Merge remote-tracking branch 'origin/master' into wip-texlive

107 files changed, 5177 insertions, 1444 deletions

diff --git a/Makefile.am b/Makefile.am
index 7fa51d17ac..0bd85e8fcf 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -249,6 +249,7 @@ MODULES =					\
   guix/scripts/describe.scm			\
   guix/scripts/system.scm			\
   guix/scripts/system/search.scm		\
+  guix/scripts/system/reconfigure.scm		\
   guix/scripts/lint.scm				\
   guix/scripts/challenge.scm			\
   guix/scripts/import/crate.scm			\
diff --git a/configure.ac b/configure.ac
index 3918550a79..689b28d984 100644
--- a/configure.ac
+++ b/configure.ac
@@ -119,8 +119,8 @@ if test "x$have_guile_git" != "xyes"; then
 fi
 
 dnl Check for Guile-JSON.
-GUILE_MODULE_AVAILABLE([have_guile_json], [(json)])
-if test "x$have_guile_json" != "xyes"; then
+GUIX_CHECK_GUILE_JSON
+if test "x$guix_cv_have_recent_guile_json" != "xyes"; then
   AC_MSG_ERROR([Guile-JSON is missing; please install it.])
 fi
 
diff --git a/doc/guix.texi b/doc/guix.texi
index 8c5fa5f741..cb60d5c7b7 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -28,7 +28,7 @@ Copyright @copyright{} 2014, 2015, 2016 Alex Kost@*
 Copyright @copyright{} 2015, 2016 Mathieu Lirzin@*
 Copyright @copyright{} 2014 Pierre-Antoine Rault@*
 Copyright @copyright{} 2015 Taylan Ulrich Bayırlı/Kammer@*
-Copyright @copyright{} 2015, 2016, 2017 Leo Famulari@*
+Copyright @copyright{} 2015, 2016, 2017, 2019 Leo Famulari@*
 Copyright @copyright{} 2015, 2016, 2017, 2018, 2019 Ricardo Wurmus@*
 Copyright @copyright{} 2016 Ben Woodcroft@*
 Copyright @copyright{} 2016, 2017, 2018 Chris Marusich@*
@@ -564,6 +564,10 @@ $ wget @value{OPENPGP-SIGNING-KEY-URL} \
 
 @noindent
 and rerun the @code{gpg --verify} command.
+
+Take note that a warning like ``This key is not certified with a trusted
+signature!'' is normal.
+
 @c end authentication part
 
 @item
@@ -746,7 +750,7 @@ or later;
 @c FIXME: Specify a version number once a release has been made.
 @uref{https://gitlab.com/guile-git/guile-git, Guile-Git}, from August
 2017 or later;
-@item @uref{https://savannah.nongnu.org/projects/guile-json/, Guile-JSON};
+@item @uref{https://savannah.nongnu.org/projects/guile-json/, Guile-JSON} 3.x;
 @item @url{https://zlib.net, zlib};
 @item @url{https://www.gnu.org/software/make/, GNU Make}.
 @end itemize
@@ -1911,6 +1915,10 @@ $ wget @value{OPENPGP-SIGNING-KEY-URL} \
 
 @noindent
 and rerun the @code{gpg --verify} command.
+
+Take note that a warning like ``This key is not certified with a trusted
+signature!'' is normal.
+
 @c end duplication
 
 This image contains the tools necessary for an installation.
@@ -5846,8 +5854,11 @@ should be added to the package definition via the
 
 In its @code{configure} phase, this build system will make any source inputs
 specified in the @code{#:cargo-inputs} and @code{#:cargo-development-inputs}
-parameters available to cargo.  The @code{install} phase installs any crate
-the binaries if they are defined by the crate.
+parameters available to cargo.  The @code{update-cargo-lock} phase will,
+when there is a @code{Cargo.lock} file, update the @code{Cargo.lock} file
+with the inputs and their versions available at build time.  The
+@code{install} phase installs any crate the binaries if they are defined by
+the crate.
 @end defvr
 
 @cindex Clojure (programming language)
@@ -7431,7 +7442,8 @@ This is the declarative counterpart of @code{gexp->derivation}.
 @end deffn
 
 @deffn {Monadic Procedure} gexp->script @var{name} @var{exp} @
-  [#:guile (default-guile)] [#:module-path %load-path]
+  [#:guile (default-guile)] [#:module-path %load-path] @
+  [#:system (%current-system)] [#:target #f]
 Return an executable script @var{name} that runs @var{exp} using
 @var{guile}, with @var{exp}'s imported modules in its search path.
 Look up @var{exp}'s modules in @var{module-path}.
@@ -8040,7 +8052,7 @@ guix build --with-branch=guile-sqlite3=master cuirass
 @item --with-commit=@var{package}=@var{commit}
 This is similar to @code{--with-branch}, except that it builds from
 @var{commit} rather than the tip of a branch.  @var{commit} must be a valid
-Git commit SHA1 identifier.
+Git commit SHA1 identifier or a tag.
 @end table
 
 @node Additional Build Options
diff --git a/gnu/installer.scm b/gnu/installer.scm
index 1452c4dc7e..15d971dfc4 100644
--- a/gnu/installer.scm
+++ b/gnu/installer.scm
@@ -69,7 +69,7 @@ version of this file."
         (setlocale LC_ALL "en_US.utf8")))
 
   (define builder
-    (with-extensions (list guile-json)
+    (with-extensions (list guile-json-3)
       (with-imported-modules (source-module-closure
                               '((gnu installer locale)))
         #~(begin
@@ -313,7 +313,7 @@ selected keymap."
     ;; packages …), etc. modules.
     (with-extensions (list guile-gcrypt guile-newt
                            guile-parted guile-bytestructures
-                           guile-json guile-git guix)
+                           guile-json-3 guile-git guix)
       (with-imported-modules `(,@(source-module-closure
                                   `(,@modules
                                     (gnu services herd)
diff --git a/gnu/installer/locale.scm b/gnu/installer/locale.scm
index 13f3a1e881..ccffb6d8ef 100644
--- a/gnu/installer/locale.scm
+++ b/gnu/installer/locale.scm
@@ -134,16 +134,18 @@ ISO639-3 and ISO639-5 files."
         (lambda (port-iso639-5)
           (filter-map
            (lambda (hash)
-             (let ((alpha2 (hash-ref hash "alpha_2"))
-                   (alpha3 (hash-ref hash "alpha_3"))
-                   (name   (hash-ref hash "name")))
+             (let ((alpha2 (assoc-ref hash "alpha_2"))
+                   (alpha3 (assoc-ref hash "alpha_3"))
+                   (name   (assoc-ref hash "name")))
                (and (supported-locale? locales alpha2 alpha3)
                     `((alpha2 . ,alpha2)
                       (alpha3 . ,alpha3)
                       (name   . ,name)))))
            (append
-            (hash-ref (json->scm port-iso639-3) "639-3")
-            (hash-ref (json->scm port-iso639-5) "639-5"))))))))
+            (vector->list
+             (assoc-ref (json->scm port-iso639-3) "639-3"))
+            (vector->list
+             (assoc-ref (json->scm port-iso639-5) "639-5")))))))))
 
 (define (language-code->language-name languages language-code)
   "Using LANGUAGES as a list of ISO639 association lists, return the language
@@ -179,10 +181,11 @@ ISO3166 file."
   (call-with-input-file iso3166
     (lambda (port)
       (map (lambda (hash)
-             `((alpha2 . ,(hash-ref hash "alpha_2"))
-               (alpha3 . ,(hash-ref hash "alpha_3"))
-               (name   . ,(hash-ref hash "name"))))
-           (hash-ref (json->scm port) "3166-1")))))
+             `((alpha2 . ,(assoc-ref hash "alpha_2"))
+               (alpha3 . ,(assoc-ref hash "alpha_3"))
+               (name   . ,(assoc-ref hash "name"))))
+           (vector->list
+            (assoc-ref (json->scm port) "3166-1"))))))
 
 (define (territory-code->territory-name territories territory-code)
   "Using TERRITORIES as a list of ISO3166 association lists return the
diff --git a/gnu/local.mk b/gnu/local.mk
index eb3b0dcd3b..42e79e879a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -597,6 +597,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/tests/mail.scm				\
   %D%/tests/messaging.scm			\
   %D%/tests/networking.scm			\
+  %D%/tests/reconfigure.scm			\
   %D%/tests/rsync.scm				\
   %D%/tests/security-token.scm			\
   %D%/tests/singularity.scm			\
@@ -756,6 +757,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/dfu-programmer-fix-libusb.patch		\
   %D%/packages/patches/diffutils-gets-undeclared.patch		\
   %D%/packages/patches/diffutils-getopt.patch			\
+  %D%/packages/patches/dkimproxy-add-ipv6-support.patch		\
   %D%/packages/patches/docbook-xsl-nonrecursive-string-subst.patch	\
   %D%/packages/patches/doc++-include-directives.patch		\
   %D%/packages/patches/doc++-segfault-fix.patch			\
@@ -770,6 +772,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/elfutils-tests-ptrace.patch		\
   %D%/packages/patches/elixir-path-length.patch			\
   %D%/packages/patches/einstein-build.patch			\
+  %D%/packages/patches/emacs-dired-toggle-sudo-emacs-26.patch   \
   %D%/packages/patches/emacs-exec-path.patch			\
   %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
   %D%/packages/patches/emacs-json-reformat-fix-tests.patch	\
@@ -1021,7 +1024,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/libotr-test-auth-fix.patch		\
   %D%/packages/patches/libmad-armv7-thumb-pt1.patch		\
   %D%/packages/patches/libmad-armv7-thumb-pt2.patch		\
-  %D%/packages/patches/libmad-frame-length.patch		\
+  %D%/packages/patches/libmad-length-check.patch		\
+  %D%/packages/patches/libmad-md_size.patch			\
   %D%/packages/patches/libmad-mips-newgcc.patch			\
   %D%/packages/patches/libmygpo-qt-fix-qt-5.11.patch		\
   %D%/packages/patches/libmygpo-qt-missing-qt5-modules.patch	\
@@ -1162,6 +1166,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/patchelf-rework-for-arm.patch		\
   %D%/packages/patches/patchutils-test-perms.patch		\
   %D%/packages/patches/patch-hurd-path-max.patch		\
+  %D%/packages/patches/pcre2-fix-jit_match-crash.patch		\
   %D%/packages/patches/perl-autosplit-default-time.patch	\
   %D%/packages/patches/perl-deterministic-ordering.patch	\
   %D%/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \
@@ -1301,6 +1306,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/soundconverter-remove-gconf-dependency.patch	\
   %D%/packages/patches/sssd-curl-compat.patch			\
   %D%/packages/patches/steghide-fixes.patch			\
+  %D%/packages/patches/strace-ipc-tests.patch			\
   %D%/packages/patches/streamlink-update-test.patch		\
   %D%/packages/patches/stumpwm-fix-broken-read-one-line.patch	\
   %D%/packages/patches/superlu-dist-awpm-grid.patch		\
diff --git a/gnu/machine/ssh.scm b/gnu/machine/ssh.scm
index 278d43c10f..552eafa9de 100644
--- a/gnu/machine/ssh.scm
+++ b/gnu/machine/ssh.scm
@@ -17,23 +17,21 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
 
 (define-module (gnu machine ssh)
-  #:use-module (gnu bootloader)
   #:use-module (gnu machine)
   #:autoload   (gnu packages gnupg) (guile-gcrypt)
-  #:use-module (gnu services)
-  #:use-module (gnu services shepherd)
   #:use-module (gnu system)
-  #:use-module (guix derivations)
   #:use-module (guix gexp)
   #:use-module (guix i18n)
   #:use-module (guix modules)
   #:use-module (guix monads)
   #:use-module (guix records)
   #:use-module (guix remote)
+  #:use-module (guix scripts system reconfigure)
   #:use-module (guix ssh)
   #:use-module (guix store)
   #:use-module (ice-9 match)
   #:use-module (srfi srfi-19)
+  #:use-module (srfi srfi-26)
   #:use-module (srfi srfi-35)
   #:export (managed-host-environment-type
 
@@ -105,118 +103,6 @@ an environment type of 'managed-host."
 ;;; System deployment.
 ;;;
 
-(define (switch-to-system machine)
-  "Monadic procedure creating a new generation on MACHINE and execute the
-activation script for the new system configuration."
-  (define (remote-exp drv script)
-    (with-extensions (list guile-gcrypt)
-      (with-imported-modules (source-module-closure '((guix config)
-                                                      (guix profiles)
-                                                      (guix utils)))
-        #~(begin
-            (use-modules (guix config)
-                         (guix profiles)
-                         (guix utils))
-
-            (define %system-profile
-              (string-append %state-directory "/profiles/system"))
-
-            (let* ((system #$drv)
-                   (number (1+ (generation-number %system-profile)))
-                   (generation (generation-file-name %system-profile number)))
-              (switch-symlinks generation system)
-              (switch-symlinks %system-profile generation)
-              ;; The implementation of 'guix system reconfigure' saves the
-              ;; load path and environment here. This is unnecessary here
-              ;; because each invocation of 'remote-eval' runs in a distinct
-              ;; Guile REPL.
-              (setenv "GUIX_NEW_SYSTEM" system)
-              ;; The activation script may write to stdout, which confuses
-              ;; 'remote-eval' when it attempts to read a result from the
-              ;; remote REPL. We work around this by forcing the output to a
-              ;; string.
-              (with-output-to-string
-                (lambda ()
-                  (primitive-load #$script))))))))
-
-  (let* ((os (machine-system machine))
-         (script (operating-system-activation-script os)))
-    (mlet* %store-monad ((drv (operating-system-derivation os)))
-      (machine-remote-eval machine (remote-exp drv script)))))
-
-;; XXX: Currently, this does NOT attempt to restart running services. This is
-;; also the case with 'guix system reconfigure'.
-;;
-;; See <https://issues.guix.info/issue/33508>.
-(define (upgrade-shepherd-services machine)
-  "Monadic procedure unloading and starting services on the remote as needed
-to realize the MACHINE's system configuration."
-  (define target-services
-    ;; Monadic expression evaluating to a list of (name output-path) pairs for
-    ;; all of MACHINE's services.
-    (mapm %store-monad
-          (lambda (service)
-            (mlet %store-monad ((file ((compose lower-object
-                                                shepherd-service-file)
-                                       service)))
-              (return (list (shepherd-service-canonical-name service)
-                            (derivation->output-path file)))))
-          (service-value
-           (fold-services (operating-system-services (machine-system machine))
-                          #:target-type shepherd-root-service-type))))
-
-  (define (remote-exp target-services)
-    (with-imported-modules '((gnu services herd))
-      #~(begin
-          (use-modules (gnu services herd)
-                       (srfi srfi-1))
-
-          (define running
-            (filter live-service-running (current-services)))
-
-          (define (essential? service)
-            ;; Return #t if SERVICE is essential and should not be unloaded
-            ;; under any circumstance.
-            (memq (first (live-service-provision service))
-                  '(root shepherd)))
-
-          (define (obsolete? service)
-            ;; Return #t if SERVICE can be safely unloaded.
-            (and (not (essential? service))
-                 (every (lambda (requirements)
-                          (not (memq (first (live-service-provision service))
-                                     requirements)))
-                        (map live-service-requirement running))))
-
-          (define to-unload
-            (filter obsolete?
-                    (remove (lambda (service)
-                              (memq (first (live-service-provision service))
-                                    (map first '#$target-services)))
-                            running)))
-
-          (define to-start
-            (remove (lambda (service-pair)
-                      (memq (first service-pair)
-                            (map (compose first live-service-provision)
-                                 running)))
-                    '#$target-services))
-
-          ;; Unload obsolete services.
-          (for-each (lambda (service)
-                      (false-if-exception
-                       (unload-service service)))
-                    to-unload)
-
-          ;; Load the service files for any new services and start them.
-          (load-services/safe (map second to-start))
-          (for-each start-service (map first to-start))
-
-          #t)))
-
-  (mlet %store-monad ((target-services target-services))
-    (machine-remote-eval machine (remote-exp target-services))))
-
 (define (machine-boot-parameters machine)
   "Monadic procedure returning a list of 'boot-parameters' for the generations
 of MACHINE's system profile, ordered from most recent to oldest."
@@ -275,71 +161,20 @@ of MACHINE's system profile, ordered from most recent to oldest."
                            (boot-parameters-kernel-arguments params))))))))
           generations))))
 
-(define (install-bootloader machine)
-  "Create a bootloader entry for the new system generation on MACHINE, and
-configure the bootloader to boot that generation by default."
-  (define bootloader-installer-script
-    (@@ (guix scripts system) bootloader-installer-script))
-
-  (define (remote-exp installer bootcfg bootcfg-file)
-    (with-extensions (list guile-gcrypt)
-      (with-imported-modules (source-module-closure '((gnu build install)
-                                                      (guix store)
-                                                      (guix utils)))
-        #~(begin
-            (use-modules (gnu build install)
-                         (guix store)
-                         (guix utils))
-            (let* ((gc-root (string-append "/" %gc-roots-directory "/bootcfg"))
-                   (temp-gc-root (string-append gc-root ".new")))
-
-              (switch-symlinks temp-gc-root gc-root)
-
-              (unless (false-if-exception
-                       (begin
-                         ;; The implementation of 'guix system reconfigure'
-                         ;; saves the load path here. This is unnecessary here
-                         ;; because each invocation of 'remote-eval' runs in a
-                         ;; distinct Guile REPL.
-                         (install-boot-config #$bootcfg #$bootcfg-file "/")
-                         ;; The installation script may write to stdout, which
-                         ;; confuses 'remote-eval' when it attempts to read a
-                         ;; result from the remote REPL. We work around this
-                         ;; by forcing the output to a string.
-                         (with-output-to-string
-                           (lambda ()
-                             (primitive-load #$installer)))))
-                (delete-file temp-gc-root)
-                (error "failed to install bootloader"))
-
-              (rename-file temp-gc-root gc-root)
-              #t)))))
-
-  (mlet* %store-monad ((boot-parameters (machine-boot-parameters machine)))
-    (let* ((os (machine-system machine))
-           (bootloader ((compose bootloader-configuration-bootloader
-                                 operating-system-bootloader)
-                        os))
-           (bootloader-target (bootloader-configuration-target
-                               (operating-system-bootloader os)))
-           (installer (bootloader-installer-script
-                       (bootloader-installer bootloader)
-                       (bootloader-package bootloader)
-                       bootloader-target
-                       "/"))
-           (menu-entries (map boot-parameters->menu-entry boot-parameters))
-           (bootcfg (operating-system-bootcfg os menu-entries))
-           (bootcfg-file (bootloader-configuration-file bootloader)))
-      (machine-remote-eval machine (remote-exp installer bootcfg bootcfg-file)))))
-
 (define (deploy-managed-host machine)
   "Internal implementation of 'deploy-machine' for MACHINE instances with an
 environment type of 'managed-host."
   (maybe-raise-unsupported-configuration-error machine)
-  (mbegin %store-monad
-    (switch-to-system machine)
-    (upgrade-shepherd-services machine)
-    (install-bootloader machine)))
+  (mlet %store-monad ((boot-parameters (machine-boot-parameters machine)))
+    (let* ((os (machine-system machine))
+           (eval (cut machine-remote-eval machine <>))
+           (menu-entries (map boot-parameters->menu-entry boot-parameters))
+           (bootloader-configuration (operating-system-bootloader os))
+           (bootcfg (operating-system-bootcfg os menu-entries)))
+      (mbegin %store-monad
+        (switch-to-system eval os)
+        (upgrade-shepherd-services eval os)
+        (install-bootloader eval bootloader-configuration bootcfg)))))
 
 
 ;;;
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 99f4d7aded..c3b1e04901 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -913,6 +913,51 @@ by bandwidth they use.")
                (base32
                 "0rmk2p3f2wz1h092anidjclh212rv3gxyk0c641qk3frlrjnw6mp"))))
     (build-system perl-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'refer-to-inputs
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* (list "lib/App/ClusterSSH/Config.pm"
+                                "t/15config.t")
+               (("xterm")
+                (which "xterm")))
+             #t))
+         (add-before 'check 'delete-failing-tests
+           (lambda _
+             ;; This checks whether all code is nicely formatted.  The above
+             ;; ‘refer-to-inputs’ phase breaks this pedantry, so disable it.
+             (delete-file "t/perltidy.t")
+             ;; Update the manifest so t/manifest.t happily passes.
+             (substitute* "MANIFEST"
+               (("t/perltidy.t\n") ""))
+             #t))
+         (add-after 'install 'augment-library-path
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin")))
+               (with-directory-excursion bin
+                 (for-each
+                  (lambda (program)
+                    (wrap-program program
+                      `("PERL5LIB" ":" prefix
+                        ,(map (lambda (file-name)
+                                (string-append file-name
+                                               "/lib/perl5/site_perl"))
+                              (cons out
+                                    (map (lambda (input)
+                                           (assoc-ref inputs input))
+                                         ;; These may be propagated and hence
+                                         ;; not explicitly listed as inputs.
+                                         (list "perl-class-data-inheritable"
+                                               "perl-devel-stacktrace"
+                                               "perl-exception-class"
+                                               "perl-tk"
+                                               "perl-try-tiny"
+                                               "perl-x11-protocol"
+                                               "perl-x11-protocol-other")))))))
+                  (find-files "." ".*")))
+               #t))))))
     (native-inputs
      `(("perl-cpan-changes" ,perl-cpan-changes)
        ("perl-file-slurp" ,perl-file-slurp)
@@ -926,13 +971,14 @@ by bandwidth they use.")
        ("perl-test-pod-coverage" ,perl-test-pod-coverage)
        ("perl-test-trap" ,perl-test-trap)
        ("perltidy" ,perltidy)))
-    (propagated-inputs
-     `(("xterm" ,xterm)
-       ("perl-exception-class" ,perl-exception-class)
+    (inputs
+     `(("perl-exception-class" ,perl-exception-class)
+       ("perl-sort-naturally" ,perl-sort-naturally)
        ("perl-tk" ,perl-tk)
        ("perl-try-tiny" ,perl-try-tiny)
        ("perl-x11-protocol" ,perl-x11-protocol)
-       ("perl-x11-protocol-other" ,perl-x11-protocol-other)))
+       ("perl-x11-protocol-other" ,perl-x11-protocol-other)
+       ("xterm" ,xterm)))
     ;; The clusterssh.sourceforge.net address requires login to view
     (home-page "https://sourceforge.net/projects/clusterssh/")
     (synopsis "Secure concurrent multi-server terminal control")
diff --git a/gnu/packages/algebra.scm b/gnu/packages/algebra.scm
index 88fca62e4e..fb9e78bf92 100644
--- a/gnu/packages/algebra.scm
+++ b/gnu/packages/algebra.scm
@@ -344,7 +344,7 @@ precision.")
 (define-public giac
   (package
     (name "giac")
-    (version "1.5.0-61")
+    (version "1.5.0-63")
     (source (origin
               (method url-fetch)
               ;; "~parisse/giac" is not used because the maintainer regularly
@@ -356,7 +356,7 @@ precision.")
                                   "source/giac_" version ".tar.gz"))
               (sha256
                (base32
-                "050vzpqq77fhky32sbisc0ysimgp60xjv39q7y45jkaabdkmclwh"))))
+                "1jp7awyp8j8w6fhn802z8ddbq1fxhkyk9xdf0mq0mm0chpkylwqk"))))
     (build-system gnu-build-system)
     (arguments
      `(#:modules ((ice-9 ftw)
diff --git a/gnu/packages/bioconductor.scm b/gnu/packages/bioconductor.scm
index e5a2d66b2d..74af02a47d 100644
--- a/gnu/packages/bioconductor.scm
+++ b/gnu/packages/bioconductor.scm
@@ -22,6 +22,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix build-system r)
   #:use-module (gnu packages)
   #:use-module (gnu packages base)
@@ -37,7 +38,8 @@
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages statistics)
-  #:use-module (gnu packages web))
+  #:use-module (gnu packages web)
+  #:use-module (srfi srfi-1))
 
 
 ;;; Annotations
@@ -865,6 +867,34 @@ which were then sequenced to a depth of ~4 million reads per library,
 resulting in a complete gene expression profile for each cell.")
     (license license:artistic2.0)))
 
+(define-public r-all
+  (package
+    (name "r-all")
+    (version "1.26.0")
+    (source (origin
+              (method url-fetch)
+              ;; We cannot use bioconductor-uri here because this tarball is
+              ;; located under "data/experiment/" instead of "bioc/".
+              (uri (string-append "https://www.bioconductor.org/packages/"
+                                  "release/data/experiment/src/contrib/"
+                                  "ALL_" version ".tar.gz"))
+              (sha256
+               (base32
+                "1z7kpjw4ndj6fkxwvhqf3gawhrn26ksrlns7j2c78qzxqmjndik9"))))
+    (properties `((upstream-name . "ALL")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-biobase" ,r-biobase)))
+    (home-page "https://bioconductor.org/packages/ALL")
+    (synopsis "Acute Lymphoblastic Leukemia data from the Ritz laboratory")
+    (description
+     "The data consist of microarrays from 128 different individuals with
+@dfn{acute lymphoblastic leukemia} (ALL).  A number of additional covariates
+are available.  The data have been normalized (using rma) and it is the
+jointly normalized data that are available here.  The data are presented in
+the form of an @code{exprSet} object.")
+    (license license:artistic2.0)))
+
 
 ;;; Packages
 
@@ -2235,6 +2265,68 @@ tasks on single cell expression data.  It is designed to work with RNA-Seq and
 qPCR data, but could be used with other types as well.")
     (license license:artistic2.0)))
 
+(define-public r-monocle3
+  (package
+    (name "r-monocle3")
+    (version "0.1.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/cole-trapnell-lab/monocle3.git")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "1cjxqfw3qvy269hsf5v80d4kshl932wrl949iayas02saj6f70ls"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-biobase" ,r-biobase)
+       ("r-biocgenerics" ,r-biocgenerics)
+       ("r-delayedmatrixstats" ,r-delayedmatrixstats)
+       ("r-dplyr" ,r-dplyr)
+       ("r-ggplot2" ,r-ggplot2)
+       ("r-ggrepel" ,r-ggrepel)
+       ("r-grr" ,r-grr)
+       ("r-htmlwidgets" ,r-htmlwidgets)
+       ("r-igraph" ,r-igraph)
+       ("r-irlba" ,r-irlba)
+       ("r-limma" ,r-limma)
+       ("r-lmtest" ,r-lmtest)
+       ("r-mass" ,r-mass)
+       ("r-matrix" ,r-matrix)
+       ("r-matrix-utils" ,r-matrix-utils)
+       ("r-pbapply" ,r-pbapply)
+       ("r-pbmcapply" ,r-pbmcapply)
+       ("r-pheatmap" ,r-pheatmap)
+       ("r-plotly" ,r-plotly)
+       ("r-pryr" ,r-pryr)
+       ("r-proxy" ,r-proxy)
+       ("r-pscl" ,r-pscl)
+       ("r-purrr" ,r-purrr)
+       ("r-rann" ,r-rann)
+       ("r-rcpp" ,r-rcpp)
+       ("r-rcppparallel" ,r-rcppparallel)
+       ("r-reshape2" ,r-reshape2)
+       ("r-reticulate" ,r-reticulate)
+       ("r-rhpcblasctl" ,r-rhpcblasctl)
+       ("r-rtsne" ,r-rtsne)
+       ("r-shiny" ,r-shiny)
+       ("r-slam" ,r-slam)
+       ("r-spdep" ,r-spdep)
+       ("r-speedglm" ,r-speedglm)
+       ("r-stringr" ,r-stringr)
+       ("r-singlecellexperiment" ,r-singlecellexperiment)
+       ("r-tibble" ,r-tibble)
+       ("r-tidyr" ,r-tidyr)
+       ("r-uwot" ,r-uwot)
+       ("r-viridis" ,r-viridis)))
+    (home-page "https://github.com/cole-trapnell-lab/monocle3")
+    (synopsis "Analysis toolkit for single-cell RNA-Seq data")
+    (description
+     "Monocle 3 is an analysis toolkit for single-cell RNA-Seq experiments.")
+    (license license:expat)))
+
 (define-public r-noiseq
   (package
     (name "r-noiseq")
@@ -4769,3 +4861,293 @@ read mapping, read counting, SNP calling, structural variant detection and
 gene fusion discovery.  It can be applied to all major sequencing techologies
 and to both short and long sequence reads.")
     (license license:gpl3)))
+
+(define-public r-flowutils
+  (package
+    (name "r-flowutils")
+    (version "1.48.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "flowUtils" version))
+       (sha256
+        (base32
+         "1r7b0rszdzjq7jphh65p5m4x5ps0zbbagxl26gn2mapbjdyb47rm"))))
+    (properties `((upstream-name . "flowUtils")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-biobase" ,r-biobase)
+       ("r-corpcor" ,r-corpcor)
+       ("r-flowcore" ,r-flowcore)
+       ("r-graph" ,r-graph)
+       ("r-runit" ,r-runit)
+       ("r-xml" ,r-xml)))
+    (home-page "https://github.com/jspidlen/flowUtils")
+    (synopsis "Utilities for flow cytometry")
+    (description
+     "This package provides utilities for flow cytometry data.")
+    (license license:artistic2.0)))
+
+(define-public r-consensusclusterplus
+  (package
+    (name "r-consensusclusterplus")
+    (version "1.48.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "ConsensusClusterPlus" version))
+       (sha256
+        (base32
+         "1mlcm3wq5n8s0gxs35j0ph9576fhbrbrrsj2xy84fy20prcfs4w8"))))
+    (properties
+     `((upstream-name . "ConsensusClusterPlus")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-all" ,r-all)
+       ("r-biobase" ,r-biobase)
+       ("r-cluster" ,r-cluster)))
+    (home-page "https://bioconductor.org/packages/ConsensusClusterPlus")
+    (synopsis "Clustering algorithm")
+    (description
+     "This package provides an implementation of an algorithm for determining
+cluster count and membership by stability evidence in unsupervised analysis.")
+    (license license:gpl2)))
+
+(define-public r-flowcore
+  (package
+    (name "r-flowcore")
+    (version "1.50.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "flowCore" version))
+       (sha256
+        (base32
+         "0pvcyzycsmgc8iw60q9xnhllfan6ihwpz3gvk8h1n9jmhpxzylan"))))
+    (properties `((upstream-name . "flowCore")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-bh" ,r-bh)
+       ("r-biobase" ,r-biobase)
+       ("r-biocgenerics" ,r-biocgenerics)
+       ("r-corpcor" ,r-corpcor)
+       ("r-graph" ,r-graph)
+       ("r-mass" ,r-mass)
+       ("r-matrixstats" ,r-matrixstats)
+       ("r-rcpp" ,r-rcpp)
+       ("r-rrcov" ,r-rrcov)))
+    (home-page "https://bioconductor.org/packages/flowCore")
+    (synopsis "Basic structures for flow cytometry data")
+    (description
+     "This package provides S4 data structures and basic functions to deal
+with flow cytometry data.")
+    (license license:artistic2.0)))
+
+(define-public r-flowmeans
+  (package
+    (name "r-flowmeans")
+    (version "1.44.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "flowMeans" version))
+       (sha256
+        (base32
+         "0yp6y3mq5h4nf1d7ybqnriigwfmwanrqavpj3ry482sgiaip1hp2"))))
+    (properties `((upstream-name . "flowMeans")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-biobase" ,r-biobase)
+       ("r-feature" ,r-feature)
+       ("r-flowcore" ,r-flowcore)
+       ("r-rrcov" ,r-rrcov)))
+    (home-page "https://bioconductor.org/packages/flowMeans")
+    (synopsis "Non-parametric flow cytometry data gating")
+    (description
+     "This package provides tools to identify cell populations in Flow
+Cytometry data using non-parametric clustering and segmented-regression-based
+change point detection.")
+    (license license:artistic2.0)))
+
+(define-public r-flowsom
+  (package
+    (name "r-flowsom")
+    (version "1.16.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "FlowSOM" version))
+       (sha256
+        (base32
+         "03wl3xk7g7vajc4kkrqa0gsbjfxlqr918qi849h5nir31963398l"))))
+    (properties `((upstream-name . "FlowSOM")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-biocgenerics" ,r-biocgenerics)
+       ("r-consensusclusterplus" ,r-consensusclusterplus)
+       ("r-flowcore" ,r-flowcore)
+       ("r-flowutils" ,r-flowutils)
+       ("r-igraph" ,r-igraph)
+       ("r-tsne" ,r-tsne)
+       ("r-xml" ,r-xml)))
+    (home-page "https://bioconductor.org/packages/FlowSOM/")
+    (synopsis "Visualize and interpret cytometry data")
+    (description
+     "FlowSOM offers visualization options for cytometry data, by using
+self-organizing map clustering and minimal spanning trees.")
+    (license license:gpl2+)))
+
+(define-public r-mixomics
+  (package
+    (name "r-mixomics")
+    (version "6.8.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "mixOmics" version))
+       (sha256
+        (base32
+         "1f08jx35amn3sfcmqb96mjxxsm6dnpzhff625z758x1992wj4zsk"))))
+    (properties `((upstream-name . "mixOmics")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-corpcor" ,r-corpcor)
+       ("r-dplyr" ,r-dplyr)
+       ("r-ellipse" ,r-ellipse)
+       ("r-ggplot2" ,r-ggplot2)
+       ("r-gridextra" ,r-gridextra)
+       ("r-igraph" ,r-igraph)
+       ("r-lattice" ,r-lattice)
+       ("r-mass" ,r-mass)
+       ("r-matrixstats" ,r-matrixstats)
+       ("r-rarpack" ,r-rarpack)
+       ("r-rcolorbrewer" ,r-rcolorbrewer)
+       ("r-reshape2" ,r-reshape2)
+       ("r-tidyr" ,r-tidyr)))
+    (home-page "http://www.mixOmics.org")
+    (synopsis "Multivariate methods for exploration of biological datasets")
+    (description
+     "mixOmics offers a wide range of multivariate methods for the exploration
+and integration of biological datasets with a particular focus on variable
+selection.  The package proposes several sparse multivariate models we have
+developed to identify the key variables that are highly correlated, and/or
+explain the biological outcome of interest.  The data that can be analysed
+with mixOmics may come from high throughput sequencing technologies, such as
+omics data (transcriptomics, metabolomics, proteomics, metagenomics etc) but
+also beyond the realm of omics (e.g.  spectral imaging).  The methods
+implemented in mixOmics can also handle missing values without having to
+delete entire rows with missing data.")
+    (license license:gpl2+)))
+
+(define-public r-depecher
+  (package
+    (name "r-depecher")
+    (version "1.0.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "DepecheR" version))
+       (sha256
+        (base32
+         "0qj2h2a50fncppvi2phh0mbivxkn1mv702mqpi9mvvkf3bzq8m0h"))))
+    (properties `((upstream-name . "DepecheR")))
+    (build-system r-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-syntax-error
+           (lambda _
+             (substitute* "src/Makevars"
+               ((" & ") " && "))
+             #t)))))
+    (propagated-inputs
+     `(("r-beanplot" ,r-beanplot)
+       ("r-biocparallel" ,r-biocparallel)
+       ("r-dosnow" ,r-dosnow)
+       ("r-dplyr" ,r-dplyr)
+       ("r-foreach" ,r-foreach)
+       ("r-ggplot2" ,r-ggplot2)
+       ("r-gplots" ,r-gplots)
+       ("r-mass" ,r-mass)
+       ("r-matrixstats" ,r-matrixstats)
+       ("r-mixomics" ,r-mixomics)
+       ("r-moments" ,r-moments)
+       ("r-rcpp" ,r-rcpp)
+       ("r-rcppeigen" ,r-rcppeigen)
+       ("r-reshape2" ,r-reshape2)
+       ("r-viridis" ,r-viridis)))
+    (home-page "https://bioconductor.org/packages/DepecheR/")
+    (synopsis "Identify traits of clusters in high-dimensional entities")
+    (description
+     "The purpose of this package is to identify traits in a dataset that can
+separate groups.  This is done on two levels.  First, clustering is performed,
+using an implementation of sparse K-means.  Secondly, the generated clusters
+are used to predict outcomes of groups of individuals based on their
+distribution of observations in the different clusters.  As certain clusters
+with separating information will be identified, and these clusters are defined
+by a sparse number of variables, this method can reduce the complexity of
+data, to only emphasize the data that actually matters.")
+    (license license:expat)))
+
+(define-public r-cicero
+  (package
+    (name "r-cicero")
+    (version "1.2.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (bioconductor-uri "cicero" version))
+       (sha256
+        (base32
+         "0f15l8zrh7l7nnvznb66116hvfk15djb9q240vbscm2w0y5fvkcr"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-assertthat" ,r-assertthat)
+       ("r-biobase" ,r-biobase)
+       ("r-biocgenerics" ,r-biocgenerics)
+       ("r-data-table" ,r-data-table)
+       ("r-dplyr" ,r-dplyr)
+       ("r-fnn" ,r-fnn)
+       ("r-genomicranges" ,r-genomicranges)
+       ("r-ggplot2" ,r-ggplot2)
+       ("r-glasso" ,r-glasso)
+       ("r-gviz" ,r-gviz)
+       ("r-igraph" ,r-igraph)
+       ("r-iranges" ,r-iranges)
+       ("r-matrix" ,r-matrix)
+       ("r-monocle" ,r-monocle)
+       ("r-plyr" ,r-plyr)
+       ("r-reshape2" ,r-reshape2)
+       ("r-s4vectors" ,r-s4vectors)
+       ("r-stringr" ,r-stringr)
+       ("r-tibble" ,r-tibble)
+       ("r-vgam" ,r-vgam)))
+    (home-page "https://bioconductor.org/packages/cicero/")
+    (synopsis "Predict cis-co-accessibility from single-cell data")
+    (description
+     "Cicero computes putative cis-regulatory maps from single-cell chromatin
+accessibility data.  It also extends the monocle package for use in chromatin
+accessibility data.")
+    (license license:expat)))
+
+;; This is the latest commit on the "monocle3" branch.
+(define-public r-cicero-monocle3
+  (let ((commit "fa2fb6515857a8cfc88bc9af044f34de1bcd2b7b")
+        (revision "1"))
+    (package (inherit r-cicero)
+      (name "r-cicero-monocle3")
+      (version (git-version "1.3.2" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/cole-trapnell-lab/cicero-release.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "077yza93wdhi08n40md20jwk55k9lw1f3y0063qkk90cpz60wi0c"))))
+      (propagated-inputs
+       `(("r-monocle3" ,r-monocle3)
+         ,@(alist-delete "r-monocle"
+                         (package-propagated-inputs r-cicero)))))))
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index 5412440fb1..bcec9cd279 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -13,6 +13,7 @@
 ;;; Copyright © 2018 Gábor Boskovits <boskovits@gmail.com>
 ;;; Copyright © 2018 Mădălin Ionel Patrașcu <madalinionel.patrascu@mdc-berlin.de>
 ;;; Copyright © 2019 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2019 Brian Leung <bkleung89@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -4206,8 +4207,15 @@ command, or queried for specific k-mers with @code{jellyfish query}.")
        (modify-phases %standard-phases
          (add-after 'unpack 'set-cc
            (lambda _ (setenv "CC" "gcc") #t))
-         ;; FIXME: This fails with "permission denied".
-         (delete 'reset-gzip-timestamps))))
+
+         (add-before 'reset-gzip-timestamps 'make-files-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             ;; Make sure .gz files are writable so that the
+             ;; 'reset-gzip-timestamps' phase can do its work.
+             (let ((out (assoc-ref outputs "out")))
+               (for-each make-file-writable
+                         (find-files out "\\.gz$"))
+               #t))))))
     (native-inputs
      `(("python-cython" ,python-cython)
        ("python-pytest" ,python-pytest)
@@ -8427,7 +8435,7 @@ library implementing most of the pipeline's features.")
      `(("r-minimal" ,r-minimal)
        ("r-rcas" ,r-rcas)
        ("guile-next" ,guile-2.2)
-       ("guile-json" ,guile-json)
+       ("guile-json" ,guile-json-1)
        ("guile-redis" ,guile-redis)))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
diff --git a/gnu/packages/chromium.scm b/gnu/packages/chromium.scm
index d072fc58ad..a014486361 100644
--- a/gnu/packages/chromium.scm
+++ b/gnu/packages/chromium.scm
@@ -73,7 +73,8 @@
   #:use-module (srfi srfi-1))
 
 (define %preserved-third-party-files
-  '("base/third_party/dmg_fp" ;X11-style
+  '("base/third_party/cityhash" ;Expat
+    "base/third_party/dmg_fp" ;X11-style
     "base/third_party/dynamic_annotations" ;BSD-2
     "base/third_party/icu" ;Unicode, X11-style
     "base/third_party/superfasthash" ;BSD-3
@@ -85,7 +86,7 @@
     "courgette/third_party/divsufsort" ;Expat
     "net/third_party/mozilla_security_manager" ;MPL-1.1/GPL2+/LGPL2.1+
     "net/third_party/nss" ;MPL-2.0
-    "net/third_party/quic" ;BSD-3
+    "net/third_party/quiche" ;BSD-3
     "net/third_party/uri_template" ;ASL2.0
     "third_party/abseil-cpp" ;ASL2.0
     "third_party/adobe/flash/flapper_version.h" ;no license, trivial
@@ -105,6 +106,10 @@
     "third_party/blink" ;BSD-3, LGPL2+
     "third_party/boringssl" ;OpenSSL/ISC (Google additions are ISC)
     "third_party/boringssl/src/third_party/fiat" ;Expat
+    "third_party/boringssl/src/third_party/sike" ;Expat
+    ;; XXX: these files are generated by fp-$arch.pl in the above directory.
+    "third_party/boringssl/linux-aarch64/crypto/third_party/sike/asm/fp-armv8.S"
+    "third_party/boringssl/linux-x86_64/crypto/third_party/sike/asm/fp-x86_64.S"
     "third_party/breakpad" ;BSD-3
     "third_party/brotli" ;Expat
     "third_party/cacheinvalidation" ;ASL2.0
@@ -164,6 +169,7 @@
     "third_party/nasm" ;BSD-2
     "third_party/node" ;Expat
     "third_party/node/node_modules/polymer-bundler/lib/third_party/UglifyJS2" ;BSD-2
+    "third_party/openscreen" ;BSD-3
     "third_party/ots" ;BSD-3
     "third_party/pdfium" ;BSD-3
     "third_party/pdfium/third_party/agg23" ;Expat
@@ -182,9 +188,10 @@
     "third_party/s2cellid" ;ASL2.0
     "third_party/sfntly" ;ASL2.0
     "third_party/skia" ;BSD-3
+    "third_party/skia/include/third_party/skcms" ;BSD-3
     "third_party/skia/third_party/gif" ;MPL1.1/GPL2+/LGPL2.1+
     "third_party/skia/third_party/skcms" ;BSD-3
-    "third_party/skia/third_party/vulkan" ;BSD-3
+    "third_party/skia/third_party/vulkanmemoryallocator" ;BSD-3, Expat
     "third_party/smhasher" ;Expat, public domain
     "third_party/speech-dispatcher" ;GPL2+
     "third_party/spirv-headers" ;ASL2.0
@@ -231,9 +238,9 @@ from forcing GEXP-PROMISE."
                       #:system system
                       #:guile-for-build guile)))
 
-(define %chromium-version "75.0.3770.142")
-(define %ungoogled-revision "5d8abc38b43a62f379615a0dc972b29d9aebb4b4")
-(define %debian-revision "debian/75.0.3770.90-1")
+(define %chromium-version "76.0.3809.87")
+(define %ungoogled-revision "6ea939002bae43a27910e03569d43519d07842e7")
+(define %debian-revision "debian/76.0.3809.87-2")
 (define package-revision "0")
 (define %package-version (string-append %chromium-version "-"
                                         package-revision "."
@@ -247,7 +254,7 @@ from forcing GEXP-PROMISE."
                         %chromium-version ".tar.xz"))
     (sha256
      (base32
-      "1b550hc9sav0qdnh4hiin2bb3jmfyrb3dhbmnc0v8662rjknq3ji"))))
+      "1521vh38mfgy7aj1lw1vpbdm8m6wyh52d5p7bz4x6kvvxsnacp11"))))
 
 (define %ungoogled-origin
   (origin
@@ -258,7 +265,7 @@ from forcing GEXP-PROMISE."
                               (string-take %ungoogled-revision 7)))
     (sha256
      (base32
-      "1vk8jzzsn20ysn4nlz84mwwhfa9nnywzd1lrahlhcky9pf6xzpwa"))))
+      "1nhrh9fn1appbxf8d3dg49jrqjvha721s89i60s4m63d037cifzr"))))
 
 (define %debian-origin
   (origin
@@ -272,7 +279,29 @@ from forcing GEXP-PROMISE."
                                   (string-take %debian-revision 7))))
     (sha256
      (base32
-      "0sh6z2lx44zb31qrpa29vm0sw09dxi7i9h6fsq3ivfxjs7v98bbx"))))
+      "1fjhpzrxmgjr7i31li1vsfmp0qkbi0cpyc7p1zjwvf2x4da0v907"))))
+
+(define (gentoo-patch name hash revision)
+  (origin
+    (method url-fetch)
+    (uri (string-append "https://gitweb.gentoo.org/repo/gentoo.git/plain"
+                        "/www-client/chromium/files/" name "?id=" revision))
+    (file-name name)
+    (sha256 (base32 hash))))
+
+(define-syntax-rule (gentoo-patches (name hash) ...)
+  (list (gentoo-patch name hash "9fd80e7d75aa63843ec33c9d44fee32596ae8f25")
+        ...))
+
+(define %auxiliary-patches
+  ;; XXX: Debians "gcc/wrong-namespace.patch" and "fixes/inspector.patch" does
+  ;; not work for us, so we take these upstream fixes via Gentoo instead.
+  (gentoo-patches
+   ("chromium-76-quiche.patch" "1cs0y16jn7r1nxh0j36vqcsdvigl902kdcqfmyivnxgblrx66l2i")
+   ("chromium-76-gcc-blink-namespace1.patch"
+    "0k7nrn0dhvqxj4sg2gndzxih0l1f77h6pv7jhcdz7h69sm4xci2z")
+   ("chromium-76-gcc-blink-namespace2.patch"
+    "014y2d8ii9sr340sjbv1fhsjd5s3dl0vbmq5wzlkdjsp91dcn9ch")))
 
 ;; This is a "computed" origin that does the following:
 ;; *) Runs the Ungoogled scripts on a pristine Chromium tarball.
@@ -314,6 +343,12 @@ from forcing GEXP-PROMISE."
                    (force-output)
                    (invoke "tar" "xf" #+chromium-source)
 
+                   ;; Ungoogled-Chromium contains a forked subset of the Debian
+                   ;; patches.  Disable those, as we apply newer versions later.
+                   (substitute* "patches/series"
+                     ((".*/debian_buster/.*")
+                      ""))
+
                    (format #t "Ungooglifying...~%")
                    (force-output)
                    (invoke "python3" "utils/prune_binaries.py" chromium-dir
@@ -330,16 +365,7 @@ from forcing GEXP-PROMISE."
                      (force-output)
                      (let* ((debian  #+debian-source)
                             (patches (string-append debian "/debian/patches"))
-                            (series  (string-append patches "/series"))
-                            (grep-q (lambda (query file)
-                                      (with-input-from-file file
-                                        (lambda ()
-                                          (let loop ((line (read-line))
-                                                     (match #f))
-                                            (if (or match (eof-object? line))
-                                                (if match #t #f)
-                                                (loop (read-line)
-                                                      (string-contains line query)))))))))
+                            (series  (string-append patches "/series")))
                        (with-input-from-file series
                          (lambda ()
                            (let loop ((line (read-line)))
@@ -347,19 +373,35 @@ from forcing GEXP-PROMISE."
                                (when (and (> (string-length line) 1)
                                           ;; Skip the Debian-specific ones.
                                           (not (string-prefix? "debianization/" line))
+                                          (not (string-prefix? "buster/" line))
                                           ;; And those that conflict with Ungoogled.
                                           (not (any (cute string-suffix? <> line)
                                                     '("widevine-buildflag.patch"
                                                       "signin.patch"
-                                                      "third-party-cookies.patch")))
-                                          ;; Ungoogled includes a subset of the Debian
-                                          ;; patches.  Exclude those already present.
-                                          (not (grep-q line "../patches/series")))
+                                                      "third-party-cookies.patch"
+
+                                                      ;; XXX: 'fixes/inspector.patch'
+                                                      ;; makes v8 reuse the top-level
+                                                      ;; third_party/inspector_protocol
+                                                      ;; instead of its own bundled copy,
+                                                      ;; but that does not work here for
+                                                      ;; some reason.  Ignore that patch
+                                                      ;; and those that depend on it.
+                                                      "wrong-namespace.patch"
+                                                      "explicit-specialization.patch"
+                                                      "inspector.patch"))))
                                  (invoke "patch" "--force" "-p1" "--input"
                                          (string-append patches "/" line)
                                          "--no-backup-if-mismatch"))
                                (loop (read-line)))))))
 
