Update NEWS.

nls: Update 'fr' translation of the manual.
gnu: xfdesktop: Add Guix logo to the default background.
2020-11-22 20:27:28 +01:00 · 2020-11-21 15:51:59 +01:00 · 2020-11-21 15:51:44 +01:00 · 2020-11-21 15:51:32 +01:00 · 2020-11-18 22:37:17 +01:00 · 2020-11-18 22:31:32 +01:00
938 changed files with 323677 additions and 108635 deletions
@@ -8,7 +8,38 @@
     ;; For use with 'bug-reference-prog-mode'.
     (bug-reference-url-format . "http://bugs.gnu.org/%s")
     (bug-reference-bug-regexp
-      . "<https?://\\(debbugs\\|bugs\\)\\.gnu\\.org/\\([0-9]+\\)>")))
+      . "<https?://\\(debbugs\\|bugs\\)\\.gnu\\.org/\\([0-9]+\\)>")
+
+     ;; Emacs-Guix
+     (eval . (setq-local guix-directory
+                         (locate-dominating-file default-directory
+                                                 ".dir-locals.el")))
+
+     ;; Geiser
+     ;; This allows automatically setting the `geiser-guile-load-path'
+     ;; variable when using various Guix checkouts (e.g., via git worktrees).
+     (eval . (let ((root-dir-unexpanded (locate-dominating-file
+                                         default-directory ".dir-locals.el")))
+               ;; While Guix should in theory always have a .dir-locals.el
+               ;; (we are reading this file, after all) there seems to be a
+               ;; strange problem where this code "escapes" to some other buffers,
+               ;; at least vc-mode.  See:
+               ;;   https://lists.gnu.org/archive/html/guix-devel/2020-11/msg00296.html
+               ;; Upstream report: <https://bugs.gnu.org/44698>
+               ;; Hence the following "when", which might otherwise be unnecessary;
+               ;; it prevents causing an error when root-dir-unexpanded is nil.
+               (when root-dir-unexpanded
+                 (let* ((root-dir (expand-file-name root-dir-unexpanded))
+                        ;; Workaround for bug https://issues.guix.gnu.org/43818.
+                        (root-dir* (directory-file-name root-dir)))
+
+                   (unless (boundp 'geiser-guile-load-path)
+                     (defvar geiser-guile-load-path '()))
+                   (make-local-variable 'geiser-guile-load-path)
+                   (require 'cl-lib)
+                   (cl-pushnew root-dir* geiser-guile-load-path
+                               :test #'string-equal)))))))
+
 (c-mode          . ((c-file-style . "gnu")))
 (scheme-mode
  .
@@ -37,8 +68,10 @@
   (eval . (put 'with-file-lock 'scheme-indent-function 1))
   (eval . (put 'with-file-lock/no-wait 'scheme-indent-function 1))
   (eval . (put 'with-profile-lock 'scheme-indent-function 1))
+   (eval . (put 'with-writable-file 'scheme-indent-function 2))

   (eval . (put 'package 'scheme-indent-function 0))
+   (eval . (put 'package/inherit 'scheme-indent-function 1))
   (eval . (put 'origin 'scheme-indent-function 0))
   (eval . (put 'build-system 'scheme-indent-function 0))
   (eval . (put 'bag 'scheme-indent-function 0))
@@ -88,13 +121,18 @@
   (eval . (put 'let-system 'scheme-indent-function 1))

   (eval . (put 'with-database 'scheme-indent-function 2))
-   (eval . (put 'call-with-transaction 'scheme-indent-function 2))
+   (eval . (put 'call-with-transaction 'scheme-indent-function 1))
+   (eval . (put 'with-statement 'scheme-indent-function 3))
+   (eval . (put 'call-with-retrying-transaction 'scheme-indent-function 1))
+   (eval . (put 'call-with-savepoint 'scheme-indent-function 1))
+   (eval . (put 'call-with-retrying-savepoint 'scheme-indent-function 1))

   (eval . (put 'call-with-container 'scheme-indent-function 1))
   (eval . (put 'container-excursion 'scheme-indent-function 1))
   (eval . (put 'eventually 'scheme-indent-function 1))

   (eval . (put 'call-with-progress-reporter 'scheme-indent-function 1))
+   (eval . (put 'with-repository 'scheme-indent-function 2))
   (eval . (put 'with-temporary-git-repository 'scheme-indent-function 2))
   (eval . (put 'with-environment-variables 'scheme-indent-function 1))
   (eval . (put 'with-fresh-gnupg-setup 'scheme-indent-function 1))
@@ -66,6 +66,7 @@
 /doc/stamp-vti
 /doc/version.texi
 /doc/version-*.texi
+/etc/committer.scm
 /etc/gnu-store.mount
 /etc/guix-daemon.cil
 /etc/guix-daemon.conf
@@ -73,6 +74,7 @@
 /etc/guix-publish.conf
 /etc/guix-publish.service
 /etc/init.d/guix-daemon
+/etc/openrc/guix-daemon
 /guix-daemon
 /guix/config.scm
 /libformat.a
@@ -88,17 +90,8 @@
 /m4/nls.m4
 /m4/po.m4
 /m4/progtest.m4
-/nix-setuid-helper
-/nix/AUTHORS
-/nix/COPYING
 /nix/config.h
 /nix/config.h.in
-/nix/nix-daemon/nix-daemon.cc
-/nix/nix-setuid-helper/nix-setuid-helper.cc
-/nix/scripts/authenticate
-/nix/scripts/list-runtime-roots
-/nix/scripts/offload
-/nix/scripts/substitute
 /po/doc/*.mo
 /po/guix/*.gmo
 /po/guix/*.insert-header
@@ -147,9 +140,13 @@ Makefile
 Makefile.in
 config.cache
 stamp-h[0-9]
+.dirstamp
+.deps
 tmp
 /doc/os-config-lightweight-desktop.texi
 /nix/scripts/download
 /.version
 /doc/stamp-[0-9]
 /gnu/packages/bootstrap
+/gnu/packages/aux-files/guile-guile-launcher.o
+/guile
@@ -1,5 +1,5 @@
-;; This is the list of OpenPGP keys currently authorized to sign commits in
-;; this repository.
+;; This file, which is best viewed as -*- Scheme -*-, lists the OpenPGP keys
+;; currently authorized to sign commits in this repository.

 (authorizations
 (version 0)
@@ -27,15 +27,13 @@
  (;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
   "A0C5 E352 2EF8 EF5C 64CD  B7F0 FD73 CAC7 19D3 2566"
   (name "bavier"))
-  ("3774 8024 880F D3FF DCA2  C9AB 5893 6E0E 2F1B 5A4C"
-   (name "beffa"))
  ("BCF8 F737 2CED 080A 67EB  592D 2A6A D9F4 AAC2 0DF6"
   (name "benwoodcroft"))
  ("45CC 63B8 5258 C9D5 5F34  B239 D37D 0EA7 CECC 3912"
   (name "biscuolo"))
  ("7988 3B9F 7D6A 4DBF 3719  0367 2506 A96C CF63 0B21"
   (name "boskovits"))
-  ("DFC0 C7F7 9EE6 0CA7 AE55  5E19 6722 43C4 A03F 0EEE"
+  ("E82A C026 95D6 FF02 43CA  1E5C F6C5 2DD1 BA27 CB87"
   (name "brettgilio"))
  (;; primary: "8929 BBC5 73CD 9206 3DDD 979D 3D36 CAA0 116F 0F99"
   "1C9B F005 1A1A 6A44 5257 599A A949 03A1 66A1 8FAE"
@@ -58,14 +56,8 @@
   (name "davexunit (2nd)"))
  ("53C4 1E6E 41AA FE55 335A  CA5E 446A 2ED4 D940 BF14"
   (name "daviwil"))
-  ("6909 6DFD D702 8BED ACC5  884B C5E0 51C7 9C0B ECDB"
-   (name "dvc"))
-  ("5F43 B681 0437 2F4B A898  A64B 33B9 E9FD E28D 2C23"
-   (name "dvc (old)"))
  ("A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351"
   (name "efraim"))
-  ("9157 41FE B22F A4E3 3B6E  8F8D F4C1 D391 7EAC EE93"
-   (name "efraim (old)"))
  (;; primary: "2453 02B1 BAB1 F867 FDCA  96BC 8F3F 861F 82EB 7A9A"
   "CBC5 9C66 EC27 B971 7940  6B3E 6BE8 208A DF21 FE3F"
   (name "glv"))
@@ -78,13 +70,8 @@
  (;; primary: "66A5 6D9C 9A98 BE7F 719A  B401 2652 5665 AE72 7D37"
   "0325 78A6 8298 94E7 2AA2  66F5 D415 BF25 3B51 5976"
   (name "iyzsong"))
-
-  ;; https://lists.gnu.org/archive/html/guix-devel/2018-04/msg00229.html
-  ("DB34 CB51 D25C 9408 156F  CDD6 A12F 8797 8D70 1B99"
-   (name "janneke (old)"))
  ("1A85 8392 E331 EAFD B8C2  7FFB F3C1 A0D9 C1D6 5273"
   (name "janneke"))
-
  (;; primary: "1BA4 08C5 8BF2 0EA7 3179  635A 865D C0A3 DED9 B5D0"
   "E31D 9DDE EBA5 4A14 8A20  4550 DA45 97F9 47B4 1025"
   (name "jlicht"))
@@ -97,6 +84,8 @@
   (name "lfam"))
  ("2AE3 1395 932B E642 FC0E  D99C 9BED 6EDA 32E5 B0BC"
   (name "lsl88"))
+  ("8887 84C4 1459 ACCB 83E7  E84C 634C 6E89 79FA BEC2"
+   (name "m1gu3l"))
  ("CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D"
   (name "marusich"))
  ("BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"
@@ -114,6 +103,9 @@
   (name "ngz"))
  ("CEF4 CB91 4856 BA38 0A20  A7E2 3008 88CB 39C6 3817"
   (name "pelzflorian"))
+  (;; primary: "41CA 12EA DE0C F33F 6885  A58F 5719 6E37 E00B 77FD"
+   "72D5 3D81 8CB6 F4A1 7258  374C A8FC 9E44 7F4F 7D54"
+   (name "planglois"))
  (;; primary: "B68B DF22 73F9 DA0E 63C1  8A32 515B F416 9242 D600"
   "C699 ED09 E51B CE89 FD1D  A078 AAC7 E891 896B 568A"
   (name "pgarlick"))
@@ -2,4 +2,6 @@

 (channel
  (version 0)
-  (news-file "etc/news.scm"))
+  (news-file "etc/news.scm")
+  (keyring-reference "keyring")
+  (url "https://git.savannah.gnu.org/git/guix.git")) ;the primary URL
@@ -13,7 +13,7 @@ Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>

 * Contributing

-See the manual for useful hacking informations, either by running
+See the manual for useful hacking information, either by running

  info -f doc/guix.info "Contributing"

@@ -47,6 +47,18 @@ scripts/guix: scripts/guix.in Makefile
 	$(AM_V_GEN)$(do_subst) < "$(srcdir)/$@.in" > "$@-t"
 	$(AM_V_at)chmod a+x,a-w "$@-t" && mv -f "$@-t" "$@"

+# This is our variant of the 'guile' executable, one that doesn't complain
+# about locales.
+pkglibexec_PROGRAMS = guile
+guile_SOURCES = gnu/packages/aux-files/guile-launcher.c
+guile_LDADD   = $(GUILE_LIBS)
+guile_CFLAGS  = $(GUILE_CFLAGS)
+
+# Have the 'guix' command refer to our 'guile'.
+install-exec-hook:
+	$(SED) -i "$(DESTDIR)$(bindir)/guix"				\
+	       -e 's,^#![[:graph:]]\+,#!$(pkglibexecdir)/guile,g'
+
 nodist_noinst_SCRIPTS =				\
  pre-inst-env					\
  test-env
@@ -68,7 +80,6 @@ MODULES =					\
  guix/cpio.scm					\
  guix/deprecation.scm				\
  guix/docker.scm	   			\
-  guix/json.scm					\
  guix/records.scm				\
  guix/openpgp.scm				\
  guix/pki.scm					\
@@ -80,6 +91,7 @@ MODULES =					\
  guix/modules.scm				\
  guix/download.scm				\
  guix/discovery.scm				\
+  guix/android-repo-download.scm		\
  guix/bzr-download.scm            		\
  guix/git-download.scm				\
  guix/hg-download.scm				\
@@ -93,6 +105,7 @@ MODULES =					\
  guix/derivations.scm				\
  guix/grafts.scm				\
  guix/repl.scm					\
+  guix/transformations.scm			\
  guix/inferior.scm				\
  guix/describe.scm				\
  guix/quirks.scm				\
@@ -109,8 +122,6 @@ MODULES =					\
  guix/cache.scm				\
  guix/cve.scm					\
  guix/workers.scm				\
-  guix/zlib.scm					\
-  guix/lzlib.scm				\
  guix/build-system.scm				\
  guix/build-system/android-ndk.scm		\
  guix/build-system/ant.scm			\
@@ -132,6 +143,7 @@ MODULES =					\
  guix/build-system/haskell.scm			\
  guix/build-system/julia.scm			\
  guix/build-system/linux-module.scm		\
+  guix/build-system/maven.scm			\
  guix/build-system/node.scm			\
  guix/build-system/perl.scm			\
  guix/build-system/python.scm			\
@@ -171,6 +183,7 @@ MODULES =					\
  guix/build/minify-build-system.scm		\
  guix/build/font-build-system.scm		\
  guix/build/go-build-system.scm		\
+  guix/build/android-repo.scm			\
  guix/build/asdf-build-system.scm		\
  guix/build/bzr.scm				\
  guix/build/copy-build-system.scm		\
@@ -181,6 +194,7 @@ MODULES =					\
  guix/build/gnu-build-system.scm		\
  guix/build/gnu-dist.scm			\
  guix/build/guile-build-system.scm		\
+  guix/build/maven-build-system.scm		\
  guix/build/node-build-system.scm		\
  guix/build/perl-build-system.scm		\
  guix/build/python-build-system.scm		\
@@ -212,6 +226,9 @@ MODULES =					\
  guix/build/emacs-utils.scm			\
  guix/build/java-utils.scm			\
  guix/build/lisp-utils.scm			\
+  guix/build/maven/java.scm			\
+  guix/build/maven/plugin.scm			\
+  guix/build/maven/pom.scm			\
  guix/build/graft.scm				\
  guix/build/bournish.scm			\
  guix/build/qt-utils.scm			\
@@ -281,6 +298,8 @@ MODULES =					\
  guix/scripts/publish.scm			\
  guix/scripts/edit.scm				\
  guix/scripts/size.scm				\
+  guix/scripts/git.scm				\
+  guix/scripts/git/authenticate.scm		\
  guix/scripts/graph.scm			\
  guix/scripts/weather.scm			\
  guix/scripts/container.scm			\
@@ -326,6 +345,10 @@ dist_noinst_DATA =				\
 AUX_FILES =						\
  gnu/packages/aux-files/chromium/master-preferences.json		\
  gnu/packages/aux-files/emacs/guix-emacs.el		\
+  gnu/packages/aux-files/linux-libre/5.9-arm.conf       \
+  gnu/packages/aux-files/linux-libre/5.9-arm64.conf     \
+  gnu/packages/aux-files/linux-libre/5.9-i686.conf      \
+  gnu/packages/aux-files/linux-libre/5.9-x86_64.conf    \
  gnu/packages/aux-files/linux-libre/5.4-arm.conf	\
  gnu/packages/aux-files/linux-libre/5.4-arm64.conf	\
  gnu/packages/aux-files/linux-libre/5.4-i686.conf	\
@@ -385,6 +408,7 @@ SCM_TESTS =					\
  tests/base16.scm				\
  tests/base32.scm				\
  tests/base64.scm				\
+  tests/boot-parameters.scm			\
  tests/bournish.scm				\
  tests/builders.scm				\
  tests/build-utils.scm			\
@@ -416,11 +440,11 @@ SCM_TESTS =					\
  tests/import-utils.scm			\
  tests/inferior.scm				\
  tests/lint.scm				\
-  tests/lzlib.scm				\
  tests/modules.scm				\
  tests/monads.scm				\
  tests/nar.scm				\
  tests/networking.scm				\
+  tests/offload.scm				\
  tests/opam.scm				\
  tests/openpgp.scm				\
  tests/packages.scm				\
@@ -433,7 +457,6 @@ SCM_TESTS =					\
  tests/pypi.scm				\
  tests/records.scm				\
  tests/scripts.scm				\
-  tests/scripts-build.scm			\
  tests/search-paths.scm			\
  tests/services.scm				\
  tests/services/linux.scm			\
@@ -450,19 +473,20 @@ SCM_TESTS =					\
  tests/syscalls.scm				\
  tests/system.scm				\
  tests/texlive.scm				\
+  tests/transformations.scm			\
  tests/ui.scm					\
  tests/union.scm				\
  tests/upstream.scm				\
  tests/utils.scm				\
  tests/uuid.scm				\
-  tests/workers.scm				\
-  tests/zlib.scm
+  tests/workers.scm

 SH_TESTS =					\
  tests/guix-build.sh				\
  tests/guix-build-branch.sh			\
  tests/guix-download.sh			\
  tests/guix-gc.sh				\
+  tests/guix-git-authenticate.sh		\
  tests/guix-hash.sh				\
  tests/guix-pack.sh				\
  tests/guix-pack-localstatedir.sh		\
@@ -477,6 +501,7 @@ SH_TESTS =					\
  tests/guix-environment-container.sh		\
  tests/guix-graph.sh				\
  tests/guix-describe.sh			\
+  tests/guix-repl.sh     			\
  tests/guix-lint.sh

 TESTS = $(SCM_TESTS) $(SH_TESTS)
@@ -522,7 +547,7 @@ check-system: $(GOBJECTS)

 # Public keys used to sign substitutes.
 dist_pkgdata_DATA =				\
-  etc/substitutes/berlin.guixsd.org.pub		\
+  etc/substitutes/berlin.guix.gnu.org.pub	\
  etc/substitutes/ci.guix.gnu.org.pub		\
  etc/substitutes/ci.guix.info.pub

@@ -537,7 +562,7 @@ dist_zshcompletion_DATA = etc/completion/zsh/_guix
 dist_fishcompletion_DATA = etc/completion/fish/guix.fish

 # SELinux policy
-dist_selinux_policy_DATA = etc/guix-daemon.cil
+nodist_selinux_policy_DATA = etc/guix-daemon.cil

 EXTRA_DIST +=						\
  HACKING						\
@@ -545,12 +570,14 @@ EXTRA_DIST +=						\
  TODO							\
  CODE-OF-CONDUCT					\
  .dir-locals.el					\
+  .guix-authorizations					\
  .guix-channel						\
  scripts/guix.in					\
  etc/guix-install.sh					\
  etc/news.scm						\
  etc/release-manifest.scm				\
  etc/system-tests.scm					\
+  etc/historical-authorizations				\
  build-aux/build-self.scm				\
  build-aux/compile-all.scm				\
  build-aux/hydra/evaluate.scm				\
@@ -559,12 +586,12 @@ EXTRA_DIST +=						\
  build-aux/hydra/guix-modular.scm			\
  build-aux/cuirass/gnu-system.scm			\
  build-aux/cuirass/guix-modular.scm			\
+  build-aux/cuirass/hurd-manifest.scm			\
  build-aux/cuirass/hydra-to-cuirass.scm		\
  build-aux/check-final-inputs-self-contained.scm	\
  build-aux/check-channel-news.scm			\
  build-aux/compile-as-derivation.scm			\
  build-aux/generate-authors.scm			\
-  build-aux/git-authenticate.scm			\
  build-aux/test-driver.scm				\
  build-aux/update-guix-package.scm			\
  build-aux/update-NEWS.scm				\
@@ -633,17 +660,21 @@ $(guix_install_go_files): install-nobase_dist_guilemoduleDATA
 install-data-hook:
 	touch "$(DESTDIR)$(guileobjectdir)/guix/config.go"

-# Commit corresponding to the 'v1.0.1' tag.
-commit_v1_0_1 = d68de958b60426798ed62797ff7c96c327a672ac
+# Commit corresponding to the 'v1.0.0' tag.
+commit_v1_0_0 = 6298c3ffd9654d3231a6f25390b056483e8f407c

-# Authenticate the current Git checkout by checking signatures on every commit
-# starting from $(commit_v1_0_1).
-authenticate: guix/openpgp.go guix/git-authenticate.go guix/git.go
+# Introduction of the 'guix' channel.  Keep in sync with (guix channels)!
+channel_intro_commit = 9edb3f66fd807b096b48283debdcddccfea34bad
+channel_intro_signer = BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA
+
+# Authenticate the current Git checkout by checking signatures on every commit.
+GUIX_GIT_KEYRING = origin/keyring
+authenticate:
 	$(AM_V_at)echo "Authenticating Git checkout..." ;	\
-	"$(top_builddir)/pre-inst-env" $(GUILE)			\
-	  --no-auto-compile -e git-authenticate			\
-	  "$(top_srcdir)/build-aux/git-authenticate.scm"	\
-	  "$(commit_v1_0_1)"
+	guix git authenticate					\
+	    --keyring=$(GUIX_GIT_KEYRING)			\
+	    --cache-key=channels/guix --stats			\
+	    "$(channel_intro_commit)" "$(channel_intro_signer)"

 # Assuming Guix is already installed and the daemon is up and running, this
 # rule builds from $(srcdir), creating and building derivations.
@@ -680,7 +711,7 @@ AM_DISTCHECK_CONFIGURE_FLAGS =			\
  ac_cv_guix_test_root="$(GUIX_TEST_ROOT)"

 # Name of the 'guix' package shipped in the binary tarball.
-GUIX_FOR_BINARY_TARBALL = guile3.0-guix
+GUIX_FOR_BINARY_TARBALL = guix

 # The self-contained tarball.
 guix-binary.%.tar.xz:
@@ -700,8 +731,8 @@ distcheck-hook: assert-binaries-available assert-final-inputs-self-contained

 EXTRA_DIST += $(top_srcdir)/.version
 BUILT_SOURCES += $(top_srcdir)/.version
-$(top_srcdir)/.version:
-	echo $(VERSION) > "$@-t" && mv "$@-t" "$@"
+$(top_srcdir)/.version: config.status
+	$(AM_V_GEN)echo $(VERSION) > "$@-t" && mv "$@-t" "$@"

 gen-tarball-version:
 	echo $(VERSION) > "$(distdir)/.tarball-version"
@@ -796,9 +827,10 @@ release: dist-with-updated-version
 	$(MKDIR_P) "$(releasedir)"
 	rm -f "$(releasedir)"/*
 	mv $(SOURCE_TARBALLS) "$(releasedir)"
-	$(top_builddir)/pre-inst-env "$(GUILE)"			\
-	   $(top_srcdir)/build-aux/update-guix-package.scm	\
-	   "`git rev-parse HEAD`" "$(PACKAGE_VERSION)"
+	GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT=yes \
+	$(top_builddir)/pre-inst-env "$(GUILE)"	\
+		$(top_srcdir)/build-aux/update-guix-package.scm	\
+	   	"`git rev-parse HEAD`" "$(PACKAGE_VERSION)"
 	git add $(top_srcdir)/gnu/packages/package-management.scm
 	git commit -m "gnu: guix: Update to $(PACKAGE_VERSION)."
 	$(top_builddir)/pre-inst-env guix build $(GUIX_FOR_BINARY_TARBALL)	\
@@ -810,9 +842,10 @@ release: dist-with-updated-version
 	  mv "guix-binary.$$system.tar.xz"					\
 	      "$(releasedir)/guix-binary-$(PACKAGE_VERSION).$$system.tar.xz" ;	\
 	done
-	$(top_builddir)/pre-inst-env "$(GUILE)"			\
-	   $(top_srcdir)/build-aux/update-guix-package.scm	\
-	   "`git rev-parse HEAD`"
+	GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT=yes \
+	$(top_builddir)/pre-inst-env "$(GUILE)"	\
+		$(top_srcdir)/build-aux/update-guix-package.scm	\
+		"`git rev-parse HEAD`"
 	git add $(top_srcdir)/gnu/packages/package-management.scm
 	git commit -m "gnu: guix: Update to `git rev-parse HEAD | cut -c1-7`."
 	$(top_builddir)/pre-inst-env guix build guix			\
@@ -820,8 +853,8 @@ release: dist-with-updated-version
 	      -v1 --no-grafts --fallback
 	for system in $(GUIX_SYSTEM_SUPPORTED_SYSTEMS) ; do				\
 	  image=`$(top_builddir)/pre-inst-env						\
-	    guix system disk-image							\
-	    --file-system-type=iso9660							\
+	    guix system disk-image -t iso9660                                           \
+	    --label="GUIX_$${system}_$(VERSION)"					\
            --system=$$system --fallback						\
 	    gnu/system/install.scm` ;							\
 	  if [ ! -f "$$image" ] ; then							\
@@ -11,6 +11,160 @@ Copyright © 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>

 Please send Guix bug reports to bug-guix@gnu.org.

