Add Graal

Change-Id: I0350197af84ac351031e70a63fd0d483d022bad9
gnu: LLVM, Clang, libomp, lld: Update to 21.1.8.
2026-01-01 18:33:49 +01:00 · 2026-01-01 02:04:57 +01:00 · 2026-01-01 01:10:36 +01:00 · 2026-01-01 01:06:14 +01:00 · 2026-01-01 01:06:06 +01:00 · 2025-12-31 17:33:28 +00:00
576 changed files with 287965 additions and 93185 deletions
@@ -68,6 +68,7 @@
 /doc/stamp-vti
 /doc/version.texi
 /doc/version-*.texi
+/etc/apparmor.d/tunables/guix
 /etc/committer.scm
 /etc/gnu-store.mount
 /etc/guix-daemon.cil
@@ -23,6 +23,8 @@
   (name "cbaines"))
  ("3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"
   (name "civodul"))
+  ("CCB8 1842 F9D7 058E CD67  377A BF5C DF4D F6BF 6682"
+   (name "csantosb"))
  ("510A 8628 E2A7 7678 8F8C  709C 4BC0 2592 5FF8 F4D3"
   (name "cwebber"))
  (;; primary: "295A F991 6F46 F8A1 34B0  29DA 8086 3842 F0FE D83B"
@@ -98,6 +100,9 @@
   ;; <https://lists.gnu.org/archive/html/guix-devel/2020-01/msg00499.html>.
   "1EFB 0909 1F17 D28C CBF9  B13A 53D4 57B2 D636 EE82"
   (name "roptat"))
+  (;; primary: "3AC5 5D0E 1DA7 AF44 3868  11EE 213D C372 0E7A 023C"
+   "6B51 071A 0FB1 52AD ED93  6360 0322 7982 69E4 71C3"
+   (name "Rutherther"))
  ("EAD1 89E4 799B 5E5E B20A  2A19 CDBC 0BD9 5943 A706"
   (name "SameExpert"))
  (;; primary: "D6B0 C593 DA8C 5EDC A44C  7A58 C336 91F7 1188 B004"
@@ -30,6 +30,7 @@ Eric Bavier <bavier@posteo.net> <bavier@member.fsf.org>
 Eric Dvorsak <eric@dvorsak.fr> <yenda1@gmail.com>
 Evgeny Pisemsky <mail@pisemsky.site> <evgeny@pisemsky.com>
 George Clemmer <myglc2@gmail.com>
+Giacomo Leidi <therewasa@fishinthecalculator.me> <goodoldpaul@autistici.org>
 ison <ison@airmail.cc> <ison111@protonmail.com>
 Ivan Vilata i Balaguer <ivan@selidor.net>
 Jakob L. Kreuze <zerodaysfordays@sdf.org> <zerodaysfordays@sdf.lonestar.org>
@@ -58,6 +59,7 @@ Mathieu Othacehe <mathieu.othacehe@parrot.com>
 Mathieu Othacehe <othacehe@gnu.org>
 Matthew James Kraai <kraai@ftbfs.org>
 Maxim Cournoyer <maxim@guixotic.coop> <maxim.cournoyer@gmail.com>
+Nguyễn Gia Phong <cnx@loang.net> <mcsinyx@disroot.org>
 Nikita Karetnikov <nikita@karetnikov.org> <nikita.karetnikov@gmail.com>
 nikita <nikita@n0.is>
 nikita <nikita@n0.is> ng0 <ng0@n0.is>
@@ -12,6 +12,17 @@ gnu/packages/audio\.scm                            @guix/audio
 gnu/packages/fluidplug\.scm                        @guix/audio
 gnu/packages/xiph\.scm                             @guix/audio

+gnu/packages/elixir(-.+|)\.scm$                    @guix/beam
+guix/build/mix-build-system\.scm                   @guix/beam
+guix/build-system/mix\.scm                         @guix/beam
+gnu/packages/erlang(-.+|)\.scm$                    @guix/beam
+guix/build/rebar-build-system\.scm                 @guix/beam
+guix/build-system/rebar\.scm                       @guix/beam
+guix/import/hexpm\.scm                             @guix/beam
+guix/scripts/import/hexpm\.scm                     @guix/beam
+
+gnu/packages/bioinformatics\.scm                   @guix/bioinformatics
+
 gnu/packages/commencement\.scm                     @guix/bootstrap
 gnu/packages/mes\.scm                              @guix/bootstrap

@@ -118,6 +129,14 @@ guix/build/gnu-build-system\.scm                   @guix/core-packages
 guix/build/utils\.scm                              @guix/core-packages
 guix/build-system/gnu\.scm                         @guix/core-packages

+gnu/packages/(.*-|)crypto\.scm$                    @guix/crypto
+gnu/packages/gnupg\.scm                            @guix/crypto
+gnu/packages/nettle\.scm                           @guix/crypto
+gnu/packages/password-utils\.scm                   @guix/crypto
+gnu/packages/security-token\.scm                   @guix/crypto
+gnu/packages/ssh\.scm                              @guix/crypto
+gnu/packages/tls\.scm                              @guix/crypto
+
 gnu/packages/debian\.scm                           @guix/debian

 \.texi$                                            @guix/documentation
@@ -174,6 +193,12 @@ guix/import/go\.scm                                @guix/go
 guix/scripts/import/go\.scm                        @guix/go
 tests/import/go\.scm                               @guix/go

+gnu/packages/hare\.scm                             @guix/hare
+gnu/packages/hare-apps\.scm                        @guix/hare
+gnu/packages/hare-xyz\.scm                         @guix/hare
+guix/build-system/hare\.scm                        @guix/hare
+guix/build/hare-build-system\.scm                  @guix/hare
+
 gnu/packages/dhall\.scm                            @guix/haskell
 gnu/packages/haskell(-.+|)\.scm$                   @guix/haskell
 gnu/packages/purescript\.scm                       @guix/haskell
@@ -292,7 +317,8 @@ gnu/packages/chez\.scm                             @guix/racket
 gnu/packages/racket\.scm                           @guix/racket

 NEWS                                               @guix/release
-etc/manifests/release\.scm                         @guix/release
+etc/manifests/release-minimal\.scm                 @guix/release
+etc/manifests/release-desktop\.scm                 @guix/release

 gnu/packages/diffoscope\.scm                       @guix/reproduciblebuilds

@@ -456,11 +456,6 @@ AUX_FILES =						\
  gnu/packages/aux-files/linux-libre/6.17-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.17-riscv.conf	\
  gnu/packages/aux-files/linux-libre/6.17-x86_64.conf	\
-  gnu/packages/aux-files/linux-libre/6.16-arm.conf	\
-  gnu/packages/aux-files/linux-libre/6.16-arm64.conf	\
-  gnu/packages/aux-files/linux-libre/6.16-riscv.conf	\
-  gnu/packages/aux-files/linux-libre/6.16-x86_64.conf	\
-  gnu/packages/aux-files/linux-libre/6.16-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.12-arm.conf	\
  gnu/packages/aux-files/linux-libre/6.12-arm64.conf	\
  gnu/packages/aux-files/linux-libre/6.12-i686.conf	\
@@ -751,6 +746,14 @@ dist_fishcompletion_DATA = etc/completion/fish/guix.fish
 # SELinux policy
 nodist_selinux_policy_DATA = etc/guix-daemon.cil

+# AppArmor profiles.
+nodist_apparmor_profile_DATA =	\
+  etc/apparmor.d/guix		\
+  etc/apparmor.d/guix-daemon
+
+nodist_apparmor_profile_tunables_DATA = \
+  etc/apparmor.d/tunables/guix
+
 EXTRA_DIST +=						\
  .dir-locals.el					\
  .guix-authorizations					\
@@ -784,7 +787,9 @@ EXTRA_DIST +=						\
  etc/manifests/disarchive.scm				\
  etc/manifests/hurd.scm				\
  etc/manifests/kernels.scm				\
-  etc/manifests/release.scm				\
+  etc/manifests/release-minimal.scm			\
+  etc/manifests/release-desktop.scm			\
+  etc/manifests/release-user-packages.scm		\
  etc/manifests/source.scm				\
  etc/manifests/system-tests.scm			\
  etc/manifests/time-travel.scm				\
@@ -1137,12 +1142,18 @@ system_flags = $(foreach system,$(1),-s $(system))
 #   5. Build the installation and VM images.  The images will run 'guix'
 #      corresponding to 'vX.Y.Z' + 1 commit, and they will install 'vX.Y.Z'.
 #
-# This 'release' target takes care of everything and copies the resulting
-# files to $(releasedir).
+# This is split into two targets, because a commit is made that has to be
+# pushed to Guix.
+# First, 'prepare-release' should be run, doing steps 1 and 2.
+# Then, the resulting commit should be pushed so that it's available
+# to be downloaded for the system images.
+# Afterwards, the 'release' target takes care of the rest.  This 'release'
+# target takes care of everything and copies the resulting files to
+# $(releasedir).
 #
 # XXX: Depend on 'dist' rather than 'distcheck' to work around the Gettext
 # issue described at <https://savannah.gnu.org/bugs/index.php?51027>.
-release: dist-with-updated-version all
+prepare-release: dist-with-updated-version all
 	@if ! git diff-index --quiet HEAD; then			\
 	  echo "There are uncommitted changes; stopping." >&2 ;	\
 	  exit 1 ;						\
@@ -1160,48 +1171,26 @@ release: dist-with-updated-version all
 	$(top_builddir)/pre-inst-env guix build guix	\
 	      $(call system_flags,$(SUPPORTED_SYSTEMS))	\
 	      -v1 --no-grafts --fallback
-# Generate the binary release tarballs.
-	rm -f $(BINARY_TARBALLS)
-	$(MAKE) $(BINARY_TARBALLS)
-	for system in $(SUPPORTED_SYSTEMS) ; do					\
-	  mv "guix-binary.$$system.tar.xz"					\
-	      "$(releasedir)/guix-binary-$(PACKAGE_VERSION).$$system.tar.xz" ;	\
-	done
-# Build 'current-guix' to speed things up for the next step.
-	$(top_builddir)/pre-inst-env guix build				\
-	      -e '((@ (gnu packages package-management) current-guix))'	\
-	      $(call system_flags,$(GUIX_SYSTEM_INSTALLER_SYSTEMS))	\
-	      -v1 --no-grafts --fallback
-# Generate the ISO installation images.
-	for system in $(GUIX_SYSTEM_INSTALLER_SYSTEMS) ; do				\
-	  GUIX_DISPLAYED_VERSION="`git describe --match=v* | sed -'es/^v//'`" ;		\
-	  image=`$(top_builddir)/pre-inst-env						\
-	    guix system image -t iso9660						\
-	    --label="GUIX_$${system}_$(VERSION)"					\
-            --system=$$system --fallback						\
-	    gnu/system/install.scm` ;							\
-	  if [ ! -f "$$image" ] ; then							\
-	    echo "failed to produce Guix installation image for $$system" >&2 ;		\
-	    exit 1 ;									\
-	  fi ;										\
-	  cp "$$image" "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso.tmp" ;	\
-	  mv "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso.tmp"			\
-	     "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso" ;			\
-	done
-# Generate the VM images.
-	for system in $(GUIX_SYSTEM_VM_SYSTEMS) ; do					\
-	  GUIX_DISPLAYED_VERSION="`git describe --match=v* | sed -'es/^v//'`" ;		\
-	  image=`$(top_builddir)/pre-inst-env						\
-	    guix system image -t qcow2 $(GUIX_SYSTEM_VM_IMAGE_FLAGS)			\
-	    --save-provenance								\
-	    --system=$$system --fallback						\
-	    gnu/system/examples/vm-image.tmpl` ;					\
-	  if [ ! -f "$$image" ] ; then							\
-	    echo "failed to produce Guix VM image for $$system" >&2 ;			\
-	    exit 1 ;									\
-	  fi ;										\
-	  cp "$$image" "$(releasedir)/$(GUIX_SYSTEM_VM_IMAGE_BASE).$$system.qcow2";	\
-	done
+
+	@echo
+	@echo "First step done! Source tarball is ready in $(releasedir)"
+	@echo "Now push the resulting commit and run `make release`."
+	@echo
+
+# Make sure you've ran prepare-release prior to running release and pushed
+# the commit to Guix. It might be pushed to any branch, such as version-X.Y.Z.
+release: all
+# Build the artifacts for current commit.
+# Use time-machine for provenance.
+	$(MKDIR_P) "$(releasedir)"
+	@echo "Building guix inferior for current commit."
+	COMMIT="$$(git rev-parse HEAD)" &&					\
+	GUIX="$$(guix time-machine --commit=$$COMMIT)/bin/guix" &&		\
+	echo "Building artifacts for current commit: $$COMMIT." &&		\
+	ARTIFACTS="$$($$GUIX build --no-grafts					\
+		-f ./etc/teams/release/artifacts.scm)" &&			\
+	echo "Artifacts built! Copying to $(releasedir)" &&			\
+	cp -f "$$ARTIFACTS"/* "$(releasedir)"
 	@echo
 	@echo "Congratulations!  All the release files are now in $(releasedir)."
 	@echo
@@ -1240,9 +1229,10 @@ assert-no-store-file-names:
 # Make sure installer substitutes are available.  Check only the primary
 # server so that '--display-missing' doesn't print two lists.
 assert-binaries-available: $(GOBJECTS)
-	$(AM_V_at)$(top_builddir)/pre-inst-env				\
-	  guix weather -m "$(top_srcdir)/etc/manifests/release.scm"	\
-	                --substitute-urls="https://ci.guix.gnu.org"	\
+	$(AM_V_at)$(top_builddir)/pre-inst-env					\
+	  guix weather -m "$(top_srcdir)/etc/manifests/release-minimal.scm"	\
+	                -m "$(top_srcdir)/etc/manifests/release-desktop.scm"	\
+	                --substitute-urls="https://ci.guix.gnu.org"		\
 	                --display-missing

 # Make sure the final inputs don't refer to bootstrap tools.
@@ -50,7 +50,7 @@
                                      directory))
                                 ((_ . directory) directory))
                               (derivation->output-paths drv)))))
-              %final-inputs))
+              (%final-inputs system)))

 (define (assert-valid-substitute substitute)
  "Make sure SUBSTITUTE does not refer to any bootstrap inputs, and bail out
@@ -81,6 +81,15 @@ AC_ARG_WITH([selinux-policy-dir],
  [selinux_policydir='${datadir}/selinux/'])
 AC_SUBST([selinux_policydir])

+AC_ARG_WITH([apparmor-profile-dir],
+  AS_HELP_STRING([--with-apparmor-profile-dir=DIR],
+    [name of the AppArmor profile directory]),
+  [apparmor_profiledir="$withval"],
+  [apparmor_profiledir='${sysconfdir}/apparmor.d'])
+AC_SUBST([apparmor_profiledir])
+apparmor_profile_tunablesdir='${apparmor_profiledir}/tunables'
+AC_SUBST([apparmor_profile_tunablesdir])
+
 dnl Better be verbose.
 AC_MSG_CHECKING([for the store directory])
 AC_MSG_RESULT([$storedir])
@@ -308,6 +317,7 @@ AC_CONFIG_FILES([Makefile
                 po/guix/Makefile.in
                 po/packages/Makefile.in
                 etc/guix-daemon.cil
+                 etc/apparmor.d/tunables/guix
                 guix/config.scm])

 AC_CONFIG_FILES([etc/committer.scm], [chmod +x etc/committer.scm])
@@ -72,7 +72,7 @@

 (define %cookbook-languages
  ;; Available translations for the 'guix-cookbook' text domain.
-  '("de" "en" "es" "fr" "it" "ko" "pt_BR" "ru" "sk" "sv" "zh_CN"))
+  '("de" "en" "es" "fr" "it" "ko" "pt_BR" "ru" "sk" "sv" "ta" "zh_CN"))

 (define %languages
  ;; Available translations for the document being built.
@@ -1300,7 +1300,7 @@ must be the Guix top-level source directory, from which PO files are taken."
                                                  language))
                               ".html")))
                         "HTML, entirely on one page"))
-                  ,@(if (member language '("ko" "ru"))
+                  ,@(if (member language '("ko" "ru" "ta"))
                        '()
                        `((li (a (@ (href ,(string-append
                                            #$manual
@@ -134,7 +134,11 @@ C++11 standard.
@section Building from Git

 If you want to hack Guix itself, it is recommended to use the latest
-version from the Git repository:
+version from the Git repository@footnote{
+Guix uses @code{master} as the default branch name. A proposal in 2025 to
+change the default branch name to @code{main} did not reach consensus.
+See @uref{https://codeberg.org/guix/guix-consensus-documents/src/branch/main/003-rename-default-branch.md,
+Guix Consensus Document 003}.}:

@example
 git clone https://git.guix.gnu.org/guix.git
@@ -77,8 +77,9 @@ Italian (@pxref{Top,,, guix-cookbook.it, Ricettario di GNU Guix}),
 Brazilian Portuguese (@pxref{Top,,, guix-cookbook.pt_BR,
 Livro de receitas do GNU Guix}), Russian (@pxref{Top,,, guix-cookbook.ru,
 GNU Guix Рецепты}), Slovak (@pxref{Top,,, guix-cookbook.sk,
-Receptár GNU Guix}), and Swedish (@pxref{Top,,, guix-cookbook.sv,
-Kokbok för GNU Guix}).  If you would like to translate
+Receptár GNU Guix}), Swedish (@pxref{Top,,, guix-cookbook.sv,
+Kokbok för GNU Guix}), and Tamil (@pxref{Top,,, guix-cookbook.ta,
+GNU Guix கையேடு}).  If you would like to translate
 this document in your native language, consider joining
@uref{https://translate.codeberg.org/projects/guix/documentation-cookbook,
 Weblate} (@pxref{Translating Guix,,, guix, GNU Guix Reference
@@ -292,7 +293,7 @@ Examples of valid expressions:
@result{} 17

 (display (string-append "Hello " "Guix" "\n"))
-@print{} Hello Guix!
+@print{} Hello Guix
@result{} #<unspecified>
@end lisp

@@ -504,10 +505,6 @@ selection of documents to learn more about Scheme:
@uref{https://spritely.institute/static/papers/scheme-primer.html, @i{A
 Scheme Primer}}, by Christine Lemmer-Webber and the Spritely Institute.

-@item
-@uref{http://www.troubleshooters.com/codecorn/scheme_guile/hello.htm,
-@i{Scheme at a Glance}}, by Steve Litt.
-
@item
@c There used to be a copy at mitpress.mit.edu but it vanished.
@uref{https://sarabander.github.io/sicp/,
@@ -2,7 +2,7 @@
 # Modified by Ludovic Courtès <ludo@gnu.org> for the GNU Guix manual.
 # Further modified by Tomas Volf <~@wolfsden.cz>.

-htmlxrefversion=2025-08-31.16; # UTC
+htmlxrefversion=2025-11-29.21; # UTC

 # Copyright 2010-2020, 2022 Free Software Foundation, Inc.
 #
@@ -453,6 +453,8 @@ GUIX_COOKBOOK = ${GUIX_ROOT}/cookbook
 guix-cookbook.sk	node    ${GUIX_COOKBOOK}/sk/html_node/
 guix-cookbook.sv	mono    ${GUIX_COOKBOOK}/sv/guix-cookbook.sv.html
 guix-cookbook.sv	node    ${GUIX_COOKBOOK}/sv/html_node/
+ guix-cookbook.ta	mono    ${GUIX_COOKBOOK}/ta/guix-cookbook.ta.html
+ guix-cookbook.ta	node    ${GUIX_COOKBOOK}/ta/html_node/
 guix-cookbook		mono    ${GUIX_COOKBOOK}/en/guix-cookbook.html
 guix-cookbook		node	${GUIX_COOKBOOK}/en/html_node/
 guix-cookbook.zh_CN	mono    ${GUIX_COOKBOOK}/zh-cn/guix-cookbook.zh_CN.html
@@ -26,7 +26,7 @@

 # If adding a language, update the following variables, and info_TEXINFOS.
 MANUAL_LANGUAGES = de es fr it pt_BR ru zh_CN
-COOKBOOK_LANGUAGES = de es fr it ko pt_BR ru sk sv zh_CN
+COOKBOOK_LANGUAGES = de es fr it ko pt_BR ru sk sv ta zh_CN

 # Arg1: A list of languages codes.
 # Arg2: The file name stem.
@@ -52,6 +52,7 @@ info_TEXINFOS = %D%/guix.texi			\
  %D%/guix-cookbook.ru.texi			\
  %D%/guix-cookbook.sk.texi			\
  %D%/guix-cookbook.sv.texi			\
+  %D%/guix-cookbook.ta.texi			\
  %D%/guix-cookbook.zh_CN.texi

 %C%_guix_TEXINFOS = \
@@ -0,0 +1,12 @@
+abi <abi/4.0>,
+
+include <tunables/global>
+include <tunables/guix>
+
+# There’s no point in confining the guix executable, since it can run
+# any user code and so everything is expected.  We just need to
+# explicitely enable userns for systems with the
+# kernel.apparmor_restrict_unprivileged_userns sysctl.
+profile guix @{guix_storedir}/{*-guix-command,*-guix-*/bin/guix} flags=(unconfined) {
+  userns,
+}
@@ -0,0 +1,88 @@
+abi <abi/4.0>,
+
+include <tunables/global>
+include <tunables/guix>
+
+profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) {
+  include <abstractions/base>
+
+  userns,
+  signal,
+  capability sys_admin,
+  capability net_admin,
+  capability sys_chroot,
+  capability setgid,
+  capability chown,
+  network dgram,
+  umount,
+  mount,
+  pivot_root,
+  # Paths inside build chroot
+  /real-root/ w,
+  / w,
+
+  @{guix_localstatedir}/guix/** rwk,
+  /var/log/guix/** w,
+  owner @{PROC}/@{pid}/{fd/,environ} r,
+  owner @{PROC}/@{pid}/oom_score_adj w,
+  owner @{PROC}/@{pid}/uid_map rw,
+  owner @{PROC}/@{pid}/gid_map rw,
+  owner @{PROC}/@{pid}/setgroups w,
+  @{guix_storedir}/ r,
+  @{guix_storedir}/** rwlmk,
+  @{guix_storedir}/*/bin/guile cx -> guix-builder,
+  @{guix_storedir}/*-guix-command cx -> guix-helper,
+  @{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper,
+  @{etc_rw}/nsswitch.conf r,
+  @{etc_rw}/passwd r,
+  @{etc_rw}/group r,
+  owner /tmp/** rwl,
+  owner /var/tmp/** rwl,
+
+  /usr/bin/newgidmap Ux,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/guix-daemon>
+
+  profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) {
+    include <abstractions/base>
+
+    signal (receive),
+
+    @{guix_storedir}/** rwlmkux,
+
+    owner /tmp/** rw,
+
+    @{PROC}/@{pid}/fd/ r,
+
+    /disconnected/** rw,
+  }
+
+  # This is for any time guix is called by the daemon as a helper:
+  # - guix download
+  # - guix discover
+  # - guix gc --list-busy
+  # - probably more?
+  profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) {
+    include <abstractions/base>
+    include <abstractions/nameservice>
+
+    signal (receive),
+    ptrace (read) peer=guix-daemon,
+
+    /disconnected/run/dbus/system_bus_socket rw,
+    dbus (send, receive),
+    @{guix_localstatedir}/guix/discover/ rw,
+    @{guix_localstatedir}/guix/discover/* rw,
+
+    @{guix_localstatedir}/guix/substitute/ rw,
+    @{guix_localstatedir}/guix/substitute/** rwk,
+
+    @{guix_sysconfdir}/guix/** r,
+
+    @{guix_storedir}/** rwlmix,
+
+    @{PROC}/ r,
+    owner @{PROC}/@{pid}/{fd/,environ} r,
+  }
+}
@@ -0,0 +1,5 @@
+@{guix_storedir} = @storedir@
+@{guix_sysconfdir} = @guix_sysconfdir@
+@{guix_localstatedir} = @guix_localstatedir@
+
+include if exists <tunables/guix.d>
@@ -303,22 +303,23 @@ corresponding to the top-level definition containing the staged changes."
                (or (equal? old-values new-values)
                    (let ((removed (lset-difference equal? old-values new-values))
                          (added (lset-difference equal? new-values old-values)))
-                      (format port
-                              "[~a]: ~a~%" field
-                              (break-string
-                               ;; A dependency can be a list of (pkg output).
-                               (match (list (map object->string removed)
-                                            (map object->string added))
-                                 ((() added)
-                                  (format #f "Add ~a."
-                                          (listify added)))
-                                 ((removed ())
-                                  (format #f "Remove ~a."
-                                          (listify removed)))
-                                 ((removed added)
-                                  (format #f "Remove ~a; add ~a."
-                                          (listify removed)
-                                          (listify added))))))))))
+                      (unless (and (null? added) (null? removed))
+                        (format port
+                                "[~a]: ~a~%" field
+                                (break-string
+                                 ;; A dependency can be a list of (pkg output).
+                                 (match (list (map object->string removed)
+                                              (map object->string added))
+                                   ((() added)
+                                    (format #f "Add ~a."
+                                            (listify added)))
+                                   ((removed ())
+                                    (format #f "Remove ~a."
+                                            (listify removed)))
+                                   ((removed added)
+                                    (format #f "Remove ~a; add ~a."
+                                            (listify removed)
+                                            (listify added)))))))))))
            '(inputs propagated-inputs native-inputs)))

 (define* (add-commit-message file-name variable-name
@@ -175,6 +175,10 @@
         (file (execute
                execute_no_trans read write open entrypoint map
                getattr link unlink)))
+  ;; Needed to execute the 'newgidmap' helper.
+  (allow guix_daemon_t
+         bin_t
+         (file (execute execute_no_trans map)))

  ;; Remounting /gnu/store read-write.
  (allow guix_daemon_t
@@ -185,6 +189,9 @@
  (allow guix_daemon_t
         root_t
         (dir (mounton)))
+  (allow init_t
+         guix_daemon.guix_store_content_t
+         (dir (mounton)))
  (allow guix_daemon_t
         fs_t
         (filesystem (getattr)))
@@ -319,7 +326,7 @@
                map
                getattr setattr
                unlink
-                open read write)))
+                open read write append)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (lnk_file (create getattr rename unlink read)))
@@ -361,6 +368,14 @@
         self
         (netlink_route_socket (bind create getattr nlmsg_read read write getopt)))

+  ;; Allow use of user namespaces
+  (allow guix_daemon_t
+         self
+         (cap_userns (setgid sys_admin net_admin sys_chroot)))
+  (allow guix_daemon_t
+         self
+         (user_namespace (create)))
+
  ;; Socket operations
  (allow guix_daemon_t
         guix_daemon_socket_t
@@ -440,6 +455,27 @@
         vnc_port_t
         (tcp_socket (name_bind)))

+  ;; 'guix gc' needs to go through /proc entries for all processes that are
+  ;; running.  Strictly speaking, it means guix-daemon needs access to all
+  ;; process types in the SELinux policy.  In practice, only processes from
+  ;; programs in the /gnu/store are relevant for finding roots for garbage
+  ;; collection.  Since Guix currently doesn't install any SELinux policy for
+  ;; its packages, we can assume that all the processes it needs to access run
+  ;; as unconfined_t.
+  ;;
+  ;; FIXME: This doesn't stop 'guix gc' from generating a lot of unnecessary
+  ;; AVC denied audit messages.  Perhaps guix-daemon could test whether it has
+  ;; access to the proc entry before trying to access it?
+  (allow guix_daemon_t
+         unconfined_t
+         (dir (search)))
+  (allow guix_daemon_t
+         unconfined_t
+         (file (read)))
+  (allow guix_daemon_t
+         unconfined_t
+         (lnk_file (read)))
+
  ;; I guess sometimes it needs random numbers
  (allow guix_daemon_t
         random_device_t
@@ -14,6 +14,12 @@ ExecStart=@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daem
    --substitute-urls='@GUIX_SUBSTITUTE_URLS@'
 Environment='GUIX_STATE_DIRECTORY=@localstatedir@/guix' 'GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale' LC_ALL=en_US.utf8

+# Stop the gnu-store.mount so that the daemon can capture the store as
+# read-write in its private mount namespace.
+# See <https://codeberg.org/guix/guix/issues/4744>.
+ExecStartPre=-+systemctl stop gnu-store.mount
+ExecStartPost=-+systemctl start gnu-store.mount --no-block
+
 # Run under a dedicated unprivileged user account.
 User=guix-daemon

@@ -17,6 +17,7 @@
 # Copyright © 2024 Tomas Volf <~@wolfsden.cz>
 # Copyright © 2024 Richard Sent <richard@freakingpenguin.com>
 # Copyright © 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
+# Copyright © 2025 Noé Lopez <noelopez@free.fr>
 #
 # This file is part of GNU Guix.
 #
@@ -105,10 +106,11 @@ DEBUG=0
 GNU_URL="https://ftpmirror.gnu.org/gnu/guix/"

 # The following associative array holds set of GPG keys used to sign the
-# releases, keyed by their corresponding Savannah user ID.
+# releases, keyed by their corresponding Codeberg user name.
 declare -A GPG_SIGNING_KEYS
-GPG_SIGNING_KEYS[15145]=3CE464558A84FDC69DB40CFB090B11993D9AEBB5  # ludo
-GPG_SIGNING_KEYS[127547]=27D586A4F8900854329FF09F1260E46482E63562 # maxim
+GPG_SIGNING_KEYS["civodul"]=3CE464558A84FDC69DB40CFB090B11993D9AEBB5  # ludo
+GPG_SIGNING_KEYS["apteryx"]=27D586A4F8900854329FF09F1260E46482E63562 # maxim
+PUBLIC_KEYSERVERS="keys.openpgp.org pgpkeys.eu keyserver.ubuntu.com"

 # ------------------------------------------------------------------------------
 #+UTILITIES
@@ -203,6 +205,7 @@ chk_gpg_keyring()

    for user_id in "${!GPG_SIGNING_KEYS[@]}"; do
        gpg_key_id=${GPG_SIGNING_KEYS[$user_id]}
+        codeberg_username=$user_id
        # Without --dry-run this command will create a ~/.gnupg owned by root on
        # systems where gpg has never been used, causing errors and confusion.
        if gpg --dry-run --list-keys "$gpg_key_id" >/dev/null 2>&1; then
@@ -211,20 +214,39 @@ chk_gpg_keyring()
        if prompt_yes_no "${INF}The following OpenPGP public key is \
 required to verify the Guix binary signature: $gpg_key_id.
 Would you like me to fetch it for you?"; then
-            # Use a reasonable time-out here so users don't report silent
-            # ‘freezes’ when Savannah goes out to lunch, as has happened.
-            if wget "https://sv.gnu.org/people/viewgpg.php?user_id=$user_id" \
-                    --timeout=30 --no-verbose -O- | gpg --import -; then
+            if wget "https://codeberg.org/$codeberg_username.gpg" \
+                   --tries=1 --timeout=30 --no-verbose -O- | gpg --import -; then
+                continue
+            fi
+            
+            key_obtained=false
+            # Try to fetch keys from an available keyserver
+            for key_server in $PUBLIC_KEYSERVERS; do
+                if gpg --keyserver $key_server --recv-key $gpg_key_id; then
+                    key_obtained=true
+                    break
+                fi
+            done
+            
+            if $key_obtained; then
                continue
            fi
        fi
 	# If we reach this point, the key is (still) missing.  Report further
 	# missing keys, if any, but then abort the installation.
        _err "Missing OpenPGP public key ($gpg_key_id).
-Fetch it with this command:
+Fetch it with codeberg username:

-  wget \"https://sv.gnu.org/people/viewgpg.php?user_id=$user_id\" -O - | \
-sudo -i gpg --import -"
+  wget \"https://codeberg.org/$codeberg_username.gpg\" -O - | \
+sudo -i gpg --import -
+
+If this fails, try to fetch it via a keyserver:
+
+  for key_server in $PUBLIC_KEYSERVERS; do
+      if sudo -i gpg --keyserver $key_server --recv-key $gpg_key_id; then
+          break
+      fi
+  done"
        exit_flag=yes
    done
    if [ "$exit_flag" = yes ]; then
@@ -773,10 +795,6 @@ export PATH="$GUIX_PROFILE/bin${PATH:+:}$PATH"
 # trailing colon so the system default search path is used.
 export INFOPATH="$GUIX_PROFILE/share/info:$INFOPATH"
 export MANPATH="$GUIX_PROFILE/share/man:$MANPATH"
-# Expose the latest Guix modules to Guile so guix shell and repls spawned by
-# e.g. Geiser work out of the box.
-export GUILE_LOAD_PATH="$GUIX_PROFILE/share/guile/site/3.0${GUILE_LOAD_PATH:+:}$GUILE_LOAD_PATH"
-export GUILE_LOAD_COMPILED_PATH="$GUIX_PROFILE/lib/guile/3.0/site-ccache${GUILE_LOAD_COMPILED_PATH:+:}$GUILE_LOAD_COMPILED_PATH"

 # User's default profile, if it exists
 GUIX_PROFILE="$HOME/.guix-profile"
@@ -798,6 +816,11 @@ if [ -L "$GUIX_PROFILE" ]; then
    *$GUIX_PROFILE/share/man*) ;;
    *) export MANPATH="$GUIX_PROFILE/share/man:$MANPATH"
  esac
+
+  case $XDG_DATA_DIRS in
+    *$GUIX_PROFILE/share*) ;;
+    *) export XDG_DATA_DIRS="$GUIX_PROFILE/share:$XDG_DATA_DIRS"
+  esac
 fi

 # NOTE: Guix Home handles its own profile initialization in ~/.profile. See
@@ -892,6 +915,64 @@ sys_maybe_setup_selinux()
    restorecon -R /gnu /var/guix
 }

+sys_maybe_setup_apparmor()
+{
+    if ! [ -f /sys/module/apparmor/parameters/enabled ]
+    then
+        return
+    fi
+
+    if ! command -v apparmor_parser &> /dev/null
+    then
+        return
+    fi
+
+    prompt_yes_no "Install AppArmor profile that might be required to run guix-daemon?" \
+        || return 0
+
+    local var_guix=/var/guix/profiles/per-user/root/current-guix
+    local apparmor_sources="${var_guix}/etc/apparmor.d/"
+
+    if ! [ -d "$apparmor_sources" ]
+    then
+        _err "This version of Guix doesn’t contain AppArmor profiles."
+        return
+    fi
+
+    cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix"
+    cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon"
+    cp -f -t /etc/apparmor.d "$apparmor_sources/guix"
+    apparmor_parser --warn=all -r /etc/apparmor.d/guix-daemon
+    apparmor_parser --warn=all -r /etc/apparmor.d/guix
+
+    _msg_pass "apparmor profiles installed and loaded"
+}
+
+sys_delete_apparmor_profiles()
+{
+    # Not a big deal if the apparmor_parser commands fail as they only apply
+    # for the current boot, we still want to go on and remove the files.
+    if [ -f "/etc/apparmor.d/guix" ]
+    then
+        _msg_info "removing /etc/apparmor.d/guix"
+        apparmor_parser -R /etc/apparmor.d/guix || true
+        rm -f "/etc/apparmor.d/guix"
+    fi
+
+    if [ -f "/etc/apparmor.d/guix-daemon" ]
+    then
+        _msg_info "removing /etc/apparmor.d/guix-daemon"
+        apparmor_parser -R /etc/apparmor.d/guix-daemon || true
+        rm -f "/etc/apparmor.d/guix-daemon"
+    fi
+
+    if [ -f "/etc/apparmor.d/tunables/guix" ]
+    then
+        _msg_info "removing /etc/apparmor.d/tunables/guix"
+        rm -f "/etc/apparmor.d/tunables/guix"
+    fi
+}
+
 sys_delete_init_profile()
 {
    _msg_info "removing /etc/profile.d/zzz-guix.sh"
@@ -969,7 +1050,6 @@ main_install()
    chk_init_sys
    add_init_sys_require
    chk_require "${REQUIRE[@]}"
-    chk_gpg_keyring
    chk_sys_arch
    chk_sys_nscd
    chk_existing
@@ -980,6 +1060,7 @@ main_install()
    tmp_path="$(mktemp -t -d guix.XXXXXX)"

    if [ -z "${GUIX_BINARY_FILE_NAME}" ]; then
+        chk_gpg_keyring
        guix_get_bin_list "${GNU_URL}"
        guix_get_bin "${GNU_URL}" "${BIN_VER}" "$tmp_path"
        GUIX_BINARY_FILE_NAME=${BIN_VER}.tar.xz
@@ -994,6 +1075,7 @@ main_install()
    sys_create_store "${GUIX_BINARY_FILE_NAME}" "${tmp_path}"
    sys_create_build_user
    sys_maybe_setup_selinux
+    sys_maybe_setup_apparmor
    sys_enable_guix_daemon
    sys_authorize_build_farms
    sys_create_init_profile
@@ -1027,6 +1109,7 @@ main_uninstall()
    sys_delete_guix_daemon
    # stop people from accessing their profiles.
    sys_delete_user_profiles
+    sys_delete_apparmor_profiles
    # kill guix off all the guts of guix
    sys_delete_store
    # clean up the system
@@ -71,18 +71,21 @@ TARGET."
         "connman" "network-manager" "wpa-supplicant" "isc-dhcp" "cups"
         "linux-libre" "grub-hybrid")))

-(define %system-gui-packages
+(define (%system-gui-packages target)
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
               '(;; build system `python' does not support cross builds
-                 ;"gnome" "xfce" "mate" "openbox"
+                                        ;"gnome" "xfce" "mate" "openbox"
                 "awesome"
                 "i3-wm" "i3status" "dmenu" "st"
                 "ratpoison" "xterm"
                 ;; build system `emacs' does not support cross builds
-                 ;"emacs-exwm" "emacs-desktop-environment"
+                                        ;"emacs-exwm" "emacs-desktop-environment"
                 "emacs"))
-          %default-xorg-modules))
+          ;; NOTE: %default-xorg-modules depends on system.
+          (parameterize
+              ((%current-target-system target))
+            %default-xorg-modules)))

 (define %packages-to-cross-build
  ;; Packages that must be cross-buildable from x86_64-linux.
@@ -151,7 +154,8 @@ TARGET."
                                 ;; With a graphical environment:
                                 (if (or (target-x86-32? target)
                                         (target-aarch64? target))
-                                     %system-gui-packages
+                                     ;; %system-gui-packages depends on the system.
+                                     (%system-gui-packages target)
                                     '()))))
                  (fold delete (map platform-system->target (systems))
                        '(;; Disable cross-compilation to self:
@@ -0,0 +1,167 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest containing packages which are needed by the
+;;; installer.
+
+(use-modules (guix packages)
+             (gnu packages)
+             ((gnu services xorg) #:select (%default-xorg-modules))
+             (guix profiles)
+             (guix utils)
+             (srfi srfi-1))
+
+(define %desktop-packages
+  (append
+   %default-xorg-modules
+   (map specification->package
+        (list
+         ;; etc-service
+         "net-base"
+         "tzdata"
+         ;; boot-file-system-utilities-service
+         "e2fsprogs"
+         ;; plasma-deskto-sservice-type
+         "plasma"
+         ;; gnome-desktop-service
+         "gnome"
+         ;; xfce-desktop-service
+         "xfce"
+         ;; mate-desktop-service
+         "mate"
+         ;; set-xorg-configuration-service
+         "font-alias"
+         "font-misc-misc"
+         "font-adobe75dpi"
+         "xorg-server"
+         ;; screen-locker-service
+         "slock"
+         "xlockmore"
+         ;; mtp-service
+         "libmtp"
+         ;; sane-service
+         "sane"
+         "sane-backends"
+         ;; mount-setuid-helpers-service
+         "nfs-utils"
+         "ntfs-3g"
+         ;; guix-artwork-service
+         "guix-backgrounds"
+         "guix-icons"
+         ;; vte-integration-service
+         "vte"
+         ;; network-manager-applet-service
+         "network-manager-applet"
+         ;; modem-manager-service
+         "modem-manager"
+         ;; usb-modeswitch-service
+         "usb-modeswitch"
+         "usb-modeswitch-data"
+         ;; avahi-service
+         "avahi"
+         ;; udisks-service
+         "udisks"
+         ;; cups-pk-helper-service
+         "cups-pk-helper"
+         ;; colord-service
+         "colord"
+         ;; geoclue-service
+         "geoclue"
+         ;; polkit-service
+         "polkit"
+         ;; elogind-service
+         "elogind"
+         ;; dbus-service
+         ;; ntp-service
+         "ntp"
+         ;; alsa-service
+         "alsa-plugins"
+         ;; mingetty-service
+         "mingetty"
+         ;; etc-bashrc-d-service
+         "bash-completion"
+         ;; udev-service
+         "eudev"
+         "lvm2"
+         "alsa-utils"
+         "crda"
+         ;; sysctl-service
+         "procps"
+         ;; special-files-service
+         "coreutils"
+         "grub-pc"
+         "less"
+         "mg"
+         "nano"
+         "nvi"
+         "man-db"
+         "info-reader"
+         "kbd"
+         "guile-readline"
+         "guile-colorized"
+         "pciutils"
+         "usbutils"
+         "util-linux-with-udev"
+         "kmod"
+         "isc-dhcp"
+         "iproute2"
+         "wget"
+         "nss-certs"
+         "iw"
+         "wireless-tools"
+         "psmisc"
+         "which"
+         "guile"
+         "findutils"
+         "grep"
+         "sed"
+         "diffutils"
+         "patch"
+         "gawk"
+         "tar"
+         "gzip"
+         "bzip2"
+         "lzip"
+         "xz"
+         "zstd"
+         ;; packages
+         "sway"
+         "foot"
+         "wmenu"
+         "icewm"
+         "openbox"
+         "awesome"
+         "i3-wm"
+         "i3status"
+         "dmenu"
+         "st"
+         "ratpoison"
+         "xterm"
+         "emacs"
+         "emacs-exwm"
+         "emacs-desktop-environment"))))
+
+(define %desktop-manifest
+  (manifest
+   ;; Some of %SYSTEM-PACKAGES are currently unsupported on some
+   ;; systems--e.g., GNOME on 32-bit, due to Rust.  Filter them out.
+   (filter-map (lambda (package)
+                 (and (supported-package? package (%current-system))
+                      (package->manifest-entry package)))
+               (append %desktop-packages))))
+
+%desktop-manifest
@@ -23,7 +23,9 @@
 ;;; installer.