+                     (format #t "Applying Guix-specific patches...~%")
+                     (force-output)
+                     (for-each (lambda (patch)
+                                 (invoke "patch" "--force" "-p1" "--input"
+                                         patch "--no-backup-if-mismatch"))
+                               '#+%auxiliary-patches)
+
                      (format #t "Pruning third party files...~%")
                      (force-output)
                      (apply invoke "python"
@@ -458,7 +500,6 @@ from forcing GEXP-PROMISE."
              "is_clang=false"
              ;; Disable debugging features to save space.  These are normally
              ;; pulled in by "is_official_build", but that requires "is_clang".
-             "blink_symbol_level=0"
              "enable_iterator_debugging=false"
              "exclude_unwind_tables=true"
              ;; Optimize for building everything at once, as opposed to
@@ -488,7 +529,7 @@ from forcing GEXP-PROMISE."
                    '("use_vaapi=true")
                    '())
 
-             ;; Don't arbitrarily restrict formats supported by system ffmpeg.
+             ;; Do not artifically restrict formats supported by system ffmpeg.
              "proprietary_codecs=true"
              "ffmpeg_branding=\"Chrome\""
 
@@ -561,12 +602,12 @@ from forcing GEXP-PROMISE."
              (substitute* "third_party/webrtc/rtc_base/strings/json.h"
                (("#include \"third_party/jsoncpp/") "#include \"json/"))
 
-             (substitute* '("ui/gfx/skia_util.h"
+             (substitute* '("components/viz/common/gpu/vulkan_context_provider.h"
                             "components/viz/common/resources/resource_format_utils.h")
                (("third_party/vulkan/include/") ""))
 
              (substitute* "third_party/skia/include/gpu/vk/GrVkVulkan.h"
-               (("\\.\\./\\.\\./include/third_party/vulkan/") ""))
+               (("include/third_party/vulkan/") ""))
 
              ;; Building chromedriver embeds some files using the ZIP
              ;; format which doesn't support timestamps before
@@ -587,6 +628,9 @@ from forcing GEXP-PROMISE."
              (setenv "AR" "ar") (setenv "NM" "nm")
              (setenv "CC" "gcc") (setenv "CXX" "g++")
 
+             ;; Prevent GCC from optimizing away null pointer safety checks.
+             (setenv "CXXFLAGS" "-fno-delete-null-pointer-checks")
+
              ;; Work around <https://bugs.gnu.org/30756>.
              (unsetenv "C_INCLUDE_PATH")
              (unsetenv "CPLUS_INCLUDE_PATH")
diff --git a/gnu/packages/ci.scm b/gnu/packages/ci.scm
index eb5f665fc1..4af2cdc6ea 100644
--- a/gnu/packages/ci.scm
+++ b/gnu/packages/ci.scm
@@ -121,7 +121,7 @@
        `(("guile" ,guile-2.2)
          ("guile-fibers" ,guile-fibers)
          ("guile-gcrypt" ,guile-gcrypt)
-         ("guile-json" ,guile-json)
+         ("guile-json" ,guile-json-1)
          ("guile-sqlite3" ,guile-sqlite3)
          ("guile-git" ,guile-git)
          ;; FIXME: this is propagated by "guile-git", but it needs to be among
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index d821298e56..9834fcbe63 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -1363,14 +1363,14 @@ or junctions, and always follows hard links.")
 (define-public zstd
   (package
     (name "zstd")
-    (version "1.4.1")
+    (version "1.4.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://github.com/facebook/zstd/releases/download/"
                            "v" version "/zstd-" version ".tar.gz"))
        (sha256
-        (base32 "180sfl0iz5hy43xcr0gh8kz2vxgpb8rh5d7wmpxn3bxkgs320l2k"))))
+        (base32 "1ja3nrjynmiwwdjrf6crraizkbagp7y414bqqq2ady91nn1hjwqj"))))
     (build-system gnu-build-system)
     (outputs '("out"                    ;1.1MiB executables and documentation
                "lib"                    ;1MiB shared library and headers
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 3f0d819df7..3bd0d664da 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -118,6 +118,51 @@ experiment that allows a generic to warn if any arguments passed in @code{...}
 are not used.")
     (license license:gpl3)))
 
+(define-public r-grr
+  (package
+    (name "r-grr")
+    (version "0.9.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "grr" version))
+       (sha256
+        (base32
+         "0arbcgrvhkwb5xk4nry1ffg2qj0v8ivhjghdr505ib4357g0c9i9"))))
+    (build-system r-build-system)
+    (home-page "https://cran.r-project.org/web/packages/grr")
+    (synopsis "Alternative implementations of base R functions")
+    (description
+     "This package provides alternative implementations of some base R
+functions, including @code{sort}, @code{order}, and @code{match}.  The
+functions are simplified but can be faster or have other advantages.")
+    (license license:gpl3)))
+
+(define-public r-matrix-utils
+  (package
+    (name "r-matrix-utils")
+    (version "0.9.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "Matrix.utils" version))
+       (sha256
+        (base32
+         "1x64r4aj3gy1dzjjysyrk1j9jq3qsnyrqws8i6bs7q8pf6gvr7va"))))
+    (properties `((upstream-name . "Matrix.utils")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-grr" ,r-grr)
+       ("r-matrix" ,r-matrix)))
+    (home-page "https://github.com/cvarrichio/Matrix.utils")
+    (synopsis
+     "Data.frame-Like Operations on Sparse and Dense Matrix Objects")
+    (description
+     "This package implements data manipulation methods such as @code{cast},
+@code{aggregate}, and @code{merge}/@code{join} for Matrix and Matrix-like
+objects.")
+    (license license:gpl3)))
+
 (define-public r-sys
   (package
     (name "r-sys")
@@ -822,6 +867,121 @@ this gives the user direct access to the file system without the need to
 well as file saving is available.")
     (license license:gpl2+)))
 
+;; The package sources include minified variants of d3.js and non-minified
+;; source code of d3-jetpack.
+(define-public r-d3r
+  (package
+    (name "r-d3r")
+    (version "0.8.6")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "d3r" version))
+       (sha256
+        (base32
+         "0vcmiyhd000xyl28k6rm7ba50x5sz5b2cpllxnq36q13qhdnqw6k"))))
+    (build-system r-build-system)
+    (arguments
+     `(#:modules ((guix build utils)
+                  (guix build r-build-system)
+                  (srfi srfi-1)
+                  (ice-9 popen))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'process-javascript
+           (lambda* (#:key inputs #:allow-other-keys)
+             (with-directory-excursion "inst/www/d3/"
+               (call-with-values
+                   (lambda ()
+                     (unzip2
+                      `((,(assoc-ref inputs "d3.v3.js")
+                         "v3/dist/d3.min.js")
+                        (,(assoc-ref inputs "d3.v4.js")
+                         "v4/dist/d3.min.js")
+                        (,(assoc-ref inputs "d3.v5.js")
+                         "v5/dist/d3.min.js"))))
+                 (lambda (sources targets)
+                   (for-each (lambda (source target)
+                               (format #t "Processing ~a --> ~a~%"
+                                       source target)
+                               (delete-file target)
+                               (let ((minified (open-pipe* OPEN_READ "uglify-js" source)))
+                                 (call-with-output-file target
+                                   (lambda (port)
+                                     (dump-port minified port)))))
+                             sources targets))))
+             #t)))))
+    (propagated-inputs
+     `(("r-dplyr" ,r-dplyr)
+       ("r-htmltools" ,r-htmltools)
+       ("r-tidyr" ,r-tidyr)))
+    (native-inputs
+     `(("uglify-js" ,uglify-js)
+       ("d3.v3.js"
+        ,(origin
+           (method url-fetch)
+           (uri "https://d3js.org/d3.v3.js")
+           (sha256
+            (base32
+             "1arr7sr08vy7wh0nvip2mi7dpyjw4576vf3bm45rp4g5lc1k1x41"))))
+       ("d3.v4.js"
+        ,(origin
+           (method url-fetch)
+           (uri "https://d3js.org/d3.v4.js")
+           (sha256
+            (base32
+             "0y7byf6kcinfz9ac59jxc4v6kppdazmnyqfav0dm4h550fzfqqlg"))))
+       ("d3.v5.js"
+        ,(origin
+           (method url-fetch)
+           (uri "https://d3js.org/d3.v5.js")
+           (sha256
+            (base32
+             "0kxvx5pfagxn6nhavdwsdnzyd26g0z5dsfi1pi5dvcmb0c8ipcdn"))))))
+    (home-page "https://github.com/timelyportfolio/d3r")
+    (synopsis "d3.js utilities for R")
+    (description
+     "This package provides a suite of functions to help ease the use of the
+d3.js visualization library in R.  These helpers include
+@code{htmltools::htmlDependency} functions, hierarchy builders, and conversion
+tools for @code{partykit}, @code{igraph}, @code{table}, and @code{data.frame}
+R objects into the JSON format that the d3.js library expects.")
+    (license license:bsd-3)))
+
+;; We use the latest commit here because the last release was in 2016 while
+;; the latest commit was in 2018.
+(define-public r-sankeyd3
+  (let ((commit "fd50a74e29056e0d67d75b4d04de47afb2f932bc")
+        (revision "1"))
+    (package
+      (name "r-sankeyd3")
+      (version (git-version "0.3.2" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/fbreitwieser/sankeyD3.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "0jrcnfax321pszbpjdifnkbrgbjr43bjzvlzv1p5a8wskksqwiyx"))))
+      (build-system r-build-system)
+      (propagated-inputs
+       `(("r-d3r" ,r-d3r)
+         ("r-htmlwidgets" ,r-htmlwidgets)
+         ("r-shiny" ,r-shiny)
+         ("r-magrittr" ,r-magrittr)))
+      (home-page "https://github.com/fbreitwieser/sankeyD3")
+      (synopsis "Sankey network graphs from R")
+      (description
+       "This package provides an R library to generate Sankey network graphs
+in R and Shiny via the D3 visualization library.")
+      ;; The R code is licensed under GPLv3+.  It includes the non-minified
+      ;; JavaScript source code of d3-sankey, which is released under the
+      ;; 3-clause BSD license.
+      (license (list license:gpl3+ license:bsd-3)))))
+
 (define-public r-crosstalk
   (package
     (name "r-crosstalk")
@@ -8675,6 +8835,29 @@ package provides a minimal R interface by relying on the Rcpp package.")
     ;; hnswlib is released under Version 2.0 of the Apache License.
     (license (list license:gpl3 license:asl2.0))))
 
+(define-public r-rcppparallel
+  (package
+    (name "r-rcppparallel")
+    (version "4.4.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "RcppParallel" version))
+       (sha256
+        (base32
+         "1ym0bzs9g6bsg2lz24fisxxa3gypr6xcvrczn304czmrrag9413s"))))
+    (properties `((upstream-name . "RcppParallel")))
+    (build-system r-build-system)
+    (home-page "http://rcppcore.github.io/RcppParallel")
+    (synopsis "Parallel programming tools for Rcpp")
+    (description
+     "This package provides high level functions for parallel programming with
+Rcpp.  For example, the @code{parallelFor()} function can be used to convert
+the work of a standard serial @code{for} loop into a parallel one and the
+@code{parallelReduce()} function can be used for accumulating aggregates or
+other values.")
+    (license license:gpl2)))
+
 (define-public r-ncdf4
   (package
     (name "r-ncdf4")
@@ -9279,6 +9462,29 @@ only sparse real matrices in Matrix package format are supported.")
     ;; BSD-3.
     (license (list license:bsd-3 license:bsd-2))))
 
+(define-public r-speedglm
+  (package
+    (name "r-speedglm")
+    (version "0.3-2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "speedglm" version))
+       (sha256
+        (base32
+         "1b25zimk0z7ad62yacqdg0zk0qs0jja4i918ym942xfw4j1z3jjz"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-mass" ,r-mass)
+       ("r-matrix" ,r-matrix)))
+    (home-page "https://cran.r-project.org/web/packages/speedglm")
+    (synopsis "Fit linear and generalized linear models to large data sets")
+    (description
+     "This package provides tools for fitting linear models and generalized
+linear models to large data sets by updating algorithms.")
+    ;; Any version of the GPL
+    (license license:gpl2+)))
+
 (define-public r-densityclust
   (package
     (name "r-densityclust")
@@ -14199,6 +14405,25 @@ Molecular Epidemiology\" (SCRIME).  The main focus is on SNP data, but most of
 the functions can also be applied to other types of categorical data.")
     (license license:gpl2)))
 
+(define-public r-pbmcapply
+  (package
+    (name "r-pbmcapply")
+    (version "1.5.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "pbmcapply" version))
+       (sha256
+        (base32
+         "0i58gcqpnbyvc448qfgm45b7rpbmrnagsvk1h1hsqchbbicfslnz"))))
+    (build-system r-build-system)
+    (home-page "https://github.com/kvnkuang/pbmcapply")
+    (synopsis "Track the progress of apply procedures with a progress bar")
+    (description
+     "This light-weight package helps you track and visualize the progress of
+parallel versions of vectorized R functions of the @code{mc*apply} family.")
+    (license license:expat)))
+
 (define-public r-blme
   (package
     (name "r-blme")
@@ -14530,3 +14755,140 @@ including regression, classification and ranking.  The package is made to be
 extensible, so that users are also allowed to define their own objectives
 easily.")
     (license license:asl2.0)))
+
+(define-public r-umap
+  (package
+    (name "r-umap")
+    (version "0.2.2.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "umap" version))
+       (sha256
+        (base32
+         "1s82w9gy1387h7cprjfbhp49l89zbmn3gc9s0wzqb1s73nza9n31"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-rcpp" ,r-rcpp)
+       ("r-reticulate" ,r-reticulate)
+       ("r-rspectra" ,r-rspectra)))
+    (home-page "https://github.com/tkonopka/umap")
+    (synopsis "Uniform manifold approximation and projection")
+    (description
+     "Uniform manifold approximation and projection is a technique for
+dimension reduction.  This package provides an interface to the UMAP algorithm
+in R, including a translation of the original algorithm into R.")
+    (license license:expat)))
+
+(define-public r-uwot
+  (package
+    (name "r-uwot")
+    (version "0.1.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "uwot" version))
+       (sha256
+        (base32
+         "1mq6qi8q9xslh1b99srj480s2a08pfv4bs9m2ykyijj44j9fcdj9"))))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-dqrng" ,r-dqrng)
+       ("r-fnn" ,r-fnn)
+       ("r-irlba" ,r-irlba)
+       ("r-matrix" ,r-matrix)
+       ("r-rcpp" ,r-rcpp)
+       ("r-rcppannoy" ,r-rcppannoy)
+       ("r-rcppparallel" ,r-rcppparallel)
+       ("r-rcppprogress" ,r-rcppprogress)
+       ("r-rspectra" ,r-rspectra)))
+    (home-page "https://github.com/jlmelville/uwot")
+    (synopsis "Uniform manifold approximation and projection")
+    (description
+     "This package provides an implementation of the Uniform Manifold
+Approximation and Projection dimensionality reduction by McInnes et
+al. (2018).  It also provides means to transform new data and to carry out
+supervised dimensionality reduction.  An implementation of the related
+LargeVis method of Tang et al. (2016) is also provided.")
+    (license license:gpl3)))
+
+(define-public r-kableextra
+  (package
+    (name "r-kableextra")
+    (version "1.1.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "kableExtra" version))
+       (sha256
+        (base32
+         "1nicvw06xsf3a1f5c10mih07b76m2v5s5h165vmz0qx6n1a3492i"))))
+    (properties `((upstream-name . "kableExtra")))
+    (build-system r-build-system)
+    (propagated-inputs
+     `(("r-digest" ,r-digest)
+       ("r-glue" ,r-glue)
+       ("r-htmltools" ,r-htmltools)
+       ("r-knitr" ,r-knitr)
+       ("r-magrittr" ,r-magrittr)
+       ("r-readr" ,r-readr)
+       ("r-rmarkdown" ,r-rmarkdown)
+       ("r-rstudioapi" ,r-rstudioapi)
+       ("r-rvest" ,r-rvest)
+       ("r-scales" ,r-scales)
+       ("r-stringr" ,r-stringr)
+       ("r-viridislite" ,r-viridislite)
+       ("r-webshot" ,r-webshot)
+       ("r-xml2" ,r-xml2)))
+    (home-page "https://haozhu233.github.io/kableExtra/")
+    (synopsis "Construct complex tables with pipe syntax")
+    (description
+     "Build complex HTML or LaTeX tables using @code{kable()} from
+@code{knitr} and the piping syntax from @code{magrittr}.  The function
+@code{kable()} is a light weight table generator coming from @code{knitr}.
+This package simplifies the way to manipulate the HTML or LaTeX codes
+generated by @code{kable()} and allows users to construct complex tables and
+customize styles using a readable syntax.")
+    (license license:expat)))
+
+(define-public r-glasso
+  (package
+    (name "r-glasso")
+    (version "1.10")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "glasso" version))
+       (sha256
+        (base32
+         "0nshpx14v2yny7lr8ll6nnz71n0f02sddh2c2dglfprbk89p9yp6"))))
+    (build-system r-build-system)
+    (native-inputs `(("gfortran" ,gfortran)))
+    (home-page "http://www-stat.stanford.edu/~tibs/glasso")
+    (synopsis "Graphical Lasso: estimation of Gaussian graphical models")
+    (description
+     "This is a package for estimation of a sparse inverse covariance matrix
+using a lasso (L1) penalty.  Facilities are provided for estimates along a
+path of values for the regularization parameter.")
+    (license license:gpl2)))
+
+(define-public r-rhpcblasctl
+  (package
+    (name "r-rhpcblasctl")
+    (version "0.18-205")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (cran-uri "RhpcBLASctl" version))
+       (sha256
+        (base32
+         "1ls2286fvrp1g7p8v4l6axznychh3qndranfpzqz806cm9ml1cdp"))))
+    (properties `((upstream-name . "RhpcBLASctl")))
+    (build-system r-build-system)
+    (home-page "http://prs.ism.ac.jp/~nakama/Rhpc/")
+    (synopsis "Control the number of threads on BLAS")
+    (description
+     "This package allows you to control the number of threads the BLAS
+library uses.  It is also possible to control the number of threads in
+OpenMP.")
+    (license license:agpl3+)))
diff --git a/gnu/packages/crypto.scm b/gnu/packages/crypto.scm
index 45e1d64cd2..b975afe6d3 100644
--- a/gnu/packages/crypto.scm
+++ b/gnu/packages/crypto.scm
@@ -131,16 +131,15 @@ communication, encryption, decryption, signatures, etc.")
 (define-public signify
   (package
     (name "signify")
-    (version "25")
+    (version "26")
     (home-page "https://github.com/aperezdc/signify")
     (source (origin
-              (method git-fetch)
-              (uri (git-reference (url home-page)
-                                  (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
+              (method url-fetch)
+              (uri (string-append "https://github.com/aperezdc/signify/releases"
+                                  "/download/v" version "/signify-" version ".tar.xz"))
               (sha256
                (base32
-                "0zg0rffxwj2a71s1bllhrn491xsmirg9sshpq8f3vl25lv4c2cnq"))))
+                "16sl1yq5bbsads5q4a0fbrf31b0x8r1hi4wagl90nbrhrca98baw"))))
     (build-system gnu-build-system)
     ;; TODO Build with libwaive (described in README.md), to implement something
     ;; like OpenBSD's pledge().
diff --git a/gnu/packages/dictionaries.scm b/gnu/packages/dictionaries.scm
index d3a3f8d832..228a8b6472 100644
--- a/gnu/packages/dictionaries.scm
+++ b/gnu/packages/dictionaries.scm
@@ -218,7 +218,7 @@ It comes with a German-English dictionary with approximately 270,000 entries.")
 (define-public grammalecte
   (package
     (name "grammalecte")
-    (version "1.2")
+    (version "1.2.1")
     (source
      (origin
        (method url-fetch/zipbomb)
@@ -226,7 +226,7 @@ It comes with a German-English dictionary with approximately 270,000 entries.")
                            "Grammalecte-fr-v" version ".zip"))
        (sha256
         (base32
-         "0dwizai6w9yn617y7cnqdiwv77vn22p18s9sypypbl1bl695cnma"))))
+         "1j2avdk8hcgcv0lahp029qzpdb2rnys38hc64jy30awzx64fa6i4"))))
     (build-system python-build-system)
     (home-page "https://grammalecte.net")
     (synopsis  "French spelling and grammar checker")
diff --git a/gnu/packages/dns.scm b/gnu/packages/dns.scm
index 17357c1292..b4d5a9ab27 100644
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@@ -12,6 +12,7 @@
 ;;; Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Chris Marusich <cmmarusich@gmail.com>
+;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -372,14 +373,14 @@ to result in system-wide compromise.")
 (define-public unbound
   (package
     (name "unbound")
-    (version "1.9.1")
+    (version "1.9.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://www.unbound.net/downloads/unbound-"
                            version ".tar.gz"))
        (sha256
-        (base32 "1iarvk0i92asvrkpla9z55aan20k6pklzpck9yk4rfnchsdvzh63"))))
+        (base32 "15bbrczibap30db8a1pmqhvjbmkxms39hwiivby7f4j5rz2wwykg"))))
     (build-system gnu-build-system)
     (outputs '("out" "python"))
     (native-inputs
diff --git a/gnu/packages/docker.scm b/gnu/packages/docker.scm
index 18e7bea724..94cfa2bdb7 100644
--- a/gnu/packages/docker.scm
+++ b/gnu/packages/docker.scm
@@ -63,12 +63,13 @@
     (arguments '(#:tests? #f))
     (inputs
      `(("python-requests" ,python-requests-2.20)
-       ("python-docker-pycreds" ,python-docker-pycreds)
        ("python-ipaddress" ,python-ipaddress)
-       ("python-paramiko" ,python-paramiko)
        ("python-six" ,python-six)
        ("python-urllib3" ,python-urllib3-1.24)
        ("python-websocket-client" ,python-websocket-client)))
+    (propagated-inputs
+     `(("python-docker-pycreds" ,python-docker-pycreds)
+       ("python-paramiko" ,python-paramiko))) ; adds SSH support
     (home-page "https://github.com/docker/docker-py/")
     (synopsis "Python client for Docker")
     (description "Docker-Py is a Python client for the Docker container
@@ -113,17 +114,11 @@ client.")
     ;; TODO: Tests require running Docker daemon.
     (arguments '(#:tests? #f))
     (inputs
-     `(("python2-backport-ssl-match-hostname"
-        ,python2-backport-ssl-match-hostname)
-       ("python-cached-property"
+     `(("python-cached-property"
         ,python-cached-property)
-       ("python-colorama" ,python-colorama)
        ("python-docker-py" ,python-docker-py)
-       ("python-docker-pycreds" ,python-docker-pycreds)
        ("python-dockerpty" ,python-dockerpty)
        ("python-docopt" ,python-docopt)
-       ("python-ipaddress" ,python-ipaddress)
-       ("python-paramiko" ,python-paramiko)
        ("python-jsonschema" ,python-jsonschema-2.6)
        ("python-pyyaml" ,python-pyyaml)
        ("python-requests" ,python-requests-2.20)
@@ -586,6 +581,9 @@ provisioning etc.")
              ;; information, and the DWARF symbol table.
              (setenv "LDFLAGS" "-s -w")
 
+             ;; Make sure "docker -v" prints a usable version string.
+             (setenv "VERSION" ,%docker-version)
+
              ;; Make build reproducible.
              (setenv "BUILDTIME" "1970-01-01 00:00:01.000000000+00:00")
              (symlink "src/github.com/docker/cli/scripts" "./scripts")
diff --git a/gnu/packages/ebook.scm b/gnu/packages/ebook.scm
index cf424f285d..205dd3c8a7 100644
--- a/gnu/packages/ebook.scm
+++ b/gnu/packages/ebook.scm
@@ -56,7 +56,8 @@
   #:use-module (gnu packages tls)
   #:use-module (gnu packages web)
   #:use-module (gnu packages xml)
-  #:use-module (gnu packages xorg))
+  #:use-module (gnu packages xorg)
+  #:use-module (gnu packages wxwidgets))
 
 (define-public chmlib
   (package
@@ -330,3 +331,27 @@ following formats:
 @item XHTML
 @end enumerate")
     (license license:gpl2+)))
+
+(define-public xchm
+  (package
+    (name "xchm")
+    (version "1.30")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/rzvncj/xCHM"
+                                  "/releases/download/"
+                                  version "/xchm-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1865wb3ppmx5y12rqfhv4wri0lfdah41zsfz94xb8gym80m8zac5"))))
+    (build-system gnu-build-system)
+    (inputs
+     `(("wxwidgets" ,wxwidgets)
+       ("chmlib" ,chmlib)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "https://github.com/rzvncj/xCHM")
+    (synopsis "CHM file viewer")
+    (description "xCHM is a graphical CHM file viewer.  It is a frontend to
+the CHM library CHMLIB.")
+    (license license:gpl2+)))
diff --git a/gnu/packages/education.scm b/gnu/packages/education.scm
index 8501db02a1..0bb9c099fb 100644
--- a/gnu/packages/education.scm
+++ b/gnu/packages/education.scm
@@ -250,7 +250,7 @@ easy.")
 (define-public snap
   (package
     (name "snap")
-    (version "5.0.4")
+    (version "5.0.8")
     (source
      (origin
        (method git-fetch)
@@ -260,7 +260,7 @@ easy.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1zdypxifvxjkzhi4n9mkck8l419wc0pg103339yzhsbb9kkd3jlr"))))
+         "0fwfssdgv3mfzyv8hw1a1z5ky1yn0p59kyl6l9fxsm4w2ckgyizd"))))
     (build-system trivial-build-system)
     (arguments
      `(#:modules ((guix build utils))
diff --git a/gnu/packages/emacs-xyz.scm b/gnu/packages/emacs-xyz.scm
index 9baa782e2e..213dac78f6 100644
--- a/gnu/packages/emacs-xyz.scm
+++ b/gnu/packages/emacs-xyz.scm
@@ -50,6 +50,7 @@
 ;;; Copyright © 2019 Amar Singh <nly@disroot.org>
 ;;; Copyright © 2019 Baptiste Strazzulla <bstrazzull@hotmail.fr>
 ;;; Copyright © 2019 Giacomo Leidi <goodoldpaul@autitici.org>
+;;; Copyright © 2019 Jens Mølgaard <jens@zete.tk>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -948,6 +949,33 @@ regexp-like arguments to @code{skip-chars-forward} and
 @code{skip-chars-backward}.")
     (license license:gpl3+)))
 
+(define-public emacs-bug-hunter
+  (let ((commit "b88d981afa9154b236c5a3a83b50d5889d46c6a7")
+        (revision "1"))
+    (package
+      (name "emacs-bug-hunter")
+      (version (git-version "1.3.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/Malabarba/elisp-bug-hunter.git")
+               (commit commit)))
+         (file-name (git-file-name name commit))
+         (sha256
+          (base32
+           "134fj493sdn93pyyac8rpz1fzahzmayvphsrmqp3wvgysmfqm38l"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-seq" ,emacs-seq)))
+      (home-page "https://github.com/Malabarba/elisp-bug-hunter")
+      (synopsis "Hunt down errors by bisecting elisp files")
+      (description
+       "The Bug Hunter is an Emacs library that finds the source of an error
+or unexpected behavior inside an elisp configuration file (typically
+@file{init.el} or @file{.emacs}).")
+      (license license:gpl3+))))
+
 
 ;;;
 ;;; Web browsing.
@@ -3361,6 +3389,76 @@ for the current function or variable in the minibuffer.")
 completion candidate when using the Company text completion framework.")
     (license license:gpl3+)))
 
+(define-public emacs-math-symbol-lists
+  (let ((commit "dc7531cff0c845d5470a50c24d5d7309b2ced7eb")
+        (revision "1"))
+    (package
+      (name "emacs-math-symbol-lists")
+      (version (git-version "1.2.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/vspinu/math-symbol-lists.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "094m21i9rns6m59cmhxcivxxafbg52w8f8na4y3v47aq67zmhhqm"))))
+      (build-system emacs-build-system)
+      (home-page "https://github.com/vspinu/math-symbol-lists")
+      (synopsis "Lists of Unicode math symbols and @code{LaTeX} commands")
+      (description "This is a storage package used by completion engines like
+@code{company-math}.")
+      (license license:gpl3+))))
+
+(define-public emacs-company-math
+  (let ((commit "600e49449644f6835f9dc3501bc58461999e8ab9")
+        (revision "1"))
+    (package
+      (name "emacs-company-math")
+      (version (git-version "1.3" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/vspinu/company-math.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "1ps2lpkzn8mjbpcbvvy1qz3xbgrh6951x8y9bsd1fm32drdph9lh"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-math-symbol-lists" ,emacs-math-symbol-lists)
+         ("emacs-company" ,emacs-company)))
+      (home-page "https://github.com/vspinu/company-math")
+      (synopsis "Completion backends for Unicode math symbols and @code{LaTeX} tags")
+      (description "This package provides a backend for use with
+@code{company-mode} allowing for completion of common math symbols.")
+      (license license:gpl3+))))
+
+(define-public emacs-nswbuff
+  (let ((commit "362da7f3687e2eb5bb11667347de85f4a9d002bc")
+        (revision "1"))
+    (package
+      (name "emacs-nswbuff")
+      (version (git-version "1.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/joostkremers/nswbuff.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "0l2xfz8z5qd4hz3kv6zn7h6qq3narkilri8a071y1n8j31jps4ma"))))
+      (build-system emacs-build-system)
+      (home-page "https://github.com/joostkremers/nswbuff")
+      (synopsis "Quickly switch between buffers")
+      (description "This package allows for navigating between buffers within
+a customizable list.")
+      (license license:gpl3+))))
+
 (define-public emacs-multiple-cursors
   (package
     (name "emacs-multiple-cursors")
@@ -3382,6 +3480,32 @@ completion candidate when using the Company text completion framework.")
 simultaneous cursors.")
     (license license:gpl3+)))
 
+(define-public emacs-mc-extras
+  (let ((commit "053abc52181b8718559d7361a587bbb795faf164")
+        (revision "1"))
+    (package
+      (name "emacs-mc-extras")
+      (version (git-version "1.2.4" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/knu/mc-extras.el.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "16y48qrd20m20vypvys5jp4v4gc1qrqlkm75s1pk1r68i9zrw481"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-multiple-cursors" ,emacs-multiple-cursors)))
+      (home-page "https://github.com/knu/mc-extras.el")
+      (synopsis "Extra functions for manipulating multiple cursors")
+      (description
+       "This package provides additional functions for
+@code{multiple-cursors}, including functions for marking s-expressions,
+comparing characters, removing cursors, and more.")
+      (license license:bsd-2))))
+
 (define-public emacs-typo
   (package
     (name "emacs-typo")
@@ -3983,6 +4107,38 @@ minutes is started automatically.  Every 4 breaks a long break is
 started with 20 minutes.  All values are customizable.")
     (license license:gpl3+)))
 
+(define-public emacs-org-sidebar
+  (let ((commit "74ca98b9920f3de3f13d49866581435e1ec63ec5")
+        (revision "1"))
+    (package
+      (name "emacs-org-sidebar")
+      (version (git-version "0.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/alphapapa/org-sidebar.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "03p1ndyw2qp2skib5hszc4xyh84w7p2mhkd4a9dy6qv8q47xpsqn"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-dash" ,emacs-dash)
+         ("emacs-org-super-agenda" ,emacs-org-super-agenda)
+         ("emacs-org" ,emacs-org)
+         ("emacs-org-ql" ,emacs-org-ql)
+         ("emacs-s" ,emacs-s)))
+      (home-page "https://github.com/alphapapa/org-sidebar")
+      (synopsis "Helpful sidebar for Org buffers")
+      (description "This package provides a sidebar for Org buffers.  At the
+top is a chronological list of scheduled and deadlined tasks in the current
+buffer (similar to the Org agenda ,but without all its features), and below
+that is a list of all other non-done to-do items.  If the buffer is narrowed,
+the sidebar only shows items in the narrowed portion; this allows seeing an
+overview of tasks in a subtree.")
+      (license license:gpl3+))))
+
 (define-public emacs-org-trello
   (package
     (name "emacs-org-trello")
@@ -4576,45 +4732,50 @@ automatically.")
     (license license:gpl3+)))
 
 (define-public emacs-ivy
-  (package
-    (name "emacs-ivy")
-    (version "0.12.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/abo-abo/swiper.git")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "0xgngn3jhmyn6mlkk9kmgfgh0w5i50b27syr4cgfgarg6p77j05w"))))
-    (build-system emacs-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'install 'install-doc
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (info (string-append out "/share/info")))
-               (with-directory-excursion "doc"
-                 (invoke "makeinfo" "ivy.texi")
-                 (install-file "ivy.info" info)
-                 #t)))))))
-    (propagated-inputs
-     `(("emacs-hydra" ,emacs-hydra)))
-    (native-inputs
-     `(("texinfo" ,texinfo)))
-    (home-page "http://oremacs.com/swiper/")
-    (synopsis "Incremental vertical completion for Emacs")
-    (description
-     "This package provides @code{ivy-read} as an alternative to
+  ;; The latest release version introduced a new feature, swiper-isearch, that
+  ;; generally works well but had some noticeable bugs; this later commit
+  ;; includes fixes for several of them.
+  (let ((commit "d3e4514fd72f217c704ae18afdf711bb9036a04d")
+        (revision "1"))
+    (package
+      (name "emacs-ivy")
+      (version (git-version "0.12.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/abo-abo/swiper.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "142axxc6vsl14cfyvzj9csiykxdn7vhw88fy955hzx7av4qfqg4x"))))
+      (build-system emacs-build-system)
+      (arguments
+       `(#:phases
+         (modify-phases %standard-phases
+           (add-after 'install 'install-doc
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out"))
+                      (info (string-append out "/share/info")))
+                 (with-directory-excursion "doc"
+                   (invoke "makeinfo" "ivy.texi")
+                   (install-file "ivy.info" info)
+                   #t)))))))
+      (propagated-inputs
+       `(("emacs-hydra" ,emacs-hydra)))
+      (native-inputs
+       `(("texinfo" ,texinfo)))
+      (home-page "http://oremacs.com/swiper/")
+      (synopsis "Incremental vertical completion for Emacs")
+      (description
+       "This package provides @code{ivy-read} as an alternative to
 @code{completing-read} and similar functions.  No attempt is made to determine
 the best candidate.  Instead, the user can navigate candidates with
 @code{ivy-next-line} and @code{ivy-previous-line}.  The matching is done by
 splitting the input text by spaces and re-building it into a regular
 expression.")
-    (license license:gpl3+)))
+      (license license:gpl3+))))
 
 (define-public emacs-ivy-pass
   (let ((commit "5b523de1151f2109fdd6a8114d0af12eef83d3c5")
@@ -5200,7 +5361,7 @@ strings, and code folding.")
 (define-public emacs-nodejs-repl
   (package
     (name "emacs-nodejs-repl")
-    (version "0.2.1")
+    (version "0.2.2")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -5209,7 +5370,7 @@ strings, and code folding.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "05ccv87rnw7fss3lib8m9sywjrj6n92fnd7mmhmjh27g2klqc83z"))))
+                "1kkj888k9x5n0i7xkia177gzsa84my3g8n0n7v65281cc4f1yhk5"))))
     (build-system emacs-build-system)
     (home-page "https://github.com/abicky/nodejs-repl.el")
     (synopsis "Node.js REPL inside Emacs")
@@ -5552,28 +5713,35 @@ environments (virtualenv) inside Emacs.")
     (license license:gpl3+)))
 
 (define-public emacs-highlight-indentation
-  (package
-    (name "emacs-highlight-indentation")
-    (version "0.7.0")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/antonj/Highlight-Indentation-for-Emacs.git")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "00l54k75qk24a0znzl4ij3s3nrnr2wy9ha3za8apphzlm98m907k"))))
-    (build-system emacs-build-system)
-    (home-page "https://github.com/antonj/Highlight-Indentation-for-Emacs/")
-    (synopsis "Highlighting indentation for Emacs")
-    (description "Provides two minor modes to highlight indentation guides in Emacs:
+  ;; Last release version is from 2015.
+  (let ((commit "d03803f2c06749c430443a3d24e039cbafc9c58f")
+        (revision "1"))
+    (package
+      (name "emacs-highlight-indentation")
+      (version (git-version "0.7.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/antonj/Highlight-Indentation-for-Emacs.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "1jq0gf4kcx9hvrw40rnw5c2qynjpjw1vsjbi2i4lqjbsnfnxn4wz"))))
+      (build-system emacs-build-system)
+      (home-page "https://github.com/antonj/Highlight-Indentation-for-Emacs/")
+      (synopsis "Highlighting indentation for Emacs")
+      (description "This package provides two minor modes to highlight
+indentation guides in Emacs:
+
 @enumerate
 @item @code{highlight-indentation-mode}, which displays guidelines
-indentation (space indentation only).
-@item @code{highlight-indentation-current-column-mode}, which displays guidelines for the current-point indentation (space indentation only).
+  indentation (space indentation only).
+@item @code{highlight-indentation-current-column-mode}, which displays
+  guidelines for the current-point indentation (space indentation only).
 @end enumerate")
-    (license license:gpl2+)))
+      (license license:gpl2+))))
 
 (define-public emacs-elpy
   (package
@@ -5903,7 +6071,7 @@ ack, ag, helm and pt.")
 (define-public emacs-helm
   (package
     (name "emacs-helm")
-    (version "3.2")
+    (version "3.3")
     (source
      (origin
        (method git-fetch)
@@ -5912,7 +6080,7 @@ ack, ag, helm and pt.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "12yyprpgh2by2pd41i4z9gz55fxg0f90x03bfrsf791xwbhf6931"))))
+        (base32 "0fqhw7r9fcsja5d3pgbipw7pkw9nj534faav6hi45413hc3gyv92"))))
     (build-system emacs-build-system)
     (propagated-inputs
      `(("emacs-async" ,emacs-async)
@@ -6091,21 +6259,21 @@ xref, etc...) are still available, but with better integration.")
       (license license:gpl3+))))
 
 (define-public emacs-lua-mode
-  (let ((commit "652e299cb967fccca827dda381d61a9c144d97de")
-        (revision "1"))
+  (let ((commit "95c64bb5634035630e8c59d10d4a1d1003265743")
+        (revision "2"))
     (package
       (name "emacs-lua-mode")
-      (version (string-append "20151025." revision "-" (string-take commit 9)))
+      (version (git-version "20151025" revision commit))
       (home-page "https://github.com/immerrr/lua-mode/")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
                       (url home-page)
                       (commit commit)))
-                (file-name (string-append name "-" version ".checkout"))
+                (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "053025k930wh0lak6rc1973ynfrmm8zsyzfqhhd39x7abkl41hc9"))))
+                  "1mra4db25ds64526dsj8m5yv0kfq3lgggjh1x6xmqypdaryddbcp"))))
       (build-system emacs-build-system)
       (synopsis "Major mode for lua")
       (description
@@ -6371,12 +6539,11 @@ aligning text objects based on separators.")
       (license license:gpl3+))))
 
 (define-public emacs-evil-expat
-  (let ((commit "4c344ea19b789002d759a202ffbf594730d2c59a")
-        (version "0.0.1")
+  (let ((commit "f4fcd0aa3edc359adb5c986b5dd9188d220d84e2")
         (revision "1"))
     (package
       (name "emacs-evil-expat")
-      (version (git-version version revision commit))
+      (version (git-version "0.0.1" revision commit))
       (source
        (origin
          (method git-fetch)
@@ -6386,7 +6553,7 @@ aligning text objects based on separators.")
          (file-name (git-file-name name version))
          (sha256
           (base32
-           "16v7fnldxag6l1lsnrnhdjkga9qi78lbdfbb82k6pmv04991mbkr"))))
+           "0872ix682hkdz0k8pn6sb54rqkx00rz5fxpd5j2snx406yagpaxz"))))
       (build-system emacs-build-system)
       (propagated-inputs `(("emacs-evil" ,emacs-evil)))
       (home-page "https://github.com/edkolev/evil-expat")
@@ -6559,14 +6726,14 @@ passive voice.")
     (name "emacs-org")
     ;; emacs-org-contrib inherits from this package.  Please update its sha256
     ;; checksum as well.
-    (version "9.2.3")
+    (version "9.2.5")
     (source (origin
               (method url-fetch)
-              (uri (string-append "http://elpa.gnu.org/packages/org-"
+              (uri (string-append "https://elpa.gnu.org/packages/org-"
                                   version ".tar"))
               (sha256
                (base32
-                "0hqy4lns9q5p0l1ylgmlckqprn9sbasszhznanmv0rsh0gzhsbyw"))))
+                "1pid1sykgz83i4ry5n8f270finag6sm7ckqxn5lkikyya43wlzx1"))))
     (build-system emacs-build-system)
     (home-page "https://orgmode.org/")
     (synopsis "Outline-based notes management and organizer")
@@ -6580,14 +6747,14 @@ programming and reproducible research.")
   (package
     (inherit emacs-org)
     (name "emacs-org-contrib")
-    (version "20190715")
+    (version "20190805")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://orgmode.org/elpa/org-plus-contrib-"
                                   version ".tar"))
               (sha256
                (base32
-                "0yxxkcaxhp5bmjsfdd9pz79rj9s7nb4gj5ci51sh4pf8mimk9542"))))
+                "1mw91hwbqyjq5pyz9hzdhvjlc2bphqpi23yqd3sdk1crpc87s40c"))))
     (arguments
      `(#:modules ((guix build emacs-build-system)
                   (guix build utils)
@@ -7131,6 +7298,56 @@ find files owned by packages...  And much more, including performing all the
 above over the network.")
       (license license:gpl3+))))
 
+(define-public emacs-helm-org-rifle
+  (package
+    (name "emacs-helm-org-rifle")
+    (version "1.6.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/alphapapa/helm-org-rifle")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "1r38xhwvgbv6kn5x159phz3xgss7f1rc7icq27rnr4d8aj91wm6k"))))
+    (build-system emacs-build-system)
+    (propagated-inputs
+     `(("emacs-dash" ,emacs-dash)
+       ("emacs-f" ,emacs-f)
+       ("emacs-helm" ,emacs-helm)
+       ("emacs-s" ,emacs-s)))
+    (home-page "https://github.com/alphapapa/helm-org-rifle")
+    (synopsis "Rifle through Org files")
+    (description "This package searches both headings and contents of entries
+in Org buffers and displays matching entries.")
+    (license license:gpl3+)))
+
+(define-public emacs-dired-toggle-sudo
+  (package
+    (name "emacs-dired-toggle-sudo")
+    (version "1.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/renard/dired-toggle-sudo")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "0ajj8d6k5in2hclcrqckinfh80ylddplva0ryfbkzsjkfq167cv2"))
+       (patches
+        (search-patches
+         "emacs-dired-toggle-sudo-emacs-26.patch"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/renard/dired-toggle-sudo")
+    (synopsis "Browse directory with @code{sudo} privileges")
+    (description "This package allows for the use of @code{dired} with
+@code{sudo} privileges.")
+    (license license:wtfpl2)))
+
 (define-public emacs-memoize
   (package
     (name "emacs-memoize")
@@ -8500,12 +8717,11 @@ the actual transformations.")
       (license license:gpl2+))))
 
 (define-public emacs-dired-hacks
-  (let ((commit "2c1234592aee91dcd9401bcd67213e6a4a464fd9")
-        (revision "1"))
+  (let ((commit "886befe113fae397407c804f72c45613d1d43535")
+        (revision "2"))
     (package
       (name "emacs-dired-hacks")
-      (version (string-append "0.0.1-" revision "."
-                              (string-take commit 7)))
+      (version (git-version "0.0.1" revision commit))
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
@@ -8514,7 +8730,7 @@ the actual transformations.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "1g7mky41cahpryzj6frdgzdymknpqq7pidzfjj9304887kijmhj3"))))
+                  "1cvibg90ggyrivpjmcfprpi2fx7dpa68f8kzg08s88gw5ib75djl"))))
       (build-system emacs-build-system)
       (propagated-inputs
        `(("emacs-dash" ,emacs-dash)
@@ -8525,7 +8741,9 @@ the actual transformations.")
       (synopsis
        "Collection of useful dired additions")
       (description
-       "Collection of Emacs dired mode additions:
+       "This package provides the following collection of Emacs dired mode
+additions:
+
 @itemize
 @item dired-avfs
 @item dired-columns
@@ -8595,6 +8813,32 @@ available key bindings that follow C-x (or as many as space allows given your
 settings).")
     (license license:gpl3+)))
 
+(define-public emacs-hercules
+  (let ((commit "3345904a0dab4c7a4d4478f0766f1d9f5d1bb501")
+        (revision "1"))
+    (package
+      (name "emacs-hercules")
+      (version (git-version "0.2" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://gitlab.com/jjzmajic/hercules.el.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "0cpq8h6l47nqhzch6snax5yrhxl8p4wn35q13ci35lj3iq8kmlk8"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-which-key" ,emacs-which-key)))
+      (home-page "https://gitlab.com/jjzmajic/hercules.el")
+      (synopsis "Call a chain of related commands without repeated prefix keys")
+      (description
+       "This package provides sticky-key-like functionality to obviate the
+need for repeated prefix-key sequences, and can reuse existing keymaps. The
+list of commands is displayed in a handy popup.")
+      (license license:gpl3+))))
+
 (define-public emacs-ws-butler
   (package
     (name "emacs-ws-butler")
@@ -8772,7 +9016,7 @@ internally.")
 (define-public emacs-gitpatch
   (package
     (name "emacs-gitpatch")
-    (version "0.5.0")
+    (version "0.5.1")
     (source
      (origin
        (method git-fetch)
@@ -8781,7 +9025,7 @@ internally.")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1jj12pjwza6cq8a3kr8nqnmm3vxs0wam8h983irry4xr4ifywsn4"))))
+        (base32 "1drf4fvmak7brf16axkh4nfz8pg44i7pjhfjz3dbkycbpp8y5vig"))))
     (build-system emacs-build-system)
     (home-page "https://github.com/tumashu/gitpatch")
     (synopsis "Mail git patch from Emacs")
@@ -10405,29 +10649,32 @@ as well as functions for navigating between these headings.")
     (license license:gpl3+)))
 
 (define-public emacs-org-super-agenda
-  (package
-   (name "emacs-org-super-agenda")
-   (version "1.1")
-   (source (origin
-            (method git-fetch)
-            (uri (git-reference
-                  (url "https://github.com/alphapapa/org-super-agenda")
-                  (commit version)))
-            (file-name (git-file-name name version))
-            (sha256
-             (base32
-              "0vzf91lsxnhwf52kvm8ycpf0wb9c8l91689vyhwgv4wz8q6cvjwp"))))
-   (build-system emacs-build-system)
-   (propagated-inputs
-    `(("emacs-org" ,emacs-org)
-      ("emacs-dash" ,emacs-dash)
-      ("emacs-ht" ,emacs-ht)
-      ("emacs-s" ,emacs-s)))
-   (home-page "https://github.com/alphapapa/org-super-agenda")
-   (synopsis "Supercharged Org agenda")
-   (description "This package allows items in the Org agenda to be grouped
+  ;; emacs-org-sidebar depends on a newer commit than the latest release version.
+  (let ((commit "375bde4ca72494ac88a2a9738754f047fe45cc4e")
+        (revision "1"))
+    (package
+      (name "emacs-org-super-agenda")
+      (version (git-version "1.1.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/alphapapa/org-super-agenda")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0hrwf02fqjm0d9gj146ax67ib76093qpqh7066dcxj2gy20625yj"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-org" ,emacs-org)
+         ("emacs-dash" ,emacs-dash)
+         ("emacs-ht" ,emacs-ht)
+         ("emacs-s" ,emacs-s)))
+      (home-page "https://github.com/alphapapa/org-super-agenda")
+      (synopsis "Supercharged Org agenda")
+      (description "This package allows items in the Org agenda to be grouped
 into sections while preserving the structure imposed by any timestamps.")
-   (license license:gpl3+)))
+      (license license:gpl3+))))
 
 (define-public emacs-org-make-toc
   (package
@@ -10454,30 +10701,27 @@ tables of contents.")
     (license license:gpl3+)))
 
 (define-public emacs-org-ql
-  (let ((commit "0aec8ec60395197b2ef2b885c216cf84286efed9")
-        (version "0.1-pre")
-        (revision "1"))
-    (package
-      (name "emacs-org-ql")
-      (version (git-version version revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/alphapapa/org-ql")
-                      (commit commit)))
-                (sha256
-                 (base32
-                  "0bj85hxhym7rvkaddcxybxdm7g7w439wij9f2w5ljz1hmvp55991"))
-                (file-name (git-file-name name version))))
-      (build-system emacs-build-system)
-      (propagated-inputs
-       `(("emacs-s" ,emacs-s)
-         ("emacs-dash" ,emacs-dash)))
-      (home-page "https://github.com/alphapapa/org-ql")
-      (synopsis "Query language for Org buffers")
-      (description "This package provides a Lispy query language for Org
+  (package
+    (name "emacs-org-ql")
+    (version "0.1")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/alphapapa/org-ql")
+                    (commit version)))
+              (sha256
+               (base32
+                "1nvzirn1lmgmgl7irbsc1n391a2cw8gmvwm3pa228l2c1gcx8kd8"))
+              (file-name (git-file-name name version))))
+    (build-system emacs-build-system)
+    (propagated-inputs
+     `(("emacs-s" ,emacs-s)
+       ("emacs-dash" ,emacs-dash)))
+    (home-page "https://github.com/alphapapa/org-ql/")
+    (synopsis "Query language for Org buffers")
+    (description "This package provides a Lispy query language for Org
 files, allowing for actions to be performed based on search criteria.")
-      (license license:gpl3+))))
+    (license license:gpl3+)))
 