+* Changes in 1.2.0 (since 1.1.0)
+
+** Package management
+*** ‘guix pull’ now crytographically authenticates channels
+*** ‘guix describe -f channels’ now shows “channel introductions”
+*** ‘guix describe -f channels-sans-intro’ omits channel introductions
+*** New ‘guix git authenticate’ command, to authenticate Git checkouts
+*** ‘guix pull’ and ‘guix system reconfigure’ detect attempts to downgrade
+*** New ‘--allow-downgrades’ option for ‘guix pull’ and ‘guix system’
+*** Guix build time reduced thanks to Guile 3.0.4’s “baseline compiler”
+*** New ‘--with-debug-info’ package transformation option
+*** New ‘--with-c-toolchain’ package transformation option
+*** New ‘--without-tests’ package transformation option
+*** ‘--with-input’ & co. now also apply to implicit dependencies
+*** Package transformation options are now recorded in profiles
+*** New fakechroot “execution engine” for packs produced by ‘guix pack -RR’
+*** New ‘--cache-bypass-threshold’ option for ‘guix publish’
+*** New ‘--diff’ option for ‘guix challenge’, to compare substitutes
+*** New ‘--exclude’ option for ‘guix lint’, to exclude checkers
+*** New ‘check-for-collisions’ checker in ‘guix lint’
+*** All of Guix and Guix System now runs on Guile 3.0
+*** ‘guix pull’ and ‘--with-git-url’ now support authenticated SSH repos
+*** ‘guix pull’ now honors $http_proxy and $https_proxy
+*** New ‘--path’ option for ‘guix graph’, showing the shortest path
+*** ‘guix repl’ can now be passed a script to execute
+*** ‘guix help’ finally shows command descriptions
+*** ‘guix install’ etc. no longer list items to download by default
+*** ‘guix search’ etc. now automatically invoke the pager
+*** New ‘--hash’ option for ‘guix hash’
+*** New ‘--list-formats’ option for ‘guix describe’
+*** New “Getting Started” section in the manual
+
+** Distribution
+*** Bootstrap binary seeds reduced to 60 MiB on x86_64/i686
+*** New ‘--target’ option for ‘guix system’, for cross-compilation
+*** New ‘--image-type’ option for ‘guix system disk-image’
+*** New ‘--label’ option for ‘guix system disk-image’
+*** Guix System can now boot from a Btrfs subvolume
+*** New ‘hurd’ field of ‘operating-system’, for GNU/Hurd support
+*** Guix System can be cross-compiled to GNU/Hurd with ‘--target=i586-pc-gnu’
+*** New ‘hurd-vm-service-type’ to spawn a GNU/Hurd VM on GNU/Linux
+*** /etc/guix/acl on Guix System is now built from the OS configuration
+*** ‘rottlog-service-type’ is now part of ‘%base-services’
+*** Linux-libre modules are now gzip-compressed
+*** The efivarfs file system is now part of ‘%base-file-systems’
+*** mcron job specs are now statically checked at OS build time
+*** ‘swap-devices’ field of ‘operating-system’ can contains UUIDs and labels
+*** Graphical installer uses UUIDs for unencrypted swap partitions
+*** Graphical installer now supports NTFS file systems
+*** File systems UUIDs and labels now recognized for F2FS and NTFS
+*** Root file system can now be on NFS
+*** New services
+
+autossh, ganeti, gmnisrv, guix-build-coordinator,
+guix-build-coordinator-agent, guix-build-coordinator-queue-builds, hostapd,
+hurd-console, hurd-getty, hurd-vm, lxqt, rshiny, secret-service,
+simulated-wifi, udev-rules, unattended-upgrade, webssh, zram
+
+*** 1999 new packages
+*** 3652 package updates
+
+Noteworthy updates:
+bash 5.0.16, binutils 2.34, cups 2.3.3, emacs 27.1, enlightenment 0.24.2,
+gcc-toolchain 10.2.0, gdb 10.1, ghc 8.8.3, gimp 2.10.22, glibc 2.31,
+gnome 3.34.2, gnupg 2.2.23, go 1.14.10, guile 3.0.4,
+icecat 78.4.0-guix0-preview1, inkscape 1.0.1, julia 1.5.2,
+libreoffice 6.4.6.2, linux-libre 5.9.3, mate 1.24.1, ocaml 4.09.0,
+openjdk 14.0, perl 5.30.2, python2 2.7.17, python 3.8.2, racket 7.8,
+rust 1.46.0, r 4.0.3, sbcl 2.0.10, shepherd 0.8.1, xfce 4.14.2,
+xorg-server 1.20.8
+
+
+** Programming interfaces
+*** New ‘maven-build-system’, for packages built with Maven
+*** ‘haskell-build-system’ now always adds a “static” output
+*** New (gnu image) module, to build system images
+*** New (guix git-authenticate) module, for Git checkout authentication
+*** New (guix openpgp) module with a minimal OpenPGP implementation
+*** New (guix transformations) module, for package transformations
+*** New (gnu services hurd) module providing GNU/Hurd services
+*** (guix json) removed in favor of Guile-JSON’s (json) module
+*** (guix zlib) and (guix lzlib) removed in favor of Guile-{Zlib,Lzlib}
+*** ‘local-file’ warns about non-literal relative file names
+*** Daemon now supports more hash algorithms: SHA3 and BLAKE2s
+*** New <content-hash> record type for use in ‘origin’
+*** New ‘let-system’ for in (guix gexp), for system-dependent code
+*** New lowerable <profile> record type in (guix profiles)
+*** (gnu build secret-service) can share secrets with a guest OS
+*** “Programming Interface” section of the manual greatly expounded
+
+** Noteworthy bug fixes
+*** ‘guix pull’ now shows a progress bar while fetching from Git
+    (<https://bugs.gnu.org/39260>)
+*** ‘guix copy’ and ‘guix deploy’ show a progress bar while copying
+*** Bootloader messages are now localized
+    (<https://issues.guix.gnu.org/35394>)
+*** ‘guix system reconfigure’ now starts services not currently running
+    (<https://bugs.gnu.org/43720>)
+*** Desktop environments now detect newly installed applications
+    (<https://bugs.gnu.org/35594>)
+*** Offloading and copying small items is now much faster
+    (<https://issues.guix.gnu.org/43340>)
+*** GCC switched back to C_INCLUDE_PATH & co. from CPATH
+    (<https://bugs.gnu.org/30756>)
+*** Graphical installer no longer hangs while connecting to WiFi network
+    (<https://issues.guix.gnu.org/40682>)
+*** GNU Aspell truly honors ASPELL_DICT_DIR (<https://bugs.gnu.org/29686>)
+*** Fix overly aggressive memoization of “commencement” packages
+    (<https://bugs.gnu.org/40482>)
+*** Duplicate /etc entries are now reported (<https://bugs.gnu.org/40729>)
+*** ‘guix pack -R’ wrapper correctly reports exit code
+    (<https://bugs.gnu.org/40816>)
+*** Fix time travel to pre-Guile 3.0 revisions
+    (<https://bugs.gnu.org/41028>)
+*** ‘package-grafts’ returns grafts for all the relevant outputs
+    (<https://bugs.gnu.org/41796>)
+*** ‘guix pull’ and related commands authenticate Git checkouts
+    (<https://bugs.gnu.org/22883>)
+*** Fix GNU libstdc++ misconfiguration in recent ‘gcc-toolchain’ versions
+    (<https://bugs.gnu.org/42392>)
+*** ‘guix pack -R’ wraps propagated inputs as well
+    (<https://bugs.gnu.org/42510>)
+*** ‘guix pack -R’ wrapper leaves root available to child processes
+    (<https://bugs.gnu.org/44261>)
+*** ‘lib/guix/package.cache’ generated by ‘guix pull’ is now bit-reproducible
+    (<https://bugs.gnu.org/42009>)
+*** Graphical installer now properly detects disks containing an LVM partition
+    (<https://issues.guix.gnu.org/42683>)
+*** Fix possible crash when copying store items over SSH
+    (<https://bugs.gnu.org/42740>)
+*** ‘gcc’ is now a “deprecated” alias for ‘gcc-toolchain’
+    (<https://bugs.gnu.org/43303>)
+*** ‘package-input-rewriting’ & co. no longer yield unnecessary rebuilds
+    (<https://bugs.gnu.org/42156>)
+*** Offloading better normalizes build machine load
+    (<https://issues.guix.gnu.org/43773>)
+*** ‘guix build --check’ now honors ‘--rounds’
+    (<https://issues.guix.gnu.org/40144>)
+*** ‘guix-install.sh’ now installs shell completion files
+    (<https://bugs.gnu.org/43744>)
+*** ‘guix-install.sh’ now warns about lack of ‘nscd’
+    (<https://bugs.gnu.org/43744>)
+
+** Native language support
+*** Updated translations of the manual
+
+The manual is fully translated into French, German, and Spanish, and has
+preliminary translations into Chinese and Russian.
+
+*** Updated translations of messages
+
+This version of Guix is fully translated in French, German, and Spanish, and
+partially translated in 11 other languages.
+
 * Changes in 1.1.0 (since 1.0.1)
 ** Package management
 *** New ‘guix deploy’ command to deploy several machines at once
@@ -33,25 +33,14 @@ See the manual for the installation instructions, either by running

 or by checking the [[https://guix.gnu.org/manual/en/html_node/Installation.html][web copy of the manual]].

-For information on installation from a Git checkout, please see the section
-"Building from Git" in the manual.
+* Building from Git

-* Installing Guix from Guix
+For information on building Guix from a Git checkout, please see the relevant
+section in the manual, either by running

-You can re-build and re-install Guix using a system that already runs Guix.
-To do so:
+  info -f doc/guix.info "Building from Git"

-  - Start a shell with the development environment for Guix:
-
-      guix environment guix
-
-  - Re-run the 'configure' script passing it the option
-    '--localstatedir=/somewhere', where '/somewhere' is the 'localstatedir'
-    value of the currently installed Guix (failing to do that would lead the
-    new Guix to consider the store to be empty!).  We recommend to use the
-    value '/var'.
-
-  - Run "make", "make check", and "make install".
+or by checking the [[https://guix.gnu.org/manual/en/html_node/Building-from-Git.html][web_copy of the manual]].

 * How It Works

@@ -71,7 +71,7 @@
                                      (variables rest ...))))))
    (variables %localstatedir %storedir %sysconfdir %system)))

-(define* (make-config.scm #:key zlib gzip xz bzip2
+(define* (make-config.scm #:key gzip xz bzip2
                          (package-name "GNU Guix")
                          (package-version "0")
                          (bug-report-address "bug-guix@gnu.org")
@@ -133,11 +133,7 @@
                     (define %bzip2
                       #+(and bzip2 (file-append bzip2 "/bin/bzip2")))
                     (define %xz
-                       #+(and xz (file-append xz "/bin/xz")))
-
-                     (define %libz
-                       #+(and zlib
-                              (file-append zlib "/lib/libz")))))))
+                       #+(and xz (file-append xz "/bin/xz")))))))


 ;;;
@@ -0,0 +1,74 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; Commentary:
+;;;
+;;; This file defines a manifest with a selection of packages for Cuirass to
+;;; build for GNU/Hurd.
+;;;
+;;; Code:
+
+(use-modules (gnu)
+             (gnu system hurd)
+             (guix packages)
+             (guix utils)
+             (ice-9 match)
+             (srfi srfi-1))
+
+(use-package-modules
+ base commencement compression file gawk gdb gettext guile
+ hurd less m4 package-management python ssh version-control)
+
+(define (input->package input)
+  "Return the INPUT as package, or #f."
+  (match input
+    ((label (and (? package?) package))
+     package)
+    ((label (and (? package?) package . output))
+     (cons package output))
+    (_ #f)))
+
+(define guix-dependencies
+  (filter-map input->package
+              (fold alist-delete (package-direct-inputs guix)
+                    '("glibc-utf8-locales" "graphviz" "po4a"))))
+
+(define (package-without-tests p)
+  (package/inherit p
+    (arguments
+     (substitute-keyword-arguments (package-arguments p)
+       ((#:tests? _ #f) #f)))))
+
+(packages->manifest
+ (cons*
+  ;; where it all starts
+  hello
+
+  ;; development utililities
+  diffutils file findutils gawk grep gzip less m4 openssh-sans-x tar xz
+
+  ;; development packages
+  gcc-toolchain gdb-minimal git-minimal gnu-make
+
+  ;; guix environment guix --without-tests=python-minimal --without-tests=gettext-minimal
+  (package-without-tests gettext-minimal)
+  (package-without-tests python-minimal)
+
+  (append
+   guix-dependencies
+   (delete guile-3.0 %base-packages/hurd))))
@@ -1,299 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;;
-;;; Authenticate a range of commits.
-;;;
-
-(use-modules (git)
-             (guix base16)
-             (guix git)
-             (guix git-authenticate)
-             (guix i18n)
-             ((guix openpgp)
-              #:select (openpgp-public-key-fingerprint
-                        openpgp-format-fingerprint))
-             (guix progress)
-             (srfi srfi-1)
-             (srfi srfi-26)
-             (ice-9 match)
-             (ice-9 format)
-             (ice-9 pretty-print))
-
-
-(define %historical-committers
-  ;; List of "historical" committers---people once authorized committers
-  ;; before the '.guix-authorizations' file was created.
-  ;;
-  ;; These are the user names found on
-  ;; <https://savannah.gnu.org/project/memberlist.php?group=guix> along with
-  ;; the fingerprint of the signing (sub)key.
-  '(("andreas"
-     "AD17 A21E F8AE D8F1 CC02  DBD9 F7D5 C9BF 765C 61E3")
-    ("ajgrf"
-     "2A39 3FFF 68F4 EF7A 3D29  12AF 6F51 20A0 22FB B2D5")
-    ("alexvong1995"
-     "306F CB8F 2C01 C25D 29D3  0556 61EF 502E F602 52F2")
-    ("alezost"
-     "4FB9 9F49 2B12 A365 7997  E664 8246 0C08 2A0E E98F")
-    ("ambrevar"
-     "50F3 3E2E 5B0C 3D90 0424  ABE8 9BDC F497 A4BB CC7F")
-    ("apteryx"
-     "27D5 86A4 F890 0854 329F  F09F 1260 E464 82E6 3562")
-    ("arunisaac"
-     "7F73 0343 F2F0 9F3C 77BF  79D3 2E25 EE8B 6180 2BB3")
-    ("atheia"
-     ;; primary: "3B12 9196 AE30 0C3C 0E90  A26F A715 5567 3271 9948"
-     "9A2B 401E D001 0650 1584  BAAC 8BC4 F447 6E8A 8E00")
-    ("bandali"
-     ;; primary: "BE62 7373 8E61 6D6D 1B3A  08E8 A21A 0202 4881 6103"
-     "39B3 3C8D 9448 0D2D DCC2  A498 8B44 A0CD C7B9 56F2")
-    ("bavier"
-     ;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
-     "A0C5 E352 2EF8 EF5C 64CD  B7F0 FD73 CAC7 19D3 2566")
-    ("beffa"
-     "3774 8024 880F D3FF DCA2  C9AB 5893 6E0E 2F1B 5A4C")
-    ("benwoodcroft"
-     "BCF8 F737 2CED 080A 67EB  592D 2A6A D9F4 AAC2 0DF6")
-    ("biscuolo"
-     "45CC 63B8 5258 C9D5 5F34  B239 D37D 0EA7 CECC 3912")
-    ("boskovits"
-     "7988 3B9F 7D6A 4DBF 3719  0367 2506 A96C CF63 0B21")
-    ("brettgilio"
-     "DFC0 C7F7 9EE6 0CA7 AE55  5E19 6722 43C4 A03F 0EEE")
-    ("carl"
-     ;; primary: "0401 7A2A 6D9A 0CCD C81D  8EC2 96AB 007F 1A7E D999"
-     "09CD D25B 5244 A376 78F6  EEA8 0CC5 2153 1979 91A5")
-    ("cbaines"
-     "3E89 EEE7 458E 720D 9754  E0B2 5E28 A33B 0B84 F577")
-    ("civodul"
-     "3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5")
-    ("cwebber"
-     "510A 8628 E2A7 7678 8F8C  709C 4BC0 2592 5FF8 F4D3")
-    ("dannym"
-     ;; primary: "295A F991 6F46 F8A1 34B0  29DA 8086 3842 F0FE D83B"
-     "76CE C6B1 7274 B465 C02D  B3D9 E71A 3554 2C30 BAA5")
-    ("davexunit"
-     "B3C0 DB4D AD73 BA5D 285E  19AE 5143 0234 CEFD 87C3")
-    ("davexunit (2nd)"                            ;FIXME: to be confirmed!
-     "8CCB A7F5 52B9 CBEA E1FB  2915 8328 C747 0FF1 D807")
-    ("daviwil"
-     "53C4 1E6E 41AA FE55 335A  CA5E 446A 2ED4 D940 BF14")
-    ("dvc"
-     "6909 6DFD D702 8BED ACC5  884B C5E0 51C7 9C0B ECDB")
-    ("dvc (old)"
-     "5F43 B681 0437 2F4B A898  A64B 33B9 E9FD E28D 2C23")
-    ("efraim"
-     "A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351")
-    ("efraim (old)"
-     "9157 41FE B22F A4E3 3B6E  8F8D F4C1 D391 7EAC EE93")
-    ("glv"
-     ;; primary: "2453 02B1 BAB1 F867 FDCA  96BC 8F3F 861F 82EB 7A9A"
-     "CBC5 9C66 EC27 B971 7940  6B3E 6BE8 208A DF21 FE3F")
-    ("hoebjo"
-     "2219 43F4 9E9F 276F 9499  3382 BF28 6CB6 593E 5FFD")
-    ("htgoebel"
-     "B943 509D 633E 80DD 27FC  4EED 634A 8DFF D3F6 31DF")
-    ("ipetkov"
-     "7440 26BA 7CA3 C668 E940  1D53 0B43 1E98 3705 6942")
-    ("iyzsong"
-     ;; primary: "66A5 6D9C 9A98 BE7F 719A  B401 2652 5665 AE72 7D37"
-     "0325 78A6 8298 94E7 2AA2  66F5 D415 BF25 3B51 5976")
-
-    ;; https://lists.gnu.org/archive/html/guix-devel/2018-04/msg00229.html
-    ("janneke (old)"
-     "DB34 CB51 D25C 9408 156F  CDD6 A12F 8797 8D70 1B99")
-    ("janneke"
-     "1A85 8392 E331 EAFD B8C2  7FFB F3C1 A0D9 C1D6 5273")
-
-    ("jlicht"
-     ;; primary: "1BA4 08C5 8BF2 0EA7 3179  635A 865D C0A3 DED9 B5D0"
-     "E31D 9DDE EBA5 4A14 8A20  4550 DA45 97F9 47B4 1025")
-    ("jmd"
-     "8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3")
-    ("kkebreau"
-     "83B6 703A DCCA 3B69 4BCE  2DA6 E6A5 EE3C 1946 7A0D")
-    ("leungbk"
-     "45E5 75FA 53EA 8BD6 1BCE  0B4E 3ADC 75F0 13D6 78F9")
-    ("lfam"
-     ;; primary: "4F71 6F9A 8FA2 C80E F1B5  E1BA 5E35 F231 DE1A C5E0"
-     "B051 5948 F1E7 D3C1 B980  38A0 2646 FA30 BACA 7F08")
-    ("lsl88"
-     "2AE3 1395 932B E642 FC0E  D99C 9BED 6EDA 32E5 B0BC")
-    ("marusich"
-     "CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D")
-    ("mbakke"
-     "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA")
-    ("mhw"
-     "D919 0965 CE03 199E AF28  B3BE 7CEF 2984 7562 C516")
-    ("mothacehe"
-     "4008 6A7E 0252 9B60 31FB  8607 8354 7635 3176 9CA6")
-    ("mthl"
-     "F2A3 8D7E EB2B 6640 5761  070D 0ADE E100 9460 4D37")
-    ("nckx"
-     ;; primary: "F5BC 5534 C36F 0087 B39D  36EF 1C9D C4FE B9DB 7C4B"
-     "F5DA 2032 4B87 3D0B 7A38  7672 0DB0 FF88 4F55 6D79")
-    ("nckx (revoked; not compromised)"
-     ;; primary: "F5BC 5534 C36F 0087 B39D  36EF 1C9D C4FE B9DB 7C4B"
-     "7E8F AED0 0944 78EF 72E6  4D16 D889 B0F0 18C5 493C")
-    ("niedzejkob"
-     "E576 BFB2 CF6E B13D F571  33B9 E315 A758 4613 1564")
-    ("ngz"
-     "ED0E F1C8 E126 BA83 1B48  5FE9 DA00 B4F0 48E9 2F2D")
-    ("pelzflorian"
-     "CEF4 CB91 4856 BA38 0A20  A7E2 3008 88CB 39C6 3817")
-    ("pgarlick"
-     ;; primary: "B68B DF22 73F9 DA0E 63C1  8A32 515B F416 9242 D600"
-     "C699 ED09 E51B CE89 FD1D  A078 AAC7 E891 896B 568A")
-    ("phant0mas"
-     "3A86 380E 58A8 B942 8D39  60E1 327C 1EF3 8DF5 4C32")
-    ("reepca"
-     "74D6 A930 F44B 9B84 9EA5  5606 C166 AA49 5F7F 189C")
-    ("rekado"
-     "BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC")
-    ("rhelling"
-     "0154 E1B9 1CC9 D9EF 7764  8DE7 F3A7 27DB 44FC CA36")
-    ("roelj (old)"
-     "17CB 2812 EB63 3DFF 2C7F  0452 C3EC 1DCA 8430 72E1")
-    ("roelj"
-     ;; From commit cc51c03ff867d4633505354819c6d88af88bf919 (March 2020).
-     ;; See <https://lists.gnu.org/archive/html/guix-devel/2020-03/msg00070.html>.
-     "F556 FD94 FB8F 8B87 79E3  6832 CBD0 CD51 38C1 9AFC")
-    ("roptat (old)"
-     "B5FA E628 5B41 3728 B2A0  FAED 4311 1F45 2008 6A0C")
-    ("roptat"
-     ;; From commit 2cbede5935eb6a40173bbdf30a9ad22bf7574c22 (Jan. 2020).  See
-     ;; <https://lists.gnu.org/archive/html/guix-devel/2020-01/msg00499.html>.
-     "1EFB 0909 1F17 D28C CBF9  B13A 53D4 57B2 D636 EE82")
-    ("samplet"
-     ;; primary: "D6B0 C593 DA8C 5EDC A44C  7A58 C336 91F7 1188 B004"
-     "A02C 2D82 0EF4 B25B A6B5  1D90 2AC6 A5EC 1C35 7C59")
-    ("sleep_walker"
-     "77DD AD2D 97F5 31BB C0F3  C7FD DFB5 EB09 AA62 5423")
-    ("snape"
-     "F494 72F4 7A59 00D5 C235  F212 89F9 6D48 08F3 59C7")
-    ("steap"
-     "4E26 CCE9 578E 0828 9855  BDD4 1C79 95D2 D5A3 8336")
-    ("taylanub"
-     "9ADE 9ECF 2B19 C180 9C99  5CEA A1F4 CFCC 5283 6BAC")
-
-    ;; https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00826.html
-    ("thomasd"
-     ;; primary: "1DD1 681F E285 E07F 11DC  0C59 2E15 A6BC D77D 54FD"
-     "3D2C DA58 819C 08C2 A649  D43D 5C3B 064C 724A 5726")
-    ("thomasd (old)"
-     "A5C5 92EA 606E 7106 A6A3  BC08 98B2 1575 91E1 2B08")
-
-    ("toothbrush"
-     "D712 1D73 A40A 7264 9E43  ED7D F284 6B1A 0D32 C442")
-    ("vagrantc"
-     "6580 7361 3BFC C5C7 E2E4  5D45 DC51 8FC8 7F97 16AA")
-    ("wigust"
-     ;; primary: "C955 CC5D C048 7FB1 7966  40A9 199A F6A3 67E9 4ABB"
-     "7238 7123 8EAC EB63 4548  5857 167F 8EA5 001A FA9C")
-    ("wingo"
-     "FF47 8FB2 64DE 32EC 2967  25A3 DDC0 F535 8812 F8F2")))
-
-(define %historical-authorized-signing-keys
-  ;; Fingerprint of historically authorized signing keys.
-  (map (match-lambda
-         ((name fingerprint)
-          (base16-string->bytevector
-           (string-downcase (string-filter char-set:graphic fingerprint)))))
-       %historical-committers))
-
-(define %commits-with-bad-signature
-  ;; Commits with a known-bad signature.
-  '("6a34f4ccc8a5d4a48e25ad3c9c512f8634928b91"))  ;2016-12-29
-
-(define %unsigned-commits
-  ;; Commits lacking a signature.
-  '())
-
-(define commit-short-id
-  (compose (cut string-take <> 7) oid->string commit-id))
-
-
-;;;
-;;; Entry point.
-;;;
-
-(define (git-authenticate args)
-  (define repository
-    (repository-open "."))
-
-  (let loop ((args args))
-    (match args
-      ((_ start end)
-       (define start-commit
-         (commit-lookup repository (string->oid start)))
-       (define end-commit
-         (commit-lookup repository (string->oid end)))
-
-       (define authenticated-commits
-         ;; Previously-authenticated commits that don't need to be checked
-         ;; again.
-         (filter-map (lambda (id)
-                       (false-if-exception
-                        (commit-lookup repository (string->oid id))))
-                     (previously-authenticated-commits)))
-
-       (define commits
-         ;; Commits to authenticate, excluding the closure of
-         ;; AUTHENTICATED-COMMITS.
-         (commit-difference end-commit start-commit
-                            authenticated-commits))
-
-       (define reporter
-         (progress-reporter/bar (length commits)))
-
-       (format #t (G_ "Authenticating ~a to ~a (~a commits)...~%")
-               (commit-short-id start-commit)
-               (commit-short-id end-commit)
-               (length commits))
-
-       (let ((stats (call-with-progress-reporter reporter
-                      (lambda (report)
-                        (authenticate-commits repository commits
-                                              #:default-authorizations
-                                              %historical-authorized-signing-keys
-                                              #:report-progress report)))))
-         (cache-authenticated-commit (oid->string (commit-id end-commit)))
-
-         (unless (null? stats)
-           (format #t (G_ "Signing statistics:~%"))
-           (for-each (match-lambda
-                       ((signer . count)
-                        (format #t "  ~a ~10d~%"
-                                (openpgp-format-fingerprint
-                                 (openpgp-public-key-fingerprint signer))
-                                count)))
-                     (sort stats
-                           (match-lambda*
-                             (((_ . count1) (_ . count2))
-                              (> count1 count2))))))))
-      ((command start)
-       (let* ((head (repository-head repository))
-              (end  (reference-target head)))
-         (loop (list command start (oid->string end)))))
-      (_
-       (format (current-error-port)
-               (G_ "Usage: git-authenticate START [END]
-
-Authenticate commits START to END or the current head.\n"))))))
@@ -43,17 +43,25 @@ for SYSTEM.  Use VERSION as the version identifier."
    (define build
      (primitive-load (string-append source "/build-aux/build-self.scm")))

