Merge branch 'master' into staging

64 files changed, 2079 insertions, 674 deletions

diff --git a/gnu/bootloader/grub.scm b/gnu/bootloader/grub.scm
index a131f3b506..06856dd58c 100644
--- a/gnu/bootloader/grub.scm
+++ b/gnu/bootloader/grub.scm
@@ -387,12 +387,18 @@ submenu \"GNU system, old configurations...\" {~%")
       ;; Install GRUB onto the EFI partition mounted at EFI-DIR, for the
       ;; system whose root is mounted at MOUNT-POINT.
       (let ((grub-install (string-append bootloader "/sbin/grub-install"))
-            (install-dir (string-append mount-point "/boot")))
+            (install-dir (string-append mount-point "/boot"))
+            ;; When installing GuixSD, it's common to mount EFI-DIR below
+            ;; MOUNT-POINT rather than /boot/efi on the live image.
+            (target-esp (if (file-exists? (string-append mount-point efi-dir))
+                            (string-append mount-point efi-dir)
+                            efi-dir)))
         ;; Tell 'grub-install' that there might be a LUKS-encrypted /boot or
         ;; root partition.
         (setenv "GRUB_ENABLE_CRYPTODISK" "y")
         (unless (zero? (system* grub-install "--boot-directory" install-dir
-                                "--efi-directory" efi-dir))
+                                "--bootloader-id=GuixSD"
+                                "--efi-directory" target-esp))
           (error "failed to install GRUB (EFI)")))))
 
 
diff --git a/gnu/build/vm.scm b/gnu/build/vm.scm
index 73d0191de7..abecc8c470 100644
--- a/gnu/build/vm.scm
+++ b/gnu/build/vm.scm
@@ -34,6 +34,7 @@
   #:use-module (ice-9 format)
   #:use-module (ice-9 match)
   #:use-module (ice-9 regex)
+  #:use-module (ice-9 popen)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-9)
   #:use-module (srfi srfi-26)
@@ -408,42 +409,67 @@ SYSTEM-DIRECTORY is the name of the directory of the 'system' derivation."
                              register-closures? (closures '()))
   "Given a GRUB package, creates an iso image as TARGET, using CONFIG-FILE as
 GRUB configuration and OS-DRV as the stuff in it."
-  (let ((grub-mkrescue (string-append grub "/bin/grub-mkrescue"))
-        (target-store  (string-append "/tmp/root" (%store-directory))))
-    (populate-root-file-system os-drv "/tmp/root")
-
-    (mount (%store-directory) target-store "" MS_BIND)
-
-    (when register-closures?
-      (display "registering closures...\n")
-      (for-each (lambda (closure)
-                  (register-closure
-                   "/tmp/root"
-                   (string-append "/xchg/" closure)
-                   ;; XXX: Using deduplication causes cross device link errors.
-                   #:deduplicate? #f))
-                closures))
-
-    (apply invoke
-           `(,grub-mkrescue "-o" ,target
-                            ,(string-append "boot/grub/grub.cfg=" config-file)
-                            ,(string-append "gnu/store=" os-drv "/..")
-                            "etc=/tmp/root/etc"
-                            "var=/tmp/root/var"
-                            "run=/tmp/root/run"
-                            ;; /mnt is used as part of the installation
-                            ;; process, as the mount point for the target
-                            ;; file system, so create it.
-                            "mnt=/tmp/root/mnt"
-                            "--"
-                            "-volid" ,(string-upcase volume-id)
-                            ,@(if volume-uuid
-                                  `("-volume_date" "uuid"
-                                    ,(string-filter (lambda (value)
-                                                      (not (char=? #\- value)))
-                                                    (iso9660-uuid->string
-                                                     volume-uuid)))
-                                  `())))))
+  (define grub-mkrescue
+    (string-append grub "/bin/grub-mkrescue"))
+
+  (define target-store
+    (string-append "/tmp/root" (%store-directory)))
+
+  (define items
+    ;; The store items to add to the image.
+    (delete-duplicates
+     (append-map (lambda (closure)
+                   (map store-info-item
+                        (call-with-input-file (string-append "/xchg/" closure)
+                          read-reference-graph)))
+                 closures)))
+
+  (populate-root-file-system os-drv "/tmp/root")
+  (mount (%store-directory) target-store "" MS_BIND)
+
+  (when register-closures?
+    (display "registering closures...\n")
+    (for-each (lambda (closure)
+                (register-closure
+                 "/tmp/root"
+                 (string-append "/xchg/" closure)
+
+                 ;; TARGET-STORE is a read-only bind-mount so we shouldn't try
+                 ;; to modify it.
+                 #:deduplicate? #f
+                 #:reset-timestamps? #f))
+              closures)
+    (register-bootcfg-root "/tmp/root" config-file))
+
+  (let ((pipe
+         (apply open-pipe* OPEN_WRITE
+                grub-mkrescue "-o" target
+                (string-append "boot/grub/grub.cfg=" config-file)
+                "etc=/tmp/root/etc"
+                "var=/tmp/root/var"
+                "run=/tmp/root/run"
+                ;; /mnt is used as part of the installation
+                ;; process, as the mount point for the target
+                ;; file system, so create it.
+                "mnt=/tmp/root/mnt"
+                "-path-list" "-"
+                "--"
+                "-volid" (string-upcase volume-id)
+                (if volume-uuid
+                    `("-volume_date" "uuid"
+                      ,(string-filter (lambda (value)
+                                        (not (char=? #\- value)))
+                                      (iso9660-uuid->string
+                                       volume-uuid)))
+                    `()))))
+    ;; Pass lines like 'gnu/store/…-x=/gnu/store/…-x' corresponding to the
+    ;; '-path-list -' option.
+    (for-each (lambda (item)
+                (format pipe "~a=~a~%"
+                        (string-drop item 1) item))
+              items)
+    (unless (zero? (close-pipe pipe))
+      (error "oh, my! grub-mkrescue failed" grub-mkrescue))))
 
 (define* (initialize-hard-disk device
                                #:key
diff --git a/gnu/local.mk b/gnu/local.mk
index 672c002eb6..d2490dd5b7 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -582,6 +582,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/azr3.patch				\
   %D%/packages/patches/bash-completion-directories.patch	\
   %D%/packages/patches/bazaar-CVE-2017-14176.patch		\
+  %D%/packages/patches/beignet-correct-file-names.patch		\
   %D%/packages/patches/bind-CVE-2018-5738.patch			\
   %D%/packages/patches/binutils-aarch64-symbol-relocation.patch	\
   %D%/packages/patches/binutils-loongson-workaround.patch	\
@@ -647,7 +648,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/elfutils-tests-ptrace.patch		\
   %D%/packages/patches/elogind-glibc-2.27.patch			\
   %D%/packages/patches/einstein-build.patch			\
-  %D%/packages/patches/emacs-browse-at-remote-cgit-gnu.patch	\
   %D%/packages/patches/emacs-exec-path.patch			\
   %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
   %D%/packages/patches/emacs-json-reformat-fix-tests.patch	\
@@ -706,6 +706,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/gcc-6-cross-environment-variables.patch	\
   %D%/packages/patches/gcc-6-source-date-epoch-1.patch		\
   %D%/packages/patches/gcc-6-source-date-epoch-2.patch		\
+  %D%/packages/patches/gcc-8-strmov-store-file-names.patch	\
   %D%/packages/patches/gcr-disable-failing-tests.patch		\
   %D%/packages/patches/gcr-fix-collection-tests-to-work-with-gpg-21.patch	\
   %D%/packages/patches/gd-CVE-2018-5711.patch			\
@@ -795,6 +796,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/hurd-fix-eth-multiplexer-dependency.patch        \
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
   %D%/packages/patches/icecat-avoid-bundled-libraries.patch	\
+  %D%/packages/patches/icecat-bug-1413868-pt1.patch		\
   %D%/packages/patches/icecat-CVE-2018-5157-and-CVE-2018-5158.patch	\
   %D%/packages/patches/icecat-use-system-graphite2.patch	\
   %D%/packages/patches/icecat-use-system-harfbuzz.patch		\
@@ -886,6 +888,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/libtheora-config-guess.patch		\
   %D%/packages/patches/libtiff-CVE-2017-9935.patch		\
   %D%/packages/patches/libtiff-CVE-2017-18013.patch		\
+  %D%/packages/patches/libtiff-CVE-2018-8905.patch		\
+  %D%/packages/patches/libtiff-CVE-2018-10963.patch		\
   %D%/packages/patches/libtool-skip-tests2.patch		\
   %D%/packages/patches/libusb-0.1-disable-tests.patch		\
   %D%/packages/patches/libusb-for-axoloti.patch			\
@@ -1083,6 +1087,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/qemu-CVE-2018-11806.patch 		\
   %D%/packages/patches/qt4-ldflags.patch			\
   %D%/packages/patches/qtbase-use-TZDIR.patch			\
+  %D%/packages/patches/qtoctave-qt-5.11-fix.patch		\
   %D%/packages/patches/qtscript-disable-tests.patch		\
   %D%/packages/patches/quagga-reproducible-build.patch          \
   %D%/packages/patches/quassel-qt-5.11.patch			\
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 6b8af60b1b..f00bcd89d7 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -140,13 +140,13 @@ usual file attributes can be checked for inconsistencies.")
 (define-public progress
   (package
     (name "progress")
-    (version "0.13.1")
+    (version "0.14")
     (source (origin
       (method url-fetch)
       (uri (string-append "https://github.com/Xfennec/"
                           name "/archive/v" version ".tar.gz"))
       (sha256
-       (base32 "199rk6608q9m6l0fbjm0xl2w1c5krf8245dqnksdp4rqp7l9ak06"))
+       (base32 "1wcanixfsi5k4i9h5vrnncgjdncalsdfqllrxibxwpgfnf20sji1"))
       (file-name (string-append name "-" version ".tar.gz"))))
     (build-system gnu-build-system)
     (native-inputs
@@ -865,7 +865,7 @@ over ssh connections.")
 (define-public rename
   (package
     (name "rename")
-    (version "0.20")
+    (version "0.35")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -873,7 +873,7 @@ over ssh connections.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "1cf6xx2hiy1xalp35fh8g73j67r0w0g66jpcbc6971x9jbm7bvjy"))))
+                "052iqmn7ya3w1nadpiyavmr3rx566r0lbflx94y8b5wx9q5c16rq"))))
     (build-system perl-build-system)
     (native-inputs
      `(("perl-module-build" ,perl-module-build)
@@ -1651,7 +1651,7 @@ limits.")
 (define-public autojump
   (package
     (name "autojump")
-    (version "22.3.4")
+    (version "22.5.1")
     (source
      (origin
        (method url-fetch)
@@ -1660,7 +1660,7 @@ limits.")
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
         (base32
-         "113rcpr37ngf2xs8da41qdarq5qmj0dwx8ggqy3lhlb0kvqq7g9z"))))
+         "17z9j9936x0nizwrzf664bngh60x5qbvrrf1s5qdzd0f2gdanpvn"))))
     (build-system gnu-build-system)
     (native-inputs                      ;for tests
      `(("python-mock" ,python-mock)
@@ -1668,36 +1668,19 @@ limits.")
     (inputs
      `(("python" ,python-wrapper)))
     (arguments
-     `(#:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  (delete 'build)
-                  (replace 'check
-                    (lambda _
-                      (zero?
-                       (system* "python" "tests/unit/autojump_utils_test.py"))))
-                  (replace 'install
-                    ;; The install.py script doesn't allow system installation
-                    ;; into an arbitrary prefix, so do our own install.
-                    (lambda* (#:key outputs #:allow-other-keys)
-                      (let* ((out (assoc-ref outputs "out"))
-                             (bin (string-append out "/bin"))
-                             (share (string-append out "/share/autojump"))
-                             (py (string-append out "/lib/python"
-                                                ,(version-major+minor
-                                                  (package-version python-wrapper))
-                                                "/site-packages"))
-                             (man (string-append out "/share/man/man1")))
-                        (install-file "bin/autojump" bin)
-                        (for-each (λ (f) (install-file f py))
-                                  (find-files "bin" "\\.py$"))
-                        (for-each (λ (f) (install-file f share))
-                                  (find-files "bin" "autojump\\..*$"))
-                        (substitute* (string-append share "/autojump.sh")
-                          (("/usr/local") out))
-                        (install-file "docs/autojump.1" man)
-                        (wrap-program (string-append bin "/autojump")
-                          `("PYTHONPATH" ":" prefix (,py)))
-                        #t))))))
+     `(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (delete 'build)
+         (replace 'check
+           (lambda _
+             (invoke "python" "tests/unit/autojump_utils_test.py")))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (setenv "SHELL" (which "bash"))
+             (invoke "python" "install.py"
+                     (string-append "--destdir="
+                                    (assoc-ref outputs "out"))))))))
     (home-page "https://github.com/wting/autojump")
     (synopsis "Shell extension for file system navigation")
     (description
@@ -2649,7 +2632,7 @@ Python loading in HPC environments.")
   (let ((real-name "inxi"))
     (package
       (name "inxi-minimal")
-      (version "3.0.12-1")
+      (version "3.0.13-1")
       (source
        (origin
          (method git-fetch)
@@ -2658,7 +2641,7 @@ Python loading in HPC environments.")
                (commit version)))
          (sha256
           (base32
-           "1a2sjz90gzzvhp63x89hs0a424rkd13qrff2njqmjxp322zyp527"))))
+           "0732ligzmzwpwaxin4g8rbfj91ghyvf69lx2jyrahi4df0bfamh5"))))
       (build-system trivial-build-system)
       (inputs
        `(("bash" ,bash)
diff --git a/gnu/packages/animation.scm b/gnu/packages/animation.scm
index 22af707401..a10747ef38 100644
--- a/gnu/packages/animation.scm
+++ b/gnu/packages/animation.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -226,10 +227,10 @@ contains the graphical user interface for synfig.")
                                    "\nLIBS +=" libsndfile
                                    "/lib/libsndfile.so\n"
                                    "win32 {"))))
-               (zero? (system* "qmake"
-                               (string-append "DESTDIR="
-                                              (assoc-ref outputs "out")
-                                              "/bin")))))
+               (invoke "qmake"
+                       (string-append "DESTDIR="
+                                      (assoc-ref outputs "out")
+                                      "/bin"))))
            ;; Ensure that all required Qt plugins are found at runtime.
            (add-after 'install 'wrap-executable
              (lambda* (#:key inputs outputs #:allow-other-keys)
diff --git a/gnu/packages/cdrom.scm b/gnu/packages/cdrom.scm
index 5d45d07288..027a333d67 100644
--- a/gnu/packages/cdrom.scm
+++ b/gnu/packages/cdrom.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015 Paul van der Walt <paul@denknerd.org>
@@ -46,9 +46,10 @@
   #:use-module (gnu packages xml)
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages glib)
-  #:use-module (gnu packages man)
   #:use-module (gnu packages m4)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages mp3)
+  #:use-module (gnu packages music)
   #:use-module (gnu packages ncurses)
   #:use-module (gnu packages elf)
   #:use-module (gnu packages wxwidgets)
@@ -57,6 +58,7 @@
   #:use-module (gnu packages readline)
   #:use-module (gnu packages base)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages perl-web)
   #:use-module (gnu packages python)
   #:use-module (gnu packages image)
   #:use-module (gnu packages photo)
@@ -513,6 +515,9 @@ from an audio CD.")
                    (parano (assoc-ref inputs "cdparanoia"))
                    (which  (assoc-ref inputs "which"))
                    (discid (assoc-ref inputs "cd-discid"))
+                   (perl-discid (assoc-ref inputs "perl-musicbrainz-discid"))
+                   (perl-ws (assoc-ref inputs "perl-webservice-musicbrainz"))
+                   (perl-mojo (assoc-ref inputs "perl-mojolicious"))
                    (flac   (assoc-ref inputs "flac"))
                    (out    (assoc-ref outputs "out")))
                (define (wrap file)
@@ -524,7 +529,14 @@ from an audio CD.")
                                                   which "/bin:"
                                                   vorbis "/bin:"
                                                   discid "/bin:"
-                                                  parano "/bin")))))
+                                                  parano "/bin")))
+                               `("PERL5LIB" ":" prefix
+                                 (,(string-append perl-discid
+                                                  "/lib/perl5/site_perl:"
+                                                  perl-ws
+                                                  "/lib/perl5/site_perl:"
+                                                  perl-mojo
+                                                  "/lib/perl5/site_perl")))))
 
                (for-each wrap
                          (find-files (string-append out "/bin")
@@ -538,6 +550,10 @@ from an audio CD.")
               ("vorbis-tools" ,vorbis-tools)
               ("flac" ,flac)
 
+              ("perl-musicbrainz-discid" ,perl-musicbrainz-discid)
+              ("perl-webservice-musicbrainz" ,perl-webservice-musicbrainz)
+              ("perl-mojolicious" ,perl-mojolicious) ;indirect dependency
+
               ;; A couple of Python and Perl scripts are included.
               ("python" ,python)
               ("perl" ,perl)))
diff --git a/gnu/packages/cluster.scm b/gnu/packages/cluster.scm
index 7cfd04f008..faaaa2419a 100644
--- a/gnu/packages/cluster.scm
+++ b/gnu/packages/cluster.scm
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Sou Bunnbu <iyzsong@member.fsf.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,7 +31,7 @@
 (define-public keepalived
   (package
     (name "keepalived")
-    (version "2.0.1")
+    (version "2.0.4")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -38,18 +39,11 @@
                     version ".tar.gz"))
               (sha256
                (base32
-                "0hp8i56zkf0398bmpi32a85f05cv2fy9wizkdfbxk7gav4z6yx18"))))
+                "0qf46bfxv4w7qx7d73qq26pp72cvbyfjvna3hxn208vynvapalh0"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
        (modify-phases %standard-phases
-         (add-before 'configure 'patch-configure
-           (lambda _
-             ;; XXX: The 'configure' script doesn't handle '-L' flags in the
-             ;; output of 'pkg-config'.
-             (substitute* "configure"
-               (("PKG_CONFIG --libs") "PKG_CONFIG --libs-only-l"))
-             #t))
          (add-after 'build 'build-info
            (lambda _
              (invoke "make" "-C" "doc" "texinfo")
@@ -77,11 +71,11 @@
        ("libnfnetlink" ,libnfnetlink)
        ("libnl" ,libnl)))
     (home-page "http://www.keepalived.org/")
-    (synopsis "Loadbalancing and high-availability frameworks")
+    (synopsis "Load balancing and high-availability frameworks")
     (description
      "Keepalived provides frameworks for both load balancing and high
 availability.  The load balancing framework relies on the Linux Virtual
-Server (IPVS) kernel module.  High availability is achieved by the Virtual
-Redundancy Routing Protocol (VRRP).  Each Keepalived framework can be used
+Server (@dfn{IPVS}) kernel module.  High availability is achieved by the Virtual
+Redundancy Routing Protocol (@dfn{VRRP}).  Each Keepalived framework can be used
 independently or together to provide resilient infrastructures.")
     (license license:gpl2+)))
diff --git a/gnu/packages/code.scm b/gnu/packages/code.scm
index a8c85fdb5e..dea2f09022 100644
--- a/gnu/packages/code.scm
+++ b/gnu/packages/code.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2015, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2015, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
@@ -581,7 +581,7 @@ Objective@tie{}C, D, Java, Pawn, and Vala).  Features:
 (define-public astyle
   (package
     (name "astyle")
-    (version "2.05")
+    (version "3.1")
     (source
      (origin
        (method url-fetch)
@@ -589,7 +589,7 @@ Objective@tie{}C, D, Java, Pawn, and Vala).  Features:
                            version "/astyle_"  version "_linux.tar.gz"))
        (sha256
         (base32
-         "0f9sh9kq5ajp1yz133h00fr9235p1m698x7n3h7zbrhjiwgynd6s"))))
+         "1ms54wcs7hg1bsywqwf2lhdfizgbk7qxc9ghasxk8i99jvwlrk6b"))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f                      ;no tests
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index e998e9981e..30a0ffcec9 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -1069,4 +1069,7 @@ and binaries, plus debugging symbols in the 'debug' output), and Binutils.")
 (define-public gcc-toolchain-7
   (make-gcc-toolchain gcc-7))
 
+(define-public gcc-toolchain-8
+  (make-gcc-toolchain gcc-8))
+
 ;;; commencement.scm ends here
diff --git a/gnu/packages/cran.scm b/gnu/packages/cran.scm
index 57603bf57a..eeaeefd81f 100644
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@@ -246,15 +246,17 @@ into a pipeline of data manipulation and visualisation.")
 (define-public r-haven
   (package
     (name "r-haven")
-    (version "1.1.1")
+    (version "1.1.2")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "haven" version))
        (sha256
         (base32
-         "1fkcvsrnw8waqwggv0aydbvbi99x5kp9g78xfxj4w6s3xvdzcysz"))))
+         "0pp8xjf5lzqg1wr8cwxj4njx99vxwlflwjrd7jvyzwlfpwh7n1qa"))))
     (build-system r-build-system)
+    (inputs
+     `(("zlib" ,zlib)))
     (propagated-inputs
      `(("r-forcats" ,r-forcats)
        ("r-hms" ,r-hms)
@@ -1577,14 +1579,14 @@ Delaunay triangulation and convex hull computation.")
 (define-public r-ddalpha
   (package
     (name "r-ddalpha")
-    (version "1.3.3")
+    (version "1.3.4")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "ddalpha" version))
        (sha256
         (base32
-         "0g4iqhrz2gym05q40ih6srilyajw2l2mv46pchn65bc7hw4vkgrk"))))
+         "16cn0bhbaz9l9k4y79sv2d4f7pvs7dyka273y89igs5jvr99kfj1"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-bh" ,r-bh)
@@ -4287,14 +4289,14 @@ and adds the annotation to the plot.")
 (define-public r-ggpubr
   (package
     (name "r-ggpubr")
-    (version "0.1.6")
+    (version "0.1.7")
     (source
      (origin
        (method url-fetch)
        (uri (cran-uri "ggpubr" version))
        (sha256
         (base32
-         "0mvw215bj887958p34f0dzlrb8mgyfcz9b5zvsschvbhamqinqna"))))
+         "110ny8p41kmbz0a5rl0mv9cqpjkx6yr3ybflp1r0fmcvhwv7cr3i"))))
     (build-system r-build-system)
     (propagated-inputs
      `(("r-cowplot" ,r-cowplot)
diff --git a/gnu/packages/digest.scm b/gnu/packages/digest.scm
index 5f14ab913b..d5533bc474 100644
--- a/gnu/packages/digest.scm
+++ b/gnu/packages/digest.scm
@@ -19,21 +19,21 @@
 (define-module (gnu packages digest)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
-  #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix build-system gnu))
 