 (define-public emacs-parsebib
   (package
@@ -12651,6 +12895,29 @@ When @code{gac-automatically-push-p} is non-nil, it also tries to push to
 the current upstream.")
     (license license:gpl3+)))
 
+(define-public emacs-scroll-on-drag
+  (let ((commit "888abd04c34753b1fc4b2fe541bc004ebec5c996")
+        (revision "1"))
+    (package
+      (name "emacs-scroll-on-drag")
+      (version (git-version "0.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://gitlab.com/ideasman42/emacs-scroll-on-drag.git")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "1si4hdqa3jw1inbyh3wb3i5i9grbms1nwky3vyk9zg7iznwm8a9p"))))
+      (build-system emacs-build-system)
+      (home-page "https://gitlab.com/ideasman42/emacs-scroll-on-drag")
+      (synopsis "Interactive scrolling")
+      (description "This package permits scrolling at increasing speeds based
+on drag distance.")
+      (license license:gpl3+))))
+
 (define-public emacs-company-restclient
   (package
     (name "emacs-company-restclient")
@@ -13667,12 +13934,11 @@ server with @code{M-x pinentry-start}.")
       (license license:gpl3+))))
 
 (define-public emacs-so-long
-  (let ((commit "3ebe97decdb5cbbfba82ca686e0ad2c7d2722b4a")
-        (version "1.0")
-        (revision "1"))
+  (let ((commit "cfae473b1bf65f78ddb015159e667ec0103d881c")
+        (revision "2"))
     (package
       (name "emacs-so-long")
-      (version (git-version version revision commit))
+      (version (git-version "1.0" revision commit))
       (source
        (origin
          (method git-fetch)
@@ -13682,7 +13948,7 @@ server with @code{M-x pinentry-start}.")
          (file-name (git-file-name name version))
          (sha256
           (base32
-           "0fi71g5rsdsi978jz8406k8hvzgnssm9wxar8yqfhs97178r9s5m"))))
+           "0g943n5cl9lz5s7hszg6yvp10xd1xvd8mfgxyg0yckmp8fqkswin"))))
       (build-system emacs-build-system)
       (home-page "https://www.emacswiki.org/emacs/SoLong")
       (synopsis "Improve performance in files with long lines")
@@ -14117,7 +14383,7 @@ buffers – other modes on the TODO list).
 (define-public emacs-magit-todos
   (package
     (name "emacs-magit-todos")
-    (version "1.2")
+    (version "1.3")
     (source
      (origin
        (method git-fetch)
@@ -14127,7 +14393,7 @@ buffers – other modes on the TODO list).
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "17a18gszbypz82bj36xbfyykc4s9rz83vwmpxvlf65svhd51c0nh"))))
+         "0gfm6wn2a4v5i9lfsvvin0kwpr9n96ddm3z4yf50jd3kg2igzry1"))))
     (build-system emacs-build-system)
     (propagated-inputs
      `(("emacs-async" ,emacs-async)
@@ -16164,7 +16430,7 @@ previewed by scrolling up and down within a @code{dired} buffer.")
 (define-public emacs-counsel-etags
   (package
     (name "emacs-counsel-etags")
-    (version "1.8.4")
+    (version "1.8.7")
     (source
      (origin
        (method git-fetch)
@@ -16174,7 +16440,7 @@ previewed by scrolling up and down within a @code{dired} buffer.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "14my9jvxl26a5yn381h5pi5481y9d9gyk7wnxxd0s4sjc964c5h5"))))
+         "0vjcjspfrz1csnmfi6r7p7f070a496adxkqnsxwx1gx8cpylwp1g"))))
     (build-system emacs-build-system)
     (propagated-inputs
      `(("emacs-ivy" ,emacs-ivy)))
@@ -16607,6 +16873,30 @@ provided.  Those alternative commands are and bound by default to their
 corresponding Evil keys.")
       (license license:expat))))
 
+(define-public emacs-evil-traces
+  (let ((commit "b41b7432b8110378c199a3d25af464083777f453")
+        (revision "1"))
+    (package
+      (name "emacs-evil-traces")
+      (version (git-version "0.0.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/mamapanda/evil-traces.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0a15f2saynz9fws1h5s7py3cshsk4xs1kwgwj1m5rsin36g0j6hc"))))
+      (build-system emacs-build-system)
+      (propagated-inputs
+       `(("emacs-evil" ,emacs-evil)))
+      (home-page "https://github.com/mamapanda/evil-traces")
+      (synopsis "Visual hints for @code{evil-ex}")
+      (description "This package adds visual hints to certain @code{ex}
+commands in @code{evil-mode}.")
+      (license license:gpl3+))))
+
 (define-public emacs-xterm-color
   (let ((commit "a452ab38a7cfae97078062ff8885b5d74fd1e5a6")
         (version "1.8")
@@ -16656,6 +16946,26 @@ Org-mode (the notes may have outlines, latex fragments, babel, etc...) while
 acting like notes that are made @emph{in} the document.")
     (license license:gpl3+)))
 
+(define-public emacs-org-redmine
+  (let ((commit "e77d013bc3784947c46a5c53f03cd7d3c68552fc"))
+    (package
+      (name "emacs-org-redmine")
+      (version (git-version "0.1" "1" commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/gongo/org-redmine.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "06miv3mf2a39vkf6mmm5ssc47inqh7dq82khsyc03anz4d4lj822"))))
+      (build-system emacs-build-system)
+      (home-page "https://github.com/gongo/org-redmine/")
+      (synopsis "Redmine tools using Emacs")
+      (description "This program provides an Emacs client for Redmine.")
+      (license license:gpl3+))))
+
 (define-public emacs-multi-term
   (let ((commit "0804b11e52b960c80f5cd0712ee1e53ae70d83a4"))
     (package
@@ -16747,3 +17057,137 @@ connections using TLS encryption.")
      "Zerodark is a dark theme inspired from One Dark and Niflheim.
 An optional mode-line format can be enabled with @code{zerodark-setup-modeline-format}.")
     (license license:gpl3+)))
+
+(define-public emacs-gnus-alias
+  (package
+    (name "emacs-gnus-alias")
+    (version "20150316")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/hexmode/gnus-alias.git")
+                    (commit "9447d3ccb4c0e75d0468899cccff7aa249657bac")))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1i278npayv3kfxxd1ypi9n83q5l402sbc1zkm11pf8g006ifqsp4"))))
+    (build-system emacs-build-system)
+    (home-page "https://melpa.org/#/gnus-alias")
+    (synopsis "Alternative to @code{gnus-posting-styles}")
+    (description "This Emacs add-on provides a simple mechanism to switch
+Identities when using a @code{message-mode} or a @code{message-mode} derived
+mode.  Identities can include @code{From} and @code{Organisation} headers,
+extra headers, body and signature.  Other features include:
+
+@itemize
+@item Switch Identities in a message buffer.
+@item Access original message to help determine Identity of the followup/reply
+message.
+@item Act on a forwarded message as if it were a message being replied to.
+@item Start a new message with a given Identity pre-selected.
+@end itemize")
+    (license license:gpl2+)))
+
+(define-public emacs-ox-epub
+  (package
+    (name "emacs-ox-epub")
+    (version "0.3")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/ofosos/ox-epub.git")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "057sqmvm8hwkhcg3yd4i8zz2xlqsqrpyiklyiw750s3i5mxdn0k7"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/ofosos/ox-epub")
+    (synopsis "Export org mode projects to EPUB")
+    (description "@code{ox-epub} extends the (X)HTML exporter to generate
+@code{.epub} files directly from OrgMode.  This will export EPUB version 2,
+which should give broad compatibility.  It should also be relatiely easy to
+convert the resulting @code{.epub} to a @code{.mobi} file.  Needs a working
+zip utility (default is @code{zip}).")
+    (license license:gpl3+)))
+
+(define-public emacs-ox-pandoc
+  (package
+    (name "emacs-ox-pandoc")
+    (version "20180510")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/kawabata/ox-pandoc.git")
+                    (commit "aa37dc7e94213d4ebedb85c384c1ba35007da18e")))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0iibxplgdp34bpq1yll2gmqjd8d8lnqn4mqjvx6cdf0y438yr4jz"))))
+    (build-system emacs-build-system)
+    (inputs
+     `(("pandoc" ,ghc-pandoc)))
+    (propagated-inputs
+     `(("emacs-dash" ,emacs-dash)
+       ("emacs-ht" ,emacs-ht)))
+    (home-page "https://github.com/kawabata/ox-pandoc")
+    (synopsis "Org exporter for Pandoc")
+    (description "@code{ox-pandoc} is an exporter for converting Org-mode
+files to numerous other formats via Pandoc.")
+    (license license:gpl3+)))
+
+(define-public emacs-wc-mode
+  (package
+    (name "emacs-wc-mode")
+    (version "1.3")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/bnbeckwith/wc-mode.git")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0pjlxv46zzqdq6q131jb306vqlg4sfqls1x8vag7mmfw462hafqp"))))
+    (build-system emacs-build-system)
+    (home-page "https://github.com/bnbeckwith/wc-mode")
+    (synopsis "Running word count with goals (minor mode)")
+    (description "@code{wc-mode} is a minor mode, providing a ‘wc’ function
+for Emacs buffers as well as a modeline addition with live word, line and
+character counts.  Additionally, a user can set specific goals for adding or
+deleting words.  These goals were partly inspired by 750words.com where the
+goal of the site is to encourage writing by setting a goal of 750 words at a
+time.")
+    (license license:gpl3+)))
+
+(define-public emacs-mastodon
+  (package
+    (name "emacs-mastodon")
+    (version "0.9.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/jdenen/mastodon.el.git")
+                    (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0hwax6y9dghqwsbnb6f1bnc7gh8xsh5cvcnayk2sn49x8b0zi5h1"))))
+    (build-system emacs-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         ;; Move the source files to the top level, which is included in
+         ;; the EMACSLOADPATH.
+         (add-after 'unpack 'move-source-files
+           (lambda _
+             (let ((el-files (find-files "./lisp" ".*\\.el$")))
+               (for-each (lambda (f)
+                           (rename-file f (basename f)))
+                         el-files))
+             #t)))))
+    (home-page "https://github.com/jdenen/mastodon.el")
+    (synopsis "Emacs client for Mastodon")
+    (description "@code{mastodon.el} is an Emacs client for Mastodon, the
+federated microblogging social network.")
+    (license license:gpl3+)))
diff --git a/gnu/packages/enchant.scm b/gnu/packages/enchant.scm
index ce148b47a5..cfec161784 100644
--- a/gnu/packages/enchant.scm
+++ b/gnu/packages/enchant.scm
@@ -33,7 +33,7 @@
 (define-public enchant
   (package
     (name "enchant")
-    (version "2.2.4")
+    (version "2.2.5")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/AbiWord/enchant/releases"
@@ -41,7 +41,7 @@
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1p6a3qmrh8bjzds6x7rg9da0ir44gg804jzkf634h39wsa4vdmpm"))))
+                "0iqwzs11i9fvqdxv5kn0svcn2mzymn657qf3j66lg8dx1nh4xkpz"))))
     (build-system gnu-build-system)
     (arguments
      '(#:configure-flags '("--disable-static"
diff --git a/gnu/packages/finance.scm b/gnu/packages/finance.scm
index 977ac9c19c..2163ea2152 100644
--- a/gnu/packages/finance.scm
+++ b/gnu/packages/finance.scm
@@ -13,6 +13,7 @@
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
 ;;; Copyright © 2019 Tanguy Le Carrour <tanguy@bioneland.org>
+;;; Copyright © 2019 Martin Becze <mjbecze@riseup.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -38,6 +39,7 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system python)
   #:use-module (guix build-system glib-or-gtk)
+  #:use-module (guix build-system go)
   #:use-module (guix utils)
   #:use-module (gnu packages)
   #:use-module (gnu packages base)
@@ -712,9 +714,6 @@ the Monero GUI client.")
 Ledger Nano as a hardware SSH/GPG agent.")
     (license license:lgpl3)))
 
-(define-public python2-trezor-agent
-  (package-with-python2 python-trezor-agent))
-
 (define-public python-mnemonic
   (package
     (name "python-mnemonic")
@@ -810,9 +809,6 @@ Ledger Blue/Nano S.")
 TREZOR Hardware Wallet.")
     (license license:lgpl3)))
 
-(define-public python2-trezor
-  (package-with-python2 python-trezor))
-
 (define-public python-keepkey
   (package
     (name "python-keepkey")
@@ -962,7 +958,7 @@ Luhn and family of ISO/IEC 7064 check digit algorithms. ")
 (define-public python-duniterpy
   (package
     (name "python-duniterpy")
-    (version "0.54.3")
+    (version "0.55.1")
     (source
      (origin
        (method git-fetch)
@@ -973,7 +969,7 @@ Luhn and family of ISO/IEC 7064 check digit algorithms. ")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1k3rpfc9zxj9z50cr4zjfyzdla9ap5mj1v1rlcriqmflgb5cmiba"))))
+         "07zsbbkzmnvyv5v0vw2d42vw3ar4iqhlidy9376ysk4ldlj1igf7"))))
     (build-system python-build-system)
     (arguments
      ;; Tests fail with "AttributeError: module 'attr' has no attribute 's'".
@@ -1020,7 +1016,7 @@ main features are:
 (define-public silkaj
   (package
     (name "silkaj")
-    (version "0.7.2")
+    (version "0.7.3")
     (source
      (origin
        (method git-fetch)
@@ -1030,7 +1026,7 @@ main features are:
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "059k2kil2l8jcm4wp86w1z7y8p26rww7d3l5fzds0qq2dzvkvzgs"))))
+         "0yk2574yb0d0k0rg7qf0pkmjidblsad04x8hhqpy9k80rvgjcr5w"))))
     (build-system python-build-system)
     (arguments
      `(#:tests? #f))                    ;no test
@@ -1092,3 +1088,26 @@ financial years, budget estimates, bankcard management and other
 information.")
     (home-page "http://grisbi.org")
     (license license:gpl2+)))
+
+(define-public trezord
+  (package
+    (name "trezord")
+    (version "2.0.17")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/trezor/trezord-go.git")
+              (commit (string-append "v" version))))
+       (sha256
+        (base32
+         "0nqzpq0i3crh0i4r1cppja5sn3rwi1fv9afxzwzv63096x5l30a7"))
+       (file-name (git-file-name name version))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/trezor/trezord-go"))
+    (home-page "https://trezor.io")
+    (synopsis "Trezor Communication Daemon aka Trezor Bridge (written in Go)")
+    (description "This allows a Trezor hardware wallet to communicate to the
+Trezor wallet.")
+    (license license:lgpl3+)))
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index 1982d0bf4b..e64f3b099e 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -616,7 +616,7 @@ definitions.")
 opentype fonts.  You can save fonts in many different outline formats, and
 generate bitmaps.")
    (license license:gpl3+)
-   (home-page "https://fontforge.github.io/en-US/")))
+   (home-page "https://fontforge.github.io")))
 
 (define-public python2-ufolib
   (package
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index 266a2d3bac..07ed02ba18 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -3264,26 +3264,19 @@ tactics.")
 (define-public starfighter
   (package
     (name "starfighter")
-    (version "2.0.0.2")
-    ;; As recommended by the upstream maintainer, use the git source code
-    ;; instead of the released source tarball until missing files in the tarball
-    ;; are added.  The 'url-fetch' method may be appropriate again after the
-    ;; next update.  See https://github.com/pr-starfighter/starfighter/issues/1
-    ;; for more details.
+    (version "2.0.0.3")
     (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/pr-starfighter/starfighter")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/pr-starfighter/starfighter/releases"
+                    "/download/v" version "/starfighter-"
+                    (version-major+minor version) "-src.tar.gz"))
               (sha256
                (base32
-                "0p81ywgm2dxjbpmbsgx4f2d83sy6lv3hinrr1vzprkf9viidqnd2"))))
+                "13vi5kh9ahws4f52421cbyw0jn7pmbnld358lqfmr6flql7ilj3b"))))
     (build-system gnu-build-system)
     (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("pkg-config" ,pkg-config)))
+     `(("pkg-config" ,pkg-config)))
     (inputs
      `(("pango" ,pango)
        ("sdl2" ,sdl2)
@@ -6763,7 +6756,7 @@ fight each other on an arena-like map.")
 (define-public flare-engine
   (package
     (name "flare-engine")
-    (version "1.10")
+    (version "1.11")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -6772,7 +6765,7 @@ fight each other on an arena-like map.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "19l83145ya1wk666acr91b6917a63ak7l77d10i5im8xfhv29ml4"))))
+                "1mqr1s72p5bdh4kq2a8hg72dk8lwnddicjnd2cdp1sbfa9lmjym8"))))
     (build-system cmake-build-system)
     (arguments
      `(#:tests? #f                      ;no test
@@ -6791,7 +6784,7 @@ action RPGs.")
 (define-public flare-game
   (package
     (name "flare-game")
-    (version "1.10")
+    (version "1.11")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -6800,7 +6793,7 @@ action RPGs.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "0dx4f1j1n3p4q3h0r0fb89f0llvhg9lia0s247pacff3r88ljihk"))))
+                "0bd5g7sd89a9176ilr408hdqzdfv4j7wj0idd685c1n6s01c3h6p"))))
     (build-system cmake-build-system)
     (arguments
      `(#:tests? #f                      ;no test
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 9aa4ed538b..601248b7f5 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -38,6 +38,7 @@
 ;;; Copyright © 2019 Florian Pelz <pelzflorian@pelzflorian.de>
 ;;; Copyright © 2019 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2019 Jelle Licht <jlicht@fsfe.org>
+;;; Copyright © 2019 Jonathan Frederickson <jonathan@terracrypt.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -8152,12 +8153,18 @@ advanced image management tool")
     (inputs
      `(("cairo" ,cairo)
        ("gobject-introspection" ,gobject-introspection)
+       ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
        ("python2-pycairo" ,python2-pycairo)
        ("python2-pygobject" ,python2-pygobject)
        ("python2-psutil" ,python2-psutil)
        ("vte" ,vte)))
     (arguments
-     `(#:python ,python-2                          ;Python 3 not supported
+     `(#:python ,python-2                          ; Python 3 isn't supported
+       #:imported-modules ((guix build glib-or-gtk-build-system)
+                           ,@%python-build-system-modules)
+       #:modules ((guix build python-build-system)
+                  ((guix build glib-or-gtk-build-system) #:prefix glib-or-gtk:)
+                  (guix build utils))
        #:phases
        (modify-phases %standard-phases
          (add-after
@@ -8168,10 +8175,60 @@ advanced image management tool")
               (wrap-program prog
                 `("PYTHONPATH" = (,(getenv "PYTHONPATH")))
                 `("GI_TYPELIB_PATH" = (,(getenv "GI_TYPELIB_PATH"))))
-              #t))))))
+              #t)))
+         (add-after 'wrap-program 'glib-or-gtk-wrap
+           (assoc-ref glib-or-gtk:%standard-phases 'glib-or-gtk-wrap)))))
     (home-page "https://gnometerminator.blogspot.com/")
     (synopsis "Store and run multiple GNOME terminals in one window")
     (description
      "Terminator allows you to run multiple GNOME terminals in a grid and
 +tabs, and it supports drag and drop re-ordering of terminals.")
     (license license:gpl2)))
+
+(define-public libhandy
+  (package
+    (name "libhandy")
+    (version "0.0.10")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://source.puri.sm/Librem5/libhandy")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1702hbdqhfpgw0c4vj2ag08vgl83byiryrbngbq11b9azmj3jhzs"))))
+    (build-system meson-build-system)
+    (arguments
+     `(#:configure-flags
+       '("-Dglade_catalog=disabled"
+         "-Dgtk_doc=true")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'disable-broken-test
+           (lambda _
+             ;; This test fails for unknown reasons
+             (substitute* "tests/meson.build"
+               (("'test-dialog',") ""))
+             #t))
+         (add-before 'check 'pre-check
+           (lambda _
+             ;; Tests require a running X server.
+             (system "Xvfb :1 &")
+             (setenv "DISPLAY" ":1")
+             #t)))))
+    (inputs
+     `(("gtk+" ,gtk+)))
+    (native-inputs
+     `(("glib:bin" ,glib "bin")
+       ("gobject-introspection" ,gobject-introspection) ; for g-ir-scanner
+       ("vala" ,vala)
+       ("gtk-doc" ,gtk-doc)
+       ("pkg-config" ,pkg-config)
+       ("gettext" ,gettext-minimal)
+       ("xorg-server" ,xorg-server)))
+    (home-page "https://source.puri.sm/Librem5/libhandy")
+    (synopsis "Library full of GTK+ widgets for mobile phones")
+    (description "The aim of the handy library is to help with developing user
+intefaces for mobile devices using GTK+.")
+    (license license:lgpl2.1+)))
diff --git a/gnu/packages/golang.scm b/gnu/packages/golang.scm
index 2f5396dd1e..c67ef036ee 100644
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@@ -48,6 +48,8 @@
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages mp3)
+  #:use-module (gnu packages textutils)
+  #:use-module (gnu packages tls)
   #:use-module (ice-9 match)
   #:use-module (srfi srfi-1))
 
@@ -220,7 +222,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
   (package
     (inherit go-1.4)
     (name "go")
-    (version "1.11.10")
+    (version "1.11.12")
     (source
      (origin
        (method url-fetch)
@@ -228,7 +230,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
                            name version ".src.tar.gz"))
        (sha256
         (base32
-         "06rw962xigbrxblp942jbh7k133blpxg2xfrxi32qdhxkmmfj9yz"))))
+         "09k9zmq7hhgg0bf1y7rwa0kn7q1vkkr94cmg2iv9lq3najh5nykd"))))
     (arguments
      (substitute-keyword-arguments (package-arguments go-1.4)
        ((#:phases phases)
@@ -401,7 +403,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
   (package
     (inherit go-1.4)
     (name "go")
-    (version "1.12.1")
+    (version "1.12.7")
     (source
      (origin
        (method url-fetch)
@@ -409,7 +411,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
                            name version ".src.tar.gz"))
        (sha256
         (base32
-         "12l12mmgqvy3nbscy7sz83qj4m6iz5a322aq9sk45f7l9ml2gq8b"))))
+         "04rvwj69gmw3bz8pw5pf10r21ar0pgpnswp15nkddf04dxyl9s4m"))))
     (arguments
      (substitute-keyword-arguments (package-arguments go-1.4)
        ((#:phases phases)
@@ -582,7 +584,7 @@ in the style of communicating sequential processes (@dfn{CSP}).")
        ,@(package-native-inputs go-1.4)))
     (supported-systems %supported-systems)))
 
-(define-public go go-1.11)
+(define-public go go-1.12)
 
 (define-public go-github-com-alsm-ioprogress
   (let ((commit "063c3725f436e7fba0c8f588547bee21ffec7ac5")
@@ -768,6 +770,79 @@ expressing configuration which is easy for both humans and machines to read.")
       (home-page "https://github.com/hashicorp/hcl")
       (license license:mpl2.0))))
 
+(define-public go-golang-org-x-tools
+  (let ((commit "8b927904ee0dec805c89aaf9172f4459296ed6e8")
+        (revision "0"))
+    (package
+      (name "go-golang-org-x-tools")
+      (version (git-version "0.1.3" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://go.googlesource.com/tools")
+                      (commit commit)))
+                (file-name (string-append "go.googlesource.com-tools-"
+                                          version "-checkout"))
+                (sha256
+                 (base32
+                  "0iinb70xhcjsddgi42ia1n745lx2ibnjdm6m2v666qrk3876vpck"))))
+      (build-system go-build-system)
+      (arguments
+       `(#:import-path "golang.org/x/tools"
+         ;; Source-only package
+         #:tests? #f
+         #:phases
+         (modify-phases %standard-phases
+           ;; Source-only package
+           (delete 'build))))
+      (synopsis "Tools that support the Go programming language")
+      (description "This package provides miscellaneous tools that support the
+Go programming language.")
+      (home-page "https://go.googlesource.com/tools/")
+      (license license:bsd-3))))
+
+(define-public go-golang-org-x-crypto
+  (let ((commit "b7391e95e576cacdcdd422573063bc057239113d")
+        (revision "3"))
+    (package
+      (name "go-golang-org-x-crypto")
+      (version (git-version "0.0.0" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://go.googlesource.com/crypto")
+                      (commit commit)))
+                (file-name (string-append "go.googlesource.com-crypto-"
+                                          version "-checkout"))
+                (sha256
+                 (base32
+                  "1jqfh81mhgwcc6b9l0bs6rb0707s01qpvn7896i5bsmig46lc7zm"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "golang.org/x/crypto"
+         ;; Source-only package
+         #:tests? #f
+         #:phases
+         (modify-phases %standard-phases
+           ;; Source-only package
+           (delete 'build)
+           (add-before 'reset-gzip-timestamps 'make-gzip-archive-writable
+             (lambda* (#:key outputs #:allow-other-keys)
+               (map (lambda (file)
+                      (make-file-writable file))
+                    (find-files
+                      (string-append (assoc-ref outputs "out")
+                                     "/src/golang.org/x/crypto/ed25519/testdata")
+                      ".*\\.gz$"))
+               #t)))))
+      (propagated-inputs
+       `(("go-golang-org-x-sys-cpu" ,go-golang-org-x-sys-cpu)))
+      (synopsis "Supplementary cryptographic libraries in Go")
+      (description "This package provides supplementary cryptographic libraries
+for the Go language.")
+      (home-page "https://go.googlesource.com/crypto/")
+      (license license:bsd-3))))
+
 (define-public go-golang-org-x-crypto-bcrypt
   (let ((commit "b7391e95e576cacdcdd422573063bc057239113d")
         (revision "3"))
@@ -933,8 +1008,8 @@ fixed-output-length hash functions and the SHAKE variable-output-length hash
 functions defined by FIPS-202.")))
 
 (define-public go-golang-org-x-net-ipv4
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-ipv4")
       (version (git-version "0.0.0" revision commit))
@@ -946,11 +1021,13 @@ functions defined by FIPS-202.")))
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/ipv4"
          #:unpack-path "golang.org/x/net"))
+      (propagated-inputs
+       `(("go-golang-org-x-sys-unix" ,go-golang-org-x-sys-unix)))
       (synopsis "Go IPv4 support")
       (description "This package provides @code{ipv4}, which implements IP-level
 socket options for the Internet Protocol version 4.")
@@ -958,8 +1035,8 @@ socket options for the Internet Protocol version 4.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-bpf
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-bpf")
       (version (git-version "0.0.0" revision commit))
@@ -972,11 +1049,13 @@ socket options for the Internet Protocol version 4.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/bpf"
          #:unpack-path "golang.org/x/net"))
+      (propagated-inputs
+       `(("go-golang-org-x-sys-unix" ,go-golang-org-x-sys-unix)))
       (synopsis "Berkeley Packet Filters (BPF) in Go")
       (description "This package provides a Go implementation of the Berkeley
 Packet Filter (BPF) virtual machine.")
@@ -984,8 +1063,8 @@ Packet Filter (BPF) virtual machine.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-context
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-context")
       (version (git-version "0.0.0" revision commit))
@@ -998,7 +1077,7 @@ Packet Filter (BPF) virtual machine.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/context"
@@ -1011,8 +1090,8 @@ request-scoped values across API boundaries and between processes.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-internal-socks
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-internal-socks")
       (version (git-version "0.0.0" revision commit))
@@ -1025,7 +1104,7 @@ request-scoped values across API boundaries and between processes.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/internal/socks"
@@ -1036,8 +1115,8 @@ request-scoped values across API boundaries and between processes.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-internal-socket
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-internal-socket")
       (version (git-version "0.0.0" revision commit))
@@ -1050,19 +1129,21 @@ request-scoped values across API boundaries and between processes.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/internal/socket"
          #:unpack-path "golang.org/x/net"))
+      (propagated-inputs
+       `(("go-golang-org-x-sys-unix" ,go-golang-org-x-sys-unix)))
       (synopsis "")
       (description "")
       (home-page "https://go.googlesource.com/net/")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-internal-iana
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-internal-iana")
       (version (git-version "0.0.0" revision commit))
@@ -1075,7 +1156,7 @@ request-scoped values across API boundaries and between processes.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/internal/iana"
@@ -1087,8 +1168,8 @@ number resources managed by the Internet Assigned Numbers Authority (IANA).")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-ipv6
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-ipv6")
       (version (git-version "0.0.0" revision commit))
@@ -1101,11 +1182,13 @@ number resources managed by the Internet Assigned Numbers Authority (IANA).")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/ipv6"
          #:unpack-path "golang.org/x/net"))
+      (propagated-inputs
+       `(("go-golang-org-x-sys-unix" ,go-golang-org-x-sys-unix)))
       (synopsis "Go IPv6 support")
       (description "This package provides @code{ipv6}, which implements
 IP-level socket options for the Internet Protocol version 6.")
@@ -1113,8 +1196,8 @@ IP-level socket options for the Internet Protocol version 6.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-net-proxy
-  (let ((commit "351d144fa1fc0bd934e2408202be0c29f25e35a0")
-        (revision "2"))
+  (let ((commit "d28f0bde5980168871434b95cfc858db9f2a7a99")
+        (revision "3"))
     (package
       (name "go-golang-org-x-net-proxy")
       (version (git-version "0.0.0" revision commit))
@@ -1127,7 +1210,7 @@ IP-level socket options for the Internet Protocol version 6.")
                                           version "-checkout"))
                 (sha256
                  (base32
-                  "1c5x25qjyz83y92bq0lll5kmznyi3m02wd4c54scgf0866gy938k"))))
+                  "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/net/proxy"
@@ -1139,8 +1222,8 @@ for a variety of protocols to proxy network data.")
       (license license:bsd-3))))
 
 (define-public go-golang-org-x-sys-unix
-  (let ((commit "4d1cda033e0619309c606fc686de3adcf599539e")
-        (revision "2"))
+  (let ((commit "5ed2794edfdc1c54dfb61d619c5944285f35d444")
+        (revision "3"))
     (package
       (name "go-golang-org-x-sys-unix")
       (version (git-version "0.0.0" revision commit))
@@ -1152,7 +1235,7 @@ for a variety of protocols to proxy network data.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "1wgaldbnkmh568v8kkgvnmkskaj96fqrbzhx23yji2kh1432q6gh"))))
+                  "1qy8hmv5nwpcywk7sh1pg0s32jwpd4ykh492xzl4mmxy8galwsr5"))))
       (build-system go-build-system)
       (arguments
        `(#:import-path "golang.org/x/sys/unix"
@@ -1174,59 +1257,55 @@ for low-level interaction with the operating system.")
     (description "Thi spackage provides @code{cpu}, which offers tools for CPU
 feature detection in Go.")))
 
+(define-public go-golang-org-x-text-encoding
+  (package
+    (name "go-golang-org-x-text-encoding")
+    (version "0.3.2")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://go.googlesource.com/text")
+                    (commit (string-append "v" version))))
+              (file-name (string-append "go.googlesource.com-text-"
+                                        version "-checkout"))
+              (sha256
+               (base32
+                "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh"))))
+    (build-system go-build-system)
+    (arguments
+     `(#:import-path "golang.org/x/text/encoding"
+       #:unpack-path "golang.org/x/text"))
+    (synopsis "Interface for character encodings for conversion to and from
+UTF-8")
+    (description "This package defines an interface for character encodings.
+Specific implementations of encoding for CJK text as well as simple character
+encodings are provided in subpackages.")
+    (home-page "https://go.googlesource.com/text")
+    (license license:bsd-3)))
+
 (define-public go-golang-org-x-text-transform
-  (let ((commit "e19ae1496984b1c655b8044a65c0300a3c878dd3")
-        (revision "1"))
-    (package
-      (name "go-golang-org-x-text-transform")
-      (version (git-version "0.0.0" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://go.googlesource.com/text")
-                      (commit commit)))
-                (file-name (string-append "go.googlesource.com-text-"
-                                          version "-checkout"))
-                (sha256
-                 (base32
-                  "1cvnnx8nwx5c7gr6ajs7sldhbqh52n7h6fsa3i21l2lhx6xrsh4w"))))
-      (build-system go-build-system)
-      (arguments
-       `(#:import-path "golang.org/x/text/transform"
-         #:unpack-path "golang.org/x/text"))
-      (synopsis "Go text transformation")
-      (description "This package provides @code{transform}, which provides
+  (package
+    (inherit go-golang-org-x-text-encoding)
+    (name "go-golang-org-x-text-transform")
+    (arguments
+     `(#:import-path "golang.org/x/text/transform"
+       #:unpack-path "golang.org/x/text"))
+    (synopsis "Go text transformation")
+    (description "This package provides @code{transform}, which provides
 reader and writer wrappers that transform the bytes passing through.  Example
 transformations provided by other packages include normalization and conversion
-between character sets.")
-      (home-page "https://go.googlesource.com/text")
-      (license license:bsd-3))))
+between character sets.")))
 
 (define-public go-golang-org-x-text-unicode-norm
-  (let ((commit "e19ae1496984b1c655b8044a65c0300a3c878dd3")
-        (revision "1"))
-    (package
-      (name "go-golang-org-x-text-unicode-norm")
-      (version (git-version "0.0.0" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://go.googlesource.com/text")
-                      (commit commit)))
-                (file-name (string-append "go.googlesource.com-text-"
-                                          version "-checkout"))
-                (sha256
-                 (base32
-                  "1cvnnx8nwx5c7gr6ajs7sldhbqh52n7h6fsa3i21l2lhx6xrsh4w"))))
-      (build-system go-build-system)
-      (arguments
-       `(#:import-path "golang.org/x/text/unicode/norm"
-         #:unpack-path "golang.org/x/text"))
-      (synopsis "Unicode normalization in Go")
-      (description "This package provides @code{norm}, which contains types and
-functions for normalizing Unicode strings.")
-      (home-page "https://go.googlesource.com/text")
-      (license license:bsd-3))))
+  (package
+    (inherit go-golang-org-x-text-encoding)
+    (name "go-golang-org-x-text-unicode-norm")
+    (arguments
+     `(#:import-path "golang.org/x/text/unicode/norm"
+       #:unpack-path "golang.org/x/text"))
+    (synopsis "Unicode normalization in Go")
+    (description "This package provides @code{norm}, which contains types and
+functions for normalizing Unicode strings.")))
 
 (define-public go-golang-org-x-time-rate
   (let ((commit "6dc17368e09b0e8634d71cac8168d853e869a0c7")
@@ -1292,12 +1371,11 @@ is similar to Go's standard library @code{json} and @code{xml} package.")
     (license license:expat)))
 
 (define-public go-github-com-getsentry-raven-go
-  (let ((commit
-         "dffeb57df75d6a911f00232155194e43d79d38d7")
+  (let ((commit "5c24d5110e0e198d9ae16f1f3465366085001d92")
         (revision "0"))
     (package
       (name "go-github-com-getsentry-raven-go")
-      (version (git-version "0.0.0" revision commit))
+      (version (git-version "0.2.0" revision commit))
       (source
        (origin
          (method git-fetch)
@@ -1307,14 +1385,16 @@ is similar to Go's standard library @code{json} and @code{xml} package.")
          (file-name (git-file-name name version))
          (sha256
           (base32
-           "13sb9rvl3369m7fah3ss9g0hwky259snqfn8gmbr0h5zvp651lja"))))
+           "0lvc376sq8r8jhy2v1m6rf1wyld61pvbk0x6j9xpg56ivqy69xs7"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/getsentry/raven-go"))
-      (home-page
-       "https://github.com/getsentry/raven-go")
+      (propagated-inputs
+       `(("go-github-com-certifi-gocertifi" ,go-github-com-certifi-gocertifi)
+         ("go-github-com-pkg-errors" ,go-github-com-pkg-errors)))
+      (home-page "https://github.com/getsentry/raven-go")
       (synopsis "Sentry client in Go")
-      (description "This package is Go client API for the Sentry event/error
+      (description "This package is a Go client API for the Sentry event/error
 logging system.")
       (license license:bsd-3))))
 
@@ -1859,11 +1939,11 @@ which satisfies the cron expression.")
                      license:asl2.0)))))
 
 (define-public go-gopkg-in-check-v1
-  (let ((commit "20d25e2804050c1cd24a7eea1e7a6447dd0e74ec")
-        (revision "0"))
+  (let ((commit "788fd78401277ebd861206a03c884797c6ec5541")
+        (revision "1"))
     (package
       (name "go-gopkg-in-check-v1")
-      (version (git-version "0.0.0" revision commit))
+      (version (git-version "1.0.0" revision commit))
       (source
        (origin
          (method git-fetch)
@@ -1873,43 +1953,42 @@ which satisfies the cron expression.")
          (file-name (git-file-name name version))
          (sha256
           (base32
-           "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np"))))
+           "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "gopkg.in/check.v1"))
+      (propagated-inputs
+       `(("go-github-com-kr-pretty" ,go-github-com-kr-pretty)))
       (home-page "https://gopkg.in/check.v1")
       (synopsis "Test framework for the Go language")
-      (description
-       "This package provides a test library for the Go language.")
+      (description "This package provides a test library for the Go language.")
       (license license:asl2.0))))
 
 (define-public go-gopkg-in-yaml-v2
-  (let ((commit "14227de293ca979cf205cd88769fe71ed96a97e2")
-        (revision "0"))
-    (package
-      (name "go-gopkg-in-yaml-v2")
-      (version (git-version "0.0.0" revision commit))
-      (source
-        (origin
-          (method git-fetch)
-          (uri (git-reference
-                 (url "https://gopkg.in/yaml.v2.git")
-                 (commit commit)))
-          (file-name (git-file-name name version))
-          (sha256
-            (base32
-              "038hnrjcnjygyi3qidfrkpkakis82qg381sr495d2s40g2dwlzah"))))
-      (build-system go-build-system)
-      (arguments
-       '(#:import-path "gopkg.in/yaml.v2"))
-      (native-inputs
-       `(("go-gopkg-in-check-v1" ,go-gopkg-in-check-v1)))
-      (home-page "https://gopkg.in/yaml.v2")
-      (synopsis "YAML reader and writer for the Go language")
-      (description
-       "This package provides a Go library for encode and decode YAML
+  (package
+    (name "go-gopkg-in-yaml-v2")
+    (version "2.2.2")
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url "https://gopkg.in/yaml.v2.git")
+               (commit (string-append "v" version))))
+        (file-name (git-file-name name version))
+        (sha256
+         (base32
+          "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "gopkg.in/yaml.v2"))
+    (native-inputs
+     `(("go-gopkg-in-check-v1" ,go-gopkg-in-check-v1)))
+    (home-page "https://gopkg.in/yaml.v2")
+    (synopsis "YAML reader and writer for the Go language")
+    (description
+     "This package provides a Go library for encode and decode YAML
 values.")
-      (license license:asl2.0))))
+    (license license:asl2.0)))
 
 (define-public go-github-com-mattn-go-isatty
   (package
@@ -3238,6 +3317,171 @@ format in Go.")
     (home-page "https://github.com/kr/text")
     (license license:expat)))
 
+(define-public go-golang-org-sql-mock
+  (let ((commit "e98392b8111b45f8126e00af035a0dd95dc12e8b")
+        (version "1.3.3")
+        (revision "1"))
+    (package
+      (name "go-golang-org-sql-mock")
+      (version (git-version version revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/DATA-DOG/go-sqlmock")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "033vv29g2wf6fd757ajfmha30bqin3b07377037zkl051mk6mghs"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "github.com/DATA-DOG/go-sqlmock"))
+      (synopsis "Mock library implementing @code{sql/driver}")
+      (description "This library simulates SQL-driver behavior in tests
+without requiring a real database connection.")
+      (home-page "https://github.com/DATA-DOG/go-sqlmock")
+      (license license:expat))))
+
+(define-public go-golang-org-colorful
+  (package
+    (name "go-golang-org-colorful")
+    (version "1.0.2")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/lucasb-eyer/go-colorful")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0fig06880bvk1l92j4127v4x9sar4ds7ga8959gxxghb2w70b7l2"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/lucasb-eyer/go-colorful"))
+    (native-inputs
+     `(("go-golang-org-sql-mock" ,go-golang-org-sql-mock)))
+    (synopsis "Convert between colorspaces and generate colors")
+    (description "This package implements Go's @code{color.Color} interface
+and provides a means of converting colors stored as RGB to various
+colorspaces.")
+    (home-page "https://github.com/lucasb-eyer/go-colorful")
+    (license license:expat)))
+
+(define-public go-github-com-gdamore-encoding
+  (package
+    (name "go-github-com-gdamore-encoding")
+    (version "1.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/gdamore/encoding")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "1vmm5zll92i2fm4ajqx0gyx0p9j36496x5nabi3y0x7h0inv0pk9"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/gdamore/encoding"))
+    (inputs
+     `(("go-golang-org-x-text-encoding" ,go-golang-org-x-text-encoding)
+       ("go-golang-org-x-text-transform" ,go-golang-org-x-text-transform)))
+    (home-page "https://github.com/gdamore/encoding")
+    (synopsis "Provide encodings missing from Go")
+    (description "This package provides useful encodings not included in the
+standard @code{Text} package, including some for dealing with I/O streams from
+non-UTF-friendly sources.")
+    (license license:expat)))
+
+(define-public go-github-com-gdamore-tcell
+  (let ((commit "aaadc574a6ed8dc3abe56036ca130dcee1ee6b6e")
+        (version "1.1.2")
+        (revision "1"))
+    (package
+      (name "go-github-com-gdamore-tcell")
+      (version (git-version version revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/gdamore/tcell")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "0il2nnxp2cqiy73m49215dnf9in3vd25ji8qxbmq87c5qy7i1q9d"))))
+      (build-system go-build-system)
+      (arguments
+       `(#:import-path "github.com/gdamore/tcell"
+         #:phases
+         (modify-phases %standard-phases
+           (add-before 'reset-gzip-timestamps 'make-files-writable
+             (lambda* (#:key outputs #:allow-other-keys)
+               ;; Make sure .gz files are writable so that the
+               ;; 'reset-gzip-timestamps' phase can do its work.
+               (let ((out (assoc-ref outputs "out")))
+                 (for-each make-file-writable
+                           (find-files out "\\.gz$"))
+                 #t))))))
+      (inputs
+       `(("go-github.com-mattn-go-runewidth" ,go-github.com-mattn-go-runewidth)
+         ("go-golang-org-colorful" ,go-golang-org-colorful)
+         ("go-golang-org-x-text-encoding" ,go-golang-org-x-text-encoding)
+         ("go-golang-org-x-text-transform" ,go-golang-org-x-text-transform)
+         ("go-github-com-gdamore-encoding" ,go-github-com-gdamore-encoding)))
+      (home-page "https://github.com/gdamore/tcell")
+      (synopsis "Provide a cell-based view for text terminals")
+      (description "This package includes a full parser and expander for
+terminfo capability strings to avoid hard-coding escape strings for
+formatting.  It also favors portability, and includes support for all POSIX
+systems.")
+      (license license:expat))))
+
+(define-public go-github-com-mattn-go-shellwords
+  (let ((commit "2444a32a19f450fabaa0bb3e96a703f15d9a97d2")
+        (version "1.0.5")
+        (revision "1"))
+    (package
+      (name "go-github-com-mattn-go-shellwords")
+      (version (git-version version revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/mattn/go-shellwords")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "08zcgr1az1n8zaxzwdd205j86hczgyc52nxfnw5avpw7rrkf7v0d"))))
+      (build-system go-build-system)
+      (arguments
+       `(#:import-path "github.com/mattn/go-shellwords"
+         ;; TODO: can't make homeless-shelter:
+         ;; go: disabling cache (/homeless-shelter/.cache/go-build) due to
+         ;; initialization failure: mkdir /homeless-shelter: permission denied
+
+         ;; This doesn't seem to work:
+
+         ;; #:phases
+         ;; (modify-phases %standard-phases
+         ;;   (replace 'check
+         ;;     (lambda* (#:key import-path #:allow-other-keys)
+         ;;       (setenv "HOME" "/tmp")
+         ;;       (invoke "go" "test" import-path))))
+
+         ;; TODO: There are also a couple of tests that have stymied Debian in
+         ;; the past.  They seem to work when run locally.
+
+         #:tests? #f
+         ))
+      (home-page "https://github.com/mattn/go-shellwords")
+      (synopsis "Parse lines into shell words")
+      (description "This package parses text into shell arguments.  Based on
+the @code{cpan} module @code{Parse::CommandLine}.")
+      (license license:expat))))
+
 (define-public go-github-com-burntsushi-locker
   (let ((commit "a6e239ea1c69bff1cfdb20c4b73dadf52f784b6a")
         (revision "0"))
@@ -3271,3 +3515,128 @@ test.
 All locks are implemented with read-write mutexes.  To use them like a regular
 mutex, simply ignore the RLock/RUnlock functions.")
       (license license:unlicense))))
+
+(define-public go-github-com-marten-seemann-qtls
+  (package
+    (name "go-github-com-marten-seemann-qtls")
+    (version "0.2.3")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/marten-seemann/qtls")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0b9p7bwkm9hfg1mb565q4nw5k7xyks0z2xagz5fp95azy2psbnfg"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/marten-seemann/qtls"
+       ;; The test suite requires networking.
+       #:tests? #f))
+    (propagated-inputs
+     `(("go-golang-org-x-crypto" ,go-golang-org-x-crypto)))
+    (synopsis "TLS 1.3 with QUIC in Go")
+    (description "This package provides @code{qtls}, a QUIC-capable variant of
+the Go standard library's TLS 1.3 implementation.")
+    (home-page "https://github.com/marten-seemann/qtls")
+    (license license:bsd-3)))
+
+(define-public go-github-com-cheekybits-genny
+  (package
+    (name "go-github-com-cheekybits-genny")
+    (version "1.0.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/cheekybits/genny")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1pcir5ic86713aqa51581rfb67rgc3m0c72ddjfcp3yakv9vyq87"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/cheekybits/genny"))
+    (propagated-inputs
+     `(("go-golang-org-x-tools" ,go-golang-org-x-tools)))
+    (synopsis "Generics for Go")
+    (description "This package provides @code{genny}, a Go language
+implementation of generics.")
+    (home-page "https://github.com/cheekybits/genny/")
+    (license license:expat)))
+
+(define-public go-github-com-lucas-clemente-quic-go
+  (package
+    (name "go-github-com-lucas-clemente-quic-go")
+    (version "0.11.2")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/lucas-clemente/quic-go")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0gqm5mc8alg84ra7yxach34il1jvcij8f76qdqcahnd3d2nhjbia"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/lucas-clemente/quic-go"
+       ;; XXX More packages required...
+       #:tests? #f))
+    (propagated-inputs
+     `(("go-golang-org-x-crypto" ,go-golang-org-x-crypto)
+       ("go-github-com-cheekybits-genny" ,go-github-com-cheekybits-genny)
+       ("go-github-com-marten-seemann-qtls" ,go-github-com-marten-seemann-qtls)))
+    (synopsis "QUIC in Go")
+    (description "This package provides a Go language implementation of the QUIC
+network protocol.")
+    (home-page "https://github.com/lucas-clemente/quic-go")
+    (license license:expat)))
+
+(define-public go-github-com-pkg-errors
+  (let ((commit "27936f6d90f9c8e1145f11ed52ffffbfdb9e0af7")
+        (revision "0"))
+    (package
+      (name "go-github-com-pkg-errors")
+      (version (git-version "0.8.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/pkg/errors.git")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0yzmgi6g4ak4q8y7w6x0n5cbinlcn8yc3gwgzy4yck00qdn25d6y"))))
+      (build-system go-build-system)
+      (arguments
+       `(#:import-path "github.com/pkg/errors"))
+      (synopsis "Go error handling primitives")
+      (description "This package provides @code{error}, which offers simple
+error handling primitives in Go.")
+      (home-page "https://github.com/pkg/errors")
+      (license license:bsd-2))))
+
+(define-public go-github-com-maruel-panicparse
+  (package
+    (name "go-github-com-maruel-panicparse")
+    (version "1.2.1")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/maruel/panicparse")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "05hf68ifb7ww4rpmxyywbj9r0kyap45p1273ncq4qy2ydv042l8j"))))
+    (build-system go-build-system)
+    (arguments
+     '(#:import-path "github.com/maruel/panicparse"))
+    (synopsis "Toolkit for parsing Go stack traces")
+    (description "This package provides a toolkit for parsing Go language panic
+stack traces.  It simplifies the traces to make salient information more visible
+and aid debugging.")
+    (home-page "https://github.com/maruel/panicparse")
+    (license license:asl2.0)))
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index 94a797c8f5..bc3a418e99 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -80,16 +80,14 @@
 (define-public blender
   (package
     (name "blender")
-    (version "v2.80-rc1")
+    (version "2.80")
     (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://git.blender.org/blender.git")
-                     (commit version)))
-              (file-name (git-file-name name version))
+              (method url-fetch)
+              (uri (string-append "https://download.blender.org/source/"
+                                  "blender-" version ".tar.gz"))
               (sha256
                (base32
-                "11dcf0rjq42mpphk8r8cy7gvhzzl1cj1vslp98ibh8sdjzaz2mdq"))))
+                "1h550jisdbis50hxwk5kxrvrk1a6sh2fsri3yyj66vhzbi87x7fd"))))
     (build-system cmake-build-system)
     (arguments
       (let ((python-version (version-major+minor (package-version python))))
@@ -162,9 +160,7 @@
      "Blender is a 3D graphics creation suite.  It supports the entirety of
 the 3D pipeline—modeling, rigging, animation, simulation, rendering,
 compositing and motion tracking, even video editing and game creation.  The
-application can be customized via its API for Python scripting.
-
-WARNING: This is a release candidate build of Blender.")
+application can be customized via its API for Python scripting.")
     (license license:gpl2+)))
 
 (define-public blender-2.79
diff --git a/gnu/packages/guile-xyz.scm b/gnu/packages/guile-xyz.scm
index c16342deb0..6dcdcedccf 100644
--- a/gnu/packages/guile-xyz.scm
+++ b/gnu/packages/guile-xyz.scm
@@ -146,7 +146,7 @@
       ;; projects.
       ;; TODO: Add guile-dbi and guile-dbd optional dependencies.
       (inputs `(("guile" ,guile-2.2)
-                ("guile-json" ,guile-json)
+                ("guile-json" ,guile-json-1)
                 ("guile-redis" ,guile-redis)))
       (native-inputs `(("bash"       ,bash)         ;for the `source' builtin
                        ("pkgconfig"  ,pkg-config)
@@ -844,7 +844,7 @@ messaging library.")
       (inputs
        `(("openssl" ,openssl)
          ("guile" ,guile-2.2)
-         ("guile-json" ,guile-json)
+         ("guile-json" ,guile-json-1)
          ("guile-simple-zmq" ,guile-simple-zmq)))
       (synopsis "Guile kernel for the Jupyter Notebook")
       (description
@@ -1008,7 +1008,7 @@ Scheme by using Guile’s foreign function interface.")
     (inputs
      `(("guile" ,guile-2.2)
        ("gnutls" ,gnutls)
-       ("guile-json" ,guile-json)))
+       ("guile-json" ,guile-json-1)))
     (home-page "https://framagit.org/prouby/guile-mastodon")
     (synopsis "Guile Mastodon REST API module")
     (description "This package provides Guile modules to access the
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 6e11a13c56..b8a53824b4 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -300,29 +300,27 @@ without requiring the source code to be rewritten.")
 