 (use-modules (guix packages)
-             ((gnu services xorg) #:select (%default-xorg-modules))
+             (gnu packages)
+             ((gnu system) #:select (%base-packages %base-firmware))
+             (guix profiles)
             (guix utils)
             (srfi srfi-1))

@@ -44,16 +46,14 @@ TARGET."
 (define %system-packages
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
-               '("guix" "shepherd"
-                 "gnome" "xfce" "mate"
-                 "icewm" "openbox" "awesome"
-                 "i3-wm" "i3status" "dmenu" "st"
-                 "ratpoison" "xterm"
-                 "emacs" "emacs-exwm" "emacs-desktop-environment"
-                 "openssh" "tor" "ntp" "gpm"
+               '("guix" "shepherd" "guile-static-initrd"
+                 "openssh" "tor" "ntp" "gpm" "mingetty"
                 "connman" "network-manager" "wpa-supplicant" "isc-dhcp" "cups"
-                 "linux-libre" "grub-hybrid"))
-          %default-xorg-modules))
+                 "linux-libre" "grub-hybrid"
+                 ;; privileged programs
+                 "shadow" "sudo" "fuse" "inetutils" "util-linux"))
+          %base-firmware
+          %base-packages))

 (define %bootloader-packages
  ;; The bootloaders offered by the Guix System installer.
@@ -0,0 +1,165 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 Noé Lopez <noelopez@free.fr>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This manifest is a list of packages that user care about (collected via an
+;;; online form).  It corresponds to the “Important packages” of GCD 005.
+
+(specifications->manifest
+ (list
+  "0ad"
+  "agda"
+  "alacritty"
+  "ardour"
+  "autoconf"
+  "automake"
+  "blender"
+  "borg"
+  "btrfs-progs"
+  "certbot"
+  "chez-scheme"
+  "clang-toolchain"
+  "cryptsetup"
+  "dillo"
+  "direnv"
+  "docker-cli"
+  "dovecot"
+  "emacs"
+  "emacs-exwm"
+  "emacs-pgtk"
+  "evince"
+  "fcitx5"
+  "file"
+  "fish"
+  "foot"
+  "fzf"
+  "gajim"
+  "gallery-dl"
+  "gcc-toolchain"
+  "getmail6"
+  "gettext"
+  "ghc-xmonad-contrib"
+  "gimp"
+  "git"
+  "gmp"
+  "gnome"
+  "gnupg"
+  "godot"
+  "gpaste"
+  "guile"
+  "guile-json"
+  "hatch"
+  "help2man"
+  "helvum"
+  "hexchat"
+  "hyprland"
+  "icecat"
+  "idris"
+  "imagemagick"
+  "imapfilter"
+  "jami"
+  "k3b"
+  "kakoune"
+  "keepassxc"
+  "krita"
+  "ksoloti-patcher"
+  "libreoffice"
+  "librewolf"
+  "libsecret"
+  "libtool"
+  "libvirt"
+  "llama-cpp"
+  "mariadb"
+  "luanti"
+  "mpc"
+  "mpfr"
+  "mplayer"
+  "mpv"
+  "mullvadbrowser"
+  "neovim"
+  "nginx"
+  "niri"
+  "nix"
+  "node"
+  "notmuch"
+  "obs"
+  "offlineimap3"
+  "opencv"
+  "openmpi"
+  "opensmtpd"
+  "openssh"
+  "openttd"
+  "pandoc"
+  "password-store"
+  "pavucontrol"
+  "php"
+  "picard"
+  "pipewire"
+  "pkg-config"
+  "plasma"
+  "plasma-desktop"
+  "po4a"
+  "podman"
+  "postgresql"
+  "python"
+  "python-lxml"
+  "python-pycryptodome"
+  "qemu"
+  "ranger"
+  "retroarch"
+  ;;"rocm"
+  "rofi"
+  "rspamd"
+  "rsync"
+  "screen"
+  "slurm"
+  "sqlite"
+  "sqlitebrowser"
+  "strace"
+  "strawberry"
+  "syncthing"
+  "taisei"
+  "telegram-desktop"
+  "texlive-babel"
+  "texlive-babel-english"
+  "texlive-babel-french"
+  "texlive-babel-german"
+  "texlive-collection-latex"
+  "texlive-collection-latexrecommended"
+  "texlive-collection-xetex"
+  "texlive-pdfjam"
+  "tmux"
+  "tuba"
+  "ungoogled-chromium"
+  "unison"
+  "unzip"
+  "uv"
+  "viewnior"
+  "virt-manager"
+  "waybar"
+  "wine"
+  "wine64"
+  "wireguard-tools"
+  "xmobar"
+  "xmonad"
+  "xournal"
+  "xournalpp"
+  "xpdf"
+  "yt-dlp"
+  "zig"
+  "zip"
+  "zsh"))
@@ -42,6 +42,69 @@
 (channel-news
 (version 0)

+ (entry (commit "d3b79beaa806452dceaffb8b211b69dc4c346aba")
+        (title
+         (en "Linux-libre 5.4 no longer supported")
+         (de "Linux-libre 5.4 nicht mehr unterstützt")
+         (pt "Linux-libre 5.4 não é mais suportado"))
+        (body
+         (en "The linux-libre 5.4 kernel series is no longer supported
+upstream and will be removed from GNU Guix soon:
+
+https://www.kernel.org/category/releases.html
+
+This kernel series was first added to Guix in 2019 by Mark Weaver, at version
+5.4.5.  After ~297 updates delivered to Guix users, we have deployed the final
+update, 5.4.302.
+
+The next kernel series removals are scheduled for December 2026, when the Linux
+long-term support team is planning to stop supporting four different kernel
+series: 6.12, 6.6, 5.15, and 5.10.")
+         (de "Die Versionsreihe 5.4 des Linux-libre-Kernels wird von dessen
+Anbieter nicht mehr unterstützt und wird bald aus GNU Guix entfernt werden:
+
+https://www.kernel.org/category/releases.html
+
+Diese Kernel-Reihe wurde ursprünglich 2019 zu Guix hinzugefügt von Mark Weaver
+mit Version 5.4.5.  Nach ~297 Aktualisierungen, die Guix seinen Nutzern
+bereitgestellt hat, haben wir nun die letzte Aktualisierung
+ausgeliefert, 5.4.302.
+
+Der weitere Plan von Linux’ Team für Langzeitunterstützung sieht vor, als
+Nächstes die Unterstützung für vier verschiedene Kernel-Reihen im Dezember 2026
+zu beenden: 6.12, 6.6, 5.15 und 5.10.")
+         (pt "A série 5.4 do kernel linux-libre não é mais suportada pelo
+fornecedor e será removida do GNU Guix em breve:
+
+https://www.kernel.org/category/releases.html
+
+Esta série de kernels foi adicionada inicialmente ao Guix em 2019 por Mark
+Weaver, na versão 5.4.5.  Após ~297 atualizações entregues aos usuários do
+Guix, implantamos a atualização final, 5.4.302.
+
+As próximas remoções de séries do kernel estão agendadas para dezembro de
+2026, quando o time de suporte de longo prazo planeja interromper o suporte a
+quatro séries diferentes do kernel: 6.12, 6.6, 5.15 e 5.10.")))
+
+ (entry (commit "14bb0192fde79909999c3880b6b66aa22499eb11")
+        (title
+         (en "Linux-libre 6.16 removed from Guix")
+         (de "Linux-libre 6.16 wurde aus Guix entfernt")
+         (pt "Linux-libre 6.16 removido do Guix")
+         (zh "Linux-libre 6.16 已从 Guix 中移除"))
+        (body
+         (en "The linux-libre 6.16 kernel series has been removed from Guix, as
+it is no longer supported upstream.  The 6.17 kernel series is now the
+default.")
+         (de "Die Versionsreihe 6.16 des Linux-libre-Kernels wurde aus GNU Guix
+entfernt, weil sie von dessen Anbieter nicht mehr unterstützt wird.
+Kernel-Versionsreihe 6.17 ist jetzt vorgegeben.")
+         (pt "A série 6.16 do kernel linux-libre foi removida do Guix, dado
+que não é mais suportada pelo fornecedor.  A série 6.17 é o padrão atual")
+         (zh "由于上游不再支持，GNU Guix 已移除 6.16 系列的 linux-libre 内核。6.17
+内核系列现已成为默认版本。")))
+
+
 (entry (commit "8daae75de3670594dfcb63b6ae6f1603ca6f7971")
        (title
         (en "Fundraising to sustain and strengthen Guix")
@@ -15,6 +15,7 @@ exec $pre_inst_env_maybe guix repl -- "$0" "$@"
 ;;; Copyright © 2025 Jelle Licht <jlicht@fsfe.org>
 ;;; Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2025 jgart <jgart@dismail.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -464,6 +465,26 @@ already exists.  Lookup team IDs among CURRENT-TEAMS."
                      "gnu/packages/fluidplug.scm"
                      "gnu/packages/xiph.scm")))

+(define-team beam
+  (team 'beam
+        #:name "Erlang/Elixir/BEAM team"
+        #:description "The virtual machine at the core of the Erlang Open
+Telecom Platform (OTP), Erlang and Elxir languages and packages, development
+of Rebar and Mix build systems and Hex.pm importer."
+        #:scope (list (make-regexp* "^gnu/packages/elixir(-.+|)\\.scm$")
+                      "guix/build/mix-build-system.scm"
+                      "guix/build-system/mix.scm"
+                      (make-regexp* "^gnu/packages/erlang(-.+|)\\.scm$")
+                      "guix/build/rebar-build-system.scm"
+                      "guix/build-system/rebar.scm"
+                      "guix/import/hexpm.scm"
+                      "guix/scripts/import/hexpm.scm")))
+
+(define-team bioinformatics
+  (team 'bioinformatics
+        #:name "Bioinformatics team"
+        #:scope (list "gnu/packages/bioinformatics.scm")))
+
 (define-team bootstrap
  (team 'bootstrap
        #:name "Bootstrap"
@@ -677,6 +698,15 @@ GLib/GIO, GTK, GStreamer and Webkit."
                      "guix/scripts/import/go.scm"
                      "tests/import/go.scm")))

+(define-team hare
+  (team 'hare
+        #:name "Hare"
+        #:scope (list "gnu/packages/hare.scm"
+                      "gnu/packages/hare-apps.scm"
+                      "gnu/packages/hare-xyz.scm"
+                      "guix/build-system/hare.scm"
+                      "guix/build/hare-build-system.scm")))
+
 (define-team haskell
  (team 'haskell
        #:name "Haskell team"
@@ -909,7 +939,8 @@ importer."
        "The current release team.  Members are expected to change with each
 release."
        #:scope (list "NEWS"
-                      "etc/manifests/release.scm")))
+                      "etc/manifests/release-minimal.scm"
+                      "etc/manifests/release-desktop.scm")))

 (define-team reproduciblebuilds
  (team 'reproduciblebuilds
@@ -941,6 +972,19 @@ release."
                      "guix/scripts/import/crate.scm"
                      "tests/import/crate.scm")))

+(define-team crypto
+  (team 'crypto
+        #:name "Crypto team"
+        #:description
+        "Secrets, passwords, cryptography and security related packages."
+        #:scope (list (make-regexp* "^gnu/packages/(.*-|)crypto\\.scm$")
+                      "gnu/packages/gnupg.scm"
+                      "gnu/packages/nettle.scm"
+                      "gnu/packages/password-utils.scm"
+                      "gnu/packages/security-token.scm"
+                      "gnu/packages/ssh.scm"
+                      "gnu/packages/tls.scm")))
+
 (define-team science
  (team 'science
        #:name "Science team"
@@ -1053,11 +1097,6 @@ the \"texlive\" importer."
                       "bavier")
  science)

-(define-member (person "Lars-Dominik Braun"
-                       "lars@6xq.net"
-                       "ldb")
-  python haskell)
-
 (define-member (person "Jonathan Brielmaier"
                       "jonathan.brielmaier@web.de"
                       "jonsger")
@@ -1072,7 +1111,7 @@ the \"texlive\" importer."
 (define-member (person "Andreas Enge"
                       "andreas@enge.fr"
                       "enge")
-  bootstrap core-packages lxqt science tex)
+  bootstrap core-packages crypto lxqt science tex)

 (define-member (person "Tanguy Le Carrour"
                       "tanguy@bioneland.org"
@@ -1102,7 +1141,7 @@ the \"texlive\" importer."
 (define-member (person "jgart"
                       "jgart@dismail.de"
                       "jgart")
-  lisp mentors)
+  hare lisp mentors)

 (define-member (person "Guillaume Le Vaillant"
                       "glv@posteo.net"
@@ -1137,7 +1176,7 @@ the \"texlive\" importer."
 (define-member (person "Ricardo Wurmus"
                       "rekado@elephly.net"
                       "rekado")
-  r sugar)
+  bioinformatics r sugar)

 (define-member (person "Christopher Baines"
                       "guix@cbaines.net"
@@ -1237,9 +1276,9 @@ the \"texlive\" importer."
  games)

 (define-member (person "Laurent Gatto"
-                       "laurent.gatto@gmail.com"
+                       "lgatto@protonmail.ch"
                       "lgatto")
-  r)
+  r bioinformatics)

 (define-member (person "Nicolas Goaziou"
                       "guix@nicolasgoaziou.fr"
@@ -1279,7 +1318,7 @@ the \"texlive\" importer."
 (define-member (person "Cayetano Santos"
                       "csantosb@inventati.org"
                       "csantosb")
-  ai emacs electronics hpc)
+  ai emacs electronics hpc crypto)

 (define-member (person "Greg Hogan"
                       "code@greghogan.com"
@@ -1288,8 +1327,7 @@ the \"texlive\" importer."

 (define-member (person "Hilton Chain"
                       "hako@ultrarare.space"
-                       "hako")
-  emacs home localization mozilla rust zig)
+                       "hako"))

 (define-member (person "Noé Lopez"
                       "noelopez@free.fr"
@@ -1326,9 +1364,9 @@ the \"texlive\" importer."
  hurd)

 (define-member (person "Giacomo Leidi"
-                       "goodoldpaul@autistici.org"
+                       "therewasa@fishinthecalculator.me"
                       "fishinthecalculator")
-  audio)
+  audio beam)

 (define-member (person "Saku Laesvuori"
                       "saku@laesvuori.fi"
@@ -1353,13 +1391,33 @@ the \"texlive\" importer."
 (define-member (person "Danny Milosavljevic"
                       "dannym@friendly-machines.com"
                       "daym")
-  bootstrap hpc rust science)
+  bootstrap hpc python rust science)

 (define-member (person "Andy Tai"
                       "atai@atai.org"
                       "atai")
  ai)

+(define-member (person "Pierre-Henry Fröhring"
+                       "contact@phfrohring.com"
+                       "phfrohring")
+  beam)
+
+(define-member (person "Igorj Gorjaĉev"
+                       "igor@goryachev.org"
+                       "delitrem")
+  beam)
+
+(define-member (person "Nguyễn Gia Phong"
+                       "cnx@loang.net"
+                       "cnx")
+  python)
+
+(define-member (person "Lilah Tascheter"
+                       "lilah@lunabee.space"
+                       "tinystar")
+  hare)
+

 (define (find-team name)
  (or (hash-ref %teams (string->symbol name))
@@ -0,0 +1,60 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest of packages built using the mix-build-system.
+;;; It is used to assist continuous integration of the beam-team branch.
+;;;
+;;;
+;;; You can use it to build all covered packages with:
+;;;
+;;;  ./pre-inst-env guix build -m etc/teams/beam/elixir-manifest.scm
+;;;
+;;; or to update them with:
+;;;
+;;;  ./pre-inst-env guix refresh -u -m etc/teams/beam/elixir-manifest.scm
+
+(use-modules (guix packages)
+             (guix profiles)
+             (guix gexp)
+             (guix build-system)
+             (ice-9 match)
+             (srfi srfi-1)
+             (srfi srfi-26))
+
+(define* (has-mix-build-system? build-system #:key modules #:allow-other-keys)
+  (or (eq? (build-system-name build-system) 'mix)
+      (any
+       (match-lambda
+         (('guix 'build 'mix-build-system) #t)
+         ('((guix build mix-build-system) . _) #t)
+         (_ #f))
+       (cond
+        ((gexp? modules) (gexp->approximate-sexp modules))
+        ((pair? modules) modules)
+        (else '())))))
+
+(manifest
+  (map package->manifest-entry
+       (fold-packages
+        (lambda (package lst)
+          (if (apply has-mix-build-system?
+                     (package-build-system package)
+                     (package-arguments package))
+              (cons package lst)
+              lst))
+        (list))))
@@ -0,0 +1,60 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest of packages built using the rebar-build-system.
+;;; It is used to assist continuous integration of the beam-team branch.
+;;;
+;;;
+;;; You can use it to build all covered packages with:
+;;;
+;;;  ./pre-inst-env guix build -m etc/teams/beam/erlang-manifest.scm
+;;;
+;;; or to update them with:
+;;;
+;;;  ./pre-inst-env guix refresh -u -m etc/teams/beam/erlang-manifest.scm
+
+(use-modules (guix packages)
+             (guix profiles)
+             (guix gexp)
+             (guix build-system)
+             (ice-9 match)
+             (srfi srfi-1)
+             (srfi srfi-26))
+
+(define* (has-rebar-build-system? build-system #:key modules #:allow-other-keys)
+  (or (eq? (build-system-name build-system) 'rebar)
+      (any
+       (match-lambda
+         (('guix 'build 'rebar-build-system) #t)
+         ('((guix build rebar-build-system) . _) #t)
+         (_ #f))
+       (cond
+        ((gexp? modules) (gexp->approximate-sexp modules))
+        ((pair? modules) modules)
+        (else '())))))
+
+(manifest
+  (map package->manifest-entry
+       (fold-packages
+        (lambda (package lst)
+          (if (apply has-rebar-build-system?
+                     (package-build-system package)
+                     (package-arguments package))
+              (cons package lst)
+              lst))
+        (list))))
@@ -52,7 +52,8 @@
 tools/versions-stable")))

 (define (fetch-releng-content)
-  "Return an input port to the %GNOME-RELENG-VERSIONS-URI file."
+  "Return a string corresponding to the content of the %GNOME-RELENG-VERSIONS-URI
+file."
  (call-with-port (http-fetch/cached (%gnome-releng-versions-uri))
    get-string-all))

@@ -75,8 +76,8 @@ NL < '\n'")
  '(("adwaita-fonts" . "font-adwaita")))

 (define (parse-releng data)
-  "Return DATA, a string representing the content of a GNOME releng file, and
-return the complete parse tree."
+  "Return the complete parse tree for DATA, a string representing the content of
+a GNOME releng file."
  (let ((tree (peg:tree (match-pattern releng data))))
    (match tree
      (#f (raise-exception (make-releng-parser-error)))
@@ -0,0 +1,34 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest of packages built using the hare-build-system.
+;;; It is used to assist continuous integration of the hare-team branch.
+
+(use-modules (guix packages)
+             (guix profiles)
+             (guix build-system))
+
+(manifest
+  (map package->manifest-entry
+       (fold-packages
+         (lambda (package lst)
+           (if (or (eq? 'hare (build-system-name (package-build-system package)))
+                   (string=? "hare" (package-name package)))
+               (cons package lst)
+             lst))
+         '())))
@@ -0,0 +1,40 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest of packages built using any one of the 
+;;; asdf build systems. It is used to assist continuous integration of 
+;;; the lisp-team branch.
+
+(use-modules (guix packages)
+             (guix profiles)
+             (guix build-system))
+
+(manifest
+ (map package->manifest-entry
+      (fold-packages
+       (lambda (package lst)
+         (if (or (eq? 'asdf/sbcl (build-system-name (package-build-system package)))
+                 (eq? 'asdf/ecl (build-system-name (package-build-system package)))
+                 (eq? 'asdf/clasp (build-system-name (package-build-system package)))
+                 (string=? "clasp-cl" (package-name package))
+                 (string=? "ecl" (package-name package))
+                 (string=? "sbcl" (package-name package)))
+             (cons package lst)
+             lst))
+       '())))
+
@@ -0,0 +1,35 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 jgart <jgart@dismail.de>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This file returns a manifest of packages built using the python-build-system.
+;;; It is used to assist continuous integration of the python-team branch.
+
+(use-modules (guix packages)
+             (guix profiles)
+             (guix build-system))
+
+(manifest
+  (map package->manifest-entry
+       (fold-packages
+         (lambda (package lst)
+           (if (or (eq? 'python (build-system-name (package-build-system package)))
+                   (eq? 'pyproject (build-system-name (package-build-system package)))
+                   (string=? "python" (package-name package)))
+               (cons package lst)
+             lst))
+         '())))
@@ -0,0 +1,412 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; This manifest returns build artfacts for all supported systems.  This can be
+;;; controlled by SUPPORTED_SYSTEMS environment variable.  For the list of
+;;; artifacts produced, see artifacts-for-system and the `<thing>-for-system?`
+;;; procedures.  NOTE: the --system argument does not change the system for which
+;;; the resulting package is built. They return different definitions of the
+;;; images. To change the system, pass different SUPPORTED_SYSTEMS.
+
+(use-modules (gnu compression)
+             (gnu image)
+             (gnu packages graphviz)
+             (gnu packages imagemagick)
+             (gnu packages package-management)
+             (gnu packages perl)
+             (gnu services)
+             (gnu system image)
+             (gnu system install)
+             (gnu system)
+             (guix build-system gnu)
+             (guix build-system trivial)
+             (guix channels)
+             (guix gexp)
+             (guix git)
+             (guix grafts)
+             (guix memoization)
+             (guix monads)
+             (guix packages)
+             (guix profiles)
+             (guix records)
+             (guix scripts pack)
+             (guix store)
+             (guix ui)
+             (guix utils)
+             (ice-9 format)
+             (ice-9 match)
+             (srfi srfi-9)
+             (srfi srfi-26)
+             (srfi srfi-35))
+
+;; For easier testing, use (snapshot) guix package from (gnu packages
+;; package-management). Otherwise, the package is updated to current commit and
+;; might not be substitutable, leading to longer build times.
+(define %use-snapshot-package?
+  (string=? (or (getenv "GUIX_USE_SNAPSHOT_PACKAGE") "no") "yes"))
+
+(define (%guix-version)
+  ;; NOTE: while package-version guix is not correct in general,
+  ;; it is correct for the release itself. At that time, the
+  ;; guix package is updated to vX.Y.Z and it's the version
+  ;; we want to use.
+  (package-version guix))
+
+(define (%vm-image-path)
+  (search-path %load-path "gnu/system/examples/vm-image.tmpl"))
+
+(define (%vm-image-efi-path)
+  (search-path %load-path "gnu/system/examples/vm-image-efi.tmpl"))
+
+;; monadic record and gexp-compiler
+;; taken from Inria
+;; https://gitlab.inria.fr/numpex-pc5/wp3/guix-images/-/blob/17bf4585abc2d637faa5d339436e778b7c9fb1ce/modules/guix-hpc/packs.scm
+
+;; XXX: The <monadic> hack below will hopefully become unnecessary once the
+;; (guix scripts pack) interface switches to declarative style--i.e.,
+;; file-like objects.
+
+(define-record-type <monadic>
+  (monadic->declarative mvalue)
+  monadic?
+  (mvalue monadic-value))
+
+(define-gexp-compiler (monadic-compiler (monadic <monadic>) system target)
+  (monadic-value monadic))
+
+;; The tarball should be the same for every system.
+;; Still, we need to decide what system to build it
+;; for, so use the one that CI has most resources for.
+(define (source-tarball-for-system? system)
+  (member system
+        '("x86_64-linux")))
+
+(define (iso-for-system? system)
+  (member system
+        '("x86_64-linux" "i686-linux" "aarch64-linux")))
+
+(define (qcow2-for-system? system)
+  (member system
+        '("x86_64-linux" "aarch64-linux")))
+
+(define* (qcow2-gpt-for-system? system)
+  (string=? system "aarch64-linux"))
+
+(define (copy-/etc/config.scm config)
+  "Copy the configuration.scm of the operating system to /etc/config.scm, for
+user's convenience. The file has to be writable, not a link to the store, so
+etc-service-type can't be used here. CONFIG is a pair of strings, (FROM . TO).
+The config will be copied from FROM to TO."
+  (match config
+    ((from . to)
+     (with-imported-modules '((guix build utils))
+       #~(begin
+           (use-modules (guix build utils))
+           (when (not (file-exists? #$to))
+             (copy-file #$from #$to)
+             (make-file-writable #$to)))))
+    (_ (raise
+        (formatted-message-string
+         (G_ "unexpected config parameter, should be pair of strings: ~a"
+             config))))))
+
+(define copy-/etc/config.scm-service-type
+  (service-type (name 'copy-/etc/config.scm)
+                (description
+                 "Copy the system configuration file to /etc/config.scm.")
+                (extensions (list (service-extension activation-service-type
+                                                     copy-/etc/config.scm)))
+                (default-value (cons "/run/current-system/configuration.scm"
+                                     "/etc/config.scm"))))
+
+(define (operating-system-with-/etc/config.scm os)
+  "Copy the system configuration file to writable /etc/config.scm on first boot."
+  (operating-system
+    (inherit os)
+    (services (cons (service copy-/etc/config.scm-service-type)
+                    (operating-system-user-services os)))))
+
+(define (simple-provenance-entry config-file)
+  "Return system entries describing the operating system config, provided
+through CONFIG-FILE."
+  (mbegin %store-monad
+    (return `(("configuration.scm"
+               ,(local-file (assume-valid-file-name config-file)
+                            "configuration.scm"))))))
+
+;; This is mostly taken from provenance-service-type from (gnu services),
+;; but it provides only configuration.scm, not channels.scm. This is
+;; to get the same derivations for both Cuirass and local builds.
+;; In the future, provenance-service-type could be adapted to support
+;; this use case as well.
+(define simple-provenance-service-type
+  (service-type (name 'provenance)
+                (extensions
+                 (list (service-extension system-service-type
+                                          simple-provenance-entry)))
+                (default-value #f)                ;the OS config file
+                (description
+                 "Store configuration.scm of the system in the system
+itself.")))
+
+(define* (operating-system-with-simple-provenance
+          os
+          #:optional
+          (config-file
+           (operating-system-configuration-file
+            os)))
+  "Return a variant of OS that stores its CONFIG-FILE.  This is similar to
+`operating-system-with-provenance`, but it does copy only the
+configuration.scm."
+  (operating-system
+    (inherit os)
+    (services (cons (service simple-provenance-service-type config-file)
+                    (operating-system-user-services os)))))
+
+(define (guix-package-commit guix)
+  ;; Extract the commit of the GUIX package.
+  (match (package-source guix)
+    ((? channel? source)
+     (channel-commit source))
+    (_
+     (apply (lambda* (#:key commit #:allow-other-keys) commit)
+            (package-arguments guix)))))
+
+;; NOTE: Normally, we would use (current-guix), along with url
+;; overriden to the upstream repository to not leak our local checkout.
+;; But currently, the (current-guix) derivation has to be computed through
+;; QEMU for systems other than your host system. This takes a lot of time,
+;; it takes at least half an hour to get the derivations.
+(define (guix-package/with-commit guix commit)
+  "Use the guix from (gnu packages package-management),
+but override its commit to the specified version. Make sure
+to also override the channel commit to have the correct
+provenance."
+  (let ((scm-version (car (string-split (package-version guix) #\-))))
+    (package
+      (inherit guix)
+      (version (string-append scm-version "." (string-take commit 7)))
+      (source (git-checkout
+                (url (channel-url %default-guix-channel))
+                (commit commit)))
+      (arguments
+       (substitute-keyword-arguments (package-arguments guix)
+         ((#:configure-flags flags '())
+          #~(cons*
+             (string-append "--with-channel-commit=" #$commit)
+             (filter (lambda (flag)
+                       (not (string-prefix? "--with-channel-commit=" flag)))
+                     #$flags))))))))
+
+(define guix-for-images
+  (mlambda (system)
+    (cond
+     ;; For testing purposes, use the guix package directly.
+     (%use-snapshot-package? guix)
+     ;; Normally, update the guix package to current commit.
+     (else
+      (guix-package/with-commit guix (guix-package-commit (current-guix)))))))
+
+(define %binary-tarball-compression "xz")
+
+;; Like guix pack -C xz -s --localstatedir --profile-name=current-guix guix
+(define* (binary-tarball-for-system system #:key (extra-packages '()))
+  (let* ((base-name (string-append "guix-binary-" (%guix-version) "." system))
+         (manifest (packages->manifest (cons* guix extra-packages)))
+         (profile (profile (content manifest)))
+         (inputs `(("profile" ,profile)))
+         (compression %binary-tarball-compression))
+    (manifest-entry
+      (name (string-append base-name ".tar." compression))
+      (version (%guix-version))
+      (item (monadic->declarative
+             (self-contained-tarball
+              base-name profile
+              #:profile-name "current-guix"
+              #:compressor (lookup-compressor compression)
+              #:localstatedir? #t))))))
+
+;; Like guix system image -t iso9660 \
+;; --label="GUIX_$${system}_$(VERSION)" gnu/system/install.scm
+(define* (iso-for-system system)
+  (let* ((name (string-append
+                "guix-system-install-" (%guix-version) "." system ".iso"))
+         (base-os (make-installation-os
+                   #:grub-displayed-version (%guix-version)
+                   #:efi-only? (string=? system "aarch64-linux")))
+         (base-image (os->image base-os #:type iso-image-type))
+         (label (string-append "GUIX_" system "_"
+                               (if (> (string-length (%guix-version)) 7)
+                                   (string-take (%guix-version) 7)
+                                   (%guix-version)))))
+    (manifest-entry
+     (name name)
+     (version (%guix-version))
+     (item (system-image
+            (image-with-label
+             (image
+               (inherit base-image)
+               (name (string->symbol name)))
+             label))))))
+
+;; Like guix system image -t qcow2 gnu/system/examples/vm-image.tmpl
+(define* (qcow2-for-system system)
+  (let* ((name (string-append
+                "guix-system-vm-image-" (%guix-version) "." system ".qcow2"))
+         (base-os-path
+          (if (qcow2-gpt-for-system? system)
+              (%vm-image-efi-path)
+              (%vm-image-path)))
+         (target-image-type
+          (if (qcow2-gpt-for-system? system)
+              qcow2-gpt-image-type
+              qcow2-image-type))
+         (base-os
+          (operating-system-with-/etc/config.scm
+           (operating-system-with-simple-provenance
+            (load base-os-path) base-os-path)))
+         (base-image (os->image base-os #:type target-image-type)))
+    (manifest-entry
+     (name name)
+     (version (%guix-version))
+     (item (system-image
+             (image
+               (inherit base-image)
+               (volatile-root? #f)
+               (name (string->symbol name))))))))
+
+(define* (guix-source-tarball)
+  (let ((guix (package
+                (inherit guix)
+                (native-inputs
+                 (modify-inputs (package-native-inputs guix)
+                   ;; graphviz-minimal -> graphviz
+                   (replace "graphviz" graphviz)
+                   (append imagemagick)
+                   (append perl))))))
+    (manifest-entry
+      (name (string-append "guix-" (%guix-version) ".tar.gz"))
+      (version (package-version guix))
+      (item (dist-package
+             guix
+             ;; Guix is built from git source, not from tarball.
+             ;; So it's fine to use its source directly.
+             (package-source guix))))))
+
+(define* (manifest-entry-with-parameters system entry
+                                         #:key
+                                         (guix-for-images-proc guix-for-images))
+  (manifest-entry
+    (inherit entry)
+    (item
+     (with-parameters
+         ((%current-system system)
+          (%current-target-system #f)
+          (current-guix-package (guix-for-images-proc system)))
+       (manifest-entry-item entry)))))
+
+(define* (manifest-with-parameters system manifest
+                                   #:key
+                                   (guix-for-images-proc guix-for-images))
+  "Returns entries in the manifest accompanied with %current-system,
+%current-target-sytem and current-guix-package parameters."
+  (make-manifest
+   (map (cut manifest-entry-with-parameters system <>
+             #:guix-for-images-proc guix-for-images-proc)
+        (manifest-entries manifest))))
+
+(define (artifacts-for-system/nonparameterized system)
+  "Get all artifacts for given system.  This will always include the
+guix-binary tarball and optionally iso and/or qcow2 images."
+  (manifest
+   (append
+    (list
+     (binary-tarball-for-system system))
+    ;; TODO: After source tarball generation is ready, uncomment.
+    ;; (if (source-tarball-for-system? system)
+    ;;     (list (guix-source-tarball))
+    ;;     '())
+    (if (iso-for-system? system)
+        (list (iso-for-system system))
+        '())
+    (if (qcow2-for-system? system)
+        (list (qcow2-for-system system))
+        '()))))
+
+(define* (artifacts-for-system system
+                               #:key
+                               (guix-for-images-proc guix-for-images))
+  "Collects all artifacts for a system.  Gives them the proper %current-system
+and %current-target-system parameters, so the --system passed on CLI is
+irrelevant."
+  ;; NOTE: parameterizing current system, because the tarball seems to somehow
+  ;; depend on it early on. I haven't investigated it, but seems like a bug. Could
+  ;; it be the gexp->derivation + monadic->declarative, not passing down the
+  ;; system?  Symptom: guix build --system=x86_64 -m artifacts-manifest.scm and
+  ;; guix build --system=i686-linux -m artifacts-manifest.scm gives out different
+  ;; results without the parameterization.
+  (parameterize
+      ((%current-system system)
+       (%current-target-system #f)
+       (current-guix-package (guix-for-images-proc system)))
+    (manifest-with-parameters
+     system
+     (artifacts-for-system/nonparameterized system)
+     #:guix-for-images-proc guix-for-images-proc)))
+
+(define (manifest->union manifest)
+  "Makes a union that will be a folder with all the entries symlinked.  This
+is different from a profile as it expects the entries are just simple files
+and symlinks them by their manifest-entry-name."
+  (let ((entries (manifest-entries manifest)))
+    (computed-file
+     "artifacts-union"
+     (with-imported-modules '((guix build union)
+                              (guix build utils))
+       #~(begin
+           (use-modules (guix build utils))
+
+           (mkdir-p #$output)
+
+           (for-each
+            (lambda* (entry)
+              (symlink (cdr entry)
+                       (string-append #$output "/" (car entry))))
+            (list #$@(map (lambda (entry)
+                            #~(cons
+                               #$(manifest-entry-name entry)
+                               #$(manifest-entry-item entry)))
+                          entries))))))))
+
+(define %supported-systems
+  (or (and
+       (getenv "SUPPORTED_SYSTEMS")
+       (string-split (getenv "SUPPORTED_SYSTEMS") #\ ))
+      '("x86_64-linux" "i686-linux"
+        "armhf-linux" "aarch64-linux"
+        "powerpc64le-linux" "riscv64-linux")))
+
+(define supported-systems-union-manifest
+  (concatenate-manifests
+   (map artifacts-for-system
+        %supported-systems)))
+
+(when %use-snapshot-package?
+  (warning (G_ "building images using the 'guix' package (snapshot)~%")))
+(info (G_ "producing artifacts for the following systems: ~a~%")
+          %supported-systems)
+supported-systems-union-manifest
@@ -0,0 +1,26 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; Produce a single directory with all the artifacts inside of it, with proper
+;;; names. They can then be easily copied to releasedir in Makefile. The files are
+;;; symlinked to save space, but they should be copied out of the store as regular
+;;; files.
+
+(load "artifacts-manifest.scm")
+
+(manifest->union
+ supported-systems-union-manifest)
@@ -0,0 +1,94 @@
+;;; GNU Guix --- Functional package management for GNU
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(use-modules (guix packages)
+             (guix gexp)
+             (gnu services)
+             (gnu tests install)
+             (ice-9 match)
+             (guix utils)
+             (srfi srfi-26)
+             (srfi srfi-1))
+
+;; TODO find a better way to check for thunked fields
+(define* (thunked-field? field obj)
+  (and
+   (procedure? obj)
+   (eq?
+    (car (procedure-minimum-arity obj))
+    1)
+   ; Uhhh
+   (string-suffix? "(x)>"
+                   (format #f "~a" obj))))
+
+;; Prints names of all packages, prepending the service they
+;; come from.
+(define* (print-all-packages obj #:optional (pred package?))
+  (match obj
+    ((? pred)
+     (format #t "\"~a\"~%" (package-name obj))
+     (list obj))
+    ((? gexp?)
+     (list))
+    ((a . b)
+     (append (print-all-packages a pred)
+           (print-all-packages b pred)))
+    ((_ ...)
+     (apply append
+            (map (cut print-all-packages <> pred)
+                 obj)))
+    (#(_ ...)
+     (print-all-packages (vector->list obj) proc))
+    ((or (? service-type?)
+         (? origin?))
+     (list))
+    ((? record?)
+      (let* ((record-type (record-type-descriptor obj))
+             (record-fields (record-type-fields record-type)))
+        (when (service? obj)
+          (format #t ";; ~a-service~%" (service-type-name (service-kind obj))))
+        (apply append
+               (map (lambda (field)
+                      (let* ((accessor (record-accessor record-type field))
+                             (field-obj (accessor obj)))
+                        (if (thunked-field? field field-obj)
+                            (print-all-packages (field-obj obj) pred)
+                            (print-all-packages field-obj pred))))
+                    record-fields))))
+    ((? parameter?)
+     (list))
+    (_
+     (list))))
+
+(define full-installer-os
+  ((@@ (gnu tests install) installation-target-desktop-os-for-gui-tests)))
+
+(define minimal-installer-os
+  ((@@ (gnu tests install) installation-target-os-for-gui-tests)))
+
+(display "Full os packages:")
+(print-all-packages full-installer-os)
+(display "Minimal os packages:")
+(print-all-packages minimal-installer-os)
+
+;; Note that the printed packages will contain duplicates.
+;; I recommend to first put packages out of the profile service
+;; and out of packages field (they will be above service packages)
+;; at the bottom of the list and then filtering only unique lines, ie.
+;; with `awk '!a[$0]++'`. And lastly removing services that no longer
+;; have packages and also the packages that are already in minimal manifest
+;; (in case of desktop manifest)
@@ -65,6 +65,7 @@
            grub-efi-bootloader
            grub-efi-removable-bootloader
            grub-efi32-bootloader
+            grub-efi32-removable-bootloader
            grub-efi-netboot-bootloader
            grub-efi-netboot-removable-bootloader
            grub-mkrescue-bootloader
@@ -844,6 +845,13 @@ symlink to the store is not needed in this case."
   (name 'grub-efi32)
   (package grub-efi32)))

+(define grub-efi32-removable-bootloader
+  (bootloader
+   (inherit grub-efi32-bootloader)
+   (name 'grub-efi32-removable-bootloader)
+   (installer (make-grub-efi-installer #:removable? #t
+                                       #:efi32? #t))))
+
 (define (make-grub-efi-netboot-bootloader name subdir)
  (bootloader
   (name name)
@@ -359,7 +359,7 @@ to it atomically and set the appropriate permissions."
  (left    unused-subid-range-left   ;previous unused subuid range or #f
           (default #f))
  (min     unused-subid-range-min    ;lower bound of this unused subuid range
-           (default %subordinate-id-min))
+           (default 0))
  (max     unused-subid-range-max    ;upper bound
           (default %subordinate-id-max))
  (right   unused-subid-range-right  ;next unused subuid range or #f
@@ -555,7 +555,10 @@ will be marked as used in it."
  (define actual-range
    (subid-range
     (inherit range)
-     (start allocation-start)))
+     ;; New IDs are only allocated between %subordinate-id-min and
+     ;; %subordinate-id-max.
+     (start
+      (max allocation-start %subordinate-id-min))))

  (if (within-interval? allocation actual-range)
      (values
@@ -603,13 +606,6 @@ is visited to find the best unused range that can hold RANGE."
  (define range-end
    (subid-range-end range))

-  (unless (and (subordinate-id? range-start)
-               (subordinate-id? range-end))
-    (raise
-     (condition
-      (&invalid-subid-range-error
-       (range range)))))
-
  (define less?
    (< range-end allocation-start))
  (define more?
@@ -802,12 +798,23 @@ new UIDs."
 (define* (allocate-subids ranges #:optional (current-ranges '()))
  "Return a list of subids entries for RANGES, a list of <subid-range>.  IDs
 found in CURRENT-RANGES, a list of subid entries, are reused."
+  ;; Ranges from disk must always have a start.
  (let ((generic (any (compose not subid-range-has-start?) current-ranges)))
    (when generic
      (raise
       (condition
        (&specific-subid-range-expected-error
         (range generic))))))
+  (for-each
+   (lambda (range)
+     ;; New ranges must always be included in the current supported set.
+     (unless (or (not (subid-range-has-start? range))
+                 (and (subordinate-id? (subid-range-start range))
+                      (subordinate-id? (subid-range-end range))))
+       (raise
+        (condition (&invalid-subid-range-error (range range))))))
+   ranges)
+
  (define sorted-ranges
    (stable-sort ranges
                 subid-range-less))
@@ -11,6 +11,7 @@
 ;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -278,6 +279,17 @@ they already exist."

  (for-each ensure-user-home users))

+(define* (canonicalize-path* file)
+  "A safe version of `canonicalize-path' that warns rather than raises on errors.
+`canonicalize-path' uses `realpath(2)', which can return various errors like
+EINVAL, ELOOP, etc."
+  (or (false-if-exception (canonicalize-path file))
+      (begin
+        (format (current-warning-port)
+                "warning: could not canonicalize file `~a'; using as-is~%"
+                file)
+        file)))
+
 (define (activate-etc etc)
  "Install ETC, a directory in the store, as the source of static files for
 /etc."
@@ -300,26 +312,28 @@ they already exist."
  (rm-f "/etc/ssl")
  (symlink "/run/current-system/profile/etc/ssl" "/etc/ssl")

-  (rm-f "/etc/static")
-  (symlink etc "/etc/static")
  (for-each (lambda (file)
              (let ((target (string-append "/etc/" file))
-                    (source (string-append "/etc/static/" file)))
+                    ;; Canonicalize the file names to resolve any symlinks, to
+                    ;; ensure /etc/localtime points to a timezone data file in
+                    ;; the store containing the timezone name.  This is done
+                    ;; for compatibility with software expecting this systemd
+                    ;; convention to be followed.
+                    (source (canonicalize-path* (string-append etc "/" file))))
                (rm-f target)
-
-                ;; Things such as /etc/sudoers must be regular files, not
-                ;; symlinks; furthermore, they could be modified behind our
-                ;; back---e.g., with 'visudo'.  Thus, make a copy instead of
-                ;; symlinking them.
-                (if (file-is-directory? source)
-                    (symlink source target)
-                    (copy-file source target))
-
-                ;; XXX: Dirty hack to meet sudo's expectations.
-                (when (string=? (basename target) "sudoers")
-                  (chmod target #o440))))
+                (cond ((string=? (basename target) "sudoers")
+                       (begin
+                         ;; /etc/sudoers must be a regular file.
+                         (copy-file source target)
+                         ;; XXX: dirty hack to meet sudo's expectations
+                         (chmod target #o440)))
+                      ((string=? (basename target) "hosts")
+                       ;; /etc/hosts must be a regular file, as some software
+                       ;; like vpn-slice expect to be able to write to it.
+                       (copy-file source target))
+                      (else             ;usual case
+                       (symlink source target)))))
            (scandir etc (negate dot-or-dot-dot?)
-
                     ;; The default is 'string-locale<?', but we don't have
                     ;; it when run from the initrd's statically-linked
                     ;; Guile.
@@ -91,7 +91,7 @@ each retry."
              ((sleep*) delay)            ;else wait and retry
              (loop (+ 1 attempts)))
            (error "maximum number of retry attempts reached"
-                   (quote body ...) args))))))
+                   (quote (begin body ...)) args))))))


 ;;;
@@ -1,12 +1,12 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013-2020, 2025 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 Christine Lemmer-Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020, 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2022 Pavel Shlyak <p.shlyak@pantherx.org>
-;;; Copyright © 2022 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
+;;; Copyright © 2022, 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2023 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -66,12 +66,14 @@
  (number->string
   (inexact->exact (ceiling (/ size 1024)))))

-(define (estimate-partition-size root)
+(define* (estimate-partition-size root #:optional (margin .25))
  "Given the ROOT directory, evaluate and return its size.  As this doesn't
-take the partition metadata size into account, take a 25% margin.  As this in
+take the partition metadata size into account, take a MARGIN.  As this in
 turn doesn't take any constant overhead into account, force a 1-MiB minimum."
  (max (ash 1 20)
-       (* 1.25 (file-size root))))
+       ;; without inexact->exact, 'guess can result in an error like that:
+       ;; "Wrong type (expecting exact integer): 7179941140.0".
+       (inexact->exact (round (* (+ 1. margin) (file-size root))))))

 (define* (make-btrfs-image partition target root)
  "Handle the creation of BTRFS partition images. See
@@ -116,7 +118,43 @@ turn doesn't take any constant overhead into account, force a 1-MiB minimum."
                      (size-in-kib
                       (if (eq? size 'guess)
                           (estimate-partition-size root)
-                           size)))))))
+                           size)))))
+
+    ;; 'mke2fs' does not create directory indexes by default, meaning that
+    ;; directories have a limit of 65,000 sub-directories, which can be
+    ;; problematic for the store.  To avoid that, run 'e2fsck -D' to create
+    ;; those directory indexes.  See
+    ;; <https://github.com/tytso/e2fsprogs/issues/257>.
+    (invoke "e2fsck" "-fDy" target)))
+
+(define* (make-f2fs-image partition target root
+                          #:key
+                          (owner-uid 0)
+                          (owner-gid 0))
+  "Handle the creation of F2FS partition images.  See 'make-partition-image'."
+  (let ((size (partition-size partition))
+        (label (partition-label partition))
+        (uuid (partition-uuid partition))
+        (fs-options (partition-file-system-options partition)))
+    ;; The mkfs.f2fs utility can't create files, so we need to create one
+    ;; before running it.
+    (call-with-output-file target (const #t))
+    (truncate-file
+     target
+     (if (eq? size 'guess)
+         ;; The F2FS filesystem has more overhead than other filesystems like
+         ;; BTRFS and ext4.
+         (estimate-partition-size root .50)
+         size))
+    (apply invoke "fakeroot" "mkfs.f2fs"
+           "-l" label
+           "-R" (format #f "~a:~a" owner-uid owner-gid)
+           `(,@(if uuid
+                   `("-U" ,(uuid->string uuid))
+                   '())
+             ,@fs-options
+             ,target))
+    (invoke "fakeroot" "sload.f2fs" "-P" "-f" root target)))

 (define* (make-vfat-image partition target root fs-bits)
  "Handle the creation of VFAT partition images.  See 'make-partition-image'."
@@ -144,6 +182,23 @@ turn doesn't take any constant overhead into account, force a 1-MiB minimum."
                          (string-append "::" file))))
              (scandir root))))

+(define* (make-swap-image partition target)
+  "Make a swap partition of a certain size."
+  (let ((size (partition-size partition))
+        (label (partition-label partition))
+        (uuid (partition-uuid partition))
+        (fs-options (partition-file-system-options partition)))
+    (apply invoke "fakeroot" "mkswap"
+           "--pagesize" "4096"
+           "--endianness" "little"
+           "-L" label
+           "--file" target
+           "--size" (number->string size)
+           `(,@(if uuid
+                   `("-U" ,(uuid->string uuid))
+                   '())
+             ,@fs-options))))
+
 (define* (make-unformatted-image partition target)
  "Make an unformatted partition of a certain size."
  (let ((size (partition-size partition)))
@@ -162,10 +217,14 @@ ROOT directory to populate the image."
      (make-btrfs-image partition target root))
     ((string-prefix? "ext" type)
      (make-ext-image partition target root))
+     ((string=? "f2fs" type)
+      (make-f2fs-image partition target root))
     ((or (string=? type "vfat") (string=? type "fat16"))
      (make-vfat-image partition target root 16))
     ((string=? type "fat32")
      (make-vfat-image partition target root 32))
+     ((string=? "swap" type)
+      (make-swap-image partition target))
     ((string=? type "unformatted")
      (make-unformatted-image partition target))
     (else
@@ -369,7 +428,11 @@ GRUB configuration and OS-DRV as the stuff in it."
                   "-not" "-wholename" "/System/*"
                   "-not" "-name" "unicode.pf2"
                   "-not" "-name" "bzImage"
-                   "-not" "-name" "*.gz"   ; initrd & all man pages
+                   "-not" "-name" "zImage"
+                   "-not" "-name" "Image"
+                   "-not" "-name" "vmlinuz"
+                   "-not" "-name" "*.gz"   ; initrd
+                   "-not" "-name" "*.zst"  ; all man pages
                   "-not" "-name" "*.png"  ; includes grub-image.png
                   "-exec" "set_filter" "--zisofs"
                   "--")
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3,6 +3,7 @@
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2023 conses <contact@conses.eu>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2025 dan <i@dan.games>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,7 +26,7 @@
  #:use-module (gnu services configuration)
  #:use-module (gnu services xorg)
  #:autoload   (gnu packages glib)    (dbus)
-  #:autoload   (gnu packages xdisorg) (redshift unclutter)
+  #:autoload   (gnu packages xdisorg) (darkman redshift unclutter)
  #:autoload   (gnu packages xorg) (setxkbmap xmodmap)
  #:use-module (guix records)
  #:use-module (guix gexp)
@@ -46,7 +47,11 @@
            home-xmodmap-configuration
            home-xmodmap-service-type

-            home-startx-command-service-type))
+            home-startx-command-service-type
+
+            home-darkman-configuration
+            home-darkman-configuration?
+            home-darkman-service-type))


 ;;;
@@ -447,3 +452,93 @@ buttons under the Xorg display server via user-defined expressions.")))