 (define-public xxhash
   (package
     (name "xxhash")
-    (version "0.6.4")
+    (version "0.6.5")
     (source
      (origin
-       (method url-fetch)
-       (uri (string-append "https://github.com/Cyan4973/xxHash/archive/v"
-                           version ".tar.gz"))
-       (file-name (string-append name "-" version ".tar.gz"))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/Cyan4973/xxHash")
+             (commit (string-append "v" version))))
        (sha256
-        (base32 "08nv9h3jzg6y85ysy2dj3qvvfsdz0rwkk497a2366syz278wqw25"))))
+        (base32 "137hifc3f3cb4ib64rd6y83arc9hmbyncgrij2v8m94mx66g2aks"))))
     (build-system gnu-build-system)
     (arguments
      `(#:make-flags
@@ -41,6 +41,8 @@
              "XXH_FORCE_MEMORY_ACCESS=1" ; improved performance with GCC
              (string-append "prefix=" (assoc-ref %outputs "out")))
        #:test-target "test"
+       ;; Parallel testing tries to run ‘xxhsum’ before it's been built.
+       #:parallel-tests? #f
        #:phases
        (modify-phases %standard-phases
          (delete 'configure))))         ; no configure script
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index 55aa5511df..c4468c8175 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -1641,15 +1641,14 @@ type, for example: packages, buffers, files, etc.")
 (define-public emacs-guix
   (package
     (name "emacs-guix")
-    (version "0.4")
+    (version "0.4.1.1")
     (source (origin
               (method url-fetch)
-              (uri (string-append "https://github.com/alezost/guix.el"
-                                  "/releases/download/v" version
-                                  "/emacs-guix-" version ".tar.gz"))
+              (uri (string-append "https://emacs-guix.gitlab.io/website/"
+                                  "releases/emacs-guix-" version ".tar.gz"))
               (sha256
                (base32
-                "1nn4b0gd895g0k4fynzrip7z8yb1r3qmvznq9v8a6q7sm84irmqq"))))
+                "0jbnrcazbks7h50rngpw5l40a6vn2794kb53cpva3yzdjmrc1955"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -1700,7 +1699,7 @@ type, for example: packages, buffers, files, etc.")
        ("bui" ,emacs-bui)
        ("edit-indirect" ,emacs-edit-indirect)
        ("magit-popup" ,emacs-magit-popup)))
-    (home-page "https://alezost.github.io/guix.el/")
+    (home-page "https://emacs-guix.gitlab.io/website/")
     (synopsis "Emacs interface for GNU Guix")
     (description
      "Emacs-Guix provides a visual interface, tools and features for the GNU
@@ -4437,7 +4436,7 @@ indentation command behavior very similar to that of python-mode.")
 (define-public emacs-web-mode
   (package
     (name "emacs-web-mode")
-    (version "14")
+    (version "16")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://raw.githubusercontent.com/fxbois"
@@ -4445,7 +4444,7 @@ indentation command behavior very similar to that of python-mode.")
               (file-name (string-append "web-mode-" version ".el"))
               (sha256
                (base32
-                "086hik5fmxg3kx74qmransx9cz961qd22d4m6ah2dw6cwaj1s3s5"))))
+                "1hs5w7kdvcyn4ihyw1kfjg48djn5p7lz4rlbhzzdqv1g56xqx3gw"))))
     (build-system emacs-build-system)
     (synopsis "Major mode for editing web templates")
     (description "Web-mode is an Emacs major mode for editing web templates
@@ -7028,39 +7027,35 @@ Idris.")
     (license license:gpl3+)))
 
 (define-public emacs-browse-at-remote
-  (let ((commit "31dcf77d7c89a12f230e2b2332585db2c44530ef")
-        (revision "1"))
-    (package
-      (name "emacs-browse-at-remote")
-      (version (string-append "0.9.0-" revision "."
-                              (string-take commit 7)))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/rmuslimov/browse-at-remote.git")
-                      (commit commit)))
-                (file-name (string-append name "-" version "-checkout"))
-                (patches
-                 (search-patches "emacs-browse-at-remote-cgit-gnu.patch"))
-                (sha256
-                 (base32
-                  "017cb8lf7zbg0jmr7zxzd7d5kz2jy35cvw5vcpdmq1fdr3wqwkgj"))))
-      (build-system emacs-build-system)
-      (propagated-inputs
-       `(("emacs-f" ,emacs-f)
-         ("emacs-s" ,emacs-s)))
-      (native-inputs
-       `(("ert-runner" ,ert-runner)))
-      (arguments
-       `(#:tests? #t
-         #:test-command '("ert-runner")))
-      (home-page "https://github.com/rmuslimov/browse-at-remote")
-      (synopsis "Open github/gitlab/bitbucket/stash page from Emacs")
-      (description
-       "This Emacs package allows you to open a target page on
+  (package
+    (name "emacs-browse-at-remote")
+    (version "0.10.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "https://github.com/rmuslimov/browse-at-remote/archive/"
+             version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "0ymslsp6i1naw25zckv25bf4aaq6qwkbkn95qyzlwg869l802686"))))
+    (build-system emacs-build-system)
+    (propagated-inputs
+     `(("emacs-f" ,emacs-f)
+       ("emacs-s" ,emacs-s)))
+    (native-inputs
+     `(("ert-runner" ,ert-runner)))
+    (arguments
+     `(#:tests? #t
+       #:test-command '("ert-runner")))
+    (home-page "https://github.com/rmuslimov/browse-at-remote")
+    (synopsis "Open github/gitlab/bitbucket/stash page from Emacs")
+    (description
+     "This Emacs package allows you to open a target page on
 github/gitlab (or bitbucket) by calling @code{browse-at-remote} command.
 It supports dired buffers and opens them in tree mode at destination.")
-      (license license:gpl3+))))
+    (license license:gpl3+)))
 
 (define-public emacs-tiny
   (package
diff --git a/gnu/packages/emulators.scm b/gnu/packages/emulators.scm
index 1687c9652f..f669213f4f 100644
--- a/gnu/packages/emulators.scm
+++ b/gnu/packages/emulators.scm
@@ -1181,7 +1181,7 @@ play them on systems for which they were never designed!")
 (define-public mame
   (package
     (name "mame")
-    (version "0.198")
+    (version "0.199")
     (source
      (origin
        (method git-fetch)
@@ -1191,7 +1191,7 @@ play them on systems for which they were never designed!")
        (file-name (git-file-name name version))
        (sha256
         (base32
-         "0kl7qll8d6xlx7bj5920ljs888a6nc1fj2kfw1fz0r8za3m7wiq9"))
+         "0rb2k6dxss36jjalbpvj2xsqdwqyqy89qab7jpv8ig1y08dpg36n"))
        (modules '((guix build utils)))
        (snippet
         ;; Remove bundled libraries.
diff --git a/gnu/packages/file-systems.scm b/gnu/packages/file-systems.scm
index 4fd33ae901..3c9d7d49c1 100644
--- a/gnu/packages/file-systems.scm
+++ b/gnu/packages/file-systems.scm
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Gábor Boskovits <boskovits@gmail.com>
-;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2017, 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -144,7 +144,7 @@ non-determinism in the build process.")
 (define-public glusterfs
   (package
     (name "glusterfs")
-    (version "3.10.7")
+    (version "3.10.12")
     (source
      (origin
        (method url-fetch)
@@ -153,7 +153,7 @@ non-determinism in the build process.")
                            "/glusterfs-" version ".tar.gz"))
        (sha256
         (base32
-         "02sn9s3jjva2i1l47y3in326n8jgp57rbykz5s8m87y4bzpw0ym1"))
+         "01ysvamvfv2l5pswa1rygpg8w0954h2wkh1ba97h3nx03m5n0prg"))
        (patches
         (search-patches "glusterfs-use-PATH-instead-of-hardcodes.patch"))))
     (build-system gnu-build-system)
@@ -170,11 +170,12 @@ non-determinism in the build process.")
              ;; must be replaced.
              (install-file (string-append (assoc-ref inputs "automake")
                                           "/share/automake-"
-                                          ,(package-version automake) "/config.sub")
+                                          ,(version-major+minor (package-version automake)) "/config.sub")
                            ".")
              #t))
          ;; Fix flex error.  This has already been fixed with upstream commit
-         ;; db3fe245a9e8812829eae7d143e49d0bfdfef9a7.
+         ;; db3fe245a9e8812829eae7d143e49d0bfdfef9a7, but is not available in
+         ;; current releases.
          (add-before 'configure 'fix-lex
            (lambda _
              (substitute* "libglusterfs/src/Makefile.in"
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index f7dc2e7634..3123cdeb91 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -330,15 +330,16 @@ X11-system or any other graphical user interface.")
 (define-public teckit
   (package
    (name "teckit")
-   (version "2.5.7")
-   (source (origin
-            (method url-fetch)
-            (uri (string-append
-                  "https://github.com/silnrsi/teckit/releases/download/v"
-                  version "/teckit-" version ".tar.gz"))
-            (sha256
-              (base32
-                "1pbp97vcpj6x4yixx6ww0vsi1rrr99fksxdjafs6gdargzd24cj4"))))
+   (version "2.5.8")
+   (source
+    (origin
+      (method git-fetch)
+      (uri (git-reference
+            (url "https://github.com/silnrsi/teckit")
+            (commit (string-append "v" version))))
+      (file-name (git-file-name name version))
+      (sha256
+       (base32 "1jmsdmfz7bgq1n5qsqgpq1b1n77f1hll0czfw5wkxz4knzb14ndn"))))
    (build-system gnu-build-system)
    (inputs
     `(("zlib" ,zlib)
diff --git a/gnu/packages/game-development.scm b/gnu/packages/game-development.scm
index b428fa77f2..a715c958cd 100644
--- a/gnu/packages/game-development.scm
+++ b/gnu/packages/game-development.scm
@@ -1062,16 +1062,16 @@ games.")
 (define-public godot
   (package
     (name "godot")
-    (version "3.0.2")
+    (version "3.0.4")
     (source (origin
-              (method url-fetch)
-              (uri
-               (string-append "https://github.com/godotengine/godot/archive/"
-                              version "-stable.tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/godotengine/godot")
+                    (commit (string-append version "-stable"))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "0ldnk3j4w2kh454mzclmq8nk7zqrn758yrqq85i4kzljpkf93g0m"))
+                "0i4ssfb6igga9zwvsmahrnasx9cyqrsd6mlmssjgc482fy9q2kz4"))
               (modules '((guix build utils)))
               (snippet
                '(begin
diff --git a/gnu/packages/games.scm b/gnu/packages/games.scm
index 2ced2b51da..0796e48001 100644
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@@ -177,82 +177,70 @@ settings to tweak as well.")
     (license license:gpl2+)))
 
 (define-public cataclysm-dda
-  (package
-    (name "cataclysm-dda")
-    (version "0.C")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/CleverRaven/Cataclysm-DDA/"
-                                  "archive/" version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
-              (sha256
-               (base32
-                "1xlajmgl9cviqyjpp5g5q4rbljy9gqc49v54bi8gpzr68s14gsb9"))
-              (modules '((guix build utils)))
-              (snippet
-               ;; Import cmath header for the std::pow function.
-               '(begin
-                  (for-each (lambda (file)
-                              (substitute* file
-                                (("#include <math.h>")
-                                 "#include <cmath>")))
-                            (find-files "src"))
-                  #t))))
-    (build-system gnu-build-system)
-    (arguments
-     '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
-                          "USE_HOME_DIR=1" "DYNAMIC_LINKING=1" "RELEASE=1")
-       #:phases
-       (modify-phases %standard-phases
-         (replace 'configure
-           (lambda _
-             (substitute* "Makefile"
-               (("ncursesw5-config") "ncursesw6-config")
-               (("RELEASE_FLAGS = -Werror") "RELEASE_FLAGS ="))
-             #t))
-         (add-after 'build 'build-tiles
-           (lambda* (#:key make-flags outputs #:allow-other-keys)
-             ;; Change prefix directory and enable tile graphics and sound.
-             (zero?
-              (apply system* "make" "TILES=1" "SOUND=1"
-                     (string-append "PREFIX="
-                                    (assoc-ref outputs "tiles"))
-                     (cdr make-flags)))))
-         (add-after 'install 'install-tiles
-           (lambda* (#:key make-flags outputs #:allow-other-keys)
-             (zero?
-              (apply system* "make" "install" "TILES=1" "SOUND=1"
-                     (string-append "PREFIX="
-                                    (assoc-ref outputs "tiles"))
-                     (cdr make-flags))))))
-       ;; TODO: Add libtap++ from https://github.com/cbab/libtappp as a native
-       ;;       input in order to support tests.
-       #:tests? #f))
-    (outputs '("out"
-               "tiles")) ; For tile graphics and sound support.
-    (native-inputs
-     `(("gettext" ,gettext-minimal)
-       ("pkg-config" ,pkg-config)))
-    (inputs
-     `(("freetype" ,freetype)
-       ("libogg" ,libogg)
-       ("libvorbis" ,libvorbis)
-       ("ncurses" ,ncurses)
-       ("sdl2" ,sdl2)
-       ("sdl2-image" ,sdl2-image)
-       ("sdl2-ttf" ,sdl2-ttf)
-       ("sdl2-mixer" ,sdl2-mixer)))
-    (home-page "http://en.cataclysmdda.com/")
-    (synopsis "Survival horror roguelike video game")
-    (description
-     "Cataclysm: Dark Days Ahead is a roguelike set in a post-apocalyptic world.
-Struggle to survive in a harsh, persistent, procedurally generated world.
-Scavenge the remnants of a dead civilization for food, equipment, or, if you are
-lucky, a vehicle with a full tank of gas to get you out of Dodge.  Fight to
-defeat or escape from a wide variety of powerful monstrosities, from zombies to
-giant insects to killer robots and things far stranger and deadlier, and against
-the others like yourself, that want what you have.")
-    (license license:cc-by-sa3.0)))
+  (let ((commit "ad3b0c3d521292d119f97a83390e7acfe9e9e7f7")
+        (revision "1"))
+    (package
+      (name "cataclysm-dda")
+      ;; This denotes the version released after the 0.C release.
+      ;; Revert to a normal version number if updating to stable version 0.D.
+      (version (git-version "0.C" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/CleverRaven/Cataclysm-DDA.git")
+                      (commit commit)))
+                (sha256
+                 (base32
+                  "1kdgbl8zqd53f5yilm2c9nyq3w6585yxl5jvgxy65dlpzxcqqj7y"))
+                (file-name (git-file-name name version))))
+      (build-system gnu-build-system)
+      (arguments
+       '(#:make-flags (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
+                            "USE_HOME_DIR=1" "DYNAMIC_LINKING=1" "RELEASE=1")
+         #:phases
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (add-after 'build 'build-tiles
+             (lambda* (#:key make-flags outputs #:allow-other-keys)
+               ;; Change prefix directory and enable tile graphics and sound.
+               (apply invoke "make" "TILES=1" "SOUND=1"
+                      (string-append "PREFIX="
+                                     (assoc-ref outputs "tiles"))
+                      (cdr make-flags))))
+           (add-after 'install 'install-tiles
+             (lambda* (#:key make-flags outputs #:allow-other-keys)
+               (apply invoke "make" "install" "TILES=1" "SOUND=1"
+                      (string-append "PREFIX="
+                                     (assoc-ref outputs "tiles"))
+                      (cdr make-flags)))))
+         ;; TODO: Add libtap++ from https://github.com/cbab/libtappp as a native
+         ;;       input in order to support tests.
+         #:tests? #f))
+      (outputs '("out"
+                 "tiles")) ; For tile graphics and sound support.
+      (native-inputs
+       `(("gettext" ,gettext-minimal)
+         ("pkg-config" ,pkg-config)))
+      (inputs
+       `(("freetype" ,freetype)
+         ("libogg" ,libogg)
+         ("libvorbis" ,libvorbis)
+         ("ncurses" ,ncurses)
+         ("sdl2" ,sdl2)
+         ("sdl2-image" ,sdl2-image)
+         ("sdl2-ttf" ,sdl2-ttf)
+         ("sdl2-mixer" ,sdl2-mixer)))
+      (home-page "http://en.cataclysmdda.com/")
+      (synopsis "Survival horror roguelike video game")
+      (description
+       "Cataclysm: Dark Days Ahead is a roguelike set in a post-apocalyptic
+world.  Struggle to survive in a harsh, persistent, procedurally generated
+world.  Scavenge the remnants of a dead civilization for food, equipment, or,
+if you are lucky, a vehicle with a full tank of gas to get you out of Dodge.
+Fight to defeat or escape from a wide variety of powerful monstrosities, from
+zombies to giant insects to killer robots and things far stranger and deadlier,
+and against the others like yourself, that want what you have.")
+      (license license:cc-by-sa3.0))))
 
 (define-public cowsay
   (package
@@ -3678,46 +3666,43 @@ emerges from a sewer hole and pulls her below ground.")
                      license:cc-by-sa3.0)))))
 
 (define-public cdogs-sdl
-  ;; XXX: Use version 0.6.7 when it's available.
-  (let ((commit "bab2031369b9ea2dbeb7eedbde10a43dd8ca83db")
-        (revision "1"))
-   (package
-     (name "cdogs-sdl")
-     (version (git-version "0.6.6" revision commit))
-     (source (origin
-               (method git-fetch)
-               (uri (git-reference
-                     (url "https://github.com/cxong/cdogs-sdl.git")
-                     (commit commit)))
-               (file-name (git-file-name name version))
-               (sha256
-                (base32
-                 "09sfqhrrffhvxbhigvrxfmai52w01w3f9kjmixjhqvqlkhn77c9n"))))
-     (build-system cmake-build-system)
-     (arguments
-      `(#:configure-flags
-        (list (string-append "-DCDOGS_DATA_DIR="
-                             (assoc-ref %outputs "out")
-                             "/share/cdogs-sdl/"))))
-     (inputs
-      `(("mesa" ,mesa)
-        ("sdl2" ,sdl2)
-        ("sdl2-image" ,sdl2-image)
-        ("sdl2-mixer" ,sdl2-mixer)))
-     (home-page "https://cxong.github.io/cdogs-sdl/")
-     (synopsis "Classic overhead run-and-gun game")
-     (description "C-Dogs SDL is a classic overhead run-and-gun game,
+  (package
+    (name "cdogs-sdl")
+    (version "0.6.7")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/cxong/cdogs-sdl.git")
+                    (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1frafzsj3f83xkmn4llr7g728c82lcqi424ini1hv3gv5zjgpa15"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:configure-flags
+       (list (string-append "-DCDOGS_DATA_DIR="
+                            (assoc-ref %outputs "out")
+                            "/share/cdogs-sdl/"))))
+    (inputs
+     `(("mesa" ,mesa)
+       ("sdl2" ,sdl2)
+       ("sdl2-image" ,sdl2-image)
+       ("sdl2-mixer" ,sdl2-mixer)))
+    (home-page "https://cxong.github.io/cdogs-sdl/")
+    (synopsis "Classic overhead run-and-gun game")
+    (description "C-Dogs SDL is a classic overhead run-and-gun game,
 supporting up to 4 players in co-op and deathmatch modes.  Customize your
 player, choose from many weapons, and blast, slide and slash your way through
 over 100 user-created campaigns.")
-     ;; GPLv2+ for code (includes files under BSD-2 and BSD-3),
-     ;; CC0/CC-BY/CC-BY-SA for assets.
-     (license (list license:gpl2+
-                    license:bsd-2
-                    license:bsd-3
-                    license:cc0
-                    license:cc-by3.0
-                    license:cc-by-sa3.0)))))
+    ;; GPLv2+ for code (includes files under BSD-2 and BSD-3),
+    ;; CC0/CC-BY/CC-BY-SA for assets.
+    (license (list license:gpl2+
+                   license:bsd-2
+                   license:bsd-3
+                   license:cc0
+                   license:cc-by3.0
+                   license:cc-by-sa3.0))))
 
 (define-public kiki
   (package
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index 130c212669..fdca3d2ffc 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -6,6 +6,7 @@
 ;;; Copyright © 2015, 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Carlos Sánchez de La Lama <csanchezdll@gmail.com>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -515,6 +516,20 @@ Go.  It also includes runtime support libraries for these languages.")
 for several languages, including C, C++, Objective-C, Fortran, Ada, and Go.
 It also includes runtime support libraries for these languages.")))
 
