('C0')) || [0];
-+            var c1 = toNumberArray(dict.getArray('C1')) || [1];
-             var n = dict.get('N');
--            if (!isArray(c0) || !isArray(c1)) {
--              error('Illegal dictionary for interpolated function');
--            }
-             var length = c0.length;
-             var diff = [];
-             for (var i = 0; i < length; ++i) {
-               diff.push(c1[i] - c0[i]);
-             }
-             return [
-               CONSTRUCT_INTERPOLATED,
-               c0,
-@@ -41899,49 +41912,45 @@
-             return function constructInterpolatedFromIRResult(src, srcOffset, dest, destOffset) {
-               var x = n === 1 ? src[srcOffset] : Math.pow(src[srcOffset], n);
-               for (var j = 0; j < length; ++j) {
-                 dest[destOffset + j] = c0[j] + x * diff[j];
-               }
-             };
-           },
-           constructStiched: function PDFFunction_constructStiched(fn, dict, xref) {
--            var domain = dict.getArray('Domain');
-+            var domain = toNumberArray(dict.getArray('Domain'));
-             if (!domain) {
-               error('No domain');
-             }
-             var inputSize = domain.length / 2;
-             if (inputSize !== 1) {
-               error('Bad domain for stiched function');
-             }
-             var fnRefs = dict.get('Functions');
-             var fns = [];
-             for (var i = 0, ii = fnRefs.length; i < ii; ++i) {
--              fns.push(PDFFunction.getIR(xref, xref.fetchIfRef(fnRefs[i])));
--            }
--            var bounds = dict.getArray('Bounds');
--            var encode = dict.getArray('Encode');
-+              fns.push(PDFFunction.parse(xref, xref.fetchIfRef(fnRefs[i])));
-+            }
-+            var bounds = toNumberArray(dict.getArray('Bounds'));
-+            var encode = toNumberArray(dict.getArray('Encode'));
-             return [
-               CONSTRUCT_STICHED,
-               domain,
-               bounds,
-               encode,
-               fns
-             ];
-           },
-           constructStichedFromIR: function PDFFunction_constructStichedFromIR(IR) {
-             var domain = IR[1];
-             var bounds = IR[2];
-             var encode = IR[3];
--            var fnsIR = IR[4];
--            var fns = [];
-+            var fns = IR[4];
-             var tmpBuf = new Float32Array(1);
--            for (var i = 0, ii = fnsIR.length; i < ii; i++) {
--              fns.push(PDFFunction.fromIR(fnsIR[i]));
--            }
-             return function constructStichedFromIRResult(src, srcOffset, dest, destOffset) {
-               var clip = function constructStichedFromIRClip(v, min, max) {
-                 if (v > max) {
-                   v = max;
-                 } else if (v < min) {
-                   v = min;
-                 }
-                 return v;
-@@ -41968,18 +41977,18 @@
-               // Prevent the value from becoming NaN as a result
-               // of division by zero (fixes issue6113.pdf).
-               tmpBuf[0] = dmin === dmax ? rmin : rmin + (v - dmin) * (rmax - rmin) / (dmax - dmin);
-               // call the appropriate function
-               fns[i](tmpBuf, 0, dest, destOffset);
-             };
-           },
-           constructPostScript: function PDFFunction_constructPostScript(fn, dict, xref) {
--            var domain = dict.getArray('Domain');
--            var range = dict.getArray('Range');
-+            var domain = toNumberArray(dict.getArray('Domain'));
-+            var range = toNumberArray(dict.getArray('Range'));
-             if (!domain) {
-               error('No domain.');
-             }
-             if (!range) {
-               error('No range.');
-             }
-             var lexer = new PostScriptLexer(fn);
-             var parser = new PostScriptParser(lexer);
-@@ -42928,18 +42937,18 @@
-           case 'IndexedCS':
-             var baseIndexedCS = IR[1];
-             var hiVal = IR[2];
-             var lookup = IR[3];
-             return new IndexedCS(ColorSpace.fromIR(baseIndexedCS), hiVal, lookup);
-           case 'AlternateCS':
-             var numComps = IR[1];
-             var alt = IR[2];
--            var tintFnIR = IR[3];
--            return new AlternateCS(numComps, ColorSpace.fromIR(alt), PDFFunction.fromIR(tintFnIR));
-+            var tintFn = IR[3];
-+            return new AlternateCS(numComps, ColorSpace.fromIR(alt), tintFn);
-           case 'LabCS':
-             whitePoint = IR[1];
-             blackPoint = IR[2];
-             var range = IR[3];
-             return new LabCS(whitePoint, blackPoint, range);
-           default:
-             error('Unknown name ' + name);
-           }
-@@ -43067,22 +43076,22 @@
-               var name = xref.fetchIfRef(cs[1]);
-               numComps = 1;
-               if (isName(name)) {
-                 numComps = 1;
-               } else if (isArray(name)) {
-                 numComps = name.length;
-               }
-               alt = ColorSpace.parseToIR(cs[2], xref, res);
--              var tintFnIR = PDFFunction.getIR(xref, xref.fetchIfRef(cs[3]));
-+              var tintFn = PDFFunction.parse(xref, xref.fetchIfRef(cs[3]));
-               return [
-                 'AlternateCS',
-                 numComps,
-                 alt,
--                tintFnIR
-+                tintFn
-               ];
-             case 'Lab':
-               params = xref.fetchIfRef(cs[1]);
-               whitePoint = params.getArray('WhitePoint');
-               blackPoint = params.getArray('BlackPoint');
-               var range = params.getArray('Range');
-               return [
-                 'LabCS',
-@@ -52483,9 +52492,9 @@
-         initializeWorker();
-       }
-       exports.setPDFNetworkStreamClass = setPDFNetworkStreamClass;
-       exports.WorkerTask = WorkerTask;
-       exports.WorkerMessageHandler = WorkerMessageHandler;
-     }));
-   }.call(pdfjsLibs));
-   exports.WorkerMessageHandler = pdfjsLibs.pdfjsCoreWorker.WorkerMessageHandler;
--}));
-\ No newline at end of file
-+}));
-
diff --git a/gnu/packages/patches/icecat-avoid-bundled-libraries.patch b/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
index 114631517a..b5e9fb887e 100644
--- a/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
+++ b/gnu/packages/patches/icecat-avoid-bundled-libraries.patch
@@ -1,8 +1,8 @@
 Fixes needed when avoiding bundled libraries.
 
---- icecat-52.0.2/xpcom/build/moz.build.orig
-+++ icecat-52.0.2/xpcom/build/moz.build
-@@ -93,10 +93,5 @@
+--- icecat-60.2.0/xpcom/build/moz.build.orig	2018-09-13 17:46:49.000000000 -0400
++++ icecat-60.2.0/xpcom/build/moz.build	2018-09-22 04:26:50.659564554 -0400
+@@ -99,10 +99,5 @@
      '/docshell/base',
  ]
  
@@ -13,9 +13,9 @@ Fixes needed when avoiding bundled libraries.
 -
  if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
      CXXFLAGS += CONFIG['TK_CFLAGS']
---- icecat-52.0.2/storage/moz.build.orig
-+++ icecat-52.0.2/storage/moz.build
-@@ -114,7 +114,6 @@
+--- icecat-60.2.0/storage/moz.build.orig	2018-09-13 17:51:11.000000000 -0400
++++ icecat-60.2.0/storage/moz.build	2018-09-22 04:26:50.659564554 -0400
+@@ -117,7 +117,6 @@
      DEFINES['MOZ_MEMORY_TEMP_STORE_PRAGMA'] = True
  
  LOCAL_INCLUDES += [
@@ -23,13 +23,13 @@ Fixes needed when avoiding bundled libraries.
      '/dom/base',
  ]
  
---- icecat-52.0.2/dom/indexedDB/moz.build.orig
-+++ icecat-52.0.2/dom/indexedDB/moz.build
-@@ -101,7 +101,6 @@
+--- icecat-60.2.0/dom/indexedDB/moz.build.orig	2018-09-13 17:49:42.000000000 -0400
++++ icecat-60.2.0/dom/indexedDB/moz.build	2018-09-22 04:26:50.663564574 -0400
+@@ -102,7 +102,6 @@
      CXXFLAGS += ['-Wno-error=shadow']
  