-    `((derivation . ,(derivation-file-name
-                      (run-with-store store
-                        (build source #:version version #:system system
-                               #:pull-version 1
-                               #:guile-version "2.2")))) ;the latest 2.2.x
-      (description . "Modular Guix")
-      (long-description
-       . "This is the modular Guix package as produced by 'guix pull'.")
-      (license . ,license:gpl3+)
-      (home-page . ,%guix-home-page-url)
-      (maintainers . (,%guix-bug-report-address)))))
+    (let ((drv (run-with-store store
+                 (build source #:version version #:system system
+                        #:pull-version 1
+                        #:guile-version "2.2"))))
+      `((derivation . ,(derivation-file-name drv)) ;the latest 2.2.x
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
+        (description . "Modular Guix")
+        (long-description
+         . "This is the modular Guix package as produced by 'guix pull'.")
+        (license . ,license:gpl3+)
+        (home-page . ,%guix-home-page-url)
+        (maintainers . (,%guix-bug-report-address))))))

 (define (hydra-jobs store arguments)
  "Return Hydra jobs."
@@ -1,7 +1,7 @@
 #!/bin/sh

 # GNU Guix --- Functional package management for GNU
-# Copyright © 2012, 2013, 2014, 2015, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+# Copyright © 2012, 2013, 2014, 2015, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 # Copyright © 2017 Eric Bavier <bavier@cray.com>
 #
 # This file is part of GNU Guix.
@@ -46,13 +46,6 @@ export PATH
 GUIX="$abs_top_builddir/scripts/guix"
 export GUIX

-# The following variables need only be defined when compiling Guix
-# modules, but we define them to be on the safe side in case of
-# auto-compilation.
-
-NIX_HASH="@NIX_HASH@"
-export NIX_HASH
-
 # Define $GUIX_UNINSTALLED to prevent `guix' from
 # prepending @guilemoduledir@ to the Guile load paths.

@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,20 +25,25 @@
 ;;; Code:

 (use-modules (guix)
+             (guix ui)
             (guix git-download)
             (guix upstream)
             (guix utils)
             (guix base32)
             (guix build utils)
+             (guix scripts hash)
             (gnu packages package-management)
-             (ice-9 match))
+             (ice-9 match)
+             (ice-9 popen)
+             (ice-9 regex)
+             (ice-9 textual-ports)
+             (srfi srfi-1)
+             (srfi srfi-2)
+             (srfi srfi-26))

 (define %top-srcdir
  (string-append (current-source-directory) "/.."))

-(define version-controlled?
-  (git-predicate %top-srcdir))
-
 (define (package-definition-location)
  "Return the source properties of the definition of the 'guix' package."
  (call-with-input-file (location-file (package-location guix))
@@ -101,44 +107,107 @@ COMMIT."
      (exp
       (error "'guix' package definition is not as expected" exp)))))

+(define (git-add-worktree directory commit)
+  "Create a new git worktree at DIRECTORY, detached on commit COMMIT."
+  (invoke "git" "worktree" "add" "--detach" directory commit))
+
+(define (call-with-temporary-git-worktree commit proc)
+  "Execute PROC in the context of a temporary git worktree created from
+COMMIT.  PROC receives the temporary directory file name as an argument."
+  (call-with-temporary-directory
+   (lambda (tmp-directory)
+     (dynamic-wind
+       (lambda ()
+         #t)
+       (lambda ()
+         (git-add-worktree tmp-directory commit)
+         (proc tmp-directory))
+       (lambda ()
+         (invoke "git" "worktree" "remove" "--force" tmp-directory))))))
+
+(define %savannah-guix-git-repo-push-url-regexp
+  "git.(savannah|sv).gnu.org:?/srv/git/guix.git \\(push\\)")
+
+(define-syntax-rule (with-input-pipe-to-string prog arg ...)
+  (let* ((input-pipe (open-pipe* OPEN_READ prog arg ...))
+	 (output (get-string-all input-pipe))
+	 (exit-val (status:exit-val (close-pipe input-pipe))))
+    (unless (zero? exit-val)
+      (error (format #f "Command ~s exited with non-zero exit status: ~s"
+                     (string-join (list prog arg ...)) exit-val)))
+    (string-trim-both output)))
+
+(define (find-origin-remote)
+  "Find the name of the git remote with the Savannah Guix git repo URL."
+  (and-let* ((remotes (string-split (with-input-pipe-to-string
+                                     "git" "remote" "-v")
+                                    #\newline))
+             (origin-entry (find (cut string-match
+                                      %savannah-guix-git-repo-push-url-regexp
+                                      <>)
+                                 remotes)))
+    (first (string-split origin-entry #\tab))))
+
+(define (commit-already-pushed? remote commit)
+  "True if COMMIT is found in the REMOTE repository."
+  (not (string-null? (with-input-pipe-to-string
+                      "git" "branch" "-r" "--contains" commit
+                      (string-append remote "/master")))))
+
+(define (keep-source-in-store store source)
+  "Add SOURCE to the store under the name that the 'guix' package expects."
+
+  ;; Add SOURCE to the store, but this time under the real name used in the
+  ;; 'origin'.  This allows us to build the package without having to make a
+  ;; real checkout; thus, it also works when working on a private branch.
+  (reload-module
+   (resolve-module '(gnu packages package-management)))
+
+  (let* ((source (add-to-store store
+                               (origin-file-name (package-source guix))
+                               #t "sha256" source
+                               #:select? (git-predicate source)))
+         (root   (store-path-package-name source)))
+
+    ;; Add an indirect GC root for SOURCE in the current directory.
+    (false-if-exception (delete-file root))
+    (symlink source root)
+    (add-indirect-root store
+                       (string-append (getcwd) "/" root))
+
+    (info (G_ "source code kept in ~a (GC root: ~a)~%")
+          source root)))
+

 (define (main . args)
  (match args
    ((commit version)
-     (with-store store
-       (let* ((source   (add-to-store store
-                                      "guix-checkout" ;dummy name
-                                      #t "sha256" %top-srcdir
-                                      #:select? version-controlled?))
-              (hash     (query-path-hash store source))
-              (location (package-definition-location))
-              (old-hash (content-hash-value
-                          (origin-hash (package-source guix)))))
-         (edit-expression location
-                          (update-definition commit hash
-                                             #:old-hash old-hash
-                                             #:version version))
-
-         ;; Re-add SOURCE to the store, but this time under the real name used
-         ;; in the 'origin'.  This allows us to build the package without
-         ;; having to make a real checkout; thus, it also works when working
-         ;; on a private branch.
-         (reload-module
-          (resolve-module '(gnu packages package-management)))
-
-         (let* ((source (add-to-store store
-                                      (origin-file-name (package-source guix))
-                                      #t "sha256" source))
-                (root   (store-path-package-name source)))
-
-           ;; Add an indirect GC root for SOURCE in the current directory.
-           (false-if-exception (delete-file root))
-           (symlink source root)
-           (add-indirect-root store
-                              (string-append (getcwd) "/" root))
-
-           (format #t "source code for commit ~a: ~a (GC root: ~a)~%"
-                   commit source root)))))
+     (with-directory-excursion %top-srcdir
+       (or (getenv "GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT")
+           (let ((remote (find-origin-remote)))
+             (unless remote
+               (leave (G_ "Failed to find the origin git remote.~%")))
+             (commit-already-pushed? remote commit))
+           (leave (G_ "Commit ~a is not pushed upstream.  Aborting.~%") commit))
+       (call-with-temporary-git-worktree commit
+           (lambda (tmp-directory)
+             (let* ((hash (nix-base32-string->bytevector
+                           (string-trim-both
+                            (with-output-to-string
+		              (lambda ()
+		                (guix-hash "-rx" tmp-directory))))))
+                    (location (package-definition-location))
+                    (old-hash (content-hash-value
+                               (origin-hash (package-source guix)))))
+               (edit-expression location
+                                (update-definition commit hash
+                                                   #:old-hash old-hash
+                                                   #:version version))
+               ;; When GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT is set, the sources are
+               ;; added to the store.  This is used as part of 'make release'.
+               (when (getenv "GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT")
+                 (with-store store
+                   (keep-source-in-store store tmp-directory))))))))
    ((commit)
     ;; Automatically deduce the version and revision numbers.
     (main commit #f))))
@@ -105,6 +105,9 @@ if test "x$GUILE_EFFECTIVE_VERSION" = "x2.2"; then
  PKG_CHECK_MODULES([GUILE], [guile-2.2 >= 2.2.3])
 fi

+dnl Get CFLAGS and LDFLAGS for libguile.
+GUILE_FLAGS
+
 dnl Installation directories for .scm and .go files.
 guilemoduledir="${datarootdir}/guile/site/$GUILE_EFFECTIVE_VERSION"
 guileobjectdir="${libdir}/guile/$GUILE_EFFECTIVE_VERSION/site-ccache"
@@ -141,6 +144,23 @@ if test "x$guix_cv_have_recent_guile_gcrypt" != "xyes"; then
  AC_MSG_ERROR([A recent Guile-Gcrypt could not be found; please install it.])
 fi

+GUIX_CHECK_GUILE_GIT
+if test "x$guix_cv_have_recent_guile_git" != "xyes"; then
+  AC_MSG_ERROR([A recent Guile-Git could not be found; please install it.])
+fi
+
+dnl Check for Guile-zlib.
+GUILE_MODULE_AVAILABLE([have_guile_zlib], [(zlib)])
+if test "x$have_guile_zlib" != "xyes"; then
+  AC_MSG_ERROR([Guile-zlib is missing; please install it.])
+fi
+
+dnl Check for Guile-lzlib.
+GUILE_MODULE_AVAILABLE([have_guile_lzlib], [(lzlib)])
+if test "x$have_guile_lzlib" != "xyes"; then
+  AC_MSG_ERROR([Guile-lzlib is missing; please install it.])
+fi
+
 dnl Guile-newt is used by the graphical installer.
 GUILE_MODULE_AVAILABLE([have_guile_newt], [(newt)])

@@ -159,10 +179,6 @@ AM_CONDITIONAL([ENABLE_INSTALLER],
 dnl Make sure we have a full-fledged Guile.
 GUIX_ASSERT_GUILE_FEATURES([regex posix socket net-db threads])

-dnl Make sure we don't suffer from the bug in 'equal?' wrt. syntax objects
-dnl found in 2.2.1.  See <https://bugs.gnu.org/29903>.
-GUIX_ASSERT_SYNTAX_OBJECT_EQUAL
-
 AC_PROG_SED

 dnl Decompressors, for use by the substituter and other modules.
@@ -186,11 +202,6 @@ AC_ARG_WITH([nix-prefix],
   esac],
  [])

-AC_PATH_PROG([NIX_HASH], [nix-hash])
-if test "x$guix_build_daemon$NIX_HASH" = "xno"; then
-   AC_MSG_ERROR([Nix programs not found; please install Nix or use `--with-nix-prefix'.])
-fi
-
 AC_ARG_WITH([nixpkgs],
  [AS_HELP_STRING([--with-nixpkgs=DIR],
    [search for Nixpkgs in DIR (for testing purposes only)])],
@@ -245,27 +256,6 @@ esac
 AC_SUBST([LIBGCRYPT_PREFIX])
 AC_SUBST([LIBGCRYPT_LIBDIR])

-dnl Library name of zlib suitable for 'dynamic-link'.
-GUIX_LIBZ_LIBDIR([libz_libdir])
-if test "x$libz_libdir" = "x"; then
-  LIBZ="libz"
-else
-  LIBZ="$libz_libdir/libz"
-fi
-AC_MSG_CHECKING([for zlib's shared library name])
-AC_MSG_RESULT([$LIBZ])
-AC_SUBST([LIBZ])
-
-dnl Library name of lzlib suitable for 'dynamic-link'.
-GUIX_LIBLZ_FILE_NAME([LIBLZ])
-if test "x$LIBLZ" = "x"; then
-  LIBLZ="liblz"
-else
-  # Strip the .so or .so.1 extension since that's what 'dynamic-link' expects.
-  LIBLZ="`echo $LIBLZ | sed -es'/\.so\(\.[[0-9.]]\+\)\?//g'`"
-fi
-AC_SUBST([LIBLZ])
-
 dnl Check for Guile-SSH, for the (guix ssh) module.
 GUIX_CHECK_GUILE_SSH
 AM_CONDITIONAL([HAVE_GUILE_SSH],
@@ -301,6 +291,7 @@ AC_CONFIG_FILES([Makefile
                 etc/guix-daemon.cil
                 guix/config.scm])

+AC_CONFIG_FILES([etc/committer.scm], [chmod +x etc/committer.scm])
 AC_CONFIG_FILES([test-env:build-aux/test-env.in], [chmod +x test-env])
 AC_CONFIG_FILES([pre-inst-env:build-aux/pre-inst-env.in],
  [chmod +x pre-inst-env])
@@ -33,6 +33,7 @@
             (guix utils)
             (git)
             (gnu packages base)
+             (gnu packages compression)
             (gnu packages gawk)
             (gnu packages gettext)
             (gnu packages guile)
@@ -40,7 +41,10 @@
             (gnu packages iso-codes)
             (gnu packages texinfo)
             (gnu packages tex)
+             (ice-9 match)
+             (srfi srfi-1)
             (srfi srfi-19)
+             (srfi srfi-26)
             (srfi srfi-71))

 (define file-append*
@@ -204,9 +208,172 @@ content=\"width=device-width, initial-scale=1\" />"))
               (setenv "XFAIL_TESTS" "htmlprag.scm")
               #t))))))))