 (define-service-type-mapping
  startx-command-service-type => home-startx-command-service-type)
+
+
+;;;
+;;; Darkman.
+;;;
+
+(define-maybe number)
+
+(define (serialize-number field value)
+  (string-append (match field
+                   ('latitude "lat")
+                   ('longitude "lng")
+                   (_ (symbol->string field)))
+                 ": " (number->string value) "\n"))
+
+(define (serialize-boolean field value)
+  (string-append (match field
+                   ('use-geoclue "usegeoclue")
+                   ('dbus-server "dbusserver")
+                   (_ "portal"))
+                 ": " (if value "true" "false") "\n"))
+
+(define-configuration home-darkman-configuration
+  (darkman
+   (file-like darkman)
+   "The @code{darkman} package to use.")
+
+  (latitude
+   maybe-number
+   "Latitude, used at startup or when @code{use-geoclue} is @code{#f}.  More than
+one decimal point is generally not needed.")
+
+  (longitude
+   maybe-number
+   "Longitude, used at startup or when @code{use-geoclue} is @code{#f}.  More than
+one decimal point is generally not needed.")
+
+  (use-geoclue
+   (boolean #f)
+   "Whether to use a local geoclue instance to determine the current location.
+Setting this to false without explicitly setting latitude and longtitude
+disables automatic transitions entirely.")
+
+  (dbus-server
+   (boolean #t)
+   "Whether to expose the current mode via darkman's own D-Bus API.")
+
+  (portal
+   (boolean #t)
+   "Whether to expose the current mode via the XDG settings portal D-Bus API."))
+
+(define (serialize-home-darkman-configuration config)
+  (mixed-text-file
+   "config.yaml"
+   (serialize-configuration config home-darkman-configuration-fields)))
+
+(define (home-darkman-configuration-files config)
+  `(("darkman/config.yaml" ,(serialize-home-darkman-configuration config))))
+
+(define (home-darkman-profile-service config)
+  (list (home-darkman-configuration-darkman config)))
+
+(define (home-darkman-shepherd-service config)
+  (list
+   (shepherd-service
+     (provision '(darkman))
+     (requirement '(dbus))
+     (modules '((shepherd support)))      ;for '%user-log-dir'
+     (start #~(make-forkexec-constructor
+               (list #$(file-append (home-darkman-configuration-darkman config)
+                                    "/bin/darkman")
+                     "run")
+               #:log-file
+               (string-append %user-log-dir "/darkman.log")))
+     (stop #~(make-kill-destructor)))))
+
+(define home-darkman-service-type
+  (service-type
+    (name 'home-darkman)
+    (extensions
+     (list (service-extension home-shepherd-service-type
+                              home-darkman-shepherd-service)
+           (service-extension home-xdg-configuration-files-service-type
+                              home-darkman-configuration-files)
+           (service-extension home-profile-service-type
+                              home-darkman-profile-service)))
+    (default-value (home-darkman-configuration))
+    (description "Run the @code{darkman} daemon, which will invoke scripts in
+$XDG_DATA_DIRS/dark-mode.d/ when sundown, and invoke scripts in
+$XDG_DATA_DIRS/light-mode.d/ when sunrise.")))
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2024 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2021 Andrew Tropin <andrew@trop.in>
 ;;; Copyright © 2021 Xinglu Chen <public@yoctocell.xyz>
-;;; Copyright © 2023 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2023 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2023 Andrew Patterson <andrewpatt7@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -0,0 +1,104 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify
+;;; it under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation, either version 3 of the License, or
+;;; (at your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful,
+;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+
+(define-module (gnu home services gnome)
+  #:use-module (guix gexp)
+  #:use-module (guix packages)
+  #:use-module (gnu packages admin)
+  #:use-module (gnu packages gnome)
+  #:use-module (gnu system accounts)
+  #:use-module (gnu services configuration)
+  #:use-module (gnu home services)
+  #:use-module (gnu home services shepherd)
+  #:export (gcr-ssh-agent-configuration
+            gcr-ssh-agent-configuration?
+            gcr-ssh-agent-configuration-fields
+            gcr-ssh-agent-configuration-package
+            gcr-ssh-agent-configuration-log-file
+
+            home-gcr-ssh-agent-log-file
+            home-gcr-ssh-agent-shepherd-service
+
+            home-gcr-ssh-agent-service-type))
+
+(define-maybe/no-serialization string)
+
+(define-configuration/no-serialization gcr-ssh-agent-configuration
+  (package
+   (package gcr)
+   "The @code{gcr} package to use.")
+  (log-file
+   (maybe-string)
+   "Where the service will write its logs.  If unset, it defaults to
+@file{$HOME/.local/state/shepherd/gcr-ssh-agent.log}."))
+
+(define (home-gcr-ssh-agent-log-file config)
+  (define maybe-log-file (gcr-ssh-agent-configuration-log-file config))
+  (if (maybe-value-set? maybe-log-file)
+      maybe-log-file
+      #~(string-append %user-log-dir "/gcr-ssh-agent.log")))
+
+(define (home-gcr-ssh-agent-shepherd-service config)
+  (let ((package
+          (gcr-ssh-agent-configuration-package config))
+        (log-file (home-gcr-ssh-agent-log-file config)))
+    (list
+     (shepherd-service
+       (provision '(gcr-ssh-agent ssh-agent))
+       (modules
+        ;;for '%user-log-dir' and '%user-runtime-dir'
+        '((shepherd support)))
+       (start
+        #~(let* ((socket-directory
+                  (string-append %user-runtime-dir
+                                 "/gcr"))
+                 (socket-endpoint
+                  (endpoint
+                   (make-socket-address
+                    AF_UNIX
+                    (string-append socket-directory "/ssh"))
+                   #:name "ssh"
+                   #:socket-directory-permissions #o700)))
+            (make-systemd-constructor
+             (list #$(file-append package
+                                  "/libexec/gcr-ssh-agent")
+                   "-d" socket-directory)
+             (list socket-endpoint)
+             ;; With #:lazy-start #t the first ssh connection
+             ;; hangs indefinitely.
+             #:lazy-start? #f
+             #:log-file #$log-file)))
+       (stop #~(make-systemd-destructor))))))
+
+(define (home-gcr-ssh-agent-environment-variables config)
+  `(("SSH_AUTH_SOCK" . "${XDG_RUNTIME_DIR}/gcr/ssh")))
+
+(define home-gcr-ssh-agent-service-type
+  (service-type
+   (name 'home-gcr-ssh-agent)
+   (extensions
+    (list (service-extension
+           home-shepherd-service-type
+           home-gcr-ssh-agent-shepherd-service)
+          (service-extension home-environment-variables-service-type
+                             home-gcr-ssh-agent-environment-variables)))
+   (default-value (gcr-ssh-agent-configuration))
+   (description
+    "Provides @code{gcr-ssh-agent} Shepherd service and installs
+@code{gcr} in the system profile.")))
@@ -23,6 +23,7 @@
  #:use-module (gnu packages freedesktop)
  #:use-module (gnu packages glib)
  #:use-module (gnu packages gnome)
+  #:use-module (gnu packages xorg)
  #:use-module (gnu packages wm)
  #:use-module (gnu services)
  #:use-module (gnu services shepherd)
@@ -71,7 +72,8 @@ environment variables set for a Wayland desktop session."
                                     niri
                                     xdg-desktop-portal
                                     xdg-desktop-portal-gnome
-                                     xdg-desktop-portal-gtk)))))
+                                     xdg-desktop-portal-gtk
+                                     xwayland-satellite)))))
   (description "Install and configure Niri, a scrollable tiling Wayland
 compositor.  This service starts Niri as a user-level desktop session with
 proper environment variables set for Wayland compatibility.  It ensures Niri
@@ -0,0 +1,221 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2025 Lilah Tascheter <lilah@lunabee.space>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu home services secrets)
+  #:use-module (gnu home services)
+  #:use-module (gnu home services shepherd)
+  #:use-module (gnu packages password-utils)
+  #:use-module (gnu services)
+  #:use-module (gnu services configuration)
+  #:use-module (gnu services shepherd)
+  #:use-module (guix gexp)
+  #:use-module (srfi srfi-1)
+  #:export (wrap-himitsu-prompter
+            home-himitsu-configuration
+            home-himitsu-service-type
+
+            home-himitsu-ssh-configuration
+            home-himitsu-ssh-service-type
+
+            home-himitsu-secret-service-configuration
+            home-himitsu-secret-service-type))
+
+;;
+;; himitsu
+;;
+
+(define (wrap-himitsu-prompter prompter)
+  "Wraps a prompter to autodetect DISPLAY and WAYLAND_DISPLAY, necessary since
+shepherd typically starts before a graphical session."
+  (program-file "himitsu-wrapped-prompter"
+    #~(begin (use-modules (ice-9 ftw) (ice-9 match) (srfi srfi-26))
+        (unless (or (getenv "DISPLAY") (getenv "WAYLAND_DISPLAY"))
+          (for-each (lambda (dir pat cont)
+                      (match (scandir dir (cut regexp-exec pat <>) string<?)
+                        ((file . _) (cont file)) (_ #f)))
+            (list "/tmp/.X11-unix" (or (getenv "XDG_RUNTIME_DIR")
+                                     (string-append "/run/user/" (getuid))))
+            (map make-regexp '("^X[0-9]+$" "^wayland-[0-9]+$"))
+            (list (lambda (f)
+                    (setenv "DISPLAY" (string-append ":" (string-drop f 1))))
+                  (cut setenv "WAYLAND_DISPLAY" <>))))
+        (apply execl #$prompter #$prompter (cdr (command-line))))))
+
+(define-maybe string (prefix himitsu-))
+
+(define (string-or-gexp? s)
+  (or (string? s) (gexp? s)))
+
+(define list-of-strings-or-gexps? (list-of string-or-gexp?))
+
+(define (himitsu-serialize-string label val)
+  #~(format #f "~a=~a~%" '#$label #$val))
+
+(define himitsu-serialize-file-like himitsu-serialize-string)
+
+(define (himitsu-serialize-list-of-strings-or-gexps label vals)
+  #~(string-join (list #$@vals) "\n" 'suffix))
+
+(define-configuration home-himitsu-configuration
+  (package (file-like himitsu) "himitsu package to use." empty-serializer)
+  (notify-reuse maybe-string "Command run to notify the user upon use of a
+secret it was already authorized to use. Limited shell expansion available.")
+  (prompter (file-like (wrap-himitsu-prompter
+                         (file-append hiprompt-gtk "/bin/hiprompt-gtk")))
+"himitsu prompter to use to request user authorization for secret access.")
+  (extra-options (list-of-strings-or-gexps '()) "A list of extra options, one
+per line, to put verbatim into the config file.")
+  (prefix himitsu-))
+
+(define (himitsu-serialize config)
+  (mixed-text-file "himitsu.ini" "[himitsud]\n"
+    (serialize-configuration config home-himitsu-configuration-fields)))
+
+(define (himitsu-shepherd-service config)
+  (define start
+    #~(lambda _
+        (let ((data (or (getenv "XDG_DATA_HOME")
+                        (string-append user-homedir "/.local/share"))))
+          (if (directory-exists? (string-append data "/himitsu"))
+            (fork+exec-command
+              (list #$(let ((pkg (home-himitsu-configuration-package config)))
+                        (file-append pkg "/bin/himitsud"))
+                    "-C" #$(himitsu-serialize config))
+              #:log-file (string-append %user-log-dir "/himitsu.log"))
+            (error "Himitsu store must exist before the service can run! Try \
+running 'himitsu-store -i' first?")))))
+  (list (shepherd-service
+          (documentation "Run the Himitsu secret service manager.")
+          (provision '(himitsud))
+          (modules (cons* '(shepherd support) %default-modules))
+          (start start)
+          (stop #~(make-kill-destructor)))))
+
+;; we need to install the file or else himitsu-store will gen it
+(define (himitsu-xdg-configuration-service config)
+  `(("himitsu/config.ini" ,(himitsu-serialize config))))
+
+(define home-himitsu-service-type
+  (service-type
+    (name 'himitsu)
+    (extensions
+      (list (service-extension home-shepherd-service-type
+                               himitsu-shepherd-service)
+            (service-extension home-xdg-configuration-files-service-type
+                               himitsu-xdg-configuration-service)
+            (service-extension home-profile-service-type
+                               (const (list himitsu)))))
+    (compose concatenate)
+    (extend (lambda (config exts)
+              (let ((opts (home-himitsu-configuration-extra-options config)))
+                (home-himitsu-configuration
+                  (inherit config)
+                  (extra-options (append exts opts))))))
+    (default-value (home-himitsu-configuration))
+    (description "Run the Himitsu secret storage manager upon login. You
+should create the Himitsu database in advance.")))
+
+;;
+;; himitsu-ssh
+;;
+
+(define (remember-option? opt)
+  (or (number? opt) (memq opt '(session skip refuse))))
+
+(define list-of-remember-options? (list-of remember-option?))
+
+(define (himitsu-serialize-list-of-remember-options label val)
+  (himitsu-serialize-string label
+    (string-join (map (lambda (x) (cond ((number? x) (number->string x))
+                                        ((symbol? x) (symbol->string x))))
+                      val)
+                 ",")))
+
+(define-configuration home-himitsu-ssh-configuration
+  (package (file-like himitsu-ssh) "himitsu-ssh package to use."
+           empty-serializer)
+  (persist (list-of-remember-options '(session 300 refuse)) "List of options
+given when prompting to allow himitsu-ssh to see your keys. The option chosen
+decides how long himitsu-ssh has this access. Options can be either 'session,
+'refuse, 'skip, or a timeout in seconds. 'session means until the daemon
+closes, 'refuse to decline and never ask again, and 'skip means to ask again
+next use.")
+  (disclose (list-of-remember-options '(skip session 300)) "List of options
+given when prompting to allow himitsu-ssh use of your keys. The format is the
+same has persist.")
+  (prefix himitsu-))
+
+(define (himitsu-ssh-shepherd-service config)
+  (let* ((package (home-himitsu-ssh-configuration-package config))
+         (binary (file-append package "/bin/hissh-agent")))
+    (list (shepherd-service
+            (documentation "Start the Himitsu ssh-agent implementation.")
+            (provision '(himitsu-ssh ssh-agent))
+            (requirement '(himitsud))
+            (start #~(make-forkexec-constructor (list #$binary)))
+            (stop #~(make-kill-destructor))))))
+
+(define (himitsu-ssh-himitsu.ini config)
+  (list "[ssh.remember]"
+        (serialize-configuration config home-himitsu-ssh-configuration-fields)))
+
+(define (himitsu-ssh-environment-variables _)
+  '(("SSH_AUTH_SOCK" . "${XDG_RUNTIME_DIR:-/run/user/$UID}/hissh-agent")))
+
+(define home-himitsu-ssh-service-type
+  (service-type
+    (name 'himitsu-ssh)
+    (extensions (list (service-extension home-shepherd-service-type
+                                         himitsu-ssh-shepherd-service)
+                      (service-extension home-himitsu-service-type
+                                         himitsu-ssh-himitsu.ini)
+                      (service-extension home-environment-variables-service-type
+                                         himitsu-ssh-environment-variables)
+                      (service-extension home-profile-service-type
+                                         (const (list himitsu-ssh)))))
+    (default-value (home-himitsu-ssh-configuration))
+    (description "Add support for ssh to store keys in Himitsu.")))
+
+;;
+;; himitsu-secret-service
+;;
+
+(define-configuration home-himitsu-secret-service-configuration
+  (package (file-like himitsu-secret-service) "himitsu-secret-service package to
+use." empty-serializer)
+  (prefix himitsu-))
+
+(define (himitsu-secret-service-shepherd-service config)
+  (let* ((package (home-himitsu-secret-service-configuration-package config))
+         (binary (file-append package "/bin/hisecrets-agent")))
+    (list (shepherd-service
+            (documentation "Start the Himitsu secret-service implementation.")
+            (provision '(himitsu-secret-service secret-service))
+            (requirement '(himitsud dbus))
+            (start #~(make-forkexec-constructor (list #$binary)))
+            (stop #~(make-kill-destructor))))))
+
+(define home-himitsu-secret-service-type
+  (service-type
+    (name 'himitsu-secret-service)
+    (extensions
+      (list (service-extension home-shepherd-service-type
+                               himitsu-secret-service-shepherd-service)))
+    (default-value (home-himitsu-secret-service-configuration))
+    (description "Add support to Himitsu for the freedesktop.org
+secret-service protocol.")))
@@ -367,14 +367,13 @@ purposes."
     'unknown)
    ((channels ...)
     (map (lambda (channel)
-            (let* ((uri (string->uri (channel-url channel)))
-                   (url (if (or (not uri) (eq? 'file (uri-scheme uri)))
-                            "local checkout"
-                            (channel-url channel))))
-             `(channel ,(channel-name channel) ,url ,(channel-commit channel))))
+            ;; NOTE: URL is not logged to synchronize the derivations
+            ;; coming out of pre-inst-env, time-machine and Cuirass
+            ;; for generating release artifacts.
+            `(channel ,(channel-name channel) ,(channel-commit channel)))
          channels))))

-(define* (installer-program #:key dry-run?)
+(define* (installer-program #:key dry-run? (guix-for-installer (current-guix)))
  "Return a file-like object that runs the given INSTALLER."
  (define init-gettext
    ;; Initialize gettext support, so that installer messages can be
@@ -423,7 +422,7 @@ purposes."
                           guile-gnutls
                           guile-zlib           ;for (gnu build linux-modules)
                           guile-zstd           ;for (gnu build linux-modules)
-                           (current-guix))
+                           guix-for-installer)
      (with-imported-modules `(,@(source-module-closure
                                  `(,@modules
                                    (gnu services herd)
@@ -35,7 +35,7 @@
 # Copyright © 2020 Ryan Prior <rprior@protonmail.com>
 # Copyright © 2020 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
 # Copyright © 2020, 2021 Brice Waegeneire <brice@waegenei.re>
-# Copyright © 2020, 2023 Tanguy Le Carrour <tanguy@bioneland.org>
+# Copyright © 2020, 2023, 2025 Tanguy Le Carrour <tanguy@bioneland.org>
 # Copyright © 2020 Martin Becze <mjbecze@riseup.net>
 # Copyright © 2020 Malte Frank Gerdes <mate.f.gerdes@gmail.com>
 # Copyright © 2020, 2023 Vinicius Monego <monego@posteo.net>
@@ -73,6 +73,7 @@
 # Copyright © 2024 James Smith <jsubuntuxp@disroot.org>
 # Copyright © 2025 Nigko Yerden <nigko.yerden@gmail.com>
 # Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
+# Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 #
 # This file is part of GNU Guix.
 #
@@ -112,6 +113,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/home/services/dotfiles.scm		\
  %D%/home/services/symlink-manager.scm		\
  %D%/home/services/fontutils.scm		\
+  %D%/home/services/gnome.scm			\
  %D%/home/services/gnupg.scm			\
  %D%/home/services/guix.scm			\
  %D%/home/services/mail.scm			\
@@ -121,6 +123,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/home/services/music.scm			\
  %D%/home/services/niri.scm			\
  %D%/home/services/pm.scm			\
+  %D%/home/services/secrets.scm			\
  %D%/home/services/shells.scm			\
  %D%/home/services/shepherd.scm		\
  %D%/home/services/sound.scm			\
@@ -187,7 +190,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/calcurse.scm			\
  %D%/packages/ccache.scm			\
  %D%/packages/cdrom.scm			\
-  %D%/packages/cedille.scm			\
  %D%/packages/certs.scm			\
  %D%/packages/check.scm			\
  %D%/packages/chemistry.scm			\
@@ -254,6 +256,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/docker.scm			\
  %D%/packages/documentation.scm		\
  %D%/packages/dpdk.scm        \
+  %D%/packages/duckdb.scm			\
  %D%/packages/dvtm.scm				\
  %D%/packages/easyrpg.scm			\
  %D%/packages/ebook.scm			\
@@ -305,7 +308,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/game-development.scm		\
  %D%/packages/games.scm			\
  %D%/packages/gawk.scm				\
-  %D%/packages/gcal.scm				\
  %D%/packages/gcc.scm				\
  %D%/packages/gd.scm				\
  %D%/packages/gdb.scm				\
@@ -341,6 +343,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/gperf.scm			\
  %D%/packages/gpodder.scm			\
  %D%/packages/gps.scm				\
+  %D%/packages/graal.scm			\
  %D%/packages/graph.scm			\
  %D%/packages/graphics.scm			\
  %D%/packages/graphviz.scm			\
@@ -356,6 +359,8 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/gxmessage.scm			\
  %D%/packages/hardware.scm			\
  %D%/packages/hare.scm				\
+  %D%/packages/hare-apps.scm			\
+  %D%/packages/hare-xyz.scm			\
  %D%/packages/haskell.scm			\
  %D%/packages/haskell-apps.scm			\
  %D%/packages/haskell-check.scm		\
@@ -546,7 +551,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/php.scm				\
  %D%/packages/php-xyz.scm			\
  %D%/packages/piet.scm			\
-  %D%/packages/pikchr.scm			\
+  %D%/packages/diagram.scm			\
  %D%/packages/pkg-config.scm			\
  %D%/packages/plan9.scm			\
  %D%/packages/plotutils.scm			\
@@ -609,7 +614,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/rust-sources.scm			\
  %D%/packages/samba.scm			\
  %D%/packages/sagemath.scm			\
-  %D%/packages/sawfish.scm			\
  %D%/packages/scanner.scm			\
  %D%/packages/scheme.scm			\
  %D%/packages/spreadsheet.scm			\
@@ -694,7 +698,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/vpn.scm				\
  %D%/packages/vulkan.scm			\
  %D%/packages/w3m.scm				\
-  %D%/packages/wdiff.scm			\
  %D%/packages/weather.scm			\
  %D%/packages/web.scm				\
  %D%/packages/web-browsers.scm			\
@@ -801,6 +804,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/system/uuid.scm				\
  %D%/system/vm.scm				\
 						\
+  %D%/system/images/a20-olinuxino-lime2.scm			\
  %D%/system/images/hurd.scm			\
  %D%/system/images/novena.scm			\
  %D%/system/images/orangepi-r1-plus-lts-rk3328.scm	\
@@ -988,6 +992,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/akonadi-not-relocatable.patch		\
  %D%/packages/patches/akonadi-timestamps.patch		\
  %D%/packages/patches/alure-dumb-2.patch			\
+  %D%/packages/patches/amd-smi-python.patch			\
  %D%/packages/patches/ibus-anthy-fix-tests.patch		\
  %D%/packages/patches/ibus-table-paths.patch			\
  %D%/packages/patches/anki-mpv-args.patch			\
@@ -1076,7 +1081,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/calls-disable-application-test.patch	\
  %D%/packages/patches/calls-disable-sip-test.patch		\
  %D%/packages/patches/camlboot-dynamically-allocate-stack-signal.patch	\
-  %D%/packages/patches/capnproto-fix-test.patch		\
  %D%/packages/patches/capstone-fix-python-constants.patch	\
  %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
  %D%/packages/patches/chez-irregex-import-cond-expand.patch	\
@@ -1085,8 +1089,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/cdparanoia-fpic.patch			\
  %D%/packages/patches/cdrkit-libre-cross-compile.patch	\
  %D%/packages/patches/cdrtools-3.01-mkisofs-isoinfo.patch 	\
-  %D%/packages/patches/ceph-disable-cpu-optimizations.patch	\
-  %D%/packages/patches/ceph-fix-for-newer-boost.patch		\
+  %D%/packages/patches/ceph-fix-cmake.patch                     \
  %D%/packages/patches/cf-tool-add-languages.patch		\
  %D%/packages/patches/chmlib-inttypes.patch			\
  %D%/packages/patches/cl-asdf-config-directories.patch		\
@@ -1142,6 +1145,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/clucene-contribs-lib.patch               \
  %D%/packages/patches/csvkit-set-locale-for-tests.patch			\
  %D%/packages/patches/ctranslate2-local-build.patch		\
+  %D%/packages/patches/ctune-cmake-disable-git-clone.patch		\
  %D%/packages/patches/cube-nocheck.patch			\
  %D%/packages/patches/cups-relax-root-ownership-check.patch		\
  %D%/packages/patches/cura-engine-gcc-14.patch			\
@@ -1198,6 +1202,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/duc-fix-test-sh.patch                    \
  %D%/packages/patches/dune-common-skip-failing-tests.patch	\
  %D%/packages/patches/durden-shadow-arcan.patch		\
+  %D%/packages/patches/dvdbackup-with-libdvdread-6.1.0+.patch	\
  %D%/packages/patches/dvd+rw-tools-add-include.patch 		\
  %D%/packages/patches/dwarves-threading-reproducibility.patch	\
  %D%/packages/patches/efivar-fix-fprint-format.patch		\
@@ -1212,6 +1217,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/emacs-all-the-icons-remove-duplicate-rs.patch	\
  %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
  %D%/packages/patches/emacs-disable-jit-compilation.patch			\
+  %D%/packages/patches/emacs-elisp-autofmt-fix-region-send.patch	\
  %D%/packages/patches/emacs-exec-path.patch			\
  %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
  %D%/packages/patches/emacs-gnus-alias-reference-signature.patch	\
@@ -1247,11 +1253,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/esmtp-add-lesmtp.patch		\
  %D%/packages/patches/esound-c99.patch         		\
  %D%/packages/patches/exercism-disable-self-update.patch	\
-  %D%/packages/patches/extempore-unbundle-external-dependencies.patch	\
  %D%/packages/patches/extundelete-e2fsprogs-1.44.patch		\
  %D%/packages/patches/fail2ban-fix-sshd-filter.patch           \
  %D%/packages/patches/fail2ban-paths-guix-conf.patch		\
  %D%/packages/patches/faiss-tests-CMakeLists-find-googletest.patch	\
+  %D%/packages/patches/falcosecurity-libs-bpf-probes-fix.patch  \
  %D%/packages/patches/falcosecurity-libs-shared-build.patch	\
  %D%/packages/patches/farstream-gupnp.patch                         \
  %D%/packages/patches/farstream-make.patch                          \
@@ -1281,6 +1287,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/ffmpeg-jami-remove-mjpeg-log.patch	\
  %D%/packages/patches/ffmpeg-jami-screen-sharing-x11-fix.patch	\
  %D%/packages/patches/ffmpeg-4-binutils-2.41.patch	\
+  %D%/packages/patches/ffmpeg-svt-av1-v3.patch			\
  %D%/packages/patches/fgallery-also-look-for-7z.patch		\
  %D%/packages/patches/fifengine-boost-compat.patch		\
  %D%/packages/patches/fifengine-python-3.9-compat.patch	\
@@ -1436,6 +1443,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghostscript-no-header-creationdate.patch \
  %D%/packages/patches/gimp-fix-metadata-editor.patch		\
  %D%/packages/patches/gimp-fix-tiff-load.patch			\
+  %D%/packages/patches/git-clar-path-max.patch			\
  %D%/packages/patches/git-filter-repo-generate-doc.patch	\
  %D%/packages/patches/gklib-suitesparse.patch			\
  %D%/packages/patches/glib-appinfo-watch.patch			\
@@ -1516,6 +1524,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/gpaste-fix-paths.patch			\
  %D%/packages/patches/gpm-glibc-2.26.patch			\
  %D%/packages/patches/gpodder-disable-updater.patch		\
+  %D%/packages/patches/graalvm-mx-check-failed-after-join.patch	\
  %D%/packages/patches/grantlee-fix-i586-precision.patch	\
  %D%/packages/patches/grantlee-register-metaenumvariable.patch	\
  %D%/packages/patches/grep-timing-sensitive-test.patch		\
@@ -1588,7 +1597,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/hurd-refcounts-assert.patch		\
  %D%/packages/patches/hurd-rumpdisk-no-hd.patch		\
  %D%/packages/patches/hurd-startup.patch			\
+  %D%/packages/patches/hurd-proc-zombies.patch			\
  %D%/packages/patches/hwloc-1-test-btrfs.patch			\
+  %D%/packages/patches/i3lock-blur-fix-build-on-gcc-10.patch	\
  %D%/packages/patches/i7z-gcc-10.patch				\
  %D%/packages/patches/icecat-adjust-mozilla-desktop.patch      \
  %D%/packages/patches/icecat-makeicecat.patch			\
@@ -1617,7 +1628,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/irrlicht-link-against-needed-libs.patch	\
  %D%/packages/patches/isl-0.11.1-aarch64-support.patch		\
  %D%/packages/patches/ispell-for-linphone-cmake.patch		\
-  %D%/packages/patches/jamesdsp-fix-bulid-on-pipewire-1.4.0.patch\
  %D%/packages/patches/jami-find-package-avutil.patch		\
  %D%/packages/patches/jami-libjami-headers-search.patch	\
  %D%/packages/patches/jami-qwindowkit.patch			\
@@ -1649,8 +1659,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/jfsutils-gcc-compat.patch		\
  %D%/packages/patches/jfsutils-include-systypes.patch		\
  %D%/packages/patches/john-the-ripper-jumbo-with-gcc-11.patch	\
-  %D%/packages/patches/json-c-0.13-CVE-2020-12762.patch		\
  %D%/packages/patches/json-c-0.12-CVE-2020-12762.patch		\
+  %D%/packages/patches/json-c-0.13-CVE-2020-12762.patch		\
+  %D%/packages/patches/jsonnet-include-cstdint-for-gcc-13-builds.patch	\
  %D%/packages/patches/julia-SOURCE_DATE_EPOCH-mtime.patch	\
  %D%/packages/patches/julia-Use-MPFR-4.2.patch	                \
  %D%/packages/patches/komikku-python-3.11-compat.patch	                \
@@ -1696,6 +1707,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/kinit-kdeinit-extra_libs.patch		\
  %D%/packages/patches/kio-search-smbd-on-PATH.patch		\
  %D%/packages/patches/kismet-unbundle-boost.patch		\
+  %D%/packages/patches/kissfft-tflite-micro.patch               \
  %D%/packages/patches/kitty-fix-wayland-protocols.patch	\
  %D%/packages/patches/kmod-module-directory.patch		\
  %D%/packages/patches/kmscon-runtime-keymap-switch.patch	\
@@ -1724,6 +1736,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/libbraiding-no-s.patch                   \
  %D%/packages/patches/libcaca-CVE-2021-3410-pt1.patch		\
  %D%/packages/patches/libcaca-CVE-2021-3410-pt2.patch		\
+  %D%/packages/patches/libcap-magic-glibc-constant.patch	\
  %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
  %D%/packages/patches/libcanberra-wayland-crash.patch \
  %D%/packages/patches/libcroco-CVE-2020-12825.patch		\
@@ -1809,7 +1822,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/lirc-reproducible-build.patch		\
  %D%/packages/patches/llvm-13-gcc-14.patch			\
  %D%/packages/patches/lm-sensors-hwmon-attrs.patch		\
-  %D%/packages/patches/lsh-fix-x11-forwarding.patch		\
  %D%/packages/patches/lsof-compat-linux-6.9.patch		\
  %D%/packages/patches/lsof-fatal-test-failures.patch		\
  %D%/packages/patches/lua-CVE-2014-5461.patch                      \
@@ -1870,7 +1882,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/mpc123-initialize-ao.patch		\
  %D%/packages/patches/mpg321-CVE-2019-14247.patch		\
  %D%/packages/patches/mpg321-gcc-10.patch			\
-  %D%/packages/patches/mpv-0.40.0-fix-ffmpeg-8.0.patch		\
  %D%/packages/patches/modglue-fix-build.patch		\
  %D%/packages/patches/modem-manager-fix-test-wrapper.patch	\
  %D%/packages/patches/module-init-tools-moduledir.patch	\
@@ -1936,6 +1947,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/nss-3.115-disable-broken-tests.patch     \
  %D%/packages/patches/nss-3.115-disable-pkix-ocsp-tests.patch  \
  %D%/packages/patches/ntp-fix-dereferencing-the-wrong-variable.patch   \
+  %D%/packages/patches/nvi-add-function-prototypes.patch	\
  %D%/packages/patches/nvi-assume-preserve-path.patch		\
  %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
  %D%/packages/patches/nvi-db4.patch				\
@@ -2040,10 +2052,12 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-clarabel-blas.patch		\
  %D%/packages/patches/python-docrepr-fix-tests.patch		\
  %D%/packages/patches/python-feedparser-missing-import.patch	\
+  %D%/packages/patches/python-gpg-setup-72.patch                \
  %D%/packages/patches/python-hdmedians-replace-nose.patch	\
  %D%/packages/patches/python-louvain-fix-test.patch		\
  %D%/packages/patches/python-matplotlib-fix-legend-loc-best-test.patch	\
  %D%/packages/patches/python-mohawk-pytest.patch	\
+  %D%/packages/patches/python-msal-requests.patch	\
  %D%/packages/patches/python-norns-nose.patch			\
  %D%/packages/patches/python-numpy-gcc-14.patch		\
  %D%/packages/patches/python-random2-getrandbits-test.patch		\
@@ -2063,6 +2077,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/qtdeclarative-5-disable-qmlcache.patch	\
  %D%/packages/patches/qtdeclarative-disable-qmlcache.patch	\
  %D%/packages/patches/qtlocation-5.15.8-mapboxgl-gcc13.patch	\
+  %D%/packages/patches/qtwebengine-revert-egl.patch		\
  %D%/packages/patches/quodlibet-disable-bundled-packages.patch	\
  %D%/packages/patches/qxlsx-fix-include-directory.patch	\
  %D%/packages/patches/schiffbruch-fix-build-for-gcc-13.patch	\
@@ -2089,6 +2104,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/perl-5.14-no-sys-dirs.patch		\
  %D%/packages/patches/perl-autosplit-default-time.patch	\
  %D%/packages/patches/perl-class-methodmaker-reproducible.patch \
+  %D%/packages/patches/perl-crypt-des-implicit-func-decl.patch	\
  %D%/packages/patches/perl-image-exiftool-CVE-2021-22204.patch	\
  %D%/packages/patches/perl-net-amazon-s3-moose-warning.patch	\
  %D%/packages/patches/perl-net-dns-resolver-programmable-fix.patch	\
@@ -2200,19 +2216,20 @@ dist_patch_DATA =						\
  %D%/packages/patches/qtbase-qmake-fix-includedir.patch 	\
  %D%/packages/patches/qtbase-qmlimportscanner-qml-import-path.patch 	\
  %D%/packages/patches/qtbase-moc-ignore-gcc-macro.patch	\
+  %D%/packages/patches/qtbase-patch-libvulkan.patch		\
  %D%/packages/patches/qtbase-qmake-use-libname.patch		\
  %D%/packages/patches/qtbase-5-use-TZDIR.patch			\
  %D%/packages/patches/qtscript-disable-tests.patch		\
  %D%/packages/patches/quagga-reproducible-build.patch          \
-  %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
  %D%/packages/patches/quilt-grep-compat.patch 			\
  %D%/packages/patches/qmk-firmware-fix-hacker-dvorak.patch 	\
  %D%/packages/patches/qtwayland-dont-recreate-callbacks.patch	\
  %D%/packages/patches/qtwayland-cleanup-callbacks.patch	\
  %D%/packages/patches/qtwayland-update-wayland-xml.patch	\
-  %D%/packages/patches/qtwebengine-fix-dependencies.patch       \
  %D%/packages/patches/qtwebsockets-6.9-fix-tst_QWebSocket.patch\
  %D%/packages/patches/rabbitmq-defaults.patch		\
+  %D%/packages/patches/radare2-fix-meson-build-to-use-sys-qjs.patch	\
+  %D%/packages/patches/radare2-fix-meson-build-to-use-sys-sdb.patch	\
  %D%/packages/patches/ragel-char-signedness.patch		\
  %D%/packages/patches/randomjungle-disable-static-build.patch	\
  %D%/packages/patches/rapidcheck-fix-libs.patch		\
@@ -2220,8 +2237,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/retroarch-unbundle-spirv-cross.patch	\
  %D%/packages/patches/rct-add-missing-headers.patch		\
  %D%/packages/patches/readline-link-ncurses.patch		\
-  %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
-  %D%/packages/patches/renpy-use-system-fribidi.patch		\
+  %D%/packages/patches/renpy-python-3.11-compat.patch			\
+  %D%/packages/patches/renpy-fix-integer-slots.patch			\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
  %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
  %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
@@ -2240,11 +2257,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/remake-impure-dirs.patch			\
  %D%/packages/patches/restartd-update-robust.patch             \
  %D%/packages/patches/restic-0.9.6-fix-tests-for-go1.15.patch	\
+  %D%/packages/patches/rlwrap-no-rbgen.patch	\
  %D%/packages/patches/rng-tools-revert-build-randstat.patch	\
  %D%/packages/patches/rocclr-5.6.0-enable-gfx800.patch		\
  %D%/packages/patches/rocm-opencl-runtime-4.3-noclinfo.patch 	\
  %D%/packages/patches/rottlog-direntry.patch 			\
  %D%/packages/patches/ruby-actionpack-remove-browser-tests.patch	\
+  %D%/packages/patches/ruby-activesupport-fix-deprecation-warning.patch	\
  %D%/packages/patches/ruby-asciidoctor-pdf-support-prawn-svg-0_36.patch	\
  %D%/packages/patches/ruby-chunky-png-ruby-3-2-support.patch	\
  %D%/packages/patches/ruby-hiredis-use-system-hiredis.patch	\
@@ -2265,7 +2284,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\
  %D%/packages/patches/s7-flint-3.patch                      	\
  %D%/packages/patches/safeint-disable-tests.patch		\
-  %D%/packages/patches/sage-safeguard-sage-getargspec-cython.patch \
  %D%/packages/patches/sajson-for-gemmi-numbers-as-strings.patch	\
  %D%/packages/patches/sajson-build-with-gcc10.patch		\
  %D%/packages/patches/sane-look-for-plugins-in-SANE_BACKEND_LIB_PATH.patch	\
@@ -2304,6 +2322,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/slim-login.patch				\
  %D%/packages/patches/slim-display.patch			\
  %D%/packages/patches/slurm-23-salloc-fallback-shell.patch	\
+  %D%/packages/patches/slurm-drmaa-25.patch			\
  %D%/packages/patches/stex-copy-from-immutable-store.patch	\
  %D%/packages/patches/sysdig-shared-falcosecurity-libs.patch	\
  %D%/packages/patches/syslinux-gcc10.patch			\
@@ -2359,6 +2378,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/texi2html-document-encoding.patch	\
  %D%/packages/patches/texi2html-i18n.patch			\
  %D%/packages/patches/texmacs-wayland-hidpi.patch	\
+  %D%/packages/patches/tflite-micro_disable_download.patch 	\
  %D%/packages/patches/thefuck-test-environ.patch		\
  %D%/packages/patches/thefuck-remove-broken-tests.patch	\
  %D%/packages/patches/tidy-CVE-2015-5522+5523.patch		\
@@ -2441,6 +2461,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/vcmi-disable-privacy-breach.patch	\
  %D%/packages/patches/vinagre-newer-freerdp.patch             \
  %D%/packages/patches/vinagre-newer-rdp-parameters.patch      \
+  %D%/packages/patches/vlc-livemedia-2024.11.28.patch          \
  %D%/packages/patches/vsearch-unbundle-cityhash.patch		\
  %D%/packages/patches/vst3sdk-3.7.7-allow-winelib-compilation.patch	\
  %D%/packages/patches/vte-CVE-2012-2738-pt1.patch			\
@@ -2462,14 +2483,16 @@ dist_patch_DATA =						\
  %D%/packages/patches/wmctrl-64-fix.patch			\
  %D%/packages/patches/wmfire-dont-inline-draw-fire.patch	\
  %D%/packages/patches/wmfire-update-for-new-gdk-versions.patch	\
-  %D%/packages/patches/woof-doom-unbundle-spng-miniz.patch	\
  %D%/packages/patches/wordnet-CVE-2008-2149.patch			\
  %D%/packages/patches/wordnet-CVE-2008-3908-pt1.patch			\
  %D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch			\
  %D%/packages/patches/wpa-supplicant-dbus-group-policy.patch		\
+  %D%/packages/patches/x2goclient-fix-makefile.patch            \
  %D%/packages/patches/x265-arm-flags.patch			\
+  %D%/packages/patches/x265-4-arm-flags.patch			\
  %D%/packages/patches/xdg-desktop-portal-disable-portal-tests.patch\
  %D%/packages/patches/xdg-desktop-portal-disable-configuration-search-exit.patch\
+  %D%/packages/patches/xdg-desktop-portal-1.20.3-disable-configuration-search-exit.patch\
  %D%/packages/patches/xdg-desktop-portal-wlr-harcoded-length.patch\
  %D%/packages/patches/xf86-video-siliconmotion-fix-ftbfs.patch \
  %D%/packages/patches/xfig-Enable-error-message-for-missing-libraries.patch		\
@@ -2484,6 +2507,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/xplanet-1.3.1-libdisplay_DisplayOutput.cpp.patch	\
  %D%/packages/patches/xplanet-1.3.1-libimage_gif.c.patch	\
  %D%/packages/patches/xplanet-1.3.1-xpUtil-Add2017LeapSecond.cpp.patch	\
+  %D%/packages/patches/xpra-5.0-install_libs.patch              \
+  %D%/packages/patches/xpra-5.0-systemd-run.patch              \
  %D%/packages/patches/xpra-6.0-systemd-run.patch		\
  %D%/packages/patches/xpra-6.1-install_libs.patch		\
  %D%/packages/patches/xterm-370-explicit-xcursor.patch		\
@@ -651,7 +651,7 @@ fdisk -l /dev/sda"
     (format #f "#!/usr/bin/env bash
 set -eo pipefail
 apt-get update
-apt-get install cloud-initramfs-growroot --assume-yes"))
+apt-get install cloud-initramfs-growroot uidmap --assume-yes"))
    (format #t "successfully installed rescue system packages on '~a'\n" name)))

 (define (hetzner-machine-delete machine server)
@@ -77,36 +77,43 @@
    (build-system glib-or-gtk-build-system)
    (outputs '("out" "bin"))
    (arguments
-     `(#:tests? #f                      ; Tests require drivers
-       #:configure-flags
-       (list "CFLAGS=-g -O2 -Wno-error=incompatible-pointer-types"
-             "--disable-static"
-             "--enable-fake")
-       #:phases
-       (modify-phases %standard-phases
-         ,@(if (this-package-native-input "config")
-               `((add-after 'unpack 'update-config-scripts
-                   (lambda* (#:key native-inputs inputs #:allow-other-keys)
-                     (for-each
-                       (lambda (dir)
-                         (for-each (lambda (file)
-                                     (install-file
-                                       (search-input-file
-                                         (or native-inputs inputs)
-                                         (string-append "/bin/" file)) dir))
-                                   '("config.guess" "config.sub")))
-                       '("." "libltdl")))))
-               '()))))
+     (list
+      #:tests? #f                       ; Tests require drivers
+      #:configure-flags
+      #~(list "CFLAGS=-g -O2 -Wno-error=incompatible-pointer-types"
+              "--disable-static"
+              "--enable-fake")
+      #:phases
+      #~(modify-phases %standard-phases
+          #$@(if (this-package-native-input "config")
+                 #~((add-after 'unpack 'update-config-scripts
+                      (lambda* (#:key native-inputs inputs #:allow-other-keys)
+                        (for-each
+                         (lambda (dir)
+                           (for-each
+                            (lambda (file)
+                              (install-file
+                               (search-input-file
+                                (or native-inputs inputs)
+                                (string-append "/bin/" file)) dir))
+                            (list "config.guess" "config.sub")))
+                         (list "." "libltdl")))))
+                 (list)))))
    (native-inputs
     (append
-       (if (or (target-aarch64?)
-               (target-ppc64le?)
-               (target-riscv64?))
-           (list config)
-           '())
-       (list latex2html pkg-config python-wrapper swig)))
+      (if (or (target-aarch64?)
+              (target-ppc64le?)
+              (target-riscv64?))
+          (list config)
+          (list))
+      (list latex2html
+            pkg-config
+            python-wrapper
+            swig)))
    (inputs
-     (list glib gtk+-2 libusb-compat))
+     (list glib
+           gtk+-2
+           libusb-compat))
    (synopsis "Portable Braille Library")
    (description "Libbraille is a library to easily access Braille displays and
 terminals.")
@@ -30,10 +30,13 @@
  #:use-module (gnu packages check)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages perl)
+  #:use-module (gnu packages python-build)
  #:use-module (guix packages)
  #:use-module (guix download)
+  #:use-module (guix gexp)
  #:use-module (gnu packages)
  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module (guix utils))