  LOCAL_INCLUDES += [
 -    '/db/sqlite3/src',
      '/dom/base',
      '/dom/storage',
-     '/dom/workers',
+     '/ipc/glue',
diff --git a/gnu/packages/patches/icecat-bug-1413868-pt1.patch b/gnu/packages/patches/icecat-bug-1413868-pt1.patch
deleted file mode 100644
index 18382dc33a..0000000000
--- a/gnu/packages/patches/icecat-bug-1413868-pt1.patch
+++ /dev/null
@@ -1,663 +0,0 @@
-Based on <https://hg.mozilla.org/releases/mozilla-esr52/rev/431fa5dd4016>
-Adapted to apply cleanly to GNU IceCat.
-
-# HG changeset patch
-# User Honza Bambas <honzab.moz@firemni.cz>
-# Date 1528830658 14400
-# Node ID 431fa5dd4016bdab7e4bb0d3c4df85468fe337b0
-# Parent  e8e9e1ef79f2a18c61ec1b87cfb214c8d4960f8e
-Bug 1413868. r=valentin, a=RyanVM
-
-diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
---- a/toolkit/xre/nsAppRunner.cpp
-+++ b/toolkit/xre/nsAppRunner.cpp
-@@ -4,16 +4,17 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "mozilla/dom/ContentParent.h"
- #include "mozilla/dom/ContentChild.h"
- #include "mozilla/ipc/GeckoChildProcessHost.h"
- 
- #include "mozilla/ArrayUtils.h"
- #include "mozilla/Attributes.h"
-+#include "mozilla/FilePreferences.h"
- #include "mozilla/ChaosMode.h"
- #include "mozilla/IOInterposer.h"
- #include "mozilla/Likely.h"
- #include "mozilla/MemoryChecking.h"
- #include "mozilla/Poison.h"
- #include "mozilla/Preferences.h"
- #include "mozilla/ScopeExit.h"
- #include "mozilla/Services.h"
-@@ -4304,16 +4305,20 @@ XREMain::XRE_mainRun()
-       // Need to write out the fact that the profile has been removed and potentially
-       // that the selected/default profile changed.
-       mProfileSvc->Flush();
-     }
-   }
- 
-   mDirProvider.DoStartup();
- 
-+  // As FilePreferences need the profile directory, we must initialize right here.
-+  mozilla::FilePreferences::InitDirectoriesWhitelist();
-+  mozilla::FilePreferences::InitPrefs();
-+
-   OverrideDefaultLocaleIfNeeded();
- 
- #ifdef MOZ_CRASHREPORTER
-   nsCString userAgentLocale;
-   // Try a localized string first. This pref is always a localized string in
-   // IceCatMobile, and might be elsewhere, too.
-   if (NS_SUCCEEDED(Preferences::GetLocalizedCString("general.useragent.locale", &userAgentLocale))) {
-     CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("useragent_locale"), userAgentLocale);
-diff --git a/toolkit/xre/nsEmbedFunctions.cpp b/toolkit/xre/nsEmbedFunctions.cpp
---- a/toolkit/xre/nsEmbedFunctions.cpp
-+++ b/toolkit/xre/nsEmbedFunctions.cpp
-@@ -46,16 +46,17 @@
- #include "nsX11ErrorHandler.h"
- #include "nsGDKErrorHandler.h"
- #include "base/at_exit.h"
- #include "base/command_line.h"
- #include "base/message_loop.h"
- #include "base/process_util.h"
- #include "chrome/common/child_process.h"
- 
-+#include "mozilla/FilePreferences.h"
- #include "mozilla/ipc/BrowserProcessSubThread.h"
- #include "mozilla/ipc/GeckoChildProcessHost.h"
- #include "mozilla/ipc/IOThreadChild.h"
- #include "mozilla/ipc/ProcessChild.h"
- #include "ScopedXREEmbed.h"
- 
- #include "mozilla/plugins/PluginProcessChild.h"
- #include "mozilla/dom/ContentProcess.h"
-@@ -680,16 +681,18 @@ XRE_InitChildProcess(int aArgc,
-       ::SetProcessShutdownParameters(0x280 - 1, SHUTDOWN_NORETRY);
- #endif
- 
- #if defined(MOZ_SANDBOX) && defined(XP_WIN)
-       // We need to do this after the process has been initialised, as
-       // InitLoggingIfRequired may need access to prefs.
-       mozilla::sandboxing::InitLoggingIfRequired(aChildData->ProvideLogFunction);
- #endif
-+      mozilla::FilePreferences::InitDirectoriesWhitelist();
-+      mozilla::FilePreferences::InitPrefs();
- 
-       OverrideDefaultLocaleIfNeeded();
- 
- #if defined(MOZ_CRASHREPORTER)
- #if defined(MOZ_CONTENT_SANDBOX) && !defined(MOZ_WIDGET_GONK)
-       AddContentSandboxLevelAnnotation();
- #endif
- #endif
-diff --git a/xpcom/io/FilePreferences.cpp b/xpcom/io/FilePreferences.cpp
-new file mode 100644
---- /dev/null
-+++ b/xpcom/io/FilePreferences.cpp
-@@ -0,0 +1,271 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+* License, v. 2.0. If a copy of the MPL was not distributed with this
-+* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#include "FilePreferences.h"
-+
-+#include "mozilla/Preferences.h"
-+#include "nsAppDirectoryServiceDefs.h"
-+#include "nsDirectoryServiceDefs.h"
-+#include "nsDirectoryServiceUtils.h"
-+
-+namespace mozilla {
-+namespace FilePreferences {
-+
-+static bool sBlockUNCPaths = false;
-+typedef nsTArray<nsString> Paths;
-+
-+static Paths& PathArray()
-+{
-+  static Paths sPaths;
-+  return sPaths;
-+}
-+
-+static void AllowDirectory(char const* directory)
-+{
-+  nsCOMPtr<nsIFile> file;
-+  NS_GetSpecialDirectory(directory, getter_AddRefs(file));
-+  if (!file) {
-+    return;
-+  }
-+
-+  nsString path;
-+  if (NS_FAILED(file->GetTarget(path))) {
-+    return;
-+  }
-+
-+  // The whitelist makes sense only for UNC paths, because this code is used
-+  // to block only UNC paths, hence, no need to add non-UNC directories here
-+  // as those would never pass the check.
-+  if (!StringBeginsWith(path, NS_LITERAL_STRING("\\\\"))) {
-+    return;
-+  }
-+
-+  if (!PathArray().Contains(path)) {
-+    PathArray().AppendElement(path);
-+  }
-+}
-+
-+void InitPrefs()
-+{
-+  sBlockUNCPaths = Preferences::GetBool("network.file.disable_unc_paths", false);
-+}
-+
-+void InitDirectoriesWhitelist()
-+{
-+  // NS_GRE_DIR is the installation path where the binary resides.
-+  AllowDirectory(NS_GRE_DIR);
-+  // NS_APP_USER_PROFILE_50_DIR and NS_APP_USER_PROFILE_LOCAL_50_DIR are the two
-+  // parts of the profile we store permanent and local-specific data.
-+  AllowDirectory(NS_APP_USER_PROFILE_50_DIR);
-+  AllowDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR);
-+}
-+
-+namespace { // anon
-+
-+class Normalizer
-+{
-+public:
-+  Normalizer(const nsAString& aFilePath, const char16_t aSeparator);
-+  bool Get(nsAString& aNormalizedFilePath);
-+
-+private:
-+  bool ConsumeItem();
-+  bool ConsumeSeparator();
-+  bool IsEOF() { return mFilePathCursor == mFilePathEnd; }
-+
-+  bool ConsumeName();
-+  bool CheckParentDir();
-+  bool CheckCurrentDir();
-+
-+  nsString::const_char_iterator mFilePathCursor;
-+  nsString::const_char_iterator mFilePathEnd;
-+
-+  nsDependentSubstring mItem;
-+  char16_t const mSeparator;
-+  nsTArray<nsDependentSubstring> mStack;
-+};
-+
-+Normalizer::Normalizer(const nsAString& aFilePath, const char16_t aSeparator)
-+  : mFilePathCursor(aFilePath.BeginReading())
-+  , mFilePathEnd(aFilePath.EndReading())
-+  , mSeparator(aSeparator)
-+{
-+}
-+
-+bool Normalizer::ConsumeItem()
-+{
-+  if (IsEOF()) {
-+    return false;
-+  }
-+
-+  nsString::const_char_iterator nameBegin = mFilePathCursor;
-+  while (mFilePathCursor != mFilePathEnd) {
-+    if (*mFilePathCursor == mSeparator) {
-+      break; // don't include the separator
-+    }
-+    ++mFilePathCursor;
-+  }
-+
-+  mItem.Rebind(nameBegin, mFilePathCursor);
-+  return true;
-+}
-+
-+bool Normalizer::ConsumeSeparator()
-+{
-+  if (IsEOF()) {
-+    return false;
-+  }
-+
-+  if (*mFilePathCursor != mSeparator) {
-+    return false;
-+  }
-+
-+  ++mFilePathCursor;
-+  return true;
-+}
-+
-+bool Normalizer::Get(nsAString& aNormalizedFilePath)
-+{
-+  aNormalizedFilePath.Truncate();
-+
-+  if (IsEOF()) {
-+    return true;
-+  }
-+  if (ConsumeSeparator()) {
-+    aNormalizedFilePath.Append(mSeparator);
-+  }
-+
-+  if (IsEOF()) {
-+    return true;
-+  }
-+  if (ConsumeSeparator()) {
-+    aNormalizedFilePath.Append(mSeparator);
-+  }
-+
-+  while (!IsEOF()) {
-+    if (!ConsumeName()) {
-+      return false;
-+    }
-+  }
-+
-+  for (auto const& name : mStack) {
-+    aNormalizedFilePath.Append(name);
-+  }
-+
-+  return true;
-+}
-+
-+bool Normalizer::ConsumeName()
-+{
-+  if (!ConsumeItem()) {
-+    return true;
-+  }
-+
-+  if (CheckCurrentDir()) {
-+    return true;
-+  }
-+
-+  if (CheckParentDir()) {
-+    if (!mStack.Length()) {
-+      // This means there are more \.. than valid names
-+      return false;
-+    }
-+
-+    mStack.RemoveElementAt(mStack.Length() - 1);
-+    return true;
-+  }
-+
-+  if (mItem.IsEmpty()) {
-+    // this means an empty name (a lone slash), which is illegal
-+    return false;
-+  }
-+
-+  if (ConsumeSeparator()) {
-+    mItem.Rebind(mItem.BeginReading(), mFilePathCursor);
-+  }
-+  mStack.AppendElement(mItem);
-+
-+  return true;
-+}
-+
-+bool Normalizer::CheckCurrentDir()
-+{
-+  if (mItem == NS_LITERAL_STRING(".")) {
-+    ConsumeSeparator();
-+    // EOF is acceptable
-+    return true;
-+  }
-+
-+  return false;
-+}
-+
-+bool Normalizer::CheckParentDir()
-+{
-+  if (mItem == NS_LITERAL_STRING("..")) {
-+    ConsumeSeparator();
-+    // EOF is acceptable
-+    return true;
-+  }
-+
-+  return false;
-+}
-+
-+} // anon
-+
-+bool IsBlockedUNCPath(const nsAString& aFilePath)
-+{
-+  if (!sBlockUNCPaths) {
-+    return false;
-+  }
-+
-+  if (!StringBeginsWith(aFilePath, NS_LITERAL_STRING("\\\\"))) {
-+    return false;
-+  }
-+
-+  nsAutoString normalized;
-+  if (!Normalizer(aFilePath, L'\\').Get(normalized)) {
-+    // Broken paths are considered invalid and thus inaccessible
-+    return true;
-+  }
-+
-+  for (const auto& allowedPrefix : PathArray()) {
-+    if (StringBeginsWith(normalized, allowedPrefix)) {
-+      if (normalized.Length() == allowedPrefix.Length()) {
-+        return false;
-+      }
-+      if (normalized[allowedPrefix.Length()] == L'\\') {
-+        return false;
-+      }
-+
-+      // When we are here, the path has a form "\\path\prefixevil"
-+      // while we have an allowed prefix of "\\path\prefix".
-+      // Note that we don't want to add a slash to the end of a prefix
-+      // so that opening the directory (no slash at the end) still works.
-+      break;
-+    }
-+  }
-+
-+  return true;
-+}
-+
-+void testing::SetBlockUNCPaths(bool aBlock)
-+{
-+  sBlockUNCPaths = aBlock;
-+}
-+
-+void testing::AddDirectoryToWhitelist(nsAString const & aPath)
-+{
-+  PathArray().AppendElement(aPath);
-+}
-+
-+bool testing::NormalizePath(nsAString const & aPath, nsAString & aNormalized)
-+{
-+  Normalizer normalizer(aPath, L'\\');
-+  return normalizer.Get(aNormalized);
-+}
-+
-+} // ::FilePreferences
-+} // ::mozilla
-diff --git a/xpcom/io/FilePreferences.h b/xpcom/io/FilePreferences.h
-new file mode 100644
---- /dev/null
-+++ b/xpcom/io/FilePreferences.h
-@@ -0,0 +1,25 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-+/* This Source Code Form is subject to the terms of the Mozilla Public
-+* License, v. 2.0. If a copy of the MPL was not distributed with this
-+* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#include "nsIObserver.h"
-+
-+namespace mozilla {
-+namespace FilePreferences {
-+
-+void InitPrefs();
-+void InitDirectoriesWhitelist();
-+bool IsBlockedUNCPath(const nsAString& aFilePath);
-+
-+namespace testing {
-+
-+void SetBlockUNCPaths(bool aBlock);
-+void AddDirectoryToWhitelist(nsAString const& aPath);
-+bool NormalizePath(nsAString const & aPath, nsAString & aNormalized);
-+
-+}
-+
-+} // FilePreferences
-+} // mozilla
-diff --git a/xpcom/io/moz.build b/xpcom/io/moz.build
---- a/xpcom/io/moz.build
-+++ b/xpcom/io/moz.build
-@@ -79,24 +79,26 @@ EXPORTS += [
-     'nsUnicharInputStream.h',
-     'nsWildCard.h',
-     'SlicedInputStream.h',
-     'SpecialSystemDirectory.h',
- ]
- 
- EXPORTS.mozilla += [
-     'Base64.h',
-+    'FilePreferences.h',
-     'SnappyCompressOutputStream.h',
-     'SnappyFrameUtils.h',
-     'SnappyUncompressInputStream.h',
- ]
- 
- UNIFIED_SOURCES += [
-     'Base64.cpp',
-     'crc32c.c',
-+    'FilePreferences.cpp',
-     'nsAnonymousTemporaryFile.cpp',
-     'nsAppFileLocationProvider.cpp',
-     'nsBinaryStream.cpp',
-     'nsDirectoryService.cpp',
-     'nsEscape.cpp',
-     'nsInputStreamTee.cpp',
-     'nsIOUtil.cpp',
-     'nsLinebreakConverter.cpp',
-diff --git a/xpcom/io/nsLocalFileWin.cpp b/xpcom/io/nsLocalFileWin.cpp
---- a/xpcom/io/nsLocalFileWin.cpp
-+++ b/xpcom/io/nsLocalFileWin.cpp
-@@ -41,16 +41,17 @@
- #include  <stdio.h>
- #include  <stdlib.h>
- #include  <mbstring.h>
- 
- #include "nsXPIDLString.h"
- #include "prproces.h"
- #include "prlink.h"
- 
-+#include "mozilla/FilePreferences.h"
- #include "mozilla/Mutex.h"
- #include "SpecialSystemDirectory.h"
- 
- #include "nsTraceRefcnt.h"
- #include "nsXPCOMCIDInternal.h"
- #include "nsThreadUtils.h"
- #include "nsXULAppAPI.h"
- 
-@@ -1162,16 +1163,20 @@ nsLocalFile::InitWithPath(const nsAStrin
-   char16_t secondChar = *(++begin);
- 
-   // just do a sanity check.  if it has any forward slashes, it is not a Native path
-   // on windows.  Also, it must have a colon at after the first char.
-   if (FindCharInReadable(L'/', begin, end)) {
-     return NS_ERROR_FILE_UNRECOGNIZED_PATH;
-   }
- 
-+  if (FilePreferences::IsBlockedUNCPath(aFilePath)) {
-+    return NS_ERROR_FILE_ACCESS_DENIED;
-+  }
-+
-   if (secondChar != L':' && (secondChar != L'\\' || firstChar != L'\\')) {
-     return NS_ERROR_FILE_UNRECOGNIZED_PATH;
-   }
- 
-   if (secondChar == L':') {
-     // Make sure we have a valid drive, later code assumes the drive letter
-     // is a single char a-z or A-Z.
-     if (PathGetDriveNumberW(aFilePath.Data()) == -1) {
-@@ -1974,16 +1979,20 @@ nsLocalFile::CopySingleFile(nsIFile* aSo
-     bool path1Remote, path2Remote;
-     if (!IsRemoteFilePath(filePath.get(), path1Remote) ||
-         !IsRemoteFilePath(destPath.get(), path2Remote) ||
-         path1Remote || path2Remote) {
-       dwCopyFlags |= COPY_FILE_NO_BUFFERING;
-     }
-   }
- 
-+  if (FilePreferences::IsBlockedUNCPath(destPath)) {
-+    return NS_ERROR_FILE_ACCESS_DENIED;
-+  }
-+
-   if (!move) {
-     copyOK = ::CopyFileExW(filePath.get(), destPath.get(), nullptr,
-                            nullptr, nullptr, dwCopyFlags);
-   } else {
-     copyOK = ::MoveFileExW(filePath.get(), destPath.get(),
-                            MOVEFILE_REPLACE_EXISTING);
- 
-     // Check if copying the source file to a different volume,
-diff --git a/xpcom/tests/gtest/TestFilePreferencesWin.cpp b/xpcom/tests/gtest/TestFilePreferencesWin.cpp
-new file mode 100644
---- /dev/null
-+++ b/xpcom/tests/gtest/TestFilePreferencesWin.cpp
-@@ -0,0 +1,141 @@
-+#include "gtest/gtest.h"
-+
-+#include "mozilla/FilePreferences.h"
-+#include "nsIFile.h"
-+#include "nsXPCOMCID.h"
-+
-+TEST(FilePreferencesWin, Normalization)
-+{
-+  nsAutoString normalized;
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("foo"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("foo"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\foo"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\foo"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("foo\\some"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("foo\\some"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.\\foo"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\."), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.\\."), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\."), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\.\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\..\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\.."), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\..\\bar\\..\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\..\\bar"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\bar"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\..\\..\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\.\\..\\.\\..\\"), normalized);
-+  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
-+
-+  bool result;
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.."), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\..\\"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.\\..\\"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\\\bar"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\foo\\bar\\..\\..\\..\\..\\"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\\\"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\.\\\\"), normalized);
-+  ASSERT_FALSE(result);
-+
-+  result = mozilla::FilePreferences::testing::NormalizePath(
-+    NS_LITERAL_STRING("\\\\..\\\\"), normalized);
-+  ASSERT_FALSE(result);
-+}
-+
-+TEST(FilePreferencesWin, AccessUNC)
-+{
-+  nsCOMPtr<nsIFile> lf = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
-+
-+  nsresult rv;
-+
-+  mozilla::FilePreferences::testing::SetBlockUNCPaths(false);
-+
-+  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
-+  ASSERT_EQ(rv, NS_OK);
-+
-+  mozilla::FilePreferences::testing::SetBlockUNCPaths(true);
-+
-+  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
-+  ASSERT_EQ(rv, NS_ERROR_FILE_ACCESS_DENIED);
-+
-+  mozilla::FilePreferences::testing::AddDirectoryToWhitelist(NS_LITERAL_STRING("\\\\nice"));
-+
-+  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\share"));
-+  ASSERT_EQ(rv, NS_OK);
-+
-+  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
-+  ASSERT_EQ(rv, NS_ERROR_FILE_ACCESS_DENIED);
-+}
-diff --git a/xpcom/tests/gtest/moz.build b/xpcom/tests/gtest/moz.build
---- a/xpcom/tests/gtest/moz.build
-+++ b/xpcom/tests/gtest/moz.build
-@@ -51,16 +51,21 @@ UNIFIED_SOURCES += [
- if CONFIG['MOZ_DEBUG'] and CONFIG['OS_ARCH'] not in ('WINNT') and CONFIG['OS_TARGET'] != 'Android':
-     # FIXME bug 523392: TestDeadlockDetector doesn't like Windows
-     # Bug 1054249: Doesn't work on Android
-     UNIFIED_SOURCES += [
-         'TestDeadlockDetector.cpp',
-         'TestDeadlockDetectorScalability.cpp',
-     ]
- 
-+if CONFIG['OS_TARGET'] == 'WINNT':
-+    UNIFIED_SOURCES += [
-+        'TestFilePreferencesWin.cpp',
-+    ]
-+
- if CONFIG['WRAP_STL_INCLUDES'] and not CONFIG['CLANG_CL']:
-     UNIFIED_SOURCES += [
-         'TestSTLWrappers.cpp',
-     ]
- 
- # Compile TestAllocReplacement separately so Windows headers don't pollute
- # the global namespace for other files.
- SOURCES += [
-
diff --git a/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch b/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch
new file mode 100644
index 0000000000..04f2a953b7
--- /dev/null
+++ b/gnu/packages/patches/libvpx-use-after-free-in-postproc.patch
@@ -0,0 +1,34 @@
+From 52add5896661d186dec284ed646a4b33b607d2c7 Mon Sep 17 00:00:00 2001
+From: Jerome Jiang <jianj@google.com>
+Date: Wed, 23 May 2018 15:43:00 -0700
+Subject: [PATCH] VP8: Fix use-after-free in postproc.
+
+The pointer in vp8 postproc refers to show_frame_mi which is only
+updated on show frame. However, when there is a no-show frame which also
+changes the size (thus new frame buffers allocated), show_frame_mi is
+not updated with new frame buffer memory.
+
+Change the pointer in postproc to mi which is always updated.
+
+Bug: 842265
+Change-Id: I33874f2112b39f74562cba528432b5f239e6a7bd
+---
+ vp8/common/postproc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/vp8/common/postproc.c b/vp8/common/postproc.c
+index d67ee8a57..8c292d616 100644
+--- a/vp8/common/postproc.c
++++ b/vp8/common/postproc.c
+@@ -65,7 +65,7 @@ void vp8_deblock(VP8_COMMON *cm, YV12_BUFFER_CONFIG *source,
+   double level = 6.0e-05 * q * q * q - .0067 * q * q + .306 * q + .0065;
+   int ppl = (int)(level + .5);
+ 
+-  const MODE_INFO *mode_info_context = cm->show_frame_mi;
++  const MODE_INFO *mode_info_context = cm->mi;
+   int mbr, mbc;
+ 
+   /* The pixel thresholds are adjusted according to if or not the macroblock
+-- 
+2.19.0
+
diff --git a/gnu/packages/patches/rsem-makefile.patch b/gnu/packages/patches/rsem-makefile.patch
deleted file mode 100644
index 5481dc685f..0000000000
--- a/gnu/packages/patches/rsem-makefile.patch
+++ /dev/null
@@ -1,682 +0,0 @@
-This patch simplifies the Makefile, making it much easier to build rsem
-without the bundled version of samtools.  It has already been submitted
-upstream: https://github.com/bli25wisc/RSEM/pull/11
-
-From 161894e91a16c7e15af57e4fcfe8cb613711c7fa Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 14:51:07 +0200
-Subject: [PATCH 1/7] remove all headers from Makefile
-
----
- Makefile | 95 +++++++++++-----------------------------------------------------
- 1 file changed, 16 insertions(+), 79 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 54e2603..3a55ed8 100644
---- a/Makefile
-+++ b/Makefile
-@@ -10,133 +10,70 @@ all : $(PROGRAMS)
- sam/libbam.a :
- 	cd sam ; ${MAKE} all
- 
--Transcript.h : utils.h
--
--Transcripts.h : utils.h my_assert.h Transcript.h
--
--rsem-extract-reference-transcripts : utils.h my_assert.h GTFItem.h Transcript.h Transcripts.h extractRef.cpp
-+rsem-extract-reference-transcripts : extractRef.cpp
- 	$(CC) -Wall -O3 extractRef.cpp -o rsem-extract-reference-transcripts
- 
--rsem-synthesis-reference-transcripts : utils.h my_assert.h Transcript.h Transcripts.h synthesisRef.cpp
-+rsem-synthesis-reference-transcripts : synthesisRef.cpp
- 	$(CC) -Wall -O3 synthesisRef.cpp -o rsem-synthesis-reference-transcripts
- 
--BowtieRefSeqPolicy.h : RefSeqPolicy.h
--
--RefSeq.h : utils.h
--
--Refs.h : utils.h RefSeq.h RefSeqPolicy.h PolyARules.h
--
--
- rsem-preref : preRef.o
- 	$(CC) preRef.o -o rsem-preref
- 
--preRef.o : utils.h RefSeq.h Refs.h PolyARules.h RefSeqPolicy.h AlignerRefSeqPolicy.h preRef.cpp
-+preRef.o : preRef.cpp
- 	$(CC) $(COFLAGS) preRef.cpp
- 
--
--SingleRead.h : Read.h
--
--SingleReadQ.h : Read.h
--
--PairedEndRead.h : Read.h SingleRead.h
--
--PairedEndReadQ.h : Read.h SingleReadQ.h
--
--
--PairedEndHit.h : SingleHit.h
--
--HitContainer.h : GroupInfo.h
--
--
--SamParser.h : sam/sam.h sam/bam.h utils.h my_assert.h SingleRead.h SingleReadQ.h PairedEndRead.h PairedEndReadQ.h SingleHit.h PairedEndHit.h Transcripts.h
--
--
- rsem-parse-alignments : parseIt.o sam/libbam.a
- 	$(CC) -o rsem-parse-alignments parseIt.o sam/libbam.a -lz -lpthread 
- 
--parseIt.o : utils.h GroupInfo.h Read.h SingleRead.h SingleReadQ.h PairedEndRead.h PairedEndReadQ.h SingleHit.h PairedEndHit.h HitContainer.h SamParser.h Transcripts.h sam/sam.h sam/bam.h parseIt.cpp
-+parseIt.o : parseIt.cpp
- 	$(CC) -Wall -O2 -c -I. parseIt.cpp
- 
--
--rsem-build-read-index : utils.h buildReadIndex.cpp
-+rsem-build-read-index : buildReadIndex.cpp
- 	$(CC) -O3 buildReadIndex.cpp -o rsem-build-read-index
- 
--
--simul.h : boost/random.hpp
--
--ReadReader.h : SingleRead.h SingleReadQ.h PairedEndRead.h PairedEndReadQ.h ReadIndex.h
--
--SingleModel.h : utils.h my_assert.h Orientation.h LenDist.h RSPD.h Profile.h NoiseProfile.h ModelParams.h RefSeq.h Refs.h SingleRead.h SingleHit.h ReadReader.h simul.h
--
--SingleQModel.h : utils.h my_assert.h Orientation.h LenDist.h RSPD.h QualDist.h QProfile.h NoiseQProfile.h ModelParams.h RefSeq.h Refs.h SingleReadQ.h SingleHit.h ReadReader.h simul.h
--
--PairedEndModel.h : utils.h my_assert.h Orientation.h LenDist.h RSPD.h Profile.h NoiseProfile.h ModelParams.h RefSeq.h Refs.h SingleRead.h PairedEndRead.h PairedEndHit.h ReadReader.h simul.h 
--
--PairedEndQModel.h : utils.h my_assert.h Orientation.h LenDist.h RSPD.h QualDist.h QProfile.h NoiseQProfile.h ModelParams.h RefSeq.h Refs.h SingleReadQ.h PairedEndReadQ.h PairedEndHit.h ReadReader.h simul.h
--
--HitWrapper.h : HitContainer.h
--
--sam_rsem_aux.h : sam/bam.h
--
--sam_rsem_cvt.h : sam/bam.h Transcript.h Transcripts.h
--
--BamWriter.h : sam/sam.h sam/bam.h sam_rsem_aux.h sam_rsem_cvt.h SingleHit.h PairedEndHit.h HitWrapper.h Transcript.h Transcripts.h
--
--sampling.h : boost/random.hpp
--
--WriteResults.h : utils.h my_assert.h GroupInfo.h Transcript.h Transcripts.h RefSeq.h Refs.h Model.h SingleModel.h SingleQModel.h PairedEndModel.h PairedEndQModel.h
--
- rsem-run-em : EM.o sam/libbam.a
- 	$(CC) -o rsem-run-em EM.o sam/libbam.a -lz -lpthread
- 
--EM.o : utils.h my_assert.h Read.h SingleRead.h SingleReadQ.h PairedEndRead.h PairedEndReadQ.h SingleHit.h PairedEndHit.h Model.h SingleModel.h SingleQModel.h PairedEndModel.h PairedEndQModel.h Refs.h GroupInfo.h HitContainer.h ReadIndex.h ReadReader.h Orientation.h LenDist.h RSPD.h QualDist.h QProfile.h NoiseQProfile.h ModelParams.h RefSeq.h RefSeqPolicy.h PolyARules.h Profile.h NoiseProfile.h Transcript.h Transcripts.h HitWrapper.h BamWriter.h sam/bam.h sam/sam.h simul.h sam_rsem_aux.h sampling.h boost/random.hpp WriteResults.h EM.cpp
-+EM.o : EM.cpp
- 	$(CC) $(COFLAGS) EM.cpp
- 
--bc_aux.h : sam/bam.h
--
--BamConverter.h : utils.h my_assert.h sam/sam.h sam/bam.h sam_rsem_aux.h sam_rsem_cvt.h bc_aux.h Transcript.h Transcripts.h
--
--rsem-tbam2gbam : utils.h Transcripts.h Transcript.h bc_aux.h BamConverter.h sam/sam.h sam/bam.h sam/libbam.a sam_rsem_aux.h sam_rsem_cvt.h tbam2gbam.cpp sam/libbam.a
-+rsem-tbam2gbam : tbam2gbam.cpp sam/libbam.a
- 	$(CC) -O3 -Wall tbam2gbam.cpp sam/libbam.a -lz -lpthread -o $@
- 
--rsem-bam2wig : utils.h my_assert.h wiggle.h wiggle.o sam/libbam.a bam2wig.cpp
-+rsem-bam2wig : wiggle.o sam/libbam.a bam2wig.cpp
- 	$(CC) -O3 -Wall bam2wig.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
- 
--rsem-bam2readdepth : utils.h my_assert.h wiggle.h wiggle.o sam/libbam.a bam2readdepth.cpp
-+rsem-bam2readdepth : wiggle.o sam/libbam.a bam2readdepth.cpp
- 	$(CC) -O3 -Wall bam2readdepth.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
- 
--wiggle.o: sam/bam.h sam/sam.h wiggle.cpp wiggle.h
-+wiggle.o: wiggle.cpp
- 	$(CC) $(COFLAGS) wiggle.cpp
- 
- rsem-simulate-reads : simulation.o
- 	$(CC) -o rsem-simulate-reads simulation.o
- 
--simulation.o : utils.h Read.h SingleRead.h SingleReadQ.h PairedEndRead.h PairedEndReadQ.h Model.h SingleModel.h SingleQModel.h PairedEndModel.h PairedEndQModel.h Refs.h RefSeq.h GroupInfo.h Transcript.h Transcripts.h Orientation.h LenDist.h RSPD.h QualDist.h QProfile.h NoiseQProfile.h Profile.h NoiseProfile.h simul.h boost/random.hpp WriteResults.h simulation.cpp
-+simulation.o : simulation.cpp
- 	$(CC) $(COFLAGS) simulation.cpp
- 
- rsem-run-gibbs : Gibbs.o
- 	$(CC) -o rsem-run-gibbs Gibbs.o -lpthread
- 
--#some header files are omitted
--Gibbs.o : utils.h my_assert.h boost/random.hpp sampling.h Model.h SingleModel.h SingleQModel.h PairedEndModel.h PairedEndQModel.h RefSeq.h RefSeqPolicy.h PolyARules.h Refs.h GroupInfo.h WriteResults.h Gibbs.cpp 
-+Gibbs.o : Gibbs.cpp
- 	$(CC) $(COFLAGS) Gibbs.cpp
- 
--Buffer.h : my_assert.h
--
- rsem-calculate-credibility-intervals : calcCI.o
- 	$(CC) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
- 
--#some header files are omitted
--calcCI.o : utils.h my_assert.h boost/random.hpp sampling.h Model.h SingleModel.h SingleQModel.h PairedEndModel.h PairedEndQModel.h RefSeq.h RefSeqPolicy.h PolyARules.h Refs.h GroupInfo.h WriteResults.h Buffer.h calcCI.cpp
-+calcCI.o : calcCI.cpp
- 	$(CC) $(COFLAGS) calcCI.cpp
- 
--rsem-get-unique : sam/bam.h sam/sam.h getUnique.cpp sam/libbam.a
-+rsem-get-unique : getUnique.cpp sam/libbam.a
- 	$(CC) -O3 -Wall getUnique.cpp sam/libbam.a -lz -lpthread -o $@
- 
--rsem-sam-validator : sam/bam.h sam/sam.h my_assert.h samValidator.cpp sam/libbam.a
-+rsem-sam-validator : samValidator.cpp sam/libbam.a
- 	$(CC) -O3 -Wall samValidator.cpp sam/libbam.a -lz -lpthread -o $@
- 
--rsem-scan-for-paired-end-reads : sam/bam.h sam/sam.h my_assert.h scanForPairedEndReads.cpp sam/libbam.a
-+rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp sam/libbam.a
- 	$(CC) -O3 -Wall scanForPairedEndReads.cpp sam/libbam.a -lz -lpthread -o $@
- 
- ebseq :
-
-From ec136638a727632e20abfaeb65c22c46d15ca8c4 Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:06:41 +0200
-Subject: [PATCH 2/7] include current dir, ./sam and ./boost by default
-
----
- Makefile | 48 ++++++++++++++++++++++++------------------------
- 1 file changed, 24 insertions(+), 24 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 3a55ed8..1dd97ca 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- CC = g++
--CFLAGS = -Wall -c -I.
--COFLAGS = -Wall -O3 -ffast-math -c -I.
-+CFLAGS = -Wall -I. -I./sam -I./boost
-+COFLAGS = -O3 -ffast-math -c
- PROGRAMS = rsem-extract-reference-transcripts rsem-synthesis-reference-transcripts rsem-preref rsem-parse-alignments rsem-build-read-index rsem-run-em rsem-tbam2gbam rsem-run-gibbs rsem-calculate-credibility-intervals rsem-simulate-reads rsem-bam2wig rsem-get-unique rsem-bam2readdepth rsem-sam-validator rsem-scan-for-paired-end-reads
- 
- .PHONY : all ebseq clean
-@@ -11,70 +11,70 @@ sam/libbam.a :
- 	cd sam ; ${MAKE} all
- 
- rsem-extract-reference-transcripts : extractRef.cpp
--	$(CC) -Wall -O3 extractRef.cpp -o rsem-extract-reference-transcripts
-+	$(CC) $(CFLAGS) -O3 extractRef.cpp -o rsem-extract-reference-transcripts
- 
- rsem-synthesis-reference-transcripts : synthesisRef.cpp
--	$(CC) -Wall -O3 synthesisRef.cpp -o rsem-synthesis-reference-transcripts
-+	$(CC) $(CFLAGS) -O3 synthesisRef.cpp -o rsem-synthesis-reference-transcripts
- 
- rsem-preref : preRef.o
--	$(CC) preRef.o -o rsem-preref
-+	$(CC) $(CFLAGS) preRef.o -o rsem-preref
- 
- preRef.o : preRef.cpp
--	$(CC) $(COFLAGS) preRef.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) preRef.cpp
- 
- rsem-parse-alignments : parseIt.o sam/libbam.a
--	$(CC) -o rsem-parse-alignments parseIt.o sam/libbam.a -lz -lpthread 
-+	$(CC) $(CFLAGS) -o rsem-parse-alignments parseIt.o sam/libbam.a -lz -lpthread
- 
- parseIt.o : parseIt.cpp
--	$(CC) -Wall -O2 -c -I. parseIt.cpp
-+	$(CC) $(CFLAGS) -O2 -c parseIt.cpp
- 
- rsem-build-read-index : buildReadIndex.cpp
--	$(CC) -O3 buildReadIndex.cpp -o rsem-build-read-index
-+	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o rsem-build-read-index
- 
- rsem-run-em : EM.o sam/libbam.a
--	$(CC) -o rsem-run-em EM.o sam/libbam.a -lz -lpthread
-+	$(CC) $(CFLAGS) -o rsem-run-em EM.o sam/libbam.a -lz -lpthread
- 
- EM.o : EM.cpp
--	$(CC) $(COFLAGS) EM.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) EM.cpp
- 
- rsem-tbam2gbam : tbam2gbam.cpp sam/libbam.a
--	$(CC) -O3 -Wall tbam2gbam.cpp sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp sam/libbam.a -lz -lpthread -o $@
- 
- rsem-bam2wig : wiggle.o sam/libbam.a bam2wig.cpp
--	$(CC) -O3 -Wall bam2wig.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 bam2wig.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
- 
- rsem-bam2readdepth : wiggle.o sam/libbam.a bam2readdepth.cpp
--	$(CC) -O3 -Wall bam2readdepth.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
- 
- wiggle.o: wiggle.cpp
--	$(CC) $(COFLAGS) wiggle.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) wiggle.cpp
- 
- rsem-simulate-reads : simulation.o
--	$(CC) -o rsem-simulate-reads simulation.o
-+	$(CC) $(CFLAGS) -o rsem-simulate-reads simulation.o
- 
- simulation.o : simulation.cpp
--	$(CC) $(COFLAGS) simulation.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) simulation.cpp
- 
- rsem-run-gibbs : Gibbs.o
--	$(CC) -o rsem-run-gibbs Gibbs.o -lpthread
-+	$(CC) $(CFLAGS) -o rsem-run-gibbs Gibbs.o -lpthread
- 
- Gibbs.o : Gibbs.cpp
--	$(CC) $(COFLAGS) Gibbs.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) Gibbs.cpp
- 
- rsem-calculate-credibility-intervals : calcCI.o
--	$(CC) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
-+	$(CC) $(CFLAGS) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
- 
- calcCI.o : calcCI.cpp
--	$(CC) $(COFLAGS) calcCI.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) calcCI.cpp
- 
- rsem-get-unique : getUnique.cpp sam/libbam.a
--	$(CC) -O3 -Wall getUnique.cpp sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 getUnique.cpp sam/libbam.a -lz -lpthread -o $@
- 
- rsem-sam-validator : samValidator.cpp sam/libbam.a
--	$(CC) -O3 -Wall samValidator.cpp sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 samValidator.cpp sam/libbam.a -lz -lpthread -o $@
- 
- rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp sam/libbam.a
--	$(CC) -O3 -Wall scanForPairedEndReads.cpp sam/libbam.a -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 scanForPairedEndReads.cpp sam/libbam.a -lz -lpthread -o $@
- 
- ebseq :
- 	cd EBSeq ; ${MAKE} all
-
-From d366614ea50f79fdd93e3c76383ccb6fcdeaa8e0 Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:10:49 +0200
-Subject: [PATCH 3/7] separate object rules from rules for executables
-
----
- Makefile | 50 ++++++++++++++++++++++++++------------------------
- 1 file changed, 26 insertions(+), 24 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 1dd97ca..ae4de3b 100644
---- a/Makefile
-+++ b/Makefile
-@@ -10,6 +10,32 @@ all : $(PROGRAMS)
- sam/libbam.a :
- 	cd sam ; ${MAKE} all
- 
-+ebseq :
-+	cd EBSeq ; ${MAKE} all
-+
-+
-+calcCI.o : calcCI.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) calcCI.cpp
-+
-+EM.o : EM.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) EM.cpp
-+
-+Gibbs.o : Gibbs.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) Gibbs.cpp
-+
-+preRef.o : preRef.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) preRef.cpp
-+
-+parseIt.o : parseIt.cpp
-+	$(CC) $(CFLAGS) -O2 -c parseIt.cpp
-+
-+simulation.o : simulation.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) simulation.cpp
-+
-+wiggle.o: wiggle.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) wiggle.cpp
-+
-+
- rsem-extract-reference-transcripts : extractRef.cpp
- 	$(CC) $(CFLAGS) -O3 extractRef.cpp -o rsem-extract-reference-transcripts
- 
-@@ -19,24 +45,15 @@ rsem-synthesis-reference-transcripts : synthesisRef.cpp
- rsem-preref : preRef.o
- 	$(CC) $(CFLAGS) preRef.o -o rsem-preref
- 
--preRef.o : preRef.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) preRef.cpp
--
- rsem-parse-alignments : parseIt.o sam/libbam.a
- 	$(CC) $(CFLAGS) -o rsem-parse-alignments parseIt.o sam/libbam.a -lz -lpthread
- 
--parseIt.o : parseIt.cpp
--	$(CC) $(CFLAGS) -O2 -c parseIt.cpp
--
- rsem-build-read-index : buildReadIndex.cpp
- 	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o rsem-build-read-index
- 
- rsem-run-em : EM.o sam/libbam.a
- 	$(CC) $(CFLAGS) -o rsem-run-em EM.o sam/libbam.a -lz -lpthread
- 
--EM.o : EM.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) EM.cpp
--
- rsem-tbam2gbam : tbam2gbam.cpp sam/libbam.a
- 	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp sam/libbam.a -lz -lpthread -o $@
- 
-@@ -46,27 +63,15 @@ rsem-bam2wig : wiggle.o sam/libbam.a bam2wig.cpp
- rsem-bam2readdepth : wiggle.o sam/libbam.a bam2readdepth.cpp
- 	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
- 
--wiggle.o: wiggle.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) wiggle.cpp
--
- rsem-simulate-reads : simulation.o
- 	$(CC) $(CFLAGS) -o rsem-simulate-reads simulation.o
- 
--simulation.o : simulation.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) simulation.cpp
--
- rsem-run-gibbs : Gibbs.o
- 	$(CC) $(CFLAGS) -o rsem-run-gibbs Gibbs.o -lpthread
- 
--Gibbs.o : Gibbs.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) Gibbs.cpp
--
- rsem-calculate-credibility-intervals : calcCI.o
- 	$(CC) $(CFLAGS) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
- 
--calcCI.o : calcCI.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) calcCI.cpp
--
- rsem-get-unique : getUnique.cpp sam/libbam.a
- 	$(CC) $(CFLAGS) -O3 getUnique.cpp sam/libbam.a -lz -lpthread -o $@
- 
-@@ -76,9 +81,6 @@ rsem-sam-validator : samValidator.cpp sam/libbam.a
- rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp sam/libbam.a
- 	$(CC) $(CFLAGS) -O3 scanForPairedEndReads.cpp sam/libbam.a -lz -lpthread -o $@
- 
--ebseq :
--	cd EBSeq ; ${MAKE} all
--
- clean :
- 	rm -f *.o *~ $(PROGRAMS)
- 	cd sam ; ${MAKE} clean
-
-From 6ba1c33cccdf7c8e7df7a3189e7db204be3b1e8d Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:28:30 +0200
-Subject: [PATCH 4/7] add ./sam to library directories, link with -lbam
-
----
- Makefile | 36 ++++++++++++++++++------------------
- 1 file changed, 18 insertions(+), 18 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index ae4de3b..a87cc4d 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,11 +1,11 @@
- CC = g++
--CFLAGS = -Wall -I. -I./sam -I./boost
-+CFLAGS = -Wall -I. -I./sam -I./boost -L./sam
- COFLAGS = -O3 -ffast-math -c
- PROGRAMS = rsem-extract-reference-transcripts rsem-synthesis-reference-transcripts rsem-preref rsem-parse-alignments rsem-build-read-index rsem-run-em rsem-tbam2gbam rsem-run-gibbs rsem-calculate-credibility-intervals rsem-simulate-reads rsem-bam2wig rsem-get-unique rsem-bam2readdepth rsem-sam-validator rsem-scan-for-paired-end-reads
- 
- .PHONY : all ebseq clean
- 
--all : $(PROGRAMS)
-+all : sam/libbam.a $(PROGRAMS)
- 
- sam/libbam.a :
- 	cd sam ; ${MAKE} all
-@@ -45,23 +45,23 @@ rsem-synthesis-reference-transcripts : synthesisRef.cpp
- rsem-preref : preRef.o
- 	$(CC) $(CFLAGS) preRef.o -o rsem-preref
- 
--rsem-parse-alignments : parseIt.o sam/libbam.a
--	$(CC) $(CFLAGS) -o rsem-parse-alignments parseIt.o sam/libbam.a -lz -lpthread
-+rsem-parse-alignments : parseIt.o
-+	$(CC) $(CFLAGS) -o rsem-parse-alignments parseIt.o -lbam -lz -lpthread
- 
- rsem-build-read-index : buildReadIndex.cpp
- 	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o rsem-build-read-index
- 
--rsem-run-em : EM.o sam/libbam.a
--	$(CC) $(CFLAGS) -o rsem-run-em EM.o sam/libbam.a -lz -lpthread
-+rsem-run-em : EM.o
-+	$(CC) $(CFLAGS) -o rsem-run-em EM.o -lbam -lz -lpthread
- 
--rsem-tbam2gbam : tbam2gbam.cpp sam/libbam.a
--	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp sam/libbam.a -lz -lpthread -o $@
-+rsem-tbam2gbam : tbam2gbam.cpp
-+	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp -lbam -lz -lpthread -o $@
- 
--rsem-bam2wig : wiggle.o sam/libbam.a bam2wig.cpp
--	$(CC) $(CFLAGS) -O3 bam2wig.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
-+rsem-bam2wig : wiggle.o bam2wig.cpp
-+	$(CC) $(CFLAGS) -O3 bam2wig.cpp wiggle.o -lbam -lz -lpthread -o $@
- 
--rsem-bam2readdepth : wiggle.o sam/libbam.a bam2readdepth.cpp
--	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o sam/libbam.a -lz -lpthread -o $@
-+rsem-bam2readdepth : wiggle.o bam2readdepth.cpp
-+	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o -lbam -lz -lpthread -o $@
- 
- rsem-simulate-reads : simulation.o
- 	$(CC) $(CFLAGS) -o rsem-simulate-reads simulation.o
-@@ -72,14 +72,14 @@ rsem-run-gibbs : Gibbs.o
- rsem-calculate-credibility-intervals : calcCI.o
- 	$(CC) $(CFLAGS) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
- 
--rsem-get-unique : getUnique.cpp sam/libbam.a
--	$(CC) $(CFLAGS) -O3 getUnique.cpp sam/libbam.a -lz -lpthread -o $@
-+rsem-get-unique : getUnique.cpp
-+	$(CC) $(CFLAGS) -O3 getUnique.cpp -lbam -lz -lpthread -o $@
- 
--rsem-sam-validator : samValidator.cpp sam/libbam.a
--	$(CC) $(CFLAGS) -O3 samValidator.cpp sam/libbam.a -lz -lpthread -o $@
-+rsem-sam-validator : samValidator.cpp
-+	$(CC) $(CFLAGS) -O3 samValidator.cpp -lbam -lz -lpthread -o $@
- 
--rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp sam/libbam.a
--	$(CC) $(CFLAGS) -O3 scanForPairedEndReads.cpp sam/libbam.a -lz -lpthread -o $@
-+rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp
-+	$(CC) $(CFLAGS) -O3 scanForPairedEndReads.cpp -lbam -lz -lpthread -o $@
- 
- clean :
- 	rm -f *.o *~ $(PROGRAMS)
-
-From 5402b88c269df79ee245c1c59e15f3c8282a0220 Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:33:02 +0200
-Subject: [PATCH 5/7] do not repeat target name, use $@ instead
-
----
- Makefile | 18 +++++++++---------
- 1 file changed, 9 insertions(+), 9 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index a87cc4d..7ec90a3 100644
---- a/Makefile
-+++ b/Makefile
-@@ -37,22 +37,22 @@ wiggle.o: wiggle.cpp
- 
- 
- rsem-extract-reference-transcripts : extractRef.cpp
--	$(CC) $(CFLAGS) -O3 extractRef.cpp -o rsem-extract-reference-transcripts
-+	$(CC) $(CFLAGS) -O3 extractRef.cpp -o $@
- 
- rsem-synthesis-reference-transcripts : synthesisRef.cpp
--	$(CC) $(CFLAGS) -O3 synthesisRef.cpp -o rsem-synthesis-reference-transcripts
-+	$(CC) $(CFLAGS) -O3 synthesisRef.cpp -o $@
- 
- rsem-preref : preRef.o
--	$(CC) $(CFLAGS) preRef.o -o rsem-preref
-+	$(CC) $(CFLAGS) preRef.o -o $@
- 
- rsem-parse-alignments : parseIt.o
--	$(CC) $(CFLAGS) -o rsem-parse-alignments parseIt.o -lbam -lz -lpthread
-+	$(CC) $(CFLAGS) -o $@ parseIt.o -lbam -lz -lpthread
- 
- rsem-build-read-index : buildReadIndex.cpp
--	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o rsem-build-read-index
-+	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o $@
- 
- rsem-run-em : EM.o
--	$(CC) $(CFLAGS) -o rsem-run-em EM.o -lbam -lz -lpthread
-+	$(CC) $(CFLAGS) -o $@ EM.o -lbam -lz -lpthread
- 
- rsem-tbam2gbam : tbam2gbam.cpp
- 	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp -lbam -lz -lpthread -o $@
-@@ -64,13 +64,13 @@ rsem-bam2readdepth : wiggle.o bam2readdepth.cpp
- 	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o -lbam -lz -lpthread -o $@
- 
- rsem-simulate-reads : simulation.o
--	$(CC) $(CFLAGS) -o rsem-simulate-reads simulation.o
-+	$(CC) $(CFLAGS) -o $@ simulation.o
- 
- rsem-run-gibbs : Gibbs.o
--	$(CC) $(CFLAGS) -o rsem-run-gibbs Gibbs.o -lpthread
-+	$(CC) $(CFLAGS) -o $@ Gibbs.o -lpthread
- 
- rsem-calculate-credibility-intervals : calcCI.o
--	$(CC) $(CFLAGS) -o rsem-calculate-credibility-intervals calcCI.o -lpthread
-+	$(CC) $(CFLAGS) -o $@ calcCI.o -lpthread
- 
- rsem-get-unique : getUnique.cpp
- 	$(CC) $(CFLAGS) -O3 getUnique.cpp -lbam -lz -lpthread -o $@
-
-From f60784bc7aa303cc825bd87dd3f5d7d26c51bded Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:44:53 +0200
-Subject: [PATCH 6/7] use automatic variables to refer to prerequisites
-
----
- Makefile | 44 ++++++++++++++++++++++----------------------
- 1 file changed, 22 insertions(+), 22 deletions(-)
-
-diff --git a/Makefile b/Makefile
-index 7ec90a3..6540d81 100644
---- a/Makefile
-+++ b/Makefile
-@@ -15,71 +15,71 @@ ebseq :
- 
- 
- calcCI.o : calcCI.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) calcCI.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- EM.o : EM.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) EM.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- Gibbs.o : Gibbs.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) Gibbs.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- preRef.o : preRef.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) preRef.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- parseIt.o : parseIt.cpp
--	$(CC) $(CFLAGS) -O2 -c parseIt.cpp
-+	$(CC) $(CFLAGS) -O2 -c $<
- 
- simulation.o : simulation.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) simulation.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- wiggle.o: wiggle.cpp
--	$(CC) $(CFLAGS) $(COFLAGS) wiggle.cpp
-+	$(CC) $(CFLAGS) $(COFLAGS) $<
- 
- 
- rsem-extract-reference-transcripts : extractRef.cpp
--	$(CC) $(CFLAGS) -O3 extractRef.cpp -o $@
-+	$(CC) $(CFLAGS) -O3 $< -o $@
- 
- rsem-synthesis-reference-transcripts : synthesisRef.cpp
--	$(CC) $(CFLAGS) -O3 synthesisRef.cpp -o $@
-+	$(CC) $(CFLAGS) -O3 $< -o $@
- 
- rsem-preref : preRef.o
--	$(CC) $(CFLAGS) preRef.o -o $@
-+	$(CC) $(CFLAGS) $< -o $@
- 
- rsem-parse-alignments : parseIt.o
--	$(CC) $(CFLAGS) -o $@ parseIt.o -lbam -lz -lpthread
-+	$(CC) $(CFLAGS) -o $@ $< -lbam -lz -lpthread
- 
- rsem-build-read-index : buildReadIndex.cpp
--	$(CC) $(CFLAGS) -O3 buildReadIndex.cpp -o $@
-+	$(CC) $(CFLAGS) -O3 $< -o $@
- 
- rsem-run-em : EM.o
--	$(CC) $(CFLAGS) -o $@ EM.o -lbam -lz -lpthread
-+	$(CC) $(CFLAGS) -o $@ $< -lbam -lz -lpthread
- 
- rsem-tbam2gbam : tbam2gbam.cpp
--	$(CC) $(CFLAGS) -O3 tbam2gbam.cpp -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $< -lbam -lz -lpthread -o $@
- 
- rsem-bam2wig : wiggle.o bam2wig.cpp
--	$(CC) $(CFLAGS) -O3 bam2wig.cpp wiggle.o -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $^ -lbam -lz -lpthread -o $@
- 
- rsem-bam2readdepth : wiggle.o bam2readdepth.cpp
--	$(CC) $(CFLAGS) -O3 bam2readdepth.cpp wiggle.o -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $^ -lbam -lz -lpthread -o $@
- 
- rsem-simulate-reads : simulation.o
--	$(CC) $(CFLAGS) -o $@ simulation.o
-+	$(CC) $(CFLAGS) -o $@ $<
- 
- rsem-run-gibbs : Gibbs.o
--	$(CC) $(CFLAGS) -o $@ Gibbs.o -lpthread
-+	$(CC) $(CFLAGS) -o $@ $< -lpthread
- 
- rsem-calculate-credibility-intervals : calcCI.o
--	$(CC) $(CFLAGS) -o $@ calcCI.o -lpthread
-+	$(CC) $(CFLAGS) -o $@ $< -lpthread
- 
- rsem-get-unique : getUnique.cpp
--	$(CC) $(CFLAGS) -O3 getUnique.cpp -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $< -lbam -lz -lpthread -o $@
- 
- rsem-sam-validator : samValidator.cpp
--	$(CC) $(CFLAGS) -O3 samValidator.cpp -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $< -lbam -lz -lpthread -o $@
- 
- rsem-scan-for-paired-end-reads : scanForPairedEndReads.cpp
--	$(CC) $(CFLAGS) -O3 scanForPairedEndReads.cpp -lbam -lz -lpthread -o $@
-+	$(CC) $(CFLAGS) -O3 $< -lbam -lz -lpthread -o $@
- 
- clean :
- 	rm -f *.o *~ $(PROGRAMS)
-
-From 0cf9721077f67fb4ca15fdc59cbfbf24a944debd Mon Sep 17 00:00:00 2001
-From: Ricardo Wurmus <ricardo.wurmus@mdc-berlin.de>
-Date: Wed, 22 Apr 2015 15:49:19 +0200
-Subject: [PATCH 7/7] split long line
-
----
- Makefile | 17 ++++++++++++++++-
- 1 file changed, 16 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile b/Makefile
-index 6540d81..0ab04a5 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,7 +1,22 @@
- CC = g++
- CFLAGS = -Wall -I. -I./sam -I./boost -L./sam
- COFLAGS = -O3 -ffast-math -c
--PROGRAMS = rsem-extract-reference-transcripts rsem-synthesis-reference-transcripts rsem-preref rsem-parse-alignments rsem-build-read-index rsem-run-em rsem-tbam2gbam rsem-run-gibbs rsem-calculate-credibility-intervals rsem-simulate-reads rsem-bam2wig rsem-get-unique rsem-bam2readdepth rsem-sam-validator rsem-scan-for-paired-end-reads
-+PROGRAMS = \
-+  rsem-extract-reference-transcripts \
-+  rsem-synthesis-reference-transcripts \
-+  rsem-preref \
-+  rsem-parse-alignments \
-+  rsem-build-read-index \
-+  rsem-run-em \
-+  rsem-tbam2gbam \
-+  rsem-run-gibbs \
-+  rsem-calculate-credibility-intervals \
-+  rsem-simulate-reads \
-+  rsem-bam2wig \
-+  rsem-get-unique \
-+  rsem-bam2readdepth \
-+  rsem-sam-validator \
-+  rsem-scan-for-paired-end-reads
- 
- .PHONY : all ebseq clean
- 
diff --git a/gnu/packages/python-crypto.scm b/gnu/packages/python-crypto.scm
index b0f0e3c970..d773b2f948 100644
--- a/gnu/packages/python-crypto.scm
+++ b/gnu/packages/python-crypto.scm
@@ -203,14 +203,14 @@ This package provides a Python interface for BLAKE2.")
 (define-public python-paramiko
   (package
     (name "python-paramiko")
-    (version "2.4.1")
+    (version "2.4.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "paramiko" version))
        (sha256
         (base32
-         "1wx4s95i2cdh8hhi1c3jb8lzk71jifa3z9wjfsx905y7lrsngqrk"))))
+         "1jqgj2gl1pz7bi2aab1r2xq0ml0gskmm9p235cg9y32nydymm5x8"))))
     (build-system python-build-system)
     (arguments
      `(;; FIXME: Tests require many unpackaged libraries, see dev-requirements.txt.
@@ -220,7 +220,7 @@ This package provides a Python interface for BLAKE2.")
        ("python-pyasn1" ,python-pyasn1)
        ("python-pynacl" ,python-pynacl)
        ("python-cryptography" ,python-cryptography)))
-    (home-page "http://www.paramiko.org/")
+    (home-page "https://www.paramiko.org/")
     (synopsis "SSHv2 protocol library")
     (description "Paramiko is a python implementation of the SSHv2 protocol,
 providing both client and server functionality.  While it leverages a Python C
diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
index 46ba322ee3..15bff5b162 100644
--- a/gnu/packages/python-web.scm
+++ b/gnu/packages/python-web.scm
@@ -5,7 +5,7 @@
 ;;; Copyright © 2016, 2017 Danny Milosavljevic <dannym+a@scratchpost.org>
 ;;; Copyright © 2013, 2014, 2015, 2016 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2016, 2017 Marius Bakke <mbakke@fastmail.com>
-;;; Copyright © 2015, 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2015, 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2017 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2016, 2017 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2016, 2017 Nils Gillmann <ng0@n0.is>
@@ -1351,14 +1351,14 @@ Amazon Web Services (AWS) API.")
 (define-public python-wsgiproxy2
   (package
     (name "python-wsgiproxy2")
-    (version "0.4.4")
+    (version "0.4.5")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "WSGIProxy2" version ".tar.gz"))
        (sha256
         (base32
-         "16532rjc94h3w74x52jfckf3yzsp8h6z34522jk4xgjy82hpnd7r"))))
+         "19d9dva282vfjs784i0zkxp078lxfz4h3f621z30ij9wbf5rba6a"))))
     (build-system python-build-system)
     (native-inputs
      `(("python-webtest" ,python-webtest)))
@@ -1592,6 +1592,29 @@ library.")
 (define-public python2-responses
   (package-with-python2 python-responses))
 