+(define-public gcc-8
+  (package
+    (inherit gcc-7)
+    (version "8.1.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://gnu/gcc/gcc-"
+                                  version "/gcc-" version ".tar.xz"))
+              (sha256
+               (base32
+                "0lxil8x0jjx7zbf90cy1rli650akaa6hpk8wk8s62vk2jbwnc60x"))
+              (patches (search-patches "gcc-8-strmov-store-file-names.patch"
+                                       "gcc-5.0-libvtv-runpath.patch"))))))
+
 ;; Note: When changing the default gcc version, update
 ;;       the gcc-toolchain-* definitions and the gfortran definition
 ;;       accordingly.
diff --git a/gnu/packages/gnu-pw-mgr.scm b/gnu/packages/gnu-pw-mgr.scm
index 6bb5fea84b..0d16bf5f0b 100644
--- a/gnu/packages/gnu-pw-mgr.scm
+++ b/gnu/packages/gnu-pw-mgr.scm
@@ -30,7 +30,7 @@
 (define-public gnu-pw-mgr
   (package
     (name "gnu-pw-mgr")
-    (version "2.3.1")
+    (version "2.3.2")
     (source
      (origin
       (method url-fetch)
@@ -38,7 +38,7 @@
                           version ".tar.xz"))
       (sha256
        (base32
-        "05vv6n5sqdswhzm21cqn8m2p6avblxl3cv7b39nqx8yxf58gi2xv"))))
+        "0x60g0syqpd107l8w4bl213imy2lspm4kz1j18yr1sh10rdxlgxd"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index c52d21d8e3..ba60d1372a 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -479,27 +479,43 @@ security standards.")
         (mozilla-patch "icecat-CVE-2018-5150-pt08.patch" "134c728799c1" "16hbwx6fx1hrddsyjjbd3z954ql3pg348xs13h9riyblq8crzmam")
         (mozilla-patch "icecat-CVE-2018-5150-pt09.patch" "14eab155eaa8" "0wr4xgblxzk4c2gvlnpl7ic1196mrhry1hgwdl1jivq0ji5cbvbd")
         (mozilla-patch "icecat-bug-1452619.patch"        "2b75d55ccf0e" "1g87aybw6ggv6hyk385bplv0lx63n020gwyq0d6d4pqld48hsm1i")
-        (mozilla-patch "icecat-bug-1453127.patch"        "89857f35df29" "0gzi47svrw5ajdlm3i12193psm702zx70x5h1rwp4gb7gxh4m4d9")
+        (mozilla-patch "icecat-CVE-2018-5156-pt1.patch"  "89857f35df29" "0gzi47svrw5ajdlm3i12193psm702zx70x5h1rwp4gb7gxh4m4d9")
         (mozilla-patch "icecat-CVE-2018-5150-pt10.patch" "3f2ec03c0405" "0w02952dlxd2gmwghck2nm4rjjmc5ylg62bw6m1rvi35kcr134lr")
         (mozilla-patch "icecat-CVE-2018-5183.patch"      "f729bf78fb3a" "0xkj6jwxwdqkvb5c7wi16b8cm8qrnlrd3s9jnd46jg03iykrx56f")
-        (mozilla-patch "icecat-bug-1437842.patch"        "eb896089db47" "10lppk4x2d3pim71a36ky1dmg08rs5ckfiljwvfnr1cw6934qxl4")
-        (mozilla-patch "icecat-bug-1458270.patch"        "2374dca97bde" "0y1g55wvj44nzb1qfkl271jcf8s1ik8lcl1785z0zim4qzn7qkpa")
-        (mozilla-patch "icecat-bug-1452576.patch"        "70b6298e0c9e" "0n5jfy6c421dkybk8m18vd61y95zz0r64g1p1zlya3fps5knfaqi")
-        (mozilla-patch "icecat-bug-1459206-pt1.patch"    "4ef79fe9b3b7" "1c32z1ki1i6xj1nbb0xlxwqnmz48ikmy8dmp37rkjz8ssn04wgfg")
-        (mozilla-patch "icecat-bug-1459206-pt2.patch"    "9ad16112044a" "0ayya67sx7avcb8bplfdxb92l9g4mjrb1s3hby283llhqv0ikg9b")
-        (mozilla-patch "icecat-bug-1459162.patch"        "11d8a87fb6d6" "1rkmdk18llw0x1jakix75hlhy0hpsmlminnflagbzrzjli81gwm1")
-        (mozilla-patch "icecat-bug-1451297.patch"        "407b10ad1273" "16qzsfirw045xag96f1qvpdlibm8lwdj9l1mlli4n1vz0db91v9q")
-        (mozilla-patch "icecat-bug-1462682.patch"        "e76e2e481b17" "0hnx13msjy28n3bpa2c24kpzalam4bdk5gnp0f9k671l48rs9yb3")
-        (mozilla-patch "icecat-bug-1450688.patch"        "2c75bfcd465c" "1pjinj8qypafqm2fk68s3hzcbzcijn09qzrpcxvzq6bl1yfc1xfd")
-        (mozilla-patch "icecat-bug-1456975.patch"        "042f80f3befd" "0av918kin4bkrq7gnjz0h9w8kkq8rk9l93250lfl5kqrinza1gsk")
-        (mozilla-patch "icecat-bugs-1442722+1455071+1433642+1456604+1458320.patch"
+        (mozilla-patch "icecat-CVE-2018-5188-pt01.patch" "eb896089db47" "10lppk4x2d3pim71a36ky1dmg08rs5ckfiljwvfnr1cw6934qxl4")
+        (mozilla-patch "icecat-CVE-2018-5188-pt02.patch" "2374dca97bde" "0y1g55wvj44nzb1qfkl271jcf8s1ik8lcl1785z0zim4qzn7qkpa")
+        (mozilla-patch "icecat-CVE-2018-5188-pt03.patch" "70b6298e0c9e" "0n5jfy6c421dkybk8m18vd61y95zz0r64g1p1zlya3fps5knfaqi")
+        (mozilla-patch "icecat-CVE-2018-12365-pt1.patch" "4ef79fe9b3b7" "1c32z1ki1i6xj1nbb0xlxwqnmz48ikmy8dmp37rkjz8ssn04wgfg")
+        (mozilla-patch "icecat-CVE-2018-12365-pt2.patch" "9ad16112044a" "0ayya67sx7avcb8bplfdxb92l9g4mjrb1s3hby283llhqv0ikg9b")
+        (mozilla-patch "icecat-CVE-2018-12359.patch"     "11d8a87fb6d6" "1rkmdk18llw0x1jakix75hlhy0hpsmlminnflagbzrzjli81gwm1")
+        (mozilla-patch "icecat-CVE-2018-5188-pt04.patch" "407b10ad1273" "16qzsfirw045xag96f1qvpdlibm8lwdj9l1mlli4n1vz0db91v9q")
+        (mozilla-patch "icecat-CVE-2018-6126.patch"      "e76e2e481b17" "0hnx13msjy28n3bpa2c24kpzalam4bdk5gnp0f9k671l48rs9yb3")
+        (mozilla-patch "icecat-CVE-2018-5188-pt05.patch" "2c75bfcd465c" "1pjinj8qypafqm2fk68s3hzcbzcijn09qzrpcxvzq6bl1yfc1xfd")
+        (mozilla-patch "icecat-CVE-2018-5188-pt06.patch" "042f80f3befd" "0av918kin4bkrq7gnjz0h9w8kkq8rk9l93250lfl5kqrinza1gsk")
+        (mozilla-patch "icecat-CVE-2018-5188-pt07+bugs-1455071+1433642+1456604+1458320.patch"
                                                          "bb0451c9c4a0" "1lhm1b2a7c6jwhzsg3c830hfhp17p8j9zbcmgchpb8c5jkc3vw0x")
-        (mozilla-patch "icecat-bug-1465108-pt1.patch"    "8189b262e3b9" "13rh86ddwmj1bhv3ibbil3sv5xbqq1c9v1czgbsna5hxxkzc1y3b")
-        (mozilla-patch "icecat-bug-1465108-pt2.patch"    "9f81ae3f6e1d" "05vfg8a8jrzd93n1wvncmvdmqgf9cgsl8ryxgjs3032gbbjkga7q")
-        (mozilla-patch "icecat-bug-1459693.patch"        "face7a3dd5d7" "0jclw30mf693w8lrmvn0iankggj21nh4j3zh51q5363rj5xncdzx")
-        (mozilla-patch "icecat-bug-1464829.patch"        "7afb58c046c8" "1r0569r76712x7x1sw6xr0x06ilv6iw3fncb0f8r8b9mp6wrpx34")
-        (mozilla-patch "icecat-bug-1452375-pt1.patch"    "f1a745f8c42d" "11q73pb7a8f09xjzil4rhg5nr49zrnz1vb0prni0kqvrnppf5s40")
-        (mozilla-patch "icecat-bug-1452375-pt2.patch"    "1f9a430881cc" "0f79rv7njliqxx33z07n60b50jg0a596d1km7ayz2hivbl2d0168")))
+        (mozilla-patch "icecat-CVE-2018-5188-pt08.patch" "8189b262e3b9" "13rh86ddwmj1bhv3ibbil3sv5xbqq1c9v1czgbsna5hxxkzc1y3b")
+        (mozilla-patch "icecat-CVE-2018-5188-pt09.patch" "9f81ae3f6e1d" "05vfg8a8jrzd93n1wvncmvdmqgf9cgsl8ryxgjs3032gbbjkga7q")
+        (mozilla-patch "icecat-CVE-2018-12360.patch"     "face7a3dd5d7" "0jclw30mf693w8lrmvn0iankggj21nh4j3zh51q5363rj5xncdzx")
+        (mozilla-patch "icecat-CVE-2018-5188-pt10.patch" "7afb58c046c8" "1r0569r76712x7x1sw6xr0x06ilv6iw3fncb0f8r8b9mp6wrpx34")
+        (mozilla-patch "icecat-CVE-2018-12362-pt1.patch" "f1a745f8c42d" "11q73pb7a8f09xjzil4rhg5nr49zrnz1vb0prni0kqvrnppf5s40")
+        (mozilla-patch "icecat-CVE-2018-12362-pt2.patch" "1f9a430881cc" "0f79rv7njliqxx33z07n60b50jg0a596d1km7ayz2hivbl2d0168")
+        (mozilla-patch "icecat-CVE-2018-5188-pt11.patch" "28f4fc0a5141" "1a8f9z6c80in8ccj82ysdrcr2lqypp29l4acs50kwncm0c0b01zl")
+        (mozilla-patch "icecat-CVE-2018-12363.patch"     "ad5a53a1d2b1" "0rhl4r39ydb3lkfp5pkwvhhzqgfh33s9r7b7jccgkrx6f13xyq78")
+        (mozilla-patch "icecat-CVE-2018-5188-pt12.patch" "0ddfc03c0454" "1b0xw2kj9765lvpl8iwr3wwcz40bdfp3dp4y9f546a61qsi9q9d6")
+        (mozilla-patch "icecat-CVE-2018-5156-pt2.patch"  "dbf36189a364" "1awbyhy0r79i03sns2p0m78f9hb6c7kp4hwia2khx4qszlsr4j95")
+        (mozilla-patch "icecat-CVE-2018-5188-pt13.patch" "32509dfde003" "0cc3c92dgf5qynk093prq610c9x815l2fa24ddrw9czdzbwblsdq")
+        (mozilla-patch "icecat-bug-1462912.patch"        "f18535a212da" "0zkqz9il89f1s1yrp5c6hj6kysy2x02iy50vgwdj30lr56gkpzmk")
+        (mozilla-patch "icecat-CVE-2018-5188-pt14.patch" "e8e9e1ef79f2" "0dc8p6fsppq3bhbpmp41f8mjxbr31pvgpga0a73dqdaicq5ydgj4")
+        (search-patch  "icecat-bug-1413868-pt1.patch")
+        (mozilla-patch "icecat-CVE-2018-5188-pt15.patch" "9d4d31b2630d" "1lcbmsyi09kp80h1jgxj5l45zl24xn22h1lq7drbyjxsn1kggq4g")
+        (mozilla-patch "icecat-CVE-2018-12366-pt1.patch" "edf2c7dff493" "06xmyk7nm54cm9m6qc59wz8cxxfa5r25mf2xzdzy74iq5hwa1ac8")
+        (mozilla-patch "icecat-CVE-2018-5188-pt16.patch" "05549a4d1b80" "10q68cllshmmhlrbirm9h4gyc3ffrcpsxihfpcbxh90nv2h16jci")
+        (mozilla-patch "icecat-CVE-2018-12364.patch"     "67b2d8924841" "197riigbb6l30959pygr0zlv7vaims78dg1mh0pg33pa7cbna0ds")
+        (mozilla-patch "icecat-CVE-2018-12366-pt2.patch" "528d4d997bb3" "0f375i96a404dkn0fanmd9pgfj3wyrhjfc5dwslw2s44gwfjhljb")
+        (mozilla-patch "icecat-bug-1369771.patch"        "fab16ad7f256" "0kd8qm04sjgfgfg8yw3ivcxazb1d7v430g86chw4n64qybsh9ka3")
+        (mozilla-patch "icecat-CVE-2018-5188-pt17.patch" "068e249d02b4" "1iy9by1mg5qhp8502h31m8zm99aq2hx0c5n3hadd5pk11lfnq6ll")
+        (mozilla-patch "icecat-bug-1413868-pt2.patch"    "755067c14b06" "089dwqwzcdg1l6aimi0i65q4dgb2iny5h8yjx63h9zgv77n0700a")))
       (modules '((guix build utils)))
       (snippet
        '(begin
diff --git a/gnu/packages/gps.scm b/gnu/packages/gps.scm
index 0555d831e3..cd639a4d39 100644
--- a/gnu/packages/gps.scm
+++ b/gnu/packages/gps.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014, 2015 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;;
@@ -147,7 +147,7 @@ between two other data points.")
 (define-public gama
   (package
     (name "gama")
-    (version "1.22")
+    (version "2.00")
     (source
       (origin
         (method url-fetch)
@@ -155,7 +155,7 @@ between two other data points.")
                             version ".tar.gz"))
         (sha256
          (base32
-          "01q3g2zi5d5r2l10hc8jwwz6w61dwkv7nyj9xd67vvq0gajw0a7r"))))
+          "1p51jlzr6qqqvzx0sq8j7fxqfij62c3pjcsb53vgx0jx0qdqyjba"))))
     (build-system gnu-build-system)
     (arguments '(#:parallel-tests? #f)) ; race condition
     (native-inputs
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index eea7e0f79a..ff52a48234 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -724,6 +724,74 @@ format is also supported.")
   ;; This was mthl's mcron development branch, and it became mcron 1.1.
   (deprecated-package "mcron2" mcron))
 
+(define-public guile-hall
+  (package
+    (name "guile-hall")
+    (version "0.1.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.com/a-sassmannshausen/guile-hall")
+             (commit "7d1094a12fe917209ce5b76c681cc8c862d4c65b")))
+       (file-name "guile-hall-0.1.1-checkout")
+       (sha256
+        (base32
+         "03kb09cjca98hlbx9mj12mqinzsnnvp6ci6i975n88pjhaxigyp1"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:modules
+       ((ice-9 match)
+        (ice-9 ftw)
+        ,@%gnu-build-system-modules)
+       #:phases
+       (modify-phases
+           %standard-phases
+         (add-after
+             'install
+             'hall-wrap-binaries
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin/"))
+                    (site (string-append out "/share/guile/site")))
+               (match (scandir site)
+                 (("." ".." version)
+                  (let ((modules (string-append site "/" version))
+                        (compiled-modules
+                         (string-append
+                          out
+                          "/lib/guile/"
+                          version
+                          "/site-ccache")))
+                    (for-each
+                     (lambda (file)
+                       (wrap-program
+                           (string-append bin file)
+                         `("GUILE_LOAD_PATH" ":" prefix (,modules))
+                         `("GUILE_LOAD_COMPILED_PATH"
+                           ":"
+                           prefix
+                           (,compiled-modules))))
+                     ,(list 'list "hall"))
+                    #t)))))))))
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("pkg-config" ,pkg-config)
+       ("texinfo" ,texinfo)))
+    (inputs `(("guile" ,guile-2.2)))
+    (propagated-inputs
+     `(("guile-config" ,guile-config)))
+    (synopsis "Guile project tooling")
+    (description
+     "Hall is a command-line application and a set of Guile libraries that
+allow you to quickly create and publish Guile projects.  It allows you to
+transparently support the GNU build system, manage a project hierarchy &
+provides tight coupling to Guix.")
+    (home-page
+     "https://gitlab.com/a-sassmannshausen/guile-hall")
+    (license license:gpl3+)))
+
 (define-public guile-ics
   (package
     (name "guile-ics")
@@ -767,14 +835,23 @@ The library is shipped with documentation in Info format and usage examples.")
 (define-public guile-lib
   (package
     (name "guile-lib")
-    (version "0.2.5.1")
+    (version "0.2.6")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://savannah/guile-lib/guile-lib-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "19q420i3is3d4jmkdqs5y7ir7ipp4s795saflqgwf6617cx2zpj4"))))
+                "0n1lf5bsr5s9gqi07sdfkl1hpin6dzvkcj1xa63jd1w8aglwv8r1"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  ;; 'pre-inst-env' sets an incorrect load path, missing the
+                  ;; "/src" bit.  Add it.
+                  (substitute* "pre-inst-env.in"
+                    (("abs_top_(builddir|srcdir)=([[:graph:]]+)" _ dir value)
+                     (string-append "abs_top_" dir "=" value "/src")))
+                  #t))))
     (build-system gnu-build-system)
     (arguments
      '(#:make-flags
@@ -835,7 +912,8 @@ for Guile\".")
                                     "AC_SUBST([GUILE_EFFECTIVE_VERSION])\n")))
                   (substitute* '("Makefile.am" "json/Makefile.am")
                     (("moddir[[:blank:]]*=.*/share/guile/site" all)
-                     (string-append all "/@GUILE_EFFECTIVE_VERSION@")))))))
+                     (string-append all "/@GUILE_EFFECTIVE_VERSION@")))
+                  #t))))
     (build-system gnu-build-system)
     (native-inputs `(("autoconf" ,autoconf)
                      ("automake" ,automake)
@@ -1206,58 +1284,31 @@ Guile's foreign function interface.")
   (deprecated-package "guile2.2-gdbm-ffi" guile-gdbm-ffi))
 
 (define-public guile-sqlite3
-  (let ((commit "10c13a7e02ab1655c8a758e560cafc9d6eff26f4")
-        (revision "4"))
-    (package
-      (name "guile-sqlite3")
-      (version (git-version "0.0" revision commit))
-
-      ;; XXX: This used to be available read-only at
-      ;; <https://www.gitorious.org/guile-sqlite3/guile-sqlite3.git/> but it
-      ;; eventually disappeared, so we have our own copy here.
-      (home-page "https://notabug.org/civodul/guile-sqlite3.git")
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url home-page)
-                      (commit commit)))
-                (sha256
-                 (base32
-                  "0nhhswpd7nb2f0gfr55fzcc2xm3l2xx4rbljsd1clrm8fj2d7q9d"))
-                (file-name (string-append name "-" version "-checkout"))
-                (modules '((guix build utils)))
-                (snippet
-                 ;; Upgrade 'Makefile.am' to the current way of doing things.
-                 '(begin
-                    (substitute* "Makefile.am"
-                      (("TESTS_ENVIRONMENT")
-                       "TEST_LOG_COMPILER"))
-                    #t))))
-
-      (build-system gnu-build-system)
-      (native-inputs
-       `(("autoconf" ,autoconf)
-         ("automake" ,automake)
-         ("pkg-config" ,pkg-config)))
-      (inputs
-       `(("guile" ,guile-2.2)
-         ("sqlite" ,sqlite)))
-      (arguments
-       '(#:phases (modify-phases %standard-phases
-                    (add-after 'unpack 'autoreconf
-                      (lambda _
-                        (zero? (system* "autoreconf" "-vfi"))))
-                    (add-before 'build 'set-sqlite3-file-name
-                      (lambda* (#:key inputs #:allow-other-keys)
-                        (substitute* "sqlite3.scm"
-                          (("\"libsqlite3\"")
-                           (string-append "\"" (assoc-ref inputs "sqlite")
-                                          "/lib/libsqlite3\"")))
-                        #t)))))
-      (synopsis "Access SQLite databases from Guile")
-      (description
-       "This package provides Guile bindings to the SQLite database system.")
-      (license license:gpl3+))))
+  (package
+    (name "guile-sqlite3")
+    (version "0.1.0")
+    (home-page "https://notabug.org/civodul/guile-sqlite3.git")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url home-page)
+                    (commit (string-append "v" version))))
+              (sha256
+               (base32
+                "1nv8j7wk6b5n4p22szyi8lv8fs31rrzxhzz16gyj8r38c1fyp9qp"))
+              (file-name (string-append name "-" version "-checkout"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("autoconf" ,autoconf)
+       ("automake" ,automake)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("guile" ,guile-2.2)
+       ("sqlite" ,sqlite)))
+    (synopsis "Access SQLite databases from Guile")
+    (description
+     "This package provides Guile bindings to the SQLite database system.")
+    (license license:gpl3+)))
 
 (define-public haunt
   (package
@@ -1320,30 +1371,24 @@ interface for reading articles in any format.")
 (define-public guile-config
   (package
     (name "guile-config")
-    (version "0.2")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/a-sassmannshausen/guile-config")
-                    (commit "guile-config-0.2")))
-              (file-name (string-append name "-" version "-checkout"))
-              (sha256
-               (base32
-                "07q86vqdwmm81wwxz1d1ah27hbhs6qbn8kiizrfpj0s4bf95w3r9"))))
+    (version "0.3")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.com/a-sassmannshausen/guile-config")
+             (commit "ce12de3f438c6b2b59c43ee21bcd58251835fdf3")))
+       (file-name "guile-config-0.3-checkout")
+       (sha256 (base32 "02zbpin0r9m2vxmr7mv68v3xdn247dcck56kbzjn0gj4c2rhih85"))))
     (build-system gnu-build-system)
-    (arguments
-     '(#:phases (modify-phases %standard-phases
-                  (add-after 'unpack 'autoreconf
-                    (lambda _
-                      (zero? (system* "autoreconf" "-fi")))))))
     (native-inputs
      `(("autoconf" ,autoconf)
        ("automake" ,automake)
        ("pkg-config" ,pkg-config)
        ("texinfo" ,texinfo)))
-    (inputs
-     `(("guile" ,guile-2.2)))
-    (synopsis "Guile application configuration parsing library")
+    (inputs `(("guile" ,guile-2.2)))
+    (synopsis
+     "Guile application configuration parsing library.")
     (description
      "Guile Config is a library providing a declarative approach to
 application configuration specification.  The library provides clean
@@ -1352,7 +1397,8 @@ configuration file creation; configuration file parsing; command-line
 parameter parsing using getopt-long; basic GNU command-line parameter
 generation (--help, --usage, --version); automatic output generation for the
 above command-line parameters.")
-    (home-page "https://github.com/a-sassmannshausen/guile-config")
+    (home-page
+     "https://gitlab.com/a-sassmannshausen/guile-config")
     (license license:gpl3+)))
 