@@ -95,33 +98,28 @@
 (define-public python-pylibacl
  (package
    (name "python-pylibacl")
-    (version "0.6.0")
+    (version "0.7.3")
    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "pylibacl" version))
-        (sha256
-          (base32
-            "1zyrk2m20p5b6bdwxhrwib273i6i71zyr5hzssbxfqis5qra9848"))))
-    (build-system python-build-system)
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pylibacl" version))
+       (sha256
+        (base32 "08pr5cbipij3j591bihh72r5h14lyrspy24qwmfjsn0c1rcgp7wx"))))
+    (build-system pyproject-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'disable-tests
-           (lambda* (#:key outputs inputs #:allow-other-keys)
-             ;; These tests operate on real files, but our tmpfs does not support
-             ;; ACLs.
-             (substitute* "tests/test_acls.py"
-               (("( *)def test_applyto(_extended(_mixed)?)?" match indent)
-                (string-append indent "@pytest.mark.skip(reason=\"guix\")\n"
-                               match)))))
-         (replace 'check
-           (lambda* (#:key inputs outputs tests? #:allow-other-keys)
-             (when tests?
-               (add-installed-pythonpath inputs outputs)
-               (invoke "pytest" "tests")))))))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'disable-tests
+            (lambda* (#:key outputs inputs #:allow-other-keys)
+              ;; These tests operate on real files, but our tmpfs does not support
+              ;; ACLs.
+              (substitute* "tests/test_acls.py"
+                (("( *)def test_applyto(_extended(_mixed)?)?" match indent)
+                 (string-append indent "@pytest.mark.skip(reason=\"guix\")\n"
+                                match))))))))
    (inputs (list acl))
-    (native-inputs (list python-pytest))
+    (native-inputs (list python-pytest python-setuptools))
    (home-page "https://pylibacl.k1024.org/")
    (synopsis "POSIX.1e @acronym{ACLs, access control lists} for Python")
    (description
@@ -77,6 +77,8 @@
 ;;; Copyright © 2025 Dariqq <dariqq@posteo.net>
 ;;; Copyright © 2024 nik gaffney <nik@fo.am>
 ;;; Copyright © 2025 Simon Streit <simon@netpanic.org>
+;;; Copyright © 2025 Luca Kredel <luca.kredel@web.de>
+;;; Copyright © 2025 ROCKTAKEY <rocktakey@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -189,6 +191,7 @@
  #:use-module (gnu packages polkit)
  #:use-module (gnu packages python)
  #:use-module (gnu packages python-build)
+  #:use-module (gnu packages python-check)
  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages qt)
@@ -374,23 +377,34 @@ service.")
  (package
    (name "hungrycat")
    (version "0.4.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://github.com/jwilk/hungrycat/"
-                                  "releases/download/" version "/"
-                                  "hungrycat-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0xy9l4hky85h3rgdmqmhcnx0q1hq0brskr8lzw2lz6lh7pxlxmyw"))))
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/jwilk/hungrycat/")
+              (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0llfb7kh2k53aqwc1fagw77fmwhvwdxd5qlg0fyrhqq298gj8wif"))))
    (build-system gnu-build-system)
-    (native-inputs
-     ;; For tests.
-     `(("python" ,python-wrapper)
-       ("python-nose" ,python-nose)
-       ("perl" ,perl)
-       ("perl-ipc-run" ,perl-ipc-run)))
    (arguments
-     `(#:test-target "test"))
+     (list
+      ;; tests: Files=2, Tests=2334,  1 wallclock secs
+      #:test-target "test"
+      #:make-flags
+      #~(list (string-append "CC=" #$(cc-for-target)))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'build 'build-doc
+            (lambda _
+              (invoke "make" "-C" "doc"))))))
+    (native-inputs
+     (list automake
+           autoconf
+           cppcheck
+           perl
+           perl-ipc-run
+           python-docutils))
    (synopsis "Single tool that combines @command{cat} & @command{rm}")
    (description
     "hungrycat prints the contents of a file to standard output, while
@@ -583,24 +597,44 @@ interface and is based on GNU Guile.")
 (define-public shepherd-1.0
  (package
    (inherit shepherd-0.10)
-    (version "1.0.8")
+    (version "1.0.9")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/shepherd/shepherd-"
                                  version ".tar.gz"))
              (sha256
               (base32
-                "1xbzf7vmanb36hfb0kc9a240x7xnkynsfs6hcz2kj0xzf19h1srv"))))
+                "1mh080060lnycys8yq6kkiy363wif8dsip3nyklgd3a1r22wb274"))))
    (arguments
-     (substitute-keyword-arguments (package-arguments shepherd-0.10)
-       ((#:configure-flags flags #~'())
-        #~(list "--localstatedir=/var"
-
-                ;; Gzip and zstd are used by the log rotation service.
-                (string-append "--with-gzip=" #$(this-package-input "gzip")
-                               "/bin/gzip")
-                (string-append "--with-zstd=" #$(this-package-input "zstd")
-                               "/bin/zstd")))))
+     (list
+      #:configure-flags
+      #~(list "--localstatedir=/var"
+              ;; Gzip and zstd are used by the log rotation service.
+              (string-append "--with-gzip=" #$(this-package-input "gzip")
+                             "/bin/gzip")
+              (string-append "--with-zstd=" #$(this-package-input "zstd")
+                             "/bin/zstd"))
+      #:make-flags #~'("GUILE_AUTO_COMPILE=0")
+      #:phases (if (%current-target-system)
+                   #~(modify-phases %standard-phases
+                       (add-before 'configure 'set-fibers-directory
+                         (lambda* (#:key inputs  #:allow-other-keys)
+                           ;; When cross-compiling, refer to the target
+                           ;; Fibers, not the native one.
+                           (let ((fibers
+                                  (search-input-file
+                                   inputs
+                                   "share/guile/site/3.0/fibers.scm"))
+                                 (fibers-go
+                                  (search-input-file
+                                   inputs
+                                   "lib/guile/3.0/site-ccache/fibers.go")))
+                             (substitute* '("herd.in" "shepherd.in")
+                               (("%FIBERS_SOURCE_DIRECTORY%")
+                                (dirname fibers))
+                               (("%FIBERS_OBJECT_DIRECTORY%")
+                                (dirname fibers-go)))))))
+                   #~%standard-phases)))
    (native-inputs
     (modify-inputs (package-native-inputs shepherd-0.10)
       (replace "guile-fibers"
@@ -1941,7 +1975,7 @@ maintenance releases.")
 (define-public dhcpcd
  (package
    (name "dhcpcd")
-    (version "10.2.3")
+    (version "10.3.0")
    (source
     (origin
       (method git-fetch)
@@ -1950,7 +1984,7 @@ maintenance releases.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "01bqs71s2gixsir1cpnk6sm4k9dpdkrgp1r8cpbac50d6hwlxln3"))))
+        (base32 "058k8wbzbjb6mm6qklv40z1y4k6sdb4ysap1xk6pny1m1f9xkdax"))))
    (inputs (list bash-minimal coreutils-minimal eudev sed))
    (build-system gnu-build-system)
    (arguments
@@ -2214,7 +2248,7 @@ by bandwidth they use.")
           perl-test-pod
           perl-test-pod-coverage
           perl-test-trap
-           perltidy))
+           perl-tidy))
    (inputs
     (list bash-minimal                 ;for wrap-program
           perl-exception-class
@@ -2718,7 +2752,7 @@ command.")
      #:tests? #f ; no tests
      ;; Make sure the (rarely updated) package 'imagemagick/stable'
      ;; does not end up in the closure.
-      #:disallowed-references (list imagemagick/stable)
+      #:disallowed-references (list (this-package-native-input "imagemagick"))
      #:modules '((guix build qt-build-system)
                  ((guix build gnu-build-system) #:prefix gnu:)
                  (guix build utils))
@@ -2950,7 +2984,7 @@ system is under heavy load.")
 (define-public stress-ng
  (package
    (name "stress-ng")
-    (version "0.19.03")
+    (version "0.19.06")
    (source
     (origin
       (method git-fetch)
@@ -2959,7 +2993,7 @@ system is under heavy load.")
             (commit (string-append "V" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1phrmjvvjn55pyfljfkk604d8q8wn17l416v91hskj98v7b7yhck"))))
+        (base32 "0fxyxxswkx5ay8i2w8ajsiagkysh8d41l88vls9c4rc35wxzhwf6"))))
    (build-system gnu-build-system)
    (arguments
     ;; XXX The test suite seems to cause instability on the VisionFive 2
@@ -3141,29 +3175,34 @@ various ways that may be running with too much privilege.")
 (define-public smartmontools
  (package
    (name "smartmontools")
-    (version "7.4")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "mirror://sourceforge/smartmontools/smartmontools/"
-                    version "/smartmontools-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0gcrzcb4g7f994n6nws26g6x15yjija1gyzd359sjv7r3xj1z9p9"))))
+    (version "7.5")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/smartmontools/smartmontools")
+             (commit (string-append "RELEASE_"
+                                    (string-replace-substring version "." "_")))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "00c58xcqv73lzxf0baly2q0sqkyd2vncv93iabjj7jkvbzf7nqpz"))))
    (build-system gnu-build-system)
    (arguments
     (list
      #:make-flags
      #~(list "BUILD_INFO=\"(Guix)\"")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'chdir
+            (lambda _
+              (chdir "smartmontools"))))
      #:configure-flags
      #~(list (format #f "--with-scriptpath=~{~a:~}$PATH"
                      (map (lambda (pkg)
                             (in-vicinity pkg "bin"))
                           '#$(list (this-package-input "coreutils-minimal")
                                    (this-package-input "sed")))))))
-    (inputs (list coreutils-minimal
-                  libcap-ng
-                  sed))
+    (inputs (list automake autoconf coreutils-minimal libcap-ng sed))
    (home-page "https://www.smartmontools.org/")
    (synopsis "S.M.A.R.T. harddisk control and monitoring tools")
    (description
@@ -3177,7 +3216,7 @@ degradation and failure.")
 (define-public fdupes
  (package
    (name "fdupes")
-    (version "2.3.2")
+    (version "2.4.0")
    (source
     (origin
       (method url-fetch)
@@ -3185,7 +3224,7 @@ degradation and failure.")
                           "releases/download/v" version "/"
                           "fdupes-" version ".tar.gz"))
       (sha256
-        (base32 "1irab60gkjmnvk1l0x92cb5vh9zw9g0vgr3s82mir93zpvn8v3c0"))))
+        (base32 "0dhpgcylf99cnxz8h4i4dhv2i3124cs0n8lssbhwn783knijfysj"))))
    (build-system gnu-build-system)
    (inputs
     (list ncurses pcre2 sqlite))
@@ -3335,7 +3374,17 @@ provides the following commands:
       (uri (pypi-uri "ansible" version))
       (sha256
        (base32 "0apj783acx4jzkf3bnibn4y5jc6jd8ly7l0rdqq8f1jpgxal933x"))))
-    (build-system python-build-system)
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      ;; XXX: All tests errored with:
+      ;; from ...common.utils import (
+      ;; E ImportError: attempted relative import with no known parent package
+      ;;
+      ;; tests: 17 skipped, 1 warning, 1132 errors
+      #:tests? #f))
+    (native-inputs
+     (list python-setuptools))
    (propagated-inputs (list ansible-core))
    ;; The Ansible collections are found by ansible-core via the Python search
    ;; path; the following search path ensures that they are found even when
@@ -4668,7 +4717,7 @@ information tool.")
 (define-public fastfetch-minimal
  (package
    (name "fastfetch-minimal")
-    (version "2.54.0")
+    (version "2.55.1")
    (source
     (origin
       (method git-fetch)
@@ -4677,7 +4726,7 @@ information tool.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0iw58idc45x505rhix3mqymnfbk1r7jc10alyry9qypflalqwkqx"))
+        (base32 "0a2a8rp75nx16gvq0918999hifr2lph8dagpfipmyflaa5awlw54"))
       (modules '((guix build utils)))
       (snippet '(begin
                   (delete-file-recursively "src/3rdparty")))))
@@ -6613,10 +6662,11 @@ file or files to several hosts.")
                              (install-file "man-page/dust.1"
                                            (string-append share "/man/man1"))
                              (mkdir-p (string-append out
-                                        "/etc/bash_completion.d"))
-                              (copy-file "completions/dust.bash"
-                                         (string-append out
-                                          "/etc/bash_completion.d/dust"))
+                                        "/share/bash-completion/completions"))
+                              (copy-file
+                               "completions/dust.bash"
+                               (string-append
+                                out "/share/bash-completion/completions/dust"))
                              (install-file "completions/dust.fish"
                                            (string-append share
                                             "/fish/vendor_completions.d"))
@@ -6901,6 +6951,41 @@ with which other processes.  It provides more usable versions of @command{ps},
 network, which causes enabled computers to power on.")
    (license license:gpl2+)))

+(define-public witr
+  (package
+    (name "witr")
+    (version "0.1.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/pranshuparmar/witr")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "016yiwn0b00ynllka6h2w6gk2yjzj5nx2xf26shb0cz4crdwww0d"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:install-source? #f
+      #:import-path "github.com/pranshuparmar/witr/cmd/witr"
+      #:unpack-path "github.com/pranshuparmar/witr"
+      #:build-flags #~(list "-ldflags"
+                            (string-append "-X main.version=" #$version))))
+    (home-page "https://github.com/pranshuparmar/witr")
+    (synopsis "Utility to show why the process is running")
+    (description
+     "The @dfn{witr} (why-is-this-running), is a utility to show:
+@enumerate
+@item What is running?
+@item How did it start?
+@item What is keeping it running?
+@item What context does it belong to?
+@end enumerate
+It shows which process uses the port, and its information like process tree,
+working directory, user, pid, command, and so on.")
+    (license license:asl2.0)))
+
 (define-public xfel
  (package
    (name "xfel")
@@ -300,6 +300,38 @@ barcodes of the modern ECC200 variety.  libdmtx is a shared library, allowing
 C/C++ programs to use its capabilities without restrictions or overhead.")
    (license license:bsd-3)))

+(define-public dmtx-utils
+  (package
+    (name "dmtx-utils")
+    (version "0.7.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/dmtx/dmtx-utils/")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        "06m3qncqdlcnmw83n95yrx2alaq6bld320ax26z4ndnla41yk0p4")))
+    (build-system gnu-build-system)
+    (native-inputs (list autoconf automake libtool pkg-config))
+    (inputs (list libdmtx imagemagick libjpeg-turbo))
+    (home-page "https://github.com/dmtx/dmtx-utils/")
+    (synopsis "Utilities for working with Data Matrix barcodes")
+    (description
+     "libdmtx is a software library that enables programs to read and write Data
+Matrix barcodes of the modern ECC200 variety.  This package, dmtx-utils,
+provides command line utilities that allow scripts and command line users to
+use libdmtx functionality.
+
+This package includes the following programs:
+@enumerate
+@item @code{dmtxquery}: Extract information from dmtxread output.
+@item @code{dmtxread}: Scan Data Matrix barcodes.
+@item @code{dmtxwrite}: Create Data Matrix barcodes.
+@end enumerate")
+    (license (list license:lgpl2.1 license:gpl2))))
+
 ;; XXX: qt variant utils are broken: zbarcam-qt fails with segmentation fault.
 (define-public zbar
  (package
@@ -21,6 +21,7 @@
 ;;; Copyright © 2025 Nigko Yerden <nigko.yerden@gmail.com>
 ;;; Copyright © 2025 Skylar Hill <stellarskylark@posteo.net>
 ;;; Copyright © 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -60,6 +61,7 @@
  #:use-module (gnu packages image)
  #:use-module (gnu packages java)
  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages linux)
  #:use-module (gnu packages maths)
  #:use-module (gnu packages mpi)
  #:use-module (gnu packages multiprecision)
@@ -267,7 +269,7 @@ the real span of the lattice.")
 (define-public pari-gp
  (package
    (name "pari-gp")
-    (version "2.17.2")
+    (version "2.17.3")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -275,7 +277,7 @@ the real span of the lattice.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "0qahws0jmmqv3v611zdwhvg0rz5a678lhi8z51x16yzrbj7mfc3x"))))
+                "1jrd8q8bii109i01qjsc15948a47cn1kcg7jw0kqsijcb36lz74d"))))
    (build-system gnu-build-system)
    (native-inputs (list (texlive-local-tree)))
    (inputs (list gmp libx11 perl readline))
@@ -496,25 +498,20 @@ or text interfaces) or as a C++ library.")
 (define-public flint
  (package
   (name "flint")
-   (version "3.2.1")
+   (version "3.4.0")
   (source
    (origin
      (method url-fetch)
      (uri (string-append "https://flintlib.org/download/flint-"
                          version ".tar.gz"))
      (sha256
-       (base32 "0gyjbkhwrmx2vgb1gailnmmzacl4aikzgi70dzmpf8lpfxny8yya"))))
+       (base32 "0csa8n7d4l3mh892q36nhiv1r7bkb168vszz79p95bfy0jc6g5wl"))))
   (build-system gnu-build-system)
-   (inputs
-    (list ntl))
   (propagated-inputs
    (list gmp mpfr)) ; header files included by flint.h or mpfr_mat.h
   (arguments
-      ;; Parallel tests failed in the past on ARM, this may need to be
-      ;; tested again.
-    `(#:parallel-tests? #f
      ;; Prevent build machine specifics from ending up in the binary.
-      #:configure-flags '("--disable-assembly")))
+    '(#:configure-flags '("--disable-assembly")))
   (synopsis "Fast library for number theory")
   (description
    "FLINT is a C library for number theory.  It supports arithmetic
@@ -532,19 +529,31 @@ fast arithmetic.")
   (properties
    '((release-monitoring-url . "http://flintlib.org/downloads.html")))))

+(define-public flint-3.3
+  (package
+   (inherit flint)
+   (version "3.3.1")
+   (source
+    (origin
+      (method url-fetch)
+      (uri (string-append "https://flintlib.org/download/flint-"
+                          version ".tar.gz"))
+      (sha256
+       (base32 "1yzasdcv90f6w926p9g92cli2daxvb0mh2s1w1qskkvn618hxmv4"))))))
+
 (define-public python-flint
  (package
    (name "python-flint")
-    (version "0.7.1")
+    (version "0.8.0")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/fredrik-johansson/python-flint")
-             (commit version)))
+              (url "https://github.com/fredrik-johansson/python-flint")
+              (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "09nsys2cajxsfh2c13nf98a2kwnm0msmab9f9zcjpkndj4ir453a"))))
+        (base32 "1xdclpxpas29v3g14z2fxqf7hv4a6iq7bknl9d9r1510dcpxm67a"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -556,7 +565,7 @@ fast arithmetic.")
           python-pytest))
    (inputs
     (list gmp
-           flint))
+           flint-3.3))
    (propagated-inputs
     (list python-numpy))
    (home-page "https://fredrikj.net/python-flint/")
@@ -618,7 +627,7 @@ matrices, and polynomials over the integers and over finite fields.")
 (define-public singular
  (package
   (name "singular")
-   (version "4.4.1")
+   (version "4.4.1p5")
   (source
    (origin
      (method url-fetch)
@@ -634,7 +643,7 @@ matrices, and polynomials over the integers and over finite fields.")
                      "/singular-" version ".tar.gz"))
            (sha256
              (base32
-               "16xlhar1krlskh9gxbw1gw4qi8248c95w71vzxdw72avs2pblkva"))))
+               "1pwygpmhf4sddf1v5x5fr1kbbkb29wlfd5yyj7lryvhbs45s9rdw"))))
   (build-system gnu-build-system)
   (arguments
    (list
@@ -808,6 +817,80 @@ a C program.")
 principle, 'Keep It Simple, Stupid.'")
    (license license:bsd-3)))

+(define-public kissfft-for-tflite-micro
+  (package
+    (inherit kissfft)
+    (name "kissfft-for-tflite-micro")
+    (version "130")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/mborgerding/kissfft")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        "137h3pkn6jmc3pcgnqsq481f6jjblx7ygw9gyipgcdysmnhrwiv2")
+       (patches (search-patches "kissfft-tflite-micro.patch"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (delete 'build)
+          (replace 'install
+            (lambda _
+              (for-each (lambda (f)
+                          (install-file f
+                                        (string-append #$output "/include")))
+                        '("kiss_fft.h" "kissfft.hh"))
+              (for-each (lambda (f)
+                          (install-file f
+                                        (string-append #$output
+                                                       "/include/tools")))
+                        (find-files "tools"))))
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (invoke "make" "CC=gcc" "testall")))))))
+    (native-inputs (list procps))
+    (inputs (list fftw))))
+
+(define-public clac
+  (package
+    (name "clac")
+    (version "0.3.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/soveran/clac")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        "0crpm5rxxipiz6kqs5ip900d77vvnslyjn5f6nj0lrc86bkbgi8d")))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:test-target "test"
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (add-before 'build 'set-env
+            (lambda _
+              (setenv "CC" "gcc")
+              (setenv "PREFIX" #$output))))))
+    (home-page "https://github.com/soveran/clac")
+    (synopsis "Command-line, stack-based calculator with postfix notation")
+    (description
+     "Clac is a command line, stack-based calculator with postfix notation
+that displays the stack contents at all times.  As you type, the stack
+changes are reflected immediately.")
+    ;; Bundles two dependencies, both also BSD-2. SDS is not yet packaged.
+    ;; linenoise is packaged, but the package doesn't provide shared
+    ;; object files so we have to build it anyway.
+    (license license:bsd-2)))
 (define-public fftw
  (package
    (name "fftw")
@@ -1901,14 +1984,14 @@ no more than about 20 bits long).")
 (define-public r-dtt
  (package
    (name "r-dtt")
-    (version "0.1-2")
+    (version "0.1-2.1")
    (source
      (origin
        (method url-fetch)
        (uri (cran-uri "dtt" version))
        (sha256
          (base32
-            "0n8gj5iylfagdbaqirpykb01a9difsy4zl6qq55f0ghvazxqdvmn"))))
+            "113qb6fjp08gcmv4cgq3cm2fk6k3r3j1wfsrygq8889i2bq4a073"))))
    (properties `((upstream-name . "dtt")))
    (build-system r-build-system)
    (home-page "https://www.r-project.org")
@@ -2215,38 +2298,3 @@ systems.  This encompasses:
@item the computation of the dimension and the degree of the solution set.
@end itemize")
    (license license:gpl2+)))
-
-(define-public clac
-  (package
-    (name "clac")
-    (version "0.3.4")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/soveran/clac")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        "0crpm5rxxipiz6kqs5ip900d77vvnslyjn5f6nj0lrc86bkbgi8d")))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:test-target "test"
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (add-before 'build 'set-env
-            (lambda _
-              (setenv "CC" "gcc")
-              (setenv "PREFIX" #$output))))))
-    (home-page "https://github.com/soveran/clac")
-    (synopsis "Command-line, stack-based calculator with postfix notation")
-    (description
-     "Clac is a command line, stack-based calculator with postfix notation
-that displays the stack contents at all times.  As you type, the stack
-changes are reflected immediately.")
-    ;; Bundles two dependencies, both also BSD-2. SDS is not yet packaged.
-    ;; linenoise is packaged, but the package doesn't provide shared
-    ;; object files so we have to build it anyway.
-    (license license:bsd-2)))
@@ -1306,50 +1306,58 @@ emulator inside the comfort of Emacs.")
  (package
    (name "enjarify")
    (version "1.0.3")
-    (home-page "https://github.com/Storyyeller/enjarify")
    (source
     (origin
-      (method git-fetch)
-      (uri (git-reference
-            (url home-page)
-            (commit version)))
-      (file-name (git-file-name name version))
-      (patches
-       (search-patches "enjarify-setup-py.patch"))
-      (sha256
-       (base32
-        "1nam7h1g4f1h6jla4qcjjagnyvd24dv6d5445w04q8hx07nxdapk"))))
-    (build-system python-build-system)
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/Storyyeller/enjarify")
+              (commit version)))
+       (file-name (git-file-name name version))
+       (patches
+        (search-patches "enjarify-setup-py.patch"))
+       (sha256
+        (base32 "1nam7h1g4f1h6jla4qcjjagnyvd24dv6d5445w04q8hx07nxdapk"))))
+    (build-system pyproject-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-before 'check 'fixup-expected-test-results
-           ;; Upstream adjusted this test in commit:
-           ;; 3ae884a6485af82d300515813f537685b08dd800
-           (lambda _
-             (substitute* "tests/test2/expected.txt"
-               (("^20") "0"))
-             #t))
-         (add-before 'check 'drop-java-xss-argument
-           ;; Upstream removed this argument in order to support 32-bit
-           ;; architectures.  commit: 4be0111d879aa95fdc0d9f24fe529f8c664d4093
-           (lambda _
-             (substitute* "enjarify/runtests.py"
-               (("java -Xss515m") "java "))
-             #t))
-         (add-after 'install 'install-enjarify-wrapper
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let* ((out (assoc-ref outputs "out")))
-                 (mkdir-p (string-append out "/bin/"))
-                 (copy-file "enjarify.sh" (string-append out "/bin/enjarify"))
-                 #t))))))
-    (native-inputs (list openjdk12))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'fix-tests
+            (lambda _
+              (substitute* "enjarify/runtests.py"
+                (("from \\.main") "from enjarify.main")
+                (("from \\.jvm") "from enjarify.jvm"))
+              ;; Upstream adjusted this test in commit:
+              ;; 3ae884a6485af82d300515813f537685b08dd800
+              (substitute* "tests/test2/expected.txt"
+                (("^20") "0"))
+              ;; Upstream removed this argument in order to support 32-bit
+              ;; architectures.  commit:
+              ;; 4be0111d879aa95fdc0d9f24fe529f8c664d4093
+              (substitute* "enjarify/runtests.py"
+                (("java -Xss515m") "java "))))
+          (add-after 'install 'install-enjarify-wrapper
+            (lambda _
+              (let ((bin (string-append #$output "/bin")))
+                (install-file "enjarify.sh" bin)
+                (symlink (string-append bin "/enjarify.sh")
+                         (string-append bin "/enjarify")))))
+          (replace 'check
+            (lambda* (#:key tests? test-flags #:allow-other-keys)
+              (when tests?
+                (invoke "python" "-m" "enjarify.runtests")))))))
+    (native-inputs
+     (list openjdk12
+           python-setuptools))
+    (home-page "https://github.com/Storyyeller/enjarify")
    (synopsis "Translate Dalvik bytecode to equivalent Java bytecode")
-    (description "Android applications are Java programs that run on a
-customized virtual machine, which is part of the Android operating system, the
-Dalvik VM.  Their bytecode differs from the bytecode of normal Java
-applications.  Enjarify can translate the Dalvik bytecode back to equivalent
-Java bytecode, which simplifies the analysis of Android applications.")
+    (description
+     "Android applications are Java programs that run on a customized virtual
+machine, which is part of the Android operating system, the Dalvik VM.  Their
+bytecode differs from the bytecode of normal Java applications.  Enjarify can
+translate the Dalvik bytecode back to equivalent Java bytecode, which
+simplifies the analysis of Android applications.  It's an alternative fork of
+not maintained Goole's project https://github.com/google/enjarify.")
    (license license:asl2.0)))

 (define-public android-file-transfer
@@ -83,6 +83,7 @@
                  (guix build cmake-build-system)
                  (guix build utils))
      #:phases
+      (with-extensions (list (cargo-guile-json))
      #~(modify-phases %standard-phases
          (add-after 'unpack 'prepare-cargo-build-system
            (lambda args
@@ -111,7 +112,7 @@
                (substitute* "unit_tests/CMakeLists.txt"
                  (("clamd_test\\.py" test)
                   (string-append
-                    test " -k \"not test_clamd_08_VirusEvent\"")))))))))
+                    test " -k \"not test_clamd_08_VirusEvent\""))))))))))
    (native-inputs
     (append
      (list pkg-config
@@ -40,13 +40,15 @@
       (origin
         (method git-fetch)
         (uri (git-reference
-               (url "https://github.com/AppImage/type2-runtime")
-               (commit commit)))
+                (url "https://github.com/AppImage/type2-runtime")
+                (commit commit)))
         (file-name (git-file-name name version))
         (sha256
          (base32 "0954crhlbapxis96g1s0vfpf78ybr64zvjalak387ksxj560g44x"))))
+      (build-system gnu-build-system)
      (arguments
       (list
+        #:tests? #f                     ; No tests
        #:make-flags
        #~(list "-Csrc/runtime" "runtime-fuse3"
                (string-append "CC=" #$(cc-for-target))
@@ -60,34 +62,33 @@
        `((guix build gnu-build-system)
          (guix build utils)
          (ice-9 binary-ports))
-        #:phases #~(modify-phases %standard-phases
-                     (delete 'configure)
-                     (delete 'check)    ; No tests.
-                     (replace 'install
-                       (lambda _
-                         (install-file "src/runtime/runtime-fuse3"
-                                       (string-append #$output "/bin"))))
-                     ;; Must be after all elf reliant phases.  Used to identify the
-                     ;; executable as an AppImage as per the specification.
-                     (add-after 'make-dynamic-linker-cache 'set-magic-bytes
-                       (lambda _
-                         (let ((port (open (string-append #$output
-                                            "/bin/runtime-fuse3")
-                                           (logior O_WRONLY))))
-                           (seek port 8 SEEK_SET)
-                           (put-bytevector port #vu8(#x41 #x49 #x02))
-                           (close-port port)))))
-        #:disallowed-references (list squashfuse-for-appimage
-                                      fuse-for-appimage
-                                      (gexp-input zstd "static")
-                                      (gexp-input zlib "static"))))
+        #:phases
+        #~(modify-phases %standard-phases
+            (delete 'configure)
+            (replace 'install
+              (lambda _
+                (install-file "src/runtime/runtime-fuse3"
+                              (string-append #$output "/bin"))))
+            ;; Must be after all elf reliant phases.  Used to identify the
+            ;; executable as an AppImage as per the specification.
+            (add-after 'make-dynamic-linker-cache 'set-magic-bytes
+              (lambda _
+                (let ((port (open (string-append #$output
+                                                 "/bin/runtime-fuse3")
+                                  (logior O_WRONLY))))
+                  (seek port 8 SEEK_SET)
+                  (put-bytevector port #vu8(#x41 #x49 #x02))
+                  (close-port port)))))
+        #:disallowed-references
+        (list (this-package-input "squashfuse-for-appimage")
+              (this-package-input "fuse")
+              (gexp-input (this-package-input "zstd") "static")
+              (gexp-input (this-package-input "zlib") "static"))))
      ;; Only needed at build time.
      (inputs (list squashfuse-for-appimage
                    fuse-for-appimage
                    `(,zstd "static")
                    `(,zlib "static")))
-      (build-system gnu-build-system)
-      (home-page "https://github.com/AppImage/type2-runtime")
      (synopsis "Runtime for executing AppImages")
      (description "The runtime is the executable part of every AppImage.  It mounts
 the payload via @acronym{FUSE} and executes the entrypoint, allowing users to run
@@ -96,4 +97,5 @@ ensures that the AppImage can access its bundled libraries and resources seamles
 providing a consistent environment across different Linux distributions.  In the
 absence of @acronym{FUSE}, the AppImage can still be started using the
@option{--appimage-extract-and-run} flag.")
+      (home-page "https://github.com/AppImage/type2-runtime")
      (license license:expat))))
@@ -15,7 +15,7 @@
 ;;; Copyright © 2021 Sergiu Ivanov <sivanov@colimite.fr>
 ;;; Copyright © 2023 Yovan Naumovski <yovan@gorski.stream>
 ;;; Copyright © 2023 Zheng Junjie <873216071@qq.com>
-;;; Copyright © 2024 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2024, 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -482,3 +482,34 @@ European languages.")
                      (for-each (cut install-file <> include-dir)
                                '("config.h" "defhash.h" "ispell.h"
                                  "libispell.h" "local.h")))))))))))))
+
+(define-public spell
+  (package
+    (name "spell")
+    (version "1.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://gnu/spell/spell-" version ".tar.gz"))
+       (sha256
+        (base32 "0i4pqbhzkv5y4c2j7ajx713jykxsnn4dqdcqfvzn04xkgra47hkw"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'unpack 'patch-commands
+                 (lambda* (#:key inputs #:allow-other-keys)
+                   (substitute* "spell.c"
+                     (("aspell")
+                      (search-input-file inputs "bin/aspell"))
+                     (("ispell_prog = \"ispell\"")
+                      (format #f "ispell_prog = ~s"
+                              (search-input-file inputs "bin/ispell")))))))))
+    (inputs (list aspell ispell))
+    (synopsis "Spell checking")
+    (description
+     "Spell is a command-line spell-checking program.  It reads through
+a text input and prints each misspelled word on a line of its own.  It is
+implemented as a wrapper for GNU aspell or ispell.")
+    (home-page "https://savannah.gnu.org/projects/spell/")
+    (license gpl3+)))
@@ -31,7 +31,7 @@
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
 ;;; Copyright © 2020, 2021 Guillaume Le Vaillant <glv@posteo.net>
 ;;; Copyright © 2020 Jonathan Frederickson <jonathan@terracrypt.net>
-;;; Copyright © 2020, 2024 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2020, 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2020, 2021, 2023 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2020 Michael Rohleder <mike@rohleder.de>
 ;;; Copyright © 2021 jgart <jgart@dismail.de>
@@ -58,6 +58,7 @@
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 Antoine Côté <antoine.cote@posteo.net>
 ;;; Copyright © 2025 Isidor Zeuner <guix@quidecco.pl>
+;;; Copyright © 2025 Evgenii Klimov <eugene.dev@lipklim.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -249,10 +250,43 @@ promoting the market for advanced audio.")
    (home-page "https://www.khronos.org/opensles/")
    (license (license:non-copyleft "file:///LICENSE.txt"))))

+(define-public python-sounddevice
+  (package
+    (name "python-sounddevice")
+    (version "0.5.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "sounddevice" version))
+       (sha256
+        (base32 "0b4vcaj79sy9aqsrgcszkp35x2fc0i4pqzk96d2viflg35h2pb6b"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list #:tests? #false		; no tests
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'patch-generated-file-shebangs 'add-path-to-portaudio
+                 (lambda* (#:key inputs #:allow-other-keys)
+                   (substitute* "sounddevice.py"
+                     (("_find_library\\(_libname\\)")
+                      (string-append "\""
+                                     (search-input-file inputs
+                                                        "/lib/libportaudio.so.2")
+                                     "\""))))))))
+    (inputs (list portaudio))
+    (propagated-inputs (list python-cffi python-numpy))
+    (native-inputs (list python-setuptools))
+    (home-page "https://python-sounddevice.readthedocs.io/")
+    (synopsis "Play and record sound with Python")
+    (description "This Python module provides bindings for the PortAudio
+library and a few convenience functions to play and record NumPy arrays
+containing audio signals.")
+    (license license:expat)))
+
 (define-public wildmidi
  (package
    (name "wildmidi")
-    (version "0.4.4")
+    (version "0.4.6")
    (source
     (origin
       (method git-fetch)
@@ -262,7 +296,7 @@ promoting the market for advanced audio.")
         (commit (string-append name "-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "08fbbsvw6pkwwqarjwcvdp8mq4zn5sgahf025hynwc6rvf4sp167"))))
+        (base32 "0cc8vg2alyzakmm132vljx228arisqcnfqh8xyjnnczr5vryqa5k"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f ; No target
@@ -780,7 +814,7 @@ streams from live audio.")
 (define-public dsp
  (package
    (name "dsp")
-    (version "1.9")
+    (version "2.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -789,7 +823,7 @@ streams from live audio.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0iksmianwig7w78hqip2a8yy6r63sv8cv9pis8qxny6w1xap6njb"))))
+                "1kzjv972qbvzh7nml3brrdf6qmjmcapldbikbn2gxhpmkgxzhhar"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -872,120 +906,129 @@ purposes developed at Queen Mary, University of London.")
    (license license:gpl2+)))

 (define-public jamesdsp
-  (package
-    (name "jamesdsp")
-    (version "2.7.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri
-        (git-reference
-          (url "https://github.com/Audio4Linux/JDSP4Linux")
-          (commit version)
-          ;; Recurse GraqhicEQWidget, FlatTabWidget, LiquidEqualizerWidget and
-          ;; EELEditor.
-          (recursive? #t)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "17vx12kbvwxvb69vzrlb82mrgf6sl3plyk71g9f39p49ialdsnbr"))
-       (modules '((guix build utils)))
-       (snippet
-        ;; Unbundle 3rd party libraries.
-        '(begin
-           ;; Delete the bundled 3rd party libraries.
-           (for-each delete-file-recursively
-            (list "3rdparty"
-                  "src/subprojects/EELEditor/3rdparty"
-                  "src/subprojects/EELEditor/QCodeEditor"
-                  "src/subprojects/EELEditor/src/EELEditor-Linker.pri"))
-           (with-directory-excursion "src"
-             (substitute* "src.pro"
-               ;; Do not use bundled 3rd party libraries.
-               ((".*3rdparty.*") "")
-               ;; Link required libraries from system.
-               (("-ldl")
-                (string-join '("-ldl"
-                               "-lasync++"
-                               "-lQCodeEditor"
-                               "-lqcustomplot"
-                               "-lqtadvanceddocking-qt6"
-                               "-lqtcsv"
-                               "-lwaf")
-                               " ")))
-             ;; Fix including WAF headers.
-             (substitute* "MainWindow.cpp"
-                       (("<Animation") "<WAF/Animation"))
-             ;; Do not use resources from the bundled docking-system.
-             (substitute* '("interface/fragment/AppManagerFragment.ui")
-               ((".*location.*3rdparty.*") "")
-               ((" resource=.*>") ">"))
-             (with-directory-excursion "subprojects/EELEditor/src"
-               ;; Do not use bundled QCodeEditor and docking-system.
-               (substitute* "EELEditor.pri"
-                 ((".*(QCodeEditor|docking-system).*") ""))
-               ;; Do not link to bundled docking-system.
+  (let ((commit "53cf0989681ba38755208c8aec063f29ed8586d3")
+        (revision "0"))
+    (package
+      (name "jamesdsp")
+      (version (git-version "2.7.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri
+          (git-reference
+            (url "https://github.com/Audio4Linux/JDSP4Linux")
+            (commit commit)
+            ;; Recurse GraqhicEQWidget, FlatTabWidget, LiquidEqualizerWidget and
+            ;; EELEditor.
+            (recursive? #t)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "1b5612gr2gfmj1h5hdzfa9xxdwixia06a34n2zs04cra94clif9i"))
+         (modules '((guix build utils)))
+         (snippet
+          ;; Unbundle 3rd party libraries.
+          '(begin
+             ;; Delete the bundled 3rd party libraries.
+             (for-each delete-file-recursively
+              (list "3rdparty"
+                    "src/subprojects/EELEditor/3rdparty"
+                    "src/subprojects/EELEditor/QCodeEditor"
+                    "src/subprojects/EELEditor/src/EELEditor-Linker.pri"))
+             (with-directory-excursion "src"
               (substitute* "src.pro"
-                 ((".*EELEditor-Linker.*") ""))
-               ;; Fix including headers from the system.
-               (substitute* (find-files "." "\\.(cpp|h)$")
-                 (("#include <Dock") "#include <qtadvanceddocking-qt6/Dock")
-                 (("#include <FloatingDock")
-                  "#include <qtadvanceddocking-qt6/FloatingDock")
-                 (("#include <QSyntaxStyle")
-                  "#include <QCodeEditor/QSyntaxStyle")
-                 (("#include <QStyleSyntaxHighlighter")
-                  "#include <QCodeEditor/QStyleSyntaxHighlighter")
-                 (("#include <QHighlightRule")
-                  "#include <QCodeEditor/QHighlightRule")
-                 (("#include <QLanguage") "#include <QCodeEditor/QLanguage")
-                 (("#include <QCodeEditor\\.hpp")
-                  "#include <QCodeEditor/QCodeEditor.hpp"))))))
-       (patches (search-patches "jamesdsp-fix-bulid-on-pipewire-1.4.0.patch"))))
-    (build-system qt-build-system)
-    (arguments
-     (list #:qtbase qtbase
-           #:tests? #f ;no tests
-           #:phases
-           #~(modify-phases %standard-phases
-               ;; Configure using qmake.
-               (replace 'configure
-                 (lambda* (#:key inputs #:allow-other-keys)
-                   (invoke "qmake" (string-append "PREFIX=" #$output))))
-               (add-after 'install 'install-icon
-                 (lambda _
-                   (let ((pixmaps (string-append #$output "/share/pixmaps")))
-                     (mkdir-p pixmaps)
-                     (copy-file "resources/icons/icon.png"
-                                (string-append pixmaps "/jamesdsp.png")))))
-               (add-after 'install-icon 'create-desktop-entry-file
-                 (lambda _
-                   (make-desktop-entry-file
-                    (string-append #$output
-                                  "/share/applications/jamesdsp.desktop")
-                    #:name "JamesDSP"
-                    #:comment "Audio effect processor"
-                    #:keywords '("equalizer" "audio" "effect")
-                    #:categories '("AudioVideo" "Audio")
-                    #:exec (string-append #$output "/bin/jamesdsp")
-                    #:icon (string-append #$output "/share/pixmaps/jamesdsp.png")
-                    #:startup-notify #f))))))
-    (native-inputs
-     (list pkg-config))
-    (inputs
-     (list asyncplusplus
-           glibmm-2.66
-           libarchive
-           pipewire
-           qcodeeditor
-           qcustomplot
-           qt-advanced-docking-system
-           qtcsv
-           qtpromise
-           qtsvg
-           qtwidgetanimationframework))
-    (home-page "https://github.com/Audio4Linux/JDSP4Linux")
-    (synopsis "Audio effect processor for PipeWire and PulseAudio clients")
-    (description "JamesDSP is an audio effect processor for PipeWire and
+                 ;; Do not use bundled 3rd party libraries.
+                 ((".*3rdparty.*") "")
+                 ;; Link required libraries from system.
+                 (("-ldl")
+                  (string-join '("-ldl"
+                                 "-lasync++"
+                                 "-lQCodeEditor"
+                                 "-lqcustomplot"
+                                 "-lqtadvanceddocking-qt6"
+                                 "-lqtcsv"
+                                 "-lwaf")
+                                 " ")))
+               ;; Fix including WAF headers.
+               (substitute* "MainWindow.cpp"
+                         (("<Animation") "<WAF/Animation"))
+               ;; Do not use resources from the bundled docking-system.
+               (substitute* '("interface/fragment/AppManagerFragment.ui")
+                 ((".*location.*3rdparty.*") "")
+                 ((" resource=.*>") ">"))
+               (with-directory-excursion "subprojects/EELEditor/src"
+                 ;; Do not use bundled QCodeEditor and docking-system.
+                 (substitute* "EELEditor.pri"
+                   ((".*(QCodeEditor|docking-system).*") ""))
+                 ;; Do not link to bundled docking-system.
+                 (substitute* "src.pro"
+                   ((".*EELEditor-Linker.*") ""))
+                 ;; Fix including headers from the system.
+                 (substitute* (find-files "." "\\.(cpp|h)$")
+                   (("#include <Dock") "#include <qtadvanceddocking-qt6/Dock")
+                   (("#include <FloatingDock")
+                    "#include <qtadvanceddocking-qt6/FloatingDock")
+                   (("#include <QSyntaxStyle")
+                    "#include <QCodeEditor/QSyntaxStyle")
+                   (("#include <QStyleSyntaxHighlighter")
+                    "#include <QCodeEditor/QStyleSyntaxHighlighter")
+                   (("#include <QHighlightRule")
+                    "#include <QCodeEditor/QHighlightRule")
+                   (("#include <QLanguage") "#include <QCodeEditor/QLanguage")
+                   (("#include <QCodeEditor\\.hpp")
+                    "#include <QCodeEditor/QCodeEditor.hpp"))))))))
+      (build-system qt-build-system)
+      (arguments
+       (list #:qtbase qtbase
+             #:tests? #f ;no tests
+             #:parallel-build? #f ;fails on some systems
+             #:modules '((guix build qt-build-system)
+                         ((guix build gnu-build-system) #:prefix gnu:)
+                         (guix build utils))
+             #:phases
+             #~(modify-phases %standard-phases
+                 ;; Configure using qmake.
+                 (replace 'configure
+                   (lambda _
+                     (invoke "qmake" (string-append "PREFIX=" #$output))))
+                 (replace 'build (assoc-ref gnu:%standard-phases 'build))
+                 (replace 'check (assoc-ref gnu:%standard-phases 'check))
+                 (replace 'install (assoc-ref gnu:%standard-phases 'install))
+                 (add-after 'install 'install-icon
+                   (lambda _
+                     (let ((pixmaps (string-append #$output "/share/pixmaps")))
+                       (mkdir-p pixmaps)
+                       (copy-file "resources/icons/icon.png"
+                                  (string-append pixmaps "/jamesdsp.png")))))
+                 (add-after 'install-icon 'create-desktop-entry-file
+                   (lambda _
+                     (make-desktop-entry-file
+                      (string-append #$output
+                                    "/share/applications/jamesdsp.desktop")
+                      #:name "JamesDSP"
+                      #:comment "Audio effect processor"
+                      #:keywords '("equalizer" "audio" "effect")
+                      #:categories '("AudioVideo" "Audio")
+                      #:exec (string-append #$output "/bin/jamesdsp")
+                      #:icon (string-append #$output
+                                            "/share/pixmaps/jamesdsp.png")
+                      #:startup-notify #f))))))
+      (native-inputs
+       (list pkg-config))
+      (inputs
+       (list asyncplusplus
+             glibmm-2.66
+             libarchive
+             pipewire
+             qcodeeditor
+             qcustomplot
+             qt-advanced-docking-system
+             qtcsv
+             qtpromise
+             qtsvg
+             qtwidgetanimationframework))
+      (home-page "https://github.com/Audio4Linux/JDSP4Linux")
+      (synopsis "Audio effect processor for PipeWire and PulseAudio clients")
+      (description "JamesDSP is an audio effect processor for PipeWire and
 PulseAudio clients, featuring:
@itemize
@item Automatic bass boost: Frequency-detecting bass-boost
@@ -1007,7 +1050,7 @@ PulseAudio clients, featuring:
 dynamic code outline window, console output support and detailed error
 messages with inline code highlighting
@end itemize")
-    (license license:gpl3+)))
+      (license license:gpl3+))))