+(define-public python-grequests
+  (package
+    (name "python-grequests")
+    (version "0.3.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "grequests" version))
+       (sha256
+        (base32
+         "1j9icncllbkv7x5719b20mx670c6q1jrdx1sakskkarvx3pc8h8g"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-gevent" ,python-gevent)
+       ("python-requests" ,python-requests)))
+    (native-inputs
+     `(("python-nose" ,python-nose)))
+    (home-page "https://github.com/kennethreitz/grequests")
+    (synopsis "Python library for asynchronous HTTP requests")
+    (description "GRequests is a Python library that allows you to use
+@code{Requests} with @code{Gevent} to make asynchronous HTTP Requests easily")
+    (license license:bsd-2)))
+
 (define-public python-geventhttpclient
   (package
     (name "python-geventhttpclient")
@@ -2030,21 +2053,36 @@ It comes with safe defaults and easily configurable options.")
 (define-public python-flask-login
   (package
     (name "python-flask-login")
-    (version "0.4.0")
+    (version "0.4.1")
     (source
      (origin
-       (method url-fetch)
-       (uri (string-append "https://github.com/maxcountryman/flask-login/archive/"
-                           version ".tar.gz"))
-       (file-name (string-append name "-" version ".tar.gz"))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/maxcountryman/flask-login.git")
+             (commit version)))
+       (file-name (git-file-name name version))
        (sha256
-        (base32
-         "1pdqp7a2gyb7k06xda004x0fi2w66s6kn2i0ndkqndmg12d83f9w"))))
+        (base32 "1rj0qwyxapxnp84fi4lhmvh3d91fdiwz7hibw77x3d5i72knqaa9"))))
     (arguments
-     ;; Tests fail PEP8 compliance. See:
-     ;; https://github.com/maxcountryman/flask-login/issues/340
-     `(#:tests? #f))
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'avoid-yanc
+           ;; Work around '.nosetests-real: error: no such option: --with-yanc'.
+           (lambda _
+             (setenv "NOCOLOR" "set")
+             #t)))))
     (build-system python-build-system)
+    (propagated-inputs
+     `(("python-flask" ,python-flask)))
+    (native-inputs
+     ;; For tests.
+     `(("python-blinker" ,python-blinker)
+       ("python-mock" ,python-mock)
+       ("python-nose" ,python-nose)
+       ("python-pep8" ,python-pep8)
+       ("python-pyflakes" ,python-pyflakes)
+       ("python-semantic-version" ,python-semantic-version)
+       ("python-werkzeug" ,python-werkzeug)))
     (home-page "https://github.com/maxcountryman/flask-login")
     (synopsis "User session management for Flask")
     (description
@@ -2626,3 +2664,79 @@ for URL parsing and changing.")
 