+(define (normalize-language-code language)        ;XXX: deduplicate
+  ;; Normalize LANGUAGE.  For instance, "zh_CN" becomes "zh-cn".
+  (string-map (match-lambda
+                (#\_ #\-)
+                (chr chr))
+              (string-downcase language)))
+
+(define* (html-manual-identifier-index manual base-url
+                                       #:key
+                                       (name "html-manual-identifier-index"))
+  "Return an index of all the identifiers that appear in MANUAL, a
+makeinfo-generated manual.  The index is a file that contains an alist; each
+key is an identifier and the associated value is the URL reference pointing to
+that identifier.  The URL is constructed by concatenating BASE-URL to the
+actual file name."
+  (define build
+    (with-extensions (list guile-lib/htmlprag-fixed)
+      (with-imported-modules '((guix build utils))
+        #~(begin
+            (use-modules (guix build utils)
+                         (htmlprag)
+                         (srfi srfi-1)
+                         (srfi srfi-26)
+                         (ice-9 ftw)
+                         (ice-9 match)
+                         (ice-9 threads)
+                         (ice-9 pretty-print))
+
+            (define file-url
+              (let ((prefix (string-append #$manual "/")))
+                (lambda (file)
+                  ;; Return the URL for FILE.
+                  (let ((file (string-drop file (string-length prefix)))
+                        (base #$base-url))
+                    (if (string-null? base)
+                        file
+                        (string-append base "/" file))))))
+
+            (define (underscore-decode str)
+              ;; Decode STR, an "underscore-encoded" string as produced by
+              ;; makeinfo for indexes, such as "_0025base_002dservices" for
+              ;; "%base-services".
+              (let loop ((str str)
+                         (result '()))
+                (match (string-index str #\_)
+                  (#f
+                   (string-concatenate-reverse (cons str result)))
+                  (index
+                   (let ((char (string->number
+                                (substring str (+ index 1) (+ index 5))
+                                16)))
+                     (loop (string-drop str (+ index 5))
+                           (append (list (string (integer->char char))
+                                         (string-take str index))
+                                   result)))))))
+
+            (define (anchor-id->key id)
+              ;; Convert ID, an anchor ID such as
+              ;; "index-pam_002dlimits_002dservice" to the corresponding key,
+              ;; "pam-limits-service" in this example.  Drop the suffix of
+              ;; duplicate anchor IDs like "operating_002dsystem-1".
+              (let ((id (if (any (cut string-suffix? <> id)
+                                 '("-1" "-2" "-3" "-4" "-5"))
+                            (string-drop-right id 2)
+                            id)))
+                (underscore-decode
+                 (string-drop id (string-length "index-")))))
+
+            (define* (collect-anchors file #:optional (anchors '()))
+              ;; Collect the anchors that appear in FILE, a makeinfo-generated
+              ;; file.  Grab those from <dt> tags, which corresponds to
+              ;; Texinfo @deftp, @defvr, etc.  Return ANCHORS augmented with
+              ;; more name/reference pairs.
+              (define string-or-entity?
+                (match-lambda
+                  ((? string?) #t)
+                  (('*ENTITY* _ ...) #t)
+                  (_ #f)))
+
+              (define (worthy-entry? lst)
+                ;; Attempt to match:
+                ;;   Scheme Variable: <strong>x</strong>
+                ;; but not:
+                ;;   <code>cups-configuration</code> parameter: …
+                (let loop ((lst lst))
+                  (match lst
+                    (((? string-or-entity?) rest ...)
+                     (loop rest))
+                    ((('strong _ ...) _ ...)
+                     #t)
+                    ((('span ('@ ('class "symbol-definition-category"))
+                             (? string-or-entity?) ...) rest ...)
+                     #t)
+                    (x
+                     #f))))
+
+              (let ((shtml (call-with-input-file file html->shtml)))
+                (let loop ((shtml shtml)
+                           (anchors anchors))
+                  (match shtml
+                    (('dt ('@ ('id id) _ ...) rest ...)
+                     (if (and (string-prefix? "index-" id)
+                              (worthy-entry? rest))
+                         (alist-cons (anchor-id->key id)
+                                     (string-append (file-url file)
+                                                    "#" id)
+                                     anchors)
+                         anchors))
+                    ((tag ('@ _ ...) body ...)
+                     (fold loop anchors body))
+                    ((tag body ...)
+                     (fold loop anchors body))
+                    (_ anchors)))))
+
+            (define (html-files directory)
+              ;; Return the list of HTML files under DIRECTORY.
+              (map (cut string-append directory "/" <>)
+                   (scandir #$manual (lambda (file)
+                                       (string-suffix? ".html" file)))))
+
+            (define anchors
+              (sort (concatenate
+                     (n-par-map (parallel-job-count)
+                                (cut collect-anchors <>)
+                                (html-files #$manual)))
+                    (match-lambda*
+                      (((key1 . url1) (key2 . url2))
+                       (if (string=? key1 key2)
+                           (string<? url1 url2)
+                           (string<? key1 key2))))))
+
+            (call-with-output-file #$output
+              (lambda (port)
+                (display ";; Identifier index for the manual.\n\n"
+                         port)
+                (pretty-print anchors port)))))))
+
+  (computed-file name build))
+
+(define* (html-identifier-indexes manual directory-suffix
+                                  #:key (languages %languages)
+                                  (manual-name %manual)
+                                  (base-url (const "")))
+  (map (lambda (language)
+         (let ((language (normalize-language-code language)))
+           (list language
+                 (html-manual-identifier-index
+                  (file-append manual "/" language directory-suffix)
+                  (base-url language)
+                  #:name (string-append manual-name "-html-index-"
+                                        language)))))
+       languages))
+
 (define* (syntax-highlighted-html input
                                  #:key
                                  (name "highlighted-syntax")
+                                  (languages %languages)
+                                  (mono-node-indexes
+                                   (html-identifier-indexes input ""
+                                                            #:languages
+                                                            languages))
+                                  (split-node-indexes
+                                   (html-identifier-indexes input
+                                                            "/html_node"
+                                                            #:languages
+                                                            languages))
                                  (syntax-css-url
                                   "/static/base/css/code.css"))
  "Return a derivation called NAME that processes all the HTML files in INPUT
@@ -310,10 +477,25 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                   (loop rest (cons (entity->string entity) strings)))
                  ((('span _ lst ...) . rest)     ;for <span class="roman">
                   (loop (append lst rest) strings))
+                  ((('var name) . rest)           ;for @var{name} within @lisp
+                   (loop rest (cons name strings))) ;XXX: losing formatting
                  (something
                   (pk 'unsupported-code-snippet something)
                   (primitive-exit 1)))))

+            (define (highlight-definition id category symbol args)
+              ;; Produce stylable HTML for the given definition (an @deftp,
+              ;; @deffn, or similar).
+              `(dt (@ (id ,id) (class "symbol-definition"))
+                   (span (@ (class "symbol-definition-category"))
+                         ,@category)
+                   (span (@ (class "symbol-definition-prototype"))
+                         ,symbol " " ,@args)))
+
+            (define (space? obj)
+              (and (string? obj)
+                   (string-every char-set:whitespace obj)))
+
            (define (syntax-highlight sxml anchors)
              ;; Recurse over SXML and syntax-highlight code snippets.
              (let loop ((sxml sxml))
@@ -332,6 +514,15 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                             (highlight lex-scheme
                                        (concatenate-snippets code-snippet)))
                            anchors)))
+
+                  ;; Replace the ugly <strong> used for @deffn etc., which
+                  ;; translate to <dt>, with more stylable markup.
+                  (('dt (@ ('id id)) category ... ('strong thing))
+                   (highlight-definition id category thing '()))
+                  (('dt (@ ('id id)) category ... ('strong thing)
+                        (? space?) ('em args ...))
+                   (highlight-definition id category thing args))
+
                  ((tag ('@ attributes ...) body ...)
                   `(,tag (@ ,@attributes) ,@(map loop body)))
                  ((tag body ...)
@@ -339,78 +530,6 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                  ((? string? str)
                   str))))

-            (define (underscore-decode str)
-              ;; Decode STR, an "underscore-encoded" string as produced by
-              ;; makeinfo for indexes, such as "_0025base_002dservices" for
-              ;; "%base-services".
-              (let loop ((str str)
-                         (result '()))
-                (match (string-index str #\_)
-                  (#f
-                   (string-concatenate-reverse (cons str result)))
-                  (index
-                   (let ((char (string->number
-                                (substring str (+ index 1) (+ index 5))
-                                16)))
-                     (loop (string-drop str (+ index 5))
-                           (append (list (string (integer->char char))
-                                         (string-take str index))
-                                   result)))))))
-
-            (define (anchor-id->key id)
-              ;; Convert ID, an anchor ID such as
-              ;; "index-pam_002dlimits_002dservice" to the corresponding key,
-              ;; "pam-limits-service" in this example.  Drop the suffix of
-              ;; duplicate anchor IDs like "operating_002dsystem-1".
-              (let ((id (if (any (cut string-suffix? <> id)
-                                 '("-1" "-2" "-3" "-4" "-5"))
-                            (string-drop-right id 2)
-                            id)))
-                (underscore-decode
-                 (string-drop id (string-length "index-")))))
-
-            (define* (collect-anchors file #:optional (vhash vlist-null))
-              ;; Collect the anchors that appear in FILE, a makeinfo-generated
-              ;; file.  Grab those from <dt> tags, which corresponds to
-              ;; Texinfo @deftp, @defvr, etc.  Return VHASH augmented with
-              ;; more name/reference pairs.
-              (define string-or-entity?
-                (match-lambda
-                  ((? string?) #t)
-                  (('*ENTITY* _ ...) #t)
-                  (_ #f)))
-
-              (define (worthy-entry? lst)
-                ;; Attempt to match:
-                ;;   Scheme Variable: <strong>x</strong>
-                ;; but not:
-                ;;   <code>cups-configuration</code> parameter: …
-                (let loop ((lst lst))
-                  (match lst
-                    (((? string-or-entity?) rest ...)
-                     (loop rest))
-                    ((('strong _ ...) _ ...)
-                     #t)
-                    (_ #f))))
-
-              (let ((shtml (call-with-input-file file html->shtml)))
-                (let loop ((shtml shtml)
-                           (vhash vhash))
-                  (match shtml
-                    (('dt ('@ ('id id)) rest ...)
-                     (if (and (string-prefix? "index-" id)
-                              (worthy-entry? rest))
-                         (vhash-cons (anchor-id->key id)
-                                     (string-append (basename file)
-                                                    "#" id)
-                                     vhash)
-                         vhash))
-                    ((tag ('@ _ ...) body ...)
-                     (fold loop vhash body))
-                    ((tag body ...)
-                     (fold loop vhash body))
-                    (_ vhash)))))
-
            (define (process-html file anchors)
              ;; Parse FILE and perform syntax highlighting for its Scheme
              ;; snippets.  Install the result to #$output.
@@ -442,38 +561,59 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
            (define (html? file stat)
              (string-suffix? ".html" file))

+            (define language+node-anchors
+              (match-lambda
+                ((language files ...)
+                 (cons language
+                       (fold (lambda (file vhash)
+                               (let ((alist (call-with-input-file file read)))
+                                 ;; Use 'fold-right' so that the first entry
+                                 ;; wins (e.g., "car" from "Pairs" rather than
+                                 ;; from "rnrs base" in the Guile manual).
+                                 (fold-right (match-lambda*
+                                               (((key . value) vhash)
+                                                (vhash-cons key value vhash)))
+                                             vhash
+                                             alist)))
+                             vlist-null
+                             files)))))
+
+            (define mono-node-anchors
+              ;; List of language/vhash pairs, where each vhash maps an
+              ;; identifier to the corresponding URL in a single-page manual.
+              (map language+node-anchors '#$mono-node-indexes))
+
+            (define multi-node-anchors
+              ;; Likewise for split-node manuals.
+              (map language+node-anchors '#$split-node-indexes))
+
            ;; Install a UTF-8 locale so we can process UTF-8 files.
            (setenv "GUIX_LOCPATH"
                    #+(file-append glibc-utf8-locales "/lib/locale"))
            (setlocale LC_ALL "en_US.utf8")

            ;; First process the mono-node 'guix.html' files.
-            (n-par-for-each (parallel-job-count)
-                            (lambda (mono)
-                              (let ((anchors (collect-anchors mono)))
-                                (process-html mono anchors)))
-                            (find-files
-                             #$input
-                             "^guix(-cookbook|)(\\.[a-zA-Z_-]+)?\\.html$"))
+            (for-each (match-lambda
+                        ((language . anchors)
+                         (let ((files (find-files
+                                       (string-append #$input "/" language)
+                                       "^guix(-cookbook|)(\\.[a-zA-Z_-]+)?\\.html$")))
+                           (n-par-for-each (parallel-job-count)
+                                           (cut process-html <> anchors)
+                                           files))))
+                      mono-node-anchors)

-            ;; Next process the multi-node HTML files in two phases: (1)
-            ;; collect the list of anchors, and (2) perform
-            ;; syntax-highlighting.
-            (let* ((multi   (find-files #$input "^html_node$"
-                                        #:directories? #t))
-                   (anchors (n-par-map (parallel-job-count)
-                                       (lambda (multi)
-                                         (cons multi
-                                               (fold collect-anchors vlist-null
-                                                     (find-files multi html?))))
-                                       multi)))
-              (n-par-for-each (parallel-job-count)
-                              (lambda (file)
-                                (let ((anchors (assoc-ref anchors (dirname file))))
-                                  (process-html file anchors)))
-                              (append-map (lambda (multi)
-                                            (find-files multi html?))
-                                          multi)))
+            ;; Process the multi-node HTML files.
+            (for-each (match-lambda
+                        ((language . anchors)
+                         (let ((files (find-files
+                                       (string-append #$input "/" language
+                                                      "/html_node")
+                                       "\\.html$")))
+                           (n-par-for-each (parallel-job-count)
+                                           (cut process-html <> anchors)
+                                           files))))
+                      multi-node-anchors)

            ;; Last, copy non-HTML files as is.
            (for-each copy-as-is
@@ -484,6 +624,8 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
 (define* (html-manual source #:key (languages %languages)
                      (version "0.0")
                      (manual %manual)
+                      (mono-node-indexes (map list languages))
+                      (split-node-indexes (map list languages))
                      (date 1)
                      (options %makeinfo-html-options))
  "Return the HTML manuals built from SOURCE for all LANGUAGES, with the given
@@ -572,6 +714,8 @@ makeinfo OPTIONS."
  (let* ((name   (string-append manual "-html-manual"))
         (manual (computed-file name build)))
    (syntax-highlighted-html manual
+                             #:mono-node-indexes mono-node-indexes
+                             #:split-node-indexes split-node-indexes
                             #:name (string-append name "-highlighted"))))

 (define* (pdf-manual source #:key (languages %languages)
@@ -918,6 +1062,8 @@ languages:\n"
                          #:key (languages %languages)
                          (version "0.0")
                          (date (time-second (current-time time-utc)))
+                          (mono-node-indexes (map list %languages))
+                          (split-node-indexes (map list %languages))
                          (manual %manual))
  "Return the union of the HTML and PDF manuals, as well as the indexes."
  (directory-union (string-append manual "-manual")
@@ -928,7 +1074,12 @@ languages:\n"
                                #:version version
                                #:manual manual))
                        (list html-manual-indexes
-                              html-manual pdf-manual))
+                              (lambda (source . args)
+                                (apply html-manual source
+                                       #:mono-node-indexes mono-node-indexes
+                                       #:split-node-indexes split-node-indexes
+                                       args))
+                              pdf-manual))
                   #:copy? #t))

 (define (latest-commit+date directory)
@@ -941,18 +1092,146 @@ commit date (an integer)."
    ;; TODO: Use (git describe) when it's widely available.
    (values (oid->string oid) (commit-time commit))))

+
+;;;
+;;; Guile manual.
+;;;
+
+(define guile-manual
+  ;; The Guile manual as HTML, including both the mono-node "guile.html" and
+  ;; the split-node "html_node" directory.
+  (let ((guile guile-3.0-latest))
+    (computed-file (string-append "guile-manual-" (package-version guile))
+                   (with-imported-modules '((guix build utils))
+                     #~(begin
+                         (use-modules (guix build utils)
+                                      (ice-9 match))
+
+                         (setenv "PATH"
+                                 (string-append #+tar "/bin:"
+                                                #+xz "/bin:"
+                                                #+texinfo "/bin"))
+                         (invoke "tar" "xf" #$(package-source guile))
+                         (mkdir-p (string-append #$output "/en/html_node"))
+
+                         (let* ((texi (find-files "." "^guile\\.texi$"))
+                                (documentation (match texi
+                                                 ((file) (dirname file)))))
+                           (with-directory-excursion documentation
+                             (invoke "makeinfo" "--html" "--no-split"
+                                     "-o" (string-append #$output
+                                                         "/en/guile.html")
+                                     "guile.texi")
+                             (invoke "makeinfo" "--html" "-o" "split"
+                                     "guile.texi")
+                             (copy-recursively
+                              "split"
+                              (string-append #$output "/en/html_node")))))))))
+
+(define %guile-manual-base-url
+  "https://www.gnu.org/software/guile/manual")
+
+(define (for-all-languages index)
+  (map (lambda (language)
+         (list language index))
+       %languages))
+
+(define guile-mono-node-indexes
+  ;; The Guile manual is only available in English so use the same index in
+  ;; all languages.
+  (for-all-languages
+   (html-manual-identifier-index (file-append guile-manual "/en")
+                                 %guile-manual-base-url
+                                 #:name "guile-html-index-en")))
+
+(define guile-split-node-indexes
+  (for-all-languages
+   (html-manual-identifier-index (file-append guile-manual "/en/html_node")
+                                 (string-append %guile-manual-base-url
+                                                "/html_node")
+                                 #:name "guile-html-index-en")))
+
+(define (merge-index-alists alist1 alist2)
+  "Merge ALIST1 and ALIST2, both of which are list of tuples like:
+
+  (LANGUAGE INDEX1 INDEX2 ...)
+
+where LANGUAGE is a string like \"en\" and INDEX1 etc. are indexes as returned
+by 'html-identifier-indexes'."
+  (let ((languages (delete-duplicates
+                    (append (match alist1
+                              (((languages . _) ...)
+                               languages))
+                            (match alist2
+                              (((languages . _) ...)
+                               languages))))))
+    (map (lambda (language)
+           (cons language
+                 (append (or (assoc-ref alist1 language) '())
+                         (or (assoc-ref alist2 language) '()))))
+         languages)))
+

 (let* ((root (canonicalize-path
              (string-append (current-source-directory) "/..")))
-       (commit date (latest-commit+date root)))
+       (commit date (latest-commit+date root))
+       (version (or (getenv "GUIX_MANUAL_VERSION")
+                    (string-take commit 7)))
+       (select? (let ((vcs? (git-predicate root)))
+                  (lambda (file stat)
+                    (and (vcs? file stat)
+                         ;; Filter out this file.
+                         (not (string=? (basename file) "build.scm"))))))
+       (source (local-file root "guix" #:recursive? #t
+                           #:select? select?)))
+
+  (define guix-manual
+    (html-manual source
+                 #:manual "guix"
+                 #:version version
+                 #:date date))
+
+  (define guix-mono-node-indexes
+    ;; Alist of indexes for GUIX-MANUAL, where each key is a language code and
+    ;; each value is a file-like object containing the identifier index.
+    (html-identifier-indexes guix-manual ""
+                             #:manual-name "guix"
+                             #:base-url (if (string=? %manual "guix")
+                                            (const "")
+                                            (cut string-append
+                                              "/manual/devel/" <>))
+                             #:languages %languages))
+
+  (define guix-split-node-indexes
+    ;; Likewise for the split-node variant of GUIX-MANUAL.
+    (html-identifier-indexes guix-manual "/html_node"
+                             #:manual-name "guix"
+                             #:base-url (if (string=? %manual "guix")
+                                            (const "")
+                                            (cut string-append
+                                              "/manual/devel/" <>
+                                              "/html_node"))
+                             #:languages %languages))
+
+  (define mono-node-indexes
+    (merge-index-alists guix-mono-node-indexes guile-mono-node-indexes))
+
+  (define split-node-indexes
+    (merge-index-alists guix-split-node-indexes guile-split-node-indexes))
+
  (format (current-error-port)
          "building manual from work tree around commit ~a, ~a~%"
          commit
          (let* ((time (make-time time-utc 0 date))
                 (date (time-utc->date time)))
            (date->string date "~e ~B ~Y")))
-  (pdf+html-manual (local-file root "guix" #:recursive? #t
-                               #:select? (git-predicate root))
-                   #:version (or (getenv "GUIX_MANUAL_VERSION")
-                                 (string-take commit 7))
+
+  (pdf+html-manual source
+                   ;; Always use the identifier indexes of GUIX-MANUAL and
+                   ;; GUILE-MANUAL.  Both "guix" and "guix-cookbook" can
+                   ;; contain links to definitions that appear in either of
+                   ;; these two manuals.
+                   #:mono-node-indexes mono-node-indexes
+                   #:split-node-indexes split-node-indexes
+                   #:version version
                   #:date date))
@@ -28,6 +28,7 @@ choice.
 * Submitting Patches::          Share your work.
 * Tracking Bugs and Patches::   Using Debbugs.
 * Commit Access::               Pushing to the official repository.
+* Updating the Guix Package::   Updating the Guix package definition.
@end menu

@node Building from Git
@@ -42,45 +43,28 @@ git clone https://git.savannah.gnu.org/git/guix.git

@cindex authentication, of a Guix checkout
 How do you ensure that you obtained a genuine copy of the repository?
-Guix itself provides a tool to @dfn{authenticate} your checkout, but you
-must first make sure this tool is genuine in order to ``bootstrap'' the
-trust chain.  To do that, run:
+To do that, run @command{guix git authenticate}, passing it the commit
+and OpenPGP fingerprint of the @dfn{channel introduction}
+(@pxref{Invoking guix git authenticate}):

-@c XXX: Adjust instructions when there's a known tag to start from.
+@c The commit and fingerprint below must match those of the channel
+@c introduction in '%default-channels'.
@example
-git verify-commit `git log --format=%H build-aux/git-authenticate.scm`
-@end example
-
-The output must look something like:
-
-@example
-gpg: Signature made Fri 27 Dec 2019 01:27:41 PM CET
-gpg:                using RSA key 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
-@dots{}
-gpg: Signature made Fri 27 Dec 2019 01:25:22 PM CET
-gpg:                using RSA key 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
-@dots{}
+git fetch origin keyring:keyring
+guix git authenticate 9edb3f66fd807b096b48283debdcddccfea34bad \
+  "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"
@end example

@noindent
-... meaning that changes to this file are all signed with key
-@code{3CE464558A84FDC69DB40CFB090B11993D9AEBB5} (you may need to fetch
-this key from a key server, if you have not done it yet).
+This command completes with exit code zero on success; it prints an
+error message and exits with a non-zero code otherwise.