 (define ardour-bundled-media
  (origin
@@ -1158,6 +1201,16 @@ namespace ARDOUR { const char* revision = \"" version "\" ; const char* date = \
           perl
           pkg-config
           unzip))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "LADSPA_PATH")
+            (files '("lib/ladspa")))
+           (search-path-specification
+            (variable "LV2_PATH")
+            (files '("lib/lv2")))
+           (search-path-specification
+            (variable "LXVST_PATH")
+            (files '("lib/lxvst")))))
    (home-page "https://ardour.org")
    (synopsis "Digital audio workstation")
    (description
@@ -1171,7 +1224,7 @@ engineers, musicians, soundtrack editors and composers.")
 (define-public audacity
  (package
    (name "audacity")
-    (version "3.7.4")
+    (version "3.7.7")
    (source
     (origin
       (method git-fetch)
@@ -1180,7 +1233,7 @@ engineers, musicians, soundtrack editors and composers.")
             (commit (string-append "Audacity-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "184hak52p00qid0i581gky7076fl5rjxwqly0fw7ix8yi6j8li4h"))
+        (base32 "0h2xdhbx6bjhlk2mxqalpbpzjcdj0sb8wf1rp3vj0fbgvxy1y92k"))
       (patches (search-patches "audacity-ffmpeg-fallback.patch"))
       (modules '((guix build utils)))
       (snippet
@@ -1596,7 +1649,7 @@ plugins are provided.")
 (define-public cable
  (package
    (name "cable")
-    (version "0.9.8.1")
+    (version "0.9.21")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1605,10 +1658,7 @@ plugins are provided.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0pzafiim1cnxrngk6nzmpx9sx1lc6qrqjrrcxg1qpigcrjvrfjs2"))
-              (modules '((guix build utils)))
-              (snippet
-               '(delete-file-recursively "Arch packages"))))
+                "1c7fy92nwp2m96asls460s83xapzcc6pqvplmg5rqds1rddiva2h"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -1629,21 +1679,7 @@ plugins are provided.")
              (install-file "jack-plug.svg"
                            (string-append #$output "/share/icons/hicolor/scalable/apps/"))
              (install-file "com.github.magillos.cable.desktop"
-                            (string-append #$output "/share/applications/"))))
-          (add-after 'install-more 'wrap-executables
-            (lambda* (#:key inputs #:allow-other-keys)
-              (let* ((pyversion
-                      #$(version-major+minor (package-version
-                                              (this-package-input "python"))))
-                     (lib (string-append #$output "/lib/python" pyversion
-                                         "/site-packages"))
-                     (file
-                      (string-append lib "/cables/launch-connection-manager.py")))
-                (chmod file #o555)
-                (wrap-script file
-                  #:guile (search-input-file inputs "bin/guile")
-                  `("GUIX_PYTHONPATH" ":" prefix
-                    (,lib  ,(getenv "GUIX_PYTHONPATH"))))))))))
+                            (string-append #$output "/share/applications/")))))))
    (inputs
     (list python
           python-dbus
@@ -1664,7 +1700,7 @@ connections manager, pw-top wrapper, simple ALSA mixer and jack_delay GUI.")
 (define-public calf
  (package
    (name "calf")
-    (version "0.90.6")
+    (version "0.90.8")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1673,7 +1709,7 @@ connections manager, pw-top wrapper, simple ALSA mixer and jack_delay GUI.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0p4zqzr7spy3jjsmy6h7n5lsyqqyh23bswk1r3kims50b102xhxd"))))
+                "0wzkshqazw26w73h1lva5wr8v2bq0a20kjd6lfvbi1pj3ql3azk5"))))
    (build-system cmake-build-system)
    (arguments (list #:tests? #false)) ;there is no test target
    (inputs
@@ -1829,7 +1865,7 @@ reel-to-reel tape machines.")
 (define-public iir
  (package
    (name "iir")
-    (version "1.9.4")
+    (version "1.10.0")
    (source
     (origin
       (method git-fetch)
@@ -1838,7 +1874,7 @@ reel-to-reel tape machines.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1fqxn0qlvykpk9hiliivmkjjcz3g1bp83yd0zfm82r14abkjbj2g"))))
+        (base32 "0p64l0fmr7mfjhfxg6yc4f06aacbr6bb8kjmb5ffm95sq12rzdss"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -1925,7 +1961,7 @@ synthesis.")
 (define-public snapcast
  (package
    (name "snapcast")
-    (version "0.32.3")
+    (version "0.34.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1934,7 +1970,7 @@ synthesis.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "06hllji1621f29g6ymbysi1vkndjsrwj63f5ph30f6kvv3c8sqx4"))))
+                "0jqzzjw1njixapj89yvgbhk7yrfc14xsfd94pf6z6lfna8c01yq4"))))
    (build-system cmake-build-system)
    (arguments '(#:tests? #f))                    ;no included tests
    (inputs
@@ -2042,6 +2078,8 @@ emulation (valve, tape), bit fiddling (decimator, pointer-cast), etc.")
       (sha256
        (base32 "0g0yfmwmrkvrkvynx84bays6jph3wq2hq1md5ylr7n5a8g0c17hn"))))
    (build-system cmake-build-system)
+    (arguments
+     (list #:tests? #f))
    (native-inputs
     (list boost pkg-config))
    (inputs
@@ -2369,7 +2407,7 @@ the non-linear circuit elements of their original analog counterparts.")
 (define-public rev-plugins
  (package
    (name "rev-plugins")
-    (version "0.7.1")
+    (version "0.8.1")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -2378,23 +2416,24 @@ the non-linear circuit elements of their original analog counterparts.")
                    version ".tar.bz2"))
              (sha256
               (base32
-                "1ikpinxm00pkfi259bnkzhsy3miagrjgdihaaf5x4v7zac29j3g7"))))
+                "1yhnvjgr14qr0ni0n2x8dhlzbx1qfgyrnffbaaq0d5xbzfgrq543"))))
    (build-system gnu-build-system)
    (arguments
-     `(#:tests? #f ; no "check" target
-       #:phases
-       (modify-phases %standard-phases
-         ;; no configure script
-         (delete 'configure)
-         (add-before 'install 'prepare-target-directory
-           (lambda* (#:key outputs #:allow-other-keys)
-             (mkdir-p (string-append (assoc-ref outputs "out") "/lib/ladspa"))
-             #t))
-         (add-after 'unpack 'override-target-directory
-           (lambda* (#:key outputs #:allow-other-keys)
-             (substitute* "Makefile"
-               (("/usr") (assoc-ref outputs "out")))
-             #t)))))
+     (list #:tests? #f ; no "check" target
+           #:phases
+           #~(modify-phases %standard-phases
+               ;; no configure script
+               (delete 'configure)
+               (add-after 'unpack 'change-directory
+                 (lambda _
+                   (chdir "source")))
+               (add-after 'change-directory 'override-target-directory
+                 (lambda _
+                   (substitute* "Makefile"
+                     (("/usr") #$output))))
+               (add-before 'install 'prepare-target-directory
+                 (lambda _
+                   (mkdir-p (string-append #$output "/lib/ladspa")))))))
    (home-page "https://kokkinizita.linuxaudio.org")
    (synopsis "LADSPA reverb plugin")
    (description
@@ -2708,7 +2747,7 @@ also play midifiles using a Soundfont.")
 (define-public faust-2
  (package
    (inherit faust)
-    (version "2.75.7")
+    (version "2.81.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://github.com/grame-cncm/faust/"
@@ -2716,7 +2755,7 @@ also play midifiles using a Soundfont.")
                                  "/faust-" version ".tar.gz"))
              (sha256
               (base32
-                "11ww02zmj3vnva1w52hs9wkxvhwwf53agklyzm2c7gysw0jfvkw9"))))
+                "0mj7gn7xp6mzr94nqcyrrkcmzm81chq6qb1n76wspah71lw7g6f6"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -2863,7 +2902,7 @@ partial release of the General MIDI sound set.")
                    (("'rU'") "'r'")))))))
    (inputs
     (list libsndfile
-           boost
+           boost-1.83
           curl
           avahi
           eigen
@@ -3142,7 +3181,7 @@ and testing or configuring the JACK session.  Tools include @code{jack_lsp},
 (define-public jacktrip
  (package
    (name "jacktrip")
-    (version "1.6.8")
+    (version "2.7.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -3150,7 +3189,7 @@ and testing or configuring the JACK session.  Tools include @code{jack_lsp},
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
-               (base32 "0719ng799kingv0y9yk07bvnmprk25c09ph3yaia5dhapg0jz17m"))))
+               (base32 "1d9cn4nny3kbf3f9x0bcsrqb0ir1h789nv7s72xmhf7r5rfd9xm4"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -3169,10 +3208,11 @@ and testing or configuring the JACK session.  Tools include @code{jack_lsp},
           python
           python-jinja2
           python-pyyaml
-           qtbase-5
+           qtbase
+           qtwayland
           rtaudio))
    (native-inputs
-     (list pkg-config qtbase-5)) ;for qmake
+     (list pkg-config))
    (home-page "https://jacktrip.github.io/jacktrip/")
    (synopsis "Multi-machine audio system for network music performance")
    (description
@@ -3254,25 +3294,30 @@ from being able to mix multiple JACK audio streams.")
                "1q8mzjv577vdi64s47gd4pg0ydzxvs32cwrb1d64v90f52qpgbpd"))))
    (build-system meson-build-system)
    (arguments
-     `(#:tests? #f                      ; no check target
-       #:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'build-PIC
-           ;; The default -fPIE #errors when combined with our Qt packages.
-           ;; Work around the broken meson.build script clobbering c_args.
-           (lambda _
-             (substitute* "meson.build"
-               (("'-DZIX_STATIC'" match)
-                (string-append match ", '-fPIC'"))))))))
+     (list #:tests? #f                      ; no check target
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-before 'configure 'build-PIC
+                 ;; The default -fPIE #errors when combined with our Qt
+                 ;; packages.  Work around the broken meson.build script
+                 ;; clobbering c_args.
+                 (lambda _
+                   (substitute* "meson.build"
+                     (("'-DZIX_STATIC'" match)
+                      (string-append match ", '-fPIC'"))))))))
    (inputs
     (list lv2
           lilv
           suil
           gtk+
-           qtbase-5
-           jack-1))
+           jack-1
+           qtbase-5))
    (native-inputs
     (list pkg-config))
+    (native-search-paths
+     (list (search-path-specification
+            (variable "LV2_PATH")
+            (files '("lib/lv2")))))
    (home-page "https://drobilla.net/software/jalv.html")
    (synopsis "Simple LV2 host for JACK")
    (description
@@ -3536,6 +3581,7 @@ compensation, (de)interleaving, and byte-swapping
    (build-system pyproject-build-system)
    (arguments
     (list
+      #:tests? #f ;no test target
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'find-library
@@ -3725,13 +3771,13 @@ CFFI and NumPy.")
 (define-public python-soxr
  (package
    (name "python-soxr")
-    (version "0.5.0.post1")
+    (version "1.0.0")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "soxr" version))
       (sha256
-        (base32 "0wzz7j0z814mm99xr19vfrwp2x904lbwhf513x7085m4x3rvk4kh"))))
+        (base32 "02a5balcm8dvlb938gl2k3kqvfdq1k300j2g0dbnkg2rsv0yczp0"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -3759,7 +3805,6 @@ CFFI and NumPy.")
                         python-scikit-build-core
                         python-setuptools
                         python-setuptools-scm
-                         python-sphinx
                         python-typing-extensions
                         python-wheel))
    (home-page "https://github.com/dofuuz/python-soxr")
@@ -4427,7 +4472,7 @@ link REQUIRED)"))))))
                  eudev                 ;for user interactions with devices
                  avahi                 ;zeroconf service discovery support
                  icu4c
-                  boost
+                  boost-1.83
                  boost-sync
                  yaml-cpp
                  python-wrapper        ;there were warnings in the build process
@@ -4609,21 +4654,21 @@ tempo and pitch of an audio recording independently of one another.")
 (define-public rtmidi
  (package
    (name "rtmidi")
-    (version "5.0.0")
+    (version "6.0.0")
    (source (origin
              (method url-fetch)
-              (uri (string-append "https://www.music.mcgill.ca/~gary/rtmidi"
+              (uri (string-append "https://caml.music.mcgill.ca/~gary/rtmidi"
                                  "/release/rtmidi-" version ".tar.gz"))
              (file-name (string-append "rtmidi-" version ".tar.gz"))
              (sha256
               (base32
-                "1ff2yfq3k4l209fr71v3w98fpjjv1chs09vkbmxj03lcikahxns8"))))
+                "0nyvck6qlncbfpplgxspjk77fmi05w78ik0cf8039hj29gvcqq2r"))))
    (build-system gnu-build-system)
    (inputs
     (list alsa-lib jack-2))
    (native-inputs
     (list autoconf automake libtool pkg-config))
-    (home-page "https://www.music.mcgill.ca/~gary/rtmidi")
+    (home-page "https://caml.music.mcgill.ca/~gary/rtmidi")
    (synopsis "Cross-platform MIDI library for C++")
    (description
     "RtMidi is a set of C++ classes (RtMidiIn, RtMidiOut, and API specific
@@ -5966,7 +6011,7 @@ kbps at 24 bit/96 kHz.")
 (define-public bluez-alsa
  (package
    (name "bluez-alsa")
-    (version "3.0.0")
+    (version "4.3.1")
    (source (origin
              ;; The tarballs are mere snapshots and don't contain a
              ;; bootstrapped build system.
@@ -5977,7 +6022,7 @@ kbps at 24 bit/96 kHz.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1jlsgxyqfhncfhx1sy3ry0dp6p95kd4agh7g2b7g51h0c4cv74h8"))))
+                "05qzmcsihhd92vpjd45qr0gdzfqiw4jfcdjdg78mzimv9g5g3rjm"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
@@ -5989,7 +6034,12 @@ kbps at 24 bit/96 kHz.")
                            (assoc-ref %outputs "out")
                            "/etc/dbus-1/system.d"))))
    (native-inputs
-     (list autoconf automake libtool pkg-config))
+     (list autoconf
+           automake
+           `(,glib "bin")
+           libtool
+           pkg-config
+           python-minimal))
    (inputs
     (list alsa-lib
           bluez
@@ -6077,26 +6127,50 @@ customized and extended using either the s7 Scheme implementation (included in
 the Snd sources), Ruby, or Forth.")
    (license (license:non-copyleft "file://COPYING"))))

+(define-public libspecbleach
+  (package
+    (name "libspecbleach")
+    (version "0.1.6")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/lucianodato/libspecbleach")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0czmzhggg5gl833karfrl2c0pr2k3jf7q7jd3y68hyj0cnn6f3jg"))))
+    (build-system meson-build-system)
+    (native-inputs
+     (list pkg-config))
+    (inputs
+     (list fftwf))
+    (home-page "https://github.com/lucianodato/libspecbleach")
+    (synopsis "C library for audio noise reduction and other spectral effects")
+    (description
+     "This package provides a C library for audio noise reduction and other
+spectral effects.  It is based on the algorithms that were used in
+@code{noise-repellent}.  These were extracted into a this standalone library to
+remove the lv2 dependency.  It uses the concept of a spectral processor which
+itself uses a @acronym{STFT, short time Fourier transform} to process the audio.")
+    (license license:lgpl2.1+)))
+
 (define-public noise-repellent
  (package
    (name "noise-repellent")
-    (version "0.1.5")
+    (version "0.2.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/lucianodato/noise-repellent")
-                    (commit version)))
-              (file-name (string-append name "-" version "-checkout"))
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0hb89x9i2knzan46q4nwscf5zmnb2nwf4w13xl2c0y1mx1ls1mwl"))))
+                "0dq0rv7mndw0lqacl2nf9dmj4zzq19hfminzk3fzbppk5mh2rivp"))))
    (build-system meson-build-system)
-    (arguments
-     `(#:configure-flags
-       (list (string-append "--prefix=" (assoc-ref %outputs "out")
-                            "/lib/lv2"))))
    (inputs
-     (list lv2 fftwf))
+     (list fftwf libspecbleach lv2))
    (native-inputs
     (list pkg-config))
    (home-page "https://github.com/lucianodato/noise-repellent")
@@ -6120,6 +6194,41 @@ the following features:
 ")
    (license license:lgpl3+)))

+(define-public normalize
+  (package
+    (name "normalize")
+    (version "0.7.7")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "http://download.savannah.gnu.org/releases/normalize/normalize-"
+             version ".tar.gz"))
+       (sha256
+        (base32 "1n5khss10vjjp6w69q9qcl4kqfkd0pr555lgqghrchn6rjms4mb0"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:make-flags
+      #~(list "CFLAGS=-g -O2 -Wno-error=implicit-function-declaration")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'patch-shell-path
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "test/Makefile.in"
+                (("/bin/sh")
+                 (search-input-file inputs "/bin/sh"))))))))
+    (inputs (list libmad))
+    (home-page "https://normalize.nongnu.org/")
+    (synopsis "Audio track volume normalizer")
+    (description
+     "@code{normalize} is an audio track normalizer.
+For a collection of tracks with varying volumes, it is able to
+make the loudness consistent between them.  This is helpful
+when making mixtapes, for example.
+It can work with WAV and MP3 files.")
+    (license license:gpl2)))
+
 (define-public lv2-speech-denoiser
  (let ((commit "04cfba929630404f8d4f4ca5bac8d9b09a99152f")
        (revision "1"))
@@ -6220,7 +6329,7 @@ representations.")
 (define-public cava
  (package
    (name "cava")
-    (version "0.10.4")
+    (version "0.10.6")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -6229,7 +6338,7 @@ representations.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "09wwzqynfmdzn77vxxmrw2z0yz95p4zg9cgfp9vnpv70visi98d0"))))
+                "12ysxbm1di2m0qac4rgd5f94fvlxv64s7kyy5s0d2bbxyzvdcqvm"))))
    (build-system gnu-build-system)
    (native-inputs (list autoconf automake libtool pkg-config))
    (inputs (list alsa-lib fftw ncurses pipewire pulseaudio iniparser
@@ -6480,7 +6589,7 @@ other Gnaural instances, allowing synchronous sessions between many users.")
 (define-public darkice
  (package
    (name "darkice")
-    (version "1.4")
+    (version "1.5")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://github.com/rafael2k/darkice/releases/"
@@ -6488,7 +6597,7 @@ other Gnaural instances, allowing synchronous sessions between many users.")
                                  version ".tar.gz"))
              (sha256
               (base32
-                "05yq7lggxygrkd76yiqby3msrgdn082p0qlvmzzv9xbw8hmyra76"))))
+                "13h58skz5xik75sjv9kf2299haly2nc5gswl22ff1kvw79bw9d0q"))))
    (build-system gnu-build-system)
    (native-inputs (list pkg-config))
    (inputs (list lame
@@ -7302,14 +7411,14 @@ while still staying in time.")
 (define-public butt
  (package
    (name "butt")
-    (version "0.1.38")
+    (version "1.45.0")
    (source (origin
              (method url-fetch)
-              (uri (string-append "mirror://sourceforge/butt/butt/butt-"
+              (uri (string-append "https://danielnoethen.de/butt/release/"
                                  version "/butt-" version ".tar.gz"))
              (sha256
               (base32
-                "10i3xpxzccdl4pidiyymw9cfavhy50yhn7xi5bd77y91f2903kp9"))
+                "0r43xph6xf02c9zldhyj82mvy82xv0f9wbv653gg2kkcjh88ajc8"))
              (modules '((guix build utils)))
              (snippet
               '(substitute* "src/butt.cpp"
@@ -7320,19 +7429,21 @@ while still staying in time.")
           #~(modify-phases %standard-phases
               (add-after 'install 'install-documentation
                 (lambda _
-                   (let ((doc (string-append #$output "/share/doc/" #$name)))
+                   (let ((doc (string-append #$output:doc "/share/doc/" #$name)))
                     (install-file "README" doc)
                     (copy-file #$(this-package-native-input "manual")
                                (string-append doc "/butt-manual.pdf"))))))))
+    (outputs '("out" "doc"))
    (native-inputs
     `(("pkg-config" ,pkg-config)
       ("manual"
        ,(origin
           (method url-fetch)
-           (uri (string-append "https://danielnoethen.de/butt/butt-"
+           (uri (string-append "https://danielnoethen.de/butt/release/" version
+                               "/butt-"
                               version "_manual.pdf"))
           (sha256
-            (base32 "04aixxqshfj11ja3ifh0zvywl2mqzmymppcd0xj8sv0j7whjibaq"))))))
+            (base32 "07mr25k26xrpns3s7ci27jmp71c49a23r0mi662ir5v35rz4bf4q"))))))
    (inputs
     (list curl
           dbus
@@ -7350,7 +7461,8 @@ while still staying in time.")
           libogg
           openssl
           opus
-           portaudio))
+           portaudio
+           portmidi-2))
    (home-page "https://danielnoethen.de/butt/")
    (synopsis "Audio streaming tool")
    (description "Butt is a tool to stream audio to a ShoutCast or
@@ -7484,7 +7596,7 @@ Home Page}.")
 (define-public python-librosa
  (package
    (name "python-librosa")
-    (version "0.10.2.post1")
+    (version "0.11.0")
    (source
     (origin
       (method git-fetch)
@@ -7494,7 +7606,7 @@ Home Page}.")
             ;; For test files.
             (recursive? #true)))
       (sha256
-        (base32 "1x37148y1rh4sq2nc59iw9jlza3zwawxnlb7bd9w36an05aclmnh"))))
+        (base32 "065x43hx670rjrclxi4hiqxscllb16v9s7myjvg7rd5pd3y0k7sg"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -7623,7 +7735,7 @@ and DSD streams.")
 (define-public qpwgraph
  (package
    (name "qpwgraph")
-    (version "0.9.6")
+    (version "0.9.7")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -7632,7 +7744,7 @@ and DSD streams.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "17f84qp0vphw0qbgi4yzvws19cw1lppn5r35niy032gw8qr7l6nf"))))
+                "1j3na9svy0rvz84rl9g2szl3rqxfyi5rqk1i12hdiwnyi6q7ppxi"))))
    (build-system cmake-build-system)
    (arguments
     (list #:tests? #f))                ; no tests
@@ -7828,7 +7940,7 @@ verifies checksums.")
           fmt
           gsl
           gtk
-           json-modern-cxx ;nlohmann_json
+           nlohmann-json
           libadwaita
           libbs2b
           libebur128
@@ -221,8 +221,13 @@ YubiKey into your existing user authentication infrastructure.")
       (sha256
        (base32 "1mdj1wj0adcnx354fs17928yn2xfr1hj5mfraq282dagi873sqw3"))))
    (build-system gnu-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'force-reconfigure
+           (lambda _ (delete-file "configure"))))))
    (native-inputs
-     (list pkg-config))
+     (list autoconf automake libtool pkg-config))
    (inputs
     (list linux-pam))
    (home-page "https://pamtester.sourceforge.net/")
@@ -205,11 +205,24 @@ mirror_directory (const char *source, const char *target,
 	  /* Create the mount point.  */
 	  int err = firmlink (abs_source, entry, new_entry);

+	  int is_directory = 0;
+	  if (entry->d_type == DT_UNKNOWN)
+	    {
+	      struct stat statbuf;
+	      if (fstatat (dir_fd, entry->d_name, &statbuf,
+			   AT_SYMLINK_NOFOLLOW) < 0)
+		assert_perror (errno);
+	      if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
+		is_directory = 1;
+	    }
+	  else if (entry->d_type == DT_DIR)
+	    is_directory = 1;
+
 	  /* It used to be that only directories could be bind-mounted.  Thus,
 	     keep going if we fail to bind-mount a non-directory entry.
 	     That's OK because regular files in the root file system are
 	     usually uninteresting.  */
-	  if (err != 0 && entry->d_type != DT_DIR)
+	  if (err != 0 && is_directory == 0)
 	    assert_perror (errno);

 	  free (new_entry);
@@ -574,13 +574,13 @@ rsnapshot uses hard links to deduplicate identical files.")
 (define-public borg
  (package
    (name "borg")
-    (version "1.4.1")
+    (version "1.4.3")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "borgbackup" version))
       (sha256
-        (base32 "0f9qj05i02aj17lhk97fqyknb1jx3h9xr8d569mhp44xq7qziyxq"))
+        (base32 "07s4jqcv03s98hi6lvqpvmnnhl532qnvv11mjy2xc08rbmsgmfvr"))
       (snippet
        #~(begin
            ;; Delete files generated by Cython.  We used to have a regex that
@@ -1001,38 +1001,6 @@ restic's REST backend API.  It provides a secure and efficient way to backup
 data remotely, using the restic backup client and a @code{rest:} URL.")
    (license license:bsd-2)))

-(define-public zbackup
-  (package
-    (name "zbackup")
-    (version "1.4.4")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/zbackup/zbackup")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "14l1kyxg7pccpax3d6qcpmdycb70kn3fxp1a59w64hqy2493hngl"))))
-    (build-system cmake-build-system)
-    (arguments
-     `(#:tests? #f))                    ;no test
-    (inputs
-     (list lzo libressl protobuf-3.6 xz zlib))
-    (home-page "http://zbackup.org")
-    (synopsis "Versatile deduplicating backup tool")
-    (description
-     "ZBackup is a globally-deduplicating backup tool, based on the
-ideas found in Rsync.  Feed a large @file{.tar} into it, and it will
-store duplicate regions of it only once, then compress and optionally
-encrypt the result.  Feed another @file{.tar} file, and it will also
-re-use any data found in any previous backups.  This way only new
-changes are stored, and as long as the files are not very different,
-the amount of storage required is very low.  Any of the backup files
-stored previously can be read back in full at any time.  The program
-is format-agnostic, so you can feed virtually any files to it.")
-    (license license:gpl2+)))
-
 (define-public dump
  (package
    (name "dump")
@@ -1241,39 +1209,42 @@ compression parameters used by Gzip.")
 (define-public borgmatic
  (package
    (name "borgmatic")
-    (version "2.0.7")
+    (version "2.0.13")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "borgmatic" version))
+       ;; PyPI archive does not contain NEWS file needed for one test.
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://projects.torsion.org/borgmatic-collective/borgmatic")
+              (commit version)))
+       (file-name (git-file-name name version))
       (sha256
-        (base32 "01l44ny2zyn7x1hhbvhhhwr12jipcjxl3j1cz13kf6c3bdfwms8y"))))
+        (base32
+         "05w3j4knhsg4w0a0yrz8c7lvz3vp3nf95ddmql9i8mqknjqddm1v"))))
    (build-system pyproject-build-system)
    (arguments
     (list
-      ;; XXX: all tests fail with error: AttributeError: module
-      ;; '_pytest.runner' has no attribute 'call_runtest_hook'.
-      #:tests? #f
-      #:phases #~(modify-phases %standard-phases
-                   (add-after 'unpack 'configure
-                     (lambda* (#:key inputs #:allow-other-keys)
-                       ;; Set absolute store path to borg.
-                       (substitute* "borgmatic/commands/borgmatic.py"
-                         (("\\.get\\('local_path', 'borg'\\)")
-                          (string-append ".get('local_path', '"
-                                         (search-input-file inputs "bin/borg")
-                                         "')")))
-                       (substitute* "tests/unit/commands/test_borgmatic.py"
-                         (("(module.get_local_path.+ == )'borg'" all start)
-                          (string-append start "'"
-                                         (search-input-file inputs "bin/borg")
-                                         "'")))))
-                   (add-before 'check 'set-path
-                     (lambda _
-                         ;; Tests require the installed executable.
-                         (setenv "PATH"
-                                 (string-append #$output "/bin" ":"
-                                                (getenv "PATH"))))))))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'configure
+            (lambda* (#:key inputs #:allow-other-keys)
+              ;; Set absolute store path to borg.
+              (substitute* "borgmatic/commands/borgmatic.py"
+                (("\\.get\\('local_path', 'borg'\\)")
+                 (string-append ".get('local_path', '"
+                                (search-input-file inputs "bin/borg")
+                                "')")))
+              (substitute* "tests/unit/commands/test_borgmatic.py"
+                (("(module.get_local_path.+ == )'borg'" all start)
+                 (string-append start "'"
+                                (search-input-file inputs "bin/borg")
+                                "'")))))
+          (add-before 'check 'set-path
+            (lambda _
+              ;; Tests require the installed executable.
+              (setenv "PATH"
+                      (string-append #$output "/bin" ":"
+                                     (getenv "PATH"))))))))
    (native-inputs
     (list python-flexmock
           python-pytest
@@ -1298,7 +1269,7 @@ borgmatic is powered by borg.")
 (define-public vorta
  (package
    (name "vorta")
-    (version "0.10.3")
+    (version "0.11.1")
    ;; The test folder is not included in the PyPI archive.
    (source (origin
              (method git-fetch)
@@ -1308,7 +1279,7 @@ borgmatic is powered by borg.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0b4042a0lpbmwlmbh5559b2x9vr2055w6jjrs7088n45d7rkn4sn"))))
+                "16r9ch80i6nfngah634id16fqnmn62ayh60j62zxn5cfivcn3wsq"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -264,6 +264,12 @@ implementation offers several extensions over the standard utility.")
                     ",!chained renames"
                     ",!Directory"
                     "'"))))
+          ;; 'storing sparse files > 8G' fails on powerpc-linux, likely
+          ;; due to the small HDD and RAM present on these devices.
+          ((target-ppc32?)
+           '(#:make-flags (list (string-append "TESTSUITEFLAGS= -k "
+                                               "'!tricky time stamps"
+                                               ",!storing sparse files > 8G'"))))
          ;; https://lists.gnu.org/archive/html/bug-tar/2021-10/msg00007.html
          ;; tar-1.34 isn't aware of 64-bit time_t and upstream suggests
          ;; skipping the test for this release on 32-bit systems.
@@ -435,9 +435,8 @@ setup against another one.")
    (native-inputs
     (list coreutils
           python-lxml
-           python-nose
-           python-setuptools
-           python-wheel))
+           python-pynose
+           python-setuptools))
    (home-page "https://github.com/sosy-lab/benchexec/")
    (synopsis "Framework for Reliable Benchmarking")
    (description
@@ -23,6 +23,7 @@
 ;;; Copyright © 2025 Tomas Volf <~@wolfsden.cz>
 ;;; Copyright © 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2025 Junker <dk@junkeria.club>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -85,6 +86,7 @@
  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-web)
  #:use-module (gnu packages python-xyz)
+  #:use-module (gnu packages serialization)
  #:use-module (gnu packages qt)
  #:use-module (gnu packages sqlite)
  #:use-module (gnu packages ssh)
@@ -221,6 +223,49 @@ of the Transmission BitTorrent client, using its HTTP RPC protocol.")
    (home-page "https://github.com/transmission-remote-gtk/transmission-remote-gtk")
    (license l:gpl2+)))

+(define-public stig
+  (package
+    (name "stig")
+    (version "0.14.1a0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/rndusr/stig")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0196brcasdyn0mx3h2cqlgrx8x9fyv2n7bmx13nj58vnf3y4c1hg"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:tests? #f ;tests require network access
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'loosen-version-restrictions
+            (lambda _
+              (substitute* "setup.py"
+                (("urwidtrees==1.0.3")
+                 "urwidtrees>=1.0.3")))))))
+    (propagated-inputs
+     (list python-urwid
+           python-urwidtrees
+           python-aiohttp
+           python-aiohttp-socks
+           python-pyxdg
+           python-blinker
+           python-natsort
+           python-async-timeout
+           python-setproctitle))
+    (inputs (list python))
+    (native-inputs (list python-setuptools))
+    (synopsis "TUI and CLI for the BitTorrent client Transmission")
+    (description
+     "Stig is a @acronym{TUI, Text User Interface} and @acronym{CLI, Command
+Line Interface} client for the BitTorrent client Transmission.")
+    (home-page "https://github.com/rndusr/stig")
+    (license l:gpl3)))
+
 (define-public libtorrent
  (package
    (name "libtorrent")
@@ -482,7 +527,7 @@ and will take advantage of multiple processor cores where possible.")
                          "-E" exclude-regex
                          "-j" jobs
                          "--output-on-failure"))))))))
-    (inputs (list boost openssl))
+    (inputs (list boost-1.83 openssl))
    (native-inputs
     (list libfaketime
           python-wrapper
@@ -495,20 +540,6 @@ focusing on efficiency and scalability.  It runs on embedded devices as well as
 desktops.")
    (license l:bsd-2)))

-(define-public libtorrent-rasterbar-1.2
-  (package
-    (inherit libtorrent-rasterbar)
-    (version "1.2.20")
-    (source
-     (origin
-       (method url-fetch)
-       (uri
-        (string-append "https://github.com/arvidn/libtorrent/"
-                       "releases/download/v" version "/"
-                       "libtorrent-rasterbar-" version ".tar.gz"))
-       (sha256
-        (base32 "1z5rdynzxcm6wb7v48ssfbwjairbjacb8rjix5fn70fw4668xgyc"))))))
-
 (define-public qbittorrent
  (package
    (name "qbittorrent")
@@ -32,6 +32,7 @@
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system copy)
+  #:use-module (guix build-system emacs)
  #:use-module (guix build-system gnu)
  #:use-module (guix deprecation)
  #:use-module (guix download)
@@ -158,9 +159,6 @@ core computer science concepts such as abstraction in programming,
 metalinguistic abstraction, recursion, interpreters, and modular programming.")
      (license license:cc-by-sa4.0))))

-;; It may be removed after 2025-12-19.
-(define-deprecated/public-alias sicp book-sicp)
-
 (define-public book-sparc
  (package
    (name "book-sparc")
@@ -333,3 +331,40 @@ display bibles, commentaries, dictionaries, and other texts and images.
 Xiphos includes features such as searching, biblesync, bookmarks,
 parallel study, and original language study.")
    (license license:gpl2+)))
+
+(define-public book-emacs-lisp-elements
+  (package
+    (name "book-emacs-lisp-elements")
+    (version "2.0.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/protesilaos/emacs-lisp-elements")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0774zycgx3zspn6f8pszap1751xgrlv2h3x66kksnj589nfnwzil"))))
+    (build-system emacs-build-system)
+    (arguments
+     (list
+      #:tests? #f ;No code —no tests
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'install 'makeinfo
+            (lambda _
+              (emacs-makeinfo "elispelem.org"))))))
+    (native-inputs (list texinfo))
+    (home-page "https://protesilaos.com/emacs/emacs-lisp-elements")
+    (synopsis "Overview of the Emacs Lisp programming language")
+    (description
+     "Emacs Lisp Elements is a book written by Protesilaos Stavrou, providing
+a big picture view of the @acronym{Elisp, Emacs Lisp} programming language by
+combining prose with code.  This book aims to provide an idea of how Elisp
+works by showing some of the main concepts and patterns encountered in
+everyday Elisp code.
+
+This book is not intended as a replacement for the built-in Emacs Lisp
+Reference Manual, but instead to give readers enough information to reason
+about Elisp code.")
+    (license license:fdl1.3+)))
@@ -8,10 +8,10 @@
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2018, 2020, 2023 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2018, 2020, 2023, 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2018, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
-;;; Copyright © 2019, 2020 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2019, 2020 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2020, 2022 Marius Bakke <marius@gnu.org>
 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;; Copyright © 2020, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
@@ -69,22 +69,15 @@
 (define-public boost
  (package
    (name "boost")
-    (version "1.83.0")
+    (version "1.89.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://archives.boost.io/release/"
                                  version "/source/boost_"
                                  (version-with-underscores version) ".tar.bz2"))
-              (patches
-                (append
-                 (search-patches "boost-fix-duplicate-definitions-bug.patch")
-                 (list (boost-patch
-                        "0001-unordered-fix-copy-assign.patch" version
-                        "09j61m5xh7099k5na9i43x5rra51znf7vm2nyh89yqpizcll9q66"))))
-              (patch-flags '("-p2"))
              (sha256
               (base32
-                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34"))))
+                "0yhcb8dn7g5k9dfr54j99wpd4qwk59g1lpp8z0ag7d114si3z8w5"))))
    (build-system gnu-build-system)
    (inputs
     (append
@@ -133,16 +126,54 @@
                        "binary-format=elf"
                        "target-os=linux"
                        #$@(cond
+                            ((string-prefix? "x86_64" (%current-target-system))
+                             #~()) ; Implies boost.stacktrace.from_exception=on
+                            ;;; Note: With llvm's libc++, enabling that for
+                            ;;; non-x86_64 non-mingw32 would be a bad idea.
+                            ;;; libc++'s backtrace is not thread-safe and
+                            ;;; would leak then.
+                            ;;;
+                            ;;; We disable it here completely.  Alternatively,
+                            ;;; we could disable it only if the user used
+                            ;;; (package-with-c-toolchain ... clang) or
+                            ;;; otherwise has libc++ in their dependencies.
+                            ;;;
+                            ;;; In the latter case, we would have to set
+                            ;;; BOOST_STACKTRACE_LIBCXX_RUNTIME_MAY_CAUSE_MEMORY_LEAK
+                            ;;; and that seems ill-advised (if a future
+                            ;;; update broke it in other ways, we would
+                            ;;; be blind to it).
+                            ;;;
+                            ;;; See also:
+                            ;;; <https://codeberg.org/guix/guix/issues/4541>.
                            ((string-prefix? "arm" (%current-target-system))
                             #~("abi=aapcs"
                                "address-model=32"
-                                "architecture=arm"))
+                                "architecture=arm"
+                                ;; See also:
+                                ;; <https://codeberg.org/guix/guix/issues/4541>.
+                                "boost.stacktrace.from_exception=off"))
                            ((string-prefix? "aarch64" (%current-target-system))
                             #~("abi=aapcs"
                                "address-model=64"
-                                "architecture=arm"))
-                            (else #~())))
-                     #~()))
+                                "architecture=arm"
+                                ;; See also:
+                                ;; <https://codeberg.org/guix/guix/issues/4541>.
+                                "boost.stacktrace.from_exception=off"))
+                            (else
+                             ;; See also:
+                             ;; <https://codeberg.org/guix/guix/issues/4541>.
+                             #~("boost.stacktrace.from_exception=off"))))
+                     ;; Not cross-compiling.
+                     #~(#$@(cond
+                         ((string-suffix? "mingw32" (%current-system))
+                          #~()) ; Implies boost.stacktrace.from_exception=on
+                         ((string-prefix? "x86_64" (%current-system))
+                          #~()) ; Implies boost.stacktrace.from_exception=on
+                         (else
+                          ;; See also:
+                          ;; <https://codeberg.org/guix/guix/issues/4541>.
+                          #~("boost.stacktrace.from_exception=off"))))))
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'patch-shells
@@ -208,7 +239,22 @@ across a broad spectrum of applications.")
    (license (license:x11-style "https://www.boost.org/LICENSE_1_0.txt"
                                "Some components have other similar licences."))))

-(define-public boost-for-source-highlight
+(define-public boost-1.88
+  (package
+    (inherit boost)
+    (name "boost")
+    (version "1.88.0")
+    (source (origin
+              (inherit (package-source boost))
+              (uri (string-append
+                    "https://archives.boost.io/release/"
+                    version "/source/boost_"
+                    (version-with-underscores version) ".tar.bz2"))
+              (sha256
+               (base32
+                "0yrgn6syk260ckq9ld44vjv1bl6bamhy3jbp10kikcipcv0d5na6"))))))
+
+(define-public boost-1.83
  (hidden-package (package (inherit boost)
    (name "boost")
    (version "1.83.0")
@@ -224,7 +270,33 @@ across a broad spectrum of applications.")
              (patch-flags '("-p2"))
              (sha256
               (base32
-                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34")))))))
+                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments boost)
+      ((#:make-flags _ #f)
+       #~(list "threading=multi" "link=shared"
+              ;; Set the RUNPATH to $libdir so that the libs find each other.
+              (string-append "linkflags=-Wl,-rpath="
+                             #$output "/lib")
+              #$@(if (%current-target-system)
+                     #~("--user-config=user-config.jam"
+                        ;; Python is not supported when cross-compiling.
+                        "--without-python"
+                        "binary-format=elf"
+                        "target-os=linux"
+                        #$@(cond
+                            ((string-prefix? "arm" (%current-target-system))
+                             #~("abi=aapcs"
+                                "address-model=32"
+                                "architecture=arm"))
+                            ((string-prefix? "aarch64" (%current-target-system))
+                             #~("abi=aapcs"
+                                "address-model=64"
+                                "architecture=arm"))
+                            (else
+                             #~())))
+                     ;; Not cross-compiling.
+                     #~()))))))))

 (define-deprecated-package boost-with-python3
  boost)
@@ -292,7 +364,7 @@ across a broad spectrum of applications.")