 (define-public python2-google-api-client
   (package-with-python2 python-google-api-client))
+
+(define-public python-hawkauthlib
+  (package
+    (name "python-hawkauthlib")
+    (version "2.0.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "hawkauthlib" version))
+       (sha256
+        (base32
+         "03ai47s4h8nfnrf25shbfvkm1b9n1ccd4nmmj280sg1fayi69zgg"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-requests" ,python-requests)
+       ("python-webob" ,python-webob)))
+    (home-page "https://github.com/mozilla-services/hawkauthlib")
+    (synopsis "Hawk Access Authentication protocol")
+    (description
+     "This is a low-level Python library for implementing Hawk Access Authentication,
+a simple HTTP request-signing scheme.")
+    (license license:mpl2.0)))
+
+(define-public python-pybrowserid
+  (package
+    (name "python-pybrowserid")
+    (version "0.14.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "PyBrowserID" version))
+       (sha256
+        (base32
+         "1qvi79kfb8x9kxkm5lw2mp42hm82cpps1xknmsb5ghkwx1lpc8kc"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     `(("python-requests" ,python-requests)))
+    (native-inputs
+     `(("python-mock" ,python-mock)))
+    (home-page "https://github.com/mozilla/PyBrowserID")
+    (synopsis "Python library for the BrowserID protocol")
+    (description
+     "This is a Python client library for the BrowserID protocol that
+underlies Mozilla Persona.")
+    (license license:mpl2.0)))
+
+(define-public python-pyfxa
+  (package
+    (name "python-pyfxa")
+    (version "0.6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "PyFxA" version))
+       (sha256
+        (base32
+         "0axl16fyrz2r88gnw4b12mk7dpkqscv8c4wsc1y5hicl7bsbc4fm"))))
+    (build-system python-build-system)
+    (arguments '(#:tests? #f)) ; 17 tests require network access
+    (propagated-inputs
+     `(("python-cryptography" ,python-cryptography)
+       ("python-hawkauthlib" ,python-hawkauthlib)
+       ("python-pybrowserid" ,python-pybrowserid)
+       ("python-requests" ,python-requests)
+       ("python-six" ,python-six)))
+    (native-inputs
+     `(("python-grequests" ,python-grequests)
+       ("python-mock" ,python-mock)
+       ("python-responses" ,python-responses)
+       ("python-unittest2" ,python-unittest2)))
+    (home-page "https://github.com/mozilla/PyFxA")
+    (synopsis "Firefox Accounts client library for Python")
+    (description
+     "This is a Python library for interacting with the Firefox Accounts
+ecosystem.")
+    (license license:mpl2.0)))
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index e4926ce309..f7369cedef 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -715,8 +715,8 @@ and verifies that it matches the intended target hostname.")
             (setenv "PYTHONPATH"
                     (string-append (getcwd) ":"
                                    (getenv "PYTHONPATH")))
-            (and (zero? (system* "./runexamples.sh"))
-                 (zero? (system* "nosetests" "-v"))))))))
+            (invoke "./runexamples.sh")
+            (invoke "nosetests" "-v"))))))
    (home-page "https://github.com/fhs/python-hdf4")
    (synopsis "Python interface to the NCSA HDF4 library")
    (description
@@ -855,6 +855,34 @@ API for locking files.")
 (define-public python2-lockfile
   (package-with-python2 python-lockfile))
 