 (define-public guile-next
   ;; This is the upcoming Guile 3.0, with JIT support.
-  (let ((commit "6f3357b0df64c4be17e72079864c09a542f1c779")
-        (revision "1"))
-    (package
-      (inherit guile-2.2)
-      (name "guile-next")
-      (version "2.9.2")
-      (source (origin
-                (inherit (package-source guile-2.2))
-                (uri (string-append "ftp://alpha.gnu.org/gnu/guile/guile-"
-                                    version ".tar.xz"))
-                (sha256
-                 (base32
-                  "1w358df2wmcyzk2ziqrj2zhwqisaqraqfa3008ay23nf1a7bw0z4"))))
-      (native-search-paths
-       (list (search-path-specification
-              (variable "GUILE_LOAD_PATH")
-              (files '("share/guile/site/3.0")))
-             (search-path-specification
-              (variable "GUILE_LOAD_COMPILED_PATH")
-              (files '("lib/guile/3.0/site-ccache"
-                       "share/guile/site/3.0")))))
-      (properties '((ftp-server . "alpha.gnu.org")
-                    (upstream-name . "guile"))))))
+  (package
+    (inherit guile-2.2)
+    (name "guile-next")
+    (version "2.9.3")
+    (source (origin
+              (inherit (package-source guile-2.2))
+              (uri (string-append "ftp://alpha.gnu.org/gnu/guile/guile-"
+                                  version ".tar.xz"))
+              (sha256
+               (base32
+                "14990wcpysgw58kij03wbgiggmi5z94jmy7wdcqnn6ny7cimkkgr"))))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "GUILE_LOAD_PATH")
+            (files '("share/guile/site/3.0")))
+           (search-path-specification
+            (variable "GUILE_LOAD_COMPILED_PATH")
+            (files '("lib/guile/3.0/site-ccache"
+                     "share/guile/site/3.0")))))
+    (properties '((ftp-server . "alpha.gnu.org")
+                  (upstream-name . "guile")))))
 
 (define (make-guile-readline guile)
   (package
@@ -470,6 +468,10 @@ specification.  These are the main features:
     ;; Version 1.2.0 switched to GPLv3+ (from LGPLv3+).
     (license license:gpl3+)))
 
+(define-public guile-json-1
+  ;; This is the 1.x branch of Guile-JSON.
+  guile-json)
+
 (define-public guile2.2-json
   (deprecated-package "guile2.2-json" guile-json))
 
diff --git a/gnu/packages/image-viewers.scm b/gnu/packages/image-viewers.scm
index 6db52e0be0..d33a9857c9 100644
--- a/gnu/packages/image-viewers.scm
+++ b/gnu/packages/image-viewers.scm
@@ -64,7 +64,7 @@
 (define-public feh
   (package
     (name "feh")
-    (version "3.1.3")
+    (version "3.2.1")
     (home-page "https://feh.finalrewind.org/")
     (source (origin
               (method url-fetch)
@@ -72,7 +72,7 @@
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "1vsnxf4as3vyzjfhd8frzb1a8i7wnq7ck5ljx7qxqrnfqvxl1s4z"))))
+                "070axq8jpibcabmjfv4fmjmpk3k349vzvh4qhsi4n62bkcwl35wg"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (modify-phases %standard-phases (delete 'configure))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 5d3aa03124..d4273c6fa1 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -250,8 +250,8 @@ APNG patch provides APNG support to libpng.")
       ("zlib" , zlib)))
    (home-page "https://pmt.sourceforge.io/pngcrush")
    (synopsis "Utility to compress PNG files")
-   (description "pngcrusqh is an optimizer for PNG (Portable Network Graphics)
-files.  It can compress them as much as 40% losslessly.")
+   (description "Pngcrush optimizes @acronym{PNG, Portable Network Graphics}
+images.  It can further losslessly compress them by as much as 40%.")
    (license license:zlib)))
 
 (define-public pngcrunch
@@ -1108,14 +1108,14 @@ channels.")
 (define-public exiv2
   (package
     (name "exiv2")
-    (version "0.27.1")
+    (version "0.27.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://www.exiv2.org/builds/exiv2-" version
                            "-Source.tar.gz"))
        (sha256
-        (base32 "109hbfk63dh14fz20ivq20gcclb9jj9jmh48w4lcn6zxh1ljh9gi"))))
+        (base32 "0gqminvj14xm3rgbnydbywf22608js80rp7nmxxk4497j5mzali6"))))
     (build-system cmake-build-system)
     (arguments '(#:tests? #f))          ; no test suite
     (propagated-inputs
diff --git a/gnu/packages/julia.scm b/gnu/packages/julia.scm
index fa9709c40c..43254f25fd 100644
--- a/gnu/packages/julia.scm
+++ b/gnu/packages/julia.scm
@@ -47,9 +47,12 @@
   #:use-module (ice-9 match))
 
 (define libuv-julia
-  (let ((commit "52d72a52cc7ccd570929990f010ed16e2ec604c8")
-        (revision "5"))
-    (package (inherit libuv)
+  (let ((commit "26dbe5672c33fc885462c509fe2a9b36f35866fd")
+        (revision "6"))
+    ;; When upgrading Julia, also upgrade this.
+    ;; Get the commit from https://github.com/JuliaLang/julia/blob/v1.1.1/deps/libuv.version
+    (package
+      (inherit libuv)
       (name "libuv-julia")
       (version (string-append "1.9.0-" revision "." (string-take commit 8)))
       (source (origin
@@ -60,7 +63,7 @@
                 (file-name (string-append name "-" version "-checkout"))
                 (sha256
                  (base32
-                  "1daxh6ci6q7znxxajr3bm16dd53ragm0d681wf4kzg542qnjq3lh"))))
+                  "17pn2xmqaramilx897s9grs966i5246gi6sric5alch4g9j4685n"))))
       (build-system gnu-build-system)
       (arguments
        (substitute-keyword-arguments (package-arguments libuv)
@@ -69,22 +72,93 @@
              (delete 'autogen)))))
       (home-page "https://github.com/JuliaLang/libuv"))))
 
-(define libunwind-for-julia
+(define (llvm-patch-url version name)
+  (string-append "https://raw.githubusercontent.com/JuliaLang/julia/v" version
+		 "/deps/patches/" name))
+
+(define (llvm-patch name sha)
+  (let ((version "1.1.1"))
+    (origin (method url-fetch)
+	    (uri (llvm-patch-url version name))
+	    (sha256 (base32 sha))
+	    (file-name name))))
+
+(define llvm-julia
   (package
-    (inherit libunwind)
-    (version "1.1-julia2")
+    (inherit llvm-6)
+    (name "llvm-julia")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://s3.amazonaws.com/julialang/src/"
-                                  "libunwind-" version ".tar.gz"))
+              (uri "http://releases.llvm.org/6.0.1/llvm-6.0.1.src.tar.xz")
               (sha256
                (base32
-                "0499x7sg2v18a6cry6l8y713cgmic0adnjph8i0xr1db9p7n8qyv"))))))
+                "1qpls3vk85lydi5b4axl0809fv932qgsqgdgrk098567z4jc7mmn"))
+              ;; Those patches are inside the Julia source repo.
+              ;; They are _not_ Julia specific (https://github.com/julialang/julia#llvm)
+              ;; but they are required to build Julia.
+              ;; Discussion: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919628
+              (patches
+               (list
+	        (llvm-patch "llvm-6.0-D44650.patch"
+			    "1336q4vqayr94wdcnlmcxh90mjdh34dzw9x2cbiqjnx9b1j8fxyb")
+	        (llvm-patch "llvm-6.0-DISABLE_ABI_CHECKS.patch"
+			    "014fawd1ba7yckalypfld22zgic87x9nx3cim42zrwygywd36pyg")
+	        (llvm-patch "llvm-6.0-NVPTX-addrspaces.patch"
+			    "1qdi2zmrjsrj0h84zv2vyly2hjcn4f67mfy0s1q353g4v4jkscqc")
+	        (llvm-patch "llvm-6.0.0_D27296-libssp.patch"
+			    "0s5hi2r1j63i8m6ig1346crx2aiv9f7rgb3mg80kw1wx5y7pdpfh")
+	        (llvm-patch "llvm-D27629-AArch64-large_model_6.0.1.patch"
+			    "1qrshmlqvnasdyc158vfn3hnbigqph3lsq7acb9w8lwkpnnm2j4z")
+	        (llvm-patch "llvm-D34078-vectorize-fdiv.patch"
+			    "1696hg84a0jxcnggvqsc2cdp271hf9a44p4qsd078qm1mfawkaay")
+	        (llvm-patch "llvm-D42262-jumpthreading-not-i1.patch"
+			    "1c8w210gwidbnkkw8anp17dk5pnxws2fl3mb2qxh7y9wzfpixgaq")
+	        (llvm-patch "llvm-D44892-Perf-integration.patch"
+			    "0r37jd0ssh2k1pndkfd5blgpg9z90im4vlzprhb0n0wwz45g4b05")
+	        (llvm-patch "llvm-D46460.patch"
+			    "1miqgswdc0qvbaf4571c2xkxyp9ais06b1bcpa83sq22vr4hbsfb")
+	        (llvm-patch "llvm-D49832-SCEVPred.patch"
+			    "0v5c88hgqj6dymv3j86ca5mhpqab5fbnrvjiw1nvnrnya9l4dlbn")
+	        (llvm-patch "llvm-D50010-VNCoercion-ni.patch"
+			    "0iblb3q1xixwrb12jpb89h3ywmqmzdp6aqp416j4ncwakyjhhfkp")
+	        (llvm-patch "llvm-D50167-scev-umin.patch"
+			    "1f2rakcnnyhr7w10k7gqg0k0491pyvx5ijplivw557f714ys3q6v")
+	        (llvm-patch "llvm-OProfile-line-num.patch"
+			    "1jvbbmwyags0xfwamb13qrf3rgcz9i1r03m9lava7swag8xb78c7")
+	        (llvm-patch "llvm-PPC-addrspaces.patch"
+			    "1f23nhsxh2s3jskbgs7da9nwg3s1hrkbk5aahl08x41wi3mny01p")
+	        (llvm-patch "llvm-rL323946-LSRTy.patch"
+			    "10cz3vy1yw0w643z7xx021wa4kymx9fcm3bjg61s6vzdqd6d9fns")
+	        (llvm-patch "llvm-rL326967-aligned-load.patch"
+			    "04jxnv32yj5x17hqhi8g2p8rhgp38gmjzr871w7z8s44pq10v9v4")
+	        (llvm-patch "llvm-rL327898.patch"
+			    "15ah49gbsll23z28kpyahi5vl0fh3fkxcgd1zmxxdcl96s3x8bnq")))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments llvm-6)
+       ((#:configure-flags flags)
+        `(list ;; Taken from NixOS. Only way I could get libLLVM-6.0.so
+	  "-DCMAKE_BUILD_TYPE=Release"
+
+          ;; Build a native compiler and the NVPTX backend (NVIDIA) since
+          ;; Julia insists on it, nothing more.  This reduces build times and
+          ;; disk usage.
+          ,(string-append "-DLLVM_TARGETS_TO_BUILD=" (system->llvm-target))
+          "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=NVPTX"
+
+	  "-DLLVM_INSTALL_UTILS=ON"
+	  "-DLLVM_BUILD_TESTS=ON"
+	  "-DLLVM_ENABLE_FFI=ON"
+	  "-DLLVM_ENABLE_RTTI=ON"
+          ;; "-DLLVM_HOST_TRIPLE=${stdenv.hostPlatform.config}"
+          ;; "-DLLVM_DEFAULT_TARGET_TRIPLE=${stdenv.hostPlatform.config}"
+	  ;; "-DLLVM_EXPERIMENTAL_TARGETS_TO_BUILD=WebAssembly"
+	  "-DLLVM_ENABLE_DUMP=ON"
+	  "-DLLVM_LINK_LLVM_DYLIB=ON"))))))
 
 (define-public julia
   (package
     (name "julia")
-    (version "0.6.0")
+    (version "1.1.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -92,7 +166,7 @@
                     version "/julia-" version ".tar.gz"))
               (sha256
                (base32
-                "0rd6lcc9sic10q1j3c6f9qr901i1c4554m93n2sz5b3mh37byqhw"))))
+                "0hk983mywimclgnjc41zmlppm5kfdz2aj85ky07p49ilcqxi998f"))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
@@ -123,9 +197,23 @@
              (copy-file (string-append (assoc-ref inputs "virtualenv")
                                        "/bin/virtualenv")
                         "julia-env")
-             (copy-file (assoc-ref inputs "unicode-data")
-                        "doc/UnicodeData.txt")
-             #t))
+             (copy-file (assoc-ref inputs "libwhich")
+                        (string-append "deps/srccache/libwhich-"
+                                       "81e9723c0273d78493dc8c8ed570f68d9ce7e89e"
+                                       ".tar.gz"))
+             (copy-file (assoc-ref inputs "rmath")
+                        "deps/srccache/Rmath-julia-0.1.tar.gz")
+
+	     ;; needed by libwhich
+	     (setenv "LD_LIBRARY_PATH"
+		     (string-join (map (lambda (pkg)
+                                         (string-append (assoc-ref inputs pkg)
+                                                        "/lib"))
+                                       '("arpack-ng" "fftw" "gmp" "lapack"
+			                 "libgit2" "mpfr" "openblas" "openlibm"
+			                 "openspecfun" "pcre2"))
+                                  ":"))
+	     #t))
          ;; FIXME: Building the documentation requires Julia packages that
          ;; would be downloaded from the Internet.  We should build them in a
          ;; separate build phase.
@@ -168,19 +256,9 @@
                        ("lapack"      "liblapack"      "liblapack.so")
                        ("libgit2"     "libgit2"        "libgit2.so")
                        ("gmp"         "libgmp"         "libgmp.so")
-                       ("openlibm"    "libopenlibm"    "libopenlibm.so")
                        ("openspecfun" "libopenspecfun" "libopenspecfun.so")
                        ("fftw"        "libfftw3"       "libfftw3_threads.so")
                        ("fftwf"       "libfftw3f"      "libfftw3f_threads.so"))))))
-            (substitute* "base/fft/FFTW.jl"
-              (("const libfftw = Base.libfftw_name")
-               (string-append "const libfftw = \""
-                              (assoc-ref inputs "fftw") "/lib/libfftw3_threads.so"
-                              "\""))
-              (("const libfftwf = Base.libfftwf_name")
-               (string-append "const libfftwf = \""
-                              (assoc-ref inputs "fftwf") "/lib/libfftw3f_threads.so"
-                              "\"")))
             (substitute* "base/math.jl"
               (("const libm = Base.libm_name")
                (string-append "const libm = \""
@@ -192,11 +270,6 @@
                               (assoc-ref inputs "openspecfun")
                               "/lib/libopenspecfun.so"
                               "\"")))
-            (substitute* "base/pcre.jl"
-              (("const PCRE_LIB = \"libpcre2-8\"")
-               (string-append "const PCRE_LIB = \""
-                              (assoc-ref inputs "pcre2")
-                              "/lib/libpcre2-8.so" "\"")))
             #t))
          (add-before 'build 'fix-include-and-link-paths
           (lambda* (#:key inputs #:allow-other-keys)
@@ -218,9 +291,9 @@
                               "/lib/libuv.so ")))
 
             (substitute* "base/Makefile"
-              (("\\$\\(build_includedir\\)/uv-errno.h")
+              (("\\$\\(build_includedir\\)/uv/errno.h")
                (string-append (assoc-ref inputs "libuv")
-                              "/include/uv-errno.h")))
+                              "/include/uv/errno.h")))
             #t))
          (add-before 'build 'replace-default-shell
           (lambda _
@@ -229,37 +302,37 @@
             #t))
          (add-after 'unpack 'hardcode-paths
            (lambda _
-             (substitute* "base/interactiveutil.jl"
+             (substitute* "stdlib/InteractiveUtils/src/InteractiveUtils.jl"
                (("`which") (string-append "`" (which "which")))
                (("`wget")  (string-append "`" (which "wget"))))
              #t))
          (add-before 'check 'disable-broken-tests
            (lambda _
-             ;; Adjust expected error messages to match what current libgit2
-             ;; provides.
-             (substitute* "test/libgit2.jl"
-               (("Invalid Content-Type") "invalid Content-Type")
-               (("Failed to resolve path") "failed to resolve path"))
-
-             (substitute* "test/choosetests.jl"
-               ;; These tests fail, probably because some of the input
-               ;; binaries have been stripped and thus backtraces don't look
-               ;; as expected.
-               (("\"backtrace\",") "")
-               (("\"compile\",") "")
-               (("\"replutil\",") "")
-               (("\"cmdlineargs\",") "")
-               ;; FIXME: This test fails with the following error:
-               ;; Error in testset file:
-               ;; Test Failed
-               ;;   Expression: download("ba\0d", "good")
-               ;;     Expected: ArgumentError
-               ;;       Thrown: Base.UVError
-               (("\"file\",") ""))
-             #t)))
+             (define (touch file-name)
+               (call-with-output-file file-name (const #t)))
+	     ;; FIXME: All git tests works except this one. But *THIS* "fix"
+             ;; is not working, so right now I'm disabling all libgit2.jl tests
+	     ;; (substitute* "stdlib/LibGit2/test/libgit2.jl"
+	     ;; (("!LibGit2.use_http_path(cfg, github_cred)") "true")
+	     ;; (("LibGit2.use_http_path(cfg, mygit_cred)") "true"))
+             (map (lambda (test)
+                    (delete-file test)
+                    (touch test))
+	          '("stdlib/Sockets/test/runtests.jl"
+		    "stdlib/Distributed/test/runtests.jl"
+                    ;; FIXME: see above
+		    "stdlib/LibGit2/test/libgit2.jl"))
+	     (substitute* "test/choosetests.jl"
+	       ;; These tests fail, probably because some of the input
+	       ;; binaries have been stripped and thus backtraces don't look
+	       ;; as expected.
+	       (("\"backtrace\",") "")
+	       (("\"cmdlineargs\",") ""))
+	     #t)))
        #:make-flags
        (list
         (string-append "prefix=" (assoc-ref %outputs "out"))
+        (string-append "PREFIX=" (assoc-ref %outputs "out"))
 
         ;; Passing the MARCH flag is necessary to build binary substitutes for
         ;; the supported architectures.
@@ -278,6 +351,8 @@
         "USE_SYSTEM_LAPACK=1"
         "USE_SYSTEM_BLAS=1"
         "USE_BLAS64=0"          ;needed when USE_SYSTEM_BLAS=1
+        "LIBBLAS=-lopenblas"
+        "LIBBLASNAME=libopenblas"
 
         "USE_SYSTEM_FFTW=1"
         "LIBFFTWNAME=libfftw3"
@@ -296,26 +371,29 @@
                        (assoc-ref %build-inputs "utf8proc")
                        "/include")
         "USE_SYSTEM_LLVM=1"
-        "USE_LLVM_SHLIB=0" ; FIXME: fails when set to 1
+	"LLVM_VER=6.0.1"
 
-        "USE_SYSTEM_LIBUNWIND=1"
-        "USE_SYSTEM_LIBUV=1"
-        (string-append "LIBUV="
-                       (assoc-ref %build-inputs "libuv")
-                       "/lib/libuv.so")
-        (string-append "LIBUV_INC="
-                       (assoc-ref %build-inputs "libuv")
-                       "/include")
-        "USE_SYSTEM_PATCHELF=1"
-        "USE_SYSTEM_PCRE=1"
-        "USE_SYSTEM_OPENLIBM=1"
-        "USE_SYSTEM_GMP=1"
-        "USE_SYSTEM_MPFR=1"
-        "USE_SYSTEM_ARPACK=1"
-        "USE_SYSTEM_LIBGIT2=1"
-        "USE_SYSTEM_OPENSPECFUN=1")))
+	"USE_LLVM_SHLIB=1"
+	"USE_SYSTEM_LIBUNWIND=1"
+	"USE_SYSTEM_LIBUV=1"
+	(string-append "LIBUV="
+		       (assoc-ref %build-inputs "libuv")
+		       "/lib/libuv.so")
+	(string-append "LIBUV_INC="
+		       (assoc-ref %build-inputs "libuv")
+		       "/include")
+	"USE_SYSTEM_PATCHELF=1"
+	"USE_SYSTEM_PCRE=1"
+	"USE_SYSTEM_OPENLIBM=1"
+
+	"USE_SYSTEM_GMP=1"
+	"USE_SYSTEM_MPFR=1"
+	"USE_SYSTEM_ARPACK=1"
+	"USE_SYSTEM_LIBGIT2=1"
+	"USE_SYSTEM_ZLIB=1"
+	"USE_SYSTEM_OPENSPECFUN=1")))
     (inputs
-     `(("llvm" ,llvm-3.9.1)
+     `(("llvm" ,llvm-julia)
 
        ;; The bundled version is 3.3.0 so stick to that version.  With other
        ;; versions, we get test failures in 'linalg/arnoldi' as described in
@@ -325,7 +403,7 @@
        ("coreutils" ,coreutils) ;for bindings to "mkdir" and the like
        ("lapack" ,lapack)
        ("openblas" ,openblas) ;Julia does not build with Atlas
-       ("libunwind" ,libunwind-for-julia)
+       ("libunwind" ,libunwind)
        ("openlibm" ,openlibm)
        ("openspecfun" ,openspecfun)
        ("libgit2" ,libgit2)
@@ -346,6 +424,18 @@
        ;; would eventually be replaced with proper Guix packages.
 
        ;; TODO: run "make -f contrib/repackage_system_suitesparse4.make" to copy static lib
+       ;; Find dependency versions here:
+       ;; https://raw.githubusercontent.com/JuliaLang/julia/77a2c1e245c85812dc1c7687540beedecc52758f/deps/Versions.make
+       ("rmath"
+	,(origin
+	   (method git-fetch)
+	   (uri (git-reference
+                 (url "https://github.com/JuliaLang/Rmath-julia")
+                 (commit "v0.1")))
+           (file-name "rmath-julia-0.1-checkout")
+	   (sha256
+	    (base32
+	     "1zkpy0cg5zivq40zbhbdgj9128fqzs2j94wkwih8nc6xaj3gp9p6"))))
        ("suitesparse"
         ,(origin
            (method url-fetch)
@@ -362,6 +452,21 @@
            (sha256
             (base32
              "0wp6ld9vk11f4nnkn56627zmlv9k5vafi99qa3yyn1pgcd61zcfs"))))
+       ("libwhich"
+	,(let ((commit "81e9723c0273d78493dc8c8ed570f68d9ce7e89e"))
+           (origin
+             ;; Note: We use a /tarball URL, but that's because Julia's build
+             ;; system checks the hash of that tarball; thus we can't use
+             ;; 'git-fetch'.
+	     (method url-fetch)
+	     (uri (string-append
+                   "https://api.github.com/repos/vtjnash/libwhich/tarball/"
+                   commit))
+             (file-name (string-append "libwhich-" (string-take commit 7)
+                                       ".tar.gz"))
+	     (sha256
+	      (base32
+	       "1p7zg31kpmpbmh1znrk1xrbd074agx13b9q4dcw8n2zrwwdlbz3b")))))
        ("dsfmt"
         ,(origin
            (method url-fetch)
@@ -376,14 +481,7 @@
        ("perl" ,perl)
        ("patchelf" ,patchelf)
        ("pkg-config" ,pkg-config)
-       ("python" ,python-2)
-       ("unicode-data"
-        ,(origin
-           (method url-fetch)
-           (uri "http://www.unicode.org/Public/9.0.0/ucd/UnicodeData.txt")
-           (sha256
-            (base32
-             "13zfannnr6sa6s27ggvcvzmh133ndi38pfyxsssvjmw2s8ac9pv8"))))))
+       ("python" ,python-2)))
     ;; Julia is not officially released for ARM and MIPS.
     ;; See https://github.com/JuliaLang/julia/issues/10639
     (supported-systems '("i686-linux" "x86_64-linux" "aarch64-linux"))
diff --git a/gnu/packages/kde.scm b/gnu/packages/kde.scm
index 31b3670079..68d2804dcc 100644
--- a/gnu/packages/kde.scm
+++ b/gnu/packages/kde.scm
@@ -320,7 +320,7 @@ plugins, as well as code to create plugins, or complete applications.")
 (define-public krita
   (package
     (name "krita")
-    (version "4.2.2")
+    (version "4.2.5")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -329,7 +329,7 @@ plugins, as well as code to create plugins, or complete applications.")
                     "/krita-" version ".tar.gz"))
               (sha256
                (base32
-                "1pzk5bqp3kh22djhvsvmsc7ybirs4hsnkpg1y9677m2gxwbqnnps"))))
+                "1f14r2mrqasl6nr3sss0xy2h8xlxd5wdcjcd64m9nz2gwlm39r7w"))))
     (build-system cmake-build-system)
     (arguments
      `(#:tests? #f
diff --git a/gnu/packages/kodi.scm b/gnu/packages/kodi.scm
index e885aaab39..a9b5b85a47 100644
--- a/gnu/packages/kodi.scm
+++ b/gnu/packages/kodi.scm
@@ -271,7 +271,7 @@ alternatives. In compilers, this can reduce the cascade of secondary errors.")
 (define-public kodi
   (package
     (name "kodi")
-    (version "18.2")
+    (version "18.3")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -280,7 +280,7 @@ alternatives. In compilers, this can reduce the cascade of secondary errors.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1yzi8171p1mnszyf80lqkl05ql25n73s5gn8pcgvv4jph4yvasnq"))
+                "18fbl5hs3aqccrn0m3x7hp95wlafjav0yvrwmb5q3gj24mwf6jld"))
               (patches (search-patches "kodi-skip-test-449.patch"
                                        "kodi-set-libcurl-ssl-parameters.patch"))
               (snippet
diff --git a/gnu/packages/libevent.scm b/gnu/packages/libevent.scm
index 7982a12dfd..4898f0a768 100644
--- a/gnu/packages/libevent.scm
+++ b/gnu/packages/libevent.scm
@@ -41,7 +41,7 @@
 (define-public libevent
   (package
     (name "libevent")
-    (version "2.1.10")
+    (version "2.1.11")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -49,7 +49,7 @@
                    version "-stable/libevent-" version "-stable.tar.gz"))
              (sha256
               (base32
-               "1c25928gdv495clxk2v1d4gkr5py7ack4gx2n7d13frnld0syr78"))))
+               "0g988zqm45sj1hlhhz4il5z4dpi5dl74hzjwzl4md37a09iaqnx6"))))
     (build-system gnu-build-system)
     (arguments
       ;; This skips some of the tests which fail on armhf and aarch64.
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 52883282e8..9f20d2bace 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -182,31 +182,31 @@ defconfig.  Return the appropriate make target if applicable, otherwise return
 
 (define deblob-scripts-5.2
   (linux-libre-deblob-scripts
-   "5.2.1"
+   "5.2.3"
    (base32 "076fwxlm6jq6z4vg1xq3kr474zz7qk71r90sf9dnfia3rw2pb4fa")
-   (base32 "030cccchli7vnzvxcw261spyzsgnq0m113bjsz8y4vglf6gaz4n9")))
+   (base32 "0d3pp1bqchqc7vnxr1a56km5r0hzjiiipzz2xc3wgjwfi51k9kxc")))
 
 (define deblob-scripts-4.19
   (linux-libre-deblob-scripts
-   "4.19.59"
+   "4.19.61"
    (base32 "02zs405awaxydbapka4nz8h6lmnc0dahgczqsrs5s2bmzjyyqkcy")
-   (base32 "07z1bsyny8lldncfh27lb16mgx9r38nswx4vmd24c7n4xva12k2s")))
+   (base32 "1fyacg28aym6virxyn7wk99qil2fjbks3iwm7p3hxy51pccn34za")))
 
 (define deblob-scripts-4.14
   (linux-libre-deblob-scripts
-   "4.14.133"
+   "4.14.134"
    (base32 "091jk9jkn9jf39bxpc7395bhcb7p96nkg3a8047380ki06lnfxh6")
    (base32 "0x9nd3hnyrm753cbgdqmy92mbnyw86w64g4hvyibnkpq5n7s3z9n")))
 
 (define deblob-scripts-4.9
   (linux-libre-deblob-scripts
-   "4.9.185"
+   "4.9.186"
    (base32 "1wvldzlv7q2xdbadas87dh593nxr4a8p5n0f8zpm72lja6w18hmg")
    (base32 "1gmjn5cwxydg6qb47wcmahwkv37npsjx4papynzkkdxyidmrccya")))
 
 (define deblob-scripts-4.4
   (linux-libre-deblob-scripts
-   "4.4.185"
+   "4.4.186"
    (base32 "0x2j1i88am54ih2mk7gyl79g25l9zz4r08xhl482l3fvjj2irwbw")
    (base32 "1x40lbiaizksy8z38ax7wpqr9ldgq7qvkxbb0ca98vd1axpklb10")))
 
@@ -312,7 +312,7 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
 
                   (format #t "~%Packing new Linux-libre tarball...~%")
                   (force-output)
-                  (invoke "tar" "cfa" #$output
+                  (invoke "tar" "cvfa" #$output
                           ;; Avoid non-determinism in the archive.
                           "--mtime=@0"
                           "--owner=root:0"
@@ -350,42 +350,42 @@ corresponding UPSTREAM-SOURCE (an origin), using the given DEBLOB-SCRIPTS."
                         "linux-" version ".tar.xz"))
     (sha256 hash)))
 
-(define-public linux-libre-5.2-version "5.2.2")
+(define-public linux-libre-5.2-version "5.2.6")
 (define-public linux-libre-5.2-pristine-source
   (let ((version linux-libre-5.2-version)
-        (hash (base32 "173da67d51qcjwrczqsfd6g9phzazqzr11xfxwlf54ckd6117ng5")))
+        (hash (base32 "1whzgdz1wnjzkb78yqz4xs3mad02rv17ksmwaf4ykp4lfgxml45y")))
    (make-linux-libre-source version
                             (%upstream-linux-source version hash)
                             deblob-scripts-5.2)))
 
-(define-public linux-libre-4.19-version "4.19.60")
+(define-public linux-libre-4.19-version "4.19.64")
 (define-public linux-libre-4.19-pristine-source
   (let ((version linux-libre-4.19-version)
-        (hash (base32 "0ibayrvrnw2lw7si78vdqnr20mm1d3z0g6a0ykndvgn5vdax5x9a")))
+        (hash (base32 "1gasmcdsrsk81dscslmrsxqsvkfp5xxdx3ay95izggpk7piqnvvs")))
     (make-linux-libre-source version
                              (%upstream-linux-source version hash)
                              deblob-scripts-4.19)))
 
-(define-public linux-libre-4.14-version "4.14.134")
+(define-public linux-libre-4.14-version "4.14.136")
 (define-public linux-libre-4.14-pristine-source
   (let ((version linux-libre-4.14-version)
-        (hash (base32 "0b9xj1rwr5fpw2giirfghzxxc0wp1hwf4nqvalx314pxxysyf88b")))
+        (hash (base32 "0w6z5fhwqgpqnz2js8vj9j5dl6isx8n7rnzrm0vr9r8njaazz396")))
     (make-linux-libre-source version
                              (%upstream-linux-source version hash)
                              deblob-scripts-4.14)))
 
-(define-public linux-libre-4.9-version "4.9.186")
+(define-public linux-libre-4.9-version "4.9.187")
 (define-public linux-libre-4.9-pristine-source
   (let ((version linux-libre-4.9-version)
-        (hash (base32 "0sjbp7m6d625rw06wv34a0805d1lgldii4pxiqfpja871m1q8914")))
+        (hash (base32 "1iyimwl4ysnk6m66m73sg0cnp4vac56d6yy174shfpnj5h2csjq1")))
     (make-linux-libre-source version
                              (%upstream-linux-source version hash)
                              deblob-scripts-4.9)))
 
-(define-public linux-libre-4.4-version "4.4.186")
+(define-public linux-libre-4.4-version "4.4.187")
 (define-public linux-libre-4.4-pristine-source
   (let ((version linux-libre-4.4-version)
-        (hash (base32 "113rjf8842glzi23y1g1yrwncihv2saah6wz0r726r06bk9p64hb")))
+        (hash (base32 "1dlzb5yzcsicd41myj3q4dq2ql8xcc49brs5f7xjmc5ynvvjjgnc")))
     (make-linux-libre-source version
                              (%upstream-linux-source version hash)
                              deblob-scripts-4.4)))
@@ -561,7 +561,9 @@ for ARCH and optionally VARIANT, or #f if there is no such configuration."
     (search-auxiliary-file file)))
 
 (define %default-extra-linux-options
-  `(;; Modules required for initrd:
+  `(;; Some very mild hardening.
+    ("CONFIG_SECURITY_DMESG_RESTRICT" . #t)
+    ;; Modules required for initrd:
     ("CONFIG_NET_9P" . m)
     ("CONFIG_NET_9P_VIRTIO" . m)
     ("CONFIG_VIRTIO_BLK" . m)
@@ -1400,15 +1402,18 @@ Zerofree requires the file system to be unmounted or mounted read-only.")
 (define-public strace
   (package
     (name "strace")
-    (version "5.1")
+    (version "5.2")
     (home-page "https://strace.io")
     (source (origin
              (method url-fetch)
              (uri (string-append home-page "/files/" version
                                  "/strace-" version ".tar.xz"))
+             ;; XXX Remove the 'regenerate-tests' phase below when
+             ;; "strace-ipc-tests.patch" is no longer applied.
+             (patches (search-patches "strace-ipc-tests.patch"))
              (sha256
               (base32
-               "12wsga1v3rab24gr0mpfip7j7gwr90m8f9h6fviqxa3xgnwl38zm"))))
+               "1li49i75wrdw91hchyyd8spnzfcmxcfyfb5g9zbaza89aq4bq4ym"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
@@ -1417,7 +1422,14 @@ Zerofree requires the file system to be unmounted or mounted read-only.")
            (lambda _
              (substitute* "strace.c"
                (("/bin/sh") (which "sh")))
-             #t)))
+             #t))
+         (add-before 'configure 'regenerate-tests
+           ;; XXX Remove this phase when "strace-ipc-tests.patch" is no longer
+           ;; applied in the 'source' field above.  This phase is needed to
+           ;; regenerate many other files from tests/gen_tests.in, which is
+           ;; modified by the aforementioned patch.
+           (lambda _
+             (invoke "tests/gen_tests.sh"))))
        ;; Don't fail if the architecture doesn't support different personalities.
        #:configure-flags '("--enable-mpers=check")
        ;; See <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32459>.
@@ -3820,7 +3832,7 @@ and copy/paste text in the console and in xterm.")
 (define-public btrfs-progs
   (package
     (name "btrfs-progs")
-    (version "5.1.1")
+    (version "5.2.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://kernel.org/linux/kernel/"
@@ -3828,7 +3840,7 @@ and copy/paste text in the console and in xterm.")
                                   "btrfs-progs-v" version ".tar.xz"))
               (sha256
                (base32
-                "06xybs7rglxjqkbzl2409acb3rgmnc5zc0xhyaxsc2p1x5yipfcw"))))
+                "0crjv3i20nyj2dagfw6q7byshscpn6j7wlqch3apkzzzk00lmb1n"))))
     (build-system gnu-build-system)
     (outputs '("out"
                "static"))      ; static versions of the binaries in "out"
@@ -4611,7 +4623,7 @@ are exceeded.")
 (define-public mtd-utils
   (package
     (name "mtd-utils")
-    (version "2.0.2")
+    (version "2.1.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -4619,17 +4631,19 @@ are exceeded.")
                     "mtd-utils-" version ".tar.bz2"))
               (sha256
                (base32
-                "1f30jszknc5v6ykmil8ajxgksmcg54q3rsp84jsancp9x0dycggv"))))
+                "1lijl89l7hljx8xx70vrz9srd3h41v5gh4b0lvqnlv831yvyh5cd"))))
     (arguments
      '(#:configure-flags '("--enable-unit-tests")))
     (native-inputs
      `(("cmocka" ,cmocka)
        ("pkg-config" ,pkg-config)))
     (inputs
-     `(("acl" ,acl) ; for XATTR
+     `(("acl" ,acl)                     ; extended attributes (xattr)
        ("libuuid" ,util-linux)
        ("lzo" ,lzo)
-       ("zlib" ,zlib)))
+       ("openssl" ,openssl)             ; optional crypto support
+       ("zlib" ,zlib)
+       ("zstd" ,zstd "lib")))
     (build-system gnu-build-system)
     (synopsis "MTD Flash Storage Utilities")
     (description "This package provides utilities for testing, partitioning, etc
diff --git a/gnu/packages/lisp.scm b/gnu/packages/lisp.scm
index 884d00d935..d2bed231bd 100644
--- a/gnu/packages/lisp.scm
+++ b/gnu/packages/lisp.scm
@@ -6563,7 +6563,90 @@ This system contains the CFFI foreign slot access extension.")))
        ("trivia.cffi" ,sbcl-trivia.cffi)
        ("optima" ,sbcl-optima)))
     (arguments
-     `(#:test-asd-file "trivia.test.asd"))
+     `(#:test-asd-file "trivia.test.asd"
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'create-asd 'remove-component
+           ;; XXX: The original .asd has no components, but our build system
+           ;; creates an entry nonetheless.  We need to remove it for the
+           ;; generated .asd to load properly.  See trivia.trivial for a
+           ;; similar problem.
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (asd (string-append out "/lib/" (%lisp-type) "/trivia.asd")))
+               (substitute* asd
+                 (("  :components
+")
+                  ""))
+               (substitute* asd
+                 ((" *\\(\\(:compiled-file \"trivia--system\"\\)\\)")
+                  ""))))))))
     (description "Trivia is a pattern matching compiler that is compatible
 with Optima, another pattern matching library for Common Lisp.  It is meant to
 be faster and more extensible than Optima.")))
+
+(define-public sbcl-mk-string-metrics
+  (package
+    (name "sbcl-mk-string-metrics")
+    (version "0.1.2")
+    (home-page "https://github.com/cbaggers/mk-string-metrics/")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url home-page)
+                    (commit version)))
+              (sha256
+               (base32 "0bg0bv2mfd4k0g3x72x563hvmrx18xavaffr6xk5rh4if5j7kcf6"))
+              (file-name (git-file-name name version))))
+    (build-system asdf-build-system/sbcl)
+    (synopsis "Calculate various string metrics efficiently in Common Lisp")
+    (description "This library implements efficient algorithms that calculate
+various string metrics in Common Lisp:
+
+@itemize
+@item Damerau-Levenshtein distance
+@item Hamming distance
+@item Jaccard similarity coefficient
+@item Jaro distance
+@item Jaro-Winkler distance
+@item Levenshtein distance
+@item Normalized Damerau-Levenshtein distance
+@item Normalized Levenshtein distance
+@item Overlap coefficient
+@end itemize\n")
+    (license license:x11)))
+
+(define-public sbcl-cl-str
+  (let ((commit "3d5ec86e3a0199e5973aacde951086dfd754b5e5"))
+    (package
+      (name "sbcl-cl-str")
+      (version (git-version "0.8" "1" commit))
+      (home-page "https://github.com/vindarel/cl-str")
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url home-page)
+                      (commit commit)))
+                (sha256
+                 (base32 "0szzzbygw9h985yxz909vvqrp69pmpcpahn7hn350lnyjislk9ga"))
+                (file-name (git-file-name name version))))
+      (build-system asdf-build-system/sbcl)
+      (inputs
+       `(("cl-ppcre" ,sbcl-cl-ppcre)
+         ("cl-ppcre-unicode" ,sbcl-cl-ppcre-unicode)))
+      (native-inputs
+       `(("prove" ,sbcl-prove)
+         ("prove-asdf" ,sbcl-prove-asdf)))
+      (arguments
+       `(#:asd-file "str.asd"
+         #:asd-system-name "str"
+         #:test-asd-file "str.test.asd"))
+      (synopsis "Modern, consistent and terse Common Lisp string manipulation library")
+      (description "A modern and consistent Common Lisp string manipulation
+library that focuses on modernity, simplicity and discoverability:
+@code{(str:trim s)} instead of @code{(string-trim '(#\\Space ...) s)}), or
+@code{str:concat strings} instead of an unusual format construct; one
+discoverable library instead of many; consistency and composability, where
+@code{s} is always the last argument, which makes it easier to feed pipes and
+arrows.")
+      (license license:expat))))
diff --git a/gnu/packages/llvm.scm b/gnu/packages/llvm.scm
index 1fe9af38e0..9efb4a4841 100644
--- a/gnu/packages/llvm.scm
+++ b/gnu/packages/llvm.scm
@@ -46,7 +46,30 @@
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
-  #:use-module (gnu packages xml))
+  #:use-module (gnu packages xml)
+  #:export (system->llvm-target))
+
+(define* (system->llvm-target #:optional
+                              (system (or (and=> (%current-target-system)
+                                                 gnu-triplet->nix-system)
+                                          (%current-system))))
+  "Return the LLVM target name that corresponds to SYSTEM, a system type such
+as \"x86_64-linux\"."
+  ;; See the 'lib/Target' directory of LLVM for a list of supported targets.
+  (letrec-syntax ((matches (syntax-rules (=>)
+                             ((_ (system-prefix => target) rest ...)
+                              (if (string-prefix? system-prefix system)
+                                  target
+                                  (matches rest ...)))
+                             ((_)
+                              (error "LLVM target for system is unknown" system)))))
+    (matches ("aarch64"     => "AArch64")
+             ("armhf"       => "ARM")
+             ("mips64el"    => "Mips")
+             ("powerpc"     => "PowerPC")
+             ("riscv"       => "RISCV")
+             ("x86_64"      => "X86")
+             ("i686"        => "X86"))))
 
 (define-public llvm-8
   (package
diff --git a/gnu/packages/machine-learning.scm b/gnu/packages/machine-learning.scm
index 2dc7dc81ef..dd5ee1e9ee 100644
--- a/gnu/packages/machine-learning.scm
+++ b/gnu/packages/machine-learning.scm
@@ -821,8 +821,14 @@ computing environments.")
              (setenv "HOME" "/tmp")
 
              (invoke "pytest" "sklearn" "-m" "not network")))
-         ;; FIXME: This fails with permission denied
-         (delete 'reset-gzip-timestamps))))
+         (add-before 'reset-gzip-timestamps 'make-files-writable
+           (lambda* (#:key outputs #:allow-other-keys)
+             ;; Make sure .gz files are writable so that the
+             ;; 'reset-gzip-timestamps' phase can do its work.
+             (let ((out (assoc-ref outputs "out")))
+               (for-each make-file-writable
+                         (find-files out "\\.gz$"))
+               #t))))))
     (inputs
      `(("openblas" ,openblas)))
     (native-inputs
diff --git a/gnu/packages/mail.scm b/gnu/packages/mail.scm
index b555578639..40fe7d9450 100644
--- a/gnu/packages/mail.scm
+++ b/gnu/packages/mail.scm
@@ -1,9 +1,9 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2014, 2015, 2017 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
 ;;; Copyright © 2014 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2014 Julien Lepiller <julien@lepiller.eu>
+;;; Copyright © 2014, 2019 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015 Paul van der Walt <paul@denknerd.org>
 ;;; Copyright © 2015, 2016, 2018 Eric Bavier <bavier@member.fsf.org>
@@ -95,6 +95,7 @@
   #:use-module (gnu packages onc-rpc)
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages perl-check)
   #:use-module (gnu packages perl-web)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -116,6 +117,7 @@
   #:use-module (gnu packages w3m)
   #:use-module (gnu packages web)
   #:use-module (gnu packages webkit)
+  #:use-module (gnu packages xdisorg)
   #:use-module (gnu packages xorg)
   #:use-module (gnu packages xml)
   #:use-module ((guix licenses)
@@ -1119,7 +1121,8 @@ compresses it.")
               ("libxml2" ,libxml2)
               ("perl" ,perl)
               ("python-2" ,python-2)
-              ("mime-info" ,shared-mime-info)))
+              ("mime-info" ,shared-mime-info)
+              ("startup-notification" ,startup-notification)))
     (arguments
       '(#:configure-flags
         '("--enable-gnutls" "--enable-pgpmime-plugin" "--enable-enchant"
@@ -1195,7 +1198,7 @@ delivery.")
 (define-public exim
   (package
     (name "exim")
-    (version "4.92")
+    (version "4.92.1")
     (source
      (origin
        (method url-fetch)
@@ -1204,7 +1207,7 @@ delivery.")
                   (string-append "https://ftp.exim.org/pub/exim/exim4/old/exim-"
                                  version ".tar.bz2")))
        (sha256
-        (base32 "127spqn009wa6irp6r1k7a24r8vdwb6mf0raamxn8lbxsnrwy7sl"))))
+        (base32 "132zmxgzz35xwi89g3crw6hd3y74rxj5zcpamakvrnlcn256amdp"))))
     (build-system gnu-build-system)
     (inputs
      `(("bdb" ,bdb-5.3) ; ‘#error Version 6 and later BDB API is not supported’
@@ -1900,6 +1903,136 @@ Khard can also be used from within the email client @command{mutt}.")
 in Perl.")
     (license bsd-3)))
 