-From there on, you can authenticate all the commits included in your
-checkout by running:
-
-@example
-make authenticate
-@end example
-
-The first run takes a couple of minutes, but subsequent runs are faster.
-
-@quotation Note
-You are advised to run @command{make authenticate} after every
-@command{git pull} invocation.  This ensures you keep receiving valid
-changes to the repository
-@end quotation
+As you can see, there is a chicken-and-egg problem: you first need to
+have Guix installed.  Typically you would install Guix System
+(@pxref{System Installation}) or Guix on top of another distro
+(@pxref{Binary Installation}); in either case, you would verify the
+OpenPGP signature on the installation medium.  This ``bootstraps'' the
+trust chain.

 The easiest way to set up a development environment for Guix is, of
 course, by using Guix!  The following command starts a new shell where
@@ -138,14 +122,40 @@ more information.
 Then, run @command{./configure} as usual.  Make sure to pass
@code{--localstatedir=@var{directory}} where @var{directory} is the
@code{localstatedir} value used by your current installation (@pxref{The
-Store}, for information about this).  We recommend to use the value
-@code{/var}.
+Store}, for information about this), usually @file{/var}.  Note that you
+will probably not run @command{make install} at the end (you don't have
+to) but it's still important to pass the right @code{localstatedir}.

 Finally, you have to invoke @code{make check} to run tests
 (@pxref{Running the Test Suite}).  If anything
 fails, take a look at installation instructions (@pxref{Installation})
 or send a message to the @email{guix-devel@@gnu.org, mailing list}.

+From there on, you can authenticate all the commits included in your
+checkout by running:
+
+@example
+make authenticate
+@end example
+
+The first run takes a couple of minutes, but subsequent runs are faster.
+
+Or, when your configuration for your local Git repository doesn't match
+the default one, you can provide the reference for the @code{keyring}
+branch through the variable @code{GUIX_GIT_KEYRING}.  The following
+example assumes that you have a Git remote called @samp{myremote}
+pointing to the official repository:
+
+@example
+make authenticate GUIX_GIT_KEYRING=myremote/keyring
+@end example
+
+@quotation Note
+You are advised to run @command{make authenticate} after every
+@command{git pull} invocation.  This ensures you keep receiving valid
+changes to the repository.
+@end quotation
+

@node Running Guix Before It Is Installed
@section Running Guix Before It Is Installed
@@ -161,13 +171,11 @@ with all the dependencies available (@pxref{Building from Git}), and then
 simply prefix each command with
@command{./pre-inst-env} (the @file{pre-inst-env} script lives in the
 top build tree of Guix; it is generated by @command{./configure}).
-An example@footnote{The @option{-E} flag to
-@command{sudo} guarantees that @code{GUILE_LOAD_PATH} is correctly set
-such that @command{guix-daemon} and the tools it uses can find the Guile
-modules they need.}:
+As an example, here is how you would build the @code{hello} package as
+defined in your working tree (this assumes @command{guix-daemon} is
+already running on your system; it's OK if it's a different version):

@example
-$ sudo -E ./pre-inst-env guix-daemon --build-users-group=guixbuild
 $ ./pre-inst-env guix build hello
@end example

@@ -202,6 +210,17 @@ scheme@@(guile-user)> (length snakes)
 $1 = 361
@end example

+If you are hacking on the daemon and its supporting code or if
+@command{guix-daemon} is not already running on your system, you can
+launch it straight from the build tree@footnote{The @option{-E} flag to
+@command{sudo} guarantees that @code{GUILE_LOAD_PATH} is correctly set
+such that @command{guix-daemon} and the tools it uses can find the Guile
+modules they need.}:
+
+@example
+$ sudo -E ./pre-inst-env guix-daemon --build-users-group=guixbuild
+@end example
+
 The @command{pre-inst-env} script sets up all the environment variables
 necessary to support this, including @env{PATH} and @env{GUILE_LOAD_PATH}.

@@ -277,7 +296,7 @@ trigger string @code{origin...}, which can be expanded further.  The
@cindex insert or update copyright
@cindex @code{M-x guix-copyright}
@cindex @code{M-x copyright-update}
-Additionaly we provide insertion and automatic update of a copyright in
+We additionally provide insertion and automatic update of a copyright in
@file{etc/copyright.el}.  You may want to set your full name, mail, and
 load a file.

@@ -355,7 +374,7 @@ Once your package builds correctly, please send us a patch
 (@pxref{Submitting Patches}).  Well, if you need help, we will be happy to
 help you too.  Once the patch is committed in the Guix repository, the
 new package automatically gets built on the supported platforms by
-@url{@value{SUBSTITUTE-SERVER}, our continuous integration system}.
+@url{@value{SUBSTITUTE-URL}, our continuous integration system}.

@cindex substituter
 Users can obtain the new package definition simply by running
@@ -371,6 +390,7 @@ needed is to review and apply the patch.
 * Package Naming::              What's in a name?
 * Version Numbers::             When the name is not enough.
 * Synopses and Descriptions::   Helping users find the right package.
+* Snippets versus Phases::      Whether to use a snippet, or a build phase.
 * Python Modules::              A touch of British comedy.
 * Perl Modules::                Little pearls.
 * Java Packages::               Coffee break.
@@ -595,12 +615,26 @@ to make recommendations or instructions visible to them by inserting
 special comments like this (@pxref{xgettext Invocation,,, gettext, GNU
 Gettext}):

-@example
+@lisp
 ;; TRANSLATORS: "X11 resize-and-rotate" should not be translated.
 (description "ARandR is designed to provide a simple visual front end
 for the X11 resize-and-rotate (RandR) extension. @dots{}")
-@end example
+@end lisp

+@node Snippets versus Phases
+@subsection Snippets versus Phases
+
+@cindex snippets, when to use
+The boundary between using an origin snippet versus a build phase to
+modify the sources of a package can be elusive.  Origin snippets are
+typically used to remove unwanted files such as bundled libraries,
+nonfree sources, or to apply simple substitutions.  The source derived
+from an origin should produce a source that can be used to build the
+package on any system that the upstream package supports (i.e., act as
+the corresponding source).  In particular, origin snippets must not
+embed store items in the sources; such patching should rather be done
+using build phases.  Refer to the @code{origin} record documentation for
+more information (@pxref{origin Reference}).

@node Python Modules
@subsection Python Modules
@@ -991,19 +1025,19 @@ rebuilding induced, commits go to different branches, along these lines:
@item 300 dependent packages or less
@code{master} branch (non-disruptive changes).

-@item between 300 and 1,200 dependent packages
+@item between 300 and 1,800 dependent packages
@code{staging} branch (non-disruptive changes).  This branch is intended
-to be merged in @code{master} every 3 weeks or so.  Topical changes
+to be merged in @code{master} every 6 weeks or so.  Topical changes
 (e.g., an update of the GNOME stack) can instead go to a specific branch
 (say, @code{gnome-updates}).

-@item more than 1,200 dependent packages
+@item more than 1,800 dependent packages
@code{core-updates} branch (may include major and potentially disruptive
 changes).  This branch is intended to be merged in @code{master} every
-2.5 months or so.
+6 months or so.
@end table

-All these branches are @uref{@value{SUBSTITUTE-SERVER},
+All these branches are @uref{@value{SUBSTITUTE-URL},
 tracked by our build farm} and merged into @code{master} once
 everything has been successfully built.  This allows us to fix issues
 before they hit users, and to reduce the window during which pre-built
@@ -1128,18 +1162,20 @@ browse issues:

@itemize
@item
+@url{https://issues.guix.gnu.org} provides a pleasant
+interface@footnote{The web interface at
+@url{https://issues.guix.gnu.org} is powered by Mumi, a nice piece of
+software written in Guile, and you can help!  See
+@url{https://git.elephly.net/gitweb.cgi?p=software/mumi.git}.} to browse
+bug reports and patches, and to participate in discussions;
+@item
@url{https://bugs.gnu.org/guix} lists bug reports;
@item
@url{https://bugs.gnu.org/guix-patches} lists patch submissions.
@end itemize

-You can also access both of these @i{via} the (nicer)
-@url{https://issues.guix.gnu.org} interface@footnote{The web interface
-at @url{https://issues.guix.gnu.org} is powered by Mumi, a nice piece of
-software written in Guile, and you can help!  See
-@url{https://git.elephly.net/gitweb.cgi?p=software/mumi.git}.}.  To view
-discussions related to issue number @var{n}, go to
-@indicateurl{https://issues.guix.gnu.org/issue/@var{n}} or
+To view discussions related to issue number @var{n}, go to
+@indicateurl{https://issues.guix.gnu.org/@var{n}} or
@indicateurl{https://bugs.gnu.org/@var{n}}.

 If you use Emacs, you may find it more convenient to interact with
@@ -1298,3 +1334,40 @@ only push their own awesome changes, but also offer some of their time
@emph{reviewing} and pushing other people's changes.  As a committer,
 you're welcome to use your expertise and commit rights to help other
 contributors, too!
+
+@node Updating the Guix Package
+@section Updating the Guix Package
+
+@cindex update-guix-package, updating the guix package
+It is sometimes desirable to update the @code{guix} package itself (the
+package defined in @code{(gnu packages package-management)}), for
+example to make new daemon features available for use by the
+@code{guix-service-type} service type.  In order to simplify this task,
+the following command can be used:
+
+@example
+make update-guix-package
+@end example
+
+The @code{update-guix-package} make target will use the last known
+@emph{commit} corresponding to @code{HEAD} in your Guix checkout,
+compute the hash of the Guix sources corresponding to that commit and
+update the @code{commit}, @code{revision} and hash of the @code{guix}
+package definition.
+
+To validate that the updated @code{guix} package hashes are correct and
+that it can be built successfully, the following command can be run from
+the directory of your Guix checkout:
+
+@example
+./pre-inst-env guix build guix
+@end example
+
+To guard against accidentally updating the @code{guix} package to a
+commit that others can't refer to, a check is made that the commit used
+has already been pushed to the Savannah-hosted Guix git repository.
+
+This check can be disabled, @emph{at your own peril}, by setting the
+@code{GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT} environment variable.  When
+this variable is set, the updated package source is also added to the
+store.  This is used as part of the release process of Guix.
@@ -15,6 +15,8 @@ Copyright @copyright{} 2020 Oleg Pykhalov@*
 Copyright @copyright{} 2020 Matthew Brooks@*
 Copyright @copyright{} 2020 Marcin Karpezo@*
 Copyright @copyright{} 2020 Brice Waegeneire@*
+Copyright @copyright{} 2020 André Batista@*
+Copyright @copyright{} 2020 Christopher Lemmer Webber

 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -63,6 +65,7 @@ Translation Project}.
 * Packaging::                   Packaging tutorials
 * System Configuration::        Customizing the GNU System
 * Advanced package management:: Power to the users!
+* Environment management::      Control environment

 * Acknowledgments::             Thanks!
 * GNU Free Documentation License::  The license of this document.
@@ -109,8 +112,8 @@ Let's get started!

 Guix uses the Guile implementation of Scheme.  To start playing with the
 language, install it with @code{guix install guile} and start a
-@uref{https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop,
-REPL} by running @code{guile} from the command line.
+@dfn{REPL}---short for @uref{https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop,
+@dfn{read-eval-print loop}}---by running @code{guile} from the command line.

 Alternatively you can also run @code{guix environment --ad-hoc guile -- guile}
 if you'd rather not have Guile installed in your user profile.
@@ -118,15 +121,16 @@ if you'd rather not have Guile installed in your user profile.
 In the following examples, lines show what you would type at the REPL;
 lines starting with ``@result{}'' show evaluation results, while lines
 starting with ``@print{}'' show things that get printed.  @xref{Using Guile
-Interactively,,, guile, GNU Guile Reference Manual}), for more details on the
+Interactively,,, guile, GNU Guile Reference Manual}, for more details on the
 REPL.

@itemize
@item
 Scheme syntax boils down to a tree of expressions (or @emph{s-expression} in
 Lisp lingo).  An expression can be a literal such as numbers and strings, or a
-compound which is a parenthesized list of compounds and literals.  @code{#t}
-and @code{#f} stand for the Booleans ``true'' and ``false'', respectively.
+compound which is a parenthesized list of compounds and literals.  @code{#true}
+and @code{#false} (abbreviated @code{#t} and @code{#f}) stand for the
+Booleans ``true'' and ``false'', respectively.

 Examples of valid expressions:

@@ -246,8 +250,10 @@ definitions.
@end lisp

@item
-The keyword syntax is @code{#:}; it is used to create unique identifiers.
-@pxref{Keywords,,, guile, GNU Guile Reference Manual}.
+@dfn{Keywords} are typically used to identify the named parameters of a
+procedure.  They are prefixed by @code{#:} (hash, colon) followed by
+alphanumeric characters: @code{#:like-this}.
+@xref{Keywords,,, guile, GNU Guile Reference Manual}.

@item
 The percentage @code{%} is typically used for read-only global variables in
@@ -788,11 +794,11 @@ another, more sophisticated package (slightly modified from the source):
                (snippet '(begin
                            ;; Remove bundled software.
                            (delete-file-recursively "deps")
-                            #t))))
+                            #true))))
      (build-system cmake-build-system)
      (outputs '("out" "debug"))
      (arguments
-       `(#:tests? #t                            ; Run the test suite (this is the default)
+       `(#:tests? #true                         ; Run the test suite (this is the default)
         #:configure-flags '("-DUSE_SHA1DC=ON") ; SHA-1 collision detection
         #:phases
         (modify-phases %standard-phases
@@ -803,12 +809,12 @@ another, more sophisticated package (slightly modified from the source):
               (substitute* "tests/clar/fs.h"
                 (("/bin/cp") (which "cp"))
                 (("/bin/rm") (which "rm")))
-               #t))
+               #true))
           ;; Run checks more verbosely.
           (replace 'check
             (lambda _ (invoke "./libgit2_clar" "-v" "-Q")))
           (add-after 'unpack 'make-files-writable-for-tests
-               (lambda _ (for-each make-file-writable (find-files "." ".*")))))))
+             (lambda _ (for-each make-file-writable (find-files "." ".*")))))))
      (inputs
       `(("libssh2" ,libssh2)
         ("http-parser" ,http-parser)
@@ -843,12 +849,32 @@ tags, so if the @code{version} is tagged, then it can be used directly.  Sometim
 the tag is prefixed with a @code{v}, in which case you'd use @code{(commit (string-append
 "v" version))}.

-To ensure that the source code from the Git repository is stored in a unique
-directory with a readable name we use @code{(file-name (git-file-name name
+To ensure that the source code from the Git repository is stored in a
+directory with a descriptive name, we use @code{(file-name (git-file-name name
 version))}.

-Note that there is also a @code{git-version} procedure that can be used to derive the
-version when packaging programs for a specific commit.
+The @code{git-version} procedure can be used to derive the
+version when packaging programs for a specific commit, following the
+Guix contributor guidelines (@pxref{Version Numbers,,, guix, GNU Guix
+Reference Manual}).
+
+How does one obtain the @code{sha256} hash that's in there, you ask?  By
+invoking @command{guix hash} on a checkout of the desired commit, along
+these lines:
+
+@example
+git clone https://github.com/libgit2/libgit2/
+cd libgit2
+git checkout v0.26.6
+guix hash -rx .
+@end example
+
+@command{guix hash -rx} computes a SHA256 hash over the whole directory,
+excluding the @file{.git} sub-directory (@pxref{Invoking guix hash,,,
+guix, GNU Guix Reference Manual}).
+
+In the future, @command{guix download} will hopefully be able to do
+these steps for you, just like it does for regular downloads.

@subsubsection Snippets

@@ -1006,7 +1032,7 @@ If you want to know more about what happens during those phases, consult the
 associated procedures.

 For instance, as of this writing the definition of @code{unpack} for the GNU build
-system is
+system is:

@lisp
 (define* (unpack #:key source #:allow-other-keys)
@@ -1021,13 +1047,13 @@ working directory."
        ;; Preserve timestamps (set to the Epoch) on the copied tree so that
        ;; things work deterministically.
        (copy-recursively source "."
-                          #:keep-mtime? #t))
+                          #:keep-mtime? #true))
      (begin
        (if (string-suffix? ".zip" source)
            (invoke "unzip" source)
            (invoke "tar" "xvf" source))
        (chdir (first-subdirectory "."))))
-  #t)
+  #true)
@end lisp

 Note the @code{chdir} call: it changes the working directory to where the source was
@@ -1043,16 +1069,16 @@ the following forms:

@itemize
@item
-@code{(add-before PHASE NEW-PHASE PROCEDURE)}: Run @code{PROCEDURE} named @code{NEW-PHASE} before @code{PHASE}.
+@code{(add-before @var{phase} @var{new-phase} @var{procedure})}: Run @var{procedure} named @var{new-phase} before @var{phase}.
@item
-@code{(add-after PHASE NEW-PHASE PROCEDURE)}: Same, but afterwards.
+@code{(add-after @var{phase} @var{new-phase} @var{procedure})}: Same, but afterwards.
@item
-@code{(replace PHASE PROCEDURE)}.
+@code{(replace @var{phase} @var{procedure})}.
@item
-@code{(delete PHASE)}.
+@code{(delete @var{phase})}.
@end itemize

-The @code{PROCEDURE} supports the keyword arguments @code{inputs} and @code{outputs}.  Each
+The @var{procedure} supports the keyword arguments @code{inputs} and @code{outputs}.  Each
 input (whether @emph{native}, @emph{propagated} or not) and output directory is referenced
 by their name in those variables.  Thus @code{(assoc-ref outputs "out")} is the store
 directory of the main output of the package.  A phase procedure may look like
@@ -1060,16 +1086,16 @@ this:

@lisp
 (lambda* (#:key inputs outputs #:allow-other-keys)
-  (let (((bash-directory (assoc-ref inputs "bash"))
-         (output-directory (assoc-ref outputs "out"))
-         (doc-directory (assoc-ref outputs "doc"))
-  ; ...
-  #t)
+  (let ((bash-directory (assoc-ref inputs "bash"))
+        (output-directory (assoc-ref outputs "out"))
+        (doc-directory (assoc-ref outputs "doc")))
+    ;; ...
+    #true))
@end lisp

-The procedure must return @code{#t} on success.  It's brittle to rely on the return
+The procedure must return @code{#true} on success.  It's brittle to rely on the return
 value of the last expression used to tweak the phase because there is no
-guarantee it would be a @code{#t}.  Hence the trailing @code{#t} to ensure the right value
+guarantee it would be a @code{#true}.  Hence the trailing @code{#true} to ensure the right value
 is returned on success.

@subsubsection Code staging
@@ -1095,7 +1121,7 @@ Some of those functions can be found in
@samp{$GUIX_CHECKOUT/guix/guix/build/utils.scm}.  Most of them mirror the behaviour
 of the traditional Unix system commands:

-@table @asis
+@table @code
@item which
 Like the @samp{which} system command.
@item find-files
@@ -1119,6 +1145,9 @@ then restore the previous working directory.
 A ``@command{sed}-like'' function.
@end table

+@xref{Build Utilities,,, guix, GNU Guix Reference Manual}, for more
+information on these utilities.
+
@subsubsection Module prefix

 The license in our last example needs a prefix: this is because of how the
@@ -1267,7 +1296,7 @@ version or compilation options.
@subsection Getting help

 Sadly, some applications can be tough to package.  Sometimes they need a patch to
-work with the non-standard filesystem hierarchy enforced by the store.
+work with the non-standard file system hierarchy enforced by the store.
 Sometimes the tests won't run properly.  (They can be skipped but this is not
 recommended.)  Other times the resulting package won't be reproducible.

@@ -1326,8 +1355,10 @@ reference.
 * Customizing the Kernel::       Creating and using a custom Linux kernel on Guix System.
 * Connecting to Wireguard VPN::  Connecting to a Wireguard VPN.
 * Customizing a Window Manager:: Handle customization of a Window manager on Guix System.
+* Running Guix on a Linode Server:: Running Guix on a Linode Server
 * Setting up a bind mount:: Setting up a bind mount in the file-systems definition.
 * Getting substitutes from Tor:: Configuring Guix daemon to get substitutes through Tor.
+* Setting up NGINX with Lua:: Configuring NGINX web-server to load Lua modules.
@end menu

@node Customizing the Kernel
@@ -1360,8 +1391,8 @@ creates a package.
                           #:key
                           ;; A function that takes an arch and a variant.
                           ;; See kernel-config for an example.
-                           (extra-version #f)
-                           (configuration-file #f)
+                           (extra-version #false)
+                           (configuration-file #false)
                           (defconfig "defconfig")
                           (extra-options %default-extra-linux-options)
                           (patches (list %boot-logo-patch)))
@@ -1404,7 +1435,7 @@ the @code{make-linux-libre} package definition:
      (begin
        (copy-file config ".config")
        (chmod ".config" #o666))
-      (invoke "make" ,defconfig))
+      (invoke "make" ,defconfig)))
@end lisp

 Below is a sample kernel package.  The @code{linux-libre} package is nothing
@@ -1435,7 +1466,7 @@ it:
@lisp
 (define %default-extra-linux-options
  `(;; https://lists.gnu.org/archive/html/guix-devel/2014-04/msg00039.html
-   ("CONFIG_DEVPTS_MULTIPLE_INSTANCES" . #t)
+   ("CONFIG_DEVPTS_MULTIPLE_INSTANCES" . #true)
   ;; Modules required for initrd:
   ("CONFIG_NET_9P" . m)
   ("CONFIG_NET_9P_VIRTIO" . m)
@@ -1452,9 +1483,9 @@ it:
  (string-join (map (match-lambda
                      ((option . 'm)
                       (string-append option "=m"))
-                      ((option . #t)
+                      ((option . #true)
                       (string-append option "=y"))
-                      ((option . #f)
+                      ((option . #false)
                       (string-append option "=n")))
                    options)
               "\n"))
@@ -1470,7 +1501,7 @@ And in the custom configure script from the `make-linux-libre` package:
  (display extra-configuration port)
  (close-port port))

-(invoke "make" "oldconfig"))))
+(invoke "make" "oldconfig")
@end lisp

 So by not providing a configuration-file the @file{.config} starts blank, and
@@ -1480,7 +1511,7 @@ custom kernel:
@lisp
 (define %macbook41-full-config
  (append %macbook41-config-options
-          %filesystems
+          %file-systems
          %efi-support
          %emulation
          (@@@@ (gnu packages linux) %default-extra-linux-options)))
@@ -1496,8 +1527,8 @@ custom kernel:
                      #:extra-options %macbook41-config-options))
@end lisp

-In the above example @code{%filesystems} is a collection of flags enabling
-different filesystem support, @code{%efi-support} enables EFI support and
+In the above example @code{%file-systems} is a collection of flags enabling
+different file system support, @code{%efi-support} enables EFI support and
@code{%emulation} enables a x86_64-linux machine to act in 32-bit mode also.
@code{%default-extra-linux-options} are the ones quoted above, which had to be
 added in since they were replaced in the @code{extra-options} keyword.
@@ -1561,7 +1592,7 @@ The second way to setup the kernel configuration makes more use of Guix's
 features and allows you to share configuration segments between different
 kernels.  For example, all machines using EFI to boot have a number of EFI
 configuration flags that they need.  It is likely that all the kernels will
-share a list of filesystems to support.  By using variables it is easier to
+share a list of file systems to support.  By using variables it is easier to
 see at a glance what features are enabled and to make sure you don't have
 features in one kernel but missing in another.