+(define-public python-semantic-version
+  (package
+    (name "python-semantic-version")
+    (version "2.6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "semantic_version" version))
+       (sha256
+        (base32
+         "1h2l9xyg1zzsda6kjcmfcgycbvrafwci283vcr1v5sbk01l2hhra"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:tests? #f))                    ; PyPI tarball lacks tests
+    (home-page "https://github.com/rbarrois/python-semanticversion")
+    (synopsis "Semantic versioning module for Python")
+    (description
+     "The @code{semantic_version} class is a small library for handling
+@uref{https://semver.org/, semantic versioning} (@dfn{SemVer}) in Python.
+
+It can compare versions, generate a new version that represents a bump in one of
+the version levels, and check whether any given string is a proper semantic
+version identifier.")
+    (license license:bsd-3)))
+
+(define-public python2-semantic-version
+  (package-with-python2 python-semantic-version))
+
 (define-public python-setuptools
   (package
     (name "python-setuptools")
@@ -3263,16 +3291,13 @@ library, libgit2 implements Git plumbing.")
 (define-public python-pyparsing
   (package
     (name "python-pyparsing")
-    (version "2.2.0")
+    (version "2.2.1")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "mirror://sourceforge/pyparsing/pyparsing"
-                           "/pyparsing-" version
-                           "/pyparsing-" version ".tar.gz"))
+       (uri (pypi-uri "pyparsing" version))
        (sha256
-        (base32
-         "016b9gh606aa44sq92jslm89bg874ia0yyiyb643fa6dgbsbqch8"))))
+        (base32 "06dgd0iilvf8m0ssmfpcbh8l6jf0zkp8adbb84llksg17crfx4zl"))))
     (build-system python-build-system)
     (outputs '("out" "doc"))
     (arguments
@@ -3295,7 +3320,7 @@ library, libgit2 implements Git plumbing.")
                 (list "docs" "htmldoc" "examples")
                 (list doc html-doc examples))
                #t))))))
-    (home-page "http://pyparsing.wikispaces.com")
+    (home-page "https://github.com/pyparsing/pyparsing")
     (synopsis "Python parsing class library")
     (description
      "The pyparsing module is an alternative approach to creating and
@@ -4239,15 +4264,14 @@ PNG, PostScript, PDF, and SVG file output.")
 (define-public python-decorator
   (package
     (name "python-decorator")
-    (version "4.2.1")
+    (version "4.3.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "decorator" version))
        (sha256
-        (base32 "03iaf116rm3w8b4agb8hzf6z9331mrvi4khfxq35zkx17sgxsikx"))))
+        (base32 "0308djallnh00v112y5b7nadl657ysmkp6vc8xn51d6yzc9zm7n3"))))
     (build-system python-build-system)
-    (arguments '(#:tests? #f)) ; no test target
     (home-page "https://pypi.python.org/pypi/decorator/")
     (synopsis "Python module to simplify usage of decorators")
     (description
@@ -4422,7 +4446,7 @@ displayed.")
              ;; Why does it not work? Delete for now.
              (delete-file "tests/test_socket.py")
              #t))
-         (replace 'check (lambda _ (zero? (system* "nosetests" "-v")))))))
+         (replace 'check (lambda _ (invoke "nosetests" "-v"))))))
     (native-inputs
      `(("python-nose" ,python-nose)
        ("python-pytest" ,python-pytest)
@@ -5099,21 +5123,21 @@ interfaces in an easy and portable manner.")
 (define-public python-networkx
   (package
     (name "python-networkx")
-    (version "2.1")
+    (version "2.2")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "networkx" version ".zip"))
        (sha256
-        (base32 "1ccb8mfz4m821k9y0cigkbq42q2sbb4dj5fbjshp0awp32j2q9v4"))))
+        (base32 "12swxb15299v9vqjsq4z8rgh5sdhvpx497xwnhpnb0gynrx6zra5"))))
     (build-system python-build-system)
-    ;; python-decorator is needed at runtime
+    ;; python-decorator is needed at runtime.
     (propagated-inputs
      `(("python-decorator" ,python-decorator)))
     (native-inputs
      `(("python-nose" ,python-nose)
        ("unzip" ,unzip)))
-    (home-page "http://networkx.github.io/")
+    (home-page "https://networkx.github.io/")
     (synopsis "Python module for creating and manipulating graphs and networks")
     (description
       "NetworkX is a Python package for the creation, manipulation, and study
@@ -12117,14 +12141,14 @@ address is valid and really exists.")
 (define-public python-marshmallow
   (package
     (name "python-marshmallow")
-    (version "3.0.0b3")
+    (version "3.0.0b14")
     (source
      (origin
       (method url-fetch)
       (uri (pypi-uri "marshmallow" version))
       (sha256
        (base32
-        "07mcrij1yvk85lvgx44wwr9pc80xryghvlgayb057g1cazcypysd"))))
+        "1digk3f5cfk7wmlka65mc7bzsd96pbsgcsvp6pimd5b4ff9zb5p3"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-dateutil" ,python-dateutil)
@@ -12391,15 +12415,24 @@ library.")
 (define-public python-rencode
   (package
    (name "python-rencode")
-   (version "1.0.3")
+   (version "1.0.5")
    (source
     (origin
      (method url-fetch)
      (uri (pypi-uri "rencode" version))
      (sha256
       (base32
-       "08if5yax1xn5yfp8p3765ccjmfcv9di7i4m5jckgnwvdsgznwkbj"))))
+       "0mzwdq1is7kyyr32i5k4iz6g5xxdvmiyc132jnc60p9m6lnwjrpv"))))
    (build-system python-build-system)
+   (arguments
+    `(#:phases
+      (modify-phases %standard-phases
+        (add-before 'check 'delete-bogus-test
+          ;; This test requires /home/aresch/Downloads, which is not provided by
+          ;; the build environment.
+          (lambda _
+            (delete-file "rencode/t.py")
+            #t)))))
    (native-inputs `(("pkg-config" ,pkg-config)
                     ("python-cython" ,python-cython)))
    (home-page "https://github.com/aresch/rencode")
diff --git a/gnu/packages/rust.scm b/gnu/packages/rust.scm
index 74de6f3ae1..40633854ae 100644
--- a/gnu/packages/rust.scm
+++ b/gnu/packages/rust.scm
@@ -514,6 +514,26 @@ safety and thread safety guarantees.")
        (substitute-keyword-arguments (package-arguments rust-1.19)
          ((#:phases phases)
           `(modify-phases ,phases
+             (add-after 'patch-tests 'patch-cargo-tests
+               (lambda _
+                 (substitute* "src/tools/cargo/tests/build.rs"
+                  (("/usr/bin/env") (which "env"))
+                  ;; Guix llvm is compiled without asmjs-unknown-emscripten.
+                  (("fn wasm32_final_outputs") "#[ignore]\nfn wasm32_final_outputs"))
+                 (substitute* "src/tools/cargo/tests/death.rs"
+                  ;; This is stuck when built in container.
+                  (("fn ctrl_c_kills_everyone") "#[ignore]\nfn ctrl_c_kills_everyone"))
+                 ;; Prints test output in the wrong order when built on
+                 ;; i686-linux.
+                 (substitute* "src/tools/cargo/tests/test.rs"
+                   (("fn cargo_test_env") "#[ignore]\nfn cargo_test_env"))
+                 #t))
+             (add-after 'patch-cargo-tests 'ignore-glibc-2.27-incompatible-test
+               ;; https://github.com/rust-lang/rust/issues/47863
+               (lambda _
+                 (substitute* "src/test/run-pass/out-of-stack.rs"
+                   (("// ignore-android") "// ignore-test\n// ignore-android"))
+                 #t))
              (replace 'configure
                (lambda* (#:key inputs outputs #:allow-other-keys)
                  (let* ((out (assoc-ref outputs "out"))
@@ -542,7 +562,6 @@ submodules = false
 prefix = \"" out "\"
 docdir = \"" doc "/share/doc/rust" "\"
 sysconfdir = \"etc\"
-localstatedir = \"var/lib\"
 [rust]
 default-linker = \"" gcc "/bin/gcc" "\"
 channel = \"stable\"
@@ -579,10 +598,11 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
              (delete 'patch-cargo-tomls)
              (add-before 'build 'reset-timestamps-after-changes
                (lambda* _
-                 (define ref (stat "README.md"))
                  (for-each
                   (lambda (filename)
-                    (set-file-time filename ref))
+                    ;; Rust 1.20.0 treats timestamp 0 as "file doesn't exist".
+                    ;; Therefore, use timestamp 1.
+                    (utime filename 1 1 1 1))
                   (find-files "." #:directories? #t))
                  #t))
              (replace 'build
@@ -651,34 +671,6 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                ;; XXX: Revisit this when we use gcc 6.
                (substitute* "src/binaryen/CMakeLists.txt"
                  (("ADD_COMPILE_FLAG\\(\\\"-march=native\\\"\\)") ""))
-               #t))
-           (add-after 'patch-tests 'patch-cargo-tests
-             (lambda _
-               (substitute* "src/tools/cargo/tests/build.rs"
-                (("/usr/bin/env") (which "env"))
-                ;; Guix llvm is compiled without asmjs-unknown-emscripten.
-                (("fn wasm32_final_outputs") "#[ignore]\nfn wasm32_final_outputs"))
-               (substitute* "src/tools/cargo/tests/death.rs"
-                ;; This is stuck when built in container.
-                (("fn ctrl_c_kills_everyone") "#[ignore]\nfn ctrl_c_kills_everyone"))
-               ;; Prints test output in the wrong order when built on
-               ;; i686-linux.
-               (substitute* "src/tools/cargo/tests/test.rs"
-                 (("fn cargo_test_env") "#[ignore]\nfn cargo_test_env"))
-               #t))
-           (add-after 'patch-cargo-tests 'ignore-glibc-2.27-incompatible-test
-             ;; https://github.com/rust-lang/rust/issues/47863
-             (lambda _
-               (substitute* "src/test/run-pass/out-of-stack.rs"
-                 (("// ignore-android") "// ignore-test\n// ignore-android"))))
-           (add-after 'ignore-glibc-2.27-incompatible-test 'fix-mtime-bug
-             (lambda* _
-               (substitute* "src/build_helper/lib.rs"
-                 ;; Bug in Rust code.
-                 ;; Current implementation assume that if dst not exist then it's mtime
-                 ;; is 0, but in same time "src" have 0 mtime in guix build!
-                 (("let threshold = mtime\\(dst\\);")
-                  "if !dst.exists() {\nreturn false\n}\n let threshold = mtime(dst);"))
                #t))))))))
 
 (define-public rust-1.24
@@ -698,8 +690,7 @@ jemalloc = \"" jemalloc "/lib/libjemalloc_pic.a" "\"
                    ;; This test is known to fail on aarch64 and powerpc64le:
                    ;; https://github.com/rust-lang/rust/issues/45410
                    (("fn test_loading_cosine") "#[ignore]\nfn test_loading_cosine"))
-                 #t))
-             (delete 'fix-mtime-bug))))))))
+                 #t)))))))))
 