 (define-public boost-numpy
  (package
-    (inherit boost)
+    (inherit boost-1.83)
    (name "boost-numpy")
    (native-inputs
     (modify-inputs (package-native-inputs boost)
@@ -399,7 +471,7 @@ signals and slots system.")
    (build-system gnu-build-system)
    (native-inputs (list autoconf automake))
    (propagated-inputs
-      (list boost)) ; inclusion of header files
+      (list boost-1.83)) ; inclusion of header files
    (home-page "https://gitlab.com/mdds/mdds")
    (synopsis "Multi-dimensional C++ data structures and indexing algorithms")
    (description "Mdds (multi-dimensional data structure) provides a
@@ -24,6 +24,7 @@
 ;;; Copyright © 2025 Esther Flashner <esther@flashner.co.il>
 ;;; Copyright © 2025 André Batista <nandre@riseup.net>
 ;;; Copyright © 2025 dan <i@dan.games>
+;;; Copyright © 2025 Jiyu Software <info@jiyu.dev>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -863,7 +864,17 @@ tree binary files.  These are board description files used by Linux and BSD.")
       (sha256
        (base32 "1i1v86bnixh8hyqbwwr5iwdnnadmg2fqxw9g526fvclsbvl8lz0v"))
       (patches (search-patches "u-boot-allow-disabling-openssl.patch"
-                                "u-boot-rockchip-inno-usb.patch"))))
+                                "u-boot-rockchip-inno-usb.patch"))
+       (snippet
+        ;; Remove non-free binary licenses, blobs and microcode.
+        #~(begin
+           (use-modules (guix build utils))
+           (for-each delete-file
+                   '("Licenses/r8a779x_usb3.txt"
+                     "drivers/usb/host/xhci-rcar-r8a779x_usb3_v3.h"
+                     "arch/mips/mach-octeon/include/mach/cvmx-pki-cluster.h"))
+           (for-each delete-file
+                   (find-files "arch/x86/dts/microcode/" "\\.dtsi$"))))))
    (build-system gnu-build-system)
    (native-inputs
     (list bison
@@ -2,6 +2,7 @@
 ;;; Copyright © 2022 Christopher Rodriguez <yewscion@gmail.com>
 ;;; Copyright © 2022 Liliana Marie Prikler <liliana.prikler@gmail.com>
 ;;; Copyright © 2025 Lee Thompson <lee.p.thomp@gmail.com>
+;;; © 2025 case_lambda <case_lambda@disroot.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -36,77 +37,71 @@
  #:use-module (gnu packages compression))

 (define-public dbqn
-  (let ((commit "88f2b43966a75cc2c382421218eb30003bb16f4a")
-        (revision "1"))
-    (package
-      (name "dbqn")
-      (version (git-version "0.2.1" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/dzaima/BQN")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "06mzvv7kmandhgwb6jwz3rivsj4ic549sy8afnb5zr6mfn5isyg5"))))
-      (build-system gnu-build-system)
-      (arguments
-       (list
-        #:imported-modules `(,@%default-gnu-imported-modules
-                             (guix build ant-build-system))
-        #:modules `((guix build gnu-build-system)
-                    ((guix build ant-build-system)
-                     #:prefix ant:)
-                    (guix build utils))
-        #:phases #~(modify-phases %standard-phases
-                     (delete 'configure)
-                     (replace 'build
-                       (lambda* _
-                         (invoke "./build")
-                         (chmod "./BQN" #o755)))
-                     (replace 'check
-                       (lambda* (#:key tests? #:allow-other-keys)
-                         (when tests?
-                           (system "./BQN ./test/test"))))
-                     (add-after 'install 'reorder-jar-content
-                       (lambda* (#:key outputs #:allow-other-keys)
-                         (apply (assoc-ref ant:%standard-phases
-                                           'reorder-jar-content)
-                                #:outputs (list outputs))))
-                     (add-after 'reorder-jar-content 'jar-indices
-                       (lambda* (#:key outputs #:allow-other-keys)
-                         (apply (assoc-ref ant:%standard-phases
-                                           'generate-jar-indices)
-                                #:outputs (list outputs))))
-                     (add-after 'jar-indices 'fix-jar-timestamps
-                       (lambda* (#:key outputs #:allow-other-keys)
-                         (apply (assoc-ref ant:%standard-phases
-                                           'reorder-jar-content)
-                                #:outputs (list outputs))))
-                     (replace 'install
-                       (lambda* (#:key outputs #:allow-other-keys)
-                         (let* ((out (assoc-ref outputs "out"))
-                                (dest-bin (string-append out "/bin"))
-                                (dest-jar (string-append out "/share/java")))
-                           (mkdir-p dest-bin)
-                           (mkdir-p dest-jar)
-                           (rename-file "BQN" "dbqn")
-                           (install-file "dbqn" dest-bin)
-                           (install-file "BQN.jar" dest-jar)
-                           (substitute* (string-append dest-bin "/dbqn")
-                             (("BQN.jar")
-                              (string-append dest-jar "/BQN.jar")))))))))
-      (native-inputs (list `(,icedtea-8 "jdk") zip))
-      (inputs (list icedtea-8 bash-minimal))
-      (synopsis "BQN implementation based on dzaima/APL")
-      (description
-       "dbqn is a Java implementation of the
+  (package
+    (name "dbqn")
+    (version "0.2.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/dzaima/BQN")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zy3y9wbmaw0mrd2sp7d1r912gvs9k0mzw5d3drgmbzkbvpd6iq1"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:imported-modules `((guix build ant-build-system)
+                           ,@%default-gnu-imported-modules)
+      #:modules '((guix build gnu-build-system)
+                  ((guix build ant-build-system)
+                   #:prefix ant:)
+                  (guix build utils))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (replace 'build
+            (lambda _
+              (invoke "./build")))
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (if tests?
+                  (invoke "./BQN" "./test/test")
+                  (begin
+                    (display "test suite not run")
+                    (newline)))))
+          (add-after 'install 'reorder-jar-content
+            (assoc-ref ant:%standard-phases
+                       'reorder-jar-content))
+          (add-after 'reorder-jar-content 'generate-jar-indices
+            (assoc-ref ant:%standard-phases
+                       'generate-jar-indices))
+          (add-after 'generate-jar-indices 'strip-jar-timestamps
+            (assoc-ref ant:%standard-phases
+                       'strip-jar-timestamps))
+          (replace 'install
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let ((dest-jar (string-append #$output "/share/java")))
+                (rename-file "BQN" "dbqn")
+                (substitute* "dbqn"
+                  (("java")
+                   (search-input-file inputs "/bin/java"))
+                  (("BQN.jar")
+                   (string-append dest-jar "/BQN.jar")))
+                (install-file "BQN.jar" dest-jar)
+                (install-file "dbqn"
+                              (string-append #$output "/bin"))))))))
+    (native-inputs (list `(,icedtea-8 "jdk") zip))
+    (inputs (list bash-minimal icedtea-8))
+    (synopsis "BQN implementation based on dzaima/APL")
+    (description
+     "dbqn is a Java implementation of the
@uref{https://mlochbaum.github.io/BQN/, BQN programming language} that does
 not need to be bootstrapped, based on an earlier Java implementation of APL by
 the same author.")
-      (home-page "https://github.com/dzaima/BQN")
-      (license license:expat))))
+    (home-page "https://github.com/dzaima/BQN")
+    (license license:expat)))

 (define bqn-sources
  ;; Aside from dbqn above, the main bqn repository is used by other
@@ -328,7 +328,7 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
 (define noscript
  (package
    (name "noscript")
-    (version "13.2.1")
+    (version "13.2.2")
    (source (origin
              (method url-fetch/zipbomb)
              (uri (string-append
@@ -336,7 +336,7 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
                    ".xpi"))
              (sha256
               (base32
-                "16p63kg7zwnfss9sb3j2kn9m7dx9prh09h4vbz3b0pg5s7rrf0hr"))))
+                "0w2w0a76dk01bkh83mqwgs9ky02rjqk15z5sxg4a6mw0hpr81bpm"))))
    (build-system copy-build-system)
    (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
    (arguments
@@ -21,6 +21,7 @@
 ;;; Copyright © 2022, 2023 Juliana Sims <juli@incana.org>
 ;;; Copyright © 2024 Evgeny Pisemsky <mail@pisemsky.site>
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2025 Anderson Torres <anderson.torres.8519@gmail.com>
 ;;; Copyright © 2025 Aiden Isik <aidenisik+git@member.fsf.org>
 ;;; Copyright © 2025 Josep Bigorra <jjbigorra@gmail.com>
 ;;; Copyright © 2025 John Kehayias <john.kehayias@protonmail.com>
@@ -99,6 +100,40 @@
  #:use-module (gnu packages version-control)
  #:use-module (gnu packages xml))

+(define-public acr
+  (package
+    (name "acr")
+    (version "2.2.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/radareorg/acr")
+              (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "1qd7p50b9gkh2ihf7gs6xpdkb5jk8frg90ajqlw1pbza8735f9q1"))
+       (snippet
+        #~(begin
+            (delete-file "configure")))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:tests? #f                     ; No tests
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'bootstrap)
+          (add-after 'patch-source-shebangs 'bootstrap-after-patch-source-shebangs
+            (assoc-ref %standard-phases 'bootstrap)))))
+    (synopsis "Autoconf replacement written in pure Bash")
+    (description
+     "@acronym{ACR, Autoconf Replacement} tries to replace autoconf
+functionality generating a full-compatible configure script, but relying on
+Bourne shell script instead of m4.")
+    (home-page "https://github.com/radareorg/acr")
+    (license license:gpl2)))
+
 (define-public bam
  (package
    (name "bam")
@@ -384,7 +419,6 @@ resembles Python.")
           python-cython
           python-gitpython
           python-pytest
-           python-pytest-cov
           python-pytest-mock))
    (home-page "https://github.com/mesonbuild/meson-python")
    (synopsis "Meson-based build backend for Python")
@@ -1117,7 +1151,7 @@ maintenance-related files, for convenience.")
 (define-public maak
  (package
    (name "maak")
-    (version "0.2.3")
+    (version "0.2.12")
    (source
     (origin
       (method git-fetch)
@@ -1126,7 +1160,7 @@ maintenance-related files, for convenience.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "15s6khifk7k002hr9mqgl45r3ipmvsc56z9z8skwclxsj6w1cddl"))))
+        (base32 "0566damp7339n8rs2dvvq80h07amygnn3nakj2wwav2fmb1yzgx1"))))
    (build-system guile-build-system)
    (arguments
     (list
@@ -51,6 +51,7 @@
  #:use-module (guix build-system copy)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system meson)
+  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module (guix store)
  #:use-module (gnu packages)
@@ -72,6 +73,7 @@
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages pcre)
  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-build)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages gettext)
@@ -466,23 +468,26 @@ language as input.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32
-         "1rihvlg11nzk70kfzz4i3gi5izcy46w05ismcx04p5j1hlim0brb"))))
-    (build-system python-build-system)
+        (base32 "1rihvlg11nzk70kfzz4i3gi5izcy46w05ismcx04p5j1hlim0brb"))))
+    (build-system pyproject-build-system)
    (arguments
     (list
-      #:phases #~(modify-phases %standard-phases
-                   (add-after 'unpack 'unbundle-ply
-                     (lambda _
-                       (rmdir "pcpp/ply")
-                       (substitute* "setup.py"
-                         (("'pcpp/ply/ply'") "")))))))
-    (native-inputs (list python-pytest))
+      #:test-backend #~'unittest
+      #:test-flags #~(list "discover" "-s" "tests" "-p" "*.py")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'unbundle-ply
+            (lambda _
+              (rmdir "pcpp/ply")
+              (substitute* "setup.py"
+                (("'pcpp/ply/ply'")
+                 "")))))))
+    (native-inputs (list python-setuptools))
    (propagated-inputs (list python-ply))
    (home-page "https://github.com/ned14/pcpp")
    (synopsis "C99 preprocessor written in Python")
-    (description "This package provides a C99 preprocessor written in pure
-Python.")
+    (description
+     "This package provides a C99 preprocessor written in pure Python.")
    (license license:bsd-3)))

 (define-public aml
@@ -1437,7 +1442,7 @@ Telemetry Transport (MQTT) publish-subscribe messaging protocol.")
 (define-public mimalloc
  (package
    (name "mimalloc")
-    (version "2.1.2")
+    (version "3.1.5")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1446,7 +1451,7 @@ Telemetry Transport (MQTT) publish-subscribe messaging protocol.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1pyf05snc1ib7zjjm9kspvbmynd8lmxqw72qcpz8lcyzyywmz24i"))))
+                "0a3z1vi3n4w6n1iz4yqnvllrlpqb2dc2a54wn2s52js541zsfkky"))))
    (build-system cmake-build-system)
    (arguments
     `(#:build-type "Release"
@@ -1572,9 +1577,9 @@ Telemetry Transport (MQTT) publish-subscribe messaging protocol.")
                       ,(string-append "--prefix=" #$output)
                       ,(string-append "--mandir=" #$output "/share/man")
                       ,(string-append "--cores="
-                                       (if parallel-build?
-                                           (number->string (parallel-job-count))
-                                           "1")))))))))
+                                       ;; Tests require parallelism, and set upper limit as test
+                                       ;; runtime scales superliniearly in the number of cores.
+                                       (number->string (max 2 (min 8 (parallel-job-count))))))))))))
    (home-page "https://github.com/concurrencykit/ck")
    (synopsis "C library for concurrent systems")
    (description "Concurrency Kit (@code{ck}) provides concurrency primitives,
@@ -1,4 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2013, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015, 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Kei Kebreau <kkebreau@posteo.net>
@@ -10,11 +11,13 @@
 ;;; Copyright © 2020 Brendan Tildesley <mail@brendan.scot>
 ;;; Copyright © 2020 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2020 Peng Mei Yu <pengmeiyu@riseup.net>
+;;; Copyright © 2021 Petr Hodina <phodina@protonmail.com>
 ;;; Copyright © 2021 Wamm K. D. <jaft.r@outlook.com>
 ;;; Copyright © 2022 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
+;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -105,6 +108,33 @@ https://www.agendadulibre.org are in French and the adl-submit tool is only
 available in French.")
      (license license:gpl2))))

+(define-public date2name
+  (let ((commit "50cc8d3957fc0bdc26c65042ab8f0d9f05610283")
+        (revision "2"))
+    (package
+      (name "date2name")
+      (version (git-version "0.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+                (url "https://github.com/novoid/date2name")
+                (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "16m24dvyg93rpa94401cladjvj5pk3ds5y6sbz54xygdpg9qf8qm"))))
+      (build-system pyproject-build-system)
+      (native-inputs
+       (list python-poetry-core
+             python-pytest))
+      (home-page "https://github.com/novoid/date2name")
+      (synopsis "Handling time-stamps and date-stamps in file names")
+      (description
+       "By default, date2name gets the modification time of matching files and
+directories and adds a datestamp in standard ISO 8601+ format YYYY-MM-DD at
+the beginning of the file or directory name.")
+      (license license:gpl3+))))
+
 (define-public date
  (package
    (name "date")
@@ -460,6 +490,55 @@ traditional Chinese characters.")
    ;; 'Lesser GPL version 2 or later'.
    (license (list license:gpl2+ license:lgpl2.1+))))

+(define-public gcal
+  (package
+    (name "gcal")
+    (version "4.2.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.alteholz.dev/gnu/gcal-"
+                           version ".tar.xz"))
+       (sha256
+        (base32
+         "1p3q6his31bxs24nsgpfavw3nlhalqf0zak4f3b530p725s2vgfq"))
+       (snippet
+        #~(begin
+            (use-modules (guix build utils))
+            ;; Adjust the bundled gnulib to work with glibc 2.28.  See e.g.
+            ;; "m4-gnulib-libio.patch".  This is a phase rather than patch
+            ;; or snippet to work around <https://bugs.gnu.org/32347>.
+            (substitute* (find-files "lib" "\\.c$")
+              (("#if defined _IO_ftrylockfile")
+               "#if defined _IO_EOF_SEEN"))
+            (substitute* "lib/stdio-impl.h"
+              (("^/\\* BSD stdio derived implementations")
+               (string-append
+                "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
+                "# define _IO_IN_BACKUP 0x100\n"
+                "#endif\n\n"
+                "/* BSD stdio derived implementations")))
+            #t))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:configure-flags
+      #~(list "LDFLAGS=-lm")))
+    (native-inputs
+     (list check
+           pkg-config))
+    (home-page "https://www.gnu.org/software/gcal/")
+    (synopsis "Calculating and printing a wide variety of calendars")
+    (description
+     "Gcal is a program to calculate and print calendars on the
+command-line.  Calendars can be printed in 1-month, 3-month or whole-year
+views.  In addition, eternal holiday lists can be generated for many
+countries, which can be complemented by user-made lists of fixed dates to
+make an agenda.  Gcal can also calculate astronomical data, such as the
+phases of the moon, and supports alternative calendar formats: Julian,
+Gregorian, Islamic, Chinese and more.")
+    (license license:gpl3+)))
+
 (define-public gsimplecal
  (let ((version "2.4.1"))
    (package
@@ -490,7 +569,7 @@ configured to show the current time in different timezones.")
 (define-public hebcal
  (package
    (name "hebcal")
-    (version "5.8.7")
+    (version "5.9.4")
    (source
     (origin
       (method git-fetch)
@@ -499,7 +578,7 @@ configured to show the current time in different timezones.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1a1b9jip1ha6bzv6xg9fx47q167yzgbxjvrp5zngv175nzl9427j"))))
+        (base32 "0hw4485s83amvl03y33zkxi9ka9yq6rvbdsw20m6fc4m2bj8lb79"))))
    (build-system go-build-system)
    (arguments
     (list
@@ -1,124 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2019 John Soo <jsoo1@asu.edu>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-(define-module (gnu packages cedille)
-  #:use-module (gnu packages)
-  #:use-module (gnu packages agda)
-  #:use-module (gnu packages emacs-xyz)
-  #:use-module (gnu packages haskell)
-  #:use-module (gnu packages haskell-xyz)
-  #:use-module (guix build-system emacs)
-  #:use-module (guix git-download)
-  #:use-module ((guix licenses) #:prefix license:)
-  #:use-module (guix packages))
-
-(define-public cedille
-  (package
-    (name "cedille")
-    (version "1.1.2")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/cedille/cedille")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "1h5s6ayh3s76z184jai3jidcs4cjk8s4nvkkv2am8dg4gfsybq22"))))
-    (inputs
-     (list agda agda-ial ghc ghc-alex ghc-happy))
-    (build-system emacs-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-cedille-paths
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out")))
-               (substitute* "cedille-mode.el"
-                 (("/usr/share/emacs/site-lisp/cedille-mode")
-                  (string-append
-                   out "/share/emacs/site-lisp/cedille")))
-               (substitute* "cedille-mode/cedille-mode-info.el"
-                 (("\\(concat cedille-path-el \"cedille-info-main.info\"\\)")
-                  (string-append
-                   "\"" out "/share/info/cedille-info-main.info.gz\"")))
-               #t)))
-         (add-after 'patch-cedille-paths 'copy-cedille-mode
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (lisp
-                     (string-append
-                      out "/share/emacs/site-lisp/cedille/")))
-               (mkdir-p (string-append lisp "cedille-mode"))
-               (copy-recursively
-                "cedille-mode"
-                (string-append lisp "cedille-mode"))
-               (mkdir-p (string-append lisp "se-mode"))
-               (copy-recursively
-                "se-mode"
-                (string-append lisp "se-mode"))
-               #t)))
-         ;; FIXME: Byte compilation fails
-         (delete 'build)
-         (replace 'check
-           (lambda _
-             (with-directory-excursion "cedille-tests"
-               (invoke "sh" "run-tests.sh"))))
-         (add-after 'unpack 'patch-libraries
-           (lambda _ (patch-shebang "create-libraries.sh") #t))
-         (add-after 'unpack 'copy-ial
-           (lambda* (#:key inputs #:allow-other-keys)
-             (copy-recursively
-              (search-input-directory inputs "/include/agda/ial")
-              "ial")
-             ;; Ambiguous module if main is included from ial
-             (delete-file "ial/main.agda")
-             #t))
-         (add-after 'check 'build-cedille
-           ;; Agda has a hard time with parallel compilation
-           (lambda _
-             (invoke "touch" "src/Templates.hs")
-             (make-file-writable  "src/Templates.hs")
-             (invoke "touch" "src/templates.agda")
-             (make-file-writable  "src/templates.agda")
-             (invoke "make" "--jobs=1")))
-         (add-after 'install 'install-cedille
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out")))
-               (copy-recursively
-                "lib" (string-append out "/lib/cedille"))
-               (install-file "cedille" (string-append out "/bin"))
-               (install-file "core/cedille-core"
-                             (string-append out "/bin"))
-               (install-file "docs/info/cedille-info-main.info"
-                             (string-append out "/share/info"))
-               #t))))))
-    (home-page "https://cedille.github.io/")
-    (synopsis
-     "Language based on Calculus of Dependent Lambda Eliminations")
-    (description
-     "Cedille is an interactive theorem-prover and dependently typed
-programming language, based on extrinsic (aka Curry-style) type theory.  This
-makes it rather different from type theories like Coq and Agda, which are
-intrinsic (aka Church-style).  In Cedille, terms are nothing more than
-annotated versions of terms of pure untyped lambda calculus.  In contrast, in
-Coq or Agda, the typing annotations are intrinsic parts of terms.  The typing
-annotations can only be erased as an optimization under certain conditions,
-not by virtue of the definition of the type theory.")
-    (license license:expat)))
@@ -3,6 +3,7 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2021 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2021 Raghav Gururajan <rg@raghavgururajan.name>
+;;; Copyright © 2025 Luca Kredel <luca.kredel@web.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -29,11 +30,14 @@
  #:use-module (guix build-system copy)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system trivial)
+  #:use-module (guix build-system go)
  #:use-module (gnu packages)
  #:use-module (gnu packages nss)
  #:use-module (gnu packages curl)
  #:use-module (gnu packages python)
  #:use-module (gnu packages perl)
+  #:use-module (gnu packages golang-crypto)
+  #:use-module (gnu packages golang-build)
  #:use-module (gnu packages tls))

 (define-public certdata2pem
@@ -223,3 +227,33 @@ port forwarding to your local machine.")
 Let's Encrypt root and intermediate certificates.  It is intended to be used
 within Guix.")
    (license license:public-domain)))
+
+(define-public mkcert
+  (package
+    (name "mkcert")
+    (version "1.4.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/FiloSottile/mkcert")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0ms9mjspiwlsgsnir0ccj3w8vhvrphf5i6k9q3hrz47y2a6igh0l"))))
+    (build-system go-build-system)
+    (arguments
+     (list
+      #:import-path "filippo.io/mkcert"
+      #:build-flags
+      #~(list (string-append "-ldflags=-X main.Version="
+                             #$version))))
+    (native-inputs (list go-golang-org-x-net
+                         go-software-sslmate-com-src-go-pkcs12))
+    (synopsis "Zero-config tool to make locally trusted development
+     certificates")
+    (description
+     "mkcert is a simple tool for making locally-trusted development
+     certificates.  It requires no configuration.")
+    (home-page "https://github.com/FiloSottile/mkcert")
+    (license license:bsd-3)))
@@ -49,7 +49,7 @@
 ;;; Copyright © 2023 Reza Housseini <reza@housseini.me>
 ;;; Copyright © 2023 Hilton Chain <hako@ultrarare.space>
 ;;; Copyright © 2023, 2024 Troy Figiel <troy@troyfigiel.com>
-;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2024 Navid Afkhami <navid.afkhami@mdc-berlin.de>
 ;;; Copyright © 2024, 2025 gemmaro <gemmaro.dev@gmail.com>
@@ -377,11 +377,11 @@ source code editors and IDEs.")
          (add-after 'install 'install-man
            (lambda* (#:key import-path #:allow-other-keys)
              (with-directory-excursion (string-append "src/" import-path)
-                (let ((man-dir (string-append #$output "/share/man")))
+                (let ((man-dir (string-append #$output "/share/man/man1")))
                  (mkdir-p man-dir)
                  (invoke "go-md2man"
                          "-in" "man/man1/checkmake.1.md"
-                          "-out" (string-append man-dir "/man1")))))))))
+                          "-out" (string-append man-dir "/checkmake.1")))))))))
    (native-inputs
     (list go-github-com-docopt-docopt-go
           go-github-com-go-ini-ini
@@ -819,7 +819,7 @@ format.")
 (define-public cppcheck
  (package
    (name "cppcheck")
-    (version "2.17.1")
+    (version "2.18.0")
    (source (origin
      (method git-fetch)
      (uri (git-reference
@@ -827,11 +827,25 @@ format.")
             (commit version)))
      (file-name (git-file-name name version))
      (sha256
-       (base32 "19ap9ai9s4vsygyqfa215mrmpz4vki63d5b4qdb89zvbldaf3hlf"))
+       (base32 "1551pbbvx43j5jl5jz725km7gd65fizf9y7j66anjmdmqzccpdmn"))
       (patches (search-patches "cppcheck-fix-basedir-test.patch"))))
    (build-system cmake-build-system)
    (arguments
-     '(#:configure-flags '("-DBUILD_TESTS=ON")))
+     '(#:parallel-tests? #f
+       #:configure-flags '("-DBUILD_TESTS=ON"
+                           "-DUSE_BUNDLED_TINYXML2=OFF")
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-testcondition-test
+           (lambda _
+             (substitute* "test/testcondition.cpp"
+               (("test.cpp:4\\] -> \\[test.cpp:6")
+                "test.cpp:4:25] -> [test.cpp:6:18")
+               (("test.cpp:3\\] -> \\[test.cpp:5(.*false)"_ rest)
+                (string-append "test.cpp:3:22] -> [test.cpp:5:22" rest
+                               " [knownConditionTrueFalse]"))))))))
+    (inputs
+     (list tinyxml2))
    (home-page "https://cppcheck.sourceforge.io")
    (synopsis "Static C/C++ code analyzer")
    (description "Cppcheck is a static code analyzer for C and C++.  Unlike
@@ -889,46 +903,49 @@ favourite continuous integration framework.  Among Cukinia features are:
 (define-public cxxtest
  (package
    (name "cxxtest")
+    ;; 4.4 is from 2014, there is some move on master branch but still no
+    ;; fresh tag, see: <https://github.com/CxxTest/cxxtest/issues/156>.
    (version "4.4")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "mirror://sourceforge/cxxtest/cxxtest/"
-                                  version "/cxxtest-" version ".tar.gz"))
-              (sha256
-               (base32
-                "1n7pbj4z9ivx005hqvivj9ddhq8awynzg6jishfbypf6j7ply58w"))))
-    (build-system python-build-system)
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://sourceforge/cxxtest/cxxtest/" version
+                           "/cxxtest-" version ".tar.gz"))
+       (sha256
+        (base32 "1n7pbj4z9ivx005hqvivj9ddhq8awynzg6jishfbypf6j7ply58w"))))
+    (build-system pyproject-build-system)
    (arguments
-     '(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'chdir-to-source
-           (lambda _
-             (chdir "python")
-             #t))
-         (add-after 'install 'install-headers
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (include-dir (string-append out "/include/cxxtest")))
-               (for-each (lambda (header-file)
-                           (install-file header-file include-dir))
-                         (find-files "../cxxtest"))
-               #t)))
-         (add-after 'install 'install-doc
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (doc-dir (string-append out "/share/doc/cxxtest")))
-               (install-file "../README" doc-dir)
-               (install-file "../doc/guide.txt" doc-dir)
-               (copy-recursively "../sample" (string-append doc-dir "/sample"))
-               #t))))))
-    (propagated-inputs
-     (list python-ply))
-    (home-page "https://web.archive.org/web/20230604070022/http://cxxtest.com/")
+     (list
+      ;; XXX: There are SCons and CMake tests, but not pytest ones.
+      #:tests? #f
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'chdir-to-source
+            (lambda _
+              (chdir "python")))
+          (add-after 'install 'install-headers
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let ((include-dir (string-append #$output "/include/cxxtest")))
+                (for-each (lambda (header-file)
+                            (install-file header-file include-dir))
+                          (find-files "../cxxtest")))))
+          (add-after 'install 'install-doc
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let ((doc-dir (string-append #$output "/share/doc/cxxtest")))
+                (install-file "../README" doc-dir)
+                (install-file "../doc/guide.txt" doc-dir)
+                (copy-recursively "../sample"
+                                  (string-append doc-dir "/sample"))))))))
+    (native-inputs (list python-setuptools))
+    (propagated-inputs (list python-ply))
+    (home-page
+     "https://web.archive.org/web/20230604070022/http://cxxtest.com/")
    (synopsis "Unit testing framework for C++")
-    (description "CxxTest is a unit testing framework for C++ that is similar
-in spirit to JUnit, CppUnit, and xUnit.  CxxTest does not require precompiling
-a CxxTest testing library, it employs no advanced features of C++ (e.g. RTTI)
-and it supports a very flexible form of test discovery.")
+    (description
+     "CxxTest is a unit testing framework for C++ that is similar in spirit to
+JUnit, CppUnit, and xUnit.  CxxTest does not require precompiling a CxxTest
+testing library, it employs no advanced features of C++ (e.g. RTTI) and it
+supports a very flexible form of test discovery.")
    (license license:lgpl3+)))

 (define-public doctest
@@ -991,7 +1008,7 @@ has been designed to be fast, light and unintrusive.")
 (define-public kyua
  (package
    (name "kyua")
-    (version "0.13")
+    (version "0.14.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1000,7 +1017,7 @@ has been designed to be fast, light and unintrusive.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1jzdal9smhmivj18683a5gy8jd2p1dbni7kcpaxq4g9jgjdidcrq"))))
+                "0w238ynhnjz7p2v8fbgxv35kl1x7a4vs86227qhb4gxncr75nsbl"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -1025,16 +1042,6 @@ has been designed to be fast, light and unintrusive.")
                 (format #f "chdir(~s)" (dirname (which "ls"))))
                (("\"/bin/ls\"")
                 (string-append "\"" (which "ls") "\"")))))
-          (add-before 'check 'prepare-for-tests
-            (lambda _
-              ;; The test suite expects HOME to be writable.
-              (setenv "HOME" "/tmp")
-              ;; Generate the autom4te-generated testsuite script, which
-              ;; contains a '/bin/sh' shebang.
-              (invoke "make" "bootstrap/testsuite")
-              (substitute* "bootstrap/testsuite"
-                (("/bin/sh")
-                 (which "sh")))))
          (add-after 'unpack 'disable-problematic-tests
            (lambda _
              ;; The stacktrace tests expect core files to be dumped to the
@@ -1043,12 +1050,8 @@ has been designed to be fast, light and unintrusive.")
              ;; https://github.com/freebsd/kyua/issues/214).
              (substitute* "utils/Kyuafile"
                ((".*atf_test_program.*stacktrace_test.*")
-                 ""))))
-          (add-after 'install 'delete-installed-tests
-            (lambda _
-              ;; Delete 200 MiB of tests.
-              (delete-file-recursively (string-append #$output "/tests")))))))
-    (native-inputs (list autoconf automake gdb-minimal pkg-config))
+                 "")))))))
+    (native-inputs (list autoconf automake gdb-minimal libtool pkg-config))
    (inputs (list atf lutok sqlite))
    (home-page "https://github.com/freebsd/kyua")
    (synopsis "Testing framework for infrastructure software")
@@ -1062,16 +1065,16 @@ report generation engine.")
 (define-public googletest
  (package
    (name "googletest")
-    (version "1.12.1")
+    (version "1.17.0")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/google/googletest")
-             (commit (string-append "release-" version))))
+             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1cv55x3amwrvfan9pr8dfnicwr8r6ar3yf6cg9v6nykd6m2v3qsv"))))
+        (base32 "1zn701fgmbk29y45p49sajaswm01i2bv89ds2kkbiq8i0p2cr08w"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f
@@ -1085,21 +1088,6 @@ discovery, death tests, assertions, parameterized tests and XML test report
 generation.")
    (license license:bsd-3)))

-(define-public googletest-1.17
-  (package
-    (inherit googletest)
-    (name "googletest")
-    (version "1.17.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/google/googletest")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1zn701fgmbk29y45p49sajaswm01i2bv89ds2kkbiq8i0p2cr08w"))))))
-
 (define-public googletest-1.13
  (package
    (inherit googletest)
@@ -1115,6 +1103,21 @@ generation.")
       (sha256
        (base32 "1x5lr1k4kgw3i8d7c12vp759p0w8c8r2y8lwvqswswxvwygw8lid"))))))

+(define-public googletest-1.12
+  (package
+    (inherit googletest-1.13)
+    (name "googletest")
+    (version "1.12.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/google/googletest")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1cv55x3amwrvfan9pr8dfnicwr8r6ar3yf6cg9v6nykd6m2v3qsv"))))))
+
 (define-public googletest-1.8
  (package
    (inherit googletest)
@@ -1474,19 +1477,22 @@ for every Python test framework.  It supports nose, py.test, and unittest.")
 (define-public python-minimock
  (package
    (name "python-minimock")
-    (version "1.2.8")
+    (version "1.3.0")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "MiniMock" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/lowks/minimock")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
       (sha256
-        (base32
-         "0k2sxb1ibnyg05iblz7zhbv825f1zk9906rab7883iqgvzmdzpsz"))))
-    (build-system python-build-system)
-    (home-page "https://pypi.org/project/MiniMock")
+        (base32 "0mby3y78w8zka3dwp2dnsq3a0bq9nxr5g0h538p6zbyjrqly5paj"))))
+    (build-system pyproject-build-system)
+    (native-inputs (list python-pynose python-setuptools))
+    (home-page "https://github.com/lowks/minimock")
    (synopsis "Simple Python library for using mock objects")
-    (description "MiniMock is a simple library for building mock objects with
-doctest.")
+    (description
+     "MiniMock is a simple library for building mock objects with doctest.")
    (license license:expat)))

 (define-public python-mock
@@ -2393,76 +2399,90 @@ since the last commit or what tests are currently failing.")
 (define-public python-coverage
  (package
    (name "python-coverage")
-    (version "7.9.2")
+    (version "7.11.0")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "coverage" version))
       (sha256
-        (base32
-         "12qcm2j4bnc2gp6sci9brly2k406gp4jwjfpzxj04ag3a7x28w4r"))))
+        (base32 "0l403f6d59q8rik9vvzb6982qad0zrfj87dqydzsz8hwmh2dayqn"))))
    (build-system pyproject-build-system)
    (arguments
     (list
+      ;; tests: 1303 passed, 23 skipped
      #:test-flags
-      #~(list
-         "--numprocesses" (number->string (parallel-job-count))
-         ;; TODO: Rework this test options by utilizing "-k" option.
-         ;;
-         ;; 1201 passed, 19 skipped, 389 warnings
-         ;; XXX: Unable to properly compare reports.
-         "--ignore=tests/test_report.py"
-         ;; XXX: PyTracer or missing dependencies.
-         "--ignore=tests/test_venv.py"
-         "--ignore=tests/test_plugins.py"
-         "--ignore=tests/test_debug.py"
-         ;; XXX: Unclear why these fail.
-         "--ignore=tests/test_python.py"
-         "--deselect=tests/test_concurrency.py\
-::SigtermTest::test_sigterm_multiprocessing_saves_data"
-         ;; XXX: Unexpected paths order.
-         "--ignore=tests/test_process.py"
-         ;; XXX: PermissionError
-         "--deselect=tests/test_annotate.py::AnnotationGoldTest::test_multi"
-         ;; XXX: Needs C extension
-         "--deselect=tests/test_cmdline.py::CmdLineStdoutTest::test_version"
-         "--deselect=tests/test_api.py::NamespaceModuleTest::test_bug_572"
-         ;; XXX: Finds more files at toplevel
-         "--deselect=tests/test_api.py::RelativePathTest::test_files_up_one_level"
-         "--deselect=tests/test_xml.py::XmlReportTest::test_no_duplicate_packages"
-         ;; XXX: zip1 module missing.
-         "--deselect=tests/test_filereporter.py::FileReporterTest::test_zipfile"
-         ;; No module named 'coverage.tracer'
-         "--deselect=tests/test_api.py::ApiTest::test_completely_zero_reporting"
-         "--deselect=tests/test_api.py::ApiTest::test_warnings"
-         "--deselect=tests/test_oddball.py::RecursionTest::test_long_recursion_recovery"
-         ;; XXX: Checking coverage for too much files, not only the target one.
-         "--deselect=tests/test_oddball.py::DoctestTest::test_doctest"
-         ;; Module sys has no Python source
-         "--deselect=tests/test_api.py::ApiTest::test_warnings_suppressed"
-         ;; prevent FAILs on slow riscv64 SBCs
-         #$@(if (equal? (%current-system) "riscv64-linux")
-                '("--deselect=tests/test_numbits.py::NumbitsOpTest::test_union"
-                  "--deselect=tests/test_numbits.py::NumbitsOpTest::test_any_intersection")
-                '()))
+      #~(list "--numprocesses" (number->string (min 8 (parallel-job-count)))
+              #$@(map (lambda (file) (string-append "--ignore=tests/" file))
+                      ;; XXX: The most of the tests fail.
+                      (list "test_process.py"
+                            ;; Unable to properly compare reports.
+                            "test_report.py"
+                            ;; Network connection is required
+                            "test_venv.py"))
+              #$@(map (lambda (test) (string-append "--deselect="
+                                                    "tests/test_python.py::"
+                                                    "GetZipBytesTest::"
+                                                    "test_get_encoded_zip_files"
+                                                    test))
+                      ;; > assert zip_data is not None
+                      ;; E assert None is not None
+                      (list "[utf-8]@get_zip_bytes_test"
+                            "[gb2312]@get_zip_bytes_test"
+                            "[hebrew]@get_zip_bytes_test"
+                            "[shift_jis]@get_zip_bytes_test"
+                            "[cp1252]@get_zip_bytes_test"))
+              #$@(map (lambda (test) (string-append "--deselect=tests/test_"
+                                                    test))
+                      ;; AssertionError
+                      (list "api.py::RelativePathTest::test_files_up_one_level"
+                            "concurrency.py::SigtermTest::\
+test_sigterm_multiprocessing_saves_data"
+                            "oddball.py::DoctestTest::test_doctest"
+                            "oddball.py::MockingProtectionTest::\
+test_os_path_exists"
+                            "plugins.py::PluginTest::\
+test_local_files_are_importable"
+                            "regions.py::test_real_code_regions"
+                            "setup.py::SetupPyTest::test_metadata"
+                            "testing.py::test_all_our_source_files"
+                            "xml.py::XmlReportTest::test_no_duplicate_packages"
+                            ;; FileNotFoundError
+                            "setup.py::SetupPyTest::test_more_metadata"
+                            ;; ModuleNotFoundError
+                            "filereporter.py::FileReporterTest::test_zipfile"
+                            ;; OSError
+                            "annotate.py::AnnotationGoldTest::test_multi"))
+              #$@(if (or (equal? (%current-system) "riscv64-linux")
+                         (equal? (%current-system) "aarch64-linux"))
+                     ;; Thypothesis.errors.FailedHealthCheck: Data generation
+                     ;; is extremely slow.
+                     (map (lambda (test) (string-append "--deselect="
+                                                        "tests/test_numbits.py"
+                                                        test))
+                          (list "NumbitsOpTest::test_any_intersection"
+                                "NumbitsOpTest::test_conversion"
+                                "NumbitsOpTest::test_union"))
+                     '()))
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'unpack 'patch-pyproject
+          (add-after 'unpack 'fix-pytest-config
            (lambda _
              (substitute* "pyproject.toml"
-                ;; Just run pytest with no frills.
-                (("addopts.*") ""))))
-          (add-before 'check 'fix-conftest
-            ;; It tries to scan the whole sys.path and "find some place to
-            ;; write to".
+                (("-q -n auto ") ""))))
+          (add-before 'check 'pre-check
            (lambda _
-              (with-output-to-file (string-append (getcwd) "/test.pth")
-                (lambda _ (display "")))
-              (substitute* "tests/conftest.py"
-                (("map(Path, sys.path)") (format #f "[~s]" (getcwd)))))))))
+              ;; WARNING: The directory '/homeless-shelter/.cache/pip' or its
+              ;; parent directory is not owned or is not writable by the
+              ;; current user. The cache has been disabled. Check the
+              ;; permissions and owner of that directory. If executing pip
+              ;; with sudo, you should use sudo's -H flag.
+              (setenv "HOME" "/tmp")
+              ;; This would otherwise interfere with finding the installed
+              ;; coverage when running tests.
+              (delete-file-recursively "coverage"))))))
    (native-inputs
     (list python-pytest
-           python-pytest-xdist ; hardcoded in tests/conftests.py
+           python-pytest-xdist  ;some tests need xdist_group
           python-flaky
           python-setuptools))
    (home-page "https://coverage.readthedocs.io")
@@ -2753,9 +2773,11 @@ failures.")
       (sha256
        (base32 "0gxsr0wk8kzf8rqfnhy84yh1zi0b55j76c0m9n006d8q4bzy1v25"))))
    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags #~(list "-k" "not test_coverage_explicit")))
    (native-inputs
     (list python-pytest
-           python-pytest-cov
           python-setuptools
           python-setuptools-scm))
    (propagated-inputs
@@ -3129,57 +3151,6 @@ non-technical or business participants in a software project.  Behave uses
 tests written in a natural language style, backed up by Python code.")
    (license license:x11)))

-(define-public python-behave-web-api
-  (package
-    (name "python-behave-web-api")
-    (version "2.0.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "behave-web-api" version))
-       (sha256
-        (base32
-         "04p5sp6wck3mafj634w1fpvfhxm170l5q3hfb9d06pi71ql606n6"))))
-    (build-system pyproject-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-dependencies
-           (lambda _
-             (substitute* "setup.py"
-               (("'wheel'") "")                ; We don't use it.
-               (("'ordereddict==1.1'") ""))    ; Python >= 2.7 has it built-in.
-             #t)))))
-    (native-inputs
-     (list python-pytest
-           python-setuptools
-           python-wheel))
-    (propagated-inputs
-     (list behave python-requests))
-    (home-page "https://github.com/jefersondaniel/behave-web-api")
-    (synopsis "Provides testing for JSON APIs with Behave for Python")
-    (description "This package provides testing utility modules for testing
-JSON APIs with Behave.")
-    (license license:expat)))
-
-(define-public python-nose-timer
-  (package
-    (name "python-nose-timer")
-    (version "0.7.5")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "nose-timer" version))
-        (sha256
-          (base32 "05wzkc88vbzw62pqkvhl33211b90kns0lny70b7qw62rcg4flzk4"))))
-    (build-system python-build-system)
-    (propagated-inputs
-     (list python-nose python-termcolor))
-    (home-page "https://github.com/mahmoudimus/nose-timer")
-    (synopsis "Timer plugin for nosetests")
-    (description "Shows how much time was needed to run individual tests.")
-    (license license:expat)))
-
 (define-public python-freezegun
  (package
    (name "python-freezegun")
@@ -3751,28 +3722,6 @@ system.  The code under test requires no modification to work with pyfakefs.")
 asynchronous code in Python (asyncio).")
    (license license:expat)))

-(define-public python-pytest-dependency
-  (package
-    (name "python-pytest-dependency")
-    (version "0.5.1")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "pytest-dependency" version))
-        (sha256
-          (base32
-            "0swl3mxca7nnjbb5grfzrm3fa2750h9vjsha0f2kyrljc6895a62"))))
-    (build-system python-build-system)
-    (propagated-inputs
-      (list python-pytest))
-    (home-page
-      "https://github.com/RKrahl/pytest-dependency")
-    (synopsis "Manage dependencies of tests")
-    (description "This pytest plugin manages dependencies of tests.  It allows
-to mark some tests as dependent from other tests.  These tests will then be
-skipped if any of the dependencies did fail or has been skipped.")
-    (license license:asl2.0)))
-
 (define-public python-pytest-datadir
  (package
    (name "python-pytest-datadir")
@@ -72,7 +72,7 @@
 (define-public cuirass
  (package
    (name "cuirass")
-    (version "1.3.2")
+    (version "1.3.3")
    (source
     (origin
       (method git-fetch)
@@ -82,7 +82,7 @@
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "0d6ngj51q3pixi2qakc6asvaigqg0cw1qvbwvpkx285zm9csx1vd"))))
+         "0zq56wdjyxnmhr93358db95cc9i7qkffk98vscjr26pb4ab3ym21"))))
    (build-system gnu-build-system)
    (arguments
     (list #:modules `((guix build utils)
@@ -855,6 +855,7 @@ dependency graph expansion and the creation of classpaths.")
       #:doc-dirs '()
       ;; FIXME: Could not initialize class org.eclipse.aether.transport.http.SslSocketFactory
       #:tests? #f
+       #:jdk ,openjdk11
       #:phases
       (modify-phases %standard-phases
         ;; FIXME: Currently, the S3 transporter depends on ClojureScript,
@@ -46,6 +46,7 @@
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system copy)
  #:use-module (guix build-system emacs)
+  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
  #:use-module (gnu packages)
@@ -180,7 +181,7 @@ using the CMake build system.")
 (define-public cmake-bootstrap
  (package
    (name "cmake-bootstrap")
-    (version "3.31.8")
+    (version "3.31.10")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://cmake.org/files/v"
@@ -188,7 +189,7 @@ using the CMake build system.")
                                  "/cmake-" version ".tar.gz"))
              (sha256
               (base32
-                "1akcmx9w5wbygq088hrr13l6n4b5npqvh9jk20934bfwhg5f7kg3"))))
+                "0a9y7nqr27rl8acvjyj8s57q87bdjxa9w2g5mphsh7ylsvgzl1ng"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -367,7 +368,7 @@ and workspaces that can be used in the compiler environment of your choice.")
  (package
    (inherit cmake-minimal)
    (name "cmake")
-    (version "4.0.3")
+    (version "4.1.3")
    (source (origin
              (inherit (package-source cmake-minimal))
              (method url-fetch)
@@ -382,7 +383,7 @@ and workspaces that can be used in the compiler environment of your choice.")
                                  ,@rest))))
              (sha256
               (base32
-                "1yrzkwkr2nxl8hcjkk333l9ycbw9prkg363k4km609kknyvkfdcd"))))
+                "125yhgkmh5ap14w9yyh442manbb7k96dws4pa3hz32qp7njpjn3n"))))
    (outputs '("out" "doc"))
    (arguments
     (substitute-keyword-arguments (package-arguments cmake-minimal)
@@ -460,14 +461,40 @@ and workspaces that can be used in the compiler environment of your choice.")
       (uri (pypi-uri "cmakelang" version))
       (sha256
        (base32 "0zz6g1ignqanl4ja9f5nrlk5f3mvv7cp5y9yswjd0m06n23jx603"))))
-    (build-system python-build-system)
-    (arguments (list #:tests? #f        ;no test data in pypi archive
-                     #:phases #~(modify-phases %standard-phases
-                                  (add-after 'unpack 'adjust-setup.py
-                                    (lambda _
-                                      (substitute* "setup.py"
-                                        (("cmakelang/doc/README.rst")
-                                         "README.rst")))))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:tests? #f        ;no test data in pypi archive
+      #:modules '((guix build pyproject-build-system)
+                  (guix build utils)
+                  (ice-9 textual-ports))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'adjust-setup.py
+            (lambda _
+              (substitute* "setup.py"
+                (("cmakelang/doc/README.rst")
+                 "README.rst"))
+              ;; XXX: setup.py has multiple setup() calls, breaking the 'build
+              ;; phase ; in this case the package is wrong, but conveniently
+              ;; our goal is the first setup() call, so discard what comes from
+              ;; the second one.
+              (rename-file "setup.py" "setup.py.bak")
+              (call-with-input-file "setup.py.bak"
+                (lambda (in)
+                  (call-with-output-file "setup.py"
+                    (lambda (out)
+                      (let loop ((line (get-line in))
+                                 (setup-seen #f))
+                        (unless (or (eof-object? line)
+                                    (and (string-prefix? "setup(" line)
+                                         setup-seen))
+                          (display line out)
+                          (newline out)
+                          (loop (get-line in)
+                                (or setup-seen
+                                    (string-prefix? "setup(" line))))))))))))))
+    (native-inputs (list python-setuptools))
    (inputs (list python-jinja2 python-pyyaml python-six))
    (home-page "https://github.com/cheshirekow/cmake_format/")
    (synopsis "Language tools for CMake (format, lint, etc.)")
@@ -424,7 +424,7 @@ COCOMO model or user-provided parameters.")
 (define-public cloc
  (package
    (name "cloc")
-    (version "2.02")
+    (version "2.06")
    (source
     (origin
       (method git-fetch)
@@ -433,7 +433,7 @@ COCOMO model or user-provided parameters.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1syh1gppjr3p2m9mq0zm3n47bhaksxcn5bx1nwqc29xn404c2fm9"))))
+        (base32 "02l56ks3p3344nf6lz9s3aym9f0xslkns8q8d8zm1i3whf98iymv"))))
    (build-system gnu-build-system)
    (inputs
     (list bash-minimal
@@ -1032,7 +1032,7 @@ extensions over the standard utility.")
                                          "/share/sourcetrail/user/projects")))
                                (copy-recursively src dst)
                                (delete-file-recursively src))))))))
-    (inputs (list boost
+    (inputs (list boost-1.83
                  clang-19
                  expected-lite
                  qt5compat
@@ -1057,17 +1057,17 @@ in a project.")
 (define-public universal-ctags
  (package
    (name "universal-ctags")
-    (version "6.1.20250525.0")
+    (version "6.2.1")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/universal-ctags/ctags")
-             (commit (string-append "p" version))))
+             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "0nxhmpzkxixb303bsihd5j7n0d29ak2lgnqff920q3dm33y965sy"))
+         "04i9fhhifs82d39z2dskscp7v2885g7isjn9r9zm4wsl6dcnb5n7"))
       (modules '((guix build utils)))
       (snippet
        '(begin
@@ -4,7 +4,7 @@
 ;;; Copyright © 2014, 2015, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015, 2016 Eric Bavier <bavier@member.fsf.org>
-;;; Copyright © 2015, 2016, 2017, 2018, 2020, 2021, 2022, 2024 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2015, 2016, 2017, 2018, 2020, 2021, 2022, 2024, 2025 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015, 2017, 2018 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2015 Jeff Mickey <j@codemac.net>
 ;;; Copyright © 2015-2024 Efraim Flashner <efraim@flashner.co.il>
@@ -84,6 +84,7 @@
  #:use-module (gnu packages boost)
  #:use-module (gnu packages check)
  #:use-module (gnu packages cpp)
+  #:use-module (gnu packages crypto)
  #:use-module (gnu packages curl)
  #:use-module (gnu packages documentation)
  #:use-module (gnu packages file)
@@ -95,6 +96,7 @@
  #:use-module (gnu packages gtk)
  #:use-module (gnu packages java)
  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages linux)
  #:use-module (gnu packages man)
  #:use-module (gnu packages maths)
  #:use-module (gnu packages perl)
@@ -531,7 +533,14 @@ compressed with pbzip2 can be decompressed with bzip2).")
     (list
      #:configure-flags
      '(list "-DSHRINKWRAP_PREFER_STATIC=OFF"
-             "-DBUILD_TESTS=ON")))
+             "-DBUILD_TESTS=ON")
+      #:phases
+      '(modify-phases %standard-phases
+         (add-after 'unpack 'add-missing-header
+           (lambda _
+             (substitute* "include/shrinkwrap/xz.hpp"
+               (("#include <cstring>")
+                "#include <cstring>\n#include <cstdint>")))))))
    (propagated-inputs (list bzip2 xz zlib `(,zstd "lib")))
    (native-inputs (list pkg-config))
    (home-page "https://github.com/jonathonl/shrinkwrap")
@@ -590,6 +599,21 @@ than gzip and 15 % smaller output than bzip2.")
   (license (list license:gpl2+ license:lgpl2.1+)) ; bits of both
   (home-page "https://tukaani.org/xz/")))