+(define-public perl-mail-authenticationresults
+  (package
+    (name "perl-mail-authenticationresults")
+    (version "1.20180923")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                     "mirror://cpan/authors/id/M/MB/MBRADSHAW/"
+                     "Mail-AuthenticationResults-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1g1wym9vcbhldwvi4w5pl0fhd4jh2icj975awf4wr5xmkli9mxbz"))))
+    (build-system perl-build-system)
+    (native-inputs
+     `(("perl-test-exception" ,perl-test-exception)))
+    (home-page "https://metacpan.org/release/Mail-AuthenticationResults")
+    (synopsis "Object Oriented Authentication-Results Headers")
+    (description "Mail::AuthenticationResults parses the message header field
+that indicates the message authentication status as per RFC7601.  This module
+is not fully compliant with the RFC but it tries to implement most styles of
+Authentication-Results header seen in the wild.")
+    (license perl-license)))
+
+(define-public perl-mail-dkim
+  (package
+    (name "perl-mail-dkim")
+    (version "0.55")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                     "mirror://cpan/authors/id/M/MB/MBRADSHAW/Mail-DKIM-"
+                     version
+                     ".tar.gz"))
+              (sha256
+               (base32
+                "18nsh1ff6fkns4xk3y2ixmzmadgggydj11qkzj6nlnq2hzqxsafz"))))
+    (build-system perl-build-system)
+    (propagated-inputs
+     `(("perl-crypt-openssl-rsa" ,perl-crypt-openssl-rsa)
+       ("perl-mail-authenticationresults" ,perl-mail-authenticationresults)
+       ("perl-mailtools" ,perl-mailtools)
+       ("perl-net-dns" ,perl-net-dns)))
+    (native-inputs
+     `(("perl-net-dns-resolver-mock" ,perl-net-dns-resolver-mock)
+       ("perl-test-requiresinternet" ,perl-test-requiresinternet)
+       ("perl-yaml-libyaml" ,perl-yaml-libyaml)))
+    (home-page "https://metacpan.org/release/Mail-DKIM")
+    (synopsis "Signs/verifies Internet mail with DKIM/DomainKey signatures")
+    (description "Mail::DKIM is a Perl module that implements the new Domain
+Keys Identified Mail (DKIM) standard, and the older Yahoo! DomainKeys standard,
+both of which sign and verify emails using digital signatures and DNS records.
+Mail-DKIM can be used by any Perl program that wants to provide support for
+DKIM and/or DomainKeys.")
+    (license gpl3+)))
+
+(define-public dkimproxy
+  (package
+    (name "dkimproxy")
+    (version "1.4.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                     "mirror://sourceforge/dkimproxy/dkimproxy/"
+                     version "/dkimproxy-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1gc5c7lg2qrlck7b0lvjfqr824ch6jkrzkpsn0gjvlzg7hfmld75"))
+              (patches
+               (search-patches "dkimproxy-add-ipv6-support.patch"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'make-wrapper
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (wrap.pl (lambda (scripts keys)
+                               (for-each
+                                (lambda (script)
+                                  (wrap-program (string-append out script)
+                                    `("PERL5LIB" ":" prefix
+                                      ,(map (λ (input)
+                                              (string-append
+                                               (assoc-ref inputs input)
+                                               "/lib/perl5/site_perl"))
+                                            keys))))
+                                scripts))))
+               (wrap.pl (list "/bin/dkimproxy.in"
+                              "/bin/dkimproxy.out")
+                        (list "perl-crypt-openssl-rsa"
+                              "perl-io-socket-inet6"
+                              "perl-mailtools"
+                              "perl-mail-authenticationresults"
+                              "perl-mail-dkim"
+                              "perl-net-dns"
+                              "perl-net-server"
+                              "perl-socket6"))
+               (wrap.pl (list "/bin/dkim_responder.pl")
+                        (list "perl-crypt-openssl-rsa"
+                              "perl-mail-dkim"
+                              "perl-mailtools"
+                              "perl-mime-tools"
+                              "perl-net-dns"
+                              "perl-timedate"))
+               #t))))))
+    (inputs
+     `(("perl" ,perl)
+       ("perl-crypt-openssl-rsa" ,perl-crypt-openssl-rsa)
+       ("perl-io-socket-inet6" ,perl-io-socket-inet6)
+       ("perl-mailtools" ,perl-mailtools)
+       ("perl-mail-authenticationresults" ,perl-mail-authenticationresults)
+       ("perl-mail-dkim" ,perl-mail-dkim)
+       ("perl-mime-tools" ,perl-mime-tools)
+       ("perl-net-dns" ,perl-net-dns)
+       ("perl-net-server" ,perl-net-server)
+       ("perl-socket6" ,perl-socket6)
+       ("perl-timedate" ,perl-timedate)))
+    (home-page "http://dkimproxy.sourceforge.net/")
+    (synopsis "SMTP proxy to sign and verify Internet mail with DKIM headers")
+    (description
+     "DKIMproxy is an SMTP proxy that signs and verifies Internet mail using the
+@code{Mail::DKIM} Perl module.  It comprises two separate proxies: an outbound
+proxy for signing outgoing email, and an inbound proxy for verifying signatures
+of incoming messages.
+
+It was designed for Postfix, but can be used to add DKIM support to nearly any
+existing mail server.  With Postfix, the proxies can operate as either
+@code{Before-Queue} or @code{After-Queue} content filters.")
+    (license gpl2+)))
+
 (define-public mb2md
   (package
     (name "mb2md")
@@ -2848,7 +2981,7 @@ replacement for the @code{urlview} program.")
        `(("guile-debbugs" ,guile-debbugs-next)
          ("guile-email" ,guile-email)
          ("guile-fibers" ,guile-fibers)
-         ("guile-json" ,guile-json)
+         ("guile-json" ,guile-json-1)
          ("guile-syntax-highlight" ,guile-syntax-highlight)
          ("guile" ,guile-2.2)))
       (native-inputs
diff --git a/gnu/packages/man.scm b/gnu/packages/man.scm
index 04c800e95f..f5c888186f 100644
--- a/gnu/packages/man.scm
+++ b/gnu/packages/man.scm
@@ -162,7 +162,7 @@ the traditional flat-text whatis databases.")
 (define-public man-pages
   (package
     (name "man-pages")
-    (version "5.01")
+    (version "5.02")
     (source
      (origin
        (method url-fetch)
@@ -172,7 +172,7 @@ the traditional flat-text whatis databases.")
               (string-append "mirror://kernel.org/linux/docs/man-pages/Archive/"
                              "man-pages-" version ".tar.xz")))
        (sha256
-        (base32 "09xn8d8xxwgms6h1bvjlgn3mxz51vxf3ra0ry9f5dqi29qry3z3x"))))
+        (base32 "1s4pdz2pwf0kvhdwx2s6lqn3xxzi38yz5jfyq5ymdmswc9gaiyn2"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (modify-phases %standard-phases (delete 'configure))
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 99ca4f9007..967e299803 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -65,7 +65,8 @@
               "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv"))
             (patches (search-patches "libmad-armv7-thumb-pt1.patch"
                                      "libmad-armv7-thumb-pt2.patch"
-                                     "libmad-frame-length.patch"
+                                     "libmad-md_size.patch"
+                                     "libmad-length-check.patch"
                                      "libmad-mips-newgcc.patch"))))
    (build-system gnu-build-system)
    (arguments
diff --git a/gnu/packages/multiprecision.scm b/gnu/packages/multiprecision.scm
index 7d355220b2..3d899941be 100644
--- a/gnu/packages/multiprecision.scm
+++ b/gnu/packages/multiprecision.scm
@@ -64,12 +64,11 @@
                           (else '())))))
    (synopsis "Multiple-precision arithmetic library")
    (description
-    "@dfn{GMP} (the GNU Multiple Precision Arithmetic Library) is a library for
-arbitrary-precision arithmetic, operating on signed integers, rational numbers
-and floating point numbers.  The precision is only limited by the available
-memory.  The library is highly optimized, with a design focus on execution
-speed.  It is aimed at use in, for example, cryptography and computational
-algebra.")
+    "The @acronym{GMP, the GNU Multiple Precision Arithmetic} library performs
+arbitrary-precision arithmetic on signed integers, rational numbers and floating
+point numbers.  The precision is only limited by the available memory.
+The library is highly optimized, with a design focus on execution speed.
+It is aimed at use in, for example, cryptography and computational algebra.")
    (license lgpl3+)
    (home-page "https://gmplib.org/")))
 
@@ -105,7 +104,7 @@ algebra.")
    (propagated-inputs `(("gmp" ,gmp)))            ; <mpfr.h> refers to <gmp.h>
    (synopsis "C library for arbitrary-precision floating-point arithmetic")
    (description
-    "GNU@tie{}@dfn{MPFR} (Multiple Precision Floating-Point Reliably) is a C
+    "GNU@tie{}@acronym{MPFR, Multiple Precision Floating-Point Reliably} is a C
 library for performing multiple-precision, floating-point computations with
 correct rounding.")
    (license lgpl3+)
@@ -128,8 +127,8 @@ correct rounding.")
                         ("mpfr" ,mpfr)))
    (synopsis "C library for arbitrary-precision complex arithmetic")
    (description
-    "GNU@tie{}@dfn{MPC} (Multiple Precision Complex library) is a C library for
-performing arithmetic on complex numbers.  It supports arbitrarily high
+    "GNU@tie{}@acronym{MPC, Multiple Precision Complex library} is a C library
+for performing arithmetic on complex numbers.  It supports arbitrarily high
 precision and correctly rounds the results.")
    (license lgpl3+)
    (home-page "http://multiprecision.org/mpc/")))
@@ -150,11 +149,11 @@ precision and correctly rounds the results.")
                          ("mpfr" ,mpfr)))
     (synopsis "C library for arbitrary-precision interval arithmetic")
     (description
-     "@dfn{MPFI} (Multiple Precision Floating-point Interval) is a portable C
+     "@acronym{MPFI, Multiple Precision Floating-point Interval} is a portable C
 library for arbitrary-precision interval arithmetic, with intervals represented
-using MPFR reliable floating-point numbers.  It's based on the @dfn{GMP} (GNU
-Multiple Precision Arithmetic) and GNU@tie{}@dfn{MPFR} (Multiple Precision
-Floating-Point Reliably) libraries.
+using MPFR reliable floating-point numbers.  It's based on the @acronym{GMP, GNU
+Multiple Precision Arithmetic} and GNU@tie{}@acronym{MPFR, Multiple Precision
+Floating-Point Reliably} libraries.
 
 The purpose of arbitrary-precision interval arithmetic is to get results that
 are both guaranteed, thanks to interval computation, and accurate, thanks to
diff --git a/gnu/packages/networking.scm b/gnu/packages/networking.scm
index bc252fc591..16e04aaa13 100644
--- a/gnu/packages/networking.scm
+++ b/gnu/packages/networking.scm
@@ -28,6 +28,7 @@
 ;;; Copyright © 2018 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;; Copyright © 2019 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2019 Vasile Dumitrascu <va511e@yahoo.com>
+;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -593,14 +594,14 @@ of the same name.")
 (define-public wireshark
   (package
     (name "wireshark")
-    (version "3.0.2")
+    (version "3.0.3")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://www.wireshark.org/download/src/wireshark-"
                            version ".tar.xz"))
        (sha256
-        (base32 "0fz5lbyiw4a27fqc4ndi1w20bpcb6wi9k7vjv29l9fhd99kca7ky"))))
+        (base32 "0711jilp9sbgi46d105m3galw8n4wk5yncawi08031qxg2f754mg"))))
     (build-system cmake-build-system)
     (arguments
      `(#:phases
@@ -1081,6 +1082,29 @@ definitions and structure manipulators for Perl.")
 offline emulation of DNS.")
   (license license:perl-license)))
 
+(define-public perl-net-dns-resolver-mock
+  (package
+    (name "perl-net-dns-resolver-mock")
+    (version "1.20171219")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                     "mirror://cpan/authors/id/M/MB/MBRADSHAW/"
+                     "Net-DNS-Resolver-Mock-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0m3rxpkv1b9121srvbqkrgzg4m8mnydiydqv34in1i1ixwrl6jn9"))))
+    (build-system perl-build-system)
+    (inputs
+     `(("perl-net-dns" ,perl-net-dns)))
+    (home-page "https://metacpan.org/release/Net-DNS-Resolver-Mock")
+    (synopsis "Mock DNS Resolver object for testing")
+    (description
+     "Net::DNS::Resolver::Mock is a subclass of Net::DNS::Resolver, but returns
+static data from any provided DNS zone file instead of querying the network.
+It is intended primarily for use in testing.")
+    (license license:perl-license)))
+
 (define-public perl-netaddr-ip
  (package
   (name "perl-netaddr-ip")
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index ab11065379..ac9ed91722 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -293,7 +293,7 @@
       (propagated-inputs
        `(("gnutls" ,gnutls)
          ("guile-gcrypt" ,guile-gcrypt)
-         ("guile-json" ,guile-json)
+         ("guile-json" ,guile-json-1)
          ("guile-sqlite3" ,guile-sqlite3)
          ("guile-ssh" ,guile-ssh)
          ("guile-git" ,guile-git)))
@@ -325,7 +325,7 @@ the Nix package manager.")
     (inputs
      `(("gnutls" ,gnutls)
        ("guile-git" ,guile-git)
-       ("guile-json" ,guile-json)
+       ("guile-json" ,guile-json-1)
        ("guile-gcrypt" ,guile-gcrypt)
        ,@(fold alist-delete (package-inputs guix)
                '("boot-guile" "boot-guile/i686" "util-linux"))))
@@ -1027,7 +1027,7 @@ the boot loader configuration.")
 (define-public flatpak
   (package
    (name "flatpak")
-   (version "1.2.4")
+   (version "1.4.2")
    (source
     (origin
      (method url-fetch)
@@ -1035,7 +1035,7 @@ the boot loader configuration.")
                          version "/flatpak-" version ".tar.xz"))
      (sha256
       (base32
-       "1qf3ys84fzv11z6f6li59rxjdjbyrv7cyi9539k73r9i9pckjr8v"))))
+       "08nmpp26mgv0vp3mlwk97rnp0j7i108h4hr9nllja19sjxnrlygj"))))
 
    ;; Wrap 'flatpak' so that GIO_EXTRA_MODULES is set, thereby allowing GIO to
    ;; find the TLS backend in glib-networking.
@@ -1063,6 +1063,7 @@ the boot loader configuration.")
    (inputs `(("appstream-glib" ,appstream-glib)
              ("bubblewrap" ,bubblewrap)
              ("dconf" ,dconf)
+             ("fuse" ,fuse)
              ("gdk-pixbuf" ,gdk-pixbuf)
              ("gpgme" ,gpgme)
              ("json-glib" ,json-glib)
diff --git a/gnu/packages/patches/dkimproxy-add-ipv6-support.patch b/gnu/packages/patches/dkimproxy-add-ipv6-support.patch
new file mode 100644
index 0000000000..8e9988791d
--- /dev/null
+++ b/gnu/packages/patches/dkimproxy-add-ipv6-support.patch
@@ -0,0 +1,75 @@
+From: Tobias Geerinckx-Rice <me@tobias.gr>
+Date: Fri, 01 Mar 2019 20:51:32 +0100
+Subject: [PATCH] dkimproxy: Add IPv6 support.
+
+The following patch was copied verbatim from Debian[0].
+
+[0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=656041
+
+---
+--- dkimproxy-1.4.1.orig/lib/MSDW/SMTP/Server.pm
++++ dkimproxy-1.4.1/lib/MSDW/SMTP/Server.pm
+@@ -11,7 +11,7 @@
+ # Written by Bennett Todd <bet@rahul.net>
+ 
+ package MSDW::SMTP::Server;
+-use IO::Socket;
++use IO::Socket::INET6;
+ use IO::File;
+ 
+ =head1 NAME
+@@ -88,14 +88,14 @@
+ =item new(interface => $interface, port => $port);
+ 
+ The interface and port to listen on must be specified. The interface
+-must be a valid numeric IP address (0.0.0.0 to listen on all
+-interfaces, as usual); the port must be numeric. If this call
+-succeeds, it returns a server structure with an open
+-IO::Socket::INET in it, ready to listen on. If it fails it dies, so
+-if you want anything other than an exit with an explanatory error
+-message, wrap the constructor call in an eval block and pull the
+-error out of $@ as usual. This is also the case for all other
+-methods; they succeed or they die.
++must be a valid numeric IPv4 or IPv6 address (0.0.0.0 or :: to listen
++on all interfaces, as usual); the port must be numeric. If this call
++succeeds, it returns a server structure with an open IO::Socket::INET6
++in it, ready to listen on. If it fails it dies, so if you want
++anything other than an exit with an explanatory error message, wrap
++the constructor call in an eval block and pull the error out of $@ as
++usual. This is also the case for all other methods; they succeed or
++they die.
+ 
+ =item accept([debug => FD]);
+ 
+@@ -154,7 +154,7 @@
+     my ($this, @opts) = @_;
+     my $class = ref($this) || $this;
+     my $self = bless { @opts }, $class;
+-    $self->{sock} = IO::Socket::INET->new(
++    $self->{sock} = IO::Socket::INET6->new(
+ 	LocalAddr => $self->{interface},
+ 	LocalPort => $self->{port},
+ 	Proto => 'tcp',
+only in patch2:
+unchanged:
+--- dkimproxy-1.4.1.orig/scripts/dkimproxy.out
++++ dkimproxy-1.4.1/scripts/dkimproxy.out
+@@ -314,17 +314,11 @@
+ {
+ 	my $self = shift;
+ 
+-	# try to determine peer's address
+-	use Socket;
+-	my $peersockaddr = getpeername(STDOUT);
+-	my ($port, $iaddr) = sockaddr_in($peersockaddr);
+-	$ENV{REMOTE_ADDR} = inet_ntoa($iaddr);
+-
+ 	# initialize syslog
+ 	eval
+ 	{
+ 		openlog("dkimproxy.out", "perror,pid,ndelay", "mail");
+-		syslog("debug", '%s', "connect from $ENV{REMOTE_ADDR}");
++		syslog("debug", '%s', "connect from $self->{server}->{peeraddr}");
+ 	};
+ 	if (my $E = $@)
+ 	{
diff --git a/gnu/packages/patches/emacs-dired-toggle-sudo-emacs-26.patch b/gnu/packages/patches/emacs-dired-toggle-sudo-emacs-26.patch
new file mode 100644
index 0000000000..d979b113d0
--- /dev/null
+++ b/gnu/packages/patches/emacs-dired-toggle-sudo-emacs-26.patch
@@ -0,0 +1,49 @@
+From 3c0f4b27a079b90dc632f5061a81ce28cef24801 Mon Sep 17 00:00:00 2001
+From: eryx67 <eryx67@gmail.com>
+Date: Thu, 29 Nov 2018 10:30:20 +0500
+Subject: [PATCH] fix for latest emacs
+
+---
+ dired-toggle-sudo.el | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/dired-toggle-sudo.el b/dired-toggle-sudo.el
+index 386921b..fe5898e 100644
+--- a/dired-toggle-sudo.el
++++ b/dired-toggle-sudo.el
+@@ -37,17 +37,20 @@
+ unless SUDO-USER is provided."
+   (let* (;; Handle the case of local files. `tramp-dissect-file-name' does
+ 	 ;; not raise an error anymore.
+-	 (path (if (tramp-tramp-file-p path) path (concat "/:" path)))
++	 ;;(path (if (tramp-tramp-file-p path) path (concat "/-::" path)))
+ 	 (file-vec (or (ignore-errors (tramp-dissect-file-name
+ 				       path))
+ 		       (tramp-dissect-file-name
+-			(concat "/:" path) 1)))
++			(concat "/-::" path) 1)))
+ 	 (method  (tramp-file-name-method file-vec))
+ 	 (user (tramp-file-name-user file-vec))
+ 	 (host  (tramp-file-name-host file-vec))
++         (domain  (tramp-file-name-domain file-vec))
++         (port  (tramp-file-name-port file-vec))
+ 	 (localname (expand-file-name
+ 		     (tramp-file-name-localname file-vec))))
+-    (when (string= system-name host)
++    (when (or (string= (system-name) host)
++              (string= "-" host))
+       (setq host nil))
+     (cond
+      ;; remote directory -> sudo
+@@ -67,7 +70,7 @@ unless SUDO-USER is provided."
+       (setq method "sudo" user sudo-user)))
+     (replace-regexp-in-string
+      "^/:/" "/"
+-     (tramp-make-tramp-file-name method user host localname))))
++     (tramp-make-tramp-file-name method domain user host port localname))))
+ 
+ (defun dired-toggle-sudo-find (fname)
+   "Create a new buffer for file name FNAME."
+-- 
+2.22.0
+
diff --git a/gnu/packages/patches/libmad-frame-length.patch b/gnu/packages/patches/libmad-frame-length.patch
deleted file mode 100644
index 3434eba577..0000000000
--- a/gnu/packages/patches/libmad-frame-length.patch
+++ /dev/null
@@ -1,199 +0,0 @@
-Copied from Debian.
-
-; You can calculate where the next frame will start depending on things
-; like the bitrate. See mad_header_decode().  It seems that when decoding
-; the frame you can go past that boundary.  This attempts to catch those cases,
-; but might not catch all of them.
-; For more info see http://bugs.debian.org/508133
-Index: libmad-0.15.1b/layer12.c
-===================================================================
---- libmad-0.15.1b.orig/layer12.c	2008-12-23 21:38:07.000000000 +0100
-+++ libmad-0.15.1b/layer12.c	2008-12-23 21:38:12.000000000 +0100
-@@ -134,6 +134,12 @@
-   for (sb = 0; sb < bound; ++sb) {
-     for (ch = 0; ch < nch; ++ch) {
-       nb = mad_bit_read(&stream->ptr, 4);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
-       if (nb == 15) {
- 	stream->error = MAD_ERROR_BADBITALLOC;
-@@ -146,6 +152,12 @@
- 
-   for (sb = bound; sb < 32; ++sb) {
-     nb = mad_bit_read(&stream->ptr, 4);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
-     if (nb == 15) {
-       stream->error = MAD_ERROR_BADBITALLOC;
-@@ -162,6 +174,12 @@
-     for (ch = 0; ch < nch; ++ch) {
-       if (allocation[ch][sb]) {
- 	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
- # if defined(OPT_STRICT)
- 	/*
-@@ -187,6 +205,12 @@
- 	frame->sbsample[ch][s][sb] = nb ?
- 	  mad_f_mul(I_sample(&stream->ptr, nb),
- 		    sf_table[scalefactor[ch][sb]]) : 0;
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
-       }
-     }
- 
-@@ -195,6 +219,12 @@
- 	mad_fixed_t sample;
- 
- 	sample = I_sample(&stream->ptr, nb);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
- 	for (ch = 0; ch < nch; ++ch) {
- 	  frame->sbsample[ch][s][sb] =
-@@ -403,7 +433,15 @@
-     nbal = bitalloc_table[offsets[sb]].nbal;
- 
-     for (ch = 0; ch < nch; ++ch)
-+    {
-       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
-+    }
-   }
- 
-   for (sb = bound; sb < sblimit; ++sb) {
-@@ -411,6 +449,13 @@
- 
-     allocation[0][sb] =
-     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
-+
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
-   }
- 
-   /* decode scalefactor selection info */
-@@ -419,6 +464,12 @@
-     for (ch = 0; ch < nch; ++ch) {
-       if (allocation[ch][sb])
- 	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
-     }
-   }
- 
-@@ -442,6 +493,12 @@
-     for (ch = 0; ch < nch; ++ch) {
-       if (allocation[ch][sb]) {
- 	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
- 	switch (scfsi[ch][sb]) {
- 	case 2:
-@@ -452,11 +509,23 @@
- 
- 	case 0:
- 	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
-+		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+		{
-+			stream->error = MAD_ERROR_LOSTSYNC;
-+			stream->sync = 0;
-+			return -1;
-+		}
- 	  /* fall through */
- 
- 	case 1:
- 	case 3:
- 	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
-+		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+		{
-+			stream->error = MAD_ERROR_LOSTSYNC;
-+			stream->sync = 0;
-+			return -1;
-+		}
- 	}
- 
- 	if (scfsi[ch][sb] & 1)
-@@ -488,6 +557,12 @@
- 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
- 
- 	  II_samples(&stream->ptr, &qc_table[index], samples);
-+		if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+		{
-+			stream->error = MAD_ERROR_LOSTSYNC;
-+			stream->sync = 0;
-+			return -1;
-+		}
- 
- 	  for (s = 0; s < 3; ++s) {
- 	    frame->sbsample[ch][3 * gr + s][sb] =
-@@ -506,6 +581,12 @@
- 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
- 
- 	II_samples(&stream->ptr, &qc_table[index], samples);
-+	if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
-+	{
-+		stream->error = MAD_ERROR_LOSTSYNC;
-+		stream->sync = 0;
-+		return -1;
-+	}
- 
- 	for (ch = 0; ch < nch; ++ch) {
- 	  for (s = 0; s < 3; ++s) {
-Index: libmad-0.15.1b/layer3.c
-===================================================================
---- libmad-0.15.1b.orig/layer3.c	2008-12-23 21:38:07.000000000 +0100
-+++ libmad-0.15.1b/layer3.c	2008-12-23 21:38:12.000000000 +0100
-@@ -2608,6 +2608,12 @@
-     next_md_begin = 0;
- 
-   md_len = si.main_data_begin + frame_space - next_md_begin;
-+  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
-+  {
-+	stream->error = MAD_ERROR_LOSTSYNC;
-+	stream->sync = 0;
-+	return -1;
-+  }
- 
-   frame_used = 0;
- 
diff --git a/gnu/packages/patches/libmad-length-check.patch b/gnu/packages/patches/libmad-length-check.patch
new file mode 100644
index 0000000000..18ca68fd7e
--- /dev/null
+++ b/gnu/packages/patches/libmad-length-check.patch
@@ -0,0 +1,819 @@
+Copied from Debian.
+
+From: Kurt Roeckx <kurt@roeckx.be>
+Date: Sun, 28 Jan 2018 19:26:36 +0100
+Subject: Check the size before reading with mad_bit_read
+
+There are various cases where it attemps to read past the end of the buffer
+using mad_bit_read(). Most functions didn't even know the size of the buffer
+they were reading from.
+
+Index: libmad-0.15.1b/bit.c
+===================================================================
+--- libmad-0.15.1b.orig/bit.c
++++ libmad-0.15.1b/bit.c
+@@ -138,6 +138,9 @@ unsigned long mad_bit_read(struct mad_bi
+ {
+   register unsigned long value;
+ 
++  if (len == 0)
++    return 0;
++
+   if (bitptr->left == CHAR_BIT)
+     bitptr->cache = *bitptr->byte;
+ 
+Index: libmad-0.15.1b/frame.c
+===================================================================
+--- libmad-0.15.1b.orig/frame.c
++++ libmad-0.15.1b/frame.c
+@@ -120,11 +120,18 @@ static
+ int decode_header(struct mad_header *header, struct mad_stream *stream)
+ {
+   unsigned int index;
++  struct mad_bitptr bufend_ptr;
+ 
+   header->flags        = 0;
+   header->private_bits = 0;
+ 
++  mad_bit_init(&bufend_ptr, stream->bufend);
++
+   /* header() */
++  if (mad_bit_length(&stream->ptr, &bufend_ptr) < 32) {
++    stream->error = MAD_ERROR_BUFLEN;
++    return -1;
++  }
+ 
+   /* syncword */
+   mad_bit_skip(&stream->ptr, 11);
+@@ -225,8 +232,13 @@ int decode_header(struct mad_header *hea
+   /* error_check() */
+ 
+   /* crc_check */
+-  if (header->flags & MAD_FLAG_PROTECTION)
++  if (header->flags & MAD_FLAG_PROTECTION) {
++    if (mad_bit_length(&stream->ptr, &bufend_ptr) < 16) {
++      stream->error = MAD_ERROR_BUFLEN;
++      return -1;
++    }
+     header->crc_target = mad_bit_read(&stream->ptr, 16);
++  }
+ 
+   return 0;
+ }
+@@ -338,7 +350,7 @@ int mad_header_decode(struct mad_header
+       stream->error = MAD_ERROR_BUFLEN;
+       goto fail;
+     }
+-    else if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
++    else if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
+       /* mark point where frame sync word was expected */
+       stream->this_frame = ptr;
+       stream->next_frame = ptr + 1;
+@@ -361,6 +373,8 @@ int mad_header_decode(struct mad_header
+     ptr = mad_bit_nextbyte(&stream->ptr);
+   }
+ 
++  stream->error = MAD_ERROR_NONE;
++
+   /* begin processing */
+   stream->this_frame = ptr;
+   stream->next_frame = ptr + 1;  /* possibly bogus sync word */
+@@ -413,7 +427,7 @@ int mad_header_decode(struct mad_header
+     /* check that a valid frame header follows this frame */
+ 
+     ptr = stream->next_frame;
+-    if (!(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
++    if ((end - ptr >= 2) && !(ptr[0] == 0xff && (ptr[1] & 0xe0) == 0xe0)) {
+       ptr = stream->next_frame = stream->this_frame + 1;
+       goto sync;
+     }
+Index: libmad-0.15.1b/layer12.c
+===================================================================
+--- libmad-0.15.1b.orig/layer12.c
++++ libmad-0.15.1b/layer12.c
+@@ -72,10 +72,18 @@ mad_fixed_t const linear_table[14] = {
+  * DESCRIPTION:	decode one requantized Layer I sample from a bitstream
+  */
+ static
+-mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb)
++mad_fixed_t I_sample(struct mad_bitptr *ptr, unsigned int nb, struct mad_stream *stream)
+ {
+   mad_fixed_t sample;
++  struct mad_bitptr frameend_ptr;
+ 
++  mad_bit_init(&frameend_ptr, stream->next_frame);
++
++  if (mad_bit_length(ptr, &frameend_ptr) < nb) {
++    stream->error = MAD_ERROR_LOSTSYNC;
++    stream->sync = 0;
++    return 0;
++  }
+   sample = mad_bit_read(ptr, nb);
+ 
+   /* invert most significant bit, extend sign, then scale to fixed format */
+@@ -106,6 +114,10 @@ int mad_layer_I(struct mad_stream *strea
+   struct mad_header *header = &frame->header;
+   unsigned int nch, bound, ch, s, sb, nb;
+   unsigned char allocation[2][32], scalefactor[2][32];
++  struct mad_bitptr bufend_ptr, frameend_ptr;
++
++  mad_bit_init(&bufend_ptr, stream->bufend);
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   nch = MAD_NCHANNELS(header);
+ 
+@@ -118,6 +130,11 @@ int mad_layer_I(struct mad_stream *strea
+   /* check CRC word */
+ 
+   if (header->flags & MAD_FLAG_PROTECTION) {
++    if (mad_bit_length(&stream->ptr, &bufend_ptr)
++		< 4 * (bound * nch + (32 - bound))) {
++      stream->error = MAD_ERROR_BADCRC;
++      return -1;
++    }
+     header->crc_check =
+       mad_bit_crc(stream->ptr, 4 * (bound * nch + (32 - bound)),
+ 		  header->crc_check);
+@@ -133,6 +150,11 @@ int mad_layer_I(struct mad_stream *strea
+ 
+   for (sb = 0; sb < bound; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
++      if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
++	stream->error = MAD_ERROR_LOSTSYNC;
++	stream->sync = 0;
++	return -1;
++      }
+       nb = mad_bit_read(&stream->ptr, 4);
+ 
+       if (nb == 15) {
+@@ -145,6 +167,11 @@ int mad_layer_I(struct mad_stream *strea
+   }
+ 
+   for (sb = bound; sb < 32; ++sb) {
++    if (mad_bit_length(&stream->ptr, &frameend_ptr) < 4) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return -1;
++    }
+     nb = mad_bit_read(&stream->ptr, 4);
+ 
+     if (nb == 15) {
+@@ -161,6 +188,11 @@ int mad_layer_I(struct mad_stream *strea
+   for (sb = 0; sb < 32; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
++        if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++	  stream->error = MAD_ERROR_LOSTSYNC;
++	  stream->sync = 0;
++	  return -1;
++	}
+ 	scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
+ 
+ # if defined(OPT_STRICT)
+@@ -185,8 +217,10 @@ int mad_layer_I(struct mad_stream *strea
+       for (ch = 0; ch < nch; ++ch) {
+ 	nb = allocation[ch][sb];
+ 	frame->sbsample[ch][s][sb] = nb ?
+-	  mad_f_mul(I_sample(&stream->ptr, nb),
++	  mad_f_mul(I_sample(&stream->ptr, nb, stream),
+ 		    sf_table[scalefactor[ch][sb]]) : 0;
++	if (stream->error != 0)
++	  return -1;
+       }
+     }
+ 
+@@ -194,7 +228,14 @@ int mad_layer_I(struct mad_stream *strea
+       if ((nb = allocation[0][sb])) {
+ 	mad_fixed_t sample;
+ 
+-	sample = I_sample(&stream->ptr, nb);
++	if (mad_bit_length(&stream->ptr, &frameend_ptr) < nb) {
++	  stream->error = MAD_ERROR_LOSTSYNC;
++	  stream->sync = 0;
++          return -1;
++	}
++	sample = I_sample(&stream->ptr, nb, stream);
++        if (stream->error != 0)
++	  return -1;
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  frame->sbsample[ch][s][sb] =
+@@ -280,13 +321,21 @@ struct quantclass {
+ static
+ void II_samples(struct mad_bitptr *ptr,
+ 		struct quantclass const *quantclass,
+-		mad_fixed_t output[3])
++		mad_fixed_t output[3], struct mad_stream *stream)
+ {
+   unsigned int nb, s, sample[3];
++  struct mad_bitptr frameend_ptr;
++
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   if ((nb = quantclass->group)) {
+     unsigned int c, nlevels;
+ 
++    if (mad_bit_length(ptr, &frameend_ptr) < quantclass->bits) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return;
++    }
+     /* degrouping */
+     c = mad_bit_read(ptr, quantclass->bits);
+     nlevels = quantclass->nlevels;
+@@ -299,8 +348,14 @@ void II_samples(struct mad_bitptr *ptr,
+   else {
+     nb = quantclass->bits;
+ 
+-    for (s = 0; s < 3; ++s)
++    for (s = 0; s < 3; ++s) {
++      if (mad_bit_length(ptr, &frameend_ptr) < nb) {
++	stream->error = MAD_ERROR_LOSTSYNC;
++	stream->sync = 0;
++	return;
++      }
+       sample[s] = mad_bit_read(ptr, nb);
++    }
+   }
+ 
+   for (s = 0; s < 3; ++s) {
+@@ -336,6 +391,9 @@ int mad_layer_II(struct mad_stream *stre
+   unsigned char const *offsets;
+   unsigned char allocation[2][32], scfsi[2][32], scalefactor[2][32][3];
+   mad_fixed_t samples[3];
++  struct mad_bitptr frameend_ptr;
++
++  mad_bit_init(&frameend_ptr, stream->next_frame);
+ 
+   nch = MAD_NCHANNELS(header);
+ 
+@@ -402,13 +460,24 @@ int mad_layer_II(struct mad_stream *stre
+   for (sb = 0; sb < bound; ++sb) {
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
+-    for (ch = 0; ch < nch; ++ch)
++    for (ch = 0; ch < nch; ++ch) {
++      if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
++	stream->error = MAD_ERROR_LOSTSYNC;
++	stream->sync = 0;
++	return -1;
++      }
+       allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
++    }
+   }
+ 
+   for (sb = bound; sb < sblimit; ++sb) {
+     nbal = bitalloc_table[offsets[sb]].nbal;
+ 
++    if (mad_bit_length(&stream->ptr, &frameend_ptr) < nbal) {
++      stream->error = MAD_ERROR_LOSTSYNC;
++      stream->sync = 0;
++      return -1;
++    }
+     allocation[0][sb] =
+     allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
+   }
+@@ -417,8 +486,14 @@ int mad_layer_II(struct mad_stream *stre
+ 
+   for (sb = 0; sb < sblimit; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+-      if (allocation[ch][sb])
++      if (allocation[ch][sb]) {
++	if (mad_bit_length(&stream->ptr, &frameend_ptr) < 2) {
++	  stream->error = MAD_ERROR_LOSTSYNC;
++	  stream->sync = 0;
++	  return -1;
++	}
+ 	scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
++      }
+     }
+   }
+ 
+@@ -441,6 +516,11 @@ int mad_layer_II(struct mad_stream *stre
+   for (sb = 0; sb < sblimit; ++sb) {
+     for (ch = 0; ch < nch; ++ch) {
+       if (allocation[ch][sb]) {
++	if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++	  stream->error = MAD_ERROR_LOSTSYNC;
++	  stream->sync = 0;
++	  return -1;
++	}
+ 	scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
+ 
+ 	switch (scfsi[ch][sb]) {
+@@ -451,11 +531,21 @@ int mad_layer_II(struct mad_stream *stre
+ 	  break;
+ 
+ 	case 0:
++	  if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++	    stream->error = MAD_ERROR_LOSTSYNC;
++	    stream->sync = 0;
++	    return -1;
++	  }
+ 	  scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
+ 	  /* fall through */
+ 
+ 	case 1:
+ 	case 3:
++	  if (mad_bit_length(&stream->ptr, &frameend_ptr) < 6) {
++	    stream->error = MAD_ERROR_LOSTSYNC;
++	    stream->sync = 0;
++	    return -1;
++	  }
+ 	  scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
+ 	}
+ 
+@@ -487,7 +577,9 @@ int mad_layer_II(struct mad_stream *stre
+ 	if ((index = allocation[ch][sb])) {
+ 	  index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+-	  II_samples(&stream->ptr, &qc_table[index], samples);
++	  II_samples(&stream->ptr, &qc_table[index], samples, stream);
++	  if (stream->error != 0)
++            return -1;
+ 
+ 	  for (s = 0; s < 3; ++s) {
+ 	    frame->sbsample[ch][3 * gr + s][sb] =
+@@ -505,7 +597,9 @@ int mad_layer_II(struct mad_stream *stre
+       if ((index = allocation[0][sb])) {
+ 	index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+ 
+-	II_samples(&stream->ptr, &qc_table[index], samples);
++	II_samples(&stream->ptr, &qc_table[index], samples, stream);
++	if (stream->error != 0)
++          return -1;
+ 
+ 	for (ch = 0; ch < nch; ++ch) {
+ 	  for (s = 0; s < 3; ++s) {
+Index: libmad-0.15.1b/layer3.c
+===================================================================
+--- libmad-0.15.1b.orig/layer3.c
++++ libmad-0.15.1b/layer3.c
+@@ -598,7 +598,8 @@ enum mad_error III_sideinfo(struct mad_b
+ static
+ unsigned int III_scalefactors_lsf(struct mad_bitptr *ptr,
+ 				  struct channel *channel,
+-				  struct channel *gr1ch, int mode_extension)
++				  struct channel *gr1ch, int mode_extension,
++				  unsigned int bits_left, unsigned int *part2_length)
+ {
+   struct mad_bitptr start;
+   unsigned int scalefac_compress, index, slen[4], part, n, i;
+@@ -644,8 +645,12 @@ unsigned int III_scalefactors_lsf(struct
+ 
+     n = 0;
+     for (part = 0; part < 4; ++part) {
+-      for (i = 0; i < nsfb[part]; ++i)
++      for (i = 0; i < nsfb[part]; ++i) {
++	if (bits_left < slen[part])
++	  return MAD_ERROR_BADSCFSI;
+ 	channel->scalefac[n++] = mad_bit_read(ptr, slen[part]);
++	bits_left -= slen[part];
++      }
+     }
+ 
+     while (n < 39)
+@@ -690,7 +695,10 @@ unsigned int III_scalefactors_lsf(struct
+       max = (1 << slen[part]) - 1;
+ 
+       for (i = 0; i < nsfb[part]; ++i) {
++	if (bits_left < slen[part])
++	  return MAD_ERROR_BADSCFSI;
+ 	is_pos = mad_bit_read(ptr, slen[part]);
++	bits_left -= slen[part];
+ 
+ 	channel->scalefac[n] = is_pos;
+ 	gr1ch->scalefac[n++] = (is_pos == max);
+@@ -703,7 +711,8 @@ unsigned int III_scalefactors_lsf(struct
+     }
+   }
+ 
+-  return mad_bit_length(&start, ptr);
++  *part2_length = mad_bit_length(&start, ptr);
++  return MAD_ERROR_NONE;
+ }
+ 
+ /*
+@@ -712,7 +721,8 @@ unsigned int III_scalefactors_lsf(struct
+  */
+ static
+ unsigned int III_scalefactors(struct mad_bitptr *ptr, struct channel *channel,
+-			      struct channel const *gr0ch, unsigned int scfsi)
++			      struct channel const *gr0ch, unsigned int scfsi,
++			      unsigned int bits_left, unsigned int *part2_length)
+ {
+   struct mad_bitptr start;
+   unsigned int slen1, slen2, sfbi;
+@@ -728,12 +738,20 @@ unsigned int III_scalefactors(struct mad
+     sfbi = 0;
+ 
+     nsfb = (channel->flags & mixed_block_flag) ? 8 + 3 * 3 : 6 * 3;
+-    while (nsfb--)
++    while (nsfb--) {
++      if (bits_left < slen1)
++	return MAD_ERROR_BADSCFSI;
+       channel->scalefac[sfbi++] = mad_bit_read(ptr, slen1);
++      bits_left -= slen1;
++    }
+ 
+     nsfb = 6 * 3;
+-    while (nsfb--)
++    while (nsfb--) {
++      if (bits_left < slen2)
++	return MAD_ERROR_BADSCFSI;
+       channel->scalefac[sfbi++] = mad_bit_read(ptr, slen2);
++      bits_left -= slen2;
++    }
+ 
+     nsfb = 1 * 3;
+     while (nsfb--)
+@@ -745,8 +763,12 @@ unsigned int III_scalefactors(struct mad
+ 	channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 0; sfbi < 6; ++sfbi)
++      for (sfbi = 0; sfbi < 6; ++sfbi) {
++	if (bits_left < slen1)
++	  return MAD_ERROR_BADSCFSI;
+ 	channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
++	bits_left -= slen1;
++      }
+     }
+ 
+     if (scfsi & 0x4) {
+@@ -754,8 +776,12 @@ unsigned int III_scalefactors(struct mad
+ 	channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 6; sfbi < 11; ++sfbi)
++      for (sfbi = 6; sfbi < 11; ++sfbi) {
++	if (bits_left < slen1)
++	  return MAD_ERROR_BADSCFSI;
+ 	channel->scalefac[sfbi] = mad_bit_read(ptr, slen1);
++	bits_left -= slen1;
++      }
+     }
+ 
+     if (scfsi & 0x2) {
+@@ -763,8 +789,12 @@ unsigned int III_scalefactors(struct mad
+ 	channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 11; sfbi < 16; ++sfbi)
++      for (sfbi = 11; sfbi < 16; ++sfbi) {
++	if (bits_left < slen2)
++	  return MAD_ERROR_BADSCFSI;
+ 	channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
++	bits_left -= slen2;
++      }
+     }
+ 
+     if (scfsi & 0x1) {
+@@ -772,14 +802,19 @@ unsigned int III_scalefactors(struct mad
+ 	channel->scalefac[sfbi] = gr0ch->scalefac[sfbi];
+     }
+     else {
+-      for (sfbi = 16; sfbi < 21; ++sfbi)
++      for (sfbi = 16; sfbi < 21; ++sfbi) {
++	if (bits_left < slen2)
++	  return MAD_ERROR_BADSCFSI;
+ 	channel->scalefac[sfbi] = mad_bit_read(ptr, slen2);
++	bits_left -= slen2;
++      }
+     }
+ 
+     channel->scalefac[21] = 0;
+   }
+ 
+-  return mad_bit_length(&start, ptr);
++  *part2_length = mad_bit_length(&start, ptr);
++  return MAD_ERROR_NONE;
+ }
+ 
+ /*
+@@ -933,19 +968,17 @@ static
+ enum mad_error III_huffdecode(struct mad_bitptr *ptr, mad_fixed_t xr[576],
+ 			      struct channel *channel,
+ 			      unsigned char const *sfbwidth,
+-			      unsigned int part2_length)
++			      signed int part3_length)
+ {
+   signed int exponents[39], exp;
+   signed int const *expptr;
+   struct mad_bitptr peek;
+-  signed int bits_left, cachesz;
++  signed int bits_left, cachesz, fakebits;
+   register mad_fixed_t *xrptr;
+   mad_fixed_t const *sfbound;
+   register unsigned long bitcache;
+ 
+-  bits_left = (signed) channel->part2_3_length - (signed) part2_length;
+-  if (bits_left < 0)
+-    return MAD_ERROR_BADPART3LEN;
++  bits_left = part3_length;
+ 
+   III_exponents(channel, sfbwidth, exponents);
+ 
+@@ -956,8 +989,12 @@ enum mad_error III_huffdecode(struct mad
+   cachesz  = mad_bit_bitsleft(&peek);
+   cachesz += ((32 - 1 - 24) + (24 - cachesz)) & ~7;
+ 
++  if (bits_left < cachesz) {
++    cachesz = bits_left;
++  }
+   bitcache   = mad_bit_read(&peek, cachesz);
+   bits_left -= cachesz;
++  fakebits = 0;
+ 
+   xrptr = &xr[0];
+ 
+@@ -986,7 +1023,7 @@ enum mad_error III_huffdecode(struct mad
+ 
+     big_values = channel->big_values;
+ 
+-    while (big_values-- && cachesz + bits_left > 0) {
++    while (big_values-- && cachesz + bits_left - fakebits > 0) {
+       union huffpair const *pair;
+       unsigned int clumpsz, value;
+       register mad_fixed_t requantized;
+@@ -1023,10 +1060,19 @@ enum mad_error III_huffdecode(struct mad
+ 	unsigned int bits;
+ 
+ 	bits       = ((32 - 1 - 21) + (21 - cachesz)) & ~7;
++	if (bits_left < bits) {
++	  bits = bits_left;
++	}
+ 	bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
+ 	cachesz   += bits;
+ 	bits_left -= bits;
+       }
++      if (cachesz < 21) {
++	unsigned int bits = 21 - cachesz;
++	bitcache <<= bits;
++	cachesz += bits;
++	fakebits += bits;
++      }
+ 
+       /* hcod (0..19) */
+ 
+@@ -1041,6 +1087,8 @@ enum mad_error III_huffdecode(struct mad
+       }
+ 
+       cachesz -= pair->value.hlen;
++      if (cachesz < fakebits)
++	return MAD_ERROR_BADHUFFDATA;
+ 
+       if (linbits) {
+ 	/* x (0..14) */
+@@ -1054,10 +1102,15 @@ enum mad_error III_huffdecode(struct mad
+ 
+ 	case 15:
+ 	  if (cachesz < linbits + 2) {
+-	    bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-	    cachesz   += 16;
+-	    bits_left -= 16;
++	    unsigned int bits = 16;
++	    if (bits_left < 16)
++	      bits = bits_left;
++	    bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++	    cachesz   += bits;
++	    bits_left -= bits;
+ 	  }
++	  if (cachesz - fakebits < linbits)
++	    return MAD_ERROR_BADHUFFDATA;
+ 
+ 	  value += MASK(bitcache, cachesz, linbits);
+ 	  cachesz -= linbits;
+@@ -1074,6 +1127,8 @@ enum mad_error III_huffdecode(struct mad
+ 	  }
+ 
+ 	x_final:
++	  if (cachesz - fakebits < 1)
++	    return MAD_ERROR_BADHUFFDATA;
+ 	  xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
+ 	    -requantized : requantized;
+ 	}
+@@ -1089,10 +1144,15 @@ enum mad_error III_huffdecode(struct mad
+ 
+ 	case 15:
+ 	  if (cachesz < linbits + 1) {
+-	    bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-	    cachesz   += 16;
+-	    bits_left -= 16;
++	    unsigned int bits = 16;
++	    if (bits_left < 16)
++	      bits = bits_left;
++	    bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++	    cachesz   += bits;
++	    bits_left -= bits;
+ 	  }
++	  if (cachesz - fakebits < linbits)
++	    return MAD_ERROR_BADHUFFDATA;
+ 
+ 	  value += MASK(bitcache, cachesz, linbits);
+ 	  cachesz -= linbits;
+@@ -1109,6 +1169,8 @@ enum mad_error III_huffdecode(struct mad
+ 	  }
+ 
+ 	y_final:
++	  if (cachesz - fakebits < 1)
++	    return MAD_ERROR_BADHUFFDATA;
+ 	  xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
+ 	    -requantized : requantized;
+ 	}
+@@ -1128,6 +1190,8 @@ enum mad_error III_huffdecode(struct mad
+ 	    requantized = reqcache[value] = III_requantize(value, exp);
+ 	  }
+ 
++	  if (cachesz - fakebits < 1)
++	    return MAD_ERROR_BADHUFFDATA;
+ 	  xrptr[0] = MASK1BIT(bitcache, cachesz--) ?
+ 	    -requantized : requantized;
+ 	}
+@@ -1146,6 +1210,8 @@ enum mad_error III_huffdecode(struct mad
+ 	    requantized = reqcache[value] = III_requantize(value, exp);
+ 	  }
+ 
++	  if (cachesz - fakebits < 1)
++	    return MAD_ERROR_BADHUFFDATA;
+ 	  xrptr[1] = MASK1BIT(bitcache, cachesz--) ?
+ 	    -requantized : requantized;
+ 	}
+@@ -1155,9 +1221,6 @@ enum mad_error III_huffdecode(struct mad
+     }
+   }
+ 
+-  if (cachesz + bits_left < 0)
+-    return MAD_ERROR_BADHUFFDATA;  /* big_values overrun */
+-
+   /* count1 */
+   {
+     union huffquad const *table;
+@@ -1167,15 +1230,24 @@ enum mad_error III_huffdecode(struct mad
+ 
+     requantized = III_requantize(1, exp);
+ 
+-    while (cachesz + bits_left > 0 && xrptr <= &xr[572]) {
++    while (cachesz + bits_left - fakebits > 0 && xrptr <= &xr[572]) {
+       union huffquad const *quad;
+ 
+       /* hcod (1..6) */
+ 
+       if (cachesz < 10) {
+-	bitcache   = (bitcache << 16) | mad_bit_read(&peek, 16);
+-	cachesz   += 16;
+-	bits_left -= 16;
++	unsigned int bits = 16;
++	if (bits_left < 16)
++	  bits = bits_left;
++	bitcache   = (bitcache << bits) | mad_bit_read(&peek, bits);
++	cachesz   += bits;
++	bits_left -= bits;
++      }
++      if (cachesz < 10) {
++	unsigned int bits = 10 - cachesz;
++	bitcache <<= bits;
++	cachesz += bits;
++	fakebits += bits;
+       }
+ 
+       quad = &table[MASK(bitcache, cachesz, 4)];
+@@ -1188,6 +1260,11 @@ enum mad_error III_huffdecode(struct mad
+ 		      MASK(bitcache, cachesz, quad->ptr.bits)];
+       }
+ 
++      if (cachesz - fakebits < quad->value.hlen + quad->value.v
++        + quad->value.w + quad->value.x + quad->value.y)
++	/* We don't have enough bits to read one more entry, consider them
++	 * stuffing bits. */
++	break;
+       cachesz -= quad->value.hlen;
+ 
+       if (xrptr == sfbound) {
+@@ -1236,22 +1313,8 @@ enum mad_error III_huffdecode(struct mad
+ 
+       xrptr += 2;
+     }
+-
+-    if (cachesz + bits_left < 0) {
+-# if 0 && defined(DEBUG)
+-      fprintf(stderr, "huffman count1 overrun (%d bits)\n",
+-	      -(cachesz + bits_left));
+-# endif
+-
+-      /* technically the bitstream is misformatted, but apparently
+-	 some encoders are just a bit sloppy with stuffing bits */
+-
+-      xrptr -= 4;
+-    }
+   }
+ 
+-  assert(-bits_left <= MAD_BUFFER_GUARD * CHAR_BIT);
+-
+ # if 0 && defined(DEBUG)
+   if (bits_left < 0)
+     fprintf(stderr, "read %d bits too many\n", -bits_left);
+@@ -2348,10 +2411,11 @@ void III_freqinver(mad_fixed_t sample[18
+  */
+ static
+ enum mad_error III_decode(struct mad_bitptr *ptr, struct mad_frame *frame,
+-			  struct sideinfo *si, unsigned int nch)
++			  struct sideinfo *si, unsigned int nch, unsigned int md_len)
+ {
+   struct mad_header *header = &frame->header;
+   unsigned int sfreqi, ngr, gr;
++  int bits_left = md_len * CHAR_BIT;
+ 
+   {
+     unsigned int sfreq;
+@@ -2383,6 +2447,7 @@ enum mad_error III_decode(struct mad_bit
+     for (ch = 0; ch < nch; ++ch) {
+       struct channel *channel = &granule->ch[ch];
+       unsigned int part2_length;
++      unsigned int part3_length;
+ 
+       sfbwidth[ch] = sfbwidth_table[sfreqi].l;
+       if (channel->block_type == 2) {
+@@ -2391,18 +2456,30 @@ enum mad_error III_decode(struct mad_bit
+       }
+ 
+       if (header->flags & MAD_FLAG_LSF_EXT) {
+-	part2_length = III_scalefactors_lsf(ptr, channel,
++	error = III_scalefactors_lsf(ptr, channel,
+ 					    ch == 0 ? 0 : &si->gr[1].ch[1],
+-					    header->mode_extension);
++					    header->mode_extension, bits_left, &part2_length);
+       }
+       else {
+-	part2_length = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
+-					gr == 0 ? 0 : si->scfsi[ch]);
++	error = III_scalefactors(ptr, channel, &si->gr[0].ch[ch],
++					gr == 0 ? 0 : si->scfsi[ch], bits_left, &part2_length);
+       }
++      if (error)
++        return error;
++
++      bits_left -= part2_length;
+ 
+-      error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part2_length);
++      if (part2_length > channel->part2_3_length)
++        return MAD_ERROR_BADPART3LEN;
++
++      part3_length = channel->part2_3_length - part2_length;
++      if (part3_length > bits_left)
++        return MAD_ERROR_BADPART3LEN;
++
++      error = III_huffdecode(ptr, xr[ch], channel, sfbwidth[ch], part3_length);
+       if (error)
+ 	return error;
++      bits_left -= part3_length;
+     }
+ 
+     /* joint stereo processing */
+@@ -2519,11 +2596,13 @@ int mad_layer_III(struct mad_stream *str
+   unsigned int nch, priv_bitlen, next_md_begin = 0;
+   unsigned int si_len, data_bitlen, md_len;
+   unsigned int frame_space, frame_used, frame_free;
+-  struct mad_bitptr ptr;
++  struct mad_bitptr ptr, bufend_ptr;
+   struct sideinfo si;
+   enum mad_error error;
+   int result = 0;
+ 
++  mad_bit_init(&bufend_ptr, stream->bufend);
++
+   /* allocate Layer III dynamic structures */
+ 
+   if (stream->main_data == 0) {
+@@ -2587,14 +2666,15 @@ int mad_layer_III(struct mad_stream *str
+     unsigned long header;
+ 
+     mad_bit_init(&peek, stream->next_frame);
++    if (mad_bit_length(&peek, &bufend_ptr) >= 57) {
++      header = mad_bit_read(&peek, 32);
++      if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
++        if (!(header & 0x00010000L))  /* protection_bit */
++	  mad_bit_skip(&peek, 16);  /* crc_check */
+ 
+-    header = mad_bit_read(&peek, 32);
+-    if ((header & 0xffe60000L) /* syncword | layer */ == 0xffe20000L) {
+-      if (!(header & 0x00010000L))  /* protection_bit */
+-	mad_bit_skip(&peek, 16);  /* crc_check */
+-
+-      next_md_begin =
+-	mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
++        next_md_begin =
++	  mad_bit_read(&peek, (header & 0x00080000L) /* ID */ ? 9 : 8);
++      }
+     }
+ 
+     mad_bit_finish(&peek);
+@@ -2653,7 +2733,7 @@ int mad_layer_III(struct mad_stream *str
+   /* decode main_data */
+ 
+   if (result == 0) {
+-    error = III_decode(&ptr, frame, &si, nch);
++    error = III_decode(&ptr, frame, &si, nch, md_len);
+     if (error) {
+       stream->error = error;
+       result = -1;
diff --git a/gnu/packages/patches/libmad-md_size.patch b/gnu/packages/patches/libmad-md_size.patch
new file mode 100644
index 0000000000..0eb6844a2a
--- /dev/null
+++ b/gnu/packages/patches/libmad-md_size.patch
@@ -0,0 +1,60 @@
+Copied from Debian.
+
+From: Kurt Roeckx <kurt@roeckx.be>
+Date: Sun, 28 Jan 2018 15:44:08 +0100
+Subject: Check the size of the main data
+
+The main data to decode a frame can come from the current frame and part of the
+previous frame, the so called bit reservoir. si.main_data_begin is the part of
+the previous frame we need for this frame. frame_space is the amount of main
+data that can be in this frame, and next_md_begin is the part of this frame that
+is going to be used for the next frame.
+
+The maximum amount of data from a previous frame that the format allows is 511
+bytes. The maximum frame size for the defined bitrates is at MPEG 2.5 layer 2
+at 320 kbit/s and 8 kHz sample rate which gives 72 * (320000 / 8000) + 1 = 2881.
+So those defines are not large enough:
+ # define MAD_BUFFER_GUARD      8
+ # define MAD_BUFFER_MDLEN      (511 + 2048 + MAD_BUFFER_GUARD)
+
+There is also support for a "free" bitrate which allows you to create any frame
+size, which can be larger than the buffer.
+
+Changing the defines is not an option since it's part of the ABI, so we check
+that the main data fits in the bufer.
+
+The previous frame data is stored in *stream->main_data and contains
+stream->md_len bytes. If stream->md_len is larger than the data we
+need from the previous frame (si.main_data_begin) it still wouldn't fit
+in the buffer, so just keep the data that we need.
+
+Index: libmad-0.15.1b/layer3.c
+===================================================================
+--- libmad-0.15.1b.orig/layer3.c
++++ libmad-0.15.1b/layer3.c
+@@ -2608,6 +2608,11 @@ int mad_layer_III(struct mad_stream *str
+     next_md_begin = 0;
+ 
+   md_len = si.main_data_begin + frame_space - next_md_begin;
++  if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN) {
++    stream->error = MAD_ERROR_LOSTSYNC;
++    stream->sync = 0;
++    return -1;
++  }
+ 
+   frame_used = 0;
+ 
+@@ -2625,8 +2630,11 @@ int mad_layer_III(struct mad_stream *str
+       }
+     }
+     else {
+-      mad_bit_init(&ptr,
+-		   *stream->main_data + stream->md_len - si.main_data_begin);
++      memmove(stream->main_data,
++	*stream->main_data + stream->md_len - si.main_data_begin,
++	si.main_data_begin);
++      stream->md_len = si.main_data_begin;
++      mad_bit_init(&ptr, *stream->main_data);
+ 
+       if (md_len > si.main_data_begin) {
+ 	assert(stream->md_len + md_len -
diff --git a/gnu/packages/patches/pcre2-fix-jit_match-crash.patch b/gnu/packages/patches/pcre2-fix-jit_match-crash.patch
new file mode 100644
index 0000000000..7543319ee9
--- /dev/null
+++ b/gnu/packages/patches/pcre2-fix-jit_match-crash.patch
@@ -0,0 +1,25 @@
+From: Tobias Geerinckx-Rice <me@tobias.gr>
+Date: Thu, 01 Aug 2019 21:12:52 +0200
+Subject: [PATCH] gnu: pcre2: Fix jit_match crash.
+
+Fixes <https://bugs.exim.org/show_bug.cgi?id=2421>, reported as a ‘secrity
+problem’.
+
+Copied verbatim from upstream[0].
+
+[0]: https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_jit_compile.c?view=patch&r1=1089&r2=1092&pathrev=1092
+
+--- trunk/src/pcre2_jit_compile.c	2019/05/10 13:15:20	1089
++++ trunk/src/pcre2_jit_compile.c	2019/05/13 16:38:18	1092
+@@ -8571,7 +8571,10 @@
+ PCRE2_SPTR bptr;
+ uint32_t c;
+ 
+-GETCHARINC(c, cc);
++/* Patch by PH */
++/* GETCHARINC(c, cc); */
++
++c = *cc++;
+ #if PCRE2_CODE_UNIT_WIDTH == 32
+ if (c >= 0x110000)
+   return NULL;
diff --git a/gnu/packages/patches/strace-ipc-tests.patch b/gnu/packages/patches/strace-ipc-tests.patch
new file mode 100644
index 0000000000..49341765ca
--- /dev/null
+++ b/gnu/packages/patches/strace-ipc-tests.patch
@@ -0,0 +1,30 @@
+Fix a test failure on some systems.
+
+Taken from upstream:
+https://github.com/strace/strace/commit/4377e3a1535a0ec3a42da8a1366ad6943f4efa0e
+
+diff --git a/tests/gen_tests.in b/tests/gen_tests.in
+index 4a506b94c..4fdf4722c 100644
+--- a/tests/gen_tests.in
++++ b/tests/gen_tests.in
+@@ -168,16 +168,16 @@ ipc_msg-Xabbrev	+ipc.sh -Xabbrev -a26
+ ipc_msg-Xraw	+ipc.sh -Xraw -a16
+ ipc_msg-Xverbose	+ipc.sh -Xverbose -a34
+ ipc_msgbuf-Xabbrev	+ipc_msgbuf.test -Xabbrev
+-ipc_msgbuf-Xraw	+ipc_msgbuf.test -Xraw -a22
++ipc_msgbuf-Xraw	+ipc_msgbuf.test -Xraw -a20
+ ipc_msgbuf-Xverbose	+ipc_msgbuf.test -Xverbose
+ ipc_sem	+ipc.sh -a29
+ ipc_sem-Xabbrev	+ipc.sh -Xabbrev -a29
+ ipc_sem-Xraw	+ipc.sh -Xraw -a19
+ ipc_sem-Xverbose	+ipc.sh -Xverbose -a36
+-ipc_shm	+ipc.sh -a29
+-ipc_shm-Xabbrev	+ipc.sh -Xabbrev -a29
++ipc_shm	+ipc.sh -a26
++ipc_shm-Xabbrev	+ipc.sh -Xabbrev -a26
+ ipc_shm-Xraw	+ipc.sh -Xraw -a19
+-ipc_shm-Xverbose	+ipc.sh -Xverbose -a36
++ipc_shm-Xverbose	+ipc.sh -Xverbose -a34
+ kcmp	-a22
+ kcmp-y	-a22 -y -e trace=kcmp
+ kern_features -a16
diff --git a/gnu/packages/pcre.scm b/gnu/packages/pcre.scm
index 1395a3ea40..7385c78b9f 100644
--- a/gnu/packages/pcre.scm
+++ b/gnu/packages/pcre.scm
@@ -89,6 +89,7 @@ POSIX regular expression API.")
 (define-public pcre2
   (package
     (name "pcre2")
+    (replacement pcre2/fixed)
     (version "10.33")
     (source (origin
               (method url-fetch)
@@ -125,3 +126,14 @@ own native API, as well as a set of wrapper functions that correspond to the
 POSIX regular expression API.")
    (license license:bsd-3)
    (home-page "https://www.pcre.org/")))
+
+(define-public pcre2/fixed
+  ;; PHP >= 7.3.8 requires a fixed version at build time, so make it public
+  ;; and hide it in the UI.
+  (package
+    (inherit pcre2)
+    (source
+     (origin
+       (inherit (package-source pcre2))
+       (patches (search-patches "pcre2-fix-jit_match-crash.patch"))))
+    (properties '((hidden? . #t)))))
diff --git a/gnu/packages/php.scm b/gnu/packages/php.scm
index 62444308db..2411de55c9 100644
--- a/gnu/packages/php.scm
+++ b/gnu/packages/php.scm
@@ -58,15 +58,15 @@
 (define-public php
   (package
     (name "php")
-    (version "7.3.6")
+    (version "7.3.8")
     (home-page "https://secure.php.net/")
     (source (origin
               (method url-fetch)
               (uri (string-append home-page "distributions/"
-                                  name "-" version ".tar.xz"))
+                                  "php-" version ".tar.xz"))
               (sha256
                (base32
-                "0r51aiff2abbr3d2swhvja0wm56sjxzqbciabcvvq3m3v9kqkz7y"))
+                "19fm990yl97fq538lkp0m1imbp30qrx7785x211w1n15wqm6n17n"))
               (modules '((guix build utils)))
               (snippet
                '(with-directory-excursion "ext"
@@ -76,7 +76,7 @@
                             ;;"mbstring/libmbfl"
                             ;;"date/lib"
                             ;;"bcmath/libbcmath"
-                            ;;"fileinfo/libmagic" ; This is a patched version of libmagic.
+                            ;;"fileinfo/libmagic" ; a patched version of libmagic
                             '("gd/libgd"
                               "mbstring/oniguruma"
                               "pcre/pcre2lib"
@@ -367,7 +367,7 @@
        ("oniguruma" ,oniguruma-5)
        ("openldap" ,openldap)
        ("openssl" ,openssl)
-       ("pcre" ,pcre2)
+       ("pcre" ,pcre2/fixed)            ; must be /fixed for tests
        ("postgresql" ,postgresql)
        ("readline" ,readline)
        ("sqlite" ,sqlite)
@@ -378,7 +378,7 @@
      `(("pkg-config" ,pkg-config)
        ("bison" ,bison)
        ("intltool" ,intltool)
-       ("procps" ,procps)))         ; For tests.
+       ("procps" ,procps)))             ; for tests
     (synopsis "PHP programming language")
     (description
       "PHP (PHP Hypertext Processor) is a server-side (CGI) scripting
diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scm
index ca3e3b642b..b937eef63a 100644
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@@ -10942,25 +10942,36 @@ command @command{natsort} that exposes this functionality in the command line.")
 (define-public python-glances
   (package
   (name "python-glances")
-  (version "3.0.2")
+  (version "3.1.1")
   (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "Glances" version))
       (sha256
         (base32
-          "09fxysfp1n16csqvzvawy74qm6a94nvwjf3vcf5gkqp4i6k4vjjy"))))
+          "07j1ggzsqiskyz1i4mrnyr9i95v0dqi0i0hibnv1l188km8shmi8"))
+      (modules '((guix build utils)))
+      (snippet
+       '(begin
+          ;; Glances phones PyPI for weekly update checks by default.
+          ;; Disable these.  The user can re-enable them if desired.
+          (substitute* "glances/outdated.py"
+            (("^(.*)self\\.load_config\\(config\\)\n" line indentation)
+             (string-append indentation
+                            "self.args.disable_check_update = True\n"
+                            line)))
+          #t))))
   (build-system python-build-system)
   (propagated-inputs
-   `(("python-psutil" ,python-psutil)))
+   `(("python-future" ,python-future)
+     ("python-psutil" ,python-psutil)))
   (home-page
     "https://github.com/nicolargo/glances")
-  (synopsis
-    "A cross-platform curses-based monitoring tool")
+  (synopsis "Cross-platform curses-based monitoring tool")
   (description
     "Glances is a curses-based monitoring tool for a wide variety of platforms.
-Glances uses the PsUtil library to get information from your system. It monitors
-CPU, load, memory, network bandwidth, disk I/O, disk use, and more.")
+Glances uses the PsUtil library to get information from your system.  It
+monitors CPU, load, memory, network bandwidth, disk I/O, disk use, and more.")
   (license license:lgpl3+)))
 