 (define-public rust-1.25
   (let ((base-rust
diff --git a/gnu/packages/skarnet.scm b/gnu/packages/skarnet.scm
index 9a6733d8bc..6546d40597 100644
--- a/gnu/packages/skarnet.scm
+++ b/gnu/packages/skarnet.scm
@@ -105,7 +105,7 @@ complexity.")))
 (define-public s6
   (package
    (name "s6")
-   (version "2.7.2.0")
+   (version "2.7.2.1")
    (source
     (origin
      (method url-fetch)
@@ -113,7 +113,7 @@ complexity.")))
                          version ".tar.gz"))
      (sha256
       (base32
-       "02canrzmhr66gi16ldyylk378jlmyfl73vn72ayr12h2wyxgqm5g"))))
+       "0vyl4wr2l4mp9ams0dyg224qxhl8ksxsv2shs6606lhhp9g1rb6b"))))
    (build-system gnu-build-system)
    (inputs `(("skalibs" ,skalibs)
              ("execline" ,execline)))
diff --git a/gnu/packages/syndication.scm b/gnu/packages/syndication.scm
index f37c0eaac5..6247d1f3b6 100644
--- a/gnu/packages/syndication.scm
+++ b/gnu/packages/syndication.scm
@@ -1,6 +1,9 @@
+;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
+;;; This file is part of GNU Guix.
+;;;
 ;;; GNU Guix is free software; you can redistribute it and/or modify it
 ;;; under the terms of the GNU General Public License as published by
 ;;; the Free Software Foundation; either version 3 of the License, or (at
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 58c870df5a..204ec403f6 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -712,13 +712,13 @@ default) of the repository.")
 (define-public python-gitdb
   (package
     (name "python-gitdb")
-    (version "2.0.3")
+    (version "2.0.4")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "gitdb2" version))
               (sha256
                (base32
-                "02azg62mr99b7cllyjrly77np3vw32y8nrxpa2xjapiyaga2j3mn"))))
+                "0i608q9c47rdsmyac1cn6s0hzwwj7cb957y8fc9wacc5lnw8ak5v"))))
     (build-system python-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
@@ -733,7 +733,7 @@ default) of the repository.")
                                                   "file" (number->string filecount))
                             (lambda (port)
                               (format port "~a" filecount))))
-                        (and
+                        (begin
                          (invoke "git" "init")
                          (invoke "git" "config" "user.name" "Total Git")
                          (invoke "git" "config" "user.email" "git@localhost")
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index 4882f0476a..448773e0d9 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -1242,7 +1242,8 @@ access to mpv's powerful playback capabilities.")
               (sha256
                (base32
                 "0vvh89hvp8qg9an9vcmwb7d9k3nixhxaz6zi65qdjnd0i56kkcz6"))
-              (patches (search-patches "libvpx-CVE-2016-2818.patch"))))
+              (patches (search-patches "libvpx-use-after-free-in-postproc.patch"
+                                       "libvpx-CVE-2016-2818.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags (list "--enable-shared"
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index ac8e48eb10..0cbade457f 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -5019,12 +5019,14 @@ deployments.")
                                "--localstatedir=/var")
        #:phases
        (modify-phases %standard-phases
-         (add-after 'unpack 'patch-/bin/sh
+         (add-after 'unpack 'use-absolute-file-names
            (lambda _
              (substitute* '("bin/varnishtest/vtc_varnish.c"
                             "bin/varnishtest/vtc_process.c"
                             "bin/varnishd/mgt/mgt_vcc.c")
                (("/bin/sh") (which "sh")))
+             (substitute* "bin/varnishd/mgt/mgt_shmem.c"
+               (("rm -rf") (string-append (which "rm") " -rf")))
              #t))
          (add-before 'install 'patch-Makefile
            (lambda _
diff --git a/gnu/packages/webkit.scm b/gnu/packages/webkit.scm
index b671e44d18..c5238a8a65 100644
--- a/gnu/packages/webkit.scm
+++ b/gnu/packages/webkit.scm
@@ -24,6 +24,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix utils)
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages)
@@ -32,6 +33,7 @@
   #:use-module (gnu packages databases)
   #:use-module (gnu packages enchant)
   #:use-module (gnu packages flex)
+  #:use-module (gnu packages gcc)
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages gl)
   #:use-module (gnu packages glib)
@@ -85,23 +87,7 @@
                           ;; XXX Disable WOFF2 ‘web fonts’.  These were never
                           ;; supported in our previous builds.  Enabling them
                           ;; requires building libwoff2 and possibly woff2dec.
-                          "-DUSE_WOFF2=OFF")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after
-          'set-paths 'add-gst-plugins-base-include-path
-          (lambda* (#:key inputs #:allow-other-keys)
-            ;; XXX Work around a problem in the build system, which neglects
-            ;; to add -I for gst-plugins-base when compiling
-            ;; Source/WebKit2/UIProcess/WebPageProxy.cpp, apparently assuming
-            ;; that it will be in the same directory as gstreamer's header
-            ;; files.
-            (setenv "CPATH"
-                    (string-append (getenv "C_INCLUDE_PATH")
-                                   ":"
-                                   (assoc-ref inputs "gst-plugins-base")
-                                   "/include/gstreamer-1.0"))
-            #t)))))
+                          "-DUSE_WOFF2=OFF")))
     (native-inputs
      `(("bison" ,bison)
        ("gettext" ,gettext-minimal)
@@ -149,3 +135,32 @@ HTML/CSS applications to full-fledged web browsers.")
                    license:lgpl2.1+
                    license:bsd-2
                    license:bsd-3))))
+
+;; This version of webkitgtk needs to be kept separate, because it requires a
+;; newer version of GCC than our default compiler, and this causes problems
+;; when linked with C++ libraries built using our default compiler.  For now,
+;; we use this newer webkitgtk only for selected packages, e.g. epiphany.
+(define-public webkitgtk-2.22
+  (package/inherit webkitgtk
+    (name "webkitgtk")
+    (version "2.22.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://www.webkitgtk.org/releases/"
+                                  name "-" version ".tar.xz"))
+              (sha256
+               (base32
+                "1flrbr8pzbrlwv09b4pmgh6vklw7jghd2lgrhcb72vl9s7a8fm1l"))))
+    (native-inputs
+     `(("gcc" ,gcc-7)  ; webkitgtk-2.22 requires gcc-6 or newer
+       ,@(package-native-inputs webkitgtk)))
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (add-before 'configure 'work-around-gcc-7-include-path-issue
+                    ;; FIXME: Work around a problem with gcc-7 includes (see
+                    ;; <https://bugs.gnu.org/30756>).
+                    (lambda _
+                      (unsetenv "C_INCLUDE_PATH")
+                      (unsetenv "CPLUS_INCLUDE_PATH")
+                      #t)))
+       ,@(package-arguments webkitgtk)))))
diff --git a/gnu/packages/wxwidgets.scm b/gnu/packages/wxwidgets.scm
index f1a61329e8..6cbfd76e10 100644
--- a/gnu/packages/wxwidgets.scm
+++ b/gnu/packages/wxwidgets.scm
@@ -49,7 +49,7 @@
 (define-public wxwidgets
   (package
     (name "wxwidgets")
-    (version "3.0.3")
+    (version "3.0.4")
     (source
      (origin
        (method url-fetch)
@@ -57,7 +57,7 @@
                            "releases/download/v" version
                            "/wxWidgets-" version ".tar.bz2"))
        (sha256
-        (base32 "0yrhp5cs2g33cpbdwdzicmm5m4mfnlvxwv031x9266zc90zh7j08"))))
+        (base32 "1w7pgfqjab7n84lc4aarydl3g55d1hdgl2ilwml766r6inc7y5cn"))))
     (build-system glib-or-gtk-build-system)
     (inputs
      `(("glu" ,glu)
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 0cecb5bf7c..a3b6e22607 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -681,20 +681,23 @@ This module provide functions which simplify writing tests for
 (define-public perl-xml-compile
   (package
     (name "perl-xml-compile")
-    (version "1.54")
+    (version "1.60")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://cpan/authors/id/M/MA/MARKOV/"
                                   "XML-Compile-" version ".tar.gz"))
               (sha256
                (base32
-                "1hp41960bpqxvv1samv9hc0ghhmvs3i16r4rfl9yp54lp6jhsr2c"))))
+                "04vv7wy5v1l38xsfdbacvyd90qircvnrs2f3ysljm1nhq8mycmwm"))))
     (build-system perl-build-system)
     (propagated-inputs
-     `(("perl-log-report" ,perl-log-report)
+     `(("perl-carp" ,perl-carp)
+       ("perl-log-report" ,perl-log-report)
        ("perl-xml-compile-tester" ,perl-xml-compile-tester)
        ("perl-xml-libxml" ,perl-xml-libxml)
-       ("perl-test-deep" ,perl-test-deep)))
+       ("perl-scalar-list-utils" ,perl-scalar-list-utils)
+       ("perl-test-deep" ,perl-test-deep)
+       ("perl-types-serialiser" ,perl-types-serialiser)))
     (home-page "https://metacpan.org/release/XML-Compile")
     (synopsis "Compilation-based XML processing")
     (description
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index cee87756af..ad872be2e0 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5910,7 +5910,7 @@ basic eye-candy effects.")
 (define-public xpra
   (package
     (name "xpra")
-    (version "2.3.3")
+    (version "2.3.4")
     (source
      (origin
        (method url-fetch)
@@ -5918,7 +5918,7 @@ basic eye-candy effects.")
                            version ".tar.xz"))
        (sha256
         (base32
-         "1azvvddjfq7lb5kmbn0ilgq2nf7pmymsc3b9lhbjld6w156qdv01"))))
+         "0wa3kx54himy3i1b2801hlzfilh3cf4kjk40k1cjl0ds28m5hija"))))
     (build-system python-build-system)
     (inputs `(("ffmpeg" ,ffmpeg)
               ("flac" ,flac)
diff --git a/gnu/services/web.scm b/gnu/services/web.scm
index 1c38e7d8d3..1edb1f4d34 100644
--- a/gnu/services/web.scm
+++ b/gnu/services/web.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2018 Pierre-Antoine Rouby <pierre-antoine.rouby@inria.fr>
 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
+;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -190,7 +191,21 @@
             tailon-configuration-config-file
             tailon-configuration-package
 
-            tailon-service-type))
+            tailon-service-type
+
+            <varnish-configuration>
+            varnish-configuration
+            varnish-configuration?
+            varnish-configuration-package
+            varnish-configuration-name
+            varnish-configuration-backend
+            varnish-configuration-vcl
+            varnish-configuration-listen
+            varnish-configuration-storage
+            varnish-configuration-parameters
+            varnish-configuration-extra-options
+
+            varnish-service-type))
 
 ;;; Commentary:
 ;;;
@@ -1162,3 +1177,82 @@ files.")
                   (files (append (tailon-configuration-file-files old-config-file)
                                  files))))))))
    (default-value (tailon-configuration))))
+
+
+;;;
+;;; Varnish
+;;;
+
+(define-record-type* <varnish-configuration>
+  varnish-configuration make-varnish-configuration
+  varnish-configuration?
+  (package             varnish-configuration-package          ;<package>
+                       (default varnish))
+  (name                varnish-configuration-name             ;string
+                       (default "default"))
+  (backend             varnish-configuration-backend          ;string
+                       (default "localhost:8080"))
+  (vcl                 varnish-configuration-vcl              ;#f | <file-like>
+                       (default #f))
+  (listen              varnish-configuration-listen           ;list of strings
+                       (default '("localhost:80")))
+  (storage             varnish-configuration-storage          ;list of strings
+                       (default '("malloc,128m")))
+  (parameters          varnish-configuration-parameters       ;list of string pairs
+                       (default '()))
+  (extra-options       varnish-configuration-extra-options    ;list of strings
+                       (default '())))
+
+(define %varnish-accounts
+  (list (user-group
+         (name "varnish")
+         (system? #t))
+        (user-account
+         (name "varnish")
+         (group "varnish")
+         (system? #t)
+         (comment "Varnish Cache User")
+         (home-directory "/var/varnish")
+         (shell (file-append shadow "/sbin/nologin")))))
+
+(define varnish-shepherd-service
+  (match-lambda
+    (($ <varnish-configuration> package name backend vcl listen storage
+                                parameters extra-options)
+     (list (shepherd-service
+            (provision (list (symbol-append 'varnish- (string->symbol name))))
+            (documentation (string-append "The Varnish Web Accelerator"
+                                          " (" name ")"))
+            (requirement '(networking))
+            (start #~(make-forkexec-constructor
+                      (list #$(file-append package "/sbin/varnishd")
+                            "-n" #$name
+                            #$@(if vcl
+                                   #~("-f" #$vcl)
+                                   #~("-b" #$backend))
+                            #$@(append-map (lambda (a) (list "-a" a)) listen)
+                            #$@(append-map (lambda (s) (list "-s" s)) storage)
+                            #$@(append-map (lambda (p)
+                                             (list "-p" (format #f "~a=~a"
+                                                                (car p) (cdr p))))
+                                           parameters)
+                            #$@extra-options)
+                      ;; Varnish will drop privileges to the "varnish" user when
+                      ;; it exists.  Not passing #:user here allows the service
+                      ;; to bind to ports < 1024.
+                      #:pid-file (if (string-prefix? "/" #$name)
+                                     (string-append #$name "/_.pid")
+                                     (string-append "/var/varnish/" #$name "/_.pid"))))
+            (stop #~(make-kill-destructor)))))))
+
+(define varnish-service-type
+  (service-type
+   (name 'varnish)
+   (description "Run the Varnish cache server.")
+   (extensions
+    (list (service-extension account-service-type
+                             (const %varnish-accounts))
+          (service-extension shepherd-root-service-type
+                             varnish-shepherd-service)))
+   (default-value
+     (varnish-configuration))))
diff --git a/gnu/system/mapped-devices.scm b/gnu/system/mapped-devices.scm
index af73dc608c..a874666463 100644
--- a/gnu/system/mapped-devices.scm
+++ b/gnu/system/mapped-devices.scm
@@ -157,7 +157,10 @@ these lines:
    ;; @dots{}
    (initrd-modules (append (list~{ ~s~})
                            %base-initrd-modules)))
-@end example\n")
+@end example
+
+If you think this diagnostic is inaccurate, use the @option{--skip-checks}
+option of @command{guix system}.\n")
                                missing)))
                 (&error-location
                  (location (source-properties->location location)))))))))
diff --git a/gnu/system/vm.scm b/gnu/system/vm.scm
index 91e117b9f3..a1b595d45d 100644
--- a/gnu/system/vm.scm
+++ b/gnu/system/vm.scm
@@ -99,21 +99,28 @@
           (device "store")
           (type "9p")
           (needed-for-boot? #t)
-          (options "trans=virtio")
+          (flags '(read-only))
+          (options "trans=virtio,cache=loose")
           (check? #f))
+
+        ;; The 9p documentation says that cache=loose is "intended for
+        ;; exclusive, read-only mounts", without additional details.  In
+        ;; practice it seems to work well for these, and it's much faster than
+        ;; the default cache=none, especially when copying and registering
+        ;; store items.
         (file-system
           (mount-point "/xchg")
           (device "xchg")
           (type "9p")
           (needed-for-boot? #t)
-          (options "trans=virtio")
+          (options "trans=virtio,cache=loose")
           (check? #f))
         (file-system
           (mount-point "/tmp")
           (device "tmp")
           (type "9p")
           (needed-for-boot? #t)
-          (options "trans=virtio")
+          (options "trans=virtio,cache=loose")
           (check? #f))))
 
 (define not-config?
@@ -390,7 +397,12 @@ the image."
                                  #:closures graphs
                                  #:copy-closures? #$copy-inputs?
                                  #:register-closures? #$register-closures?
-                                 #:system-directory #$os-drv))
+                                 #:system-directory #$os-drv
+
+                                 ;; Disable deduplication to speed things up,
+                                 ;; and because it doesn't help much for a
+                                 ;; single system generation.
+                                 #:deduplicate? #f))
                     (root-size  #$(if (eq? 'guess disk-image-size)
                                       #~(max
                                          ;; Minimum 20 MiB root size
diff --git a/gnu/tests/web.scm b/gnu/tests/web.scm
index 45fcb668fb..bcc919137b 100644
--- a/gnu/tests/web.scm
+++ b/gnu/tests/web.scm
@@ -32,6 +32,7 @@
   #:use-module (guix store)
   #:export (%test-httpd
             %test-nginx
+            %test-varnish
             %test-php-fpm
             %test-hpcguix-web
             %test-tailon))
@@ -169,6 +170,46 @@ HTTP-PORT."
 
 
 ;;;
+;;; Varnish
+;;;
+
+(define %varnish-vcl
+  (mixed-text-file
+   "varnish-test.vcl"
+   "vcl 4.0;
+backend dummy { .host = \"127.1.1.1\"; }
+sub vcl_recv { return(synth(200, \"OK\")); }
+sub vcl_synth {
+  synthetic(\"" %index.html-contents "\");
+  set resp.http.Content-Type = \"text/plain\";
+  return(deliver);
+}"))
+
+(define %varnish-os
+  (simple-operating-system
+   (dhcp-client-service)
+   ;; Pretend to be a web server that serves %index.html-contents.
+   (service varnish-service-type
+            (varnish-configuration
+             (name "/tmp/server")
+             ;; Use a small VSL buffer to fit in the test VM.
+             (parameters '(("vsl_space" . "4M")))
+             (vcl %varnish-vcl)))
+   ;; Proxy the "server" using the builtin configuration.
+   (service varnish-service-type
+            (varnish-configuration
+             (parameters '(("vsl_space" . "4M")))
+             (backend "localhost:80")
+             (listen '(":8080"))))))
+
+(define %test-varnish
+  (system-test
+   (name "varnish")
+   (description "Test the Varnish Cache server.")
+   (value (run-webserver-test "varnish-default" %varnish-os))))
+
+
+;;;
 ;;; PHP-FPM
 ;;;
 
diff --git a/guix/build/store-copy.scm b/guix/build/store-copy.scm
index 2d9590d16f..64ade7885c 100644
--- a/guix/build/store-copy.scm
+++ b/guix/build/store-copy.scm
@@ -19,6 +19,7 @@
 (define-module (guix build store-copy)
   #:use-module (guix build utils)
   #:use-module (guix sets)
+  #:use-module (guix progress)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-9)
   #:use-module (srfi srfi-26)
@@ -167,7 +168,8 @@ REFERENCE-GRAPHS, a list of reference-graph files."
 
   (reduce + 0 (map file-size items)))
 
-(define* (populate-store reference-graphs target)
+(define* (populate-store reference-graphs target
+                         #:key (log-port (current-error-port)))
   "Populate the store under directory TARGET with the items specified in
 REFERENCE-GRAPHS, a list of reference-graph files."
   (define store
@@ -183,9 +185,20 @@ REFERENCE-GRAPHS, a list of reference-graph files."
 