 (define-public guile-redis
diff --git a/gnu/packages/image-viewers.scm b/gnu/packages/image-viewers.scm
index 5abcdf9a2a..b2e67e52f9 100644
--- a/gnu/packages/image-viewers.scm
+++ b/gnu/packages/image-viewers.scm
@@ -60,7 +60,7 @@
 (define-public feh
   (package
     (name "feh")
-    (version "2.26.3")
+    (version "2.27")
     (home-page "https://feh.finalrewind.org/")
     (source (origin
               (method url-fetch)
@@ -68,7 +68,7 @@
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "08aagymgajcvciagwy2zdxhicvdfnjmd2xyx9bqjy7l1n16ydwrz"))))
+                "0kn6cka9m76697i495npd60ad64jnfnzv5z6znzyr0vlxx2nhcmg"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (modify-phases %standard-phases (delete 'configure))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index a2874be1a8..5ad6fe9487 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -394,6 +394,7 @@ extracting icontainer icon files.")
 (define-public libtiff
   (package
    (name "libtiff")
+   (replacement libtiff/fixed)
    (version "4.0.9")
    (source
      (origin
@@ -426,6 +427,17 @@ collection of tools for doing simple manipulations of TIFF images.")
                                   "See COPYRIGHT in the distribution."))
    (home-page "http://www.simplesystems.org/libtiff/")))
 
+(define libtiff/fixed
+  (package
+    (inherit libtiff)
+    (source
+      (origin
+        (inherit (package-source libtiff))
+        (patches
+          (append (origin-patches (package-source libtiff))
+                  (search-patches "libtiff-CVE-2018-8905.patch"
+                                  "libtiff-CVE-2018-10963.patch")))))))
+
 (define-public leptonica
   (package
     (name "leptonica")
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index e80da6d848..24e62142b9 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -47,14 +47,14 @@
     ;; The 7 release series has an incompatible API, while the 6 series is still
     ;; maintained. Don't update to 7 until we've made sure that the ImageMagick
     ;; users are ready for the 7-series API.
-    (version "6.9.9-43")
+    (version "6.9.10-3")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "09vfxb1ljfma7mvkcqp17bs7adlrfh6kc6k9hifkhgxf51vr7hk6"))))
+               "0njq3vp0f3d5992jsah5nhbc5id2bnl7myhdw669k0vmc55mmlcj"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags '("--with-frozenpaths" "--without-gcc-arch")
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index 747edc18d0..0f6a778360 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -2683,7 +2683,16 @@ documentation tools.")
                     "code.google.com/jarjar/jarjar-src-" version ".zip"))
               (sha256
                (base32
-                "1v8irhni9cndcw1l1wxqgry013s2kpj0qqn57lj2ji28xjq8ndjl"))))
+                "1v8irhni9cndcw1l1wxqgry013s2kpj0qqn57lj2ji28xjq8ndjl"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  ;; Delete bundled thirds-party jar archives.
+                  ;; TODO: unbundle maven-plugin-api.
+                  (delete-file "lib/asm-4.0.jar")
+                  (delete-file "lib/asm-commons-4.0.jar")
+                  (delete-file "lib/junit-4.8.1.jar")
+                  #t))))
     (build-system ant-build-system)
     (arguments
      `(;; Tests require junit, which ultimately depends on this package.
@@ -2691,6 +2700,26 @@ documentation tools.")
        #:build-target "jar"
        #:phases
        (modify-phases %standard-phases
+         (add-before 'build 'do-not-use-bundled-asm
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "build.xml"
+               (("<path id=\"path.build\">")
+                (string-append "<path id=\"path.build\"><fileset dir=\""
+                               (assoc-ref inputs "java-asm-bootstrap")
+                               "/share/java\" includes=\"**/*.jar\"/>"))
+               (("<zipfileset src=\"lib/asm-4.0.jar\"/>") "")
+               (("lib/asm-commons-4.0.jar")
+                (string-append (assoc-ref inputs "java-asm-bootstrap")
+                               "/share/java/asm-6.0.jar"))
+               (("<include name=\"org/objectweb/asm/commons/Remap\\*\\.class\"/>")
+                (string-append "<include name=\"org/objectweb/asm/"
+                               "commons/Remap*.class\"/>"
+                               "<include name=\"org/objectweb/asm/*.class\"/>"
+                               "<include name=\"org/objectweb/asm/"
+                               "signature/*.class\"/>"
+                               "<include name=\"org/objectweb/asm/"
+                               "commons/SignatureRemapper.class\"/>")))
+             #t))
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((target (string-append (assoc-ref outputs "out")
@@ -2698,6 +2727,8 @@ documentation tools.")
                (install-file (string-append "dist/jarjar-" ,version ".jar")
                              target))
              #t)))))
+    (inputs
+     `(("java-asm-bootstrap" ,java-asm-bootstrap)))
     (native-inputs
      `(("unzip" ,unzip)))
     (home-page "https://code.google.com/archive/p/jarjar/")
@@ -7111,7 +7142,8 @@ it manages project dependencies, gives diffs jars, and much more.")
     (name "java-aqute-libg-bootstrap")
     (arguments
      ;; Disable tests, at this stage of bootstrap we have no test frameworks.
-     `(#:tests? #f))
+     (substitute-keyword-arguments (package-arguments java-aqute-libg)
+       ((#:tests? _ #f) #f)))
     (inputs
      `(("slf4j-bootstrap" ,java-slf4j-api-bootstrap)
        ,@(delete `("slf4j" ,java-slf4j-api)
diff --git a/gnu/packages/libusb.scm b/gnu/packages/libusb.scm
index 62c936c191..e4b8bbbbed 100644
--- a/gnu/packages/libusb.scm
+++ b/gnu/packages/libusb.scm
@@ -7,6 +7,7 @@
 ;;; Copyright © 2016 Theodoros Foradis <theodoros@foradis.org>
 ;;; Copyright © 2017 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Vagrant Cascadian <vagrant@debian.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -214,6 +215,49 @@ with usb4java.")
 implementing @code{javax.usb} (JSR-80).")
     (license expat)))
 
+(define-public python-libusb1
+  (package
+    (name "python-libusb1")
+    (version "1.6.4")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "libusb1" version))
+       (sha256
+        (base32
+         "03b7xrz8vqg8w0za5r503jhcmbd1ls5610jcja1rqz833nf0v4wc"))))
+    (build-system python-build-system)
+    (arguments
+     `(#:modules ((srfi srfi-1)
+                  (guix build utils)
+                  (guix build python-build-system))
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'install-license-files 'remove-incorrect-license
+           (lambda* (#:key out #:allow-other-keys)
+             ;; Was relicensed to LGPL 2.1+, but old COPYING file still left
+             ;; in source. Remove it so it does not get installed.
+             (delete-file "COPYING")
+             #t))
+         (add-after 'unpack 'fix-libusb-reference
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* "usb1/libusb1.py"
+               (("libusb_path = ctypes.util.find_library\\(base_name\\)")
+                (string-append
+                 "libusb_path = \""
+                 (find (negate symbolic-link?)
+                       (find-files (assoc-ref inputs "libusb")
+                                   "^libusb.*\\.so\\..*"))
+                 "\"")))
+             #t)))))
+    (inputs `(("libusb" ,libusb)))
+    (home-page "https://github.com/vpelletier/python-libusb1")
+    (synopsis "Pure-python wrapper for libusb-1.0")
+    (description "Libusb is a library that gives applications easy access to
+USB devices on various operating systems.  This package provides a Python
+wrapper for accessing libusb-1.0.")
+    (license lgpl2.1+)))
+
 (define-public python-pyusb
   (package
     (name "python-pyusb")
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index a28aa5a2ea..5c1f679a36 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -402,8 +402,8 @@ It has been modified to remove all non-free binary blobs.")
 ;; supports qemu "virt" machine and possibly a large number of ARM boards.
 ;; See : https://wiki.debian.org/DebianKernel/ARMMP.
 
-(define %linux-libre-version "4.17.2")
-(define %linux-libre-hash "0xkswi9vhbzi466pqvyli7glkvdyxhphn8yjg69kpw37rpw8ix5l")
+(define %linux-libre-version "4.17.3")
+(define %linux-libre-hash "06mjbs3i0xq1h1cgr6xldr6a8rxsy30mf86wp3n2ff6l5v78iw2q")
 
 (define-public linux-libre
   (make-linux-libre %linux-libre-version
@@ -411,8 +411,8 @@ It has been modified to remove all non-free binary blobs.")
                     %linux-compatible-systems
                     #:configuration-file kernel-config))
 
-(define %linux-libre-4.14-version "4.14.51")
-(define %linux-libre-4.14-hash "1ifczslgp3ng0948l5p0khcnfkv9i44mq0bzk1y8mwdhy4mik0b9")
+(define %linux-libre-4.14-version "4.14.52")
+(define %linux-libre-4.14-hash "0lx916iw33n32h1fca59r7mh6l2smyml6igvzhimcah62hqx4rk8")
 
 (define-public linux-libre-4.14
   (make-linux-libre %linux-libre-4.14-version
@@ -421,8 +421,8 @@ It has been modified to remove all non-free binary blobs.")
                     #:configuration-file kernel-config))
 
 (define-public linux-libre-4.9
-  (make-linux-libre "4.9.109"
-                    "1i27fmlr0b05n4qri2vxdbg0qddwk1clyaramwbl3w0w10k63qkc"
+  (make-linux-libre "4.9.110"
+                    "0nzfna9w9a45y521d3dcxkdv66gn38n4pq814rdqazk74qb5macn"
                     %intel-compatible-systems
                     #:configuration-file kernel-config))
 
diff --git a/gnu/packages/machine-learning.scm b/gnu/packages/machine-learning.scm
index 59e38bb88e..a86bdcb5ed 100644
--- a/gnu/packages/machine-learning.scm
+++ b/gnu/packages/machine-learning.scm
@@ -49,6 +49,7 @@
   #:use-module (gnu packages maths)
   #:use-module (gnu packages mpi)
   #:use-module (gnu packages ocaml)
+  #:use-module (gnu packages onc-rpc)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages python)
@@ -233,7 +234,7 @@ classification.")
                #t))
            (add-after 'disable-broken-tests 'autogen
              (lambda _
-               (zero? (system* "bash" "autogen.sh")))))))
+               (invoke "bash" "autogen.sh"))))))
       (inputs
        `(("python" ,python-2) ; only Python 2 is supported
          ("libxml2" ,libxml2)))
@@ -667,15 +668,18 @@ and a QP solver.")
              ;; No test target, so we build and run the unit tests here.
              (let ((test-dir (string-append "../dlib-" ,version "/dlib/test")))
                (with-directory-excursion test-dir
-                 (and (zero? (system* "make" "-j" (number->string (parallel-job-count))))
-                      (zero? (system* "./dtest" "--runall")))))))
+                 (invoke "make" "-j" (number->string (parallel-job-count)))
+                 (invoke "./dtest" "--runall"))
+               #t)))
          (add-after 'install 'delete-static-library
            (lambda* (#:key outputs #:allow-other-keys)
              (delete-file (string-append (assoc-ref outputs "out")
                                          "/lib/libdlib.a"))
              #t)))))
     (native-inputs
-     `(("pkg-config" ,pkg-config)))
+     `(("pkg-config" ,pkg-config)
+       ;; For tests.
+       ("libnsl" ,libnsl)))
     (inputs
      `(("giflib" ,giflib)
        ("lapack" ,lapack)
@@ -726,7 +730,7 @@ computing environments.")
              (setenv "HOME" "/tmp")
              ;; Step out of the source directory just to be sure.
              (chdir "..")
-             (zero? (system* "nosetests" "-v" "sklearn")))))))
+             (invoke "nosetests" "-v" "sklearn"))))))
     (inputs
      `(("openblas" ,openblas)))
     (native-inputs
diff --git a/gnu/packages/markup.scm b/gnu/packages/markup.scm
index bce411d0bd..e15e8497b7 100644
--- a/gnu/packages/markup.scm
+++ b/gnu/packages/markup.scm
@@ -3,7 +3,7 @@
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Nils Gillmann <ng0@n0.is>
-;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -137,10 +137,9 @@ convert it to structurally valid XHTML (or HTML).")
          (replace 'configure
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (setenv "CC" "gcc")
-             (zero? (system*
-                     "./configure.sh"
+             (invoke "./configure.sh"
                      (string-append "--prefix=" (assoc-ref outputs "out"))
-                     "--shared")))))))
+                     "--shared"))))))
     (synopsis "Markdown processing library, written in C")
     (description
      "Discount is a markdown implementation, written in C.  It provides a
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index 7d70ac1fa6..8d7535a8dc 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -1400,12 +1400,18 @@ script files.")
 (define-public qtoctave
   (package (inherit octave)
     (name "qtoctave")
+    (source (origin
+              (inherit (package-source octave))
+              (patches (append (origin-patches (package-source octave))
+                               (search-patches
+                                "qtoctave-qt-5.11-fix.patch")))))
     (inputs
      `(("qscintilla" ,qscintilla)
        ("qt" ,qtbase)
        ,@(package-inputs octave)))
     (native-inputs
      `(("qttools" , qttools) ;for lrelease
+       ("texlive" ,texlive) ;for texi2dvi
        ,@(package-native-inputs octave)))
     (arguments
      (substitute-keyword-arguments (package-arguments octave)
@@ -1598,7 +1604,7 @@ September 2004}")
                             ,@configure-flags)))
               (format #t "build directory: ~s~%" (getcwd))
               (format #t "configure flags: ~s~%" flags)
-              (zero? (apply system* "./configure" flags)))))
+              (apply invoke "./configure" flags))))
         (add-after 'configure 'clean-local-references
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
@@ -1755,7 +1761,8 @@ savings are consistently > 5x.")
           ;; documentation is difficult.
           (lambda* (#:key outputs #:allow-other-keys)
             (let* ((out (assoc-ref outputs "out")))
-              (for-each delete-file (find-files out "\\.html$")))))
+              (for-each delete-file (find-files out "\\.html$"))
+              #t)))
          (add-after 'install 'clean-install
           ;; Clean up unnecessary build logs from installation.
           (lambda* (#:key outputs #:allow-other-keys)
@@ -1766,7 +1773,8 @@ savings are consistently > 5x.")
                               (delete-file f))))
                         '("configure.log" "make.log" "gmake.log"
                           "test.log" "error.log" "RDict.db"
-                          "uninstall.py"))))))))
+                          "uninstall.py"))
+              #t))))))
     (home-page "http://slepc.upv.es")
     (synopsis "Scalable library for eigenproblems")
     (description "SLEPc is a software library for the solution of large sparse
@@ -1911,8 +1919,8 @@ IORDERINGSC  = $(IPORD) $(IMETIS) $(ISCOTCH)"
           ;; By default only the d-precision library is built.  Make with "all"
           ;; target so that all precision libraries and examples are built.
           (lambda _
-            (zero? (system* "make" "all"
-                            (format #f "-j~a" (parallel-job-count))))))
+            (invoke "make" "all"
+                    (format #f "-j~a" (parallel-job-count)))))
          (replace 'check
           ;; Run the simple test drivers, which read test input from stdin:
           ;; from the "real" input for the single- and double-precision
@@ -2231,11 +2239,11 @@ CDEFS       = -DAdd_"
              ;; isn't used anyway.)
              (setenv "OMPI_MCA_plm_rsh_agent" (which "cat"))
              (with-directory-excursion "EXAMPLE"
-               (and
-                (zero? (system* "mpirun" "-n" "2"
-                                "./pddrive" "-r" "1" "-c" "2" "g20.rua"))
-                (zero? (system* "mpirun" "-n" "2"
-                                "./pzdrive" "-r" "1" "-c" "2" "cg20.cua"))))))
+               (invoke "mpirun" "-n" "2"
+                       "./pddrive" "-r" "1" "-c" "2" "g20.rua")
+               (invoke "mpirun" "-n" "2"
+                       "./pzdrive" "-r" "1" "-c" "2" "cg20.cua"))
+             #t))
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
              ;; Library is placed in lib during the build phase.  Copy over
@@ -2283,7 +2291,7 @@ implemented in ANSI C, and MPI for communications.")
        (modify-phases %standard-phases
          (add-after
           'unpack 'chdir-to-src
-          (lambda _ (chdir "src")))
+          (lambda _ (chdir "src") #t))
          (replace
           'configure
           (lambda _
@@ -2320,7 +2328,8 @@ YACC = bison -pscotchyy -y -b y
                           ;; XXX: Causes invalid frees in superlu-dist tests
                           ;; "SCOTCH_PTHREAD"
                           ;; "SCOTCH_PTHREAD_NUMBER=2"
-                          "restrict=__restrict"))))))
+                          "restrict=__restrict"))))
+            #t))
          (add-after
           'build 'build-esmumps
           (lambda _
@@ -2330,24 +2339,25 @@ YACC = bison -pscotchyy -y -b y
             ;; isn't used anyway.)
             (setenv "OMPI_MCA_plm_rsh_agent" (which "cat"))
 
-            (zero? (system* "make"
-                            (format #f "-j~a" (parallel-job-count))
-                            "esmumps"))))
+            (invoke "make"
+                    (format #f "-j~a" (parallel-job-count))
+                    "esmumps")))
          (replace
           'install
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
               (mkdir out)
-              (zero? (system* "make"
-                              (string-append "prefix=" out)
-                              "install"))
+              (invoke "make"
+                      (string-append "prefix=" out)
+                      "install")
               ;; esmumps files are not installed with the above
               (for-each (lambda (f)
                           (copy-file f (string-append out "/include/" f)))
                         (find-files "../include" ".*esmumps.h$"))
               (for-each (lambda (f)
                           (copy-file f (string-append out "/lib/" f)))
-                        (find-files "../lib" "^lib.*esmumps.*"))))))))
+                        (find-files "../lib" "^lib.*esmumps.*"))
+              #t))))))
     (home-page "http://www.labri.fr/perso/pelegrin/scotch/")
     (synopsis "Programs and libraries for graph algorithms")
     (description "SCOTCH is a set of programs and libraries which implement
diff --git a/gnu/packages/mes.scm b/gnu/packages/mes.scm
index 8183b2b827..52464e28d4 100644
--- a/gnu/packages/mes.scm
+++ b/gnu/packages/mes.scm
@@ -73,7 +73,7 @@ extensive examples, including parsers for the Javascript and C99 languages.")
   (let ((triplet "i686-unknown-linux-gnu"))
     (package
       (name "mes")
-      (version "0.15")
+      (version "0.16")
       (source (origin
                 (method url-fetch)
                 (uri (string-append "https://gitlab.com/janneke/mes"
@@ -81,7 +81,7 @@ extensive examples, including parsers for the Javascript and C99 languages.")
                                     "/mes-" version ".tar.gz"))
                 (sha256
                  (base32
-                  "0kj2ywgii1795gxj6k29zxa0848h2j0ihbwlgn55wdalswl165dq"))))
+                  "0c4vz1qw767af5h615055hh8zjwwmwf5mwkb64l0l921zaa9hg2n"))))
       (build-system gnu-build-system)
       (supported-systems '("i686-linux" "x86_64-linux"))
       (propagated-inputs
@@ -120,7 +120,7 @@ Guile-] Scheme interpreter prototype in C and a Nyacc-based C compiler in
 (define-public mescc-tools
   (package
     (name "mescc-tools")
-    (version "0.4")
+    (version "0.5.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -130,7 +130,7 @@ Guile-] Scheme interpreter prototype in C and a Nyacc-based C compiler in
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1iwc8xqwzdaqckb4jkkisljrgn8ii4bl7dzk1l2kpv98hsyq9vi1"))))
+                "0rsxbjc3bg0jl3h7ai4hndxx2iyyk8bvwj9nd3xv2vgz3bmypnah"))))
     (build-system gnu-build-system)
     (supported-systems '("i686-linux" "x86_64-linux"))
     (arguments
diff --git a/gnu/packages/mpd.scm b/gnu/packages/mpd.scm
index 3c06fb0e64..57a04e1113 100644
--- a/gnu/packages/mpd.scm
+++ b/gnu/packages/mpd.scm
@@ -276,7 +276,7 @@ information about tracks being played to a scrobbler, such as Libre.FM.")
      '(#:phases
        (modify-phases %standard-phases
          (replace 'check
-           (lambda _ (zero? (system* "python" "mpd_test.py")))))))
+           (lambda _ (invoke "python" "mpd_test.py"))))))
     (native-inputs `(("python-mock" ,python-mock)))
     (home-page "https://github.com/Mic92/python-mpd2")
     (synopsis "Python MPD client library")
diff --git a/gnu/packages/music.scm b/gnu/packages/music.scm
index 824b03dc0c..deb4f222b8 100644
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@@ -17,6 +17,7 @@
 ;;; Copyright © 2018 nee <nee.git@hidamari.blue>
 ;;; Copyright © 2018 Stefan Reichör <stefan@xsteve.at>
 ;;; Copyright © 2018 Pierre Neidhardt <ambrevar@gmail.com>
+;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -43,6 +44,7 @@
   #:use-module (guix build-system ant)
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system meson)
+  #:use-module (guix build-system perl)
   #:use-module (guix build-system python)
   #:use-module (guix build-system scons)
   #:use-module (guix build-system glib-or-gtk)
@@ -104,6 +106,7 @@
   #:use-module (gnu packages pcre)
   #:use-module (gnu packages pdf)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages perl-web)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages protobuf)
   #:use-module (gnu packages pulseaudio) ;libsndfile
@@ -3510,16 +3513,16 @@ audio samples and various soft sythesizers.  It can receive input from a MIDI ke
 (define-public musescore
   (package
     (name "musescore")
-    (version "2.2.1")
+    (version "2.3")
     (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "https://github.com/musescore/MuseScore/archive/"
-                    "v" version ".tar.gz"))
-              (file-name (string-append name "-" version ".tar.gz"))
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/musescore/MuseScore.git")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
               (sha256
                (base32
-                "1ml99ayzpdyd18cypcp0lbsbasfg3abw57i5fl7ph5739vikj6i6"))
+                "1y5x0a40x7ji4g4181adm95qxk2dfjiy5xb5wksps90ji9q2qlcs"))
               (modules '((guix build utils)))
               (snippet
                ;; Un-bundle OpenSSL and remove unused libraries.
@@ -3540,8 +3543,8 @@ audio samples and various soft sythesizers.  It can receive input from a MIDI ke
        `(,(string-append "PREFIX=" (assoc-ref %outputs "out"))
          "USE_SYSTEM_FREETYPE=ON"
          "DOWNLOAD_SOUNDFONT=OFF"
-         ;; The following is not supported since Qt 5.11.  Can be
-         ;; removed in Musescore 2.2.2+.
+         ;; The following is not supported since Qt 5.11.  May be removed in
+         ;; a future release.
          "BUILD_WEBKIT=OFF")
        ;; There are tests, but no simple target to run.  The command
        ;; used to run them is:
@@ -3554,14 +3557,6 @@ audio samples and various soft sythesizers.  It can receive input from a MIDI ke
        #:tests? #f
        #:phases
        (modify-phases %standard-phases
-         ;; Fix Qt 5.11 upgrade.  Should be fixed in 2.2.2+, see:
-         ;; <https://github.com/musescore/MuseScore/commit/d10e70415c8e52e2ba9d45de564467e42f66c102>
-         (add-after 'unpack 'patch-sources
-           (lambda _
-             (substitute* "all.h"
-               (("#include <QRadioButton>") "#include <QRadioButton>
-#include <QButtonGroup>"))
-             #t))
          (delete 'configure))))
     (inputs
      `(("alsa-lib" ,alsa-lib)
@@ -4019,6 +4014,57 @@ mb_client, is a development library geared towards developers who wish to add
 MusicBrainz lookup capabilities to their applications.")
     (license license:lgpl2.1+)))
 