 (define-public python2-glances
diff --git a/gnu/packages/regex.scm b/gnu/packages/regex.scm
index 71dac09737..ad01814318 100644
--- a/gnu/packages/regex.scm
+++ b/gnu/packages/regex.scm
@@ -30,7 +30,7 @@
 (define-public re2
    (package
      (name "re2")
-     (version "2019-07-01")
+     (version "2019-08-01")
      (home-page "https://github.com/google/re2")
      (source (origin
                (method git-fetch)
@@ -38,7 +38,7 @@
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                 "1ric6gdnf5mqj5iy5f81al49mr3mmjqj3nqi3mw2hjdbbgwkdn71"))))
+                 "11w9x16y26nfgliis28ivrh9b1x6pxawdwxfwxfjh34h57c0dkzg"))))
      (build-system gnu-build-system)
      (arguments
       `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index 812a36ca9a..da4f251ab6 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -153,14 +153,14 @@ anywhere.")
 (define-public samba
   (package
     (name "samba")
-    (version "4.10.5")
+    (version "4.10.6")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.samba.org/pub/samba/stable/"
                                  "samba-" version ".tar.gz"))
              (sha256
               (base32
-               "0xb3mz38hcayqxchk0ws9mxn10vswsn97jbxl4gcwi4cbrnjc43c"))))
+               "0hpgdqlyczj98pkh2ldglvvnkrb1q541r3qikdvxq0qjvd9fpywy"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/scanner.scm b/gnu/packages/scanner.scm
index d23da9e502..b371cf3105 100644
--- a/gnu/packages/scanner.scm
+++ b/gnu/packages/scanner.scm
@@ -34,15 +34,16 @@
 (define-public sane-backends-minimal
   (package
     (name "sane-backends-minimal")
-    (version "1.0.27")
+    (version "1.0.28")
     (source (origin
              (method url-fetch)
              (uri (string-append
-                   "https://alioth.debian.org/frs/download.php/latestfile/176/"
+                   "https://gitlab.com/sane-project/backends/uploads/"
+                   "9e718daff347826f4cfe21126c8d5091/"
                    "sane-backends-" version ".tar.gz"))
              (sha256
               (base32
-               "1j9nbqspaj0rlgalafb5z6r606k0i22kz0rcpd744p176yzlfdr9"))
+               "00yy8q9hqdf0zjxxl4d8njr9zf0hhi3a9ib23ikc2anqf8zhy9ii"))
              (modules '((guix build utils)))
              (snippet
               ;; Generated HTML files and udev rules normally embed a
@@ -63,6 +64,10 @@
          (add-before 'configure 'disable-backends
            (lambda _
              (setenv "BACKENDS" " ")
+
+             ;; Disable tests that may require back ends to be built.
+             (substitute* "testsuite/Makefile.in"
+               ((" backend ") " "))
              #t))
          (add-after 'unpack 'disable-failing-tests
            (lambda _
@@ -113,6 +118,7 @@ package contains the library, but no drivers.")
     (name "sane-backends")
     (inputs
      `(("hplip" ,(@ (gnu packages cups) hplip-minimal))
+       ("libjpeg" ,libjpeg)             ; wanted by pixma, epsonds, others
        ("libpng" ,libpng)               ; support ‘scanimage --format=png’
        ,@(package-inputs sane-backends-minimal)))
     (arguments
diff --git a/gnu/packages/sdl.scm b/gnu/packages/sdl.scm
index b6b28b7d06..cb5b5839df 100644
--- a/gnu/packages/sdl.scm
+++ b/gnu/packages/sdl.scm
@@ -107,7 +107,7 @@ joystick, and graphics hardware.")
 (define-public sdl2
   (package (inherit sdl)
     (name "sdl2")
-    (version "2.0.9")
+    (version "2.0.10")
     (source (origin
              (method url-fetch)
              (uri
@@ -115,7 +115,7 @@ joystick, and graphics hardware.")
                              version ".tar.gz"))
              (sha256
               (base32
-               "1c94ndagzkdfqaa838yqg589p1nnqln8mv0hpwfhrkbfczf8cl95"))))
+               "0mqxp6w5jhbq6y1j690g9r3gpzwjxh4czaglw8x05l7hl49nqrdl"))))
     (arguments
      (substitute-keyword-arguments (package-arguments sdl)
        ((#:configure-flags flags)
diff --git a/gnu/packages/shells.scm b/gnu/packages/shells.scm
index 1900925022..0579c167fc 100644
--- a/gnu/packages/shells.scm
+++ b/gnu/packages/shells.scm
@@ -709,18 +709,17 @@ interactive POSIX shell targeted at resource-constrained systems.")
 (define-public mksh
   (package
     (name "mksh")
-    (version "56")
+    (version "57")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://www.mirbsd.org/MirOS/dist/mir/mksh/mksh-R"
                            version ".tgz"))
        (sha256
-        (base32
-         "1x4zjj9259ijpf8jw0nyh1fnr1pbm5fwvylclpvcrlb45xrglf5d"))))
+        (base32 "0xdykm1z710wriwd6nc8s8lwk2dwjl63dq96xxaawlid31a1241x"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:tests? #f ; tests require access to /dev/tty
+     `(#:tests? #f                      ; tests require access to /dev/tty
        #:phases
        (modify-phases %standard-phases
          (delete 'configure)
@@ -744,7 +743,7 @@ interactive POSIX shell targeted at resource-constrained systems.")
 Korn Shell programming language and a successor to the Public Domain Korn
 Shell (pdksh).")
     (license (list miros
-                   isc)))) ; strlcpy.c
+                   isc))))              ; strlcpy.c
 
 (define-public oil-shell
   (package
diff --git a/gnu/packages/spice.scm b/gnu/packages/spice.scm
index 1e9dfadf02..4787f107f0 100644
--- a/gnu/packages/spice.scm
+++ b/gnu/packages/spice.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016 David Craven <david@craven.ch>
-;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Rutger Helling <rhelling@mykolab.com>
 ;;; Copyright © 2019 Marius Bakke <mbakke@fastmail.com>
 ;;;
@@ -115,23 +115,10 @@ which allows users to view a desktop computing environment.")
     (home-page "https://www.spice-space.org")
     (license (list license:bsd-3 license:lgpl2.1+))))
 
-(define-public spice-protocol-0.12
-  (package
-    (inherit spice-protocol)
-    (version "0.12.15")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://www.spice-space.org/download/releases/"
-                    "spice-protocol-" version ".tar.bz2"))
-              (sha256
-               (base32
-                "06b461i4jv741in8617jjpfk28wk7zs9p7841njkf4sbm8xv4kcb"))))))
-
 (define-public spice-gtk
   (package
     (name "spice-gtk")
-    (version "0.36")
+    (version "0.37")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -139,7 +126,7 @@ which allows users to view a desktop computing environment.")
                 "spice-gtk-" version ".tar.bz2"))
               (sha256
                (base32
-                "1kfpixfdmxs9wn3id48gc9bvfrgxz935y3wpykf40bgi9mcc69ki"))))
+                "1drvj8y35gnxbnrxsipwi15yh0vs9ixzv4wslz6r3lra8w3bfa0z"))))
     (build-system gnu-build-system)
     (propagated-inputs
       `(("gstreamer" ,gstreamer)
@@ -148,7 +135,7 @@ which allows users to view a desktop computing environment.")
         ("gst-plugins-good" ,gst-plugins-good)
         ("gst-plugins-bad" ,gst-plugins-bad)
         ("gst-plugins-ugly" ,gst-plugins-ugly)
-        ("spice-protocol" ,spice-protocol-0.12)
+        ("spice-protocol" ,spice-protocol)
 
         ;; These are required by the pkg-config files.
         ("gtk+" ,gtk+)
diff --git a/gnu/packages/syncthing.scm b/gnu/packages/syncthing.scm
index cd3dd0de54..c35ee8639c 100644
--- a/gnu/packages/syncthing.scm
+++ b/gnu/packages/syncthing.scm
@@ -30,7 +30,7 @@
 (define-public syncthing
   (package
     (name "syncthing")
-    (version "1.1.4")
+    (version "1.2.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/syncthing/syncthing"
@@ -38,7 +38,7 @@
                                   "/syncthing-source-v" version ".tar.gz"))
               (sha256
                (base32
-                "0pkb9vdb10lnlk6sgg6hxgkdjnvxx90cfdf8vgrc5sljzm5qhr6l"))
+                "1l7crhggg2vq4y7pgzsj8wp7k4l9hw5yblflly5bzwywzxz8ff83"))
               (modules '((guix build utils)))
               ;; Delete bundled ("vendored") free software source code.
               (snippet '(begin
@@ -102,10 +102,14 @@
        ("go-github-com-vitrun-qart-coding" ,go-github-com-vitrun-qart-coding)
        ("go-github-com-vitrun-qart-gf256" ,go-github-com-vitrun-qart-gf256)
        ("go-github-com-mattn-go-isatty" ,go-github-com-mattn-go-isatty)
-       ("go-golang-org-x-crypto-bcrypt" ,go-golang-org-x-crypto-bcrypt)
-       ("go-golang-org-x-crypto-blowfish" ,go-golang-org-x-crypto-blowfish)
+       ("go-golang-org-x-crypto" ,go-golang-org-x-crypto)
        ("go-github-com-flynn-archive-go-shlex"
         ,go-github-com-flynn-archive-go-shlex)
+       ("go-github-com-getsentry-raven-go" ,go-github-com-getsentry-raven-go)
+       ("go-github-com-maruel-panicparse" ,go-github-com-maruel-panicparse)
+       ("go-github-com-ccding-go-stun" ,go-github-com-ccding-go-stun)
+       ("go-github-com-audriusbutkevicius-pfilter" ,go-github-com-audriusbutkevicius-pfilter)
+       ("go-github-com-lucas-clemente-quic-go" ,go-github-com-lucas-clemente-quic-go)
 
        ;; For tests
        ("go-github-com-d4l3k-messagediff" ,go-github-com-d4l3k-messagediff)))
@@ -569,11 +573,11 @@ run-time in Go.")
     (license asl2.0)))
 
 (define-public go-github-com-syndtr-goleveldb
-  (let ((commit "34011bf325bce385408353a30b101fe5e923eb6e")
-        (revision "2"))
+  (let ((commit "c3a204f8e96543bb0cc090385c001078f184fc46")
+        (revision "3"))
     (package
       (name "go-github-com-syndtr-goleveldb")
-      (version (git-version "0.0.0" revision commit))
+      (version (git-version "1.0.1" revision commit))
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
@@ -582,7 +586,7 @@ run-time in Go.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "097ja0vyj6p27zrxha9nhk09fj977xsvhmd3bk2hbyvnbw4znnhd"))))
+                  "18cac90dim2z5g28vazzibxa058q2ynihsmf0vbscwzba6l5s5ms"))))
       (build-system go-build-system)
       (propagated-inputs
        `(("go-github-com-golang-snappy" ,go-github-com-golang-snappy)))
@@ -739,28 +743,6 @@ hashes.")
       (home-page "https://github.com/chmduquesne/rollinghash")
       (license expat))))
 
-(define-public go-github-com-pkg-errors
-  (package
-    (name "go-github-com-pkg-errors")
-    (version "0.8.1")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/pkg/errors.git")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "0g5qcb4d4fd96midz0zdk8b9kz8xkzwfa8kr1cliqbg8sxsy5vd1"))))
-    (build-system go-build-system)
-    (arguments
-     `(#:import-path "github.com/pkg/errors"))
-    (synopsis "Go error handling primitives")
-    (description "This package provides @code{error}, which offers simple
-error handling primitives in Go.")
-    (home-page "https://github.com/pkg/errors")
-    (license bsd-2)))
-
 (define-public go-github-com-petermattis-goid
   (let ((commit "3db12ebb2a599ba4a96bea1c17b61c2f78a40e02")
         (revision "0"))
@@ -863,20 +845,18 @@ bounds.")
       (license expat))))
 
 (define-public go-github-com-golang-protobuf-proto
-  (let ((commit "1e59b77b52bf8e4b449a57e6f79f21226d571845")
-        (revision "0"))
     (package
       (name "go-github-com-golang-protobuf-proto")
-      (version (git-version "0.0.0" revision commit))
+      (version "1.3.1")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
                        (url "https://github.com/golang/protobuf.git")
-                       (commit commit)))
+                       (commit (string-append "v" version))))
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "19bkh81wnp6njg3931wky6hsnnl2d1ig20vfjxpv450sd3k6yys8"))))
+                  "15am4s4646qy6iv0g3kkqq52rzykqjhm4bf08dk0fy2r58knpsyl"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/golang/protobuf/proto"
@@ -887,11 +867,11 @@ bounds.")
       (description "This package provides Go support for the Protocol Buffers
 data serialization format.")
       (home-page "https://github.com/golang/protobuf")
-      (license bsd-3))))
+      (license bsd-3)))
 
 (define-public go-github-com-prometheus-client-model-go
-  (let ((commit "99fa1f4be8e564e8a6b613da7fa6f46c9edafc6c")
-        (revision "0"))
+  (let ((commit "fd36f4220a901265f90734c3183c5f0c91daa0b8")
+        (revision "1"))
     (package
       (name "go-github-com-prometheus-client-model-go")
       (version (git-version "0.0.2" revision commit))
@@ -903,7 +883,7 @@ data serialization format.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "19y4ywsivhpxj7ikf2j0gm9k3cmyw37qcbfi78n526jxcc7kw998"))))
+                  "1bs5d72k361llflgl94c22n0w53j30rsfh84smgk8mbjbcmjsaa5"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/prometheus/client_model/go"
@@ -948,20 +928,18 @@ message streaming.")
       (license asl2.0))))
 
 (define-public go-github-com-prometheus-common-expfmt
-  (let ((commit "2e54d0b93cba2fd133edc32211dcc32c06ef72ca")
-        (revision "0"))
     (package
       (name "go-github-com-prometheus-common-expfmt")
-      (version (git-version "0.0.0" revision commit))
+      (version "0.4.1")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
                        (url "https://github.com/prometheus/common.git")
-                       (commit commit)))
+                       (commit (string-append "v" version))))
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "14kn5w7imcxxlfdqxl21fsnlf1ms7200g3ldy29hwamldv8qlm7j"))))
+                  "0sf4sjdckblz1hqdfvripk3zyp8xq89w7q75kbsyg4c078af896s"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/prometheus/common/expfmt"
@@ -995,23 +973,21 @@ message streaming.")
       (description "This package provides tools for reading and writing
 Prometheus metrics.")
       (home-page "https://github.com/prometheus/common")
-      (license asl2.0))))
+      (license asl2.0)))
 
 (define-public go-github-com-prometheus-common-model
-  (let ((commit "2e54d0b93cba2fd133edc32211dcc32c06ef72ca")
-        (revision "0"))
     (package
       (name "go-github-com-prometheus-common-model")
-      (version (git-version "0.0.0" revision commit))
+      (version "0.4.1")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
                        (url "https://github.com/prometheus/common.git")
-                       (commit commit)))
+                       (commit (string-append "v" version))))
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "14kn5w7imcxxlfdqxl21fsnlf1ms7200g3ldy29hwamldv8qlm7j"))))
+                  "0sf4sjdckblz1hqdfvripk3zyp8xq89w7q75kbsyg4c078af896s"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/prometheus/common/model"
@@ -1020,36 +996,37 @@ Prometheus metrics.")
       (description "This package provides a component of the Go Prometheus
 implementation.")
       (home-page "https://github.com/prometheus/common")
-      (license asl2.0))))
+      (license asl2.0)))
 
 (define-public go-github-com-prometheus-procfs
-  (let ((commit "b15cd069a83443be3154b719d0cc9fe8117f09fb")
-        (revision "0"))
     (package
       (name "go-github-com-prometheus-procfs")
-      (version (git-version "0.0.0" revision commit))
+      (version "0.0.3")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
                        (url "https://github.com/prometheus/procfs.git")
-                       (commit commit)))
+                       (commit (string-append "v" version))))
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "1cr45wg2m40bj2za8f32mq09rjlcnk5kfam0h0hr8wcb015k4wxj"))))
+                  "18c4m795fwng8f8qa395f3crvamlbk5y5afk8b5rzyisnmjq774y"))))
       (build-system go-build-system)
       (arguments
-       '(#:import-path "github.com/prometheus/procfs"))
+       '(#:import-path "github.com/prometheus/procfs"
+         ;; The tests require Go modules, which are not yet supported in Guix's
+         ;; Go build system.
+         #:tests? #f))
       (synopsis "Go library for reading @file{/proc}")
       (description "The @code{procfs} Go package provides functions to retrieve
 system, kernel, and process metrics from the @file{/proc} pseudo file system.")
       (home-page "https://github.com/prometheus/procfs")
-      (license asl2.0))))
+      (license asl2.0)))
 
 (define-public go-github-com-client-golang-prometheus-promhttp
     (package
       (name "go-github-com-client-golang-prometheus-promhttp")
-      (version "0.9.2")
+      (version "0.9.4")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
@@ -1058,7 +1035,7 @@ system, kernel, and process metrics from the @file{/proc} pseudo file system.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "02b4yg6rfag0m3j0i39sillcm5xczwv8h133vn12yr8qw04cnigs"))))
+                  "0s134fj4i7k6pxdmxwkdi7amb1882yq33spv15hg3pkpbd3h311p"))))
       (build-system go-build-system)
       (arguments
        '(#:tests? #f ; The tests require internet access
@@ -1087,7 +1064,7 @@ server tools for Prometheus metrics.")
 (define-public go-github-com-prometheus-client-golang-prometheus
     (package
       (name "go-github-com-prometheus-client-golang-prometheus")
-      (version "0.9.2")
+      (version "0.9.4")
       (source (origin
                 (method git-fetch)
                 (uri (git-reference
@@ -1096,7 +1073,7 @@ server tools for Prometheus metrics.")
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "02b4yg6rfag0m3j0i39sillcm5xczwv8h133vn12yr8qw04cnigs"))))
+                  "0s134fj4i7k6pxdmxwkdi7amb1882yq33spv15hg3pkpbd3h311p"))))
       (build-system go-build-system)
       (arguments
        '(#:import-path "github.com/prometheus/client_golang/prometheus"
@@ -1204,7 +1181,7 @@ quoting, commenting, and escaping.")
 (define-public go-github-com-prometheus-common-internal-bitbucket-org-ww-goautoneg
   (package
     (name "go-github-com-prometheus-common-internal-bitbucket-org-ww-goautoneg")
-    (version "0.2.0")
+    (version "0.4.1")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -1213,7 +1190,7 @@ quoting, commenting, and escaping.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "02kym6lcfnlq23qbv277jr0q1n7jj0r14gqg93c7wn7gc44jv3vp"))))
+                "0sf4sjdckblz1hqdfvripk3zyp8xq89w7q75kbsyg4c078af896s"))))
     (build-system go-build-system)
     (arguments
      '(#:import-path "github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg"
@@ -1222,3 +1199,53 @@ quoting, commenting, and escaping.")
     (description "This package is an internal component of Prometheus.")
     (home-page "https://github.com/prometheus/common")
     (license asl2.0)))
+
+(define-public go-github-com-audriusbutkevicius-pfilter
+  (let ((commit "c55ef6137fc6f075801eac099cc2687ede0f101d")
+        (revision "3"))
+    (package
+      (name "go-github-com-audriusbutkevicius-pfilter")
+      (version (git-version "0.0.0" revision commit))
+      (source
+        (origin
+          (method git-fetch)
+          (uri (git-reference
+                 (url "https://github.com/AudriusButkevicius/pfilter.git")
+                 (commit commit)))
+          (file-name (git-file-name name version))
+          (sha256
+           (base32
+            "0xzhwyd0w21bhvzl5pinn22hp0y6h44rh3s2ppql69rafc6zd3c6"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "github.com/AudriusButkevicius/pfilter"))
+      (synopsis "Filter packets into mulitple virtual connections")
+      (description "Pfilter is a Go package for filtering packets into multiple
+virtual connections from a single physical connection.")
+      (home-page "https://github.com/AudriusButkevicius/pfilter")
+      (license expat))))
+
+(define-public go-github-com-ccding-go-stun
+  (let ((commit "be486d185f3dfcb2dbf8429332da50a0da7f95a6")
+        (revision "2"))
+    (package
+      (name "go-github-com-ccding-go-stun")
+      (version (git-version "0.0.0" revision commit))
+      (source
+        (origin
+          (method git-fetch)
+          (uri (git-reference
+                 (url "https://github.com/ccding/go-stun.git")
+                 (commit commit)))
+          (file-name (git-file-name name version))
+          (sha256
+           (base32
+            "1gr0rw1c1y7wh6913lyn5k4ig023by27i36bly6am8dwgrgp34ww"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "github.com/ccding/go-stun"))
+      (synopsis "STUN client implementation")
+      (description "Go-stun is a go implementation of the STUN client (RFC 3489
+and RFC 5389).")
+      (home-page "https://github.com/ccding/go-stun")
+      (license asl2.0))))
diff --git a/gnu/packages/telephony.scm b/gnu/packages/telephony.scm
index b5c14143a8..cf37756503 100644
--- a/gnu/packages/telephony.scm
+++ b/gnu/packages/telephony.scm
@@ -847,10 +847,10 @@ This package provides a library common to all Jami clients.")
     (home-page "https://jami.net")
     (license license:gpl3+)))
 
-(define-public jami-client-gnome
+(define-public jami
   (package
     (inherit libring)
-    (name "jami-client-gnome")
+    (name "jami")
     (build-system cmake-build-system)
     (inputs
      `(("libringclient" ,libringclient)
@@ -906,3 +906,6 @@ IAX protocols, as well as decentralized calling using P2P-DHT.
 This package provides the Jami client for the GNOME desktop.")
     (home-page "https://jami.net")
     (license license:gpl3+)))
+
+(define-public jami-client-gnome
+  (deprecated-package "jami-client-gnome" jami))
diff --git a/gnu/packages/terminals.scm b/gnu/packages/terminals.scm
index 4d0e875012..df8d1e4b79 100644
--- a/gnu/packages/terminals.scm
+++ b/gnu/packages/terminals.scm
@@ -54,6 +54,7 @@
   #:use-module (gnu packages gl)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnome)
+  #:use-module (gnu packages golang)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages image)
   #:use-module (gnu packages libevent)
@@ -754,6 +755,35 @@ with terminals in Go.")
       (home-page "https://go.googlesource.com/crypto/")
       (license license:bsd-3))))
 
+(define-public go-github-com-junegunn-fzf
+  (package
+    (name "go-github-com-junegunn-fzf")
+    (version "0.18.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/junegunn/fzf")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "0pwpr4fpw56yzzkcabzzgbgwraaxmp7xzzmap7w1xsrkbj7dl2xl"))))
+    (build-system go-build-system)
+    (arguments
+     `(#:import-path "github.com/junegunn/fzf"))
+    (inputs
+     `(("go-github.com-mattn-go-runewidth" ,go-github.com-mattn-go-runewidth)
+       ("go-github-com-mattn-go-shellwords" ,go-github-com-mattn-go-shellwords)
+       ("go-github-com-mattn-go-isatty" ,go-github-com-mattn-go-isatty)
+       ("go-github-com-gdamore-tcell" ,go-github-com-gdamore-tcell)
+       ("go-golang-org-x-crypto-ssh-terminal" ,go-golang-org-x-crypto-ssh-terminal)))
+    (home-page "https://github.com/junegunn/fzf")
+    (synopsis "Command-line fuzzy-finder")
+    (description "This package provides an interactive command-line filter
+usable with any list--including files, command history, processes and more.")
+    (license license:expat)))
+
 (define-public go-github.com-howeyc-gopass
   (let ((commit "bf9dde6d0d2c004a008c27aaee91170c786f6db8")
         (revision "0"))
diff --git a/gnu/packages/text-editors.scm b/gnu/packages/text-editors.scm
index b35486ba59..4412d54579 100644
--- a/gnu/packages/text-editors.scm
+++ b/gnu/packages/text-editors.scm
@@ -8,6 +8,7 @@
 ;;; Copyright © 2017, 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2019 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2019 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -35,6 +36,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
   #:use-module (gnu packages assembly)
+  #:use-module (gnu packages autotools)
   #:use-module (gnu packages boost)
   #:use-module (gnu packages documentation)
   #:use-module (gnu packages fontutils)
@@ -50,6 +52,7 @@
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages python-xyz)
   #:use-module (gnu packages qt)
   #:use-module (gnu packages regex)
   #:use-module (gnu packages ruby)
@@ -397,15 +400,14 @@ editors.")
 (define-public texmacs
   (package
     (name "texmacs")
-    (version "1.99.9")
+    (version "1.99.11")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "https://www.texmacs.org/Download/ftp/tmftp/"
                            "source/TeXmacs-" version "-src.tar.gz"))
        (sha256
-        (base32
-         "0i95sf9y8qpgxd8f39cprbp3s200nm9lml0xdpyn46n838acvw19"))
+        (base32 "12bp0f34izzqimz49lfpgf4lyz3h45s9xbmk8v6zsawdjki76alg"))
        (modules '((guix build utils)))
        (snippet
         '(begin
@@ -421,7 +423,7 @@ editors.")
        ("python" ,python-wrapper)
        ("qt" ,qt-4)))
     (arguments
-     `(#:tests? #f ;no check target
+     `(#:tests? #f                      ; no check target
        #:phases
        (modify-phases %standard-phases
          (add-before 'configure 'gzip-flags
@@ -437,3 +439,131 @@ types of content.  It has robust support for mathematical formulas and plots.
 and Octave.  TeXmacs is completely extensible via Guile.")
     (license license:gpl3+)
     (home-page "https://www.texmacs.org/tmweb/home/welcome.en.html")))
+
+(define-public scintilla
+  (package
+    (name "scintilla")
+    (version "4.2.0")
+    (source (origin
+              (method url-fetch)
+              (uri (let ((v (apply string-append (string-split version #\.))))
+                     (string-append
+                      "https://www.scintilla.org/scintilla" v ".tgz")))
+              (sha256
+               (base32
+                "02ymi86fpcypg6423vfr54lbkxbks046q02v3m3dypawcf3bqy42"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list "GTK3=1" "CC=gcc" "-Cgtk")
+       #:tests? #f                      ;require un-packaged Pyside
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)            ;no configure script
+         (add-after 'unpack 'build-shared-library
+           (lambda _
+             (substitute* "gtk/makefile"
+               (("scintilla\\.a") "libscintilla.so")
+               (("\\$\\(AR\\) \\$\\(ARFLAGS\\) \\$@ \\$\\^")
+                "$(CC) -shared $^ -o $@")
+               (("\\$\\(RANLIB\\) \\$@") ""))
+             #t))
+         (add-before 'build 'expand-C++-include-path
+           (lambda* (#:key inputs #:allow-other-keys)
+             ;; Make <gcc>/include/c++/ext/string_conversions.h find
+             ;; <stdlib.h>.
+             (let* ((path "CPLUS_INCLUDE_PATH")
+                    (gcc  (assoc-ref inputs "gcc"))
+                    (c++  (string-append gcc "/include/c++")))
+               (setenv path (string-append c++ ":" (getenv path))))
+             #t))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (lib (string-append out "/lib"))
+                    (include (string-append out "/include")))
+               (install-file "bin/libscintilla.so" lib)
+               (for-each (lambda (f) (install-file f include))
+                         (find-files "include/" "."))
+               #t))))))
+    (native-inputs
+     `(("gcc" ,gcc-7)                   ;require GCC 7.1+
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("gtk+" ,gtk+)))
+    (home-page "https://www.scintilla.org/")
+    (synopsis "Code editor for GTK+")
+    (description "Scintilla is a source code editing component for
+GTK+.  It has the usual features found in text editing components, as
+well as some that are especially useful for editing and debugging
+source code; these include support for syntax styling, error
+indicators, code completion and call tips.  Styling choices are more
+open than with many editors: Scintilla lets you use proportional
+fonts, bold and italics, multiple foreground and background colours,
+and multiple fonts.")
+    (license license:hpnd)))
+
+(define-public geany
+  (package
+    (name "geany")
+    (version "1.35")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://download.geany.org/"
+                                  "geany-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "179xfnvhcxsv54v2mlrhykqv2j7klniln5sffvqqpjmdvwyivvim"))
+              (modules '((guix build utils)))
+              (snippet '(begin
+                          (delete-file-recursively "scintilla")
+                          #t))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("doxygen" ,doxygen)
+       ("glib" ,glib "bin")
+       ("intltool" ,intltool)
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)
+       ("python-docutils" ,python-docutils))) ;for rst2html
+    (inputs
+     `(("gtk+" ,gtk+)
+       ("scintilla" ,scintilla)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'use-scintilla-shared-library
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "configure.ac"
+               (("scintilla/Makefile") "")
+               (("scintilla/include/Makefile") ""))
+             (substitute* "Makefile.am"
+               (("scintilla ") ""))
+             (substitute* "src/Makefile.am"
+               (("\\$\\(top_builddir\\)/scintilla/libscintilla.la") "")
+               (("geany_LDFLAGS =" all) (string-append all " -lscintilla")))
+             (substitute* "doc/Makefile.am"
+               (("\\$\\(INSTALL_DATA\\) \\$\\(top_srcdir\\)/scintilla/License.txt \\$\\(DOCDIR\\)/ScintillaLicense.txt") ""))
+             (for-each delete-file (list "autogen.sh" "configure" "Makefile.in"))
+             #t)))))
+    (home-page "https://www.geany.org")
+    (synopsis "Fast and lightweight IDE")
+    (description "Geany is a small and fast Integrated Development
+Environment (IDE) that only has a few dependencies on other packages and is as
+independent as possible from special desktop environments like KDE or GNOME.
+
+The basic features of Geany are:
+@itemize
+@item syntax highlighting
+@item code completion
+@item auto completion of often constructed constructs like if, for and while
+@item auto completion of XML and HTML tags
+@item call tips
+@item folding
+@item many supported filetypes like C, Java, PHP, HTML, Python, Perl, Pascal
+@item symbol lists
+@item embedded terminal emulation
+@item extensibility through plugins
+@end itemize")
+    (license license:gpl2+)))
diff --git a/gnu/packages/textutils.scm b/gnu/packages/textutils.scm
index d1dc14e6d7..2c520dfbdf 100644
--- a/gnu/packages/textutils.scm
+++ b/gnu/packages/textutils.scm
@@ -693,27 +693,32 @@ and Cython.")
       (license license:expat))))
 
 (define-public go-github.com-mattn-go-runewidth
-  (package
-    (name "go-github.com-mattn-go-runewidth")
-    (version "0.0.2")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/mattn/go-runewidth")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "0vkrfrz3fzn5n6ix4k8s0cg0b448459sldq8bp4riavsxm932jzb"))))
-    (build-system go-build-system)
-    (arguments
-     '(#:import-path "github.com/mattn/go-runewidth"))
-    (synopsis "@code{runewidth} provides Go functions to work with string widths")
-    (description
-     "The @code{runewidth} library provides Go functions for padding,
-measuring and checking the width of strings, with support east asian text.")
-    (home-page "https://github.com/jessevdk/go-flags")
-    (license license:expat)))
+  (let ((commit "703b5e6b11ae25aeb2af9ebb5d5fdf8fa2575211")
+        (version "0.0.4")
+        (revision "1"))
+    (package
+      (name "go-github.com-mattn-go-runewidth")
+      (version (git-version version revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/mattn/runewidth")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32
+           "0znpyz71gajx3g0j2zp63nhjj2c07g16885vxv4ykwnrfmzbgk4w"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "github.com/mattn/go-runewidth"))
+      (synopsis "@code{runewidth} provides Go functions to work with string widths")
+      (description
+       "The @code{runewidth} library provides Go functions for padding,
+measuring and checking the width of strings, with support for East Asian
+text.")
+      (home-page "https://github.com/mattn/runewidth")
+      (license license:expat))))
 