   (mkdir-p store)
   (chmod store #o1775)
-  (for-each (lambda (thing)
-              (copy-recursively thing
-                                (string-append target thing)))
-            (things-to-copy)))
+
+  (let* ((things   (things-to-copy))
+         (len      (length things))
+         (progress (progress-reporter/bar len
+                                          (format #f "copying ~a store items"
+                                                  len)
+                                          log-port)))
+    (call-with-progress-reporter progress
+      (lambda (report)
+        (for-each (lambda (thing)
+                    (copy-recursively thing
+                                      (string-append target thing)
+                                      #:log (%make-void-port "w"))
+                    (report))
+                  things)))))
 
 ;;; store-copy.scm ends here
diff --git a/guix/channels.scm b/guix/channels.scm
index 2e7bffae9f..82389eb583 100644
--- a/guix/channels.scm
+++ b/guix/channels.scm
@@ -47,9 +47,9 @@
             channel-instance-checkout
 
             latest-channel-instances
-            channel-instance-derivations
             latest-channel-derivation
-            channel-instances->manifest))
+            channel-instances->manifest
+            channel-instances->derivation))
 
 ;;; Commentary:
 ;;;
@@ -294,13 +294,17 @@ channel instances."
                                           (zip instances derivations))))
     (return (manifest entries))))
 
+(define (channel-instances->derivation instances)
+  "Return the derivation of the profile containing INSTANCES, a list of
+channel instances."
+  (mlet %store-monad ((manifest (channel-instances->manifest instances)))
+    (profile-derivation manifest)))
+
 (define latest-channel-instances*
   (store-lift latest-channel-instances))
 
 (define* (latest-channel-derivation #:optional (channels %default-channels))
   "Return as a monadic value the derivation that builds the profile for the
 latest instances of CHANNELS."
-  (mlet* %store-monad ((instances ((store-lift latest-channel-instances)
-                                   channels))
-                       (manifest  (channel-instances->manifest instances)))
-    (profile-derivation manifest)))
+  (mlet %store-monad ((instances (latest-channel-instances* channels)))
+    (channel-instances->derivation instances)))
diff --git a/guix/git-download.scm b/guix/git-download.scm
index 24cf11be5e..fa94fad8f8 100644
--- a/guix/git-download.scm
+++ b/guix/git-download.scm
@@ -156,22 +156,23 @@ HASH-ALGO (a symbol).  Use NAME as the file name, or a generic name if #f."
 The result is similar to that of the 'git ls-files' command, except that it
 also includes directories, not just regular files.  The returned file names
 are relative to DIRECTORY, which is not necessarily the root of the checkout."
-  (let* ((directory  (canonicalize-path directory))
+  (let* (;; 'repository-working-directory' always returns a trailing "/",
+         ;; so add one here to ease the comparisons below.
+         (directory  (string-append (canonicalize-path directory) "/"))
          (dot-git    (repository-discover directory))
-         (top        (dirname dot-git))
          (repository (repository-open dot-git))
+         ;; XXX: This procedure is mistakenly private in Guile-Git 0.1.0.
+         (workdir    ((@@ (git repository) repository-working-directory)
+                      repository))
          (head       (repository-head repository))
          (oid        (reference-target head))
          (commit     (commit-lookup repository oid))
          (tree       (commit-tree commit))
          (files      (tree-list tree)))
     (repository-close! repository)
-    (if (string=? top directory)
+    (if (string=? workdir directory)
         files
-        (let ((relative (string-append
-                         (string-drop directory
-                                      (+ 1 (string-length top)))
-                         "/")))
+        (let ((relative (string-drop directory (string-length workdir))))
           (filter-map (lambda (file)
                         (and (string-prefix? relative file)
                              (string-drop file (string-length relative))))
diff --git a/guix/gnupg.scm b/guix/gnupg.scm
index b30ce461b4..40feb44561 100644
--- a/guix/gnupg.scm
+++ b/guix/gnupg.scm
@@ -57,7 +57,7 @@
 (define %openpgp-key-server
   ;; The default key server.  Note that keys.gnupg.net appears to be
   ;; unreliable.
-  (make-parameter "pgp.mit.edu"))
+  (make-parameter "pool.sks-keyservers.net"))
 
 (define* (gnupg-verify sig file
                        #:optional (keyring (current-keyring)))
diff --git a/guix/inferior.scm b/guix/inferior.scm
index af37233a03..1dbb9e1699 100644
--- a/guix/inferior.scm
+++ b/guix/inferior.scm
@@ -19,24 +19,68 @@
 (define-module (guix inferior)
   #:use-module (srfi srfi-9)
   #:use-module (srfi srfi-9 gnu)
-  #:use-module ((guix utils) #:select (source-properties->location))
+  #:use-module ((guix utils)
+                #:select (%current-system
+                          source-properties->location
+                          call-with-temporary-directory
+                          version>? version-prefix?
+                          cache-directory))
+  #:use-module ((guix store)
+                #:select (nix-server-socket
+                          nix-server-major-version
+                          nix-server-minor-version
+                          store-lift))
+  #:use-module ((guix derivations)
+                #:select (read-derivation-from-file))
+  #:use-module (guix gexp)
+  #:use-module (guix search-paths)
+  #:use-module (guix profiles)
+  #:use-module (guix channels)
+  #:use-module (guix monads)
+  #:use-module (guix store)
+  #:use-module (guix derivations)
+  #:use-module (guix base32)
+  #:use-module (gcrypt hash)
+  #:autoload   (guix cache) (maybe-remove-expired-cache-entries)
+  #:autoload   (guix ui) (show-what-to-build*)
+  #:autoload   (guix build utils) (mkdir-p)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
+  #:autoload   (ice-9 ftw) (scandir)
   #:use-module (ice-9 match)
   #:use-module (ice-9 popen)
+  #:use-module (ice-9 vlist)
+  #:use-module (ice-9 binary-ports)
+  #:use-module ((rnrs bytevectors) #:select (string->utf8))
   #:export (inferior?
             open-inferior
             close-inferior
             inferior-eval
             inferior-object?
 
+            inferior-packages
+            lookup-inferior-packages
+
             inferior-package?
             inferior-package-name
             inferior-package-version
-
-            inferior-packages
             inferior-package-synopsis
             inferior-package-description
             inferior-package-home-page
-            inferior-package-location))
+            inferior-package-location
+            inferior-package-inputs
+            inferior-package-native-inputs
+            inferior-package-propagated-inputs
+            inferior-package-transitive-propagated-inputs
+            inferior-package-native-search-paths
+            inferior-package-transitive-native-search-paths
+            inferior-package-search-paths
+            inferior-package-derivation
+
+            inferior-package->manifest-entry
+
+            %inferior-cache-directory
+            inferior-for-channels))
 
 ;;; Commentary:
 ;;;
@@ -48,11 +92,13 @@
 
 ;; Inferior Guix process.
 (define-record-type <inferior>
-  (inferior pid socket version)
+  (inferior pid socket version packages table)
   inferior?
   (pid      inferior-pid)
   (socket   inferior-socket)
-  (version  inferior-version))                    ;REPL protocol version
+  (version  inferior-version)                    ;REPL protocol version
+  (packages inferior-package-promise)            ;promise of inferior packages
+  (table    inferior-package-table))             ;promise of vhash
 
 (define (inferior-pipe directory command)
   "Return an input/output pipe on the Guix instance in DIRECTORY.  This runs
@@ -96,9 +142,12 @@ equivalent.  Return #f if the inferior could not be launched."
 
   (match (read pipe)
     (('repl-version 0 rest ...)
-     (let ((result (inferior 'pipe pipe (cons 0 rest))))
+     (letrec ((result (inferior 'pipe pipe (cons 0 rest)
+                                (delay (%inferior-packages result))
+                                (delay (%inferior-package-table result)))))
        (inferior-eval '(use-modules (guix)) result)
        (inferior-eval '(use-modules (gnu)) result)
+       (inferior-eval '(use-modules (ice-9 match)) result)
        (inferior-eval '(define %package-table (make-hash-table))
                       result)
        result))
@@ -123,8 +172,7 @@ equivalent.  Return #f if the inferior could not be launched."
 
 (set-record-type-printer! <inferior-object> write-inferior-object)
 
-(define (inferior-eval exp inferior)
-  "Evaluate EXP in INFERIOR."
+(define (read-inferior-response inferior)
   (define sexp->object
     (match-lambda
       (('value value)
@@ -132,14 +180,21 @@ equivalent.  Return #f if the inferior could not be launched."
       (('non-self-quoting address string)
        (inferior-object address string))))
 
-  (write exp (inferior-socket inferior))
-  (newline (inferior-socket inferior))
   (match (read (inferior-socket inferior))
     (('values objects ...)
      (apply values (map sexp->object objects)))
     (('exception key objects ...)
      (apply throw key (map sexp->object objects)))))
 
+(define (send-inferior-request exp inferior)
+  (write exp (inferior-socket inferior))
+  (newline (inferior-socket inferior)))
+
+(define (inferior-eval exp inferior)
+  "Evaluate EXP in INFERIOR."
+  (send-inferior-request exp inferior)
+  (read-inferior-response inferior))
+
 
 ;;;
 ;;; Inferior packages.
@@ -162,8 +217,8 @@ equivalent.  Return #f if the inferior could not be launched."
 
 (set-record-type-printer! <inferior-package> write-inferior-package)
 
-(define (inferior-packages inferior)
-  "Return the list of packages known to INFERIOR."
+(define (%inferior-packages inferior)
+  "Compute the list of inferior packages from INFERIOR."
   (let ((result (inferior-eval
                  '(fold-packages (lambda (package result)
                                    (let ((id (object-address package)))
@@ -179,6 +234,33 @@ equivalent.  Return #f if the inferior could not be launched."
             (inferior-package inferior name version id)))
          result)))
 
+(define (inferior-packages inferior)
+  "Return the list of packages known to INFERIOR."
+  (force (inferior-package-promise inferior)))
+
+(define (%inferior-package-table inferior)
+  "Compute a package lookup table for INFERIOR."
+  (fold (lambda (package table)
+          (vhash-cons (inferior-package-name package) package
+                      table))
+        vlist-null
+        (inferior-packages inferior)))
+
+(define* (lookup-inferior-packages inferior name #:optional version)
+  "Return the sorted list of inferior packages matching NAME in INFERIOR, with
+highest version numbers first.  If VERSION is true, return only packages with
+a version number prefixed by VERSION."
+  ;; This is the counterpart of 'find-packages-by-name'.
+  (sort (filter (lambda (package)
+                  (or (not version)
+                      (version-prefix? version
+                                       (inferior-package-version package))))
+                (vhash-fold* cons '() name
+                             (force (inferior-package-table inferior))))
+        (lambda (p1 p2)
+          (version>? (inferior-package-version p1)
+                     (inferior-package-version p2)))))
+
 (define (inferior-package-field package getter)
   "Return the field of PACKAGE, an inferior package, accessed with GETTER."
   (let ((inferior (inferior-package-inferior package))
@@ -216,3 +298,261 @@ record."
                                             (location->source-properties
                                              loc)))
                                      package-location))))
+
+(define (inferior-package-input-field package field)
+  "Return the input field FIELD (e.g., 'native-inputs') of PACKAGE, an
+inferior package."
+  (define field*
+    `(compose (lambda (inputs)
+                (map (match-lambda
+                       ;; XXX: Origins are not handled.
+                       ((label (? package? package) rest ...)
+                        (let ((id (object-address package)))
+                          (hashv-set! %package-table id package)
+                          `(,label (package ,id
+                                            ,(package-name package)
+                                            ,(package-version package))
+                                   ,@rest)))
+                       (x
+                        x))
+                     inputs))
+              ,field))
+
+  (define inputs
+    (inferior-package-field package field*))
+
+  (define inferior
+    (inferior-package-inferior package))
+
+  (map (match-lambda
+         ((label ('package id name version) . rest)
+          ;; XXX: eq?-ness of inferior packages is not preserved here.
+          `(,label ,(inferior-package inferior name version id)
+                   ,@rest))
+         (x x))
+       inputs))
+
+(define inferior-package-inputs
+  (cut inferior-package-input-field <> 'package-inputs))
+
+(define inferior-package-native-inputs
+  (cut inferior-package-input-field <> 'package-native-inputs))
+
+(define inferior-package-propagated-inputs
+  (cut inferior-package-input-field <> 'package-propagated-inputs))
+
+(define inferior-package-transitive-propagated-inputs
+  (cut inferior-package-input-field <> 'package-transitive-propagated-inputs))
+
+(define (%inferior-package-search-paths package field)
+  "Return the list of search path specificiations of PACKAGE, an inferior
+package."
+  (define paths
+    (inferior-package-field package
+                            `(compose (lambda (paths)
+                                        (map (@ (guix search-paths)
+                                                search-path-specification->sexp)
+                                             paths))
+                                      ,field)))
+
+  (map sexp->search-path-specification paths))
+
+(define inferior-package-native-search-paths
+  (cut %inferior-package-search-paths <> 'package-native-search-paths))
+
+(define inferior-package-search-paths
+  (cut %inferior-package-search-paths <> 'package-search-paths))
+
+(define inferior-package-transitive-native-search-paths
+  (cut %inferior-package-search-paths <> 'package-transitive-native-search-paths))
+
+(define (proxy client backend)                    ;adapted from (guix ssh)
+  "Proxy communication between CLIENT and BACKEND until CLIENT closes the
+connection, at which point CLIENT is closed (both CLIENT and BACKEND must be
+input/output ports.)"
+  (define (select* read write except)
+    ;; This is a workaround for <https://bugs.gnu.org/30365> in Guile < 2.2.4:
+    ;; since 'select' sometimes returns non-empty sets for no good reason,
+    ;; call 'select' a second time with a zero timeout to filter out incorrect
+    ;; replies.
+    (match (select read write except)
+      ((read write except)
+       (select read write except 0))))
+
+  ;; Use buffered ports so that 'get-bytevector-some' returns up to the
+  ;; whole buffer like read(2) would--see <https://bugs.gnu.org/30066>.
+  (setvbuf client _IOFBF 65536)
+  (setvbuf backend _IOFBF 65536)
+
+  (let loop ()
+    (match (select* (list client backend) '() '())
+      ((reads () ())
+       (when (memq client reads)
+         (match (get-bytevector-some client)
+           ((? eof-object?)
+            (close-port client))
+           (bv
+            (put-bytevector backend bv)
+            (force-output backend))))
+       (when (memq backend reads)
+         (match (get-bytevector-some backend)
+           (bv
+            (put-bytevector client bv)
+            (force-output client))))
+       (unless (port-closed? client)
+         (loop))))))
+
+(define* (inferior-package-derivation store package
+                                      #:optional
+                                      (system (%current-system))
+                                      #:key target)
+  "Return the derivation for PACKAGE, an inferior package, built for SYSTEM
+and cross-built for TARGET if TARGET is true.  The inferior corresponding to
+PACKAGE must be live."
+  ;; Create a named socket in /tmp and let the inferior of PACKAGE connect to
+  ;; it and use it as its store.  This ensures the inferior uses the same
+  ;; store, with the same options, the same per-session GC roots, etc.
+  (call-with-temporary-directory
+   (lambda (directory)
+     (chmod directory #o700)
+     (let* ((name     (string-append directory "/inferior"))
+            (socket   (socket AF_UNIX SOCK_STREAM 0))
+            (inferior (inferior-package-inferior package))
+            (major    (nix-server-major-version store))
+            (minor    (nix-server-minor-version store))
+            (proto    (logior major minor)))
+       (bind socket AF_UNIX name)
+       (listen socket 1024)
+       (send-inferior-request
+        `(let ((socket (socket AF_UNIX SOCK_STREAM 0)))
+           (connect socket AF_UNIX ,name)
+
+           ;; 'port->connection' appeared in June 2018 and we can hardly
+           ;; emulate it on older versions.  Thus fall back to
+           ;; 'open-connection', at the risk of talking to the wrong daemon or
+           ;; having our build result reclaimed (XXX).
+           (let* ((store   (if (defined? 'port->connection)
+                               (port->connection socket #:version ,proto)
+                               (open-connection)))
+                  (package (hashv-ref %package-table
+                                      ,(inferior-package-id package)))
+                  (drv     ,(if target
+                                `(package-cross-derivation store package
+                                                           ,target
+                                                           ,system)
+                                `(package-derivation store package
+                                                     ,system))))
+             (close-connection store)
+             (close-port socket)
+             (derivation-file-name drv)))
+        inferior)
+       (match (accept socket)
+         ((client . address)
+          (proxy client (nix-server-socket store))))
+       (close-port socket)
+       (read-derivation-from-file (read-inferior-response inferior))))))
+
+(define inferior-package->derivation
+  (store-lift inferior-package-derivation))
+
+(define-gexp-compiler (package-compiler (package <inferior-package>) system
+                                        target)
+  ;; Compile PACKAGE for SYSTEM, optionally cross-building for TARGET.
+  (inferior-package->derivation package system #:target target))
+
+
+;;;
+;;; Manifest entries.
+;;;
+
+(define* (inferior-package->manifest-entry package
+                                           #:optional (output "out")
+                                           #:key (parent (delay #f))
+                                           (properties '()))
+  "Return a manifest entry for the OUTPUT of package PACKAGE."
+  ;; For each dependency, keep a promise pointing to its "parent" entry.
+  (letrec* ((deps  (map (match-lambda
+                          ((label package)
+                           (inferior-package->manifest-entry package
+                                                             #:parent (delay entry)))
+                          ((label package output)
+                           (inferior-package->manifest-entry package output
+                                                             #:parent (delay entry))))
+                        (inferior-package-propagated-inputs package)))
+            (entry (manifest-entry
+                     (name (inferior-package-name package))
+                     (version (inferior-package-version package))
+                     (output output)
+                     (item package)
+                     (dependencies (delete-duplicates deps))
+                     (search-paths
+                      (inferior-package-transitive-native-search-paths package))
+                     (parent parent)
+                     (properties properties))))
+    entry))
+
+
+;;;
+;;; Cached inferiors.
+;;;
+
+(define %inferior-cache-directory
+  ;; Directory for cached inferiors (GC roots).
+  (make-parameter (string-append (cache-directory #:ensure? #f)
+                                 "/inferiors")))
+
+(define* (inferior-for-channels channels
+                                #:key
+                                (cache-directory (%inferior-cache-directory))
+                                (ttl (* 3600 24 30)))
+  "Return an inferior for CHANNELS, a list of channels.  Use the cache at
+CACHE-DIRECTORY, where entries can be reclaimed after TTL seconds.  This
+procedure opens a new connection to the build daemon.
+
+This is a convenience procedure that people may use in manifests passed to
+'guix package -m', for instance."
+  (with-store store
+    (let ()
+      (define instances
+        (latest-channel-instances store channels))
+
+      (define key
+        (bytevector->base32-string
+         (sha256
+          (string->utf8
+           (string-concatenate (map channel-instance-commit instances))))))
+
+      (define cached
+        (string-append cache-directory "/" key))
+
+      (define (base32-encoded-sha256? str)
+        (= (string-length str) 52))
+
+      (define (cache-entries directory)
+        (map (lambda (file)
+               (string-append directory "/" file))
+             (scandir directory base32-encoded-sha256?)))
+
+      (define symlink*
+        (lift2 symlink %store-monad))
+
+      (define add-indirect-root*
+        (store-lift add-indirect-root))
+
+      (mkdir-p cache-directory)
+      (maybe-remove-expired-cache-entries cache-directory
+                                          cache-entries
+                                          #:entry-expiration
+                                          (file-expiration-time ttl))
+
+      (if (file-exists? cached)
+          (open-inferior cached)
+          (run-with-store store
+            (mlet %store-monad ((profile
+                                 (channel-instances->derivation instances)))
+              (mbegin %store-monad
+                (show-what-to-build* (list profile))
+                (built-derivations (list profile))
+                (symlink* (derivation->output-path profile) cached)
+                (add-indirect-root* cached)
+                (return (open-inferior cached)))))))))
diff --git a/guix/profiles.scm b/guix/profiles.scm
index 8acfcff8c1..669ebe04e5 100644
--- a/guix/profiles.scm
+++ b/guix/profiles.scm
@@ -314,12 +314,31 @@ file name."
   "Return a list of manifest entries, one for each item listed in PACKAGES.
 Elements of PACKAGES can be either package objects or package/string tuples
 denoting a specific output of a package."
+  (define inferiors-loaded?
+    ;; This hack allows us to provide seamless integration for inferior
+    ;; packages while not having a hard dependency on (guix inferior).
+    (resolve-module '(guix inferior) #f #f #:ensure #f))
+
+  (define (inferior->entry)
+    (module-ref (resolve-interface '(guix inferior))
+                'inferior-package->manifest-entry))
+
   (manifest
    (map (match-lambda
-         ((package output)
-          (package->manifest-entry package output))
-         ((? package? package)
-          (package->manifest-entry package)))
+          ((package output)
+           (package->manifest-entry package output))
+          ((? package? package)
+           (package->manifest-entry package))
+          ((thing output)
+           (if inferiors-loaded?
+               ((inferior->entry) thing output)
+               (throw 'wrong-type-arg 'packages->manifest
+                      "Wrong package object: ~S" (list thing) (list thing))))
+          (thing
+           (if inferiors-loaded?
+               ((inferior->entry) thing)
+               (throw 'wrong-type-arg 'packages->manifest
+                      "Wrong package object: ~S" (list thing) (list thing)))))
         packages)))
 