+(define-public perl-musicbrainz-discid
+  (package
+    (name "perl-musicbrainz-discid")
+    (version "0.04")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://cpan/authors/id/N/NJ/NJH/MusicBrainz-DiscID-"
+                    version ".tar.gz"))
+              (sha256
+               (base32
+                "1i4qk1qfcmxdibqkyfjrrjdq2zk42vjcz590qgiyc47fi9p6xx1j"))))
+    (build-system perl-build-system)
+    (native-inputs `(("pkg-config" ,pkg-config)
+                     ("which" ,which)))
+    (inputs `(("libdiscid" ,libdiscid)))
+    (home-page "https://metacpan.org/release/MusicBrainz-DiscID")
+    (synopsis "Perl interface to the MusicBrainz libdiscid library")
+    (description
+     "The @code{MusicBrainz::DiscID} module is a Perl interface to the
+MusicBrainz libdiscid library, allowing you to manipulate digital audio
+compact disc (CDDA) identifiers.")
+    (license license:gpl2)))
+
+(define-public perl-webservice-musicbrainz
+  (package
+    (name "perl-webservice-musicbrainz")
+    (version "1.0.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://cpan/authors/id/B/BF/BFAIST/WebService-MusicBrainz-"
+                    version ".tar.gz"))
+              (sha256
+               (base32
+                "182z3xjajk6s7k5xm3kssjy3hqx2qbnq4f8864hma098ryy2ph3a"))))
+    (build-system perl-build-system)
+    (arguments
+     ;; Tests try to connect to http://musicbrainz.org.
+     '(#:tests? #f))
+    (native-inputs
+     `(("perl-module-build" ,perl-module-build)))
+    (propagated-inputs
+     `(("perl-mojolicious" ,perl-mojolicious)))
+    (home-page "https://metacpan.org/release/WebService-MusicBrainz")
+    (synopsis "Web service API to the MusicBrainz database")
+    (description
+     "This module searches the MusicBrainz database through their web service
+at @code{musicbrainz.org}.")
+    (license license:perl-license)))
+
 (define-public clyrics
   (package
     (name "clyrics")
diff --git a/gnu/packages/ntp.scm b/gnu/packages/ntp.scm
index e9ae9fa466..8fc0a1eb97 100644
--- a/gnu/packages/ntp.scm
+++ b/gnu/packages/ntp.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017, 2018 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -163,8 +164,8 @@ minimalist than ntpd.")
                       ;; date that is recorded in binaries.  It must be a
                       ;; "recent date" since it is used to detect bogus dates
                       ;; received from servers.
-                      (setenv "COMPILE_DATE" (number->string 1450563040))
-                      (zero? (system* "sh" "autogen.sh")))))))
+                      (setenv "COMPILE_DATE" (number->string 1530144000))
+                      (invoke "sh" "autogen.sh"))))))
     (inputs `(("openssl" ,openssl)
               ("libevent" ,libevent)))
     (native-inputs `(("pkg-config" ,pkg-config)
diff --git a/gnu/packages/opencl.scm b/gnu/packages/opencl.scm
index b31fa09474..644cd95e93 100644
--- a/gnu/packages/opencl.scm
+++ b/gnu/packages/opencl.scm
@@ -21,9 +21,21 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix download)
   #:use-module (guix git-download)
-  #:use-module (guix packages)
   #:use-module ((guix licenses) #:prefix license:)
-  #:use-module (gnu packages python))
+  #:use-module (guix packages)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages gl)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages compression)
+  #:use-module (gnu packages libedit)
+  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages ruby)
+  #:use-module (gnu packages video)
+  #:use-module (gnu packages xdisorg)
+  #:use-module (gnu packages xorg))
 
 ;; This file adds OpenCL implementation related packages. Due to the fact that
 ;; OpenCL devices are not available during build (store environment), tests are
@@ -118,3 +130,161 @@ programming.")
     (description
      "This package provides the @dfn{host API} C++ headers for OpenCL.")
     (license license:expat)))
+
+(define-public ocl-icd
+  (package
+    (name "ocl-icd")
+    (version "2.2.12")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://forge.imag.fr/frs/download.php/836/ocl-icd-"
+                    version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1x2dr8p4dkfds56r38av360i3nv1y3326jmshxvjngaf6mlg6rbn"))
+              (modules '((guix build utils)))
+              (snippet
+               '(delete-file-recursively "khronos-headers"))))
+    (native-inputs
+     `(("opencl-headers" ,opencl-headers)
+       ("ruby" ,ruby)))
+    (inputs
+     `(("libgcrypt" ,libgcrypt)))
+    (build-system gnu-build-system)
+    (arguments
+     '(#:configure-flags '("DEBUG_OCL_ICD=1")))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "OPENCL_VENDOR_PATH")
+            (files '("etc/OpenCL/vendors")))))
+    (search-paths native-search-paths)
+    (home-page "https://forge.imag.fr/projects/ocl-icd/")
+    (synopsis "OpenCL loader for Installable Client Drivers (ICDs)")
+    (description
+     "OpenCL implementations are provided as ICDs (Installable Client
+Drivers).  An OpenCL program can use several ICDs thanks to the use of an ICD
+Loader as provided by this package.")
+    (license license:bsd-2)))
+
+(define-public clinfo
+  (package
+    (name "clinfo")
+    (version "2.2.18.04.06")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/Oblomov/clinfo/archive/"
+                    version ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0v7cy01irwdgns6lzaprkmm0502pp5a24zhhffydxz1sgfjj2w7p"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("opencl-headers" ,opencl-headers)))
+    (inputs
+     `(("ocl-icd" ,ocl-icd)))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (replace 'build
+           (lambda _
+             (let ((cores (number->string (parallel-job-count))))
+               (setenv "CC" "gcc")
+               (invoke "make" "-j" cores))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (invoke "make" "install" (string-append
+                                       "PREFIX="
+                                       (assoc-ref outputs "out"))))))
+       #:tests? #f))
+    (home-page "https://github.com/Oblomov/clinfo")
+    (synopsis "Print information about OpenCL platforms and devices")
+    ;; Only the implementation installed via Guix will be detected.
+    (description
+     "This package provides the @command{clinfo} command that enumerates all
+possible (known) properties of the OpenCL platform and devices available on
+the system.")
+    (license license:cc0)))
+
+(define-public beignet
+  (package
+    (name "beignet")
+    (version "1.3.2")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/intel/beignet/archive/Release_v"
+                    version
+                    ".tar.gz"))
+              (file-name (string-append name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "18r0lq3dkd4yn6bxa45s2lrr9cjbg70nr2nn6xablvgqwzw0jb0r"))
+              (patches (search-patches "beignet-correct-file-names.patch"))
+              (modules '((guix build utils)))
+              (snippet
+               ;; There's a suspicious .isa binary file under kernels/.
+               ;; Remove it.
+               '(for-each delete-file (find-files "." "\\.isa$")))))
+    (native-inputs `(("pkg-config" ,pkg-config)
+                     ("python" ,python)))
+    (inputs `(("clang@3.7" ,clang-3.7)
+              ("clang-runtime@3.7" ,clang-runtime-3.7)
+              ("glu" ,glu)
+              ("llvm@3.7" ,llvm-3.7)
+              ("libdrm" ,libdrm)
+              ("libedit" ,libedit)
+              ("libpthread-stubs", libpthread-stubs)
+              ("libsm" ,libsm)
+              ("libva" ,libva)
+              ("libxfixes" ,libxfixes)
+              ("libxext" ,libxext)
+              ("mesa-utils" ,mesa-utils)
+              ("ncurses" ,ncurses)
+              ("ocl-icd" ,ocl-icd)
+              ("opencl-headers" ,opencl-headers)
+              ("xextproto" ,xextproto)
+              ("zlib" ,zlib)))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:configure-flags
+       (list (string-append "-DCLANG_LIBRARY_DIR="
+                            (assoc-ref %build-inputs "clang@3.7") "/lib")
+             "-DENABLE_GL_SHARING=ON"
+             "-DEXPERIMENTAL_DOUBLE=ON")
+
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'remove-headers
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (delete-file-recursively
+                (string-append out "/include"))
+               #t)))
+         (add-after 'remove-headers 'install-kernels
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (builddir (getcwd))
+                    (source-dir (string-append
+                                 builddir
+                                 "/../beignet-Release_v1.3.2/kernels")))
+               (copy-recursively source-dir
+                                 (string-append out "/lib/beignet/kernels"))
+               #t))))
+       ;; Beignet tries to find GPU when running tests, which is not available
+       ;; during build.
+       #:tests? #f))
+    (home-page "https://wiki.freedesktop.org/www/Software/Beignet/")
+    (synopsis "OpenCL framework for Intel GPUs")
+    (description
+     "Beignet is an implementation of the OpenCL specification.  This code
+base contains the code to run OpenCL programs on Intel GPUs---IvyBridge,
+Haswell, Skylake, Apollolake, etc.  It defines and implements the OpenCL host
+functions required to initialize the device, create the command queues, the
+kernels and the programs, and run them on the GPU.  The code also contains a
+back-end for the LLVM compiler framework.")
+    (license license:lgpl2.1+)))
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index 6a55f62ee6..1c31230e58 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -2,7 +2,7 @@
 ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2017 Muriithi Frederick Muriuki <fredmanglis@gmail.com>
-;;; Copyright © 2017 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2017, 2018 Oleg Pykhalov <go.wigust@gmail.com>
 ;;; Copyright © 2017 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Julien Lepiller <julien@lepiller.eu>
@@ -41,6 +41,7 @@
   #:use-module (gnu packages curl)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages docbook)
+  #:use-module (gnu packages emacs)
   #:use-module (gnu packages file)
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages glib)
@@ -433,20 +434,27 @@ sub-directory.")
 
 (define-public emacs-nix-mode
   (package
-    (inherit nix)
     (name "emacs-nix-mode")
+    (version "1.2.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/NixOS/nix-mode/archive/v"
+                           version ".tar.gz"))
+       (file-name (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "06aqz0czznsj8835jqnk794sy2p6pa8kxfqwh0nl5d5vxivria6z"))))
     (build-system emacs-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'chdir-elisp
-           ;; Elisp directory is not in root of the source.
-           (lambda _
-             (chdir "misc/emacs"))))))
+    (inputs
+     `(("emacs-company" ,emacs-company)
+       ("emacs-mmm-mode" ,emacs-mmm-mode)))
+    (home-page "https://github.com/NixOS/nix-mode")
     (synopsis "Emacs major mode for editing Nix expressions")
     (description "@code{nixos-mode} provides an Emacs major mode for editing
 Nix expressions.  It supports syntax highlighting, indenting and refilling of
-comments.")))
+comments.")
+    (license license:lgpl2.1+)))
 