 (define-public docx2txt
   (package
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index ac85b9595c..20dc69282a 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -4,7 +4,7 @@
 ;;; Copyright © 2014 Ian Denhardt <ian@zenhack.net>
 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
-;;; Copyright © 2015, 2016, 2017, 2018 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016, 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017, 2018 ng0 <ng0@n0.is>
 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
@@ -33,8 +33,10 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix utils)
   #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
   #:use-module (guix build-system perl)
   #:use-module (guix build-system python)
   #:use-module (guix build-system cmake)
@@ -951,3 +953,27 @@ coding footprint.")
 ACME-server (currently only provided by Let's Encrypt) implemented as a
 relatively simple Bash script.")
     (license license:expat)))
+
+(define-public go-github-com-certifi-gocertifi
+  (let ((commit "d2eda712971317d7dd278bc2a52acda7e945f97e")
+        (revision "0"))
+    (package
+      (name "go-github-com-certifi-gocertifi")
+      (version (git-version "2018.01.18" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                       (url "https://github.com/certifi/gocertifi")
+                       (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0f3v26xps7gadw4qfmh1kxbpgp0cgqdd61a257xnnvnd7ll6k8dh"))))
+      (build-system go-build-system)
+      (arguments
+       '(#:import-path "github.com/certifi/gocertifi"))
+      (synopsis "X.509 TLS root certificate bundle for Go")
+      (description "This package is a Go language X.509 TLS root certificate bundle,
+derived from Mozilla's collection.")
+      (home-page "https://certifi.io")
+      (license license:mpl2.0))))
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index 2854ae2228..04715a5ce1 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -473,16 +473,18 @@ and creating Matroska files from other media files (@code{mkvmerge}).")
 (define-public x265
   (package
     (name "x265")
-    (version "3.1.1")
+    (version "3.1.2")
     (outputs '("out" "static"))
     (source
       (origin
         (method url-fetch)
-        (uri (string-append "https://download.videolan.org/videolan/x265/"
-                            "x265_" version ".tar.gz"))
+        (uri (list (string-append "https://bitbucket.org/multicoreware/x265"
+                                  "/downloads/x265_" version ".tar.gz")
+                   (string-append "https://download.videolan.org/videolan/x265/"
+                                  "x265_" version ".tar.gz")))
         (sha256
          (base32
-          "1l68lgdbsi4wjz5vad98ggx7mf92rnvzlq34m6w0a08ark3h0yc2"))
+          "1ajr59gjj47gnczfb2qhmzclj746pdiq9a1d81b0mq22k8f5yy3g"))
         (patches (search-patches "x265-arm-flags.patch"))
         (modules '((guix build utils)))
         (snippet '(begin
@@ -753,6 +755,40 @@ entry-points (VLD, IDCT, Motion Compensation etc.) for prevailing coding
 standards (MPEG-2, MPEG-4 ASP/H.263, MPEG-4 AVC/H.264, and VC-1/VMW3).")
     (license license:expat)))
 
+(define-public libva-utils
+  (package
+    (name "libva-utils")
+    (version "2.5.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/intel/libva-utils/releases/download/"
+                           version "/libva-utils-" version ".tar.bz2"))
+       (sha256
+        (base32 "05rasyqnsg522zqxak1q8rrm1hys7wwbi41kd0szjq0d27awjf4j"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags
+       (list "--enable-wayland"
+             "--enable-x11")))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("libdrm" ,libdrm)
+       ("libva" ,libva)
+       ("libx11" ,libx11)
+       ("mesa" ,mesa)
+       ("wayland" ,wayland)))
+    (home-page "https://01.org/linuxmedia/vaapi")
+    (synopsis "Collection of testing utilities for VA-API")
+    (description
+     "This is a collection of utilities  to query and test the @acronym{VA-API,
+Video Acceleration API} implemented by the libva library.
+
+These tools require a supported graphics chip, driver, and VA-API back end to
+operate properly.")
+    (license license:expat)))
+
 (define-public ffmpeg
   (package
     (name "ffmpeg")
@@ -1013,7 +1049,7 @@ videoformats depend on the configuration flags of ffmpeg.")
 (define-public vlc
   (package
     (name "vlc")
-    (version "3.0.7")
+    (version "3.0.7.1")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -1022,7 +1058,7 @@ videoformats depend on the configuration flags of ffmpeg.")
                    "/vlc-" version ".tar.xz"))
              (sha256
               (base32
-               "05irswyg9acflxzy4vfyvgi643r72vsvagv118zawjqg1wagxdaw"))))
+               "1xb4c8n0hkwijzfdlbwadhxnx9z8rlhmrdq4c7q74rq9f51q0m86"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("flex" ,flex)
@@ -1446,7 +1482,7 @@ access to mpv's powerful playback capabilities.")
 (define-public youtube-dl
   (package
     (name "youtube-dl")
-    (version "2019.06.21")
+    (version "2019.08.02")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/rg3/youtube-dl/releases/"
@@ -1454,7 +1490,7 @@ access to mpv's powerful playback capabilities.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "03a729198zzhixbn7xixi9bprmk3qqh5dsyh3dqhji6lmlijx1w5"))))
+                "101b6jrf6ckbxrn76ppvgdyrb25p7d247kn8qgq7n476sfnkfg2p"))))
     (build-system python-build-system)
     (arguments
      ;; The problem here is that the directory for the man page and completion
@@ -1585,7 +1621,7 @@ other site that youtube-dl supports.")
 (define-public you-get
   (package
     (name "you-get")
-    (version "0.4.1302")
+    (version "0.4.1328")
     (source (origin
               (method git-fetch)
               (uri (git-reference
@@ -1594,7 +1630,7 @@ other site that youtube-dl supports.")
               (file-name (git-file-name name version))
               (sha256
                (base32
-                "1fwwzslv1vpjr8q0fq10dbngr8zai1n3d6na700cgpky4j9y0y99"))))
+                "1r9qffwvxmp74byva12h2jsn3n33vyim052sx9lykv5dygibbp65"))))
     (build-system python-build-system)
     (inputs
      `(("ffmpeg" ,ffmpeg)))             ; for multi-part and >=1080p videos
@@ -2695,6 +2731,51 @@ of modern, widely supported codecs.")
     ;; Combination under GPLv2.  See LICENSE.
     (license license:gpl2)))
 
+(define-public intel-vaapi-driver
+  (package
+    (name "intel-vaapi-driver")
+    (version "2.3.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/intel/intel-vaapi-driver/"
+                           "releases/download/" version "/intel-vaapi-driver-"
+                           version ".tar.bz2"))
+       (sha256
+        (base32 "1qyzxh3p8cw4fv8bz9zd4kc8hajlaps7xryzh6pad814n3m5sbjw"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("libdrm" ,libdrm)
+       ("libva" ,libva)
+       ("libx11" ,libx11)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'set-target-directory
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (setenv "LIBVA_DRIVERS_PATH" (string-append out "/lib/dri"))
+               #t))))))
+    ;; XXX Because of <https://issues.guix.gnu.org/issue/22138>, we need to add
+    ;; this to all VA-API back ends instead of once to libva.
+    (native-search-paths
+     (list (search-path-specification
+            (variable "LIBVA_DRIVERS_PATH")
+            (files '("lib/dri")))))
+    (supported-systems '("i686-linux" "x86_64-linux"))
+    (home-page "https://01.org/linuxmedia/vaapi")
+    (synopsis "VA-API video acceleration driver for Intel GEN Graphics devices")
+    (description
+     "This is the @acronym{VA-API, Video Acceleration API} back end required for
+hardware-accelerated video processing on Intel GEN Graphics devices supported by
+the i915 driver, such as integrated Intel HD Graphics.  It provides access to
+both hardware and shader functionality for faster encoding, decoding, and
+post-processing of video formats like MPEG2, H.264/AVC, and VC-1.")
+    (license (list license:bsd-2        ; src/gen9_vp9_const_def.c
+                   license:expat))))    ; the rest, excluding the test suite
+
 (define-public openh264
   (package
     (name "openh264")
diff --git a/gnu/packages/virtualization.scm b/gnu/packages/virtualization.scm
index e68007ec2c..26477714e4 100644
--- a/gnu/packages/virtualization.scm
+++ b/gnu/packages/virtualization.scm
@@ -390,14 +390,14 @@ manage system or application containers.")
 (define-public libvirt
   (package
     (name "libvirt")
-    (version "5.5.0")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://libvirt.org/sources/libvirt-"
-                                  version ".tar.xz"))
-              (sha256
-               (base32
-                "1s1mzw4cmkcfivs1kphpgy4lpddx0w1qnjysr4ggk5558w4yy1i3"))))
+    (version "5.6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://libvirt.org/sources/libvirt-"
+                           version ".tar.xz"))
+       (sha256
+        (base32 "1d5rmcx5fgb024hw8chbiv886n3jal5wp2yajjk5l4qh9s9gkx35"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -479,37 +479,31 @@ to integrate other virtualization mechanisms if needed.")
 (define-public libvirt-glib
   (package
     (name "libvirt-glib")
-    (version "1.0.0")
+    (version "2.0.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "ftp://libvirt.org/libvirt/glib/"
                                   "libvirt-glib-" version ".tar.gz"))
               (sha256
                (base32
-                "0iwa5sdbii52pjpdm5j37f67sdmf0kpcky4liwhy1nf43k85i4fa"))))
+                "0six9ckmvlwwyavyjkgc262qkpvfqgi8rjij7cyk00bmqq8c9s4l"))))
     (build-system gnu-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-tests
-           (lambda _
-             (substitute* "tests/test-events.c"
-               (("/bin/true") (which "true")))
-             #t)))))
     (inputs
-     `(("libxml2" ,libxml2)
-       ("libvirt" ,libvirt)
-       ("gobject-introspection" ,gobject-introspection)
-       ("glib" ,glib)
-       ("openssl" ,openssl)
+     `(("openssl" ,openssl)
        ("cyrus-sasl" ,cyrus-sasl)
-       ("lvm2" ,lvm2) ; for libdevmapper
+       ("lvm2" ,lvm2)                   ; for libdevmapper
        ("libyajl" ,libyajl)))
     (native-inputs
      `(("pkg-config" ,pkg-config)
        ("intltool" ,intltool)
        ("glib" ,glib "bin")
        ("vala" ,vala)))
+    (propagated-inputs
+     ;; ‘Required:’ by the installed .pc files.
+     `(("glib" ,glib)
+       ("libvirt" ,libvirt)
+       ("libxml2" ,libxml2)
+       ("gobject-introspection" ,gobject-introspection)))
     (home-page "https://libvirt.org")
     (synopsis "GLib wrapper around libvirt")
     (description "libvirt-glib wraps the libvirt library to provide a
@@ -527,15 +521,15 @@ three libraries:
 (define-public python-libvirt
   (package
     (name "python-libvirt")
-    (version "5.5.0")
+    (version "5.6.0")
     (source
      (origin
        (method url-fetch)
-       ;; The latest version hosted on PyPI at 5.5.0 release time was 5.3.0.
+       ;; The latest version hosted on PyPI at 5.6.0 release time was 5.5.0.
        (uri (string-append "https://libvirt.org/sources/python/libvirt-python-"
                            version ".tar.gz"))
        (sha256
-        (base32 "00x6idyw9xrrr21vrnsyw37q2sd8yh4n6pwh0l28hh9yp3nsy72n"))))
+        (base32 "11i440aibykxw22fzyavmrvn67s8rmnijw5bag0yx9r8jpnkzwad"))))
     (build-system python-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index f81d12c7ce..f2d1f316d4 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -6,7 +6,7 @@
 ;;; Copyright © 2015, 2016, 2017, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018 Raoul Jean Pierre Bonnal <ilpuccio.febo@gmail.com>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
-;;; Copyright © 2015, 2016, 2017, 2018 Eric Bavier <bavier@member.fsf.org>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2016 Jelle Licht <jlicht@fsfe.org>
@@ -127,6 +127,7 @@
   #:use-module (gnu packages tls)
   #:use-module (gnu packages valgrind)
   #:use-module (gnu packages version-control)
+  #:use-module (gnu packages vim)
   #:use-module (gnu packages xml))
 
 (define-public httpd
@@ -205,14 +206,14 @@ Interface} specification.")
     ;; ’stable’ and recommends that “in general you deploy the NGINX mainline
     ;; branch at all times” (https://www.nginx.com/blog/nginx-1-6-1-7-released/)
     ;; Consider updating the nginx-documentation package together with this one.
-    (version "1.17.1")
+    (version "1.17.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://nginx.org/download/nginx-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0gp7cy2bbn8yi1wapjzssf4bhmn4d4vphdb0k1wiaq2fa6s2a63g"))))
+                "1v39gslwbvpfhqqv74q0lkfrhrwsp59xc8pwhvxns7af8s3kccsy"))))
     (build-system gnu-build-system)
     (inputs `(("openssl" ,openssl)
               ("pcre" ,pcre)
@@ -4239,15 +4240,15 @@ C.  It is developed as part of the NetSurf project.")
 (define-public hubbub
   (package
     (name "hubbub")
-    (version "0.3.5")
+    (version "0.3.6")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           "lib" name "-" version "-src.tar.gz"))
+                           "libhubbub-" version "-src.tar.gz"))
        (sha256
         (base32
-         "13yq1k96a7972x4r71i9bcsz9yiglj0yx7lj0ziq5r94w5my70ma"))
+         "1x3v7xvagx85v9h3pypzc86rcxs4mij87mmcqkp8pq50q6awfmnp"))
        (patches (search-patches "hubbub-sort-entities.patch"))))
     (build-system gnu-build-system)
     (native-inputs
@@ -4345,15 +4346,15 @@ commenting.")
 (define-public libwapcaplet
   (package
     (name "libwapcaplet")
-    (version "0.4.1")
+    (version "0.4.2")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           name "-" version "-src.tar.gz"))
+                           "libwapcaplet-" version "-src.tar.gz"))
        (sha256
         (base32
-         "134pljlm8kby1yy49826f0ixnpig8iqak6xpyl3aivagnsjnxzy8"))))
+         "1fjwzbn7j8bi1b9bvwxsy3i2cr6byq2s2d29866801pjnf528g86"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("netsurf-buildsystem" ,netsurf-buildsystem)
@@ -4371,15 +4372,15 @@ developed as part of the Netsurf project.")
 (define-public libcss
   (package
     (name "libcss")
-    (version "0.8.0")
+    (version "0.9.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           name "-" version "-src.tar.gz"))
+                           "libcss-" version "-src.tar.gz"))
        (sha256
         (base32
-         "0pxdqbxn6brj03nv57bsvac5n70k4scn3r5msaw0jgn2k06lk81m"))))
+         "1vw9j3d2mr4wbvs8fyqmgslkbxknvac10456775hflxxcivbm3xr"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("netsurf-buildsystem" ,netsurf-buildsystem)
@@ -4399,15 +4400,15 @@ written in C.  It is developed as part of the NetSurf project.")
 (define-public libdom
   (package
     (name "libdom")
-    (version "0.3.3")
+    (version "0.4.0")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           name "-" version "-src.tar.gz"))
+                           "libdom-" version "-src.tar.gz"))
        (sha256
         (base32
-         "1919757mdl3gii2pl6kzm8b1cal0h06r5nqd2y0kny6hc5yrhsp0"))))
+         "1ixkqsl3f7dl1kajksm0c231w1v5xy8z6hm3v67hgm9nh4qcvfcy"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("netsurf-buildsystem" ,netsurf-buildsystem)
@@ -4509,6 +4510,34 @@ written in C.  It is developed as part of the NetSurf project.")
 C.  It is developed as part of the NetSurf project.")
     (license license:expat)))
 
+(define-public libnslog
+  (package
+    (name "libnslog")
+    (version "0.1.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
+                           "libnslog-" version "-src.tar.gz"))
+       (sha256
+        (base32
+         "1ggs6xvxp8fbg5w8pifalipm458ygr9ab6j2yvj8fnnmxwvdh4jd"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("netsurf-buildsystem" ,netsurf-buildsystem)
+       ("pkg-config" ,pkg-config)
+       ("check" ,check)                 ;for tests
+       ("bison" ,bison)
+       ("flex" ,flex)))
+    (arguments netsurf-buildsystem-arguments)
+    (home-page "http://www.netsurf-browser.org/")
+    (synopsis "Logging library")
+    (description
+     "Libnslog provides a category-based logging library which supports
+complex logging filters, multiple log levels, and provides context through to
+client applications.  It is developed as part of the NetSurf project.")
+    (license license:expat)))
+
 (define-public libnsutils
   (package
     (name "libnsutils")
@@ -4535,15 +4564,15 @@ developed as part of the NetSurf project.")
 (define-public libnspsl
   (package
     (name "libnspsl")
-    (version "0.1.3")
+    (version "0.1.5")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           name "-" version "-src.tar.gz"))
+                           "libnspsl-" version "-src.tar.gz"))
        (sha256
         (base32
-         "1rsk1k2a495axxgv8060s0p1phhhcxrv75252kllbkvr8id5kqld"))))
+         "0siq8zjfxv75i9fw6q5hkaijpdm1w3zskd5qk6vsvz8cqan4vifd"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("netsurf-buildsystem" ,netsurf-buildsystem)))
@@ -4558,15 +4587,15 @@ Public Suffix List.  It is developed as part of the NetSurf project.")
 (define-public nsgenbind
   (package
     (name "nsgenbind")
-    (version "0.6")
+    (version "0.7")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "http://download.netsurf-browser.org/libs/releases/"
-                           name "-" version "-src.tar.gz"))
+                           "nsgenbind-" version "-src.tar.gz"))
        (sha256
         (base32
-         "0v1cb1rz5fix9ql31nzmglj7sybya6d12b2fkaypm1avcca59xwj"))))
+         "0rplmky4afsjwiwh7grkmcdmzg86zksa55j93dvq92f91yljwqqq"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("netsurf-buildsystem" ,netsurf-buildsystem)
@@ -4586,7 +4615,7 @@ w3c webidl files and a binding configuration file.")
 (define-public netsurf
   (package
     (name "netsurf")
-    (version "3.8")
+    (version "3.9")
     (source
      (origin
        (method url-fetch)
@@ -4594,7 +4623,7 @@ w3c webidl files and a binding configuration file.")
                            "releases/source/netsurf-" version "-src.tar.gz"))
        (sha256
         (base32
-         "0hjm1h4m1i913y4mhkl7yqdifn8k70fwi58zdh6faypawzryc3m0"))
+         "1hzcm2s2wh5sapgr000lg63hcdbj6hyajxl43xa1x80kc5piqbyp"))
        (patches (search-patches "netsurf-system-utf8proc.patch"
                                 "netsurf-y2038-tests.patch"
                                 "netsurf-longer-test-timeout.patch"
@@ -4607,7 +4636,8 @@ w3c webidl files and a binding configuration file.")
        ("check" ,check)
        ("perl" ,perl)
        ("perl-html-parser" ,perl-html-parser)
-       ("pkg-config" ,pkg-config)))
+       ("pkg-config" ,pkg-config)
+       ("xxd" ,xxd)))
     (inputs
      `(("curl" ,curl)
        ("gtk+" ,gtk+-2)
@@ -4619,6 +4649,7 @@ w3c webidl files and a binding configuration file.")
        ("libdom" ,libdom)
        ("libnsbmp" ,libnsbmp)
        ("libnsgif" ,libnsgif)
+       ("libnslog" ,libnslog)
        ("libnspsl" ,libnspsl)
        ("libnsutils" ,libnsutils)
        ("libsvgtiny" ,libsvgtiny)
@@ -6436,8 +6467,8 @@ compressed JSON header blocks.
     (license license:expat)))
 
 (define-public hpcguix-web
-  (let ((commit "53e09ea59ec0380b41a4cbda32df8bdb9a10004d")
-        (revision "3"))
+  (let ((commit "f39c90b35e99e4122b0866ec4337020d61c81508")
+        (revision "4"))
     (package
       (name "hpcguix-web")
       (version (git-version "0.0.1" revision commit))
@@ -6449,7 +6480,7 @@ compressed JSON header blocks.
                 (file-name (git-file-name name version))
                 (sha256
                  (base32
-                  "1ah4pn9697vazhbvd45n4b1rrkx2nbhnw384cr0b941q3sz1dfyc"))))
+                  "0idzzlwnaymk6hm5q9nh146h5m6vd8acp32vlmzp6qq08mimfkq7"))))
       (build-system gnu-build-system)
       (arguments
        `(#:modules ((guix build gnu-build-system)
@@ -6509,7 +6540,7 @@ compressed JSON header blocks.
       (propagated-inputs
        `(("guile" ,guile-2.2)
          ("guile-commonmark" ,guile-commonmark)
-         ("guile-json" ,guile-json)))
+         ("guile-json" ,guile-json-3)))
       (home-page "https://github.com/UMCUGenetics/hpcguix-web")
       (synopsis "Web interface for cluster deployments of Guix")
       (description "Hpcguix-web provides a web interface to the list of packages
diff --git a/gnu/packages/wine.scm b/gnu/packages/wine.scm
index 62cf225ceb..fd7277a7af 100644
--- a/gnu/packages/wine.scm
+++ b/gnu/packages/wine.scm
@@ -310,7 +310,7 @@ integrate Windows applications into your desktop.")
 (define-public wine-staging-patchset-data
   (package
     (name "wine-staging-patchset-data")
-    (version "4.12.1")
+    (version "4.13")
     (source
      (origin
        (method git-fetch)
@@ -320,7 +320,7 @@ integrate Windows applications into your desktop.")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "1bvpvj6vcw2p6vcjm6mw5maarbs4lfw1ix3pj020w4n3kg4nmmc4"))))
+         "0bbwsd2qpjilxpjscqbp78p0gl0awj1yj62g0wvybh4x89fzy8zj"))))
     (build-system trivial-build-system)
     (native-inputs
      `(("bash" ,bash)
@@ -366,7 +366,7 @@ integrate Windows applications into your desktop.")
               (file-name (string-append name "-" version ".tar.xz"))
               (sha256
                (base32
-                "09yjfb2k14y11k19lm8dqmb8qwxyhh67d5q1gqv480y64mljvkx0"))))
+                "0rqx8g394aj5q913cd18zsi60sldvxarrp178w6ja0y4rd8l25vr"))))
     (inputs `(("autoconf" ,autoconf) ; for autoreconf
               ("faudio" ,faudio)
               ("ffmpeg" ,ffmpeg)
@@ -407,10 +407,7 @@ integrate Windows applications into your desktop.")
                     (script (string-append (assoc-ref %build-inputs
                             "wine-staging-patchset-data")
                             "/share/wine-staging/patches/patchinstall.sh")))
-               ;; Exclude specific patches that conflict with FAudio.
-               (invoke script (string-append "DESTDIR=" ".") "--all" "-W"
-                       "xaudio2-revert" "-W" "xaudio2_CommitChanges" "-W"
-                       "xaudio2_7-WMA_support" "-W" "xaudio2_7-CreateFX-FXEcho")
+               (invoke script (string-append "DESTDIR=" ".") "--all")
                #t)))
          (add-after 'configure 'patch-dlopen-paths
            ;; Hardcode dlopened sonames to absolute paths.
@@ -487,9 +484,7 @@ integrated into the main branch.")
                             "wine-staging-patchset-data")
                             "/share/wine-staging/patches/patchinstall.sh")))
                ;; Exclude specific patches that conflict with FAudio.
-               (invoke script (string-append "DESTDIR=" ".") "--all" "-W"
-                       "xaudio2-revert" "-W" "xaudio2_CommitChanges" "-W"
-                       "xaudio2_7-WMA_support" "-W" "xaudio2_7-CreateFX-FXEcho")
+               (invoke script (string-append "DESTDIR=" ".") "--all")
                #t)))
          (add-after 'install 'copy-wine32-binaries
            (lambda* (#:key outputs #:allow-other-keys)
diff --git a/gnu/packages/wm.scm b/gnu/packages/wm.scm
index 8fe94e28b4..c56cf406ee 100644
--- a/gnu/packages/wm.scm
+++ b/gnu/packages/wm.scm
@@ -131,20 +131,19 @@ the leaves of a full binary tree.")
 (define-public i3status
   (package
     (name "i3status")
-    (version "2.12")
+    (version "2.13")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://i3wm.org/i3status/i3status-"
                                   version ".tar.bz2"))
               (sha256
                (base32
-                "06krpbijv4yi33nypg6qcn4hilcrdyarsdpd9fmr2cq46qaqiikg"))))
+                "0rhlzb96mw64z2jnhwz9nibc7pxg549626lz5642xxk5hpzwk2ff"))))
     (build-system gnu-build-system)
     (arguments
-     `(#:make-flags (list "CC=gcc" (string-append "PREFIX=" %output))
-       #:phases
-       (modify-phases %standard-phases
-         (delete 'configure))
+     `(;; XXX: Do an "out of source" build to work around
+       ;; <https://github.com/i3/i3status/issues/339>.
+       #:out-of-source? #t
        #:tests? #f)) ; no test suite
     (inputs
      `(("openlibm" ,openlibm)
@@ -156,7 +155,10 @@ the leaves of a full binary tree.")
        ("libcap" ,libcap)
        ("asciidoc" ,asciidoc)))
     (native-inputs
-     `(("pkg-config" ,pkg-config)))
+     `(("pkg-config" ,pkg-config)
+       ("docbook-xsl" ,docbook-xsl)
+       ("libxml2" ,libxml2)             ;for XML_CATALOG_FILES
+       ("xmlto" ,xmlto)))
     (home-page "https://i3wm.org/i3status/")
     (synopsis "Status bar for i3bar, dzen2, xmobar or similar programs")
     (description "i3status is a small program for generating a status bar for
@@ -171,14 +173,14 @@ commands would.")
 (define-public i3-wm
   (package
     (name "i3-wm")
-    (version "4.16.1")
+    (version "4.17")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://i3wm.org/downloads/i3-"
                                   version ".tar.bz2"))
               (sha256
                (base32
-                "0xl56y196vxv001gvx35xwfr25zah8m3xwizp9ycdgdc0rfc4rdb"))))
+                "1z8qmkkq9dhqmqy8sjw3rnpnmnb8v7lr456bs0qzp23bgpj17gjf"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index a2a152bec4..0dbd0326c3 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5988,7 +5988,7 @@ basic eye-candy effects.")
 (define-public xpra
   (package
     (name "xpra")
-    (version "2.5.2")
+    (version "2.5.3")
     (source
      (origin
        (method url-fetch)
@@ -5996,7 +5996,7 @@ basic eye-candy effects.")
                            version ".tar.xz"))
        (sha256
         (base32
-         "1zbh2990crrxp02c554yh30f0s9znm6iiiklkw8vpxrlmdv1z8ks"))))
+         "1ys35lj28903alccks9p055psy1fsk1nxi8ncchvw8bfxkkkvbys"))))
     (build-system python-build-system)
     (inputs `(("ffmpeg" ,ffmpeg)
               ("flac" ,flac)
diff --git a/gnu/services/herd.scm b/gnu/services/herd.scm
index 0008746fe9..2207b2d34b 100644
--- a/gnu/services/herd.scm
+++ b/gnu/services/herd.scm
@@ -40,10 +40,12 @@
             unknown-shepherd-error?
             unknown-shepherd-error-sexp
 
+            live-service
             live-service?
             live-service-provision
             live-service-requirement
             live-service-running
+            live-service-canonical-name
 
             with-shepherd-action
             current-services
@@ -192,6 +194,10 @@ of pairs."
   (requirement  live-service-requirement)         ;list of symbols
   (running      live-service-running))            ;#f | object
 
+(define (live-service-canonical-name service)
+  "Return the 'canonical name' of SERVICE."
+  (first (live-service-provision service)))
+
 (define (current-services)
   "Return the list of currently defined Shepherd services, represented as
 <live-service> objects.  Return #f if the list of services could not be
diff --git a/gnu/system/vm.scm b/gnu/system/vm.scm
index e7f7d8ca51..ac6e4ded92 100644
--- a/gnu/system/vm.scm
+++ b/gnu/system/vm.scm
@@ -514,7 +514,7 @@ system."
         (name  (string-append name ".tar.gz"))
         (graph "system-graph"))
     (define build
-      (with-extensions (cons guile-json           ;for (guix docker)
+      (with-extensions (cons guile-json-3         ;for (guix docker)
                              gcrypt-sqlite3&co)   ;for (guix store database)
         (with-imported-modules `(,@(source-module-closure
                                     '((guix docker)
diff --git a/gnu/tests/reconfigure.scm b/gnu/tests/reconfigure.scm
new file mode 100644
index 0000000000..3a2f0a2e53
--- /dev/null
+++ b/gnu/tests/reconfigure.scm
@@ -0,0 +1,262 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2019 Jakob L. Kreuze <zerodaysfordays@sdf.lonestar.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu tests reconfigure)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu services shepherd)
+  #:use-module (gnu system vm)
+  #:use-module (gnu system)
+  #:use-module (gnu tests)
+  #:use-module (guix derivations)
+  #:use-module (guix gexp)
+  #:use-module (guix monads)
+  #:use-module (guix scripts system reconfigure)
+  #:use-module (guix store)
+  #:export (%test-switch-to-system
+            %test-upgrade-services
+            %test-install-bootloader))
+
+;;; Commentary:
+;;;
+;;; Test in-place system reconfiguration: advancing the system generation on a
+;;; running instance of the Guix System.
+;;;
+;;; Code:
+
+(define* (run-switch-to-system-test)
+  "Run a test of an OS running SWITCH-SYSTEM-PROGRAM, which creates a new
+generation of the system profile."
+  (define os
+    (marionette-operating-system
+     (simple-operating-system)
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define vm (virtual-machine os))
+
+  (define (test script)
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette (list #$vm)))
+
+          ;; Return the names of the generation symlinks on MARIONETTE.
+          (define (system-generations marionette)
+            (marionette-eval
+             '(begin
+                (use-modules (ice-9 ftw)
+                             (srfi srfi-1))
+                (let* ((profile-dir "/var/guix/profiles/")
+                       (entries (map first (cddr (file-system-tree profile-dir)))))
+                  (remove (lambda (entry)
+                            (member entry '("per-user" "system")))
+                          entries)))
+             marionette))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "switch-to-system")
+
+          (let ((generations-prior (system-generations marionette)))
+            (test-assert "script successfully evaluated"
+              (marionette-eval
+               '(primitive-load #$script)
+               marionette))
+
+            (test-equal "script created new generation"
+              (length (system-generations marionette))
+              (1+ (length generations-prior))))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (gexp->derivation "switch-to-system" (test (switch-system-program os))))
+
+(define* (run-upgrade-services-test)
+  "Run a test of an OS running UPGRADE-SERVICES-PROGRAM, which upgrades the
+Shepherd (PID 1) by unloading obsolete services and loading new services."
+  (define os
+    (marionette-operating-system
+     (simple-operating-system)
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define vm (virtual-machine os))
+
+  (define dummy-service
+    ;; Shepherd service that does nothing, for the sole purpose of ensuring
+    ;; that it is properly installed and started by the script.
+    (shepherd-service (provision '(dummy))
+                      (start #~(const #t))
+                      (stop #~(const #t))
+                      (respawn? #f)))
+
+  ;; Return the Shepherd service file for SERVICE, after ensuring that it
+  ;; exists in the store.
+  (define (ensure-service-file service)
+    (let ((file (shepherd-service-file service)))
+      (mlet* %store-monad ((store-object (lower-object file))
+                           (_ (built-derivations (list store-object))))
+        (return file))))
+
+  (define (test enable-dummy disable-dummy)
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette (list #$vm)))
+
+          ;; Return the names of the running services on MARIONETTE.
+          (define (running-services marionette)
+            (marionette-eval
+             '(begin
+                (use-modules (gnu services herd))
+                (map live-service-canonical-name (current-services)))
+             marionette))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "upgrade-services")
+
+          (let ((services-prior (running-services marionette)))
+            (test-assert "script successfully evaluated"
+              (marionette-eval
+               '(primitive-load #$enable-dummy)
+               marionette))
+
+            (test-assert "script started new service"
+              (and (not (memq 'dummy services-prior))
+                   (memq 'dummy (running-services marionette))))
+
+            (test-assert "script successfully evaluated"
+              (marionette-eval
+               '(primitive-load #$disable-dummy)
+               marionette))
+
+            (test-assert "script stopped obsolete service"
+              (not (memq 'dummy (running-services marionette)))))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (mlet* %store-monad ((file (ensure-service-file dummy-service)))
+    (let ((enable (upgrade-services-program (list file) '(dummy) '() '()))
+          (disable (upgrade-services-program '() '() '(dummy) '())))
+      (gexp->derivation "upgrade-services" (test enable disable)))))
+
+(define* (run-install-bootloader-test)
+  "Run a test of an OS running INSTALL-BOOTLOADER-PROGRAM, which installs a
+bootloader's configuration file."
+  (define os
+    (marionette-operating-system
+     (simple-operating-system)
+     #:imported-modules '((gnu services herd)
+                          (guix combinators))))
+
+  (define vm (virtual-machine os))
+
+  (define (test script)
+    (with-imported-modules '((gnu build marionette))
+      #~(begin
+          (use-modules (gnu build marionette)
+                       (ice-9 regex)
+                       (srfi srfi-1)
+                       (srfi srfi-64))
+
+          (define marionette
+            (make-marionette (list #$vm)))
+
+          ;; Return the system generation paths that have GRUB menu entries.
+          (define (generations-in-grub-cfg marionette)
+            (let ((grub-cfg (marionette-eval
+                             '(begin
+                                (call-with-input-file "/boot/grub/grub.cfg"
+                                  (lambda (port)
+                                    (get-string-all port))))
+                             marionette)))
+              (map (lambda (parameter)
+                     (second (string-split (match:substring parameter) #\=)))
+                   (list-matches "system=[^ ]*" grub-cfg))))
+
+          (mkdir #$output)
+          (chdir #$output)
+
+          (test-begin "install-bootloader")
+
+          (test-assert "no prior menu entry for system generation"
+            (not (member #$os (generations-in-grub-cfg marionette))))
+
+          (test-assert "script successfully evaluated"
+            (marionette-eval
+             '(primitive-load #$script)
+             marionette))
+
+          (test-assert "menu entry created for system generation"
+            (member #$os (generations-in-grub-cfg marionette)))
+
+          (test-end)
+          (exit (= (test-runner-fail-count (test-runner-current)) 0)))))
+
+  (let* ((bootloader ((compose bootloader-configuration-bootloader
+                               operating-system-bootloader)
+                      os))
+         ;; The typical use-case for 'install-bootloader-program' is to read
+         ;; the boot parameters for the existing menu entries on the system,
+         ;; parse them with 'boot-parameters->menu-entry', and pass the
+         ;; results to 'operating-system-bootcfg'. However, to obtain boot
+         ;; parameters, we would need to start the marionette, which we should
+         ;; ideally avoid doing outside of the 'test' G-Expression. Thus, we
+         ;; generate a bootloader configuration for the script as if there
+         ;; were no existing menu entries. In the grand scheme of things, this
+         ;; matters little -- these tests should not make assertions about the
+         ;; behavior of 'operating-system-bootcfg'.
+         (bootcfg (operating-system-bootcfg os '()))
+         (bootcfg-file (bootloader-configuration-file bootloader)))
+    (gexp->derivation
+     "install-bootloader"
+     ;; Due to the read-only nature of the virtual machines used in the system
+     ;; test suite, the bootloader installer script is omitted. 'grub-install'
+     ;; would attempt to write directly to the virtual disk if the
+     ;; installation script were run.
+     (test (install-bootloader-program #f #f bootcfg bootcfg-file #f "/")))))
+
+(define %test-switch-to-system
+  (system-test
+   (name "switch-to-system")
+   (description "Create a new generation of the system profile.")
+   (value (run-switch-to-system-test))))
+
+(define %test-upgrade-services
+  (system-test
+   (name "upgrade-services")
+   (description "Upgrade the Shepherd by unloading obsolete services and
+loading new services.")
+   (value (run-upgrade-services-test))))
+
+(define %test-install-bootloader
+  (system-test
+   (name "install-bootloader")
+   (description "Install a bootloader and its configuration file.")
+   (value (run-install-bootloader-test))))
diff --git a/guix/build/cargo-build-system.scm b/guix/build/cargo-build-system.scm
index f38de16cf7..7d363a18a5 100644
--- a/guix/build/cargo-build-system.scm
+++ b/guix/build/cargo-build-system.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2016 David Craven <david@craven.ch>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Ivan Petkov <ivanppetkov@gmail.com>
+;;; Copyright © 2019 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,6 +40,21 @@
 ;;
 ;; Code:
 
+;; TODO: Move this to (guix build cargo-utils). Will cause a full rebuild
+;; of all rust compilers.
+
+(define (generate-all-checksums dir-name)
+  (for-each
+    (lambda (filename)
+      (let* ((dir (dirname filename))
+             (checksum-file (string-append dir "/.cargo-checksum.json")))
+        (when (file-exists? checksum-file) (delete-file checksum-file))
+        (display (string-append
+                   "patch-cargo-checksums: generate-checksums for "
+                   dir "\n"))
+        (generate-checksums dir)))
+    (find-files dir-name "Cargo.toml$")))
+
 (define (manifest-targets)
   "Extract all targets from the Cargo.toml manifest"
   (let* ((port (open-input-pipe "cargo read-manifest"))
@@ -94,8 +110,7 @@ Cargo.toml file present at its root."
               ;; so that we can generate any cargo checksums.
               ;; The --strip-components argument is needed to prevent creating
               ;; an extra directory within `crate-dir`.
-              (invoke "tar" "xvf" path "-C" crate-dir "--strip-components" "1")
-              (generate-checksums crate-dir)))))
+              (invoke "tar" "xvf" path "-C" crate-dir "--strip-components" "1")))))
     inputs)
 
   ;; Configure cargo to actually use this new directory.
@@ -121,6 +136,31 @@ directory = '" port)
   (setenv "CC" (string-append (assoc-ref inputs "gcc") "/bin/gcc"))
   #t)
 
+;; The Cargo.lock file tells the build system which crates are required for
+;; building and hardcodes their version and checksum.  In order to build with
+;; the inputs we provide, we need to recreate the file with our inputs.
+(define* (update-cargo-lock #:key
+                            (vendor-dir "guix-vendor")
+                            #:allow-other-keys)
+  "Regenerate the Cargo.lock file with the current build inputs."
+  (when (file-exists? "Cargo.lock")
+    (begin
+      ;; Unfortunately we can't generate a Cargo.lock file until the checksums
+      ;; are generated, so we have an extra round of generate-all-checksums here.
+      (generate-all-checksums vendor-dir)
+      (delete-file "Cargo.lock")
+      (invoke "cargo" "generate-lockfile")))
+  #t)
+
+;; After the 'patch-generated-file-shebangs phase any vendored crates who have
+;; their shebangs patched will have a mismatch on their checksum.
+(define* (patch-cargo-checksums #:key
+                                (vendor-dir "guix-vendor")
+                                #:allow-other-keys)
+  "Patch the checksums of the vendored crates after patching their shebangs."
+  (generate-all-checksums vendor-dir)
+  #t)
+
 (define* (build #:key
                 skip-build?
                 (cargo-build-flags '("--release"))
@@ -162,7 +202,9 @@ directory = '" port)
     (replace 'configure configure)
     (replace 'build build)
     (replace 'check check)
-    (replace 'install install)))
+    (replace 'install install)
+    (add-after 'configure 'update-cargo-lock update-cargo-lock)
+    (add-after 'patch-generated-file-shebangs 'patch-cargo-checksums patch-cargo-checksums)))
 
 (define* (cargo-build #:key inputs (phases %standard-phases)
                       #:allow-other-keys #:rest args)
diff --git a/guix/build/go-build-system.scm b/guix/build/go-build-system.scm
index 858068ba98..3dac43c18a 100644
--- a/guix/build/go-build-system.scm
+++ b/guix/build/go-build-system.scm
@@ -135,6 +135,9 @@ of the package being built and its dependencies, and GOBIN, which determines
 where executables (\"commands\") are installed to.  This phase is sometimes used
 by packages that use (guix build-system gnu) but have a handful of Go
 dependencies, so it should be self-contained."
+  ;; The Go cache is required starting in Go 1.12.  We don't actually use it but
+  ;; we need it to be a writable directory.
+  (setenv "GOCACHE" "/tmp/go-cache")
   ;; Using the current working directory as GOPATH makes it easier for packagers
   ;; who need to manipulate the unpacked source code.
   (setenv "GOPATH" (getcwd))
diff --git a/guix/discovery.scm b/guix/discovery.scm
index 468b6c59de..7c5fed7f0e 100644
--- a/guix/discovery.scm
+++ b/guix/discovery.scm
@@ -51,13 +51,15 @@ DIRECTORY is not accessible."
       ((? symbol? type)
        type)))
 
+  (define (dot-prefixed? file)
+    (string-prefix? "." file))
+
   ;; Use 'scandir*' so we can avoid an extra 'lstat' for each entry, as
   ;; opposed to Guile's 'scandir' or 'file-system-fold'.
   (fold-right (lambda (entry result)
                 (match entry
-                  (("." . _)
-                   result)
-                  ((".." . _)
+                  (((? dot-prefixed?) . _)
+                   ;; Exclude ".", "..", and hidden files such as backups.
                    result)
                   ((name . properties)
                    (let ((absolute (string-append directory "/" name)))
diff --git a/guix/docker.scm b/guix/docker.scm
index b1bd226fa1..c598a073f6 100644
--- a/guix/docker.scm
+++ b/guix/docker.scm
@@ -62,9 +62,9 @@
 
 (define (manifest path id)
   "Generate a simple image manifest."
-  `(((Config . "config.json")
-     (RepoTags . (,(generate-tag path)))
-     (Layers . (,(string-append id "/layer.tar"))))))
+  `#(((Config . "config.json")
+      (RepoTags . #(,(generate-tag path)))
+      (Layers . #(,(string-append id "/layer.tar"))))))
 
 ;; According to the specifications this is required for backwards
 ;; compatibility.  It duplicates information provided by the manifest.
@@ -81,17 +81,18 @@
   `((architecture . ,arch)
     (comment . "Generated by GNU Guix")
     (created . ,time)
-    (config . ,`((env . ,(map (match-lambda
-                                ((name . value)
-                                 (string-append name "=" value)))
-                              environment))
+    (config . ,`((env . ,(list->vector
+                          (map (match-lambda
+                                 ((name . value)
+                                  (string-append name "=" value)))
+                               environment)))
                  ,@(if entry-point
-                       `((entrypoint . ,entry-point))
+                       `((entrypoint . ,(list->vector entry-point)))
                        '())))
     (container_config . #nil)
     (os . "linux")
     (rootfs . ((type . "layers")
-               (diff_ids . (,(layer-diff-id layer)))))))
+               (diff_ids . #(,(layer-diff-id layer)))))))
 
 (define %tar-determinism-options
   ;; GNU tar options to produce archives deterministically.
diff --git a/guix/gexp.scm b/guix/gexp.scm
index eef308b000..45cd5869f7 100644
--- a/guix/gexp.scm
+++ b/guix/gexp.scm
@@ -427,7 +427,9 @@ This is the declarative counterpart of 'gexp->script'."
     (($ <program-file> name gexp guile module-path)
      (gexp->script name gexp
                    #:module-path module-path
-                   #:guile (or guile (default-guile))))))
+                   #:guile (or guile (default-guile))
+                   #:system system
+                   #:target target))))
 
 (define-record-type <scheme-file>
   (%scheme-file name gexp splice?)
@@ -1345,6 +1347,7 @@ last one is created from the given <scheme-file> object."
 (define* (compiled-modules modules
                            #:key (name "module-import-compiled")
                            (system (%current-system))
+                           target
                            (guile (%guile-for-build))
                            (module-path %load-path)
                            (extensions '())
@@ -1355,7 +1358,8 @@ last one is created from the given <scheme-file> object."
                            (pre-load-modules? #t))
   "Return a derivation that builds a tree containing the `.go' files
 corresponding to MODULES.  All the MODULES are built in a context where
-they can refer to each other."
+they can refer to each other.  When TARGET is true, cross-compile MODULES for
+TARGET, a GNU triplet."
   (define total (length modules))
 
   (mlet %store-monad ((modules (imported-modules modules
@@ -1374,6 +1378,12 @@ they can refer to each other."
                       (srfi srfi-26)
                       (system base compile))
 
+         ;; TODO: Inline this on the next rebuild cycle.
+         (ungexp-splicing
+          (if target
+              (gexp ((use-modules (system base target))))
+              (gexp ())))
+
          (define (regular? file)
            (not (member file '("." ".."))))
 
@@ -1391,9 +1401,19 @@ they can refer to each other."
                                                    (gexp ()))))
                          (ungexp (* total (if pre-load-modules? 2 1)))
                          entry)
-                 (compile-file entry
-                               #:output-file output
-                               #:opts %auto-compilation-options)
+
+                 (ungexp-splicing
+                  (if target
+                      (gexp ((with-target (ungexp target)
+                               (lambda ()
+                                 (compile-file entry
+                                               #:output-file output
+                                               #:opts
+                                               %auto-compilation-options)))))
+                      (gexp ((compile-file entry
+                                           #:output-file output
+                                           #:opts %auto-compilation-options)))))
+
                  (+ 1 processed))))
 
          (define (process-directory directory output processed)
@@ -1494,7 +1514,7 @@ they can refer to each other."
               'guile-2.2))
 
 (define* (load-path-expression modules #:optional (path %load-path)
-                               #:key (extensions '()))
+                               #:key (extensions '()) system target)
   "Return as a monadic value a gexp that sets '%load-path' and
 '%load-compiled-path' to point to MODULES, a list of module names.  MODULES
 are searched for in PATH.  Return #f when MODULES and EXTENSIONS are empty."
@@ -1502,10 +1522,13 @@ are searched for in PATH.  Return #f when MODULES and EXTENSIONS are empty."
       (with-monad %store-monad
         (return #f))
       (mlet %store-monad ((modules  (imported-modules modules
-                                                      #:module-path path))
+                                                      #:module-path path
+                                                      #:system system))
                           (compiled (compiled-modules modules
                                                       #:extensions extensions
-                                                      #:module-path path)))
+                                                      #:module-path path
+                                                      #:system system
+                                                      #:target target)))
         (return (gexp (eval-when (expand load eval)
                         (set! %load-path
                           (cons (ungexp modules)
@@ -1527,14 +1550,18 @@ are searched for in PATH.  Return #f when MODULES and EXTENSIONS are empty."
 
 (define* (gexp->script name exp
                        #:key (guile (default-guile))
-                       (module-path %load-path))
+                       (module-path %load-path)
+                       (system (%current-system))
+                       target)
   "Return an executable script NAME that runs EXP using GUILE, with EXP's
 imported modules in its search path.  Look up EXP's modules in MODULE-PATH."
   (mlet %store-monad ((set-load-path
                        (load-path-expression (gexp-modules exp)
                                              module-path
                                              #:extensions
-                                             (gexp-extensions exp))))
+                                             (gexp-extensions exp)
+                                             #:system system
+                                             #:target target)))
     (gexp->derivation name
                       (gexp
                        (call-with-output-file (ungexp output)
@@ -1554,6 +1581,8 @@ imported modules in its search path.  Look up EXP's modules in MODULE-PATH."
 