@@ -1738,6 +1769,246 @@ your screen but not suspend it, it's a good idea to notify xss-lock about this s
 confusion occurs. This can be done by executing @code{xset s activate} immediately
 before you execute slock.

+@node Running Guix on a Linode Server
+@section Running Guix on a Linode Server
+@cindex linode, Linode
+
+To run Guix on a server hosted by @uref{https://www.linode.com, Linode},
+start with a recommended Debian server.  We recommend using the default
+distro as a way to bootstrap Guix. Create your SSH keys.
+
+@example
+ssh-keygen
+@end example
+
+Be sure to add your SSH key for easy login to the remote server.
+This is trivially done via Linode's graphical interface for adding
+SSH keys.  Go to your profile and click add SSH Key.
+Copy into it the output of:
+
+@example
+cat ~/.ssh/<username>_rsa.pub
+@end example
+
+Power the Linode down. In the Linode's Disks/Configurations tab, resize
+the Debian disk to be smaller. 30 GB is recommended.
+
+In the Linode settings, "Add a disk", with the following:
+@itemize @bullet
+@item
+Label: "Guix"
+
+@item
+Filesystem: ext4
+
+@item
+Set it to the remaining size
+@end itemize
+
+On the "configuration" field that comes with the default image, press
+"..." and select "Edit", then on that menu add to @file{/dev/sdc} the "Guix"
+label.
+
+Now "Add a Configuration", with the following:
+@itemize @bullet
+@item
+Label: Guix
+
+@item
+Kernel:GRUB 2 (it's at the bottom!  This step is @b{IMPORTANT!})
+
+@item
+Block device assignment:
+
+@item
+@file{/dev/sda}: Guix
+
+@item
+@file{/dev/sdb}: swap
+
+@item
+Root device: @file{/dev/sda}
+
+@item
+Turn off all the filesystem/boot helpers
+@end itemize
+
+Now power it back up, picking the Debian configuration.  Once it's
+booted up, ssh in your server via @code{ssh
+root@@@var{<your-server-IP-here>}}. (You can find your server IP address in
+your Linode Summary section.) Now you can run the "install guix from
+@pxref{Binary Installation,,, guix, GNU Guix}" steps:
+
+@example
+sudo apt-get install gpg
+wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
+wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+chmod +x guix-install.sh
+./guix-install.sh
+guix pull
+@end example
+
+Now it's time to write out a config for the server.  The key information
+is below. Save the resulting file as @file{guix-config.scm}.
+
+@lisp
+(use-modules (gnu)
+             (guix modules))
+(use-service-modules networking
+                     ssh)
+(use-package-modules admin
+                     certs
+                     package-management
+                     ssh
+                     tls)
+
+(operating-system
+  (host-name "my-server")
+  (timezone "America/New_York")
+  (locale "en_US.UTF-8")
+  ;; This goofy code will generate the grub.cfg
+  ;; without installing the grub bootloader on disk.
+  (bootloader (bootloader-configuration
+               (bootloader
+                (bootloader
+                 (inherit grub-bootloader)
+                 (installer #~(const #true))))))
+  (file-systems (cons (file-system
+                        (device "/dev/sda")
+                        (mount-point "/")
+                        (type "ext4"))
+                      %base-file-systems))
+
+
+  (swap-devices (list "/dev/sdb"))
+
+
+  (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
+                        %base-initrd-modules))
+
+  (users (cons (user-account
+                (name "janedoe")
+                (group "users")
+                ;; Adding the account to the "wheel" group
+                ;; makes it a sudoer.
+                (supplementary-groups '("wheel"))
+                (home-directory "/home/janedoe"))
+               %base-user-accounts))
+
+  (packages (cons* nss-certs            ;for HTTPS access
+                   openssh-sans-x
+                   %base-packages))
+
+  (services (cons*
+             (service dhcp-client-service-type)
+             (service openssh-service-type
+                      (openssh-configuration
+                       (openssh openssh-sans-x)
+                       (password-authentication? #false)
+                       (authorized-keys
+                        `(("janedoe" ,(local-file "janedoe_rsa.pub"))
+                          ("root" ,(local-file "janedoe_rsa.pub"))))))
+             %base-services)))
+@end lisp
+
+Replace the following fields in the above configuration:
+@lisp
+(host-name "my-server")       ; replace with your server name
+; if you chose a linode server outside the U.S., then
+; use tzselect to find a correct timezone string
+(timezone "America/New_York") ; if needed replace timezone
+(name "janedoe")              ; replace with your username
+("janedoe" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key
+("root" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key
+@end lisp
+
+The last line in the above example lets you log into the server as root
+and set the initial root password.  After you have done this, you may
+delete that line from your configuration and reconfigure to prevent root
+login.
+
+Save your ssh public key (eg: @file{~/.ssh/id_rsa.pub}) as
+@file{@var{<your-username-here>}_rsa.pub} and your
+@file{guix-config.scm} in the same directory.  In a new terminal run
+these commands.
+
+@example
+sftp root@@<remote server ip address>
+put /home/<username>/ssh/id_rsa.pub .
+put /path/to/linode/guix-config.scm .
+@end example
+
+In your first terminal, mount the guix drive:
+
+@example
+mkdir /mnt/guix
+mount /dev/sdc /mnt/guix
+@end example
+
+Due to the way we set things up above, we do not install GRUB
+completely.  Instead we install only our grub configuration file.  So we
+need to copy over some of the other GRUB stuff that is already there:
+
+@example
+mkdir -p /mnt/guix/boot/grub
+cp -r /boot/grub/* /mnt/guix/boot/grub/
+@end example
+
+Now initialize the Guix installation:
+
+@example
+guix system init guix-config.scm /mnt/guix
+@end example
+
+Ok, power it down!
+Now from the Linode console, select boot and select "Guix".
+
+Once it boots, you should be able to log in via SSH!  (The server config
+will have changed though.)  You may encounter an error like:
+
+@example
+$ ssh root@@<server ip address>
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
+Someone could be eavesdropping on you right now (man-in-the-middle attack)!
+It is also possible that a host key has just been changed.
+The fingerprint for the ECDSA key sent by the remote host is
+SHA256:0B+wp33w57AnKQuHCvQP0+ZdKaqYrI/kyU7CfVbS7R4.
+Please contact your system administrator.
+Add correct host key in /home/joshua/.ssh/known_hosts to get rid of this message.
+Offending ECDSA key in /home/joshua/.ssh/known_hosts:3
+ECDSA host key for 198.58.98.76 has changed and you have requested strict checking.
+Host key verification failed.
+@end example
+
+Either delete @file{~/.ssh/known_hosts} file, or delete the offending line
+starting with your server IP address.
+
+Be sure to set your password and root's password.
+
+@example
+ssh root@@<remote ip address>
+passwd  ; for the root password
+passwd <username> ; for the user password
+@end example
+
+You may not be able to run the above commands at this point.  If you
+have issues remotely logging into your linode box via SSH, then you may
+still need to set your root and user password initially by clicking on
+the ``Launch Console'' option in your linode.  Choose the ``Glish''
+instead of ``Weblish''.  Now you should be able to ssh into the machine.
+
+Horray!  At this point you can shut down the server, delete the
+Debian disk, and resize the Guix to the rest of the size.
+Congratulations!
+
+By the way, if you save it as a disk image right at this point, you'll
+have an easy time spinning up new Guix images!  You may need to
+down-size the Guix image to 6144MB, to save it as an image.  Then you
+can resize it again to the max size.
+
@node Setting up a bind mount
@section Setting up a bind mount

@@ -1799,10 +2070,16 @@ HTTP/HTTPS will get proxied; FTP, Git protocol, SSH, etc connections
 will still go through the clearnet.  Again, this configuration isn't
 foolproof some of your traffic won't get routed by Tor at all.  Use it
 at your own risk.
+
+Also note that the procedure described here applies only to package
+substitution. When you update your guix distribution with
+@command{guix pull}, you still need to use @command{torsocks} if
+you want to route the connection to guix's git repository servers
+through Tor.
@end quotation

 Guix's substitute server is available as a Onion service, if you want
-to use it to get your substitutes from Tor configure your system as
+to use it to get your substitutes through Tor configure your system as
 follow:

@lisp
@@ -1843,6 +2120,63 @@ sudo herd set-http-proxy guix-daemon http://localhost:9250
 guix build --substitute-urls=https://bp7o7ckwlewr4slm.onion …
@end example

+@node Setting up NGINX with Lua
+@section Setting up NGINX with Lua
+@cindex nginx, lua, openresty, resty
+
+NGINX could be extended with Lua scripts.
+
+Guix provides NGINX service with ability to load Lua module and specific
+Lua packages, and reply to requests by evaluating Lua scripts.
+
+The following example demonstrates system definition with configuration
+to evaluate @file{index.lua} Lua script on HTTP request to
+@uref{http://localhost/hello} endpoint:
+
+@example
+local shell = require "resty.shell"
+
+local stdin = ""
+local timeout = 1000  -- ms
+local max_size = 4096  -- byte
+
+local ok, stdout, stderr, reason, status =
+   shell.run([[/run/current-system/profile/bin/ls /tmp]], stdin, timeout, max_size)
+
+ngx.say(stdout)
+@end example
+
+@lisp
+(use-modules (gnu))
+(use-service-modules #;… web)
+(use-package-modules #;… lua)
+(operating-system
+  ;; …
+  (services
+   ;; …
+   (service nginx-service-type
+            (nginx-configuration
+             (modules
+              (list
+               (file-append nginx-lua-module "/etc/nginx/modules/ngx_http_lua_module.so")))
+             (lua-package-path (list lua-resty-core
+                                     lua-resty-lrucache
+                                     lua-resty-signal
+                                     lua-tablepool
+                                     lua-resty-shell))
+             (lua-package-cpath (list lua-resty-signal))
+             (server-blocks
+              (list (nginx-server-configuration
+                     (server-name '("localhost"))
+                     (listen '("80"))
+                     (root "/etc")
+                     (locations (list
+                                 (nginx-location-configuration
+                                  (uri "/hello")
+                                  (body (list #~(format #f "content_by_lua_file ~s;"
+                                                        #$(local-file "index.lua"))))))))))))))
+@end lisp
+
@c *********************************************************************
@node Advanced package management
@chapter Advanced package management
@@ -2241,6 +2575,130 @@ mkdir -p "$GUIX_EXTRA_PROFILES/my-project"
 It's safe to delete the Guix channel profile you've just installed with the
 channel specification, the project profile does not depend on it.

+@c *********************************************************************
+@node Environment management
+@chapter Environment management
+
+Guix provides multiple tools to manage environment.  This chapter
+demonstrate such utilities.
+
+@menu
+* Guix environment via direnv:: Setup Guix environment with direnv
+@end menu
+
+@node Guix environment via direnv
+@section Guix environment via direnv
+
+Guix provides a @samp{direnv} package, which could extend shell after
+directory change.  This tool could be used to prepare a pure Guix
+environment.
+
+The following example provides a shell function for @file{~/.direnvrc}
+file, which could be used from Guix Git repository in
+@file{~/src/guix/.envrc} file to setup a build environment similar to
+described in @pxref{Building from Git,,, guix, GNU Guix Reference
+Manual}.
+
+Create a @file{~/.direnvrc} with a Bash code:
+
+@example
+# Thanks <https://github.com/direnv/direnv/issues/73#issuecomment-152284914>
+export_function()
+@{
+  local name=$1
+  local alias_dir=$PWD/.direnv/aliases
+  mkdir -p "$alias_dir"
+  PATH_add "$alias_dir"
+  local target="$alias_dir/$name"
+  if declare -f "$name" >/dev/null; then
+    echo "#!$SHELL" > "$target"
+    declare -f "$name" >> "$target" 2>/dev/null
+    # Notice that we add shell variables to the function trigger.
+    echo "$name \$*" >> "$target"
+    chmod +x "$target"
+  fi
+@}
+
+use_guix()
+@{
+    # Set GitHub token.
+    export GUIX_GITHUB_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+
+    # Unset 'GUIX_PACKAGE_PATH'.
+    export GUIX_PACKAGE_PATH=""
+
+    # Recreate a garbage collector root.
+    gcroots="$HOME/.config/guix/gcroots"
+    mkdir -p "$gcroots"
+    gcroot="$gcroots/guix"
+    if [ -L "$gcroot" ]
+    then
+        rm -v "$gcroot"
+    fi
+
+    # Miscellaneous packages.
+    PACKAGES_MAINTENANCE=(
+        direnv
+        git
+        git:send-email
+        git-cal
+        gnupg
+        guile-colorized
+        guile-readline
+        less
+        ncurses
+        openssh
+        xdot
+    )
+
+    # Environment packages.
+    PACKAGES=(help2man guile-sqlite3 guile-gcrypt)
+
+    # Thanks <https://lists.gnu.org/archive/html/guix-devel/2016-09/msg00859.html>
+    eval "$(guix environment --search-paths --root="$gcroot" --pure guix --ad-hoc $@{PACKAGES[@@]@} $@{PACKAGES_MAINTENANCE[@@]@} "$@@")"
+
+    # Predefine configure flags.
+    configure()
+    @{
+        ./configure --localstatedir=/var --prefix=
+    @}
+    export_function configure
+
+    # Run make and optionally build something.
+    build()
+    @{
+        make -j 2
+        if [ $# -gt 0 ]
+        then
+            ./pre-inst-env guix build "$@@"
+        fi
+    @}
+    export_function build
+
+    # Predefine push Git command.
+    push()
+    @{
+        git push --set-upstream origin
+    @}
+    export_function push
+
+    clear                        # Clean up the screen.
+    git-cal --author='Your Name' # Show contributions calendar.
+
+    # Show commands help.
+    echo "
+build          build a package or just a project if no argument provided
+configure      run ./configure with predefined parameters
+push           push to upstream Git repository
+"
+@}
+@end example
+
+Every project containing @file{.envrc} with a string @code{use guix}
+will have predefined environment variables and procedures.
+
+Run @command{direnv allow} to setup the environment for the first time.
+
@c *********************************************************************
@node Acknowledgments
@chapter Acknowledgments
@@ -96,14 +96,16 @@ define xref_command
 cat "$@.tmp" | egrep '@p?x?ref' -A1 | sed 'N;s|--\n||g;P;D' | sed 's|^| |g' | \
        tr -d '\012' | sed 's|\(@p\?x\?ref\)|\n\1|g' | egrep '@p?x?ref' | \
        sed 's|^.*@p\?x\?ref{\([^,}]*\).*$$|\1|g' | sort | uniq | while read e; do \
-  line=$$(grep -n "^msgid \"$$e\"" "$<" | cut -f1 --delimiter=":") ;\
-  ((line++)) ;\
-  if [ "$$line" != "1" ]; then \
-    translation=$$(head -n $$line "$<" | tail -1 | grep msgstr | sed 's|msgstr "\(.*\)"|\1|') ;\
-    if [ "$$translation" != "" ]; then \
-	  sed "N;s@\(p\?x\?ref\){$$(echo $$e | sed 's| |[\\n ]|g')\(,\|}\)@\1{$$translation\2@g;P;D" -i "$@.tmp" ;\
-    fi ;\
-  fi ;\
+    if [ -n "$$e" ]; then \
+      line=$$(grep -n "^msgid \"$$e\"" "$<" | cut -f1 --delimiter=":") ;\
+      ((line++)) ;\
+      if [ "$$line" != "1" ]; then \
+	translation=$$(head -n "$$line" "$<" | tail -1 | grep msgstr | sed 's|msgstr "\(.*\)"|\1|') ;\
+	if [ "$$translation" != "" ]; then \
+	      sed "N;s@\(p\?x\?ref\){$$(echo $$e | sed 's| |[\\n ]|g')\(,\|}\)@\1{$$translation\2@g;P;D" -i "$@.tmp" ;\
+	fi ;\
+      fi ;\
+   fi ;\
 done
 endef

@@ -0,0 +1,250 @@
+#!@GUILE@ \
+--no-auto-compile -s
+!#
+
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Ricardo Wurmus <rekado@elephly.net>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; Commentary:
+
+;; This script stages and commits changes to package definitions.
+
+;;; Code:
+
+(import (sxml xpath)
+        (srfi srfi-1)
+        (srfi srfi-9)
+        (ice-9 format)
+        (ice-9 popen)
+        (ice-9 match)
+        (ice-9 rdelim)
+        (ice-9 textual-ports))
+
+(define (read-excursion port)
+  "Read an expression from PORT and reset the port position before returning
+the expression."
+  (let ((start (ftell port))
+        (result (read port)))
+    (seek port start SEEK_SET)
+    result))
+
+(define (surrounding-sexp port line-no)
+  "Return the top-level S-expression surrounding the change at line number
+LINE-NO in PORT."
+  (let loop ((i (1- line-no))
+             (last-top-level-sexp #f))
+    (if (zero? i)
+        last-top-level-sexp
+        (match (peek-char port)
+          (#\(
+           (let ((sexp (read-excursion port)))
+             (read-line port)
+             (loop (1- i) sexp)))
+          (_
+           (read-line port)
+           (loop (1- i) last-top-level-sexp))))))
+
+(define-record-type <hunk>
+  (make-hunk file-name
+             old-line-number
+             new-line-number
+             diff)
+  hunk?
+  (file-name       hunk-file-name)
+  ;; Line number before the change
+  (old-line-number hunk-old-line-number)
+  ;; Line number after the change
+  (new-line-number hunk-new-line-number)
+  ;; The full diff to be used with "git apply --cached"
+  (diff hunk-diff))
+
+(define* (hunk->patch hunk #:optional (port (current-output-port)))
+  (let ((file-name (hunk-file-name hunk)))
+    (format port
+            "diff --git a/~a b/~a~%--- a/~a~%+++ b/~a~%~a"
+            file-name file-name file-name file-name
+            (hunk-diff hunk))))
+
+(define (diff-info)
+  "Read the diff and return a list of <hunk> values."
+  (let ((port (open-pipe* OPEN_READ
+                          "git" "diff"
+                          "--no-prefix"
+                          ;; Do not include any context lines.  This makes it
+                          ;; easier to find the S-expression surrounding the
+                          ;; change.
+                          "--unified=0")))
+    (define (extract-line-number line-tag)
+      (abs (string->number
+            (car (string-split line-tag #\,)))))
+    (define (read-hunk)
+      (reverse
+       (let loop ((lines '()))
+         (let ((line (read-line port 'concat)))
+           (cond
+            ((eof-object? line) lines)
+            ((or (string-prefix? "@@ " line)
+                 (string-prefix? "diff --git" line))
+             (unget-string port line)
+             lines)
+            (else (loop (cons line lines))))))))
+    (define info
+      (let loop ((acc '())
+                 (file-name #f))
+        (let ((line (read-line port)))
+          (cond
+           ((eof-object? line) acc)
+           ((string-prefix? "--- " line)
+            (match (string-split line #\space)
+              ((_ file-name)
+               (loop acc file-name))))
+           ((string-prefix? "@@ " line)
+            (match (string-split line #\space)
+              ((_ old-start new-start . _)
+               (loop (cons (make-hunk file-name
+                                      (extract-line-number old-start)
+                                      (extract-line-number new-start)
+                                      (string-join (cons* line "\n"
+                                                          (read-hunk)) ""))
+                           acc)
+                     file-name))))
+           (else (loop acc file-name))))))
+    (close-pipe port)
+    info))
+
+(define (old-sexp hunk)
+  "Using the diff information in HUNK return the unmodified S-expression
+corresponding to the top-level definition containing the staged changes."
+  ;; TODO: We can't seek with a pipe port...
+  (let* ((port (open-pipe* OPEN_READ
+                           "git" "show" (string-append "HEAD:"
+                                                       (hunk-file-name hunk))))
+         (contents (get-string-all port)))
+    (close-pipe port)
+    (call-with-input-string contents
+      (lambda (port)
+        (surrounding-sexp port (hunk-old-line-number hunk))))))
+
+(define (new-sexp hunk)
+  "Using the diff information in HUNK return the modified S-expression
+corresponding to the top-level definition containing the staged changes."
+  (call-with-input-file (hunk-file-name hunk)
+    (lambda (port)
+      (surrounding-sexp port
+                        (hunk-new-line-number hunk)))))
+
+(define* (commit-message file-name old new #:optional (port (current-output-port)))
+  "Print ChangeLog commit message for changes between OLD and NEW."
+  (define (get-values expr field)
+    (match ((sxpath `(// ,field quasiquote *)) expr)
+      (() '())
+      ((first . rest)
+       (map cadadr first))))
+  (define (listify items)
+    (match items
+      ((one) one)
+      ((one two)
+       (string-append one " and " two))
+      ((one two . more)
+       (string-append (string-join (drop-right items 1) ", ")
+                      ", and " (first (take-right items 1))))))
+  (define variable-name
+    (second old))
+  (define version
+    (and=> ((sxpath '(// version *any*)) new)
+           first))
+  (format port
+          "gnu: ~a: Update to ~a.~%~%* ~a (~a): Update to ~a.~%"
+          variable-name version file-name variable-name version)
+  (for-each (lambda (field)
+              (let ((old-values (get-values old field))
+                    (new-values (get-values new field)))
+                (or (equal? old-values new-values)
+                    (let ((removed (lset-difference equal? old-values new-values))
+                          (added (lset-difference equal? new-values old-values)))
+                      (format port
+                              "[~a]: ~a~%" field
+                              (match (list (map symbol->string removed)
+                                           (map symbol->string added))
+                                ((() added)
+                                 (format #f "Add ~a."
+                                         (listify added)))
+                                ((removed ())
+                                 (format #f "Remove ~a."
+                                         (listify removed)))
+                                ((removed added)
+                                 (format #f "Remove ~a; add ~a."
+                                         (listify removed)
+                                         (listify added)))))))))
+            '(inputs propagated-inputs native-inputs)))
+
+(define (group-hunks-by-sexp hunks)
+  "Return a list of pairs associating all hunks with the S-expression they are
+modifying."
+  (fold (lambda (sexp hunk acc)
+          (match acc
+            (((previous-sexp . hunks) . rest)
+             (if (equal? sexp previous-sexp)
+                 (cons (cons previous-sexp
+                             (cons hunk hunks))
+                       rest)
+                 (cons (cons sexp (list hunk))
+                       acc)))
+            (_
+             (cons (cons sexp (list hunk))
+                   acc))))
+        '()
+        (map new-sexp hunks)
+        hunks))
+
+(define (new+old+hunks hunks)
+  (map (match-lambda
+         ((new . hunks)
+          (cons* new (old-sexp (first hunks)) hunks)))
+       (group-hunks-by-sexp hunks)))
+
+(define (main . args)
+  (match (diff-info)
+    (()
+     (display "Nothing to be done." (current-error-port)))
+    (hunks
+     (for-each (match-lambda
+                 ((new old . hunks)
+                  (for-each (lambda (hunk)
+                                (let ((port (open-pipe* OPEN_WRITE
+                                                        "git" "apply"
+                                                        "--cached"
+                                                        "--unidiff-zero")))
+                                  (hunk->patch hunk port)
+                                  (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                                    (error "Cannot apply")))
+                                (sleep 1))
+                              hunks)
+                    (commit-message (hunk-file-name (first hunks))
+                                    old new
+                                    (current-output-port))
+                    (let ((port (open-pipe* OPEN_WRITE "git" "commit" "-F" "-")))
+                      (commit-message (hunk-file-name (first hunks))
+                                      old new
+                                      port)
+                      (sleep 1)
+                      (unless (eqv? 0 (status:exit-val (close-pipe port)))
+                        (error "Cannot commit")))))
+               (new+old+hunks hunks)))))
+
+(main)
@@ -19,6 +19,20 @@
 # Bash completion for Guix commands.