+(define-public xz-for-graal-truffle
+  (package
+   (inherit xz)
+   (name "xz-for-graal-truffle")
+   (version "5.6.2")
+   (source (origin
+            (method url-fetch)
+            (uri (list (string-append "http://tukaani.org/xz/xz-" version
+                                      ".tar.gz")
+                       (string-append "http://multiprecision.org/guix/xz-"
+                                      version ".tar.gz")))
+            (sha256
+             (base32
+              "06a585qzn2qlwdv44w7x6p6x8qmbqrqzlz29y8108vyqw7021zcb"))))))
+
 (define-public heatshrink
  (package
    (name "heatshrink")
@@ -740,14 +764,14 @@ archiving.  Lzip is a clean implementation of the LZMA algorithm.")
 (define-public lziprecover
  (package
    (name "lziprecover")
-    (version "1.23")
+    (version "1.25")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://savannah/lzip/lziprecover/"
                                  "lziprecover-" version ".tar.gz"))
              (sha256
               (base32
-                "0wmmyi03fv2lflsir5ldrsv04q57k3hmlqajzb1m3p86gwbh967j"))))
+                "0icbzw7kmp4rn711sh3f0w3sxlxly6q6dc8d7pp6dqhag2f2yfag"))))
    (build-system gnu-build-system)
    (arguments
     ;; The configure script doesn't recognise the --build or --host
@@ -755,6 +779,7 @@ archiving.  Lzip is a clean implementation of the LZMA algorithm.")
     `(,@(if (%current-target-system)
             `(#:make-flags (list ,(string-append "CXX=" (cxx-for-target))))
             '())))
+    (native-inputs (list lzip))
    (home-page "https://www.nongnu.org/lzip/lziprecover.html")
    (synopsis "Recover and decompress data from damaged lzip files")
    (description
@@ -1032,14 +1057,14 @@ decompression of some loosely related file formats used by Microsoft.")
 (define-public lz4
  (package
    (name "lz4")
-    (version "1.9.3")
+    (version "1.10.0")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference (url "https://github.com/lz4/lz4")
                           (commit (string-append "v" version))))
       (sha256
-        (base32 "1w02kazh1fps3sji2sn89fz862j1199c5ajrqcgl1bnlxj09kcbz"))
+        (base32 "12sfwid95zhk2r2ijpwwknc5a2xlll2s9xhf0s21ca2jkygvblgx"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (outputs (list "out" "static"))
@@ -1890,11 +1915,11 @@ speed.")
    (outputs '("out"))
    (inputs
     `(,@(if (%current-target-system)
-             `(("googletest" ,googletest))
+             `(("googletest" ,googletest-1.8))
             '())))
    (native-inputs
     `(,@(if (%current-system)
-             `(("googletest" ,googletest))
+             `(("googletest" ,googletest-1.8))
             '())))
    (arguments
     `(#:phases
@@ -2297,14 +2322,14 @@ corrupted input.")
 (define-public plzip
  (package
    (name "plzip")
-    (version "1.11")
+    (version "1.12")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "mirror://savannah/lzip/plzip/"
                           "plzip-" version ".tar.gz"))
       (sha256
-        (base32 "0sv2sp0ppxkdds4qiwb3ddvlv22ydv61n3hk74rkh8ljbkjcpqyq"))))
+        (base32 "0c5fmp7hkb41ybc5gmrj96xz7g74mmpfhya2ha6asm51dynimmsh"))))
    (build-system gnu-build-system)
    (arguments
     (list #:configure-flags
@@ -2342,7 +2367,7 @@ single-member files which can't be decompressed in parallel.")
   (build-system cmake-build-system)
   (arguments
    `(#:tests? #f))
-   (inputs (list boost xz))
+   (inputs (list boost-1.83 xz))
   (native-inputs (list pkg-config))
   (home-page "https://constexpr.org/innoextract/")
   (synopsis "Tool for extracting Inno Setup installers")
@@ -2502,6 +2527,46 @@ download times, and other distribution and storage costs.")
    (properties `((lint-hidden-cve . ("CVE-2023-23456" "CVE-2023-23457"))))
    (license license:gpl2+)))

+(define-public qatzip
+  (package
+    (name "qatzip")
+    (version "1.3.1")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/intel/QATzip")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0c7kph69cf48gr97j3gzh1zwd58wxmp64vfv34z4r9ixj3lh6ziz"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:phases
+           #~(modify-phases %standard-phases
+               (replace 'bootstrap
+                 (lambda _
+                   ;; The script has a broken shebang (see:
+                   ;; <https://github.com/intel/QATzip/issues/143>).
+                   (invoke "sh" "autogen.sh"))))))
+    (native-inputs (list autoconf automake libtool))
+    (inputs (list numactl qatlib))
+    (propagated-inputs (list lz4 zlib)) ;in Requires of qatzip.pc
+    (home-page "https://github.com/intel/QATzip")
+    (synopsis "Compression Library accelerated by Intel QuickAssist Technology")
+    (description "QATzip is a library which builds on top of the
+ Intel QuickAssist Technology user space library, to provide extended
+accelerated compression and decompression services by offloading the actual
+compression and decompression request(s) to the Intel Chipset Series.  QATzip
+produces data using the standard gzip format (RFC1952) with extended headers
+or lz4 blocks with lz4 frame format.  The data can be decompressed with a
+compliant gzip or lz4 implementation.  QATzip is designed to take full
+advantage of the performance provided by Intel QuickAssist Technology.")
+    (license license:bsd-3)
+    ;; This package only supports hardware that exists on the x86_64 platform,
+    ;; and is not portable.
+    (supported-systems (list "x86_64-linux"))))
+
 (define-public quazip
  (package
    (name "quazip")
@@ -8,6 +8,8 @@
 ;;; Copyright © 2024, 2025 Tomas Volf <~@wolfsden.cz>
 ;;; Copyright © 2024 Foundation Devices, Inc. <hello@foundation.xyz>
 ;;; Copyright © 2024 Jean-Pierre De Jesus DIAZ <jean@foundation.xyz>
+;;; Copyright © 2025 Tomas Volf <~@wolfsden.cz>
+;;; Copyright © 2025 Foster Hangdaan <foster@hangdaan.email>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -75,7 +77,7 @@
 (define-public crun
  (package
    (name "crun")
-    (version "1.24")
+    (version "1.25.1")
    (source
     (origin
       (method url-fetch)
@@ -85,7 +87,7 @@
             "/crun-" version ".tar.gz"))
       (sha256
        (base32
-         "0lnfvwxq14pyqyxx56bdr7k4h3l99imc9vynxram7fh0chxf7dlh"))))
+         "02kksvnja234k8mpq5j7yms8npbpvh8iz3k03h21lwcqzqsb88rx"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -169,7 +171,7 @@ runtime (like runc or crun) for a single container.")
 (define-public distrobox
  (package
    (name "distrobox")
-    (version "1.8.1.2")
+    (version "1.8.2.1")
    (source
     (origin
       (method git-fetch)
@@ -177,7 +179,7 @@ runtime (like runc or crun) for a single container.")
             (url "https://github.com/89luca89/distrobox")
             (commit version)))
       (sha256
-        (base32 "168hjzifdvmlr4rplgp2jh4sg1dwjfmbrwj8589zys8r4kqvwfy1"))
+        (base32 "1la9qkhmj9277r6b2vfadb3fnvrwa435x6la5bwvm8ch0js2dfx0"))
       (file-name (git-file-name name version))))
    (build-system copy-build-system)
    (arguments
@@ -395,54 +397,46 @@ Layer-4 sockets.")
  (package
    (name "cni-plugins")
    (version "1.8.0")
-    ;; TODO: Unvendor.
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/containernetworking/plugins")
-             (commit (string-append "v" version))))
+              (url "https://github.com/containernetworking/plugins")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
       (sha256
        (base32 "0bwczkf4kbrx47sa6mnp5kyn65dbg52qnlfyjyydrwshal8rz3gw"))
-       (file-name (git-file-name name version))))
+       (snippet
+        #~(begin (use-modules (guix build utils))
+                 (delete-file-recursively "vendor")))))
    (build-system go-build-system)
    (arguments
-     `(#:unpack-path "github.com/containernetworking/plugins"
-       #:tests? #f ; XXX: see stat /var/run below
-       #:phases (modify-phases %standard-phases
-                  (replace 'build
-                    (lambda _
-                      (with-directory-excursion
-                          "src/github.com/containernetworking/plugins"
-                        (invoke "./build_linux.sh"))))
-                  (replace 'check
-                    (lambda* (#:key tests? #:allow-other-keys)
-                      ;; Only pkg/ns tests run without root.
-                      (when tests?
-                        (with-directory-excursion
-                            "src/github.com/containernetworking/plugins/pkg/ns"
-                          (invoke "stat" "/var/run") ; XXX: test tries to stat this directory
-                          (invoke "unshare" "-rmn" "go" "test")))))
-                  (add-before 'check 'set-test-environment
-                    (lambda _
-                      (setenv "XDG_RUNTIME_DIR" "/tmp/cni-rootless")))
-                  (replace 'install
-                    (lambda* (#:key outputs #:allow-other-keys)
-                      (copy-recursively
-                       "src/github.com/containernetworking/plugins/bin"
-                       (string-append (assoc-ref outputs "out") "/bin")))))))
-    ;; XXX: Prepare for unvendor.
+     (list
+      #:install-source? #f
+      #:tests? #f ; TODO: Figure out how to run tests.
+      #:import-path "github.com/containernetworking/plugins"
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'build
+            (lambda* (#:key import-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" import-path)
+                ;; XXX: Migrate to go-build-system logic.
+                (invoke "./build_linux.sh"))))
+          (replace 'install
+            (lambda* (#:key import-path #:allow-other-keys)
+              (copy-recursively (string-append "src/"import-path "/bin")
+                                (string-append #$output "/bin")))))))
    (native-inputs
-     (list ;; go-github-com-alexflint-go-filemutex
-           ;; go-github-com-buger-jsonparser
-           ;; go-github-com-containernetworking-cni
-           ;; go-github-com-coreos-go-iptables
+     (list go-github-com-alexflint-go-filemutex
+           go-github-com-buger-jsonparser
+           go-github-com-containernetworking-cni
+           go-github-com-coreos-go-iptables
           go-github-com-coreos-go-systemd-v22
           go-github-com-godbus-dbus-v5
           go-github-com-insomniacslk-dhcp
-           ;; o-github-com-mattn-go-shellwords
+           go-github-com-mattn-go-shellwords
           ;; go-github-com-microsoft-hcsshim
-           ;; go-github-com-networkplumbing-go-nft
+           go-github-com-networkplumbing-go-nft
           go-github-com-onsi-ginkgo-v2
           go-github-com-onsi-gomega
           go-github-com-opencontainers-selinux
@@ -451,7 +445,7 @@ Layer-4 sockets.")
           go-github-com-vishvananda-netlink
           go-github-com-vishvananda-netns
           go-golang-org-x-sys
-           ;; go-sigs-k8s-io-knftables
+           go-sigs-k8s-io-knftables
           util-linux))
    (home-page "https://github.com/containernetworking/plugins")
    (synopsis "Container Network Interface (CNI) network plugins")
@@ -464,49 +458,77 @@ configure network interfaces in Linux containers.")
  (package
    (name "gvisor-tap-vsock")
    (version "0.8.7")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/containers/gvisor-tap-vsock")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1p9vypphssvqfcm3y2nc7b9v0wcc2smkrqq8k60vskaiza89974k"))))
-    (build-system gnu-build-system)
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/containers/gvisor-tap-vsock")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1p9vypphssvqfcm3y2nc7b9v0wcc2smkrqq8k60vskaiza89974k"))
+       (modules '((guix build utils)))
+       (snippet
+        #~(begin
+            (delete-file-recursively "vendor")
+            ;; Submodules with their own go.mod files and packaged separately:
+            ;;
+            ;; - github.com/containers/gvisor-tap-vsock/tools
+            (delete-file-recursively "tools")))))
+    (build-system go-build-system)
    (arguments
     (list
-      #:make-flags `(list ,(string-append "GIT_VERSION=v" version))
-      #:test-target "test"
+      #:install-source? #f
+      #:import-path "github.com/containers/gvisor-tap-vsock/cmd/gvproxy"
+      #:unpack-path "github.com/containers/gvisor-tap-vsock"
+      #:build-flags
+      #~(list (string-append "-ldflags="
+                             "-X github.com/containers/gvisor-tap-vsock"
+                             "/pkg/types.gitVersion=" #$version))
+      #:test-flags
+      ;; serve UDP error: *net.OpError read udp 127.0.0.1:5354: use of closed
+      ;; network connection
+      #~(list "-skip" "TestSuite")
+      #:test-subdirs
+      #~(list "../../...")       ;test the whole libary
      #:phases
      #~(modify-phases %standard-phases
-          (delete 'configure)
-          ;; Add -trimpath flag to avoid keeping references to go package
-          ;; in the store.
-          (add-after 'unpack 'patch-go-reference
-            (lambda _
-              (substitute* "Makefile"
-                (("go build") "go build -trimpath"))))
-          (add-before 'build 'setenv
-            (lambda _
-              ;; For golang toolchain.
-              (setenv "HOME" "/tmp")))
-          (add-before 'check 'prune-tests
-            (lambda _
-              ;; Requires internet connection to fetch QEMU image.
-              (invoke "rm" "-r" "test-qemu")
-              ;; Requires working DNS.
-              (substitute* "pkg/services/dns/dns_test.go"
-                (("Should pass DNS requests to default system DNS.*" all)
-                 (string-append all "\n" "ginkgo.Skip(\"No network.\");"))
-                (("\"redhat.com\",")
-                 "\"localhost\",")
-                (("\"52.200.142.250\"")
-                 "\"127.0.0.1\""))))
-          (replace 'install
-            (lambda _
-              (install-file "bin/gvproxy" (string-append #$output "/bin")))))))
-    (native-inputs (list go-1.23))
+          (add-after 'unpack 'prune-tests
+            (lambda* (#:key unpack-path #:allow-other-keys)
+              (with-directory-excursion (string-append "src/" unpack-path)
+                ;; Requires working DNS.
+                (substitute* "pkg/services/dns/dns_test.go"
+                  (("Should pass DNS requests to default system DNS.*" all)
+                   (string-append all "\n" "ginkgo.Skip(\"No network.\");"))
+                  (("\"redhat.com\",")
+                   "\"localhost\",")
+                  (("\"52.200.142.250\"")
+                   "\"127.0.0.1\""))))))))
+    (native-inputs
+     (list go-github-com-apparentlymart-go-cidr
+           go-github-com-containers-winquit
+           go-github-com-coreos-stream-metadata-go
+           go-github-com-dustin-go-humanize
+           go-github-com-google-gopacket
+           go-github-com-insomniacslk-dhcp
+           ;; go-github-com-linuxkit-virtsock  ;Windows only
+           go-github-com-mdlayher-vsock
+           ;; go-github-com-microsoft-go-winio ;Windows only
+           go-github-com-miekg-dns
+           go-github-com-onsi-ginkgo
+           go-github-com-onsi-gomega
+           go-github-com-opencontainers-go-digest
+           go-github-com-pkg-errors
+           go-github-com-sirupsen-logrus
+           go-github-com-songgao-packets
+           go-github-com-songgao-water
+           go-github-com-stretchr-testify
+           go-github-com-vishvananda-netlink
+           go-golang-org-x-crypto
+           go-golang-org-x-mod
+           go-golang-org-x-sync
+           go-golang-org-x-sys
+           go-gvisor-dev-gvisor))
    (home-page "https://github.com/containers/gvisor-tap-vsock")
    (synopsis "Network stack for virtualization based on gVisor")
    (description "This package provides a replacement for @code{libslirp} and
@@ -550,7 +572,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
 (define-public podman
  (package
    (name "podman")
-    (version "5.6.1")
+    (version "5.7.1")
    (outputs '("out" "docker"))
    (properties
     `((output-synopsis "docker" "docker alias for podman")
@@ -563,7 +585,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
             (url "https://github.com/containers/podman")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "1k8dppbni8wbzxqqaknp08h687qw884wn7bkpiwmbw9np261fl4b"))
+        (base32 "16lb58r8vkngics6fn1b3six8bl3nrl9awrnq6ivdv1grfgy9z61"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -594,7 +616,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
                (invoke "make" "remotesystem"))))
          (add-after 'unpack 'fix-hardcoded-paths
            (lambda _
-              (substitute* "vendor/github.com/containers/common/pkg/config/config_linux.go"
+              (substitute* "vendor/go.podman.io/common/pkg/config/config_linux.go"
                (("/usr/local/libexec/podman")
                 (string-append #$output "/libexec/podman"))
                (("/usr/local/lib/podman")
@@ -655,7 +677,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
     (list grep
           bats
           git-minimal/pinned
-           go-1.23
+           go-1.24
           go-md2man
           gettext-minimal ; for envsubst
           mandoc
@@ -681,22 +703,33 @@ To get @code{podman machine} working, install @code{qemu-minimal}, and
 (define-public podman-compose
  (package
    (name "podman-compose")
-    (version "1.2.0")
+    (version "1.5.0")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/containers/podman-compose")
-             (commit (string-append "v" version))))
+              (url "https://github.com/containers/podman-compose")
+              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "06vm088q1x7j929n93ylq3bav716bqh6l79agj8sgzsqxjsmli73"))))
+        (base32 "08pz9axvgfyr0jd8rlndmhh8147s864mz17ng6qs07831g9ylj80"))))
    (build-system pyproject-build-system)
    (arguments
     (list
-      #:test-flags #~(list "pytests")))
-    (native-inputs (list python-pytest python-parameterized python-setuptools python-wheel))
-    (propagated-inputs (list python-dotenv python-pyyaml))
+      ;; Only run tests in `tests/unit`, skipping the ones in
+      ;; `tests/integration`. The integration tests need an environment with
+      ;; the ability to manage containers and volumes using the `podman`
+      ;; command.
+      ;;
+      ;; tests: 378 tests
+      #:test-backend #~'unittest
+      #:test-flags #~(list "discover" "tests/unit")))
+    (native-inputs
+     (list python-parameterized
+           python-setuptools))
+    (propagated-inputs
+     (list python-dotenv
+           python-pyyaml))
    (home-page "https://github.com/containers/podman-compose")
    (synopsis "Script to run docker-compose.yml using podman")
    (description
@@ -708,7 +741,7 @@ being rootless and not requiring any daemon to be running.")
 (define-public buildah
  (package
    (name "buildah")
-    (version "1.41.4")
+    (version "1.42.1")
    (source
     (origin
       (method git-fetch)
@@ -716,7 +749,7 @@ being rootless and not requiring any daemon to be running.")
             (url "https://github.com/containers/buildah")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "0gca1zv98c58z6c06ckgg63mm2305b1qzavxfmlgmj8s4f72g3zh"))
+        (base32 "1agblw09yw4pc81c2nsjy3j83gznn4micyjyrgpqxlmp93w5w5h0"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -781,7 +814,7 @@ being rootless and not requiring any daemon to be running.")
                  lvm2))
    (native-inputs
     (list bats
-           go-1.23
+           go-1.24
           go-md2man
           pkg-config))
    (synopsis "Build @acronym{OCI, Open Container Initiative} images")
@@ -49,6 +49,7 @@
 ;;; Copyright © 2025 Romain Garbage <romain.garbage@inria.fr>
 ;;; Copyright © 2024, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -138,43 +139,46 @@
  #:use-module (ice-9 match))

 (define-public argagg
-  (let ((commit "79e4adfa2c6e2bfbe63da05cc668eb9ad5596748") (revision "0"))
-    (package
-      (name "argagg")
-      (version (git-version "0.4.6" revision commit))
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/vietjtnguyen/argagg")
-                      (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "1flkgh524lq3024p7ld5lg743s1v7qnbmgv77578rzmn2rjzr77n"))))
-      (build-system cmake-build-system)
-      (outputs '("out" "doc"))
-      (arguments
-       `(#:phases (modify-phases %standard-phases
-                    (add-after 'install 'move-doc
-                      (lambda* (#:key outputs #:allow-other-keys)
-                        (let* ((name ,(package-name argagg)) (out (assoc-ref
-                                                                   outputs
-                                                                   "out"))
-                               (doc (assoc-ref outputs "doc")))
-                          (mkdir-p (string-append doc "/share/doc"))
-                          (rename-file
-                           (string-append out "/share/doc/" name)
-                           (string-append doc "/share/doc/" name))))))))
-      (native-inputs (list doxygen))
-      (home-page "https://github.com/vietjtnguyen/argagg")
-      (synopsis "C++11 command line argument parser")
-      (description
-       "ArgAgg is yet another C++ command line argument/option
+  (package
+    (name "argagg")
+    (version "0.4.7")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/vietjtnguyen/argagg")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1pr0xqcc3wpwh02fwll3yf67rbxj39wbr2rqdd6bvjalmahg6hqv"))))
+    (build-system cmake-build-system)
+    (outputs '("out" "doc"))
+    (arguments
+     (list
+      #:configure-flags #~(list
+                           (format #f "-DCMAKE_CXX_FLAGS=~a"
+                                   (string-join
+                                    (list "-Wno-error=array-bounds="
+                                          "-Wno-error=sign-conversion"))))
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'install 'move-doc
+                     (lambda* (#:key outputs #:allow-other-keys)
+                       (let ((name #$(package-name argagg))
+                             (doc (assoc-ref outputs "doc")))
+                         (mkdir-p (string-append doc "/share/doc"))
+                         (rename-file
+                          (string-append #$output "/share/doc/" name)
+                          (string-append doc "/share/doc/" name))))))))
+    (native-inputs (list doxygen))
+    (home-page "https://github.com/vietjtnguyen/argagg")
+    (synopsis "C++11 command line argument parser")
+    (description
+     "ArgAgg is yet another C++ command line argument/option
 parser.  It was written as a simple and idiomatic alternative to other
 frameworks like getopt, Boost program options, TCLAP, and others.  The goal is
 to achieve the majority of argument parsing needs in a simple manner with an
 easy to use API.")
-      (license license:expat))))
+    (license license:expat)))

 (define-public argpp
  ;; XXX: Does not release anymore.
@@ -453,7 +457,7 @@ data structures for C++.")
        (base32 "08w3ppd43wx9vq641ljw5izjd7p5w7drynw13ll9shwy41ydif9n"))))
    (build-system cmake-build-system)
    (native-inputs
-     (list googletest pkg-config))
+     (list googletest-1.13 pkg-config))
    (synopsis "Guidelines Support Library")
    (description "c++-gsl contains functions and types that are suggested for
 use by the C++ Core Guidelines maintained by the Standard C++ Foundation.")
@@ -587,7 +591,7 @@ operating system functions.")
 (define-public lunasvg
  (package
    (name "lunasvg")
-    (version "3.2.1")
+    (version "3.5.0")
    (source
     (origin
       (method git-fetch)
@@ -596,11 +600,11 @@ operating system functions.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "14ppk3k6sdbf3lwhv2gjqy32vwa7ck9jcj9xfk0fxwfqbvbp6608"))))
+        (base32 "1scmm1q35j3r87117p401fg3c1bx2nkiyvc2f3svvr2m2y9ihabr"))))
    (build-system cmake-build-system)
    (inputs (list plutovg))
    (arguments
-     '(#:configure-flags '("-DBUILD_SHARED_LIBS=ON")
+     '(#:configure-flags '("-DBUILD_SHARED_LIBS=ON -DUSE_SYSTEM_PLUTOVG=ON")
       #:tests? #f)) ;No tests.
    (home-page "https://github.com/sammycage/lunasvg")
    (synopsis "SVG rendering and manipulation library in C++")
@@ -908,7 +912,7 @@ same name.")
 (define-public google-highway
  (package
    (name "google-highway")
-    (version "1.2.0")
+    (version "1.3.0")
    (source
     (origin
       (method git-fetch)
@@ -917,7 +921,7 @@ same name.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0ykhc6n3ai18dijdmi38fm1d7pa8i6nbgh64jrxd4499k7jhg568"))))
+        (base32 "1bl576f3zlygxfmjqs5rrk3sag411hlhx2210lpq461plvvs80zi"))))
    (build-system cmake-build-system)
    (arguments
     `(#:configure-flags (list "-DHWY_SYSTEM_GTEST=on"
@@ -943,7 +947,7 @@ library for SIMD (Single Instruction, Multiple Data) with runtime dispatch.")
 (define-public hyprgraphics
  (package
    (name "hyprgraphics")
-    (version "0.2.0")
+    (version "0.4.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -954,7 +958,7 @@ library for SIMD (Single Instruction, Multiple Data) with runtime dispatch.")
              (snippet #~(substitute* "CMakeLists.txt" (("libjxl_cms") "")))
              (sha256
               (base32
-                "1xr2pbawwnnwjwzkgsy9s4wq1j85x4qhj3m4s2pwb9wp6g69da2g"))))
+                "1jii9l9qbksp6x1vwbm84a985hy9q9xcpl703bliprd5rkpi6w96"))))
    (build-system cmake-build-system)
    (native-inputs (list gcc-15 pkg-config))
    (inputs (list cairo
@@ -978,7 +982,7 @@ utilities used across the hypr* ecosystem.")
 (define-public hyprlang
  (package
    (name "hyprlang")
-    (version "0.6.4")
+    (version "0.6.7")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -987,7 +991,7 @@ utilities used across the hypr* ecosystem.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "080kibsllxfrlck4gix0ygr12gnvf9p9ybi589fsvpab9p9xw857"))))
+                "0n64jq9jdabyx76sax0fb45jg92708488733c2m6zsf84r6nv2g7"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -1012,7 +1016,7 @@ language used in Hyprland.")
 (define-public hyprutils
  (package
    (name "hyprutils")
-    (version "0.10.0")
+    (version "0.10.4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1021,10 +1025,11 @@ language used in Hyprland.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0l4gdingspjv3fh7zkmdin37bjjxgxnxycn8agv4cr3n0kn9smxg"))))
+                "08b65pssaci780rgb5qgqc61zvbxmb9qda4gb58j8nh9yi3ya0jx"))))
    (build-system cmake-build-system)
    (arguments
     (list
+      #:tests? #f ; No tests in Release build type
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'fix-cross-compilation
@@ -1491,7 +1496,7 @@ tools (containers, algorithms) used by other QuantStack packages.")
 (define-public ccls
  (package
    (name "ccls")
-    (version "0.20241108")
+    (version "0.20250815.1")
    (source
     (origin
       (method git-fetch)
@@ -1499,7 +1504,7 @@ tools (containers, algorithms) used by other QuantStack packages.")
             (url "https://github.com/MaskRay/ccls")
             (commit version)))
       (sha256
-        (base32 "0474ldkkw1m46lkasdk8mn6z3q51vs4g1fbwml0sd70wgdb7h5nj"))
+        (base32 "1jl4jv1z8vxjfmkv2mvii68aqqx2nrcbd6bhzjs5dd65r23bqs6x"))
       (file-name (git-file-name name version))))
    (build-system cmake-build-system)
    (arguments
@@ -1905,7 +1910,7 @@ development of concurrent and multithreaded applications in C++.")
 (define-public taskflow
  (package
    (name "taskflow")
-    (version "3.6.0")
+    (version "3.10.0")
    (source
     (origin
       (method git-fetch)
@@ -1914,7 +1919,7 @@ development of concurrent and multithreaded applications in C++.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1cv74l181137lchc1rxygcg401cnq216ymq5qz2njsw99j342br3"))))
+        (base32 "08z7vif8lk4jri9m77j9gqyyv7nwza5qfgab0bk5gl9akb63qh5k"))))
    (build-system cmake-build-system)
    (home-page "https://taskflow.github.io/")
    (synopsis
@@ -2129,7 +2134,7 @@ point and then, after each tween step, plugging back the result.")
                (("check_target\\(gtest_main\\)") "")
                (("check_target\\(gmock\\)") "")))))))
    (native-inputs
-     (list googletest))
+     (list googletest-1.12))
    (home-page "https://abseil.io")
    (synopsis "Augmented C++ standard library")
    (description "Abseil is a collection of C++ library code designed to
@@ -2142,7 +2147,7 @@ Google's C++ code base.")
    (package
      (inherit base)
      (name "abseil-cpp")
-      (version "20250127.1")
+      (version "20250814.1")
      (source (origin
                (method git-fetch)
                (uri (git-reference
@@ -2151,7 +2156,7 @@ Google's C++ code base.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "0r2j360csym12jlgmcy92rgwdmng63shchxvfmln3j5402lv0g21"))
+                  "1wm2271hwy2pnfv9b5iy0y9xvbhiwffdf9i6s3dn89k630wh6928"))
                (patches
                 (search-patches "abseil-cpp-20220623.1-no-kepsilon-i686.patch"))))
      (arguments
@@ -2175,7 +2180,28 @@ Google's C++ code base.")
                              (setenv "CTEST_OUTPUT_ON_FAILURE" "1")
                              (invoke "ctest" "-E"
                                      "absl_symbolize_test|absl_log_format_test")))))
-                     #~()))))))))
+                     #~())))))
+      (native-inputs
+       (modify-inputs (package-native-inputs base)
+         (replace "googletest" googletest))))))
+
+(define-public abseil-cpp-20250127
+  (let ((base abseil-cpp))
+    (package
+      (inherit base)
+      (name "abseil-cpp")
+      (version "20250127.1")
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/abseil/abseil-cpp")
+                      (commit version)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0r2j360csym12jlgmcy92rgwdmng63shchxvfmln3j5402lv0g21"))
+                (patches
+                 (search-patches "abseil-cpp-20220623.1-no-kepsilon-i686.patch")))))))

 (define (abseil-cpp-for-c++-standard base version)
  (hidden-package
@@ -2288,42 +2314,39 @@ parsers according to a Parsing Expression Grammar (PEG).")
    (license license:expat)))

 (define-public lexy
-  ;; Bug fixes since last release.
-  (let ((commit "34d2adf74a2b25b6bdd760a3bbb931f3fd5e60cd")
-        (revision "0"))
-    (package
-      (name "lexy")
-      (version (git-version "2022.12.1" revision commit))
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-               (url "https://github.com/foonathan/lexy")
-               (commit commit)))
-         (file-name (git-file-name name version))
-         (sha256
-          (base32 "1ywcy3wdmqjj5z1w64hk0dwf8iv6p62s48m7l6vn881hfzc8hcxz"))))
-      (build-system cmake-build-system)
-      (arguments
-       (list #:configure-flags #~(list "-DLEXY_BUILD_DOCS=OFF") ; needs Hugo
-             #:phases
-             #~(modify-phases %standard-phases
-                 (add-after 'unpack 'fix-dependencies
-                   (lambda _
-                     (substitute* "tests/CMakeLists.txt"
-                       (("^message\\(STATUS \"Fetching doctest\"\\).*") "")
-                       (("^include\\(FetchContent\\).*") "")
-                       (("^FetchContent_Declare\\(doctest .*") "")
-                       (("^FetchContent_MakeAvailable\\(doctest\\)")
-                        "find_package(doctest REQUIRED)")
-                       (("^(target_link_libraries\\(lexy_test_base .*) doctest\\)"
-                         _ prefix)
-                        (string-append prefix ")"))))))))
-      (native-inputs (list doctest))
-      (home-page "https://lexy.foonathan.net/")
-      (synopsis "C++ parser combinator library")
-      (description "lexy is a parser combinator library for C++17 and later.")
-      (license license:boost1.0))))
+  (package
+    (name "lexy")
+    (version "2025.05.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/foonathan/lexy")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "14j2z7x2l65q95j5br5nw7awgd87p9m2xw7mma4qspiricd0rniq"))))
+    (build-system cmake-build-system)
+    (arguments
+     (list #:configure-flags #~(list "-DLEXY_BUILD_DOCS=OFF") ; needs Hugo
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'unpack 'fix-dependencies
+                 (lambda _
+                   (substitute* "tests/CMakeLists.txt"
+                     (("^message\\(STATUS \"Fetching doctest\"\\).*") "")
+                     (("^include\\(FetchContent\\).*") "")
+                     (("^FetchContent_Declare\\(doctest .*") "")
+                     (("^FetchContent_MakeAvailable\\(doctest\\)")
+                      "find_package(doctest REQUIRED)")
+                     (("^(target_link_libraries\\(lexy_test_base .*) doctest\\)"
+                       _ prefix)
+                      (string-append prefix ")"))))))))
+    (native-inputs (list doctest))
+    (home-page "https://lexy.foonathan.net/")
+    (synopsis "C++ parser combinator library")
+    (description "lexy is a parser combinator library for C++17 and later.")
+    (license license:boost1.0)))

 (define-public psascan
  (package
@@ -2389,7 +2412,7 @@ standard GNU style syntax for options.")
 (define-public folly
  (package
    (name "folly")
-    (version "2024.09.09.00")
+    (version "2025.11.10.00")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -2398,7 +2421,7 @@ standard GNU style syntax for options.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "17fdigkaxivbrww5yhz9fh25d8pirqjp126zbv4kg4qsprywfww5"))))
+                "11gdrc2jhb9dzjgpq6h3p5453f8gyvv4ngsnrqi4rylfil8a3b3i"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -2450,17 +2473,22 @@ of C++14 components that complements @code{std} and Boost.")
    (build-system cmake-build-system)
    (arguments
     (list
-      #:configure-flags #~(list "-DENABLE_TESTS=ON")
+      #:configure-flags #~(list "-DENABLE_TESTS=ON" "-DENABLE_CRYPTO=ON"
+                                "-DENABLE_NETSSL=ON")
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'disable-problematic-tests
            (lambda _
              (substitute* (list "Foundation/CMakeLists.txt" ; XXX: fails.
-                                 ;; Require network access
+                                 ;; Require network access.
                                 "Net/CMakeLists.txt"
                                 "MongoDB/CMakeLists.txt"
-                                 "Redis/CMakeLists.txt")
+                                 "Redis/CMakeLists.txt"
+                                 ;; Requires network access and uses certificates
+                                 ;; that will expire.
+                                 "NetSSL_OpenSSL/CMakeLists.txt")
                (("ENABLE_TESTS") "FALSE")))))))
+    (inputs (list openssl))
    (home-page "https://pocoproject.org/")
    (synopsis "Portable C++ components")
    (description "This package provides a collection of C++ libraries intended
@@ -2661,7 +2689,7 @@ composable sequential transformations.")
                          (lambda _
                            (delete-file-recursively "test/event_loop")))
                        (replace 'check (assoc-ref gnu:%standard-phases 'check)))))
-   (inputs (list boost immer zug))
+   (inputs (list boost-1.83 immer zug))
   (native-inputs (list catch2 cereal))
   (home-page "https://sinusoid.es/lager")
   (synopsis "Library for value-oriented design")
@@ -3166,6 +3194,7 @@ of reading and writing XML.")
       (sha256
        (base32 "1ddz14699v5lqx3dh0mb7hfffr6fk5zhmzn3z8yxkqqvriqnciim"))
       (modules '((guix build utils)))
+       (patches (search-patches "jsonnet-include-cstdint-for-gcc-13-builds.patch"))
       (snippet
        #~(begin
            (rename-file "third_party/md5" ".md5")
@@ -3283,7 +3312,8 @@ validation.")
                                        "bslh_hash.t"
                                        "bslstl_deque.0[1345].t"
                                        "bslstl_queue.t"
-                                        "bslstl_stack.t")
+                                        "bslstl_stack.t"
+                                        "bslstl_string_test.t")
                                  "|")
      #:modules '((guix build cmake-build-system)
                  ((guix build gnu-build-system) #:prefix gnu:)
@@ -4765,6 +4795,58 @@ written in C99.")
    (home-page "https://github.com/aklomp/base64")
    (license license:bsd-2)))

+(define-public unordered-dense
+  (package
+    (name "unordered-dense")
+    (version "4.8.1")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/martinus/unordered_dense")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "02a86p2abrjkjw6kxd2gcxhknn50mcb1shrch8fhg72n534yblr5"))))
+    ;; This library uses CMake as build system to distribute the package, but
+    ;; uses Meson to build and launch tests. Hence, the phase 'check is replaced
+    ;; to mimic what is defined for meson-build-system.
+    (build-system cmake-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (substitute* "../source/test/app/doctest.h"
+                  (("#include <doctest\\.h>")
+                   "#include <doctest/doctest.h>"))
+                (setenv "FUZZ_CORPUS_BASE_DIR"
+                        (string-append (getcwd) "/../source/data/fuzz/"))
+                (invoke "meson" "setup" "../source/")
+                (invoke "ninja" "--verbose" "-j"
+                        (number->string (parallel-job-count)))
+                (setenv "MESON_TESTTHREADS"
+                        (number->string (parallel-job-count)))
+                (invoke "meson" "test")))))))
+    (native-inputs (list meson pkg-config))
+    (inputs (list doctest fmt boost))
+    (home-page "https://github.com/martinus/unordered_dense")
+    (synopsis "C++17 fast and densely stored hashmap and hashset library")
+    (description
+     "A fast & densely stored hashmap and hashset based on robin-hood backward
+shift deletion for C++17 and later.
+
+The classes @code{ankerl::unordered_dense::map} and
+@code{ankerl::unordered_dense::set} are (almost) drop-in replacements of
+@code{std::unordered_map} and @code{std::unordered_set.} While they don't have
+as strong iterator / reference stability guarantees, they are typically much
+faster.  Additionally, there are @code{ankerl::unordered_dense::segmented_map}
+and @code{ankerl::unordered_dense::segmented_set} with lower peak memory usage,
+and stable references (iterators are NOT stable) on insert.")
+    (license license:expat)))
+
 (define-public zpp-serializer
  (package
    (name "zpp-serializer")
@@ -50,6 +50,7 @@
  #:use-module (gnu packages)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages aidc)
+  #:use-module (gnu packages assembly)
  #:use-module (gnu packages attr)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages base)
@@ -79,6 +80,7 @@
  #:use-module (gnu packages perl-check)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-build)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages python-check)
  #:use-module (gnu packages python-crypto)
@@ -102,6 +104,7 @@
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system perl)
  #:use-module (guix build-system python)
+  #:use-module (guix build-system pyproject)
  #:use-module (guix utils)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26))
@@ -132,7 +135,7 @@
               ;; TODO: perhaps infer #:tests?
               (if #$(%current-target-system)
                   "OFF" "ON")))))
-    (native-inputs (list googletest))
+    (native-inputs (list googletest-1.12))
    (home-page "https://github.com/google/crc32c")
    (synopsis "Cyclic redundancy check")
    (description
@@ -251,7 +254,7 @@ communication, encryption, decryption, signatures, etc.")
 (define-public libmd
  (package
    (name "libmd")
-    (version "1.0.4")
+    (version "1.1.0")
    (source (origin
            (method url-fetch)
            (uri
@@ -262,11 +265,12 @@ communication, encryption, decryption, signatures, etc.")
                             version ".tar.xz")))
            (sha256
             (base32
-              "03skgv013v0y9hxh6j143xdwynb5cmbmbdylvvgfsjz38889477m"))))
+              "0cmkfq3v0hqzjwpsyp02i3a1z2sfjrdjxky784qsy4sk4x1ammhv"))))
    (build-system gnu-build-system)
    (arguments
-     `(#:configure-flags
-       (list "--disable-static")))
+     (list
+      #:configure-flags
+      #~(list "--disable-static")))
    (synopsis "Message Digest functions from BSD systems")
    (description
     "The currently provided message digest algorithms are:
@@ -517,14 +521,14 @@ total number of shares generated.")
 (define-public tomb
  (package
    (name "tomb")
-    (version "2.11")
+    (version "2.13")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://files.dyne.org/tomb/releases/"
                           "Tomb-" version ".tar.gz"))
       (sha256
-        (base32 "05f34yx91bn9fj7rkabgpzvkw4pa6bg2c1r8cnp72wwnx6bzj97m"))))
+        (base32 "1405kw0j8i1bqyqbim8530xf6hchpf57r9p1v92aknwyn5wgny0g"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -791,6 +795,47 @@ data on your platform, so the seed itself will be as random as possible.
@end enumerate\n")
    (license license:artistic2.0)))

+(define-public qatlib
+  (package
+    (name "qatlib")
+    (version "25.08.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/intel/qatlib/")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1hbhrj0wlr68by7gdvsw4nh35rwg4yngn3m7awkx799pbqsw4iyc"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:configure-flags #~(list "--disable-static") ;avoid large .a
+           #:phases
+           #~(modify-phases %standard-phases
+               (replace 'bootstrap
+                 (lambda _
+                   ;; The script has a broken shebang (see:
+                   ;; <https://github.com/intel/qatlib/issues/128>).
+                   (invoke "sh" "autogen.sh"))))))
+    (native-inputs (list autoconf autoconf-archive automake libtool nasm))
+    (inputs (list numactl openssl zlib))
+    (propagated-inputs (list openssl))  ;in 'Requires' of libqat.pc
+    (home-page "https://github.com/intel/qatlib")
+    (synopsis "Intel QuickAssist Technology Library (QATlib)")
+    (description "Intel QuickAssist Technology provides hardware acceleration for
+offloading security, authentication and compression services from the CPU,
+thus significantly increasing the performance and efficiency of standard
+platform solutions.  Its services include symmetric encryption and
+authentication, asymmetric encryption, digital signatures, RSA, DH and ECC,
+and lossless data compression.  This package provides user space libraries
+that allow access to Intel QuickAssist devices and expose the Intel
+QuickAssist APIs and sample codes.")
+    (license license:bsd-3)
+    ;; This package only supports hardware that exists on the x86_64 platform,
+    ;; and is not portable.
+    (supported-systems (list "x86_64-linux"))))
+
 (define-public crypto++
  (package
    (name "crypto++")
@@ -982,14 +1027,16 @@ SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
 (define-public botan
  (package
    (name "botan")
-    (version "2.19.3")
+    (version "3.9.0")
    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://botan.randombit.net/releases/"
-                                  "Botan-" version ".tar.xz"))
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/randombit/botan/")
+                     (commit version)))
+              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0m9dh00zibx13pbjij8lbncf86pix3cxklxmgl47z965k7rlgq6s"))))
+                "1k5dyn39b77bfawly2yms0crbkn6g7msh16q7bxnh7dra4cnkmsn"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -1030,6 +1077,24 @@ using ctypes is included, and several other language bindings are available.")
    (home-page "https://botan.randombit.net")
    (license license:bsd-2)))

+;; Needed explicitly by biboumi
+(define-public botan-2
+  (hidden-package
+   (package
+     (inherit botan)
+     (name "botan")
+     (version "2.19.3")
+     (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url "https://github.com/randombit/botan/")
+               (commit version)))
+        (file-name (git-file-name name version))
+        (sha256
+         (base32
+          "16dsrxb7z245hvbjzapq7qf65ip1fh2390qap30hpfd383dyvilw")))))))
+
 (define-public ccrypt
  (package
    (name "ccrypt")
@@ -1054,8 +1119,8 @@ security.")
    (license license:gpl2)))