 (define-public stow
   (package
diff --git a/gnu/packages/patches/beignet-correct-file-names.patch b/gnu/packages/patches/beignet-correct-file-names.patch
new file mode 100644
index 0000000000..2c5d0bbaea
--- /dev/null
+++ b/gnu/packages/patches/beignet-correct-file-names.patch
@@ -0,0 +1,32 @@
+Help CMake find Clang's libraries.
+Have it install the ICD file in the right place.
+
+diff --git a/CMake/FindLLVM.cmake b/CMake/FindLLVM.cmake
+index 5457f248..e8e8f94a 100644
+--- a/CMake/FindLLVM.cmake
++++ b/CMake/FindLLVM.cmake
+@@ -107,7 +107,7 @@ endif (LLVM_VERSION_NODOT VERSION_GREATER 34)
+ macro(add_one_lib name)
+   FIND_LIBRARY(CLANG_LIB
+     NAMES ${name}
+-    PATHS ${LLVM_LIBRARY_DIR} NO_DEFAULT_PATH)
++    PATHS ${CLANG_LIBRARY_DIR} NO_DEFAULT_PATH)
+   set(CLANG_LIBRARIES ${CLANG_LIBRARIES} ${CLANG_LIB})
+ 	unset(CLANG_LIB CACHE)
+ endmacro()
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index c11acbb2..fb99e5c8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -217,7 +217,7 @@ IF(OCLIcd_FOUND)
+     "intel-beignet.icd.in"
+     "${ICD_FILE_NAME}"
+   )
+-  install (FILES ${CMAKE_CURRENT_BINARY_DIR}/${ICD_FILE_NAME} DESTINATION /etc/OpenCL/vendors)
++  install (FILES ${CMAKE_CURRENT_BINARY_DIR}/${ICD_FILE_NAME} DESTINATION etc/OpenCL/vendors COMPONENT config)
+ ELSE(OCLIcd_FOUND)
+   MESSAGE(STATUS "Looking for OCL ICD header file - not found")
+   MESSAGE(FATAL_ERROR "OCL ICD loader miss. If you really want to disable OCL ICD support, please run cmake with option -DOCLICD_COMPAT=0.")
+--
+2.14.3
+
diff --git a/gnu/packages/patches/emacs-browse-at-remote-cgit-gnu.patch b/gnu/packages/patches/emacs-browse-at-remote-cgit-gnu.patch
deleted file mode 100644
index b90017fdb4..0000000000
--- a/gnu/packages/patches/emacs-browse-at-remote-cgit-gnu.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-Copyright © 2018 Oleg Pykhalov <go.wigust@gmail.com>
-
-This patch adds a support for Git repositories hosted on git.savannah.gnu.org.
-
-Upstream bug URL:
-
-https://github.com/rmuslimov/browse-at-remote/pull/46
-
-From cd2ccdaef8b1d97337d790175f71cc3dbcfcff64 Mon Sep 17 00:00:00 2001
-From: Oleg Pykhalov <go.wigust@gmail.com>
-Date: Fri, 26 Jan 2018 00:05:30 +0300
-Subject: [PATCH] Add support for repositories that are hosted on gnu cgit
-
----
- browse-at-remote.el | 21 ++++++++++++++++++++-
- 1 file changed, 20 insertions(+), 1 deletion(-)
-
-diff --git a/browse-at-remote.el b/browse-at-remote.el
-index 66967b3..e210d18 100644
---- a/browse-at-remote.el
-+++ b/browse-at-remote.el
-@@ -44,7 +44,8 @@
- (defcustom browse-at-remote-remote-type-domains
-   '(("bitbucket.org" ."bitbucket")
-     ("github.com" . "github")
--    ("gitlab.com" . "gitlab"))
-+    ("gitlab.com" . "gitlab")
-+    ("git.savannah.gnu.org" . "gnu"))
-   "Alist of domain patterns to remote types."
- 
-   :type '(alist :key-type (string :tag "Domain")
-@@ -199,6 +200,24 @@ If HEAD is detached, return nil."
-     (if (fboundp formatter)
-         formatter nil)))
- 
-+(defun browse-at-remote-gnu-format-url (repo-url)
-+  "Get a gnu formatted URL."
-+  (replace-regexp-in-string
-+   (concat "https://" (car (rassoc "gnu" browse-at-remote-remote-type-domains))
-+           "/\\(git\\).*\\'")
-+   "cgit" repo-url nil nil 1))
-+
-+(defun browse-at-remote--format-region-url-as-gnu (repo-url location filename &optional linestart lineend)
-+  "URL formatter for gnu."
-+  (let ((repo-url (browse-at-remote-gnu-format-url repo-url)))
-+    (cond
-+     (linestart (format "%s.git/tree/%s?h=%s#n%d" repo-url filename location linestart))
-+     (t (format "%s.git/tree/%s?h=%s" repo-url filename location)))))
-+
-+(defun browse-at-remote--format-commit-url-as-gnu (repo-url commithash)
-+  "Commit URL formatted for gnu"
-+  (format "%s.git/commit/?id=%s" (browse-at-remote-gnu-format-url repo-url) commithash))
-+
- (defun browse-at-remote--format-region-url-as-github (repo-url location filename &optional linestart lineend)
-   "URL formatted for github."
-   (cond
--- 
-2.15.1
-
diff --git a/gnu/packages/patches/gcc-8-strmov-store-file-names.patch b/gnu/packages/patches/gcc-8-strmov-store-file-names.patch
new file mode 100644
index 0000000000..f8e6b951b2
--- /dev/null
+++ b/gnu/packages/patches/gcc-8-strmov-store-file-names.patch
@@ -0,0 +1,110 @@
+Make sure that statements such as:
+
+  strcpy (dst, "/gnu/store/…");
+
+or
+
+  static const char str[] = "/gnu/store/…";
+  …
+  strcpy (dst, str);
+
+do not result in chunked /gnu/store strings that are undetectable by
+Guix's GC and its grafting code.  See <https://bugs.gnu.org/24703>
+and <https://bugs.gnu.org/30395>.
+
+--- gcc-5.3.0/gcc/builtins.c	2016-10-18 10:50:46.080616285 +0200
++++ gcc-5.3.0/gcc/builtins.c	2016-11-09 15:26:43.693042737 +0100
+@@ -3012,6 +3012,58 @@ determine_block_size (tree len, rtx len_rtx,
+ 			  GET_MODE_MASK (GET_MODE (len_rtx)));
+ }
+ 
++extern void debug_tree (tree);
++
++/* Return true if STR contains the string "/gnu/store".  */
++
++bool
++store_reference_p (tree str)
++{
++  if (getenv ("GUIX_GCC_DEBUG") != NULL)
++    debug_tree (str);
++
++  if (TREE_CODE (str) == ADDR_EXPR)
++    str = TREE_OPERAND (str, 0);
++
++  if (TREE_CODE (str) == VAR_DECL
++      && TREE_STATIC (str)
++      && TREE_READONLY (str))
++    {
++      /* STR may be a 'static const' variable whose initial value
++         is a string constant.  See <https://bugs.gnu.org/30395>.  */
++      str = DECL_INITIAL (str);
++      if (str == NULL_TREE)
++        return false;
++    }
++
++  if (TREE_CODE (str) != STRING_CST)
++    return false;
++
++  int len;
++  const char *store;
++
++  store = getenv ("NIX_STORE") ? getenv ("NIX_STORE") : "/gnu/store";
++  len = strlen (store);
++
++  /* Size of the hash part of store file names, including leading slash and
++     trailing hyphen.  */
++  const int hash_len = 34;
++
++  if (TREE_STRING_LENGTH (str) < len + hash_len)
++    return false;
++
++  /* We cannot use 'strstr' because 'TREE_STRING_POINTER' returns a string
++     that is not necessarily NUL-terminated.  */
++
++  for (int i = 0; i < TREE_STRING_LENGTH (str) - (len + hash_len); i++)
++    {
++      if (strncmp (TREE_STRING_POINTER (str) + i, store, len) == 0)
++	return true;
++    }
++
++  return false;
++}
++
+ /* Try to verify that the sizes and lengths of the arguments to a string
+    manipulation function given by EXP are within valid bounds and that
+    the operation does not lead to buffer overflow or read past the end.
+@@ -3605,6 +3657,13 @@ expand_builtin_memory_copy_args (tree dest, tree src, tree len,
+   unsigned HOST_WIDE_INT max_size;
+   unsigned HOST_WIDE_INT probable_max_size;
+ 
++  /* Do not emit block moves, which translate to the 'movabs' instruction on
++     x86_64, when SRC refers to store items.  That way, store references
++     remain visible to the Guix GC and grafting code.  See
++     <https://bugs.gnu.org/24703>.  */
++  if (store_reference_p (src))
++    return NULL_RTX;
++
+   /* If DEST is not a pointer type, call the normal function.  */
+   if (dest_align == 0)
+     return NULL_RTX;
+--- gcc-5.5.0/gcc/gimple-fold.c	2018-03-20 11:36:16.709442004 +0100
++++ gcc-5.5.0/gcc/gimple-fold.c	2018-03-20 11:46:43.838487065 +0100
+@@ -635,6 +635,8 @@ var_decl_component_p (tree var)
+   return SSA_VAR_P (inner);
+ }
+ 
++extern bool store_reference_p (tree);
++
+ /* If the SIZE argument representing the size of an object is in a range
+    of values of which exactly one is valid (and that is zero), return
+    true, otherwise false.  */
+@@ -742,6 +744,9 @@ gimple_fold_builtin_memory_op (gimple_stmt_iterator *gsi,
+       off0 = build_int_cst (build_pointer_type_for_mode (char_type_node,
+ 							 ptr_mode, true), 0);
+ 
++      if (store_reference_p (src))
++        return false;
++
+       /* If we can perform the copy efficiently with first doing all loads
+          and then all stores inline it that way.  Currently efficiently
+ 	 means that we can load all the memory into a single integer
diff --git a/gnu/packages/patches/icecat-bug-1413868-pt1.patch b/gnu/packages/patches/icecat-bug-1413868-pt1.patch
new file mode 100644
index 0000000000..18382dc33a
--- /dev/null
+++ b/gnu/packages/patches/icecat-bug-1413868-pt1.patch
@@ -0,0 +1,663 @@
+Based on <https://hg.mozilla.org/releases/mozilla-esr52/rev/431fa5dd4016>
+Adapted to apply cleanly to GNU IceCat.
+
+# HG changeset patch
+# User Honza Bambas <honzab.moz@firemni.cz>
+# Date 1528830658 14400
+# Node ID 431fa5dd4016bdab7e4bb0d3c4df85468fe337b0
+# Parent  e8e9e1ef79f2a18c61ec1b87cfb214c8d4960f8e
+Bug 1413868. r=valentin, a=RyanVM
+
+diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
+--- a/toolkit/xre/nsAppRunner.cpp
++++ b/toolkit/xre/nsAppRunner.cpp
+@@ -4,16 +4,17 @@
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ #include "mozilla/dom/ContentParent.h"
+ #include "mozilla/dom/ContentChild.h"
+ #include "mozilla/ipc/GeckoChildProcessHost.h"
+ 
+ #include "mozilla/ArrayUtils.h"
+ #include "mozilla/Attributes.h"
++#include "mozilla/FilePreferences.h"
+ #include "mozilla/ChaosMode.h"
+ #include "mozilla/IOInterposer.h"
+ #include "mozilla/Likely.h"
+ #include "mozilla/MemoryChecking.h"
+ #include "mozilla/Poison.h"
+ #include "mozilla/Preferences.h"
+ #include "mozilla/ScopeExit.h"
+ #include "mozilla/Services.h"
+@@ -4304,16 +4305,20 @@ XREMain::XRE_mainRun()
+       // Need to write out the fact that the profile has been removed and potentially
+       // that the selected/default profile changed.
+       mProfileSvc->Flush();
+     }
+   }
+ 
+   mDirProvider.DoStartup();
+ 
++  // As FilePreferences need the profile directory, we must initialize right here.
++  mozilla::FilePreferences::InitDirectoriesWhitelist();
++  mozilla::FilePreferences::InitPrefs();
++
+   OverrideDefaultLocaleIfNeeded();
+ 
+ #ifdef MOZ_CRASHREPORTER
+   nsCString userAgentLocale;
+   // Try a localized string first. This pref is always a localized string in
+   // IceCatMobile, and might be elsewhere, too.
+   if (NS_SUCCEEDED(Preferences::GetLocalizedCString("general.useragent.locale", &userAgentLocale))) {
+     CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("useragent_locale"), userAgentLocale);
+diff --git a/toolkit/xre/nsEmbedFunctions.cpp b/toolkit/xre/nsEmbedFunctions.cpp
+--- a/toolkit/xre/nsEmbedFunctions.cpp
++++ b/toolkit/xre/nsEmbedFunctions.cpp
+@@ -46,16 +46,17 @@
+ #include "nsX11ErrorHandler.h"
+ #include "nsGDKErrorHandler.h"
+ #include "base/at_exit.h"
+ #include "base/command_line.h"
+ #include "base/message_loop.h"
+ #include "base/process_util.h"
+ #include "chrome/common/child_process.h"
+ 
++#include "mozilla/FilePreferences.h"
+ #include "mozilla/ipc/BrowserProcessSubThread.h"
+ #include "mozilla/ipc/GeckoChildProcessHost.h"
+ #include "mozilla/ipc/IOThreadChild.h"
+ #include "mozilla/ipc/ProcessChild.h"
+ #include "ScopedXREEmbed.h"
+ 
+ #include "mozilla/plugins/PluginProcessChild.h"
+ #include "mozilla/dom/ContentProcess.h"
+@@ -680,16 +681,18 @@ XRE_InitChildProcess(int aArgc,
+       ::SetProcessShutdownParameters(0x280 - 1, SHUTDOWN_NORETRY);
+ #endif
+ 
+ #if defined(MOZ_SANDBOX) && defined(XP_WIN)
+       // We need to do this after the process has been initialised, as
+       // InitLoggingIfRequired may need access to prefs.
+       mozilla::sandboxing::InitLoggingIfRequired(aChildData->ProvideLogFunction);
+ #endif
++      mozilla::FilePreferences::InitDirectoriesWhitelist();
++      mozilla::FilePreferences::InitPrefs();
+ 
+       OverrideDefaultLocaleIfNeeded();
+ 
+ #if defined(MOZ_CRASHREPORTER)
+ #if defined(MOZ_CONTENT_SANDBOX) && !defined(MOZ_WIDGET_GONK)
+       AddContentSandboxLevelAnnotation();
+ #endif
+ #endif
+diff --git a/xpcom/io/FilePreferences.cpp b/xpcom/io/FilePreferences.cpp
+new file mode 100644
+--- /dev/null
++++ b/xpcom/io/FilePreferences.cpp
+@@ -0,0 +1,271 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++* License, v. 2.0. If a copy of the MPL was not distributed with this
++* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "FilePreferences.h"
++
++#include "mozilla/Preferences.h"
++#include "nsAppDirectoryServiceDefs.h"
++#include "nsDirectoryServiceDefs.h"
++#include "nsDirectoryServiceUtils.h"
++
++namespace mozilla {
++namespace FilePreferences {
++
++static bool sBlockUNCPaths = false;
++typedef nsTArray<nsString> Paths;
++
++static Paths& PathArray()
++{
++  static Paths sPaths;
++  return sPaths;
++}
++
++static void AllowDirectory(char const* directory)
++{
++  nsCOMPtr<nsIFile> file;
++  NS_GetSpecialDirectory(directory, getter_AddRefs(file));
++  if (!file) {
++    return;
++  }
++
++  nsString path;
++  if (NS_FAILED(file->GetTarget(path))) {
++    return;
++  }
++
++  // The whitelist makes sense only for UNC paths, because this code is used
++  // to block only UNC paths, hence, no need to add non-UNC directories here
++  // as those would never pass the check.
++  if (!StringBeginsWith(path, NS_LITERAL_STRING("\\\\"))) {
++    return;
++  }
++
++  if (!PathArray().Contains(path)) {
++    PathArray().AppendElement(path);
++  }
++}
++
++void InitPrefs()
++{
++  sBlockUNCPaths = Preferences::GetBool("network.file.disable_unc_paths", false);
++}
++
++void InitDirectoriesWhitelist()
++{
++  // NS_GRE_DIR is the installation path where the binary resides.
++  AllowDirectory(NS_GRE_DIR);
++  // NS_APP_USER_PROFILE_50_DIR and NS_APP_USER_PROFILE_LOCAL_50_DIR are the two
++  // parts of the profile we store permanent and local-specific data.
++  AllowDirectory(NS_APP_USER_PROFILE_50_DIR);
++  AllowDirectory(NS_APP_USER_PROFILE_LOCAL_50_DIR);
++}
++
++namespace { // anon
++
++class Normalizer
++{
++public:
++  Normalizer(const nsAString& aFilePath, const char16_t aSeparator);
++  bool Get(nsAString& aNormalizedFilePath);
++
++private:
++  bool ConsumeItem();
++  bool ConsumeSeparator();
++  bool IsEOF() { return mFilePathCursor == mFilePathEnd; }
++
++  bool ConsumeName();
++  bool CheckParentDir();
++  bool CheckCurrentDir();
++
++  nsString::const_char_iterator mFilePathCursor;
++  nsString::const_char_iterator mFilePathEnd;
++
++  nsDependentSubstring mItem;
++  char16_t const mSeparator;
++  nsTArray<nsDependentSubstring> mStack;
++};
++
++Normalizer::Normalizer(const nsAString& aFilePath, const char16_t aSeparator)
++  : mFilePathCursor(aFilePath.BeginReading())
++  , mFilePathEnd(aFilePath.EndReading())
++  , mSeparator(aSeparator)
++{
++}
++
++bool Normalizer::ConsumeItem()
++{
++  if (IsEOF()) {
++    return false;
++  }
++
++  nsString::const_char_iterator nameBegin = mFilePathCursor;
++  while (mFilePathCursor != mFilePathEnd) {
++    if (*mFilePathCursor == mSeparator) {
++      break; // don't include the separator
++    }
++    ++mFilePathCursor;
++  }
++
++  mItem.Rebind(nameBegin, mFilePathCursor);
++  return true;
++}
++
++bool Normalizer::ConsumeSeparator()
++{
++  if (IsEOF()) {
++    return false;
++  }
++
++  if (*mFilePathCursor != mSeparator) {
++    return false;
++  }
++
++  ++mFilePathCursor;
++  return true;
++}
++
++bool Normalizer::Get(nsAString& aNormalizedFilePath)
++{
++  aNormalizedFilePath.Truncate();
++
++  if (IsEOF()) {
++    return true;
++  }
++  if (ConsumeSeparator()) {
++    aNormalizedFilePath.Append(mSeparator);
++  }
++
++  if (IsEOF()) {
++    return true;
++  }
++  if (ConsumeSeparator()) {
++    aNormalizedFilePath.Append(mSeparator);
++  }
++
++  while (!IsEOF()) {
++    if (!ConsumeName()) {
++      return false;
++    }
++  }
++
++  for (auto const& name : mStack) {
++    aNormalizedFilePath.Append(name);
++  }
++
++  return true;
++}
++
++bool Normalizer::ConsumeName()
++{
++  if (!ConsumeItem()) {
++    return true;
++  }
++
++  if (CheckCurrentDir()) {
++    return true;
++  }
++
++  if (CheckParentDir()) {
++    if (!mStack.Length()) {
++      // This means there are more \.. than valid names
++      return false;
++    }
++
++    mStack.RemoveElementAt(mStack.Length() - 1);
++    return true;
++  }
++
++  if (mItem.IsEmpty()) {
++    // this means an empty name (a lone slash), which is illegal
++    return false;
++  }
++
++  if (ConsumeSeparator()) {
++    mItem.Rebind(mItem.BeginReading(), mFilePathCursor);
++  }
++  mStack.AppendElement(mItem);
++
++  return true;
++}
++
++bool Normalizer::CheckCurrentDir()
++{
++  if (mItem == NS_LITERAL_STRING(".")) {
++    ConsumeSeparator();
++    // EOF is acceptable
++    return true;
++  }
++
++  return false;
++}
++
++bool Normalizer::CheckParentDir()
++{
++  if (mItem == NS_LITERAL_STRING("..")) {
++    ConsumeSeparator();
++    // EOF is acceptable
++    return true;
++  }
++
++  return false;
++}
++
++} // anon
++
++bool IsBlockedUNCPath(const nsAString& aFilePath)
++{
++  if (!sBlockUNCPaths) {
++    return false;
++  }
++
++  if (!StringBeginsWith(aFilePath, NS_LITERAL_STRING("\\\\"))) {
++    return false;
++  }
++
++  nsAutoString normalized;
++  if (!Normalizer(aFilePath, L'\\').Get(normalized)) {
++    // Broken paths are considered invalid and thus inaccessible
++    return true;
++  }
++
++  for (const auto& allowedPrefix : PathArray()) {
++    if (StringBeginsWith(normalized, allowedPrefix)) {
++      if (normalized.Length() == allowedPrefix.Length()) {
++        return false;
++      }
++      if (normalized[allowedPrefix.Length()] == L'\\') {
++        return false;
++      }
++
++      // When we are here, the path has a form "\\path\prefixevil"
++      // while we have an allowed prefix of "\\path\prefix".
++      // Note that we don't want to add a slash to the end of a prefix
++      // so that opening the directory (no slash at the end) still works.
++      break;
++    }
++  }
++
++  return true;
++}
++
++void testing::SetBlockUNCPaths(bool aBlock)
++{
++  sBlockUNCPaths = aBlock;
++}
++
++void testing::AddDirectoryToWhitelist(nsAString const & aPath)
++{
++  PathArray().AppendElement(aPath);
++}
++
++bool testing::NormalizePath(nsAString const & aPath, nsAString & aNormalized)
++{
++  Normalizer normalizer(aPath, L'\\');
++  return normalizer.Get(aNormalized);
++}
++
++} // ::FilePreferences
++} // ::mozilla
+diff --git a/xpcom/io/FilePreferences.h b/xpcom/io/FilePreferences.h
+new file mode 100644
+--- /dev/null
++++ b/xpcom/io/FilePreferences.h
+@@ -0,0 +1,25 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++* License, v. 2.0. If a copy of the MPL was not distributed with this
++* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "nsIObserver.h"
++
++namespace mozilla {
++namespace FilePreferences {
++
++void InitPrefs();
++void InitDirectoriesWhitelist();
++bool IsBlockedUNCPath(const nsAString& aFilePath);
++
++namespace testing {
++
++void SetBlockUNCPaths(bool aBlock);
++void AddDirectoryToWhitelist(nsAString const& aPath);
++bool NormalizePath(nsAString const & aPath, nsAString & aNormalized);
++
++}
++
++} // FilePreferences
++} // mozilla
+diff --git a/xpcom/io/moz.build b/xpcom/io/moz.build
+--- a/xpcom/io/moz.build
++++ b/xpcom/io/moz.build
+@@ -79,24 +79,26 @@ EXPORTS += [
+     'nsUnicharInputStream.h',
+     'nsWildCard.h',
+     'SlicedInputStream.h',
+     'SpecialSystemDirectory.h',
+ ]
+ 
+ EXPORTS.mozilla += [
+     'Base64.h',
++    'FilePreferences.h',
+     'SnappyCompressOutputStream.h',
+     'SnappyFrameUtils.h',
+     'SnappyUncompressInputStream.h',
+ ]
+ 
+ UNIFIED_SOURCES += [
+     'Base64.cpp',
+     'crc32c.c',
++    'FilePreferences.cpp',
+     'nsAnonymousTemporaryFile.cpp',
+     'nsAppFileLocationProvider.cpp',
+     'nsBinaryStream.cpp',
+     'nsDirectoryService.cpp',
+     'nsEscape.cpp',
+     'nsInputStreamTee.cpp',
+     'nsIOUtil.cpp',
+     'nsLinebreakConverter.cpp',
+diff --git a/xpcom/io/nsLocalFileWin.cpp b/xpcom/io/nsLocalFileWin.cpp
+--- a/xpcom/io/nsLocalFileWin.cpp
++++ b/xpcom/io/nsLocalFileWin.cpp
+@@ -41,16 +41,17 @@
+ #include  <stdio.h>
+ #include  <stdlib.h>
+ #include  <mbstring.h>
+ 
+ #include "nsXPIDLString.h"
+ #include "prproces.h"
+ #include "prlink.h"
+ 
++#include "mozilla/FilePreferences.h"
+ #include "mozilla/Mutex.h"
+ #include "SpecialSystemDirectory.h"
+ 
+ #include "nsTraceRefcnt.h"
+ #include "nsXPCOMCIDInternal.h"
+ #include "nsThreadUtils.h"
+ #include "nsXULAppAPI.h"
+ 
+@@ -1162,16 +1163,20 @@ nsLocalFile::InitWithPath(const nsAStrin
+   char16_t secondChar = *(++begin);
+ 
+   // just do a sanity check.  if it has any forward slashes, it is not a Native path
+   // on windows.  Also, it must have a colon at after the first char.
+   if (FindCharInReadable(L'/', begin, end)) {
+     return NS_ERROR_FILE_UNRECOGNIZED_PATH;
+   }
+ 
++  if (FilePreferences::IsBlockedUNCPath(aFilePath)) {
++    return NS_ERROR_FILE_ACCESS_DENIED;
++  }
++
+   if (secondChar != L':' && (secondChar != L'\\' || firstChar != L'\\')) {
+     return NS_ERROR_FILE_UNRECOGNIZED_PATH;
+   }
+ 
+   if (secondChar == L':') {
+     // Make sure we have a valid drive, later code assumes the drive letter
+     // is a single char a-z or A-Z.
+     if (PathGetDriveNumberW(aFilePath.Data()) == -1) {
+@@ -1974,16 +1979,20 @@ nsLocalFile::CopySingleFile(nsIFile* aSo
+     bool path1Remote, path2Remote;
+     if (!IsRemoteFilePath(filePath.get(), path1Remote) ||
+         !IsRemoteFilePath(destPath.get(), path2Remote) ||
+         path1Remote || path2Remote) {
+       dwCopyFlags |= COPY_FILE_NO_BUFFERING;
+     }
+   }
+ 
++  if (FilePreferences::IsBlockedUNCPath(destPath)) {
++    return NS_ERROR_FILE_ACCESS_DENIED;
++  }
++
+   if (!move) {
+     copyOK = ::CopyFileExW(filePath.get(), destPath.get(), nullptr,
+                            nullptr, nullptr, dwCopyFlags);
+   } else {
+     copyOK = ::MoveFileExW(filePath.get(), destPath.get(),
+                            MOVEFILE_REPLACE_EXISTING);
+ 
+     // Check if copying the source file to a different volume,
+diff --git a/xpcom/tests/gtest/TestFilePreferencesWin.cpp b/xpcom/tests/gtest/TestFilePreferencesWin.cpp
+new file mode 100644
+--- /dev/null
++++ b/xpcom/tests/gtest/TestFilePreferencesWin.cpp
+@@ -0,0 +1,141 @@
++#include "gtest/gtest.h"
++
++#include "mozilla/FilePreferences.h"
++#include "nsIFile.h"
++#include "nsXPCOMCID.h"
++
++TEST(FilePreferencesWin, Normalization)
++{
++  nsAutoString normalized;
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("foo"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("foo"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\foo"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\foo"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("foo\\some"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("foo\\some"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.\\foo"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\."), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.\\."), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\."), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\.\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\bar\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\..\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\.."), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\foo\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\..\\bar\\..\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\..\\bar"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\bar"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\..\\..\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\.\\..\\.\\..\\"), normalized);
++  ASSERT_TRUE(normalized == NS_LITERAL_STRING("\\\\"));
++
++  bool result;
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.."), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\..\\"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.\\..\\"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\\\bar"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\foo\\bar\\..\\..\\..\\..\\"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\\\"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\.\\\\"), normalized);
++  ASSERT_FALSE(result);
++
++  result = mozilla::FilePreferences::testing::NormalizePath(
++    NS_LITERAL_STRING("\\\\..\\\\"), normalized);
++  ASSERT_FALSE(result);
++}
++
++TEST(FilePreferencesWin, AccessUNC)
++{
++  nsCOMPtr<nsIFile> lf = do_CreateInstance(NS_LOCAL_FILE_CONTRACTID);
++
++  nsresult rv;
++
++  mozilla::FilePreferences::testing::SetBlockUNCPaths(false);
++
++  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
++  ASSERT_EQ(rv, NS_OK);
++
++  mozilla::FilePreferences::testing::SetBlockUNCPaths(true);
++
++  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
++  ASSERT_EQ(rv, NS_ERROR_FILE_ACCESS_DENIED);
++
++  mozilla::FilePreferences::testing::AddDirectoryToWhitelist(NS_LITERAL_STRING("\\\\nice"));
++
++  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\share"));
++  ASSERT_EQ(rv, NS_OK);
++
++  rv = lf->InitWithPath(NS_LITERAL_STRING("\\\\nice\\..\\evil\\share"));
++  ASSERT_EQ(rv, NS_ERROR_FILE_ACCESS_DENIED);
++}
+diff --git a/xpcom/tests/gtest/moz.build b/xpcom/tests/gtest/moz.build
+--- a/xpcom/tests/gtest/moz.build
++++ b/xpcom/tests/gtest/moz.build
+@@ -51,16 +51,21 @@ UNIFIED_SOURCES += [
+ if CONFIG['MOZ_DEBUG'] and CONFIG['OS_ARCH'] not in ('WINNT') and CONFIG['OS_TARGET'] != 'Android':
+     # FIXME bug 523392: TestDeadlockDetector doesn't like Windows
+     # Bug 1054249: Doesn't work on Android
+     UNIFIED_SOURCES += [
+         'TestDeadlockDetector.cpp',
+         'TestDeadlockDetectorScalability.cpp',
+     ]
+ 
++if CONFIG['OS_TARGET'] == 'WINNT':
++    UNIFIED_SOURCES += [
++        'TestFilePreferencesWin.cpp',
++    ]
++
+ if CONFIG['WRAP_STL_INCLUDES'] and not CONFIG['CLANG_CL']:
+     UNIFIED_SOURCES += [
+         'TestSTLWrappers.cpp',
+     ]
+ 
+ # Compile TestAllocReplacement separately so Windows headers don't pollute
+ # the global namespace for other files.
+ SOURCES += [
+
diff --git a/gnu/packages/patches/libtiff-CVE-2018-10963.patch b/gnu/packages/patches/libtiff-CVE-2018-10963.patch
new file mode 100644
index 0000000000..d31c12399d
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2018-10963.patch
@@ -0,0 +1,40 @@
+Fix CVE-2018-10963:
+
+http://bugzilla.maptools.org/show_bug.cgi?id=2795
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10963
+
+Patch copied from upstream source repository:
+
+https://gitlab.com/libtiff/libtiff/commit/de144fd228e4be8aa484c3caf3d814b6fa88c6d9
+
+From de144fd228e4be8aa484c3caf3d814b6fa88c6d9 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 12 May 2018 14:24:15 +0200
+Subject: [PATCH] TIFFWriteDirectorySec: avoid assertion. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2795. CVE-2018-10963
+
+---
+ libtiff/tif_dirwrite.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/libtiff/tif_dirwrite.c b/libtiff/tif_dirwrite.c
+index 2430de6d..c15a28db 100644
+--- a/libtiff/tif_dirwrite.c
++++ b/libtiff/tif_dirwrite.c
+@@ -695,8 +695,11 @@ TIFFWriteDirectorySec(TIFF* tif, int isimage, int imagedone, uint64* pdiroff)
+ 								}
+ 								break;
+ 							default:
+-								assert(0);   /* we should never get here */
+-								break;
++								TIFFErrorExt(tif->tif_clientdata,module,
++								            "Cannot write tag %d (%s)",
++								            TIFFFieldTag(o),
++                                                                            o->field_name ? o->field_name : "unknown");
++								goto bad;
+ 						}
+ 					}
+ 				}
+-- 
+2.17.0
+
diff --git a/gnu/packages/patches/libtiff-CVE-2018-8905.patch b/gnu/packages/patches/libtiff-CVE-2018-8905.patch
new file mode 100644
index 0000000000..f49815789e
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2018-8905.patch
@@ -0,0 +1,61 @@
+Fix CVE-2018-8095:
+
+http://bugzilla.maptools.org/show_bug.cgi?id=2780
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8905
+
+Patch copied from upstream source repository:
+
+https://gitlab.com/libtiff/libtiff/commit/58a898cb4459055bb488ca815c23b880c242a27d
+
+From 58a898cb4459055bb488ca815c23b880c242a27d Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sat, 12 May 2018 15:32:31 +0200
+Subject: [PATCH] LZWDecodeCompat(): fix potential index-out-of-bounds write.
+ Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2780 / CVE-2018-8905
+
+The fix consists in using the similar code LZWDecode() to validate we
+don't write outside of the output buffer.
+---
+ libtiff/tif_lzw.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+diff --git a/libtiff/tif_lzw.c b/libtiff/tif_lzw.c
+index 4ccb443c..94d85e38 100644
+--- a/libtiff/tif_lzw.c
++++ b/libtiff/tif_lzw.c
+@@ -602,6 +602,7 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+ 	char *tp;
+ 	unsigned char *bp;
+ 	int code, nbits;
++	int len;
+ 	long nextbits, nextdata, nbitsmask;
+ 	code_t *codep, *free_entp, *maxcodep, *oldcodep;
+ 
+@@ -753,13 +754,18 @@ LZWDecodeCompat(TIFF* tif, uint8* op0, tmsize_t occ0, uint16 s)
+ 				}  while (--occ);
+ 				break;
+ 			}
+-			assert(occ >= codep->length);
+-			op += codep->length;
+-			occ -= codep->length;
+-			tp = op;
++			len = codep->length;
++			tp = op + len;
+ 			do {
+-				*--tp = codep->value;
+-			} while( (codep = codep->next) != NULL );
++				int t;
++				--tp;
++				t = codep->value;
++				codep = codep->next;
++				*tp = (char)t;
++			} while (codep && tp > op);
++			assert(occ >= len);
++			op += len;
++			occ -= len;
+ 		} else {
+ 			*op++ = (char)code;
+ 			occ--;
+-- 
+2.17.0
+
diff --git a/gnu/packages/patches/qtoctave-qt-5.11-fix.patch b/gnu/packages/patches/qtoctave-qt-5.11-fix.patch
new file mode 100644
index 0000000000..67317d1b36
--- /dev/null
+++ b/gnu/packages/patches/qtoctave-qt-5.11-fix.patch
@@ -0,0 +1,26 @@
+This patch comes from upstream:
+https://hg.savannah.gnu.org/hgweb/octave/rev/cdaa884568b1.
+
+# HG changeset patch
+# User Mike Miller <mtmiller@octave.org>
+# Date 1527214835 25200
+# Node ID cdaa884568b159549bd373f04386ff62417f6df9
+# Parent  9e39a53b4e007d3f79f88b711ab9fa5f2f24fbc9
+add Qt include needed to build against Qt 5.11 (bug #53978)
+
+* settings-dialog.cc: Add missing include for <QButtonGroup> to fix build
+failure with Qt 5.11.
+
+diff --git a/libgui/src/settings-dialog.cc b/libgui/src/settings-dialog.cc
+--- a/libgui/src/settings-dialog.cc
++++ b/libgui/src/settings-dialog.cc
+@@ -34,6 +34,8 @@
+ #include "workspace-model.h"
+ #include "settings-dialog.h"
+ #include "ui-settings-dialog.h"
++
++#include <QButtonGroup>
+ #include <QDir>
+ #include <QFileInfo>
+ #include <QFileDialog>
+
diff --git a/gnu/packages/photo.scm b/gnu/packages/photo.scm
index 99bc90efac..7bf1d60f7c 100644
--- a/gnu/packages/photo.scm
+++ b/gnu/packages/photo.scm
@@ -69,21 +69,31 @@
 (define-public libraw
   (package
     (name "libraw")
-    (version "0.18.12")
+    (version "0.19.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.libraw.org/data/LibRaw-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1m2khr2cij8z6lawgbmdksjn14fpnjsy8ad4qahnpqapm1slsxap"))))
+                "0nfj7s7qmgfy1cl8s3ck7dxjvprfq5glfi6iidmvmy8r7gl52gz8"))))
     (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("libjpeg" ,libjpeg-8)))         ;for lossy DNGs and old Kodak cameras
+    (propagated-inputs
+     `(("lcms" ,lcms)))                 ;for color profiles
     (home-page "https://www.libraw.org")
     (synopsis "Raw image decoder")
     (description
      "LibRaw is a library for reading RAW files obtained from digital photo
 cameras (CRW/CR2, NEF, RAF, DNG, and others).")
-    (license license:lgpl2.1+)))
+    ;; LibRaw is distributed under both LGPL2.1 and CDDL 1.0.  From the README:
+    ;; "You may use one of these licensing modes and switch between them.  If
+    ;; you modify LibRaw source and made your changes public, you should accept
+    ;; both two licensing modes for your changes/additions."
+    (license (list license:lgpl2.1 license:cddl1.0))))
 