 (define (manifest->gexp manifest)
diff --git a/guix/progress.scm b/guix/progress.scm
index c9c3cd12a0..53aea1c56d 100644
--- a/guix/progress.scm
+++ b/guix/progress.scm
@@ -70,11 +70,11 @@ stopped."
     (($ <progress-reporter> start report stop)
      (start))))
 
-(define (progress-reporter-report! reporter)
+(define (progress-reporter-report! reporter . args)
   "Low-level procedure to lead REPORTER to emit a report."
   (match reporter
     (($ <progress-reporter> start report stop)
-     (report))))
+     (apply report args))))
 
 (define (stop-progress-reporter! reporter)
   "Low-level procedure to stop REPORTER."
diff --git a/guix/scripts/pull.scm b/guix/scripts/pull.scm
index 10e1a99e54..39aebb18e2 100644
--- a/guix/scripts/pull.scm
+++ b/guix/scripts/pull.scm
@@ -180,9 +180,25 @@ Download and deploy the latest version of Guix.\n"))
 
 (define (honor-x509-certificates store)
   "Use the right X.509 certificates for Git checkouts over HTTPS."
-  (let ((file      (getenv "SSL_CERT_FILE"))
+  ;; On distros such as CentOS 7, /etc/ssl/certs contains only a couple of
+  ;; files (instead of all the certificates) among which "ca-bundle.crt".  On
+  ;; other distros /etc/ssl/certs usually contains the whole set of
+  ;; certificates along with "ca-certificates.crt".  Try to choose the right
+  ;; one.
+  (let ((file      (letrec-syntax ((choose
+                                    (syntax-rules ()
+                                      ((_ file rest ...)
+                                       (let ((f file))
+                                         (if (and f (file-exists? f))
+                                             f
+                                             (choose rest ...))))
+                                      ((_)
+                                       #f))))
+                     (choose (getenv "SSL_CERT_FILE")
+                             "/etc/ssl/certs/ca-certificates.crt"
+                             "/etc/ssl/certs/ca-bundle.crt")))
         (directory (or (getenv "SSL_CERT_DIR") "/etc/ssl/certs")))
-    (if (or (and file (file-exists? file))
+    (if (or file
             (and=> (stat directory #f)
                    (lambda (st)
                      (> (stat:nlink st) 2))))
diff --git a/guix/scripts/substitute.scm b/guix/scripts/substitute.scm
index 6d31dfdaa4..50c6a22064 100755
--- a/guix/scripts/substitute.scm
+++ b/guix/scripts/substitute.scm
@@ -837,8 +837,8 @@ REPORTER, which should be a <progress-reporter> object."
        (make-custom-binary-input-port "progress-port-proc"
                                       read! #f #f
                                       (lambda ()
-                                        (close-connection port)
-                                        (stop)))))))
+                                        (stop)
+                                        (close-port port)))))))
 
 (define-syntax with-networking
   (syntax-rules ()
diff --git a/guix/serialization.scm b/guix/serialization.scm
index 129374f541..87ad7eeec0 100644
--- a/guix/serialization.scm
+++ b/guix/serialization.scm
@@ -301,8 +301,7 @@ result of 'lstat'; exclude entries for which SELECT? does not return true."
                      (filter-map (lambda (base)
                                    (let ((file (string-append directory
                                                               "/" base)))
-                                     (and (not (member base '("." "..")))
-                                          (select? file (lstat file))
+                                     (and (select? file (lstat file))
                                           base)))
                                  basenames))
 
diff --git a/guix/store/database.scm b/guix/store/database.scm
index 0879a95d0b..341276bc30 100644
--- a/guix/store/database.scm
+++ b/guix/store/database.scm
@@ -23,6 +23,7 @@
   #:use-module (guix serialization)
   #:use-module (guix store deduplication)
   #:use-module (guix base16)
+  #:use-module (guix progress)
   #:use-module (guix build syscalls)
   #:use-module ((guix build utils)
                 #:select (mkdir-p executable-file?))
@@ -234,7 +235,8 @@ be used internally by the daemon's build hook."
                   #:prefix prefix #:state-directory state-directory
                   #:deduplicate? deduplicate?
                   #:reset-timestamps? reset-timestamps?
-                  #:schema schema))
+                  #:schema schema
+                  #:log-port (%make-void-port "w")))
 
 (define %epoch
   ;; When it all began.
@@ -245,12 +247,14 @@ be used internally by the daemon's build hook."
                          (deduplicate? #t)
                          (reset-timestamps? #t)
                          registration-time
-                         (schema (sql-schema)))
+                         (schema (sql-schema))
+                         (log-port (current-error-port)))
   "Register all of ITEMS, a list of <store-info> records as returned by
 'read-reference-graph', in the database under PREFIX/STATE-DIRECTORY.  ITEMS
 must be in topological order (with leaves first.)  If the database is
 initially empty, apply SCHEMA to initialize it.  REGISTRATION-TIME must be the
-registration time to be recorded in the database; #f means \"now\"."
+registration time to be recorded in the database; #f means \"now\".
+Write a progress report to LOG-PORT."
 
   ;; Priority for options: first what is given, then environment variables,
   ;; then defaults. %state-directory, %store-directory, and
@@ -286,20 +290,32 @@ registration time to be recorded in the database; #f means \"now\"."
     (define real-file-name
       (string-append store-dir "/" (basename (store-info-item item))))
 
-    (let-values (((hash nar-size) (nar-sha256 real-file-name)))
+    ;; When TO-REGISTER is already registered, skip it.  This makes a
+    ;; significant differences when 'register-closures' is called
+    ;; consecutively for overlapping closures such as 'system' and 'bootcfg'.
+    (unless (path-id db to-register)
       (when reset-timestamps?
         (reset-timestamps real-file-name))
-      (sqlite-register db #:path to-register
-                       #:references (store-info-references item)
-                       #:deriver (store-info-deriver item)
-                       #:hash (string-append "sha256:"
-                                             (bytevector->base16-string hash))
-                       #:nar-size nar-size
-                       #:time registration-time)
-      (when deduplicate?
-        (deduplicate real-file-name hash #:store store-dir))))
+      (let-values (((hash nar-size) (nar-sha256 real-file-name)))
+        (sqlite-register db #:path to-register
+                         #:references (store-info-references item)
+                         #:deriver (store-info-deriver item)
+                         #:hash (string-append "sha256:"
+                                               (bytevector->base16-string hash))
+                         #:nar-size nar-size
+                         #:time registration-time)
+        (when deduplicate?
+          (deduplicate real-file-name hash #:store store-dir)))))
 
   (mkdir-p db-dir)
   (parameterize ((sql-schema schema))
     (with-database (string-append db-dir "/db.sqlite") db
-      (for-each (cut register db <>) items))))
+      (let* ((prefix   (format #f "registering ~a items" (length items)))
+             (progress (progress-reporter/bar (length items)
+                                              prefix log-port)))
+        (call-with-progress-reporter progress
+          (lambda (report)
+            (for-each (lambda (item)
+                        (register db item)
+                        (report))
+                      items)))))))
diff --git a/tests/guix-package.sh b/tests/guix-package.sh
index cef3b3452e..f7dfbfad00 100644
--- a/tests/guix-package.sh
+++ b/tests/guix-package.sh
@@ -358,6 +358,21 @@ EOF
 guix package --bootstrap -m "$module_dir/manifest.scm"
 guix package -I | grep guile
 test `guix package -I | wc -l` -eq 1
+guix package --rollback --bootstrap
+
+# Applying a manifest file with inferior packages.
+cat > "$module_dir/manifest.scm"<<EOF
+(use-modules (guix inferior))
+
+(define i
+  (open-inferior "$abs_top_srcdir" #:command "scripts/guix"))
+
+(let ((guile (car (lookup-inferior-packages i "guile-bootstrap"))))
+  (packages->manifest (list guile)))
+EOF
+guix package --bootstrap -m "$module_dir/manifest.scm"
+guix package -I | grep guile
+test `guix package -I | wc -l` -eq 1
 
 # Error reporting.
 cat > "$module_dir/manifest.scm"<<EOF
diff --git a/tests/inferior.scm b/tests/inferior.scm
index ff5cad4210..d1d5c00a77 100644
--- a/tests/inferior.scm
+++ b/tests/inferior.scm
@@ -17,11 +17,18 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (test-inferior)
+  #:use-module (guix tests)
   #:use-module (guix inferior)
   #:use-module (guix packages)
+  #:use-module (guix store)
+  #:use-module (guix profiles)
+  #:use-module (guix derivations)
   #:use-module (gnu packages)
+  #:use-module (gnu packages bootstrap)
+  #:use-module (gnu packages guile)
   #:use-module (srfi srfi-1)
-  #:use-module (srfi srfi-64))
+  #:use-module (srfi srfi-64)
+  #:use-module (ice-9 match))
 
 (define %top-srcdir
   (dirname (search-path %load-path "guix.scm")))
@@ -29,6 +36,16 @@
 (define %top-builddir
   (dirname (search-path %load-compiled-path "guix.go")))
 
+(define %store
+  (open-connection-for-tests))
+
+(define (manifest-entry->list entry)
+  (list (manifest-entry-name entry)
+        (manifest-entry-version entry)
+        (manifest-entry-output entry)
+        (manifest-entry-search-paths entry)
+        (map manifest-entry->list (manifest-entry-dependencies entry))))
+
 
 (test-begin "inferior")
 
@@ -72,4 +89,108 @@
            (close-inferior inferior)
            result))))
 
+(test-equal "lookup-inferior-packages"
+  (let ((->list (lambda (package)
+                  (list (package-name package)
+                        (package-version package)
+                        (package-location package)))))
+    (list (map ->list (find-packages-by-name "guile" #f))
+          (map ->list (find-packages-by-name "guile" "2.2"))))
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (->list   (lambda (package)
+                     (list (inferior-package-name package)
+                           (inferior-package-version package)
+                           (inferior-package-location package))))
+         (lst1     (map ->list
+                        (lookup-inferior-packages inferior "guile")))
+         (lst2     (map ->list
+                        (lookup-inferior-packages inferior
+                                                  "guile" "2.2"))))
+    (close-inferior inferior)
+    (list lst1 lst2)))
+
+(test-assert "lookup-inferior-packages and eq?-ness"
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (lst1     (lookup-inferior-packages inferior "guile"))
+         (lst2     (lookup-inferior-packages inferior "guile")))
+    (close-inferior inferior)
+    (every eq? lst1 lst2)))
+
+(test-equal "inferior-package-inputs"
+  (let ((->list (match-lambda
+                  ((label (? package? package) . rest)
+                   `(,label
+                     (package ,(package-name package)
+                              ,(package-version package)
+                              ,(package-location package))
+                     ,@rest)))))
+    (list (map ->list (package-inputs guile-2.2))
+          (map ->list (package-native-inputs guile-2.2))
+          (map ->list (package-propagated-inputs guile-2.2))))
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (guile    (first (lookup-inferior-packages inferior "guile")))
+         (->list   (match-lambda
+                     ((label (? inferior-package? package) . rest)
+                      `(,label
+                        (package ,(inferior-package-name package)
+                                 ,(inferior-package-version package)
+                                 ,(inferior-package-location package))
+                        ,@rest))))
+         (result   (list (map ->list (inferior-package-inputs guile))
+                         (map ->list
+                              (inferior-package-native-inputs guile))
+                         (map ->list
+                              (inferior-package-propagated-inputs
+                               guile)))))
+    (close-inferior inferior)
+    result))
+
+(test-equal "inferior-package-search-paths"
+  (package-native-search-paths guile-2.2)
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (guile    (first (lookup-inferior-packages inferior "guile")))
+         (result   (inferior-package-native-search-paths guile)))
+    (close-inferior inferior)
+    result))
+
+(test-equal "inferior-package-derivation"
+  (map derivation-file-name
+       (list (package-derivation %store %bootstrap-guile "x86_64-linux")
+             (package-derivation %store %bootstrap-guile "armhf-linux")))
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (packages (inferior-packages inferior))
+         (guile    (find (lambda (package)
+                           (string=? (package-name %bootstrap-guile)
+                                     (inferior-package-name package)))
+                         packages)))
+    (map derivation-file-name
+         (list (inferior-package-derivation %store guile "x86_64-linux")
+               (inferior-package-derivation %store guile "armhf-linux")))))
+
+(test-equal "inferior-package->manifest-entry"
+  (manifest-entry->list (package->manifest-entry
+                         (first (find-best-packages-by-name "guile" #f))))
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (guile    (first (lookup-inferior-packages inferior "guile")))
+         (entry    (inferior-package->manifest-entry guile)))
+    (close-inferior inferior)
+    (manifest-entry->list entry)))
+
+(test-equal "packages->manifest"
+  (map manifest-entry->list
+       (manifest-entries (packages->manifest
+                          (find-best-packages-by-name "guile" #f))))
+  (let* ((inferior (open-inferior %top-builddir
+                                  #:command "scripts/guix"))
+         (guile    (first (lookup-inferior-packages inferior "guile")))
+         (manifest (packages->manifest (list guile))))
+    (close-inferior inferior)
+    (map manifest-entry->list (manifest-entries manifest))))
+
 (test-end "inferior")