 declare _guix_available_packages
+declare _guix_commands
+
+_guix_complete_command ()
+{
+    local word_at_point="${COMP_WORDS[$COMP_CWORD]}"
+    if [ -z "$_guix_commands" ]
+    then
+	# Cache the list of commands to speed things up.
+	_guix_commands="$(guix --help 2> /dev/null  \
+                                     | grep '^    ' \
+				     | sed '-es/^ *\([a-z-]\+\).*$/\1/g')"
+    fi
+    COMPREPLY=($(compgen -W "$_guix_commands" -- "$word_at_point"))
+}

 _guix_complete_subcommand ()
 {
@@ -146,19 +160,6 @@ _guix_complete_pid ()
    COMPREPLY=($(compgen -W "$pids" -- "$1"))
 }

-declare _guix_subcommands
-
-_guix_complete_subcommand ()
-{
-    if [ -z "$_guix_subcommands" ]
-    then
-	# Cache the list of subcommands to speed things up.
-	_guix_subcommands="$(guix --help 2> /dev/null \
-                                     | grep '^  ' | cut -c 2-)"
-    fi
-    COMPREPLY=($(compgen -W "$_guix_subcommands" -- "$word_at_point"))
-}
-
 _guix_complete ()
 {
    local word_count=${#COMP_WORDS[*]}
@@ -176,12 +177,12 @@ _guix_complete ()

    case $COMP_CWORD in
 	1)
-	    _guix_complete_subcommand
+	    _guix_complete_command
 	    ;;
 	*)
 	    if _guix_is_command "package"
 	    then
-		if _guix_is_dash_L || _guix_is_dash_m
+		if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_p
 		then
 		    _guix_complete_file
 		elif _guix_is_removing
@@ -222,6 +223,14 @@ _guix_complete ()
 		else
 		    _guix_complete_available_package "$word_at_point"
                fi
+	    elif _guix_is_command "environment"
+	    then
+                if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_p
+                then
+                    _guix_complete_file
+		else
+		    _guix_complete_available_package "$word_at_point"
+		fi
 	    elif _guix_is_command "download"
 	    then
 		 _guix_complete_file
@@ -243,7 +252,7 @@ _guix_complete ()
                then
                    _guix_complete_file
 		else
-		    _guix_complete_subcommand
+		    _guix_complete_command
                fi
 	    elif _guix_is_command "container"
 	    then
@@ -1,6 +1,8 @@
 ; -*- lisp -*-
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
+;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,6 +23,18 @@
 ;; Intermediate Language (CIL).  It refers to types that must be defined in
 ;; the system's base policy.

+;; If you, like me, need advice about fixing an SELinux policy, I recommend
+;; reading https://danwalsh.livejournal.com/55324.html
+
+;; In particular, you can run semanage permissive -a guix_daemon.guix_daemon_t
+;; to allow guix-daemon to do whatever it wants. SELinux will still check its
+;; permissions, and when it doesn't have permission it will still send an
+;; audit message to your system logs. This lets you know what permissions it
+;; ought to have. Use ausearch --raw to find the permissions violations, then
+;; pipe that to audit2allow to generate an updated policy. You'll still need
+;; to translate that policy into CIL in order to update this file, but that's
+;; fairly straight-forward. Annoying, but easy.
+
 (block guix_daemon
  ;; Require existing types
  (typeattributeset cil_gen_require init_t)
@@ -34,14 +48,19 @@
  (roletype object_r guix_daemon_t)
  (type guix_daemon_conf_t)
  (roletype object_r guix_daemon_conf_t)
+  (typeattributeset file_type guix_daemon_conf_t)
  (type guix_daemon_exec_t)
  (roletype object_r guix_daemon_exec_t)
+  (typeattributeset file_type guix_daemon_exec_t)
  (type guix_daemon_socket_t)
  (roletype object_r guix_daemon_socket_t)
+  (typeattributeset file_type guix_daemon_socket_t)
  (type guix_store_content_t)
  (roletype object_r guix_store_content_t)
+  (typeattributeset file_type guix_store_content_t)
  (type guix_profiles_t)
  (roletype object_r guix_profiles_t)
+  (typeattributeset file_type guix_profiles_t)

  ;; These types are domains, thereby allowing process rules
  (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
@@ -55,6 +74,30 @@
  (typetransition guix_store_content_t guix_daemon_exec_t
                  process guix_daemon_t)

+  (roletype system_r guix_daemon_t)
+
+  ;; allow init_t to read and execute guix files
+  (allow init_t
+         guix_profiles_t
+         (lnk_file (read)))
+  (allow init_t
+         guix_daemon_exec_t
+         (file (execute)))
+  (allow init_t
+         guix_daemon_t
+         (process (transition)))
+  (allow init_t
+         guix_store_content_t
+         (lnk_file (read)))
+  (allow init_t
+         guix_store_content_t
+         (file (open read execute)))
+
+  ;; guix-daemon needs to know the names of users
+  (allow guix_daemon_t
+         passwd_file_t
+         (file (getattr open read)))
+
  ;; Permit communication with NSCD
  (allow guix_daemon_t
         nscd_var_run_t
@@ -71,25 +114,44 @@
  (allow guix_daemon_t
         nscd_t
         (unix_stream_socket (connectto)))
+  (allow guix_daemon_t nscd_t
+         (nscd (getgrp gethost getpwd getserv shmemgrp shmemhost shmempwd shmemserv)))
+
+  ;; permit downloading packages via HTTP(s)
+  (allow guix_daemon_t http_port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t ftp_port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t ephemeral_port_t
+         (tcp_socket (name_connect)))

  ;; Permit logging and temp file access
  (allow guix_daemon_t
         tmp_t
-         (lnk_file (setattr unlink)))
+         (lnk_file (create rename setattr unlink)))
  (allow guix_daemon_t
         tmp_t
-         (dir (create
-               rmdir
+         (file (link rename create execute execute_no_trans write unlink setattr map relabelto)))
+  (allow guix_daemon_t
+         tmp_t
+         (fifo_file (open read write create getattr ioctl setattr unlink)))
+  (allow guix_daemon_t
+         tmp_t
+         (dir (create rename
+               rmdir relabelto
               add_name remove_name
               open read write
               getattr setattr
               search)))
+  (allow guix_daemon_t
+         tmp_t
+         (sock_file (create getattr setattr unlink write)))
  (allow guix_daemon_t
         var_log_t
         (file (create getattr open write)))
  (allow guix_daemon_t
         var_log_t
-         (dir (getattr write add_name)))
+         (dir (getattr create write add_name)))
  (allow guix_daemon_t
         var_run_t
         (lnk_file (read)))
@@ -100,10 +162,10 @@
  ;; Spawning processes, execute helpers
  (allow guix_daemon_t
         self
-         (process (fork)))
+         (process (fork execmem setrlimit setpgid setsched)))
  (allow guix_daemon_t
         guix_daemon_exec_t
-         (file (execute execute_no_trans read open)))
+         (file (execute execute_no_trans read open entrypoint map)))

  ;; TODO: unknown
  (allow guix_daemon_t
@@ -119,38 +181,51 @@
  ;; Build isolation
  (allow guix_daemon_t
         guix_store_content_t
-         (file (mounton)))
+         (file (ioctl mounton)))
  (allow guix_store_content_t
         fs_t
         (filesystem (associate)))
  (allow guix_daemon_t
         guix_store_content_t
-         (dir (mounton)))
+         (dir (read mounton)))
  (allow guix_daemon_t
         guix_daemon_t
         (capability (net_admin
                      fsetid fowner
                      chown setuid setgid
                      dac_override dac_read_search
-                      sys_chroot)))
+                      sys_chroot
+                      sys_admin)))
  (allow guix_daemon_t
         fs_t
         (filesystem (unmount)))
+  (allow guix_daemon_t
+         devpts_t
+         (dir (search)))
  (allow guix_daemon_t
         devpts_t
         (filesystem (mount)))
  (allow guix_daemon_t
         devpts_t
-         (chr_file (setattr getattr)))
+         (chr_file (ioctl open read write setattr getattr)))
  (allow guix_daemon_t
         tmpfs_t
-         (filesystem (mount)))
+         (filesystem (getattr mount)))
  (allow guix_daemon_t
         tmpfs_t
-         (dir (getattr)))
+         (file (create open read unlink write)))
+  (allow guix_daemon_t
+         tmpfs_t
+         (dir (getattr add_name remove_name write)))
  (allow guix_daemon_t
         proc_t
-         (filesystem (mount)))
+         (file (getattr open read)))
+  (allow guix_daemon_t
+         proc_t
+         (dir (read)))
+  (allow guix_daemon_t
+         proc_t
+         (filesystem (associate mount)))
  (allow guix_daemon_t
         null_device_t
         (chr_file (getattr open read write)))
@@ -179,7 +254,7 @@
               search rename
               add_name remove_name
               open write
-               rmdir)))
+               rmdir relabelfrom)))
  (allow guix_daemon_t
         guix_store_content_t
         (file (create
@@ -189,7 +264,7 @@
                link unlink
                map
                rename
-                open read write)))
+                open read write relabelfrom)))
  (allow guix_daemon_t
         guix_store_content_t
         (lnk_file (create
@@ -197,17 +272,23 @@
                    link unlink
                    read
                    rename)))
+  (allow guix_daemon_t
+         guix_store_content_t
+         (fifo_file (create getattr open read unlink write)))
+  (allow guix_daemon_t
+         guix_store_content_t
+         (sock_file (create getattr unlink write)))

  ;; Access to configuration files and directories
  (allow guix_daemon_t
         guix_daemon_conf_t
-         (dir (search
+         (dir (search create
               setattr getattr
               add_name remove_name
               open read write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
-         (file (create
+         (file (create rename
                lock
                map
                getattr setattr
@@ -216,11 +297,17 @@
  (allow guix_daemon_t
         guix_daemon_conf_t
         (lnk_file (create getattr rename unlink)))
+  (allow guix_daemon_t net_conf_t
+         (file (getattr open read)))
+  (allow guix_daemon_t net_conf_t
+         (lnk_file (read)))
+  (allow guix_daemon_t NetworkManager_var_run_t
+         (dir (search)))

  ;; Access to profiles
  (allow guix_daemon_t
         guix_profiles_t
-         (dir (getattr setattr read open)))
+         (dir (search getattr setattr read write open create add_name)))
  (allow guix_daemon_t
         guix_profiles_t
         (lnk_file (read getattr)))
@@ -233,8 +320,22 @@
  (allow guix_daemon_t
         user_home_t
         (dir (search)))
+  (allow guix_daemon_t
+         cache_home_t
+         (dir (search)))
+
+  ;; self upgrades
+  (allow guix_daemon_t
+         self
+         (dir (add_name write)))
+  (allow guix_daemon_t
+         self
+         (netlink_route_socket (bind create getattr nlmsg_read read write)))

  ;; Socket operations
+  (allow guix_daemon_t
+         guix_daemon_socket_t
+         (sock_file (unlink)))
  (allow guix_daemon_t
         init_t
         (fd (use)))
@@ -253,12 +354,53 @@
                              read write
                              connect bind accept
                              getopt setopt)))
+  (allow guix_daemon_t
+         self
+         (tcp_socket (accept listen bind connect create setopt getopt getattr ioctl read write shutdown)))
+  (allow guix_daemon_t
+         unreserved_port_t
+         (tcp_socket (name_bind name_connect accept listen)))
+  (allow guix_daemon_t
+         self
+         (udp_socket (connect getattr bind getopt setopt)))
  (allow guix_daemon_t
         self
         (fifo_file (write read)))
  (allow guix_daemon_t
         self
         (udp_socket (ioctl create)))
+  (allow guix_daemon_t
+         self
+         (unix_stream_socket (connectto)))
+
+  (allow guix_daemon_t
+         node_t
+         (tcp_socket (node_bind)))
+  (allow guix_daemon_t
+         node_t
+         (udp_socket (node_bind)))
+  (allow guix_daemon_t
+         port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t
+         rtp_media_port_t
+         (udp_socket (name_bind)))
+  (allow guix_daemon_t
+         vnc_port_t
+         (tcp_socket (name_bind)))
+
+  ;; I guess sometimes it needs random numbers
+  (allow guix_daemon_t
+         random_device_t
+         (chr_file (read)))
+
+  ;; guix system vm
+  (allow guix_daemon_t
+         kvm_device_t
+         (chr_file (ioctl open read write)))
+  (allow guix_daemon_t
+         kernel_t
+         (system (ipc_info)))

  ;; Label file system
  (filecon "@guix_sysconfdir@/guix(/.*)?"
@@ -277,5 +419,7 @@
           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@storedir@/.+-(guix-.+|profile)/bin/guix-daemon"
           file (system_u object_r guix_daemon_exec_t (low low)))
+  (filecon "@storedir@/[a-z0-9]+-guix-daemon"
+           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@guix_localstatedir@/guix/daemon-socket/socket"
           any (system_u object_r guix_daemon_socket_t (low low))))
@@ -4,6 +4,9 @@
 # Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 # Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 # Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+# Copyright © 2020 Morgan Smith <Morgan.J.Smith@outlook.com>
+# Copyright © 2020 Simon Tournier <zimon.toutoune@gmail.com>
+# Copyright © 2020 Daniel Brooks <db48x@db48x.net>
 #
 # This file is part of GNU Guix.
 #
@@ -53,10 +56,12 @@ REQUIRE=(

 PAS=$'[ \033[32;1mPASS\033[0m ] '
 ERR=$'[ \033[31;1mFAIL\033[0m ] '
+WAR=$'[ \033[33;1mWARN\033[0m ] '
 INF="[ INFO ] "

 DEBUG=0
 GNU_URL="https://ftp.gnu.org/gnu/guix/"
+#GNU_URL="https://alpha.gnu.org/gnu/guix/"
 OPENPGP_SIGNING_KEY_ID="3CE464558A84FDC69DB40CFB090B11993D9AEBB5"

 # This script needs to know where root's home directory is.  However, we
@@ -111,7 +116,7 @@ chk_gpg_keyring()
    # systems where gpg has never been used, causing errors and confusion.
    gpg --dry-run --list-keys ${OPENPGP_SIGNING_KEY_ID} >/dev/null 2>&1 || (
        _err "${ERR}Missing OpenPGP public key.  Fetch it with this command:"
-        echo "  wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -"
+        echo "  wget 'https://sv.gnu.org/people/viewgpg.php?user_id=15145' -qO - | sudo -i gpg --import -"
        exit 1
    )
 }
@@ -150,6 +155,10 @@ chk_init_sys()
        _msg "${INF}init system is: sysv-init"
        INIT_SYS="sysv-init"
        return 0
+    elif [[ $(openrc --version 2>/dev/null) =~ \(OpenRC\) ]]; then
+        _msg "${INF}init system is: OpenRC"
+        INIT_SYS="openrc"
+        return 0
    else
        INIT_SYS="NA"
        _err "${ERR}Init system could not be detected."
@@ -194,6 +203,19 @@ chk_sys_arch()
    ARCH_OS="${arch}-${os}"
 }

+chk_sys_nscd()
+{ # Check if nscd is up and suggest to start it or install it
+    if [ "$(type -P pidof)" ]; then
+        if [ ! "$(pidof nscd)" ]; then
+            _msg "${WAR}We recommend installing and/or starting your distribution 'nscd' service"
+            _msg "${WAR}Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
+        fi
+    else
+        _msg "${INF}We cannot determine if your distribution 'nscd' service is running"
+        _msg "${INF}Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
+    fi
+}
+
 # ------------------------------------------------------------------------------
 #+MAIN

@@ -208,11 +230,11 @@ guix_get_bin_list()

    # Filter only version and architecture
    bin_ver_ls=("$(wget -qO- "$gnu_url" \
-        | sed -n -e 's/.*guix-binary-\([0-9.]*\)\..*.tar.xz.*/\1/p' \
+        | sed -n -e 's/.*guix-binary-\([0-9.]*[a-z0-9]*\)\..*.tar.xz.*/\1/p' \
        | sort -Vu)")

    latest_ver="$(echo "$bin_ver_ls" \
-                       | grep -oP "([0-9]{1,2}\.){2}[0-9]{1,2}" \
+                       | grep -oE "([0-9]{1,2}\.){2}[0-9]{1,2}[a-z0-9]*" \
                       | tail -n1)"

    default_ver="guix-binary-${latest_ver}.${ARCH_OS}"
@@ -268,8 +290,7 @@ sys_create_store()
    _debug "--- [ $FUNCNAME ] ---"

    cd "$tmp_path"
-    tar --warning=no-timestamp \
-        --extract \
+    tar --extract \
        --file "$pkg" &&
    _msg "${PAS}unpacked archive"

@@ -350,6 +371,8 @@ sys_enable_guix_daemon()
                  cp "${ROOT_HOME}/.config/guix/current/lib/systemd/system/gnu-store.mount" \
                     /etc/systemd/system/;
                  chmod 664 /etc/systemd/system/gnu-store.mount;
+                  systemctl daemon-reload &&
+                      systemctl enable gnu-store.mount;
              fi

              cp "${ROOT_HOME}/.config/guix/current/lib/systemd/system/guix-daemon.service" \
@@ -367,8 +390,8 @@ sys_enable_guix_daemon()
 	      fi;

              systemctl daemon-reload &&
-                  systemctl start  gnu-store.mount guix-daemon &&
-                  systemctl enable gnu-store.mount guix-daemon; } &&
+                  systemctl enable guix-daemon &&
+                  systemctl start  guix-daemon; } &&
                _msg "${PAS}enabled Guix daemon via systemd"
            ;;
        sysv-init)
@@ -382,6 +405,16 @@ sys_enable_guix_daemon()
                  service guix-daemon start; } &&
                _msg "${PAS}enabled Guix daemon via sysv"
            ;;
+        openrc)
+            { mkdir -p /etc/init.d;
+              cp "${ROOT_HOME}/.config/guix/current/etc/openrc/guix-daemon" \
+                 /etc/init.d/guix-daemon;
+              chmod 775 /etc/init.d/guix-daemon;
+
+              rc-update add guix-daemon default &&
+                  rc-service guix-daemon start; } &&
+                _msg "${PAS}enabled Guix daemon via OpenRC"
+            ;;
        NA|*)
            _msg "${ERR}unsupported init system; run the daemon manually:"
            echo "  ${ROOT_HOME}/.config/guix/current/bin/guix-daemon --build-users-group=guixbuild"
@@ -416,6 +449,7 @@ sys_authorize_build_farms()

 sys_create_init_profile()
 { # Create /etc/profile.d/guix.sh for better desktop integration
+  # This will not take effect until the next shell or desktop session!
    [ -d "/etc/profile.d" ] || mkdir /etc/profile.d # Just in case
    cat <<"EOF" > /etc/profile.d/guix.sh
 # _GUIX_PROFILE: `guix pull` profile
@@ -442,6 +476,26 @@ export XDG_DATA_DIRS="$GUIX_PROFILE/share:${XDG_DATA_DIRS:-/usr/local/share/:/us
 EOF
 }