 (define-public libexif
   (package
@@ -109,14 +119,14 @@ data as produced by digital cameras.")
 (define-public libgphoto2
   (package
     (name "libgphoto2")
-    (version "2.5.17")
+    (version "2.5.18")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://sourceforge/gphoto/libgphoto/"
                                   version "/libgphoto2-" version ".tar.bz2"))
               (sha256
                (base32
-                "0mdmjb8a07g37bb5q69h11sixw0w6y5g3kbii9z97yhklgq68x21"))))
+                "1v57ayp17j88bj79nl7rf4iyajbxx00kgb4l5k3kbv50gjfvh5sv"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)))
     (inputs
@@ -184,7 +194,7 @@ MTP, and much more.")
 (define-public perl-image-exiftool
   (package
     (name "perl-image-exiftool")
-    (version "10.80")
+    (version "11.01")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -192,7 +202,7 @@ MTP, and much more.")
                     version ".tar.gz"))
               (sha256
                (base32
-                "14rwr5wk2snqv4yva6fax1gfsdv88941n237m0wyzn3n0xh9dy5w"))))
+                "175w34n73mypdpbaqj2vgqsfp59yvfrn8k7zmx4cawnp895bypvh"))))
     (build-system perl-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/python-crypto.scm b/gnu/packages/python-crypto.scm
index e29eaea801..50e7d25c8b 100644
--- a/gnu/packages/python-crypto.scm
+++ b/gnu/packages/python-crypto.scm
@@ -17,6 +17,7 @@
 ;;; Copyright © 2017 Carlo Zancanaro <carlo@zancanaro.id.au>
 ;;; Copyright © 2018 Tomáš Čech <sleep_walker@gnu.org>
 ;;; Copyright © 2018 Nicolas Goaziou <mail@nicolasgoaziou.fr>
+;;; Copyright © 2018 Vagrant Cascadian <vagrant@debian.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -173,6 +174,32 @@ John the Ripper).")
 (define-public python2-py-bcrypt
   (package-with-python2 python-py-bcrypt))
 
+(define-public python-pyblake2
+  (package
+    (name "python-pyblake2")
+    (version "1.1.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pyblake2" version))
+       (sha256
+        (base32
+         "0gz9hgznv5zw4qjq43xa56y0yikimx30gffvibxzm0nv5sq7xk2w"))))
+    (build-system python-build-system)
+    (home-page "https://github.com/dchest/pyblake2")
+    (synopsis "BLAKE2 hash function for Python")
+    (description "BLAKE2 is a cryptographic hash function, which offers
+stronger security while being as fast as MD5 or SHA-1, and comes in two
+flavors: @code{BLAKE2b}, optimized for 64-bit platforms and produces digests
+of any size between 1 and 64 bytes, and @code{BLAKE2s}, optimized for 8- to
+32-bit platforms and produces digests of any size between 1 and 32 bytes.
+
+This package provides a Python interface for BLAKE2.")
+    ;; The COPYING file declares it as public domain, with the option to
+    ;; alternatively use and redistribute it under a variety of permissive
+    ;; licenses. cc0 is explicitly mentioned in setup.py and pyblake2module.c.
+    (license (list license:public-domain license:cc0))))
+
 (define-public python-paramiko
   (package
     (name "python-paramiko")
@@ -403,14 +430,14 @@ message digests and key derivation functions.")
 (define-public python-pyopenssl
   (package
     (name "python-pyopenssl")
-    (version "17.5.0")
+    (version "18.0.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyOpenSSL" version))
        (sha256
         (base32
-         "0wv78mwsdqbxqwdwllf4maqybhbj3vb8328ia04hnb558sxcy41c"))))
+         "1055rb456nvrjcij3sqj6c6l3kmh5cqqay0nsmx3pxq07d1g3234"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
diff --git a/gnu/packages/python-web.scm b/gnu/packages/python-web.scm
index 4e130fa164..2e98a95d4b 100644
--- a/gnu/packages/python-web.scm
+++ b/gnu/packages/python-web.scm
@@ -1413,14 +1413,14 @@ file.")
 (define-public python-webtest
   (package
     (name "python-webtest")
-    (version "2.0.29")
+    (version "2.0.30")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "WebTest" version))
        (sha256
         (base32
-         "0bcj1ica5lnmj5zbvk46x28kgphcsgh7sfnwjmn0cr94mhawrg6v"))))
+         "1mb7m4ndklv84mh0pdkhv73yrflcnra61yczj5g3bvwbqlygfsaw"))))
     (build-system python-build-system)
     (arguments
      `(;; Unfortunately we have to disable tests!
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 5d19fb40d5..2bec752946 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -1211,13 +1211,13 @@ human-friendly syntax.")
 (define-public python-pandas
   (package
     (name "python-pandas")
-    (version "0.22.0")
+    (version "0.23.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pandas" version))
        (sha256
-        (base32 "0v0fi2i10kwnmlpsl6f1fgajcpx3q6766qf6xqi5kw3ivn8l1aa4"))))
+        (base32 "142nvwb01r2wv42y2cz40bx33hd8ffh6s6gynapg859fmzr2mdah"))))
     (build-system python-build-system)
     (arguments
      `(#:modules ((guix build utils)
@@ -1237,7 +1237,8 @@ human-friendly syntax.")
                           (for-each delete-file
                                     '("pandas/tests/io/conftest.py"
                                       "pandas/tests/io/json/test_compression.py"
-                                      "pandas/tests/io/test_excel.py"))
+                                      "pandas/tests/io/test_excel.py"
+                                      "pandas/tests/io/test_parquet.py"))
                           (invoke "pytest" "-v" "pandas" "-k"
                                   (string-append
                                    "not network and not disabled"
@@ -1249,7 +1250,9 @@ human-friendly syntax.")
        ("python-dateutil" ,python-dateutil)))
     (native-inputs
      `(("python-cython" ,python-cython)
+       ("python-beautifulsoup4" ,python-beautifulsoup4)
        ("python-lxml" ,python-lxml)
+       ("python-html5lib" ,python-html5lib)
        ("python-nose" ,python-nose)
        ("python-pytest" ,python-pytest)))
     (home-page "https://pandas.pydata.org")
@@ -2680,14 +2683,14 @@ and several other projects.")
 (define-public python-rst.linker
   (package
     (name "python-rst.linker")
-    (version "1.9")
+    (version "1.10")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "rst.linker" version))
        (sha256
         (base32
-         "16crgnai6020vdmnpwdimw1vm3jb74ysfyb3kmcidb0lgma5xq2d"))))
+         "0iqaacp7pj1s8avs4kc0qg0r7dscywaq37y6l9j14glqdikk0wdj"))))
     (build-system python-build-system)
     (propagated-inputs
      `(("python-dateutil" ,python-dateutil)
@@ -2911,7 +2914,7 @@ between language specification and implementation aspects.")
 (define-public python-numpy
   (package
     (name "python-numpy")
-    (version "1.14.3")
+    (version "1.14.5")
     (source
      (origin
        (method url-fetch)
@@ -2920,7 +2923,7 @@ between language specification and implementation aspects.")
              version "/numpy-" version ".tar.gz"))
        (sha256
         (base32
-         "1yim2bxlycn4dhxmfxid6slplpmcb4ynhp411b37ahmsm2lwgkyg"))))
+         "0admjpkih63lm19zbbilq8ck4f6ny5kqi03dk3m6b2mnixsh4jhv"))))
     (build-system python-build-system)
     (inputs
      `(("openblas" ,openblas)
@@ -10423,14 +10426,14 @@ network.")
 (define-public python-xopen
   (package
     (name "python-xopen")
-    (version "0.3.2")
+    (version "0.3.3")
     (source
       (origin
         (method url-fetch)
         (uri (pypi-uri "xopen" version))
         (sha256
           (base32
-           "0bzjmn3rl1cd3d2q39cjwnkhaspk2b0hfj3rl64pclm44ihg5fb6"))
+           "1a0wbil552wsmklwd89ssmgz3pjd86qa9i7jh8wqb9wslc8a2qjr"))
         (file-name (string-append name "-" version ".tar.gz"))))
     (build-system python-build-system)
     (home-page "https://github.com/marcelm/xopen/")
@@ -10443,7 +10446,12 @@ possible on all supported Python versions.")
     (license license:expat)))
 
 (define-public python2-xopen
-  (package-with-python2 python-xopen))
+  (let ((base (package-with-python2
+               (strip-python2-variant python-xopen))))
+    (package
+      (inherit base)
+      (propagated-inputs `(("python2-bz2file" ,python2-bz2file)
+                           ,@(package-propagated-inputs base))))))
 
 (define-public python2-cheetah
   (package
@@ -13416,14 +13424,14 @@ time-based (TOTP) passwords.")
 (define-public python-parso
   (package
     (name "python-parso")
-    (version "0.2.0")
+    (version "0.2.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "parso" version))
        (sha256
         (base32
-         "0lamywk6dm5xshlkdvxxf5j6fa2k2zpi7xagf0bwidaay3vnpgb2"))))
+         "0zvh4rdhv2wkglkgh0h9kn9ndpsw5p639wcwv47jn1kfp504lq7h"))))
     (native-inputs
      `(("python-pytest" ,python-pytest)))
     (build-system python-build-system)
diff --git a/gnu/packages/regex.scm b/gnu/packages/regex.scm
index 38a371d233..d5ed06f0df 100644
--- a/gnu/packages/regex.scm
+++ b/gnu/packages/regex.scm
@@ -29,7 +29,7 @@
 (define-public re2
    (package
      (name "re2")
-     (version "2018-04-01")
+     (version "2018-07-01")
      (home-page "https://github.com/google/re2")
      (source (origin
                (method url-fetch)
@@ -37,7 +37,7 @@
                (file-name (string-append name "-" version ".tar.gz"))
                (sha256
                 (base32
-                 "04n9ngikvpikpshwcrl26sxgn8qbrymy3b5wlbsyfdhknx35951g"))))
+                 "1zh7kzyv4h7960rdp31a3bq6y4qrdxyf6k86j67yzpkf2h8phg40"))))
      (build-system gnu-build-system)
      (arguments
       `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/samba.scm b/gnu/packages/samba.scm
index e10f00a83b..0ce46056f5 100644
--- a/gnu/packages/samba.scm
+++ b/gnu/packages/samba.scm
@@ -76,7 +76,7 @@
          ;; The 6.7 tarball is missing ‘install.sh’. Create it.
          (add-after 'unpack 'autoreconf
            (lambda _
-             (zero? (system* "autoreconf" "-i"))))
+             (invoke "autoreconf" "-i")))
          (add-before 'configure 'set-root-sbin
            (lambda _ ; Don't try to install in "/sbin".
              (setenv "ROOTSBINDIR"
@@ -150,14 +150,14 @@ anywhere.")
 (define-public samba
   (package
     (name "samba")
-    (version "4.8.2")
+    (version "4.8.3")
     (source (origin
              (method url-fetch)
              (uri (string-append "https://download.samba.org/pub/samba/stable/"
                                  "samba-" version ".tar.gz"))
              (sha256
               (base32
-               "08mz29jmjxqvyyhm6pa388paagw1i2i21lc7pd2aprj9dllm5rb2"))))
+               "1vc21c0m7wky70hpyjhw6ph6zlzljsvivlgxy54znpaxc259lmp0"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -178,8 +178,7 @@ anywhere.")
            (lambda* (#:key outputs #:allow-other-keys)
              (let* ((out    (assoc-ref outputs "out"))
                     (libdir (string-append out "/lib")))
-               (zero? (system*
-                       "./configure"
+               (invoke "./configure"
                        "--enable-fhs"
                        ;; XXX: heimdal not packaged.
                        "--bundled-libraries=com_err"
@@ -188,7 +187,7 @@ anywhere.")
                        ;; Install public and private libraries into
                        ;; a single directory to avoid RPATH issues.
                        (string-append "--libdir=" libdir)
-                       (string-append "--with-privatelibdir=" libdir))))))
+                       (string-append "--with-privatelibdir=" libdir)))))
          (add-before 'install 'disable-etc-samba-directory-creation
            (lambda _
              (substitute* "dynconfig/wscript"
diff --git a/gnu/packages/scheme.scm b/gnu/packages/scheme.scm
index 0b15ea8376..4178a45a89 100644
--- a/gnu/packages/scheme.scm
+++ b/gnu/packages/scheme.scm
@@ -314,15 +314,14 @@ Scheme and C programs and between Scheme and Java programs.")
          (replace 'configure
            (lambda* (#:key inputs outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
-               (zero?
-                (system* "./configure"
-                         (string-append "--prefix=" out)
-                         (string-append "--blflags="
-                                        ;; user flags completely override useful
-                                        ;; default flags, so repeat them here.
-                                        "-copt \\$(CPICFLAGS) "
-                                        "-L \\$(BUILDLIBDIR) "
-                                        "-ldopt -Wl,-rpath," out "/lib")))))))))
+               (invoke "./configure"
+                       (string-append "--prefix=" out)
+                       (string-append "--blflags="
+                                      ;; user flags completely override useful
+                                      ;; default flags, so repeat them here.
+                                      "-copt \\$(CPICFLAGS) "
+                                      "-L \\$(BUILDLIBDIR) "
+                                      "-ldopt -Wl,-rpath," out "/lib"))))))))
     (inputs `(("avahi" ,avahi)
               ("bigloo" ,bigloo)
               ("libgc" ,libgc)
@@ -661,7 +660,8 @@ threads.")
                                  "| mit-scheme")))
                  (with-directory-excursion "scmutils/scmutils"
                    (and (zero? (system "mit-scheme < compile.scm"))
-                        (zero? (system make-img)))))))
+                        (zero? (system make-img))))
+                 #t)))
            (add-before 'install 'fix-directory-names
              ;; Correct directory names in the startup script.
              (lambda* (#:key inputs outputs #:allow-other-keys)
@@ -685,8 +685,8 @@ threads.")
              ;; code.
              (lambda* (#:key inputs outputs #:allow-other-keys)
                (with-directory-excursion "scmutils/scmutils"
-                 (zero? (apply system* "etags"
-                               (find-files "." "\\.scm"))))))
+                 (apply invoke "etags" (find-files "." "\\.scm")))
+               #t))
            (replace 'install
              ;; Copy files to the store.
              (lambda* (#:key outputs #:allow-other-keys)
@@ -882,12 +882,13 @@ regular-expression notation.")
          (add-after 'install 'remove-bin-share
                     (lambda* (#:key inputs outputs #:allow-other-keys)
                       (delete-file-recursively
-                       (string-append (assoc-ref outputs "out") "/bin"))))
+                       (string-append (assoc-ref outputs "out") "/bin"))
+                      #t))
          (replace 'configure
                   (lambda* (#:key inputs outputs #:allow-other-keys)
-                    (zero? (system* "./configure"
-                                    (string-append "--prefix="
-                                                   (assoc-ref outputs "out")))))))))
+                    (invoke "./configure"
+                            (string-append "--prefix="
+                                           (assoc-ref outputs "out"))))))))
     (native-inputs `(("unzip" ,unzip)
                      ("texinfo" ,texinfo)))
     (home-page "http://people.csail.mit.edu/jaffer/SLIB.html")
@@ -916,39 +917,34 @@ utility functions for all standard Scheme implementations.")
        (modify-phases %standard-phases
          (replace 'configure
                   (lambda* (#:key inputs outputs #:allow-other-keys)
-                    (zero? (system* "./configure"
-                                    (string-append "--prefix="
-                                                   (assoc-ref outputs "out"))))))
+                    (invoke "./configure"
+                            (string-append "--prefix="
+                                           (assoc-ref outputs "out")))))
          (add-before 'build 'pre-build
                      (lambda* (#:key inputs #:allow-other-keys)
                        (substitute* "Makefile"
-                         (("ginstall-info") "install-info"))))
+                         (("ginstall-info") "install-info"))
+                       #t))
          (replace 'build
                   (lambda* (#:key inputs outputs #:allow-other-keys)
                     (setenv "SCHEME_LIBRARY_PATH"
                             (string-append (assoc-ref inputs "slib")
                                            "/lib/slib/"))
-                    (and
-                     (zero? (system* "make" "scmlit" "CC=gcc"))
-                     (zero? (system* "make" "all")))))
+                    (invoke "make" "scmlit" "CC=gcc")
+                    (invoke "make" "all")))
          (add-after 'install 'post-install
                     (lambda* (#:key inputs outputs #:allow-other-keys)
-                      (let ((req
-                             (string-append (assoc-ref outputs "out")
-                                            "/lib/scm/require.scm")))
-                        (and
-                         (delete-file req)
-                         (format (open req (logior O_WRONLY O_CREAT))
-                                 "(define (library-vicinity) ~s)\n"
-                                 (string-append (assoc-ref inputs "slib")
-                                                "/lib/slib/"))
+                      (let* ((out         (assoc-ref outputs "out"))
+                             (req (string-append out "/lib/scm/require.scm")))
+                        (delete-file req)
+                        (format (open req (logior O_WRONLY O_CREAT))
+                                "(define (library-vicinity) ~s)\n"
+                                (string-append (assoc-ref inputs "slib")
+                                               "/lib/slib/"))
 