                            (write '(ungexp exp) port)
                            (chmod port #o555))))
+                      #:system system
+                      #:target target
                       #:module-path module-path)))
 
 (define* (gexp->file name exp #:key
diff --git a/guix/git-download.scm b/guix/git-download.scm
index f904d11c25..8f84681d46 100644
--- a/guix/git-download.scm
+++ b/guix/git-download.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Mathieu Lirzin <mthl@gnu.org>
 ;;; Copyright © 2017 Christopher Baines <mail@cbaines.net>
 ;;;
@@ -85,7 +85,7 @@ HASH-ALGO (a symbol).  Use NAME as the file name, or a generic name if #f."
     (module-ref (resolve-interface '(gnu packages compression)) 'zlib))
 
   (define guile-json
-    (module-ref (resolve-interface '(gnu packages guile)) 'guile-json))
+    (module-ref (resolve-interface '(gnu packages guile)) 'guile-json-3))
 
   (define gnutls
     (module-ref (resolve-interface '(gnu packages tls)) 'gnutls))
diff --git a/guix/git.scm b/guix/git.scm
index 289537dedf..de98fed40c 100644
--- a/guix/git.scm
+++ b/guix/git.scm
@@ -139,29 +139,44 @@ of SHA1 string."
   "Switch to REPOSITORY's branch, commit or tag specified by REF.  Return the
 OID (roughly the commit hash) corresponding to REF."
   (define obj
-    (match ref
-      (('branch . branch)
-       (let ((oid (reference-target
-                   (branch-lookup repository branch BRANCH-REMOTE))))
-         (object-lookup repository oid)))
-      (('commit . commit)
-       (let ((len (string-length commit)))
-         ;; 'object-lookup-prefix' appeared in Guile-Git in Mar. 2018, so we
-         ;; can't be sure it's available.  Furthermore, 'string->oid' used to
-         ;; read out-of-bounds when passed a string shorter than 40 chars,
-         ;; which is why we delay calls to it below.
-         (if (< len 40)
-             (if (module-defined? (resolve-interface '(git object))
-                                  'object-lookup-prefix)
-                 (object-lookup-prefix repository (string->oid commit) len)
-                 (raise (condition
-                         (&message
-                          (message "long Git object ID is required")))))
-             (object-lookup repository (string->oid commit)))))
-      (('tag    . tag)
-       (let ((oid (reference-name->oid repository
-                                       (string-append "refs/tags/" tag))))
-         (object-lookup repository oid)))))
+    (let resolve ((ref ref))
+      (match ref
+        (('branch . branch)
+         (let ((oid (reference-target
+                     (branch-lookup repository branch BRANCH-REMOTE))))
+           (object-lookup repository oid)))
+        (('commit . commit)
+         (let ((len (string-length commit)))
+           ;; 'object-lookup-prefix' appeared in Guile-Git in Mar. 2018, so we
+           ;; can't be sure it's available.  Furthermore, 'string->oid' used to
+           ;; read out-of-bounds when passed a string shorter than 40 chars,
+           ;; which is why we delay calls to it below.
+           (if (< len 40)
+               (if (module-defined? (resolve-interface '(git object))
+                                    'object-lookup-prefix)
+                   (object-lookup-prefix repository (string->oid commit) len)
+                   (raise (condition
+                           (&message
+                            (message "long Git object ID is required")))))
+               (object-lookup repository (string->oid commit)))))
+        (('tag-or-commit . str)
+         (if (or (> (string-length str) 40)
+                 (not (string-every char-set:hex-digit str)))
+             (resolve `(tag . ,str))              ;definitely a tag
+             (catch 'git-error
+               (lambda ()
+                 (resolve `(tag . ,str)))
+               (lambda _
+                 ;; There's no such tag, so it must be a commit ID.
+                 (resolve `(commit . ,str))))))
+        (('tag    . tag)
+         (let ((oid (reference-name->oid repository
+                                         (string-append "refs/tags/" tag))))
+           ;; Get the commit that the tag at OID refers to.  This is not
+           ;; strictly needed, but it's more consistent to always return the
+           ;; OID of a commit.
+           (object-lookup repository
+                          (tag-target-id (tag-lookup repository oid))))))))
 
   (reset repository obj RESET_HARD)
   (object-id obj))
@@ -218,8 +233,8 @@ please upgrade Guile-Git.~%"))))
 values: the cache directory name, and the SHA1 commit (a string) corresponding
 to REF.
 
-REF is pair whose key is [branch | commit | tag] and value the associated
-data, respectively [<branch name> | <sha1> | <tag name>].
+REF is pair whose key is [branch | commit | tag | tag-or-commit ] and value
+the associated data: [<branch name> | <sha1> | <tag name> | <string>].
 
 When RECURSIVE? is true, check out submodules as well, if any."
   (define canonical-ref
@@ -319,7 +334,7 @@ Log progress and checkout info to LOG-PORT."
   git-checkout?
   (url     git-checkout-url)
   (branch  git-checkout-branch (default "master"))
-  (commit  git-checkout-commit (default #f))
+  (commit  git-checkout-commit (default #f))      ;#f | tag | commit
   (recursive? git-checkout-recursive? (default #f)))
 
 (define* (latest-repository-commit* url #:key ref recursive? log-port)
@@ -358,7 +373,7 @@ Log progress and checkout info to LOG-PORT."
     (($ <git-checkout> url branch commit recursive?)
      (latest-repository-commit* url
                                 #:ref (if commit
-                                          `(commit . ,commit)
+                                          `(tag-or-commit . ,commit)
                                           `(branch . ,branch))
                                 #:recursive? recursive?
                                 #:log-port (current-error-port)))))
diff --git a/guix/import/cpan.scm b/guix/import/cpan.scm
index d4bea84353..ec86f11743 100644
--- a/guix/import/cpan.scm
+++ b/guix/import/cpan.scm
@@ -76,8 +76,8 @@
    ;; ssleay
    ;; sun
    ("zlib" 'zlib)
-   ((x) (string->license x))
-   ((lst ...) `(list ,@(map string->license lst)))
+   (#(x) (string->license x))
+   (#(lst ...) `(list ,@(map string->license lst)))
    (_ #f)))
 
 (define (module->name module)
@@ -88,10 +88,10 @@
   "Return the base distribution module for a given module.  E.g. the 'ok'
 module is distributed with 'Test::Simple', so (module->dist-name \"ok\") would
 return \"Test-Simple\""
-  (assoc-ref (json-fetch-alist (string-append
-                                "https://fastapi.metacpan.org/v1/module/"
-                                module
-                                "?fields=distribution"))
+  (assoc-ref (json-fetch (string-append
+                          "https://fastapi.metacpan.org/v1/module/"
+                          module
+                          "?fields=distribution"))
              "distribution"))
 
 (define (package->upstream-name package)
@@ -114,7 +114,7 @@ return \"Test-Simple\""
   "Return an alist representation of the CPAN metadata for the perl module MODULE,
 or #f on failure.  MODULE should be e.g. \"Test::Script\""
   ;; This API always returns the latest release of the module.
-  (json-fetch-alist (string-append "https://fastapi.metacpan.org/v1/release/" name)))
+  (json-fetch (string-append "https://fastapi.metacpan.org/v1/release/" name)))
 
 (define (cpan-home name)
   (string-append "https://metacpan.org/release/" name))
diff --git a/guix/import/crate.scm b/guix/import/crate.scm
index 29318aac0e..52c5cb1c30 100644
--- a/guix/import/crate.scm
+++ b/guix/import/crate.scm
@@ -51,7 +51,7 @@
   (define (crate-kind-predicate kind)
     (lambda (dep) (string=? (assoc-ref dep "kind") kind)))
 
-  (and-let* ((crate-json (json-fetch-alist (string-append crate-url crate-name)))
+  (and-let* ((crate-json (json-fetch (string-append crate-url crate-name)))
              (crate (assoc-ref crate-json "crate"))
              (name (assoc-ref crate "name"))
              (version (assoc-ref crate "max_version"))
@@ -63,8 +63,8 @@
                                  string->license)
                           '()))                   ;missing license info
              (path (string-append "/" version "/dependencies"))
-             (deps-json (json-fetch-alist (string-append crate-url name path)))
-             (deps (assoc-ref deps-json "dependencies"))
+             (deps-json (json-fetch (string-append crate-url name path)))
+             (deps (vector->list (assoc-ref deps-json "dependencies")))
              (dep-crates (filter (crate-kind-predicate "normal") deps))
              (dev-dep-crates
               (filter (lambda (dep)
diff --git a/guix/import/gem.scm b/guix/import/gem.scm
index ea576b5e4a..0bf9ff2552 100644
--- a/guix/import/gem.scm
+++ b/guix/import/gem.scm
@@ -40,7 +40,7 @@
 (define (rubygems-fetch name)
   "Return an alist representation of the RubyGems metadata for the package NAME,
 or #f on failure."
-  (json-fetch-alist
+  (json-fetch
    (string-append "https://rubygems.org/api/v1/gems/" name ".json")))
 
 (define (ruby-package-name name)
@@ -130,14 +130,18 @@ VERSION, HASH, HOME-PAGE, DESCRIPTION, DEPENDENCIES, and LICENSES."
                                (assoc-ref package "info")))
                 (home-page    (assoc-ref package "homepage_uri"))
                 (dependencies-names (map (lambda (dep) (assoc-ref dep "name"))
-                                         (assoc-ref* package "dependencies" "runtime")))
+                                         (vector->list
+                                          (assoc-ref* package
+                                                      "dependencies"
+                                                      "runtime"))))
                 (dependencies (map (lambda (dep)
                                      (if (string=? dep "bundler")
                                          "bundler" ; special case, no prefix
                                          (ruby-package-name dep)))
                                    dependencies-names))
                 (licenses     (map string->license
-                                   (assoc-ref package "licenses"))))
+                                   (vector->list
+                                    (assoc-ref package "licenses")))))
            (values (make-gem-sexp name version hash home-page synopsis
                                   description dependencies licenses)
                    dependencies-names)))))
diff --git a/guix/import/github.scm b/guix/import/github.scm
index cdac70420a..fa23fa4c06 100644
--- a/guix/import/github.scm
+++ b/guix/import/github.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
-;;; Copyright © 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2018 Eric Bavier <bavier@member.fsf.org>
 ;;; Copyright © 2019 Arun Isaac <arunisaac@systemreboot.net>
 ;;;
@@ -130,7 +130,7 @@ repository separated by a forward slash, from a string URL of the form
 
 (define (fetch-releases-or-tags url)
   "Fetch the list of \"releases\" or, if it's empty, the list of tags for the
-repository at URL.  Return the corresponding JSON dictionaries (hash tables),
+repository at URL.  Return the corresponding JSON dictionaries (alists),
 or #f if the information could not be retrieved.
 
 We look at both /releases and /tags because the \"release\" feature of GitHub
@@ -172,11 +172,11 @@ empty list."
 'https://github.com/arq5x/bedtools2/archive/v2.24.0.tar.gz' and the name of
 the package e.g. 'bedtools2'.  Return #f if there is no releases"
   (define (pre-release? x)
-    (hash-ref x "prerelease"))
+    (assoc-ref x "prerelease"))
 
   (define (release->version release)
-    (let ((tag (or (hash-ref release "tag_name") ;a "release"
-                   (hash-ref release "name")))   ;a tag
+    (let ((tag (or (assoc-ref release "tag_name") ;a "release"
+                   (assoc-ref release "name")))   ;a tag
           (name-length (string-length package-name)))
       (cond
        ;; some tags include the name of the package e.g. "fdupes-1.51"
@@ -197,7 +197,8 @@ the package e.g. 'bedtools2'.  Return #f if there is no releases"
         tag)
        (else #f))))
 
-  (let* ((json (fetch-releases-or-tags url)))
+  (let* ((json (and=> (fetch-releases-or-tags url)
+                      vector->list)))
     (if (eq? json #f)
         (if (%github-token)
             (error "Error downloading release information through the GitHub
diff --git a/guix/import/json.scm b/guix/import/json.scm
index 81ea5e7b31..8900724dcd 100644
--- a/guix/import/json.scm
+++ b/guix/import/json.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015, 2016 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -23,8 +23,7 @@
   #:use-module (guix http-client)
   #:use-module (guix import utils)
   #:use-module (srfi srfi-34)
-  #:export (json-fetch
-            json-fetch-alist))
+  #:export (json-fetch))
 
 (define* (json-fetch url
                      ;; Note: many websites returns 403 if we omit a
@@ -43,9 +42,3 @@ the query."
            (result (json->scm port)))
       (close-port port)
       result)))
-
-(define (json-fetch-alist url)
-  "Return an alist representation of the JSON resource URL, or #f if URL
-returns 403 or 404."
-  (and=> (json-fetch url)
-         hash-table->alist))
diff --git a/guix/import/launchpad.scm b/guix/import/launchpad.scm
index ffd5e9221e..1a15f28077 100644
--- a/guix/import/launchpad.scm
+++ b/guix/import/launchpad.scm
@@ -87,15 +87,16 @@ for example, 'linuxdcpp'. Return #f if there is no releases."
     ;; example, "5.1.0-rc1") are assumed to be pre-releases.
     (not (string-every (char-set-union (char-set #\.)
                                        char-set:digit)
-                       (hash-ref x "version"))))
+                       (assoc-ref x "version"))))
 
-  (hash-ref
+  (assoc-ref
    (last (remove
           pre-release?
-          (hash-ref (json-fetch
-                     (string-append "https://api.launchpad.net/1.0/"
-                                    package-name "/releases"))
-                    "entries")))
+          (vector->list
+           (assoc-ref (json-fetch
+                       (string-append "https://api.launchpad.net/1.0/"
+                                      package-name "/releases"))
+                      "entries"))))
    "version"))
 
 (define (latest-release pkg)
diff --git a/guix/import/pypi.scm b/guix/import/pypi.scm
index ab7a024ee0..9b3d80a02e 100644
--- a/guix/import/pypi.scm
+++ b/guix/import/pypi.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015 Cyril Roelandt <tipecaml@gmail.com>
-;;; Copyright © 2015, 2016, 2017 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019 Maxim Cournoyer <maxim.cournoyer@gmail.com>
@@ -56,7 +56,7 @@
 (define (pypi-fetch name)
   "Return an alist representation of the PyPI metadata for the package NAME,
 or #f on failure."
-  (json-fetch-alist (string-append "https://pypi.org/pypi/" name "/json")))
+  (json-fetch (string-append "https://pypi.org/pypi/" name "/json")))
 
 ;; For packages found on PyPI that lack a source distribution.
 (define-condition-type &missing-source-error &error
@@ -69,7 +69,7 @@ or #f on failure."
                               (assoc-ref* pypi-package "info" "version"))))
     (or (find (lambda (release)
                 (string=? "sdist" (assoc-ref release "packagetype")))
-              releases)
+              (vector->list releases))
         (raise (condition (&missing-source-error
                            (package pypi-package)))))))
 
@@ -80,7 +80,7 @@ or #f if there isn't any."
                               (assoc-ref* pypi-package "info" "version"))))
     (or (find (lambda (release)
                 (string=? "bdist_wheel" (assoc-ref release "packagetype")))
-              releases)
+              (vector->list releases))
         #f)))
 
 (define (python->package-name name)
diff --git a/guix/import/stackage.scm b/guix/import/stackage.scm
index 1c1e73a723..194bea633e 100644
--- a/guix/import/stackage.scm
+++ b/guix/import/stackage.scm
@@ -60,7 +60,7 @@
      (let* ((url (if (string=? "" version)
                      (string-append %stackage-url "/lts")
                      (string-append %stackage-url "/lts-" version)))
-            (lts-info (json-fetch-alist url)))
+            (lts-info (json-fetch url)))
        (if lts-info
            (reverse lts-info)
            (leave-with-message "LTS release version not found: ~a" version))))))
@@ -74,7 +74,7 @@
 (define (lts-package-version pkgs-info name)
   "Return the version of the package with upstream NAME included in PKGS-INFO."
   (let ((pkg (find (lambda (pkg) (string=? (stackage-package-name pkg) name))
-                   pkgs-info)))
+                   (vector->list pkgs-info))))
     (stackage-package-version pkg)))
 
 
diff --git a/guix/import/utils.scm b/guix/import/utils.scm
index 84503ab907..2a3b7341fb 100644
--- a/guix/import/utils.scm
+++ b/guix/import/utils.scm
@@ -45,7 +45,6 @@
   #:use-module (srfi srfi-41)
   #:export (factorize-uri
 
-            hash-table->alist
             flatten
             assoc-ref*
 
@@ -100,21 +99,6 @@ of the string VERSION is replaced by the symbol 'version."
                '()
                indices))))))
 
-(define (hash-table->alist table)
-  "Return an alist represenation of TABLE."
-  (map (match-lambda
-        ((key . (lst ...))
-         (cons key
-               (map (lambda (x)
-                      (if (hash-table? x)
-                          (hash-table->alist x)
-                          x))
-                    lst)))
-        ((key . (? hash-table? table))
-         (cons key (hash-table->alist table)))
-        (pair pair))
-       (hash-map->list cons table)))
-
 (define (flatten lst)
   "Return a list that recursively concatenates all sub-lists of LST."
   (fold-right
@@ -330,11 +314,14 @@ the expected fields of an <origin> object."
       (lookup-build-system-by-name
        (string->symbol (assoc-ref meta "build-system"))))
     (native-inputs
-     (specs->package-lists (or (assoc-ref meta "native-inputs") '())))
+     (specs->package-lists
+      (vector->list (or (assoc-ref meta "native-inputs") '#()))))
     (inputs
-     (specs->package-lists (or (assoc-ref meta "inputs") '())))
+     (specs->package-lists
+      (vector->list (or (assoc-ref meta "inputs") '#()))))
     (propagated-inputs
-     (specs->package-lists (or (assoc-ref meta "propagated-inputs") '())))
+     (specs->package-lists
+      (vector->list (or (assoc-ref meta "propagated-inputs") '#()))))
     (home-page
      (assoc-ref meta "home-page"))
     (synopsis
diff --git a/guix/scripts/build.scm b/guix/scripts/build.scm
index ec58ba871b..3ee0b737fe 100644
--- a/guix/scripts/build.scm
+++ b/guix/scripts/build.scm
@@ -341,10 +341,15 @@ strings like \"guile-next=cabba9e\" meaning that packages are built using
   (define (replace old url commit)
     (package
       (inherit old)
-      (version (string-append "git."
-                              (if (< (string-length commit) 7)
-                                  commit
-                                  (string-take commit 7))))
+      (version (if (and (> (string-length commit) 1)
+                        (string-prefix? "v" commit)
+                        (char-set-contains? char-set:digit
+                                            (string-ref commit 1)))
+                   (string-drop commit 1)        ;looks like a tag like "v1.0"
+                   (string-append "git."
+                                  (if (< (string-length commit) 7)
+                                      commit
+                                      (string-take commit 7)))))
       (source (git-checkout (url url) (commit commit)
                             (recursive? #t)))))
 
diff --git a/guix/scripts/deploy.scm b/guix/scripts/deploy.scm
index 978cfb2a81..52bba3f3bf 100644
--- a/guix/scripts/deploy.scm
+++ b/guix/scripts/deploy.scm
@@ -23,6 +23,8 @@
   #:use-module (guix scripts build)
   #:use-module (guix store)
   #:use-module (guix ui)
+  #:use-module (guix utils)
+  #:use-module (guix grafts)
   #:use-module (ice-9 format)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-37)
@@ -40,6 +42,8 @@
 (define (show-help)
   (display (G_ "Usage: guix deploy [OPTION] FILE...
 Perform the deployment specified by FILE.\n"))
+  (display (G_ "
+  -s, --system=SYSTEM    attempt to build for SYSTEM--e.g., \"i686-linux\""))
   (show-build-options-help)
   (newline)
   (display (G_ "
@@ -54,10 +58,14 @@ Perform the deployment specified by FILE.\n"))
                  (lambda args
                    (show-help)
                    (exit 0)))
+         (option '(#\s "system") #t #f
+                 (lambda (opt name arg result)
+                   (alist-cons 'system arg
+                               (alist-delete 'system result eq?))))
          %standard-build-options))
 
 (define %default-options
-  '((system . ,(%current-system))
+  `((system . ,(%current-system))
     (substitutes? . #t)
     (build-hook? . #t)
     (graft? . #t)
@@ -80,5 +88,7 @@ Perform the deployment specified by FILE.\n"))
       (set-build-options-from-command-line store opts)
       (for-each (lambda (machine)
                   (info (G_ "deploying to ~a...") (machine-display-name machine))
-                  (run-with-store store (deploy-machine machine)))
+                  (parameterize ((%current-system (assq-ref opts 'system))
+                                 (%graft? (assq-ref opts 'graft?)))
+                    (run-with-store store (deploy-machine machine))))
                 machines))))
diff --git a/guix/scripts/import/json.scm b/guix/scripts/import/json.scm
index 8771e7b0eb..c9daf65479 100644
--- a/guix/scripts/import/json.scm
+++ b/guix/scripts/import/json.scm
@@ -93,7 +93,7 @@ Import and convert the JSON package definition in PACKAGE-FILE.\n"))
            (let ((json (json-string->scm
                         (with-input-from-file file-name read-string))))
              ;; TODO: also print define-module boilerplate
-             (package->code (alist->package (hash-table->alist json)))))
+             (package->code (alist->package json))))
          (lambda _
            (leave (G_ "invalid JSON in file '~a'~%") file-name))))
       (()
diff --git a/guix/scripts/pack.scm b/guix/scripts/pack.scm
index 01472d9768..fdb98983bf 100644
--- a/guix/scripts/pack.scm
+++ b/guix/scripts/pack.scm
@@ -479,7 +479,7 @@ the image."
 
   (define build
     ;; Guile-JSON and Guile-Gcrypt are required by (guix docker).
-    (with-extensions (list guile-json guile-gcrypt)
+    (with-extensions (list guile-json-3 guile-gcrypt)
       (with-imported-modules `(((guix config) => ,(make-config.scm))
                                ,@(source-module-closure
                                   `((guix docker)
diff --git a/guix/scripts/system.scm b/guix/scripts/system.scm
index 67a4071684..9fc3a10e98 100644
--- a/guix/scripts/system.scm
+++ b/guix/scripts/system.scm
@@ -41,6 +41,7 @@
                                        delete-matching-generations)
   #:use-module (guix graph)
   #:use-module (guix scripts graph)
+  #:use-module (guix scripts system reconfigure)
   #:use-module (guix build utils)
   #:use-module (guix progress)
   #:use-module ((guix build syscalls) #:select (terminal-columns))
@@ -178,43 +179,9 @@ TARGET, and register them."
 
     (return *unspecified*)))
 
-(define* (install-bootloader installer
-                             #:key
-                             bootcfg bootcfg-file
-                             target)
-  "Run INSTALLER, a bootloader installation script, with error handling, in
-%STORE-MONAD."
-  (mlet %store-monad ((installer-drv (if installer
-                                         (lower-object installer)
-                                         (return #f)))
-                      (bootcfg       (lower-object bootcfg)))
-    (let* ((gc-root      (string-append target %gc-roots-directory
-                                        "/bootcfg"))
-           (temp-gc-root (string-append gc-root ".new"))
-           (install (and installer-drv
-                         (derivation->output-path installer-drv)))
-           (bootcfg (derivation->output-path bootcfg)))
-      ;; Prepare the symlink to bootloader config file to make sure that it's
-      ;; a GC root when 'installer-drv' completes (being a bit paranoid.)
-      (switch-symlinks temp-gc-root bootcfg)
-
-      (unless (false-if-exception
-               (begin
-                 (install-boot-config bootcfg bootcfg-file target)
-                 (when install
-                   (save-load-path-excursion (primitive-load install)))))
-        (delete-file temp-gc-root)
-        (leave (G_ "failed to install bootloader ~a~%") install))
-
-      ;; Register bootloader config file as a GC root so that its dependencies
-      ;; (background image, font, etc.) are not reclaimed.
-      (rename-file temp-gc-root gc-root)
-      (return #t))))
-
 (define* (install os-drv target
                   #:key (log-port (current-output-port))
-                  bootloader-installer install-bootloader?
-                  bootcfg bootcfg-file)
+                  install-bootloader? bootloader bootcfg)
   "Copy the closure of BOOTCFG, which includes the output of OS-DRV, to
 directory TARGET.  TARGET must be an absolute directory name since that's what
 'register-path' expects.
@@ -265,10 +232,11 @@ the ownership of '~a' may be incorrect!~%")
         (populate os-dir target)
 
         (mwhen install-bootloader?
-          (install-bootloader bootloader-installer
-                              #:bootcfg bootcfg
-                              #:bootcfg-file bootcfg-file
-                              #:target target))))))
+          (install-bootloader local-eval bootloader bootcfg
+                              #:target target)
+          (return
+           (info (G_ "bootloader successfully installed on '~a'~%")
+                 (bootloader-configuration-target bootloader))))))))
 
 
 ;;;
@@ -335,82 +303,6 @@ unload."
        (warning (G_ "failed to obtain list of shepherd services~%"))
        (return #f)))))
 
-(define (upgrade-shepherd-services os)
-  "Upgrade the Shepherd (PID 1) by unloading obsolete services and loading new
-services specified in OS and not currently running.
-
-This is currently very conservative in that it does not stop or unload any
-running service.  Unloading or stopping the wrong service ('udev', say) could
-bring the system down."
-  (define new-services
-    (service-value
-     (fold-services (operating-system-services os)
-                    #:target-type shepherd-root-service-type)))
-
-  ;; Arrange to simply emit a warning if the service upgrade fails.
-  (with-shepherd-error-handling
-   (call-with-service-upgrade-info new-services
-     (lambda (to-restart to-unload)
-        (for-each (lambda (unload)
-                    (info (G_ "unloading service '~a'...~%") unload)
-                    (unload-service unload))
-                  to-unload)
-
-        (with-monad %store-monad
-          (munless (null? new-services)
-            (let ((new-service-names  (map shepherd-service-canonical-name new-services))
-                  (to-restart-names   (map shepherd-service-canonical-name to-restart))
-                  (to-start           (filter shepherd-service-auto-start? new-services)))
-              (info (G_ "loading new services:~{ ~a~}...~%") new-service-names)
-              (unless (null? to-restart-names)
-                ;; Listing TO-RESTART-NAMES in the message below wouldn't help
-                ;; because many essential services cannot be meaningfully
-                ;; restarted.  See <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22039#30>.
-                (format #t (G_ "To complete the upgrade, run 'herd restart SERVICE' to stop,
-upgrade, and restart each service that was not automatically restarted.\n")))
-              (mlet %store-monad ((files (mapm %store-monad
-                                               (compose lower-object
-                                                        shepherd-service-file)
-                                               new-services)))
-                ;; Here we assume that FILES are exactly those that were computed
-                ;; as part of the derivation that built OS, which is normally the
-                ;; case.
-                (load-services/safe (map derivation->output-path files))
-
-                (for-each start-service
-                          (map shepherd-service-canonical-name to-start))
-                (return #t)))))))))
-
-(define* (switch-to-system os
-                           #:optional (profile %system-profile))
-  "Make a new generation of PROFILE pointing to the directory of OS, switch to
-it atomically, and then run OS's activation script."
-  (mlet* %store-monad ((drv (operating-system-derivation os))
-                       (script (lower-object (operating-system-activation-script os))))
-    (let* ((system     (derivation->output-path drv))
-           (number     (+ 1 (generation-number profile)))
-           (generation (generation-file-name profile number)))
-      (switch-symlinks generation system)
-      (switch-symlinks profile generation)
-
-      (format #t (G_ "activating system...~%"))
-
-      ;; The activation script may change $PATH, among others, so protect
-      ;; against that.
-      (save-environment-excursion
-       ;; Tell 'activate-current-system' what the new system is.
-       (setenv "GUIX_NEW_SYSTEM" system)
-
-       ;; The activation script may modify '%load-path' & co., so protect
-       ;; against that.  This is necessary to ensure that
-       ;; 'upgrade-shepherd-services' gets to see the right modules when it
-       ;; computes derivations with 'gexp->derivation'.
-       (save-load-path-excursion
-        (primitive-load (derivation->output-path script))))
-
-      ;; Finally, try to update system services.
-      (upgrade-shepherd-services os))))
-
 (define-syntax-rule (unless-file-not-found exp)
   (catch 'system-error
     (lambda ()
@@ -505,18 +397,13 @@ STORE is an open connection to the store."
                      ((bootloader-configuration-file-generator bootloader)
                       bootloader-config entries
                       #:old-entries old-entries)))
-           (bootcfg-file -> (bootloader-configuration-file bootloader))
-           (target -> "/")
            (drvs -> (list bootcfg)))
         (mbegin %store-monad
           (show-what-to-build* drvs)
           (built-derivations drvs)
-          ;; Only install bootloader configuration file. Thus, no installer is
-          ;; provided here.
-          (install-bootloader #f
-                              #:bootcfg bootcfg
-                              #:bootcfg-file bootcfg-file
-                              #:target target))))))
+          ;; Only install bootloader configuration file.
+          (install-bootloader local-eval bootloader-config bootcfg
+                              #:run-installer? #f))))))
 
 
 ;;;
@@ -820,8 +707,17 @@ and TARGET arguments."
                                         (condition-message c))
                                 (exit 1)))
                        (#$installer #$bootloader #$device #$target)
-                       (format #t "bootloader successfully installed on '~a'~%"
-                               #$device))))))
+                       (info (G_ "bootloader successfully installed on '~a'~%")
+                             #$device))))))
+
+(define (local-eval exp)
+  "Evaluate EXP, a G-Expression, in-place."
+  (mlet* %store-monad ((lowered (lower-gexp exp))
+                       (_ (built-derivations (lowered-gexp-inputs lowered))))
+    (save-load-path-excursion
+     (set! %load-path (lowered-gexp-load-path lowered))
+     (set! %load-compiled-path (lowered-gexp-load-compiled-path lowered))
+     (return (primitive-eval (lowered-gexp-sexp lowered))))))
 
 (define* (perform-action action os
                          #:key skip-safety-checks?
@@ -858,19 +754,12 @@ static checks."
         (map boot-parameters->menu-entry (profile-boot-parameters))))
 
   (define bootloader
-    (bootloader-configuration-bootloader (operating-system-bootloader os)))
+    (operating-system-bootloader os))
 
   (define bootcfg
     (and (memq action '(init reconfigure))
          (operating-system-bootcfg os menu-entries)))
 
-  (define bootloader-script
-    (let ((installer (bootloader-installer bootloader))
-          (target    (or target "/")))
-      (bootloader-installer-script installer
-                                   (bootloader-package bootloader)
-                                   bootloader-target target)))
-
   (when (eq? action 'reconfigure)
     (maybe-suggest-running-guix-pull))
 
@@ -897,9 +786,7 @@ static checks."
        ;; See <http://bugs.gnu.org/21068>.
        (drvs      (mapm %store-monad lower-object
                         (if (memq action '(init reconfigure))
-                            (if install-bootloader?
-                                (list sys bootcfg bootloader-script)
-                                (list sys bootcfg))
+                            (list sys bootcfg)
                             (list sys))))
        (%         (if derivations-only?
                       (return (for-each (compose println derivation-file-name)
@@ -909,28 +796,32 @@ static checks."
 
     (if (or dry-run? derivations-only?)
         (return #f)
-        (let ((bootcfg-file (bootloader-configuration-file bootloader)))
+        (begin
           (for-each (compose println derivation->output-path)
                     drvs)
 
           (case action
             ((reconfigure)
+             (newline)
+             (format #t (G_ "activating system...~%"))
              (mbegin %store-monad
-               (switch-to-system os)
+               (switch-to-system local-eval os)
                (mwhen install-bootloader?
-                 (install-bootloader bootloader-script
-                                     #:bootcfg bootcfg
-                                     #:bootcfg-file bootcfg-file
-                                     #:target "/"))))
+                 (install-bootloader local-eval bootloader bootcfg
+                                     #:target (or target "/"))
+                 (return
+                  (info (G_ "bootloader successfully installed on '~a'~%")
+                        (bootloader-configuration-target bootloader))))
+               (with-shepherd-error-handling
+                  (upgrade-shepherd-services local-eval os))))
             ((init)
              (newline)
              (format #t (G_ "initializing operating system under '~a'...~%")
                      target)
              (install sys (canonicalize-path target)
                       #:install-bootloader? install-bootloader?
-                      #:bootcfg bootcfg
-                      #:bootcfg-file bootcfg-file
-                      #:bootloader-installer bootloader-script))
+                      #:bootloader bootloader
+                      #:bootcfg bootcfg))
             (else
              ;; All we had to do was to build SYS and maybe register an
              ;; indirect GC root.
diff --git a/guix/scripts/system/reconfigure.scm b/guix/scripts/system/reconfigure.scm
new file mode 100644
index 0000000000..dee0c24bd2
--- /dev/null
+++ b/guix/scripts/system/reconfigure.scm
@@ -0,0 +1,232 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2016 Alex Kost <alezost@gmail.com>
+;;; Copyright © 2016, 2017, 2018 Chris Marusich <cmmarusich@gmail.com>
+;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2019 Christopher Baines <mail@cbaines.net>
+;;; Copyright © 2019 Jakob L. Kreuze <zerodaysfordays@sdf.lonestar.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (guix scripts system reconfigure)
+  #:autoload   (gnu packages gnupg) (guile-gcrypt)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu services)
+  #:use-module (gnu services herd)
+  #:use-module (gnu services shepherd)
+  #:use-module (gnu system)
+  #:use-module (guix gexp)
+  #:use-module (guix modules)
+  #:use-module (guix monads)
+  #:use-module (guix store)
+  #:use-module (ice-9 match)
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-11)
+  #:export (switch-system-program
+            switch-to-system
+
+            upgrade-services-program
+            upgrade-shepherd-services
+
+            install-bootloader-program
+            install-bootloader))
+
+;;; Commentary:
+;;;
+;;; This module implements the "effectful" parts of system
+;;; reconfiguration. Although building a system derivation is a pure
+;;; operation, a number of impure operations must be carried out for the
+;;; system configuration to be realized -- chiefly, creation of generation
+;;; symlinks and invocation of activation scripts.
+;;;
+;;; Code:
+
+
+;;;
+;;; Profile creation.
+;;;
+
+(define* (switch-system-program os #:optional profile)
+  "Return an executable store item that, upon being evaluated, will create a
+new generation of PROFILE pointing to the directory of OS, switch to it
+atomically, and run OS's activation script."
+  (program-file
+   "switch-to-system.scm"
+   (with-extensions (list guile-gcrypt)
+     (with-imported-modules (source-module-closure '((guix config)
+                                                     (guix profiles)
+                                                     (guix utils)))
+       #~(begin
+           (use-modules (guix config)
+                        (guix profiles)
+                        (guix utils))
+
+           (define profile
+             (or #$profile (string-append %state-directory "/profiles/system")))
+
+           (let* ((number (1+ (generation-number profile)))
+                  (generation (generation-file-name profile number)))
+             (switch-symlinks generation #$os)
+             (switch-symlinks profile generation)
+             (setenv "GUIX_NEW_SYSTEM" #$os)
+             (primitive-load #$(operating-system-activation-script os))))))))
+
+(define* (switch-to-system eval os #:optional profile)
+  "Using EVAL, a monadic procedure taking a single G-Expression as an argument,
+create a new generation of PROFILE pointing to the directory of OS, switch to
+it atomically, and run OS's activation script."
+  (eval #~(primitive-load #$(switch-system-program os profile))))
+
+
+;;;
+;;; Services.
+;;;
+
+(define (running-services eval)
+  "Using EVAL, a monadic procedure taking a single G-Expression as an argument,
+return the <live-service> objects that are currently running on MACHINE."
+  (define exp
+    (with-imported-modules '((gnu services herd))
+      #~(begin
+          (use-modules (gnu services herd))
+          (let ((services (current-services)))
+            (and services
+                 ;; 'live-service-running' is ignored, as we can't necessarily
+                 ;; serialize arbitrary objects. This should be fine for now,
+                 ;; since 'machine-current-services' is not exposed publicly,
+                 ;; and the resultant <live-service> objects are only used for
+                 ;; resolving service dependencies.
+                 (map (lambda (service)
+                        (list (live-service-provision service)
+                              (live-service-requirement service)))
+                      services))))))
+  (mlet %store-monad ((services (eval exp)))
+    (return (map (match-lambda
+                   ((provision requirement)
+                    (live-service provision requirement #f)))
+                 services))))
+
+;; XXX: Currently, this does NOT attempt to restart running services. See
+;; <https://issues.guix.info/issue/33508> for details.
+(define (upgrade-services-program service-files to-start to-unload to-restart)
+  "Return an executable store item that, upon being evaluated, will upgrade
+the Shepherd (PID 1) by unloading obsolete services and loading new
+services. SERVICE-FILES is a list of Shepherd service files to load, and
+TO-START, TO-UNLOAD, and TO-RESTART are lists of the Shepherd services'
+canonical names (symbols)."
+  (program-file
+   "upgrade-shepherd-services.scm"
+   (with-imported-modules '((gnu services herd))
+    #~(begin
+        (use-modules (gnu services herd)
+                     (srfi srfi-1))
+
+        ;; Load the service files for any new services.
+        (load-services/safe '#$service-files)
+
+        ;; Unload obsolete services and start new services.
+        (for-each unload-service '#$to-unload)
+        (for-each start-service '#$to-start)))))
+
+(define* (upgrade-shepherd-services eval os)
+  "Using EVAL, a monadic procedure taking a single G-Expression as an argument,
+upgrade the Shepherd (PID 1) by unloading obsolete services and loading new
+services as defined by OS."
+  (define target-services
+    (service-value
+     (fold-services (operating-system-services os)
+                    #:target-type shepherd-root-service-type)))
+
+  (mlet* %store-monad ((live-services (running-services eval)))
+    (let*-values (((to-unload to-restart)
+                   (shepherd-service-upgrade live-services target-services)))
+      (let* ((to-unload (map live-service-canonical-name to-unload))
+             (to-restart (map shepherd-service-canonical-name to-restart))
+             (to-start (lset-difference eqv?
+                                        (map shepherd-service-canonical-name
+                                             target-services)
+                                        (map live-service-canonical-name
+                                             live-services)))
+             (service-files (map shepherd-service-file target-services)))
+        (eval #~(primitive-load #$(upgrade-services-program service-files
+                                                            to-start
+                                                            to-unload
+                                                            to-restart)))))))
+
+
+;;;
+;;; Bootloader configuration.
+;;;
+
+(define (install-bootloader-program installer bootloader-package bootcfg
+                                    bootcfg-file device target)
+  "Return an executable store item that, upon being evaluated, will install
+BOOTCFG to BOOTCFG-FILE, a target file name, on DEVICE, a file system device,
+at TARGET, a mount point, and subsequently run INSTALLER from
+BOOTLOADER-PACKAGE."
+  (program-file
+   "install-bootloader.scm"
+   (with-extensions (list guile-gcrypt)
+     (with-imported-modules (source-module-closure '((gnu build bootloader)
+                                                     (gnu build install)
+                                                     (guix store)
+                                                     (guix utils)))
+       #~(begin
+           (use-modules (gnu build bootloader)
+                        (gnu build install)
+                        (guix build utils)
+                        (guix store)
+                        (guix utils)
+                        (ice-9 binary-ports)
+                        (srfi srfi-34)
+                        (srfi srfi-35))
+           (let* ((gc-root (string-append #$target %gc-roots-directory "/bootcfg"))
+                  (temp-gc-root (string-append gc-root ".new")))
+             (switch-symlinks temp-gc-root gc-root)
+             (install-boot-config #$bootcfg #$bootcfg-file #$target)
+             ;; Preserve the previous activation's garbage collector root
+             ;; until the bootloader installer has run, so that a failure in
+             ;; the bootloader's installer script doesn't leave the user with
+             ;; a broken installation.
+             (when #$installer
+               (catch #t
+                 (lambda ()
+                   (#$installer #$bootloader-package #$device #$target))
+                 (lambda args
+                   (delete-file temp-gc-root)
+                   (apply throw args))))
+             (rename-file temp-gc-root gc-root)))))))
+
+(define* (install-bootloader eval configuration bootcfg
+                             #:key
+                             (run-installer? #t)
+                             (target "/"))
+  "Using EVAL, a monadic procedure taking a single G-Expression as an argument,
+configure the bootloader on TARGET such that OS will be booted by default and
+additional configurations specified by MENU-ENTRIES can be selected."
+  (let* ((bootloader (bootloader-configuration-bootloader configuration))
+         (installer (and run-installer?
+                         (bootloader-installer bootloader)))
+         (package (bootloader-package bootloader))
+         (device (bootloader-configuration-target configuration))
+         (bootcfg-file (bootloader-configuration-file bootloader)))
+    (eval #~(primitive-load #$(install-bootloader-program installer
+                                                          package
+                                                          bootcfg
+                                                          bootcfg-file
+                                                          device
+                                                          target)))))
diff --git a/guix/self.scm b/guix/self.scm
index 838ede7690..f03fe01d0c 100644
--- a/guix/self.scm
+++ b/guix/self.scm
@@ -50,7 +50,7 @@
                (module-ref (resolve-interface module) variable))))
     (match-lambda
       ("guile"      (ref '(gnu packages commencement) 'guile-final))
-      ("guile-json" (ref '(gnu packages guile) 'guile-json))
+      ("guile-json" (ref '(gnu packages guile) 'guile-json-3))
       ("guile-ssh"  (ref '(gnu packages ssh)   'guile-ssh))
       ("guile-git"  (ref '(gnu packages guile) 'guile-git))
       ("guile-sqlite3" (ref '(gnu packages guile) 'guile-sqlite3))
diff --git a/guix/swh.scm b/guix/swh.scm
index d692f81806..df2a138f04 100644
--- a/guix/swh.scm
+++ b/guix/swh.scm
@@ -138,16 +138,16 @@ following SPEC, a series of field specifications."
                         (json->scm input))
                        ((string? input)
                         (json-string->scm input))
-                       ((hash-table? input)
+                       ((or (null? input) (pair? input))
                         input))))
       (let-syntax ((extract-field (syntax-rules ()
                                     ((_ table (field key json->value))
-                                     (json->value (hash-ref table key)))
+                                     (json->value (assoc-ref table key)))
                                     ((_ table (field key))
-                                     (hash-ref table key))
+                                     (assoc-ref table key))
                                     ((_ table (field))
-                                     (hash-ref table
-                                               (symbol->string 'field))))))
+                                     (assoc-ref table
+                                                (symbol->string 'field))))))
         (ctor (extract-field table spec) ...)))))
 
 (define-syntax-rule (define-json-mapping rtd ctor pred json->record
@@ -257,12 +257,13 @@ FALSE-IF-404? is true, return #f upon 404 responses."
   (target-url   branch-target-url))
 
 (define (json->branches branches)
-  (hash-map->list (lambda (key value)
-                    (make-branch key
-                                 (string->symbol
-                                  (hash-ref value "target_type"))
-                                 (hash-ref value "target_url")))
-                  branches))
+  (map (match-lambda
+         ((key . value)
+          (make-branch key
+                       (string->symbol
+                        (assoc-ref value "target_type"))
+                       (assoc-ref value "target_url"))))
+       branches))
 
 ;; <https://archive.softwareheritage.org/api/1/release/1f44934fb6e2cefccbecd4fa347025349fa9ff76/>
 (define-json-mapping <release> make-release release?
@@ -292,9 +293,10 @@ FALSE-IF-404? is true, return #f upon 404 responses."
   (license-url   content-license-url "license_url"))
 
 (define (json->checksums checksums)
-  (hash-map->list (lambda (key value)
-                    (cons key (base16-string->bytevector value)))
-                  checksums))
+  (map (match-lambda
+         ((key . value)
+          (cons key (base16-string->bytevector value))))
+       checksums))
 
 ;; <https://archive.softwareheritage.org/api/1/directory/27c69c5d298a43096a53affbf881e7b13f17bdcd/>
 (define-json-mapping <directory-entry> make-directory-entry directory-entry?
@@ -365,14 +367,15 @@ FALSE-IF-404? is true, return #f upon 404 responses."
   json->directory-entries)
 
 (define (json->directory-entries port)
-  (map json->directory-entry (json->scm port)))
+  (map json->directory-entry
+       (vector->list (json->scm port))))
 
 (define (origin-visits origin)
   "Return the list of visits of ORIGIN, a record as returned by
 'lookup-origin'."
   (call (swh-url (origin-visits-url origin))
         (lambda (port)
-          (map json->visit (json->scm port)))))
+          (map json->visit (vector->list (json->scm port))))))
 
 (define (visit-snapshot visit)
   "Return the snapshot corresponding to VISIT."
diff --git a/m4/guix.m4 b/m4/guix.m4
index d0c5ec0f08..716bfb08ec 100644
--- a/m4/guix.m4
+++ b/m4/guix.m4
@@ -174,6 +174,27 @@ AC_DEFUN([GUIX_CHECK_GUILE_SQLITE3], [
      fi])
 ])
 
+dnl GUIX_CHECK_GUILE_JSON
+dnl
+dnl Check whether a recent-enough Guile-JSON is available.
+AC_DEFUN([GUIX_CHECK_GUILE_JSON], [
+  dnl Check whether we're using Guile-JSON 3.x, which uses a JSON-to-Scheme
+  dnl mapping different from that of earlier versions.
+  AC_CACHE_CHECK([whether Guile-JSON is available and recent enough],
+    [guix_cv_have_recent_guile_json],
+    [GUILE_CHECK([retval],
+      [(use-modules (json) (ice-9 match))
+       (match (json-string->scm \"[[] { \\\"a\\\": 42 } []]\")
+         (#(("a" . 42)) #t)
+	 (_ #f))])
+     if test "$retval" = 0; then
+       guix_cv_have_recent_guile_json="yes"
+     else
+       guix_cv_have_recent_guile_json="no"
+     fi])
+])
+
+
 dnl GUIX_TEST_ROOT_DIRECTORY
 AC_DEFUN([GUIX_TEST_ROOT_DIRECTORY], [
   AC_CACHE_CHECK([for unit test root directory],
diff --git a/tests/gexp.scm b/tests/gexp.scm
index 460afe7f59..5c013d838d 100644
--- a/tests/gexp.scm
+++ b/tests/gexp.scm
@@ -1104,6 +1104,25 @@
           (return (and (zero? (close-pipe pipe))
                        (= 42 (string->number str)))))))))
 
+(test-assertm "program-file #:system"
+  (let* ((exp    (with-imported-modules '((guix build utils))
+                   (gexp (begin
+                           (use-modules (guix build utils))
+                           (display "hi!")))))
+         (system (if (string=? (%current-system) "x86_64-linux")
+                     "armhf-linux"
+                     "x86_64-linux"))
+         (file   (program-file "program" exp)))
+    (mlet %store-monad ((drv (lower-object file system)))
+      (return (and (string=? (derivation-system drv) system)
+                   (find (lambda (input)
+                           (let ((drv (pk (derivation-input-derivation input))))
+                             (and (string=? (derivation-name drv)
+                                            "module-import-compiled")
+                                  (string=? (derivation-system drv)
+                                            system))))
+                         (derivation-inputs drv)))))))
+
 (test-assertm "scheme-file"
   (let* ((text   (plain-file "foo" "Hello, world!"))
          (scheme (scheme-file "bar" #~(list "foo" #$text))))
diff --git a/tests/guix-build-branch.sh b/tests/guix-build-branch.sh
index e64782c831..3d2a7dddf5 100644
--- a/tests/guix-build-branch.sh
+++ b/tests/guix-build-branch.sh
@@ -1,5 +1,5 @@
 # GNU Guix --- Functional package management for GNU
-# Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
+# Copyright © 2018, 2019 Ludovic Courtès <ludo@gnu.org>
 #
 # This file is part of GNU Guix.
 #
@@ -52,5 +52,11 @@ guix gc -R "$v0_1_0_drv" | grep guile-gcrypt-git.9e3eacd
 test "$v0_1_0_drv" != "$latest_drv"
 test "$v0_1_0_drv" != "$orig_drv"
 
+v0_1_0_drv="`guix build guix --with-commit=guile-gcrypt=v0.1.0 -d`"
+guix gc -R "$v0_1_0_drv" | grep guile-gcrypt-git.v0.1.0
+guix gc -R "$v0_1_0_drv" | grep guile-gcrypt-9e3eacd
+test "$v0_1_0_drv" != "$latest_drv"
+test "$v0_1_0_drv" != "$orig_drv"
+
 if guix build guix --with-commit=guile-gcrypt=000 -d
 then false; else true; fi
diff --git a/tests/import-utils.scm b/tests/import-utils.scm
index 5c0c041360..c3ab25d788 100644
--- a/tests/import-utils.scm
+++ b/tests/import-utils.scm
@@ -23,6 +23,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix build-system)
+  #:use-module (gnu packages)
   #:use-module (srfi srfi-64))
 
 (test-begin "import-utils")
@@ -98,4 +99,25 @@
     (or (package-license (alist->package meta))
         'license-is-false)))
 
+(test-equal "alist->package with dependencies"
+  `(("gettext" ,(specification->package "gettext")))
+  (let* ((meta '(("name" . "hello")
+                 ("version" . "2.10")
+                 ("source" . (("method" . "url-fetch")
+                              ("uri"    . "mirror://gnu/hello/hello-2.10.tar.gz")
+                              ("sha256" .
+                               (("base32" .
+                                 "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i")))))
+                 ("build-system" . "gnu")
+                 ("home-page" . "https://gnu.org")
+                 ("synopsis" . "Say hi")
+                 ("description" . "This package says hi.")
+                                                  ;
+                 ;; Note: As with Guile-JSON 3.x, JSON arrays are represented
+                 ;; by vectors.
+                 ("native-inputs" . #("gettext"))
+
+                 ("license" . #f))))
+    (package-native-inputs (alist->package meta))))
+
 (test-end "import-utils")
diff --git a/tests/services.scm b/tests/services.scm
index 44ad0022c6..572fe38164 100644
--- a/tests/services.scm
+++ b/tests/services.scm
@@ -26,10 +26,6 @@
   #:use-module (srfi srfi-64)
   #:use-module (ice-9 match))
 
-(define live-service
-  (@@ (gnu services herd) live-service))
-
-
 (test-begin "services")
 
 (test-equal "services, default value"