 (define-public asignify
-  (let ((commit "08af003e1f4833713db28b871759d94f9b2b1469")
-        (revision "1"))
+  (let ((commit "d6b3651fa96f05aeefc318f75503fc9ca77b1f58")
+        (revision "2"))
    (package
      (name "asignify")
      (version (git-version "1.1" revision commit))
@@ -1067,26 +1132,28 @@ security.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "1zacpqa8b5lg270z1g06r5ik9vnb91crb4ivyy20381dny82xvr1"))))
+                  "0a6k21gb2n45bj1d2qy34lgi4qsd3ck59jxcycbxafs0wdglsyl9"))))
      (build-system gnu-build-system)
      (arguments
-       `(#:configure-flags
-         (list "--enable-openssl"
-               (string-append "--with-openssl="
-                              (assoc-ref %build-inputs "openssl")))))
+       (list
+        #:configure-flags
+        #~(list "--enable-openssl"
+                (string-append "--with-openssl="
+                               #$(this-package-input "openssl")))))
      (native-inputs
       (list autoconf automake libtool))
      (inputs
       (list openssl))
      (home-page "https://github.com/vstakhov/asignify")
-      (synopsis "Cryptographic authentication and encryption tool and library")
+      (synopsis
+       "Cryptographic authentication and encryption tool and library")
      (description "Asignify offers public cryptographic signatures and
-encryption with a library or a command-line tool.  The tool is heavily inspired
-by signify as used in OpenBSD.  The main goal of this project is to define a
-high level API for signing files, validating signatures and encrypting using
-public-key cryptography.  Asignify is designed to be portable and self-contained
-with zero external dependencies.  Asignify can verify OpenBSD signatures, but it
-cannot sign messages in OpenBSD format yet.")
+encryption with a library or a command-line tool.  The tool is heavily
+inspired by signify as used in OpenBSD.  The main goal of this project is to
+define a high level API for signing files, validating signatures and
+encrypting using public-key cryptography.  Asignify is designed to be portable
+and self-contained with zero external dependencies.  Asignify can verify
+OpenBSD signatures, but it cannot sign messages in OpenBSD format yet.")
      (license license:bsd-2))))

 (define-public enchive
@@ -1104,17 +1171,19 @@ cannot sign messages in OpenBSD format yet.")
                (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
-     `(#:tests? #f                      ; no check target         '
-       #:make-flags (list ,(string-append "CC=" (cc-for-target))
-                          "PREFIX=$(out)")
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  (add-after 'install 'post-install
-                    (lambda _
-                      (let* ((out (assoc-ref %outputs "out"))
-                             (lisp (string-append out "/share/emacs/site-lisp")))
-                        (install-file "enchive-mode.el" lisp)
-                        #t))))))
+     (list
+      #:tests? #f                      ;no check target         '
+      #:make-flags
+      #~(list (string-append "CC=" #$(cc-for-target))
+              (string-append "PREFIX=" #$output))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (add-after 'install 'post-install
+            (lambda _
+              (install-file
+               "enchive-mode.el"
+               (string-append #$output "/share/emacs/site-lisp")))))))
    (synopsis "Encrypted personal archives")
    (description
     "Enchive is a tool to encrypt files to yourself for long-term
@@ -1270,27 +1339,24 @@ utility/testing functions.")
                "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
    (build-system gnu-build-system)
    (arguments
-     `(#:tests? #f ; No test suite
-       #:make-flags
-       (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
-             ;; Build the program and the docs.
-             "SUBDIRS=src doc")
-       #:phases
-       (modify-phases %standard-phases
-         (delete 'configure) ; No ./configure script
-         (add-after 'unpack 'patch-path
-           (lambda _
-             (substitute* '("src/Makefile" "doc/Makefile")
-               (("/usr/bin/install")
-                "install"))))
-         (add-before 'install 'make-output-directories
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((out (assoc-ref outputs "out"))
-                    (bin (string-append out "/bin"))
-                    (man1 (string-append out "/share/man/man1")))
-               (mkdir-p bin)
-               (mkdir-p man1)
-               #t))))))
+     (list
+      #:tests? #f ; No test suite
+      #:make-flags
+      #~(list (string-append "PREFIX=" #$output)
+              ;; Build the program and the docs.
+              "SUBDIRS=src doc")
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure) ; No ./configure script
+          (add-after 'unpack 'patch-path
+            (lambda _
+              (substitute* '("src/Makefile" "doc/Makefile")
+                (("/usr/bin/install")
+                 "install"))))
+          (add-before 'install 'make-output-directories
+            (lambda _
+              (mkdir-p (string-append #$output "/bin"))
+              (mkdir-p (string-append #$output "/share/man/man1")))))))
    (inputs
     (list libsodium openssl))
    (synopsis "High-performance command-line tool for stream encryption")
@@ -1305,7 +1371,7 @@ quickly by using all your CPU cores and hardware acceleration.")
 (define-public minisign
  (package
    (name "minisign")
-    (version "0.11")
+    (version "0.12")
    (source
     (origin
       (method git-fetch)
@@ -1314,7 +1380,7 @@ quickly by using all your CPU cores and hardware acceleration.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1vv2bhhsyhlpnjclfa7gkqgd9xi3jfcdrss7abbdxvvflyrwdk5i"))))
+        (base32 "1b7iagx8jdyhvni24qhq13qydsinbh42gvb9dgn8d9vx3f33645a"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f))                    ; no test suite
@@ -1337,7 +1403,7 @@ Trusted comments are signed, thus verified, before being displayed.")
 (define-public olm
  (package
    (name "olm")
-    (version "3.2.14")
+    (version "3.2.16")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1345,7 +1411,7 @@ Trusted comments are signed, thus verified, before being displayed.")
                    (commit version)))
              (sha256
               (base32
-                "0pj7gs32ixhlls792wah7xf49j5pra0avp7dpvy9cndkdkg6biq5"))
+                "19yibssxn12q6ddl15nvqzvcf1hwqial48ng6llfafwbkfdb8z95"))
              (file-name (git-file-name name version))
              ;; Delete the bundled blob.  It's free, but unauditable,
              ;; and apparently only required for android.
@@ -1353,58 +1419,60 @@ Trusted comments are signed, thus verified, before being displayed.")
                         "android/gradle/wrapper/gradle-wrapper.jar"))))
    (build-system cmake-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (replace 'check
-           (lambda* (#:key tests? #:allow-other-keys)
-             (when tests?
-               (with-directory-excursion "tests"
-                 (invoke "ctest" "."))))))))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (with-directory-excursion "tests"
+                  (invoke "ctest" "."))))))))
    (synopsis "Implementation of the Olm and Megolm cryptographic ratchets")
    (description "The Olm library implements the Double Ratchet
 cryptographic ratchet.  It is written in C and C++11, and exposed as a C
 API.")
-    (home-page "https://matrix.org/docs/projects/other/olm/")
+    (home-page "https://gitlab.matrix.org/matrix-org/olm/")
    (license license:asl2.0)))

 (define-deprecated-package libolm
  olm)

+;; TODO: This is the only Python package here, consider to build from source
+;; directly without inheritance and move to python-crypto module.
 (define-public python-olm
  (package
    ;; python-olm is part of olm and must be updated at the same time.
    (inherit olm)
    (name "python-olm")
-    (build-system python-build-system)
+    (build-system pyproject-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'chdir
-           (lambda _
-             (chdir "python")))
-         (add-before 'build 'set-preprocessor
-           (lambda* (#:key inputs #:allow-other-keys)
-             (setenv "CPP" "gcc -E")))
-         (replace 'check
-           (lambda* (#:key tests? inputs outputs #:allow-other-keys)
-             (when tests?
-               (add-installed-pythonpath inputs outputs)
-               (invoke "pytest")))))))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'chdir
+            (lambda _
+              (chdir "python")))
+          (add-before 'build 'set-preprocessor
+            (lambda _
+              (setenv "CPP" "gcc -E"))))))
    (inputs (list olm))
    (propagated-inputs
     (list python-cffi python-future))
    (native-inputs
-     (list python-pytest python-pytest-benchmark python-aspectlib))
+     (list python-aspectlib
+           python-pytest
+           python-pytest-benchmark
+           python-setuptools))
    (synopsis "Python bindings for Olm")
    (description "The Olm library implements the Double Ratchet
 cryptographic ratchet.  This package contains its Python bindings.")))

 (define-public hash-extender
-  (let ((commit "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d")
-        (revision "2"))
+  (let ((commit "f00b1a02eca02b0907e26726f7efe437bc396aa4")
+        (revision "0"))
    (package
      (name "hash-extender")
-      (version (git-version "0.0" revision commit))
+      (version (git-version "0.02" revision commit)) ;from hash_extender.c
      (source (origin
                (method git-fetch)
                (uri (git-reference
@@ -1412,26 +1480,23 @@ cryptographic ratchet.  This package contains its Python bindings.")))
                      (commit commit)))
                (sha256
                 (base32
-                  "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b"))
+                  "12hh2vs8ppavjj47rgyp60cdw70lm2zqdpdv1zdgb3jgdzkg7bf2"))
                (file-name (git-file-name name version))))
      (build-system gnu-build-system)
      (arguments
-       `(#:phases
-         (modify-phases %standard-phases
-           (delete 'configure)
-           (replace 'check
-             (lambda _
-               (invoke "./hash_extender_test")))
-           (replace 'install
-             (lambda* (#:key outputs #:allow-other-keys)
-               (let* ((outdir (assoc-ref outputs "out"))
-                      (bindir (string-append outdir "/bin"))
-                      (docdir (string-append outdir
-                                             "/share/doc/hash-extender-"
-                                             ,version)))
-                 (install-file "hash_extender" bindir)
-                 (install-file "README.md" docdir)
-                 #t))))))
+       (list
+        #:phases
+        #~(modify-phases %standard-phases
+            (delete 'configure)
+            ;; See: https://github.com/iagox86/hash_extender/issues/29
+            (delete 'check)
+            (replace 'install
+              (lambda _
+                (install-file "hash_extender" (string-append #$output "/bin"))
+                (install-file
+                 "README.md"
+                 (string-append
+                  #$output "/share/doc/hash-extender-" #$version)))))))
      (inputs
       (list openssl))
      (synopsis "Tool for hash length extension attacks")
@@ -1456,18 +1521,16 @@ SHA-256, SHA-512, and WHIRLPOOL hashes.")
              (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
-     `(#:tests? #f ; no test suite
-       #:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'set-cflags
-           (lambda _
-             (setenv "CFLAGS" "-O3")))
-         (replace 'install
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let* ((outdir (assoc-ref outputs "out"))
-                    (bindir (string-append outdir "/bin")))
-               (install-file "mkp224o" bindir)
-               #t))))))
+     (list
+      #:tests? #f ; no test suite
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'configure 'set-cflags
+            (lambda _
+              (setenv "CFLAGS" "-O3")))
+          (replace 'install
+            (lambda _
+              (install-file "mkp224o" (string-append #$output "/bin")))))))
    (native-inputs
     (list autoconf))
    (inputs
@@ -1482,7 +1545,7 @@ addresses using a brute-force method.")
 (define-public transcrypt
  (package
    (name "transcrypt")
-    (version "2.1.0")
+    (version "2.3.1")
    (source
     (origin
       (method git-fetch)
@@ -1490,19 +1553,20 @@ addresses using a brute-force method.")
             (url "https://github.com/elasticdog/transcrypt")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "0bpz1hazbhfb6pqi68x55kq6a31bgh6vwij836slmi4jqiwvnh5a"))
+        (base32 "1yp1s69wphhsaks46rfj2ann8z397jgvbbq22ikdwxcw96f49pmk"))
       (file-name (git-file-name name version))))
    (inputs
     (list git openssl))
    (build-system copy-build-system)
    (arguments
-     `(#:install-plan
-       '(("transcrypt" "bin/transcrypt")
-         ("man/transcrypt.1" "share/man/man1/transcrypt.1")
-         ("contrib/bash/transcrypt"
-          "share/bash-completion/completions/transcrypt")
-         ("contrib/zsh/_transcrypt"
-          "share/zsh/site-functions/_transcrypt"))))
+     (list
+      #:install-plan
+      #~'(("transcrypt" "bin/transcrypt")
+          ("man/transcrypt.1" "share/man/man1/transcrypt.1")
+          ("contrib/bash/transcrypt"
+           "share/bash-completion/completions/transcrypt")
+          ("contrib/zsh/_transcrypt"
+           "share/zsh/site-functions/_transcrypt"))))
    (home-page "https://github.com/elasticdog/transcrypt")
    (synopsis "Transparently encrypt files within a git repository")
    (description
@@ -1570,7 +1634,7 @@ non-encrypted files.")
    (native-inputs
     (list pkg-config python-wrapper))
    (inputs
-     (list boost curl fuse-2 range-v3 spdlog))
+     (list boost-1.83 curl fuse-2 range-v3 spdlog))
    (home-page "https://www.cryfs.org/")
    (synopsis "Encrypted FUSE filesystem for the cloud")
    (description "CryFS encrypts your files, so you can safely store them anywhere.
@@ -1584,19 +1648,20 @@ structure.  However CryFS is not considered stable yet by the developers.")
 (define-public b3sum
  (package
    (name "b3sum")
-    (version "1.8.1")
+    (version "1.8.2")
    (source
      (origin
        (method url-fetch)
        (uri (crate-uri "b3sum" version))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-         (base32 "1zfyj3a8s1mg6w6l4j5hchrs8n5mfij92mg9m24pzxfi4da4543a"))))
+         (base32 "06qc6iv574km4j1ja4qhxyai680jkll58qzpz4mb79c0rk750dpd"))))
    (build-system cargo-build-system)
    (arguments
-      `(#:install-source? #f
-        #:phases
-        (modify-phases %standard-phases
+     (list
+      #:install-source? #f
+      #:phases
+      #~(modify-phases %standard-phases
          (add-before 'check 'patch-tests
            (lambda _
              (substitute* "tests/cli_tests.rs"
@@ -1650,7 +1715,7 @@ SunMD5, sha1crypt, NT, bsdicrypt, bigcrypt, and descrypt.")
 (define-public keychain
  (package
    (name "keychain")
-    (version "2.9.5")
+    (version "2.9.6")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1659,21 +1724,23 @@ SunMD5, sha1crypt, NT, bsdicrypt, bigcrypt, and descrypt.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1i698n0mp2wxk1yd8lhwq7i1dj5v01li1g9qi047aqc34r4079lq"))))
+                "0nj5rq9vzvf5g8axmicy5zfcjir7a6fr1ai4ha3cpqj4zgridga7"))))
    (build-system gnu-build-system)
-    (propagated-inputs (list procps))
-    (native-inputs (list perl))
    (arguments
-     `(#:tests? #f ; No test suite
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  (replace 'install
-                    (lambda _
-                      (install-file "keychain"
-                                    (string-append %output "/bin/"))
-                      (install-file "keychain.1"
-                                    (string-append %output "/share/man/man1"))
-                      #t)))))
+     (list
+      #:tests? #f ; No test suite
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (replace 'install
+            (lambda _
+              (install-file "keychain" (string-append #$output "/bin/"))
+              (install-file "keychain.1"
+                            (string-append #$output "/share/man/man1")))))))
+    (propagated-inputs
+     (list procps))
+    (native-inputs
+     (list perl))
    (synopsis
     "SSH or GPG agent frontend that can share a single agent on the same
 system")
@@ -433,7 +433,7 @@ sugar and output formatting inspired from @code{httpie}.")
 (define-public trurl
  (package
    (name "trurl")
-    (version "0.9")
+    (version "0.16.1")
    (source
     (origin
       (method git-fetch)
@@ -442,7 +442,7 @@ sugar and output formatting inspired from @code{httpie}.")
             (commit (string-append name "-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "10gsl0fdpybfcffmgf3qww7cpw3ifczl601042a2mqmwwrlx5zj7"))))
+        (base32 "1zdq81smm9ddqcmvwpcm01nf812fr8p4g6i2raxv3s0rd3hi68sl"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -452,7 +452,7 @@ sugar and output formatting inspired from @code{httpie}.")
      #:phases
      #~(modify-phases %standard-phases
          (delete 'configure))))
-    (native-inputs (list python))
+    (native-inputs (list python-minimal perl))
    (inputs (list curl))
    (home-page "https://curl.se/trurl/")
    (synopsis "Command line tool for URL parsing and manipulation")
@@ -5,6 +5,7 @@
 ;;; Copyright © 2021 Raghav Gururajan <rg@raghavgururajan.name>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
+;;; Copyright © 2025 Artyom V. Poptsov <poptsov.artyom@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -48,7 +49,7 @@
 (define-public blacksmith
  (package
    (name "blacksmith")
-    (version "0.0.1")
+    (version "0.0.2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -57,7 +58,7 @@
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0kyp71wndf527dgza5iks5m5vj543mvxp5w7cjd8x0pilmd1xrls"))
+                "15ib0lal2sdjb4j2a4r3645w5axbd1a6j8w9f0pxr8v3ra9cjp5m"))
              (modules '((guix build utils)))
              (snippet `(begin
                          (delete-file-recursively "external")
@@ -61,12 +61,13 @@
 ;;; Copyright © 2021, 2022 jgart <jgart@dismail.de>
 ;;; Copyright © 2023, 2024 Felix Gruber <felgru@posteo.net>
 ;;; Copyright © 2023 Munyoki Kilyungi <me@bonfacemunyoki.com>
-;;; Copyright © 2023, 2025 Giacomo Leidi <goodoldpaul@autistici.org>
+;;; Copyright © 2023, 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
 ;;; Copyright © 2024 Troy Figiel <troy@troyfigiel.com>
 ;;; Copyright © 2024 gemmaro <gemmaro.dev@gmail.com>
 ;;; Copyright © 2025 Ashvith Shetty <ashvithshetty0010@zohomail.in>
 ;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;; Copyright © 2025 Simen Endsjø <contact@simendsjo.me>
+;;; Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -139,6 +140,7 @@
  #:use-module (gnu packages multiprecision)
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages networking)
+  #:use-module (gnu packages node)
  #:use-module (gnu packages onc-rpc)
  #:use-module (gnu packages openstack)
  #:use-module (gnu packages pantheon)
@@ -206,39 +208,6 @@
  #:use-module (srfi srfi-26)
  #:use-module (ice-9 match))

-(define-public duckdb
-  (package
-    (name "duckdb")
-    (version "1.3.2")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/duckdb/duckdb")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1dg3g66az17z4snxxw7cslqdkrvbx2nnyry73yi77yp0vpri1lz8"))))
-    (arguments
-     (list
-      #:tests? #f
-      #:configure-flags
-      #~(list "-DBUILD_EXTENSIONS=autocomplete;icu;json;parquet;tpch;"
-              ;; There is no git checkout from which to read the version tag.
-              (string-append "-DOVERRIDE_GIT_DESCRIBE="
-                             "v" #$version "-0-g0123456789"))))
-    (build-system cmake-build-system)
-    (home-page "https://duckdb.org")
-    (synopsis "In-process SQL OLAP database management system")
-    (description "CLI and C/C++ source libraries for DuckDB, a relational
-(table-oriented) @acronym{DBMS, Database Management System} that supports
-@acronym{SQL, Structured Query Language}, contains a columnar-vectorized query
-execution engine, and provides transactional @acronym{ACID, Atomicity
-Consistency Isolation and Durability} guarantees via bulk-optimized
-@acronym{MVCC, Multi-Version Concurrency Control}.  Data can be stored in
-persistent, single-file databases with support for secondary indexes.")
-    (license license:expat)))
-
 (define-public ephemeralpg
  (package
    (name "ephemeralpg")
@@ -2190,6 +2159,27 @@ data in a single database.  RocksDB is partially based on @code{LevelDB}.")
    ;; files carry the 3-clause BSD license.
    (license (list license:gpl2 license:asl2.0 license:bsd-3))))

+(define-public rocksdb-for-ceph
+  (let ((commit "9fa4990159853479a222244574ca41202e4c95c1")
+        (revision "0"))
+    (package
+      (inherit rocksdb)
+      (name "rocksdb-for-ceph")
+      (version (git-version "7.9.2" revision commit))
+      (source (origin
+                (inherit (package-source rocksdb))
+                (uri (git-reference
+                       (url "https://github.com/ceph/rocksdb")
+                       (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "0pdy461m9a48x4i829sirpypdlzf3q79p8iw3dng9wd4r4vyv594"))))
+      (arguments (substitute-keyword-arguments (package-arguments rocksdb)
+                   ((#:configure-flags flags ''())
+                    #~(cons "-DCMAKE_CXX_FLAGS=-Wno-error=maybe-uninitialized"
+                            #$flags)))))))
+
 (define-public sparql-query
  (package
    (name "sparql-query")
@@ -3743,46 +3733,32 @@ streamlined for its use in the context of tortoise-orm.  It removes support
 for many database kinds that tortoise-orm doesn't need, for example.")
    (license license:asl2.0)))

-(define-public python-sphinxcontrib-asyncio
-  (package
-    (name "python-sphinxcontrib-asyncio")
-    (version "0.3.0")
-    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "sphinxcontrib-asyncio" version))
-        (sha256
-          (base32 "0bkj010ygsr7m769llf2aq4bbjfhdwqrrabi98j8gpvyzvh2dzcr"))))
-    (build-system python-build-system)
-    (arguments '(#:tests? #f))          ;no test suite
-    (propagated-inputs (list python-sphinx))
-    (home-page "https://github.com/aio-libs/sphinxcontrib-asyncio")
-    (synopsis "Sphinx extension to support coroutines in markup")
-    (description "This package is a Sphinx extension providing additional
-coroutine-specific markup.")
-    (license license:asl2.0)))
-
 (define-public python-asyncpg
  (package
    (name "python-asyncpg")
+    ;; asyncpg 0.31.0 requires Cython(>=3.2.1,<4.0.0), got Cython==3.1.2
    (version "0.30.0")
    (source
     (origin
+       ;; git-fetch leads to errors like
+       ;; ValueError: 'asyncpg/pgproto/pgproto.pyx' doesn't match any files
       (method url-fetch)
       (uri (pypi-uri "asyncpg" version))
       (sha256
        (base32 "0lf8xbrsb2ycpqx1vzlb05p48g5sh9zq24a8yh17cw5nia9fjlf5"))))
    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      ;; raises ValueError("Invalid IPv6 URL") ; Maybe due to urllib?
+      #~(list "-k" "not TestConnectParams")))
    (native-inputs
     (list postgresql
           python-cython
           python-pytest
           python-uvloop
           python-distro
-           python-setuptools
-           python-wheel))
-    (propagated-inputs
-     (list python-async-timeout))
+           python-setuptools))
    (home-page "https://github.com/MagicStack/asyncpg")
    (synopsis "Fast PostgreSQL database client library for Python")
    (description "@code{asyncpg} is a database interface library designed
@@ -4390,26 +4366,53 @@ framework.")
 (define-public python-sqlalchemy-utils
  (package
    (name "python-sqlalchemy-utils")
-    (version "0.38.3")
+    (version "0.42.1")
    (source
-      (origin
-        (method url-fetch)
-        (uri (pypi-uri "SQLAlchemy-Utils" version))
-        (sha256
-         (base32 "0k8z0mjhvdv302kn0nhci8b2dgw4cn2akprsf37ma1540ykgp6lz"))))
-    (build-system python-build-system)
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/kvesteri/sqlalchemy-utils")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0ny1p352p0dlgrf9fnmzj7ld1rga5zj698qpla1kdaliwwh6xawn"))))
+    (build-system pyproject-build-system)
    (arguments
-     '(#:tests? #f)) ; FIXME: Many tests require a running database server.
-       ;; #:phases
-       ;; (modify-phases %standard-phases
-       ;;   (replace 'check
-       ;;     (lambda _
-       ;;       (zero? (system* "py.test" "sqlalchemy_utils" "tests")))))
-    (propagated-inputs
-     (list python-six python-sqlalchemy))
+     (list
+      #:test-flags
+      ;; XXX: These tests require additional inputs.
+      #~(list "--deselect=tests/test_views.py::TestMySqlTrivialView"
+              "--deselect=tests/functions/test_database.py::\
+TestDatabasePostgresPg8000::test_create_and_drop"
+              "--deselect=tests/functions/test_database.py::\
+TestDatabasePostgresPsycoPG2CFFI::test_create_and_drop")
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'start-postgresql
+            (lambda* (#:key inputs tests? #:allow-other-keys)
+              (when tests?
+                (setenv "TZDIR" (search-input-directory inputs
+                                                        "share/zoneinfo"))
+                (let ((dbdir (string-append (getcwd) "/../pgdir")))
+                  (setenv "SQLALCHEMY_UTILS_TEST_POSTGRESQL_USER"
+                          "nixbld")
+                  (invoke "initdb" "-D" dbdir)
+                  (invoke "pg_ctl" "-D" dbdir
+                          "-o" (string-append "-k " dbdir)
+                          "-l" (string-append dbdir "/db.log")
+                          "start")
+	          (invoke "psql" "-h" dbdir "-d" "postgres"
+                          "-c" "CREATE DATABASE sqlalchemy_utils_test;"))))))))
+    (propagated-inputs (list python-six python-sqlalchemy))
    (native-inputs
-     (list python-dateutil python-flexmock python-psycopg2 python-pytest
-           python-pytz))
+     (list postgresql
+           python-dateutil
+           python-flexmock
+           python-psycopg2
+           python-pytest
+           python-pytz
+           python-setuptools
+           tzdata-for-tests))
    (home-page "https://github.com/kvesteri/sqlalchemy-utils")
    (synopsis "Various utility functions for SQLAlchemy")
    (description
@@ -4511,19 +4514,23 @@ SQLAlchemy Database Toolkit for Python.")
  (package
    (name "python-sqlite-fts4")
    (version "1.0.3")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "sqlite-fts4" version))
-              (sha256
-               (base32
-                "034kx0ac556sywy1p4qcrc36l24w3q0xwswqv2z9s3k8yvm5xc3q"))))
-    (build-system python-build-system)
-    (native-inputs (list python-pytest))
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/simonw/sqlite-fts4")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "05c69n4nrc9srkbih1q1wxlw6n9mb3dm7ysb47ipqjn3rp1aif11"))))
+    (build-system pyproject-build-system)
+    (native-inputs (list python-pytest python-setuptools))
    (home-page "https://github.com/simonw/sqlite-fts4")
    (synopsis "Python functions for working with SQLite FTS4 search")
-    (description "This package provides custom SQLite functions written
-in Python for ranking documents indexed using the SQLite's FTS4 full
-text search extension.")
+    (description
+     "This package provides custom SQLite functions written in Python for
+ranking documents indexed using the SQLite's FTS4 full text search
+extension.")
    (license license:asl2.0)))

 (define-public python-sqlite-utils
@@ -4649,31 +4656,21 @@ into Python.")
 (define-public python-aiosqlite
  (package
    (name "python-aiosqlite")
-    (version "0.18.0")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                    (url "https://github.com/omnilib/aiosqlite")
-                    (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1a8sggh1wwbpl46k5qcfmp97s9hjysna0x7mwwc53kyfm0m95wf8"))))
+    (version "0.21.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/omnilib/aiosqlite")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1njzxi130bbix53wl0gcsvryk1b2cazq0s2701jbkf6nvr3ywpyy"))))
    (build-system pyproject-build-system)
-    (arguments
-     (list #:phases #~(modify-phases %standard-phases
-                        (replace 'check
-                          (lambda* (#:key tests? #:allow-other-keys)
-                            (when tests?
-                              (invoke "python" "-m" "coverage" "run" "-m"
-                                      "aiosqlite.tests")
-                              (invoke "python" "-m" "coverage" "report")))))))
-    (native-inputs (list python-flit-core
-                         python-coverage
-                         python-mypy))
+    (arguments (list #:test-backend #~'unittest))
+    (native-inputs (list python-flit-core))
    (home-page "https://github.com/jreese/aiosqlite")
-    (synopsis
-     "Asyncio bridge for sqlite3")
+    (synopsis "Asyncio bridge for sqlite3")
    (description
     "The package aiosqlite replicates the standard sqlite3 module, but with
 async versions of all the standard connection and cursor methods, and context
@@ -4683,14 +4680,33 @@ managers for automatically closing connections.")
 (define-public python-databases
  (package
    (name "python-databases")
-    (version "0.7.0")
+    ;; 0.9.0 needs sqlalchemy>=2.0.7
+    ;; 0.8.0 needs sqlalchemy>=1.4.42,<1.5
+    (version "0.8.0")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "databases" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/encode/databases")
+              (commit version)))
+       (file-name (git-file-name name version))
       (sha256
-        (base32 "0x5nqhzgjqimv2ybjbzy5vv0l23g0n1g5f6fnyahbf1f7nfl2bga"))))
-    (build-system python-build-system)
+        (base32 "183yawn8w561y1ni117rf5zaxm4gqqbcmi9fp52xd5fx2dj8qy3v"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      ;; These need TEST_DATABASE_URLS set.
+      ;; TODO: Use "sqlite:///test.db"? See docs/contributing.md.
+      #~(list "--ignore=tests/test_databases.py"
+              "--ignore=tests/test_integration.py"
+              "--ignore=tests/test_connection_options.py")))
+    (native-inputs
+     (list python-httpx
+           python-psycopg
+           python-pytest
+           python-setuptools
+           python-starlette))
    (propagated-inputs
     (list python-aiosqlite
           python-aiopg
@@ -4707,18 +4723,41 @@ libraries with SQLALchemy.")
 (define-public python-psycopg2
  (package
    (name "python-psycopg2")
-    (version "2.9.6")
+    (version "2.9.11")
    (source
     (origin
-       (method url-fetch)
-       (uri (pypi-uri "psycopg2" version))
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/psycopg/psycopg2")
+              (commit version)))
+       (file-name (git-file-name name version))
       (sha256
-        (base32 "04chl9f7v7k1zssa40pmk06jvpyqiss2lpjq50dq69nqix0mhlgi"))))
-    (build-system python-build-system)
+        (base32 "04l2yzbl15nrw1pcjfkqycvqn6h9phcdh1xx9ynfy3dzfscq5ly5"))))
+    (build-system pyproject-build-system)
    (arguments
-     ;; Tests would require a postgresql database "psycopg2_test"
-     ;; and a running postgresql database management service.
-     '(#:tests? #f)) ; TODO re-enable after providing a test-db.
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'start-postgresql
+            (lambda* (#:key inputs tests? #:allow-other-keys)
+              (when tests?
+                (setenv "TZDIR" (search-input-directory inputs
+                                                        "share/zoneinfo"))
+                (let ((dbdir (string-append (getcwd) "/../pgdir")))
+                  (setenv "PSYCOPG2_TESTDB_USER" "nixbld")
+                  (setenv "PSYCOPG2_TESTDB_HOST" dbdir)
+                  (invoke "initdb" "-D" dbdir)
+                  (invoke "pg_ctl" "-D" dbdir
+                          "-o" (string-append "-k " dbdir)
+                          "-l" (string-append dbdir "/db.log")
+                          "start")
+	          (invoke "psql" "-h" dbdir "-d" "postgres"
+                          "-c" "CREATE DATABASE psycopg2_test;"))))))))
+    (native-inputs
+     (list postgresql
+           python-pytest
+           python-setuptools
+           tzdata-for-tests))
    (inputs
     (list postgresql)) ; libpq
    (home-page "https://www.psycopg.org/")
@@ -4740,14 +4779,16 @@ libraries with SQLALchemy.")
              (sha256
               (base32
                "1pkx7nj1mhacwpna7ldzqfqxd1xg8826600r0bs9ad1h93f429yh"))))
-    (build-system python-build-system)
+    (build-system pyproject-build-system)
    (arguments
-     (list #:tests? #f                  ;run for psycopg below
-           #:phases
-           #~(modify-phases %standard-phases
-               ;; This module requires 'psycopg', however psycopg needs this
-               ;; for its tests.  Disable sanity check to break the cycle.
-               (delete 'sanity-check))))
+     (list
+      #:tests? #f                  ;run for psycopg below
+      #:phases
+      #~(modify-phases %standard-phases
+          ;; This module requires 'psycopg', however psycopg needs this
+          ;; for its tests.  Disable sanity check to break the cycle.
+          (delete 'sanity-check))))
+    (native-inputs (list python-setuptools))
    (home-page "https://www.psycopg.org/")
    (synopsis "Connection pooler for psycopg")
    (description
@@ -4858,23 +4899,49 @@ from a SQLAlchemy model (or directly from the database).")
 (define-public yoyo-migrations
  (package
    (name "yoyo-migrations")
-    (version "8.2.0")
+    (version "9.0.0")
    (source
     (origin
-       ;; We use the upstream repository, as the tests are not included in the
-       ;; PyPI releases.
       (method hg-fetch)
       (uri (hg-reference
             (url "https://hg.sr.ht/~olly/yoyo")
             (changeset (string-append "v" version "-release"))))
       (file-name (string-append name "-" version "-checkout"))
       (sha256
-        (base32 "1al030ix0w63hr4s3mqry6s0mlqdj8p242pdqks06br7c25nx3yj"))))
-    (build-system python-build-system)
+        (base32 "0bn4n043y0n4dh7axwavfims2krap5dcmdaxswbadzmis3a4hxyb"))))
+    (build-system pyproject-build-system)
    (arguments
-     ;; XXX: Tests require a connection to some pgsql database and psycopg
-     ;; fails to connect to it.
-     '(#:tests? #f))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'start-postgresql
+            (lambda* (#:key inputs tests? #:allow-other-keys)
+              (when tests?
+                (delete-file "test_databases.ini")
+                (call-with-output-file "test_databases.ini"
+                  (lambda (port)
+                    (format port "[DEFAULT]
+postgresql = postgresql://nixbld@/yoyo_test~%")))
+                (setenv "TZDIR" (search-input-directory inputs
+                                                        "share/zoneinfo"))
+                (let ((dbdir (string-append (getcwd) "/../pgdir")))
+                  (setenv "PGHOST" dbdir)
+                  (setenv "PGUSER" "nixbld")
+                  (invoke "initdb" "-D" dbdir)
+                  (invoke "pg_ctl" "-D" dbdir
+                          "-o" (string-append "-k " dbdir)
+                          "-l" (string-append dbdir "/db.log")
+                          "start")
+	          (invoke "psql" "-h" dbdir "-d" "postgres"
+                          "-c" "CREATE DATABASE yoyo_test;"))))))))
+    (native-inputs
+     (list postgresql
+           python-freezegun
+           python-psycopg2
+           python-pytest
+           python-setuptools
+           tms
+           tzdata-for-tests))
    (propagated-inputs
     (list python-sqlparse python-tabulate python-importlib-metadata))
    (home-page "https://ollycope.com/software/yoyo/latest/")
@@ -5178,13 +5245,13 @@ provides support for parsing, splitting and formatting SQL statements.")
 (define-public python-sql
  (package
    (name "python-sql")
-    (version "1.6.0")
+    (version "1.7.0")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "python_sql" version))
       (sha256
-        (base32 "0v637qc2g8w155k7crlg70w4bfxznn28c94prlxcax5dx0ja2d2v"))))
+        (base32 "09niqspjmsn9wyqadgqjcrsxxa7w4r6dcp21xhi1mimr4ya0p5ky"))))
    (build-system pyproject-build-system)
    (native-inputs (list python-pytest python-setuptools))
    (home-page "https://python-sql.tryton.org/")
@@ -5196,19 +5263,21 @@ transforms idiomatic python function calls to well-formed SQL queries.")
 (define-public python-pypika
  (package
    (name "python-pypika")
-    (version "0.47.6")
+    (version "0.49.0")
    (source
-     (origin (method git-fetch)
-             (uri (git-reference
-                   (url "https://github.com/kayak/pypika")
-                   (commit (string-append "v" version))))
-             (file-name (git-file-name name version))
-             (sha256
-              (base32
-               "001pg36sw9a36zdd1kccbymcxndphjcjbbrsy6ri7ng8h4dgz549"))))
-    (build-system python-build-system)
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/kayak/pypika")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0nxm2cxq9sx43g57qxw7kzy8lsl5svq659r3mhxpa9vcbxrjrb1d"))))
+    (build-system pyproject-build-system)
    (native-inputs
-     (list python-parameterized))
+     (list python-parameterized
+           python-pytest
+           python-setuptools))
    (home-page "https://github.com/kayak/pypika")
    (synopsis "SQL query builder API for Python")
    (description
@@ -5233,6 +5302,8 @@ the SQL language using a syntax that reflects the resulting query.")
    (build-system cmake-build-system)
    (arguments
     (list
+      ;; XXX: Some tests fail on i686, run on 64bit only for now.
+      #:tests? (target-64bit?)
      #:build-type "Release"
      #:configure-flags
      #~(list "-DBUILD_JAVA=OFF"
@@ -5305,7 +5376,7 @@ with integrated support for finding required rows quickly.")
 (define-public apache-arrow
  (package
    (name "apache-arrow")
-    (version "21.0.0")
+    (version "22.0.0")
    (source
     (origin
       (method git-fetch)
@@ -5315,7 +5386,7 @@ with integrated support for finding required rows quickly.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "0lxywrjfwhiznsldpv5bd6g357za5ng64jvy943kp0ndckh5l4g9"))))
+         "09ra9p2majsczjq6ygcz2jqafdryvrzahxsbflfqp2z8invsd14b"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -5563,7 +5634,7 @@ algorithm implementations.")
  (package
    (inherit apache-arrow)
    (name "python-pyarrow")
-    (build-system python-build-system)
+    (build-system pyproject-build-system)
    (arguments
     (list
      ;; XXX: Test data is distributed separately in
@@ -5573,7 +5644,6 @@ algorithm implementations.")
      #:tests? #f
      #:phases
      #~(modify-phases %standard-phases
-          (delete 'build) ; XXX the build is performed again during the install phase
          (add-after 'unpack 'enter-source-directory
            (lambda _ (chdir "python")))
          (add-after 'enter-source-directory 'set-version
@@ -5617,7 +5687,8 @@ __version_tuple__ = version_tuple = (~a)~%" version version-tuple))))))
           python-cython
           python-pytest
           python-pytest-runner
-           python-setuptools-scm))
+           python-setuptools-scm
+           python-setuptools))
    (outputs '("out"))
    (home-page "https://arrow.apache.org/docs/python/")
    (synopsis "Python bindings for Apache Arrow")
@@ -5703,16 +5774,31 @@ and @code{intake-parquet}.  It supports the following compression algorithms:
 (define-public python-crate
  (package
    (name "python-crate")
-    (version "0.23.2")
-    (source (origin
-              (method url-fetch)
-              (uri (pypi-uri "crate" version))
-              (sha256
-               (base32
-                "0ngmlvi320c5gsxab0s7qgq0ck4jdlcwvb6lbjhnfprafdp56vvx"))))
-    (build-system python-build-system)
-    (propagated-inputs
-     (list python-urllib3))
+    (version "2.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/crate/crate-python")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0kk84wf7awgspdijycvhkbqvm5llp3wmwxa9n4w3qda861xn6krb"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      #~(list "--ignore=tests/testing/test_layer.py" ; Requires crate binary.
+              "--ignore=tests/client/test_http.py"))) ; XXX: fails collection.
+    (native-inputs
+     (list python-orjson
+           python-pytest
+           python-pytz
+           python-setuptools
+           python-sqlalchemy
+           python-verlib2
+           tzdata-for-tests))
+    (propagated-inputs (list python-urllib3))
    (home-page "https://github.com/crate/crate-python")
    (synopsis "CrateDB Python client")
    (description
@@ -5907,6 +5993,46 @@ with no external dependencies.  The targets are small apps that would
 be blown away by a SQL-DB or an external database server.")
    (license license:expat)))

+(define-public sdb
+  (package
+    (name "sdb")
+    (version "2.2.4")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/radareorg/sdb.git")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "15pc807s2nmhnr3mspyz9h47rkxkv1r07x959ir17v5b6zs7wxvw"))))
+    (build-system meson-build-system)
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'setenv-cc
+            (lambda _
+              (setenv "CC" #$(cc-for-target))))
+          ;; The provided meson.build uses a Makefile in the source root
+          ;; to run the tests, but resolves its directory relative to
+          ;; the build directory, assuming the build is one level under
+          ;; the source tree. This breaks if the build tree is elsewhere.
+          (add-before 'check 'set-test-workdir-to-source-root
+            (lambda _
+              (substitute* "../source/meson.build"
+                (("workdir: join_paths.*$")
+                 "workdir: meson.project_source_root(),\n")))))))
+    (native-inputs
+     (list node
+           perl
+           python-minimal-wrapper))
+    (home-page "https://github.com/radareorg/sdb")
+    (synopsis "Simple and fast string based key-value database")
+    (description "SDB is a simple key/value database based on djb's cdb disk
+storage that supports JSON and array introspection.")
+    (license license:expat)))
+
 (define-public sequeler
  (package
    (name "sequeler")
@@ -5987,7 +6113,7 @@ a Gtk.Grid Widget.")
                   "-DFORCE_INTERNAL_QHEXEDIT=OFF"
                   "-DENABLE_TESTING=ON")))
    (inputs
-     (list qcustomplot
+     (list qcustomplot-qt5
           qhexedit
           qscintilla
           qtbase-5
@@ -6005,7 +6131,7 @@ compatible with SQLite using a graphical user interface.")
 (define-public sqlitestudio
  (package
    (name "sqlitestudio")
-    (version "3.4.17")
+    (version "3.4.18")
    (source
     (origin
       (method git-fetch)
@@ -6014,7 +6140,7 @@ compatible with SQLite using a graphical user interface.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1zb1qr88rwkzmrxc0lm99x8h99hpn5c2wfdpvqzs9f9ph8qvasww"))))
+        (base32 "1chsm4hxy483hz569ywacysg4dh9ijis060s4rgydkgk49bbb2si"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -116,13 +116,23 @@ clients.")
 (define-public xandikos
  (package
    (name "xandikos")
-    (version "0.2.12")
+    (version "0.3.0")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "xandikos" version))
-       (sha256 (base32 "0x6g5s9pkippxg429r9agp3w0xsid2vv1h45wfc3xzdfvgj6ygsr"))))
-    (build-system python-build-system)
+       (sha256
+        (base32 "10j7qmwcrwql4ah6q8si3nf1ljwrx99w8ipiy85bzjd3qz2vackj"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-backend #~'unittest
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'check-setup
+            (lambda _
+              (setenv "XANDIKOSPATH" (mkdtemp "/tmp/xandikospath-XXXXXX")))))))
+    (native-inputs (list python-setuptools))
    (propagated-inputs
     (list python-aiohttp
           python-defusedxml
@@ -131,13 +141,6 @@ clients.")
           python-jinja2
           python-multidict
           python-vobject))
-    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'check-setup
-            (lambda _
-              (setenv "XANDIKOSPATH" (mkdtemp "/tmp/xandikospath-XXXXXX")))))))
    (home-page "https://www.xandikos.org/")
    (synopsis "Lightweight CalDAV/CardDAV server")
    (description
@@ -65,23 +65,22 @@
        (("AC_DEFINE\\(HAVE_SYSTEM_INCLUDE_FILES\\)")
         "AC_DEFINE(HAVE_SYSTEM_INCLUDE_FILES, [], [Description])"))))

-(define-public bdb-4.8
+(define-public bdb-5.3
  (package
    (name "bdb")
-    (version "4.8.30")
-    (license (license:non-copyleft "file://LICENSE"
-                                   "See LICENSE in the distribution."))
+    (version "5.3.28")
    (source (origin
-             (method url-fetch)
-             (uri (string-append "https://download.oracle.com/berkeley-db/db-"
-                                 version ".tar.gz"))
-             (sha256
-              (base32
-               "0ampbl2f0hb1nix195kz1syrqqxpmvnvnfvphambj7xjrl3iljg0"))
-             (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))
-             (modules '((guix build utils)
-                        (srfi srfi-1)))
-             (snippet bdb-snippet)))
+              (method url-fetch)
+              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))
+              (patch-flags '("-p0"))
+              (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))
+              (modules '((guix build utils)
+                         (srfi srfi-1)))
+              (snippet bdb-snippet)))
    (build-system gnu-build-system)
    (outputs '("out"                             ; programs, libraries, headers
               "doc"))                           ; 94 MiB of HTML docs
@@ -153,40 +152,29 @@
    (description
     "Berkeley DB is an embeddable database allowing developers the choice of
 SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
-    ;; Starting with version 6, BDB is distributed under AGPL3. Many individual
-    ;; files are covered by the 3-clause BSD license.
    (home-page
-     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")))
-
-(define-public bdb-5.3
-  (package (inherit bdb-4.8)
-    (name "bdb")
-    (version "5.3.28")
-    (source (origin
-              (inherit (package-source bdb-4.8))
-              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
-                                  version ".tar.gz"))
-              (sha256
-               (base32
-                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))
-              (patch-flags '("-p0"))
-              (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))))))
+     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")
+    (license (license:non-copyleft "file://LICENSE"
+                                   "See LICENSE in the distribution."))))

 (define-public bdb-6
-  (package (inherit bdb-4.8)
+  (package
    (name "bdb")
    (version "6.2.32")
    (source (origin
-              (inherit (package-source bdb-4.8))
              (method url-fetch)
              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
                                  version ".tar.gz"))
              (sha256
               (base32
                "1yx8wzhch5wwh016nh0kfxvknjkafv6ybkqh6nh7lxx50jqf5id9"))
-              (patches '())))
-    ;; Copy-paste the arguments from bdb-4.8 and drop the
+              (modules '((guix build utils)
+                         (srfi srfi-1)))
+              (snippet bdb-snippet)))
+    ;; Copy-paste the arguments from bdb-5.3 and drop the
    ;; 'bdb-configure patch phase.
+    (build-system gnu-build-system)
+    (outputs '("out" "doc"))
    (arguments
     (list #:tests? #f                        ; no check target available
           #:disallowed-references '("doc")
@@ -239,6 +227,13 @@ SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
                     (("rm (.*) configure") "")
                     (("chmod (.*) config.guess(.*)$") ""))
                   (invoke "sh" "s_config"))))))
+    (native-inputs (list autoconf automake-1.16.5 libtool))
+    (synopsis "Berkeley database")
+    (description
+     "Berkeley DB is an embeddable database allowing developers the choice of
+SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
+    (home-page
+     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")
    ;; Starting with version 6, BDB is distributed under AGPL3. Many individual
    ;; files are covered by the 3-clause BSD license.
    (license (list license:agpl3+ license:bsd-3))))
--- a/Show More
+++ b/Show More