-                         ;; We must generate the slibcat file
-                         (zero? (system*
-                                 (string-append
-                                  (assoc-ref outputs "out")
-                                  "/bin/scm")
-                                 "-br" "new-catalog")))))))))
+                        ;; We must generate the slibcat file.
+                        (invoke (string-append out "/bin/scm")
+                                "-br" "new-catalog")))))))
     (inputs `(("slib" ,slib)))
     (native-inputs `(("unzip" ,unzip)
                      ("texinfo" ,texinfo)))
diff --git a/gnu/packages/smalltalk.scm b/gnu/packages/smalltalk.scm
index c0c53a5291..9b36d83a80 100644
--- a/gnu/packages/smalltalk.scm
+++ b/gnu/packages/smalltalk.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2016 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -132,14 +133,15 @@ such as ones for networking and GUI programming.")
            (lambda* (#:key outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
                (with-directory-excursion "bld"
-                 (zero?
-                  (system* "../unix/cmake/configure"
+                 (invoke "../unix/cmake/configure"
                            (string-append "--prefix=" out)
-                           "--without-quartz"))))))
+                           "--without-quartz")
+                 #t))))
          (replace 'build
            (lambda _
              (with-directory-excursion "bld"
-               (zero? (system* "make"))))))))
+               (invoke "make"))
+             #t)))))
     (synopsis "Smalltalk programming language and environment")
     (description "Squeak is a full-featured implementation of the Smalltalk
 programming language and environment based on (and largely compatible with)
diff --git a/gnu/packages/statistics.scm b/gnu/packages/statistics.scm
index 9853e842c2..8be3ce1a80 100644
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@@ -1816,7 +1816,8 @@ and fast file reading.")
     (arguments
      `(#:phases
        (modify-phases %standard-phases
-         (replace 'check (lambda _ (zero? (system* "nosetests" "-v")))))))
+         (replace 'check
+           (lambda _ (invoke "nosetests" "-v"))))))
     (propagated-inputs
      `(("python-numpy" ,python-numpy)
        ("python-scipy" ,python-scipy)
diff --git a/gnu/packages/sync.scm b/gnu/packages/sync.scm
index df1b963878..6e57aaba1b 100644
--- a/gnu/packages/sync.scm
+++ b/gnu/packages/sync.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2015, 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,17 +22,24 @@
 (define-module (gnu packages sync)
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix build-system cmake)
+  #:use-module (guix build-system meson)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix packages)
   #:use-module (gnu packages)
+  #:use-module (gnu packages acl)
   #:use-module (gnu packages check)
   #:use-module (gnu packages compression)
+  #:use-module (gnu packages curl)
   #:use-module (gnu packages databases)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages perl)
+  #:use-module (gnu packages python)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages qt)
+  #:use-module (gnu packages rsync)
+  #:use-module (gnu packages selinux)
   #:use-module (gnu packages tls))
 
 (define-public owncloud-client
@@ -208,3 +216,46 @@ machines.  Lsyncd is thus a light-weight live mirror solution that is
 comparatively easy to install not requiring new file systems or block devices
 and does not hamper local file system performance.")
     (license license:gpl2+)))
+
+(define-public casync
+  (package
+    (name "casync")
+    (version "2")
+    (home-page "https://github.com/systemd/casync/")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url home-page)
+                    (commit (string-append "v" version))))
+              (sha256
+               (base32
+                "0znkp3fcksrykcsv06y2mjvf2lbwmin25snmvfa8i5qfm3f4rm88"))
+              (file-name (string-append name "-" version "-checkout"))))
+    (build-system meson-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("python-sphinx" ,python-sphinx)
+       ("rsync" ,rsync)))                         ;for tests
+    (inputs
+     `(("xz" ,xz)                                 ;for liblzma
+       ("zstd" ,zstd)
+       ("curl" ,curl)
+       ("acl" ,acl)
+       ("libselinux" ,libselinux)
+       ("fuse" ,fuse)
+       ("openssl" ,openssl)
+       ("zlib" ,zlib)))
+    (synopsis "File synchronization and backup system")
+    (description
+     "casync is a @dfn{content-addressable data synchronizer} that can be used
+as the basis of a backup system.  It is:
+
+@itemize
+@item A combination of the rsync algorithm and content-addressable storage;
+@item An efficient way to store and retrieve multiple related versions of
+large file systems or directory trees;
+@item An efficient way to deliver and update OS, VM, IoT and container images
+over the Internet in an HTTP and CDN friendly way;
+@item An efficient backup system.
+@end itemize\n")
+    (license license:lgpl2.1+)))
diff --git a/gnu/packages/telephony.scm b/gnu/packages/telephony.scm
index 201cd8099a..246d85901c 100644
--- a/gnu/packages/telephony.scm
+++ b/gnu/packages/telephony.scm
@@ -218,7 +218,7 @@ internet.")
 (define-public libsrtp
   (package
     (name "libsrtp")
-    (version "1.6.0")
+    (version "2.2.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://github.com/cisco/libsrtp/archive/v"
@@ -226,31 +226,13 @@ internet.")
               (file-name (string-append name "-" version ".tar.gz"))
               (sha256
                (base32
-                "1ppdqsrx5ni54vmd4kdzzmvgmf5ixb04w0jw7idy8mad6l27jghs"))))
+                "02x5l5h2nq6f9gq1bmgz5v9jmnqaab51p8aldglng1z7pjbp9za4"))))
     (native-inputs
      `(("psmisc" ,psmisc)               ;some tests require 'killall'
        ("procps" ,procps)))
     (build-system gnu-build-system)
     (arguments
-     '(#:test-target "runtest"
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-mips-variable-in-testsuite
-           ;; This comes from https://github.com/cisco/libsrtp/pull/151
-           (lambda _
-             (substitute* "test/srtp_driver.c"
-               (("mips ") "mips_est ")
-               (("mips\\)") "mips_est)"))
-             #t))
-         (add-after 'unpack 'patch-dictionary-location
-           ;; With the above changes, the rtpw_test.sh test finally runs, and fails.
-           (lambda _
-             (substitute* "test/rtpw.c"
-               (("/usr/share/dict/words")
-                (string-append (assoc-ref %build-inputs "procps")
-                               "/share/doc/procps-ng/FAQ"))
-               (("words.txt") "FAQ"))
-             #t)))))
+     '(#:test-target "runtest"))
     (synopsis "Secure RTP (SRTP) Reference Implementation")
     (description
      "This package provides an implementation of the Secure Real-time Transport
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index 7971892082..86d6afef3e 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -579,9 +579,8 @@ collaboration using typical untrusted file hosts or services.")
          (add-after 'unpack 'unpack-git
            (lambda* (#:key inputs #:allow-other-keys)
              ;; Unpack the source of git into the 'git' directory.
-             (zero? (system*
-                     "tar" "--strip-components=1" "-C" "git" "-xf"
-                     (assoc-ref inputs "git:src")))))
+             (invoke "tar" "--strip-components=1" "-C" "git" "-xf"
+                     (assoc-ref inputs "git:src"))))
          (add-after 'unpack 'patch-absolute-file-names
            (lambda* (#:key inputs #:allow-other-keys)
              (define (quoted-file-name input path)
@@ -612,21 +611,20 @@ collaboration using typical untrusted file hosts or services.")
          (delete 'configure) ; no configure script
          (add-after 'build 'build-man
            (lambda* (#:key make-flags #:allow-other-keys)
-             (zero? (apply system* `("make" ,@make-flags "doc-man")))))
+             (apply invoke "make" "doc-man" make-flags)))
          (replace 'install
            (lambda* (#:key make-flags outputs #:allow-other-keys)
              (let ((out (assoc-ref outputs "out")))
-               (and (zero? (apply system*
-                                  `("make" ,@make-flags
-                                    ,(string-append "prefix=" out)
-                                    ,(string-append
-                                      "CGIT_SCRIPT_PATH=" out "/share/cgit")
-                                    "install" "install-man")))
-                    ;; Move the platform-dependent 'cgit.cgi' into lib
-                    ;; to get it stripped.
-                    (rename-file (string-append out "/share/cgit/cgit.cgi")
-                                 (string-append out "/lib/cgit/cgit.cgi"))
-                    #t))))
+               (apply invoke
+                      "make" "install" "install-man"
+                      (string-append "prefix=" out)
+                      (string-append "CGIT_SCRIPT_PATH=" out "/share/cgit")
+                      make-flags)
+               ;; Move the platform-dependent 'cgit.cgi' into lib to get it
+               ;; stripped.
+               (rename-file (string-append out "/share/cgit/cgit.cgi")
+                            (string-append out "/lib/cgit/cgit.cgi"))
+               #t)))
          (add-after 'install 'wrap-python-scripts
            (lambda* (#:key outputs #:allow-other-keys)
              (for-each
@@ -914,7 +912,7 @@ lot easier.")
              ;; two tests will fail -> disable them. TODO: fix the failing tests
              (delete-file "t/t3300-edit.sh")
              (delete-file "t/t7504-commit-msg-hook.sh")
-             (zero? (system* "make" "test")))))))
+             (invoke "make" "test"))))))
     (home-page "http://procode.org/stgit/")
     (synopsis "Stacked Git")
     (description
@@ -1467,7 +1465,8 @@ accessed and migrated on modern systems.")
                                      "libaegis/getpw_cache.cc")
                                    (find-files "test" "\\.sh"))
                            (("/bin/sh") (which "sh")))
-              (setenv "SH" (which "sh"))))
+              (setenv "SH" (which "sh"))
+              #t))
          (replace 'check
            (lambda _
              (let ((home (string-append (getcwd) "/my-new-home")))
@@ -1475,12 +1474,20 @@ accessed and migrated on modern systems.")
                (mkdir home)
                (setenv "HOME" home)
 
-               ;; This test assumes that  flex has been symlinked to "lex".
+               ;; This test assumes that flex has been symlinked to "lex".
                (substitute* "test/00/t0011a.sh"
                  (("type lex")  "type flex"))
 
+               ;; XXX Disable tests that fail, for unknown reasons, ‘for now’.
+               (for-each
+                (lambda (test) (substitute* "Makefile"
+                                 (((string-append "test/" test "\\.ES ")) "")))
+                (list "00/t0011a"
+                      "00/t0049a"
+                      "01/t0196a"))
+
                ;; The author decided to call the check rule "sure".
-               (zero? (system* "make" "sure"))))))))
+               (invoke "make" "sure")))))))
     (home-page "http://aegis.sourceforge.net")
     (synopsis "Project change supervisor")
     (description "Aegis is a project change supervisor, and performs some of
@@ -1897,9 +1904,10 @@ unique algebra of patches called @url{http://darcs.net/Theory,Patchtheory}.
          (add-after 'build 'add-properties
            (lambda* (#:key jar-name #:allow-other-keys)
              (with-directory-excursion "src"
-               (zero? (apply system* "jar" "-uf"
-                             (string-append "../build/jar/" jar-name)
-                             (find-files "." "\\.properties$")))))))))
+               (apply invoke "jar" "-uf"
+                      (string-append "../build/jar/" jar-name)
+                      (find-files "." "\\.properties$")))
+             #t)))))
     (inputs
      `(("java-classpathx-servletapi" ,java-classpathx-servletapi)
        ("java-javaewah" ,java-javaewah)
@@ -2034,7 +2042,7 @@ directory full of HOWTOs.")
 (define-public git-annex
   (package
     (name "git-annex")
-    (version "6.20180529")
+    (version "6.20180626")
     (source
      (origin
        (method url-fetch)
@@ -2042,7 +2050,7 @@ directory full of HOWTOs.")
                            "git-annex/git-annex-" version ".tar.gz"))
        (sha256
         (base32
-         "1rx0m4yrl3gl2ca8rbbv74fdlg4s2jnddzljhph7271a7bpyxsx5"))))
+         "0vq3x9p4h3m266pcm2r3m9p51pz5z9zskh7z5nk0adh33j30xf7q"))))
     (build-system haskell-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index ce90d470f4..2b8f3e18d2 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -25,6 +25,7 @@
 ;;; Copyright © 2018 Roel Janssen <roel@gnu.org>
 ;;; Copyright © 2018 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2018 Pierre Neidhardt <ambrevar@gmail.com>
+;;; Copyright © 2018 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1610,7 +1611,7 @@ device without having to bother about the decryption.")
     (synopsis "SubRip to WebVTT subtitle converter")
     (description "srt2vtt converts SubRip formatted subtitles to WebVTT format
 for use with HTML5 video.")
-    (home-page "http://dthompson.us/pages/software/srt2vtt")
+    (home-page "https://dthompson.us/projects/srt2vtt.html")
     (license license:gpl3+)))
 
 (define-public avidemux
@@ -2974,3 +2975,27 @@ format and some of its derived file formats, including MP4.  It operates as a
 multiplexer and demultiplexer, and can mux video and audio in several formats
 using standalone executable files.")
     (license license:isc)))
+
+(define-public qtfaststart
+  (package
+    (name "qtfaststart")
+    (version "1.8")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "qtfaststart" version))
+              (sha256
+               (base32
+                "0hcjfik8hhb1syqvyh5c6aillpvzal26nkjflcq1270z64aj6i5h"))))
+    (build-system python-build-system)
+    (arguments
+     '(#:tests? #f)) ; no test suite
+    (synopsis "Move QuickTime and MP4 metadata to the beginning of the file")
+    (description "qtfaststart enables streaming and pseudo-streaming of
+QuickTime and MP4 files by moving metadata and offset information to the
+beginning of the file.  It can also print some useful information about the
+structure of the file.  This program is based on qt-faststart.c from the FFmpeg
+project, which is released into the public domain, as well as ISO 14496-12:2005
+(the official spec for MP4), which can be obtained from the ISO or found
+online.")
+    (home-page "https://github.com/danielgtaylor/qtfaststart")
+    (license license:expat)))
diff --git a/gnu/packages/vulkan.scm b/gnu/packages/vulkan.scm
index b36471c0eb..c83bfdd0c9 100644
--- a/gnu/packages/vulkan.scm
+++ b/gnu/packages/vulkan.scm
@@ -233,7 +233,8 @@ and the ICD.")
            "16p25ry2i4zrj00zihfpf210f8xd7g398ffbw25igvi9mbn4nbfd"))))
       (build-system meson-build-system)
       (arguments
-       `(#:phases
+       `(#:tests? #f ; FIXME: Tests fail.
+         #:phases
          (modify-phases %standard-phases
            (replace 'configure
              (lambda* (#:key outputs #:allow-other-keys)
diff --git a/gnu/packages/web.scm b/gnu/packages/web.scm
index 3507dd59f2..805903ad9e 100644
--- a/gnu/packages/web.scm
+++ b/gnu/packages/web.scm
@@ -26,6 +26,7 @@
 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
 ;;; Copyright © 2018 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2018 Pierre-Antoine Rouby <pierre-antoine.rouby@inria.fr>
+;;; Copyright © 2018 Gábor Boskovits <boskovits@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -6113,6 +6114,7 @@ artifact.")))
      `(#:jar-name "eclipse-jetty-security.jar"
        #:source-dir "src/main/java"
        #:jdk ,icedtea-8
+       #:test-exclude (list "**/ConstraintTest.*") ; This test fails
        #:phases
        (modify-phases %standard-phases
          (add-before 'configure 'chdir
@@ -6139,11 +6141,6 @@ infrastructure")))
     (inherit java-eclipse-jetty-security)
     (version (package-version java-eclipse-jetty-util-9.2))
     (source (package-source java-eclipse-jetty-util-9.2))
-    (arguments
-     `(#:test-exclude
-       ;; This test fails.
-       (list "**/ConstraintTest.*")
-       ,@(package-arguments java-eclipse-jetty-security)))
     (inputs
      `(("util" ,java-eclipse-jetty-util-9.2)
        ("http" ,java-eclipse-jetty-http-9.2)
diff --git a/gnu/packages/wget.scm b/gnu/packages/wget.scm
index bd43e372cf..0fb1142b68 100644
--- a/gnu/packages/wget.scm
+++ b/gnu/packages/wget.scm
@@ -3,6 +3,7 @@
 ;;; Copyright © 2014, 2015, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017 Rutger Helling <rhelling@mykolab.com>
+;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -149,9 +150,9 @@ online pastebin services.")
                       (find-files "."))
           (substitute* "./gnulib/gnulib-tool.py"
                        (("/usr/bin/python") (which "python3")))
-          (zero? (system* "sh" "./bootstrap"
+          (invoke "sh" "./bootstrap"
                           "--gnulib-srcdir=gnulib"
-                          "--no-git")))))))
+                          "--no-git"))))))
    (inputs `(("autoconf" ,autoconf)
              ("automake" ,automake)
              ("doxygen" ,doxygen)
diff --git a/gnu/packages/wine.scm b/gnu/packages/wine.scm
index 68d7c51ac1..91b37556a0 100644
--- a/gnu/packages/wine.scm
+++ b/gnu/packages/wine.scm
@@ -69,7 +69,7 @@
 (define-public wine
   (package
     (name "wine")
-    (version "3.0.1")
+    (version "3.0.2")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://dl.winehq.org/wine/source/"
@@ -77,7 +77,7 @@
                                   "/wine-" version ".tar.xz"))
               (sha256
                (base32
-                "1wr63n70pli83p3rmclr2j4lxzs4ll1cwlpdlaajfrf6v9yhvl5s"))))
+                "1zv3nk31s758ghp4795ym3w8l5868c2dllmjx9245qh9ahvp3mya"))))
     (build-system gnu-build-system)
     (native-inputs `(("pkg-config" ,pkg-config)
                      ("gettext" ,gettext-minimal)
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index dc38b41494..2a8958d37f 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -265,25 +265,23 @@ between desktops, and change the number of desktops.")
 (define-public xeyes
   (package
     (name "xeyes")
-    (version "1.0.1")
+    (version "1.1.2")
     (source
-      (origin
-        (method url-fetch)
-        (uri (string-append
-               "http://xeyes.sourcearchive.com/downloads/1.0.1/xeyes_"
-               version
-               ".orig.tar.gz"))
-        (sha256
-          (base32
-            "04c3md570j67g55h3bix1qbngcslnq91skli51k3g1avki88zkm9"))))
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.x.org/releases/individual/app/"
+                           name "-" version ".tar.bz2"))
+       (sha256
+        (base32 "0lq5j7fryx1wn998jq6h3icz1h6pqrsbs3adskjzjyhn5l6yrg2p"))))
     (build-system gnu-build-system)
     (inputs
       `(("libxext" ,libxext)
         ("libxmu" ,libxmu)
+        ("libxrender" ,libxrender)
         ("libxt" ,libxt)))
     (native-inputs
      `(("pkg-config" ,pkg-config)))
-    (home-page "http://xeyes.sourcearchive.com/")
+    (home-page "https://www.x.org/")    ; no dedicated Xeyes page exists
     (synopsis "Follow-the-mouse X demo")
     (description "Xeyes is a demo program for x.org.  It shows eyes
 following the mouse.")
@@ -736,17 +734,16 @@ Guile will work for XBindKeys.")
 (define-public sxhkd
   (package
     (name "sxhkd")
-    (version "0.5.6")
+    (version "0.5.9")
     (source
      (origin
-       (file-name (string-append name "-" version ".tar.gz"))
-       (method url-fetch)
-       (uri (string-append
-             "https://github.com/baskerville/sxhkd/archive/"
-             version ".tar.gz"))
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/baskerville/sxhkd")
+             (commit version)))
        (sha256
         (base32
-         "15grmzpxz5fqlbfg2slj7gb7r6nzkvjmflmbkqx7mlby9pm6wdkj"))))
+         "0cw547x7vky55k3ksrmzmrra4zhslqcwq9xw0y4cmbvy4s1qf64v"))))
     (build-system gnu-build-system)
     (inputs
      `(("asciidoc" ,asciidoc)
@@ -755,10 +752,14 @@ Guile will work for XBindKeys.")
        ("xcb-util-keysyms" ,xcb-util-keysyms)
        ("xcb-util-wm" ,xcb-util-wm)))
     (arguments
-     '(#:phases (modify-phases %standard-phases (delete 'configure))
+     `(#:phases (modify-phases %standard-phases (delete 'configure))
        #:tests? #f  ; no check target
-       #:make-flags (list "CC=gcc"
-                          (string-append "PREFIX=" %output))))
+       #:make-flags
+       (list "CC=gcc"
+             (string-append "PREFIX=" %output)
+             ;; Keep the documentation where the build system installs LICENSE.
+             (string-append "DOCPREFIX=" %output
+                            "/share/doc/" ,name "-" ,version))))
     (home-page "https://github.com/baskerville/sxhkd")
     (synopsis "Simple X hotkey daemon")
     (description "sxhkd is a simple X hotkey daemon with a powerful and
diff --git a/gnu/packages/xfce.scm b/gnu/packages/xfce.scm
index 134d601881..79eb64d13a 100644
--- a/gnu/packages/xfce.scm
+++ b/gnu/packages/xfce.scm
@@ -793,7 +793,7 @@ inhibit interface which allows applications to prevent automatic sleep.")
 (define-public ristretto
   (package
     (name "ristretto")
-    (version "0.8.2")
+    (version "0.8.3")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://archive.xfce.org/src/apps/ristretto/"
@@ -801,7 +801,7 @@ inhibit interface which allows applications to prevent automatic sleep.")
                                   name "-" version ".tar.bz2"))
               (sha256
                (base32
-                "1f01d47kd85kjd1k4bzpcck4cb40qpjm5fzirzwdsxzwlrybgwzq"))))
+                "0r96r8r1qslr6cqvwldm99ha563adkw9v2zvaznxkpqn11v1374c"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index a647b7e582..4ce02b783c 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -5928,7 +5928,7 @@ basic eye-candy effects.")
 (define-public xpra
   (package
     (name "xpra")
-    (version "2.3.1")
+    (version "2.3.2")
     (source
      (origin
        (method url-fetch)
@@ -5936,7 +5936,7 @@ basic eye-candy effects.")
                            version ".tar.xz"))
        (sha256
         (base32
-         "0wghjmrw77pkh6agc5rz7ynr6s8yyc68qvj9rnp0vlwa3x1fl3ry"))))
+         "02wpnlx43dwacaahpm8db5kbnjw2msm3ycq71gib0n2zamd71ni6"))))
     (build-system python-build-system)
     (inputs `(("ffmpeg" ,ffmpeg)
               ("flac" ,flac)