+sys_create_shell_completion()
+{ # Symlink supported shell completions system-wide
+
+    var_guix=/var/guix/profiles/per-user/root/current-guix
+    bash_completion=/etc/bash_completion.d
+    zsh_completion=/usr/share/zsh/site-functions
+    fish_completion=/usr/share/fish/vendor_completions.d
+
+    { # Just in case
+        for dir_shell in $bash_completion $zsh_completion $fish_completion; do
+            [ -d "$dir_shell" ] || mkdir -p $dir_shell
+        done;
+
+        ln -sf ${var_guix}/etc/bash_completion.d/* "$bash_completion";
+        ln -sf ${var_guix}/share/zsh/site-functions/* "$zsh_completion";
+        ln -sf ${var_guix}/share/fish/vendor_completions.d/* "$fish_completion"; } &&
+        _msg "${PAS}installed shell completion"
+}
+
+
 welcome()
 {
    cat<<"EOF"
@@ -485,6 +539,7 @@ main()
    chk_gpg_keyring
    chk_init_sys
    chk_sys_arch
+    chk_sys_nscd

    _msg "${INF}system is ${ARCH_OS}"

@@ -499,12 +554,16 @@ main()
    sys_enable_guix_daemon
    sys_authorize_build_farms
    sys_create_init_profile
+    sys_create_shell_completion

    _msg "${INF}cleaning up ${tmp_path}"
    rm -r "${tmp_path}"

    _msg "${PAS}Guix has successfully been installed!"
    _msg "${INF}Run 'info guix' to read the manual."
+
+    # Required to source /etc/profile in desktop environments.
+    _msg "${INF}Please log out and back in to complete the installation."
 }

 main "$@"
@@ -0,0 +1,179 @@
+;; List of "historical" committers---people once authorized committers before
+;; the '.guix-authorizations' file was created.
+;;
+;; This file is provided for historical and auditing purposes.  It is known
+;; good starting at least at 'v1.0.0'.
+;;
+;; The format is the same as for '.guix-authorizations'.  User names are those
+;; found on <https://savannah.gnu.org/project/memberlist.php?group=guix> along
+;; with the fingerprint of the signing (sub)key.
+
+(authorizations
+ (version 0)
+
+ (("AD17 A21E F8AE D8F1 CC02  DBD9 F7D5 C9BF 765C 61E3"
+   (name "andreas"))
+  ("2A39 3FFF 68F4 EF7A 3D29  12AF 6F51 20A0 22FB B2D5"
+   (name "ajgrf"))
+  ("306F CB8F 2C01 C25D 29D3  0556 61EF 502E F602 52F2"
+   (name "alexvong1995"))
+  ("4FB9 9F49 2B12 A365 7997  E664 8246 0C08 2A0E E98F"
+   (name "alezost"))
+  ("50F3 3E2E 5B0C 3D90 0424  ABE8 9BDC F497 A4BB CC7F"
+   (name "ambrevar"))
+  ("27D5 86A4 F890 0854 329F  F09F 1260 E464 82E6 3562"
+   (name "apteryx"))
+  ("7F73 0343 F2F0 9F3C 77BF  79D3 2E25 EE8B 6180 2BB3"
+   (name "arunisaac"))
+  (;; primary: "3B12 9196 AE30 0C3C 0E90  A26F A715 5567 3271 9948"
+   "9A2B 401E D001 0650 1584  BAAC 8BC4 F447 6E8A 8E00"
+   (name "atheia"))
+  (;; primary: "BE62 7373 8E61 6D6D 1B3A  08E8 A21A 0202 4881 6103"
+   "39B3 3C8D 9448 0D2D DCC2  A498 8B44 A0CD C7B9 56F2"
+   (name "bandali"))
+  (;; primary: "34FF 38BC D151 25A6 E340  A0B5 3453 2F9F AFCA 8B8E"
+   "A0C5 E352 2EF8 EF5C 64CD  B7F0 FD73 CAC7 19D3 2566"
+   (name "bavier"))
+  ("3774 8024 880F D3FF DCA2  C9AB 5893 6E0E 2F1B 5A4C"
+   (name "beffa"))
+  ("BCF8 F737 2CED 080A 67EB  592D 2A6A D9F4 AAC2 0DF6"
+   (name "benwoodcroft"))
+  ("45CC 63B8 5258 C9D5 5F34  B239 D37D 0EA7 CECC 3912"
+   (name "biscuolo"))
+  ("7988 3B9F 7D6A 4DBF 3719  0367 2506 A96C CF63 0B21"
+   (name "boskovits"))
+  ("DFC0 C7F7 9EE6 0CA7 AE55  5E19 6722 43C4 A03F 0EEE"
+   (name "brettgilio"))
+  (;; primary: "0401 7A2A 6D9A 0CCD C81D  8EC2 96AB 007F 1A7E D999"
+   "09CD D25B 5244 A376 78F6  EEA8 0CC5 2153 1979 91A5"
+   (name "carl"))
+  ("3E89 EEE7 458E 720D 9754  E0B2 5E28 A33B 0B84 F577"
+   (name "cbaines"))
+  ("3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"
+   (name "civodul"))
+  ("510A 8628 E2A7 7678 8F8C  709C 4BC0 2592 5FF8 F4D3"
+   (name "cwebber"))
+  (;; primary: "295A F991 6F46 F8A1 34B0  29DA 8086 3842 F0FE D83B"
+   "76CE C6B1 7274 B465 C02D  B3D9 E71A 3554 2C30 BAA5"
+   (name "dannym"))
+  ("B3C0 DB4D AD73 BA5D 285E  19AE 5143 0234 CEFD 87C3"
+   (name "davexunit"))
+  (                              ;FIXME: to be confirmed!
+   "8CCB A7F5 52B9 CBEA E1FB  2915 8328 C747 0FF1 D807"
+   (name "davexunit (2nd)"))
+  ("53C4 1E6E 41AA FE55 335A  CA5E 446A 2ED4 D940 BF14"
+   (name "daviwil"))
+  ("6909 6DFD D702 8BED ACC5  884B C5E0 51C7 9C0B ECDB"
+   (name "dvc"))
+  ("5F43 B681 0437 2F4B A898  A64B 33B9 E9FD E28D 2C23"
+   (name "dvc (old)"))
+  ("A28B F40C 3E55 1372 662D  14F7 41AA E7DC CA3D 8351"
+   (name "efraim"))
+  ("9157 41FE B22F A4E3 3B6E  8F8D F4C1 D391 7EAC EE93"
+   (name "efraim (old)"))
+  (;; primary: "2453 02B1 BAB1 F867 FDCA  96BC 8F3F 861F 82EB 7A9A"
+   "CBC5 9C66 EC27 B971 7940  6B3E 6BE8 208A DF21 FE3F"
+   (name "glv"))
+  ("2219 43F4 9E9F 276F 9499  3382 BF28 6CB6 593E 5FFD"
+   (name "hoebjo"))
+  ("B943 509D 633E 80DD 27FC  4EED 634A 8DFF D3F6 31DF"
+   (name "htgoebel"))
+  ("7440 26BA 7CA3 C668 E940  1D53 0B43 1E98 3705 6942"
+   (name "ipetkov"))
+  (;; primary: "66A5 6D9C 9A98 BE7F 719A  B401 2652 5665 AE72 7D37"
+   "0325 78A6 8298 94E7 2AA2  66F5 D415 BF25 3B51 5976"
+   (name "iyzsong"))
+
+  ;; https://lists.gnu.org/archive/html/guix-devel/2018-04/msg00229.html
+  ("DB34 CB51 D25C 9408 156F  CDD6 A12F 8797 8D70 1B99"
+   (name "janneke (old)"))
+  ("1A85 8392 E331 EAFD B8C2  7FFB F3C1 A0D9 C1D6 5273"
+   (name "janneke"))
+
+  (;; primary: "1BA4 08C5 8BF2 0EA7 3179  635A 865D C0A3 DED9 B5D0"
+   "E31D 9DDE EBA5 4A14 8A20  4550 DA45 97F9 47B4 1025"
+   (name "jlicht"))
+  ("8797 A26D 0854 2EAB 0285  A290 8A67 719C 2DE8 27B3"
+   (name "jmd"))
+  ("83B6 703A DCCA 3B69 4BCE  2DA6 E6A5 EE3C 1946 7A0D"
+   (name "kkebreau"))
+  ("45E5 75FA 53EA 8BD6 1BCE  0B4E 3ADC 75F0 13D6 78F9"
+   (name "leungbk"))
+  (;; primary: "4F71 6F9A 8FA2 C80E F1B5  E1BA 5E35 F231 DE1A C5E0"
+   "B051 5948 F1E7 D3C1 B980  38A0 2646 FA30 BACA 7F08"
+   (name "lfam"))
+  ("2AE3 1395 932B E642 FC0E  D99C 9BED 6EDA 32E5 B0BC"
+   (name "lsl88"))
+  ("CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D"
+   (name "marusich"))
+  ("BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"
+   (name "mbakke"))
+  ("D919 0965 CE03 199E AF28  B3BE 7CEF 2984 7562 C516"
+   (name "mhw"))
+  ("4008 6A7E 0252 9B60 31FB  8607 8354 7635 3176 9CA6"
+   (name "mothacehe"))
+  ("F2A3 8D7E EB2B 6640 5761  070D 0ADE E100 9460 4D37"
+   (name "mthl"))
+  (;; primary: "F5BC 5534 C36F 0087 B39D  36EF 1C9D C4FE B9DB 7C4B"
+   "F5DA 2032 4B87 3D0B 7A38  7672 0DB0 FF88 4F55 6D79"
+   (name "nckx"))
+  (;; primary: "F5BC 5534 C36F 0087 B39D  36EF 1C9D C4FE B9DB 7C4B"
+   "7E8F AED0 0944 78EF 72E6  4D16 D889 B0F0 18C5 493C"
+   (name "nckx (revoked; not compromised)"))
+  ("E576 BFB2 CF6E B13D F571  33B9 E315 A758 4613 1564"
+   (name "niedzejkob"))
+  ("ED0E F1C8 E126 BA83 1B48  5FE9 DA00 B4F0 48E9 2F2D"
+   (name "ngz"))
+  ("CEF4 CB91 4856 BA38 0A20  A7E2 3008 88CB 39C6 3817"
+   (name "pelzflorian"))
+  (;; primary: "B68B DF22 73F9 DA0E 63C1  8A32 515B F416 9242 D600"
+   "C699 ED09 E51B CE89 FD1D  A078 AAC7 E891 896B 568A"
+   (name "pgarlick"))
+  ("3A86 380E 58A8 B942 8D39  60E1 327C 1EF3 8DF5 4C32"
+   (name "phant0mas"))
+  ("74D6 A930 F44B 9B84 9EA5  5606 C166 AA49 5F7F 189C"
+   (name "reepca"))
+  ("BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC"
+   (name "rekado"))
+  ("0154 E1B9 1CC9 D9EF 7764  8DE7 F3A7 27DB 44FC CA36"
+   (name "rhelling"))
+  ("17CB 2812 EB63 3DFF 2C7F  0452 C3EC 1DCA 8430 72E1"
+   (name "roelj (old)"))
+  (;; From commit cc51c03ff867d4633505354819c6d88af88bf919 (March 2020).
+   ;; See <https://lists.gnu.org/archive/html/guix-devel/2020-03/msg00070.html>.
+   "F556 FD94 FB8F 8B87 79E3  6832 CBD0 CD51 38C1 9AFC"
+   (name "roelj"))
+  ("B5FA E628 5B41 3728 B2A0  FAED 4311 1F45 2008 6A0C"
+   (name "roptat (old)"))
+  (;; From commit 2cbede5935eb6a40173bbdf30a9ad22bf7574c22 (Jan. 2020).  See
+   ;; <https://lists.gnu.org/archive/html/guix-devel/2020-01/msg00499.html>.
+   "1EFB 0909 1F17 D28C CBF9  B13A 53D4 57B2 D636 EE82"
+   (name "roptat"))
+  (;; primary: "D6B0 C593 DA8C 5EDC A44C  7A58 C336 91F7 1188 B004"
+   "A02C 2D82 0EF4 B25B A6B5  1D90 2AC6 A5EC 1C35 7C59"
+   (name "samplet"))
+  ("77DD AD2D 97F5 31BB C0F3  C7FD DFB5 EB09 AA62 5423"
+   (name "sleep_walker"))
+  ("F494 72F4 7A59 00D5 C235  F212 89F9 6D48 08F3 59C7"
+   (name "snape"))
+  ("4E26 CCE9 578E 0828 9855  BDD4 1C79 95D2 D5A3 8336"
+   (name "steap"))
+  ("9ADE 9ECF 2B19 C180 9C99  5CEA A1F4 CFCC 5283 6BAC"
+   (name "taylanub"))
+
+  ;; https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00826.html
+  (;; primary: "1DD1 681F E285 E07F 11DC  0C59 2E15 A6BC D77D 54FD"
+   "3D2C DA58 819C 08C2 A649  D43D 5C3B 064C 724A 5726"
+   (name "thomasd"))
+  ("A5C5 92EA 606E 7106 A6A3  BC08 98B2 1575 91E1 2B08"
+   (name "thomasd (old)"))
+
+  ("D712 1D73 A40A 7264 9E43  ED7D F284 6B1A 0D32 C442"
+   (name "toothbrush"))
+  ("6580 7361 3BFC C5C7 E2E4  5D45 DC51 8FC8 7F97 16AA"
+   (name "vagrantc"))
+  (;; primary: "C955 CC5D C048 7FB1 7966  40A9 199A F6A3 67E9 4ABB"
+   "7238 7123 8EAC EB63 4548  5857 167F 8EA5 001A FA9C"
+   (name "wigust"))
+  ("FF47 8FB2 64DE 32EC 2967  25A3 DDC0 F535 8812 F8F2"
+   (name "wingo"))))
@@ -4,6 +4,7 @@
 ;; Copyright © 2017 Alex Kost <alezost@gmail.com>
 ;; Copyright © 2017 Ludovic Courtès <ludo@gnu.org>
 ;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>

 ;; This file is part of GNU Guix.

@@ -93,7 +94,7 @@
     ;; Indent the definition of PACKAGE-NAME in FILE-NAME.
     (find-file file-name)
     (goto-char (point-min))
-     (if (re-search-forward (concat "^(define\\(-public\\) +"
+     (if (re-search-forward (concat "^(define\\(\\|-public\\) +"
                                    package-name)
                            nil t)
         (let ((indent-tabs-mode nil))
@@ -2,6 +2,11 @@
 ;;
 ;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;; Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+;; Copyright © 2019, 2020 Miguel Ángel Arruga Vivas <rosen644835@gmail.com>
+;; Copyright © 2019, 2020 Konrad Hinsen <konrad.hinsen@fastmail.net>
+;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
+;; Copyright © 2019, 2020 Florian Pelz <pelzflorian@pelzflorian.de>
+;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
@@ -13,8 +18,618 @@
 (channel-news
 (version 0)

+ (entry (commit "3b6e4e5fd05e72b8a32ff1a2d5e21464260e21e6")
+        (title (en "List of substitute keys is now declarative on Guix System")
+               (de "Liste der Substitutschlüssel auf Guix System ist jetzt deklarativ")
+               (es "Claves para sustituciones del sistema Guix en formato declarativo")
+               (fr "Liste des clefs de substituts désormais déclarative sur Guix System"))
+        (body
+         (en "The list of authorized substitute keys, available in
+@file{/etc/guix/acl}, is now built by default in a purely declarative fashion
+on Guix System based on the @code{authorized-keys} field of the configuration
+of @code{guix-service-type}.  This means that manual changes to
+@file{/etc/guix/acl} are now @emph{discarded} upon reconfiguration or
+reboot (a backup is made as @file{/etc/guix/acl.bak} in that case).
+
+We recommend updating your operating system configuration to explicitly list
+all the authorized substitute keys.  See @command{info \"(guix) Base
+Services\"}, for more info about @code{guix-configuration} and
+@code{authorized-keys}.
+
+Alternatively, you can set the @code{authorize-key?} field of
+@code{guix-configuration} to @code{#f} to restore previous behavior.")
+         (de "Die Liste von autorisierten Substitutschlüsseln, die in
+@file{/etc/guix/acl} steht, wird auf Guix System nach Vorgabe jetzt auf rein
+deklarative Weise erstellt, je nach Inhalt des @code{authorized-keys}-Feldes
+der Konfiguration des @code{guix-service-type}. Das hat zur Folge, dass
+manuelle Änderungen an @file{/etc/guix/acl} von jetzt an nach jedem
+Rekonfigurieren oder Neustarten @emph{verworfen} werden (in diesem Fall wird
+eine Sicherheitskopie namens @file{/etc/guix/acl.bak} angelegt).
+
+Wir empfehlen, dass Sie Ihre Betriebssystemkonfiguration aktualisieren, damit
+dort alle autorisierten Substitutschlüssel ausdrücklich aufgeführt
+werden. Siehe @command{info \"(guix.de) Basisdienste\"} für mehr Informationen
+zur @code{guix-configuration} und @code{authorized-keys}.
+
+Alternativ können Sie das @code{authorize-key?}-Feld der
+@code{guix-configuration} auf @code{#f} setzen, um zum alten Verhalten
+zurückzugehen.")
+         (es "El listado de claves autorizadas para la obtención de
+sustituciones, disponible en @file{/etc/guix/acl}, ahora se genera de manera
+predeterminada en el sistema Guix de forma completamente declarativa en base
+al campo @code{authorized-keys} del la configuración para el servicio
+@code{guix-service-type}. Esto significa que los cambios que se hayan
+realizado de manera manual en @file{/etc/guix/acl} @emph{se descartan} tras
+una reconfiguración del sistema o tras un reinicio (se realiza una copia de
+seguridad en la ruta @file{/etc/guix/acl.bak} en este caso).
+
+Le recomendamos que actualice su configuración del sistema operativo para que
+enumere explícitamente todas las claves que desea autorizar para la obtención
+de sustituciones.  Véase @command{info \"(guix.es) Servicios base\"}, para
+obtener más información sobre @code{guix-configuration} y
+@code{authorized-keys}.
+
+También puede proporcionar el valor @code{#f} en el campo
+@code{authorize-key?} de @code{guix-configuration} para volver al
+comportamiento que se obtenía con versiones previas.")
+         (fr "La liste des clefs de substituts autorisées, stockée dans
+@file{/guix/guix/acl}, est dorénavant construite par défaut de manière
+déclarative sur Guix System, en se basant sur le champs @code{authorized-keys}
+de la configuration de @code{guix-service-type}.  Cela signifie que les
+modifications apportées manuellement à @file{/etc/guix/acl} seront désormais
+@emph{perdues} lors d'une reconfiguration ou d'un redémarrage (dans ce cas une
+sauvegarde est faite dans @file{/etc/guix/acl.bak}).
+
+Nous recommandons de mettre à jour sa configuration de système d'exploitation
+pour y lister explicitement les clefs autorisées.  Lancez @command{info
+\"(guix.fr) Services de base\"} pour plus d'informations sur
+@code{guix-configuration} et @code{authorized-keys}.
+
+Il est également possible de mettre le champs @code{authorize-key?} de
+@code{guix-configuration} à @code{#f} pour restaurer le comportement qui
+prévalait jusqu'à maintenant.")))
+
+ (entry (commit "6aeda81602555fbeac0c0a209e74f5262093b513")
+        (title (en "New @option{--with-debug-info} package transformation option")
+               (de "Neue Paketumwandlungsoption @option{--with-debug-info}")
+               (es "Nueva opción de transformación @option{--with-debug-info}")
+               (fr "Nouvelle option de transformation @option{--with-debug-info}"))
+        (body
+         (en "The new @option{--with-debug-info} option builds a variant of a
+package that includes debug info and grafts it onto the application you want
+to debug.  Thus, only the package for which you want debug info needs to be
+recompiled.  This is useful for packages that do not already have a
+@code{debug} output.
+
+For example, here is how you would obtain debug info for the @code{glib}
+library so you can inspect it while debugging Inkscape:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (de "Die neue Paketumwandlungsoption @option{--with-debug-info} lässt
+eine Variante eines Pakets erstellen, die auch Informationen zur Fehlersuche
+enthält. Damit wird die Anwendung veredelt, wo Sie Fehler nachvollziehen
+möchten. Somit muss nur das Paket, für das Sie die Informationen brauchen, neu
+kompiliert werden. Das ist hilfreich bei Paketen, die noch nicht über eine
+@code{debug}-Ausgabe verfügen.
+
+Zum Beispiel würden Sie so Informationen zur Fehlersuche für die
+@code{glib}-Bibliothek bekommen, um sie inspizieren zu können, wenn Sie Fehler
+in Inkscape nachvollziehen möchten:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (es "La nueva opción @option{--with-debug-info} construye una
+variante del paquete que incluye la información de depuración y la injerta
+en la aplicación que desee depurar.  Por tanto, únicamente el paquete del
+que desee información de depuración debe construirse de nuevo.  Es útil
+para paquetes que no tienen ya una salida @code{debug}.
+
+El siguiente ejemplo muestra como obtener información de depuración
+para la biblioteca @code{glib} de modo que pueda inspeccionarla mientras
+depura Inkscape:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--with-debug-info} compile une variante d'un paquet avec les
+informations de déboguage et la greffe sur l'application que l'on veut
+déboguer.  Ainsi seul le paquet pour lequel on demande des informations de
+déboguage a besoin d'être recompilé.  C'est utile pour les paquets n'ayant pas
+déjà un résultat @code{debug}.
+
+Voici par exemple comment obtenir des informations de déboguage pour la
+bibliothèque @code{glib} de manière à pouvoir l'inspecter quand on débuggue
+Inkscape :
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "abd7a474615353149a44f4504f0b4b248dcc0716")
+        (title (en "New @option{--with-c-toolchain} package transformation option")
+               (de "Neue Paketumwandlungsoption @option{--with-c-toolchain}")
+               (es "Nueva opción de transformación @option{--with-c-toolchain}")
+               (fr "Nouvelle option de transformation @option{--with-c-toolchain}"))
+        (body
+         (en "The new @option{--with-c-toolchain} package transformation
+options provides an easy way for developers to rebuild their favorite packages
+with the C/C++ tool chain of their choice instead of the default one.
+
+For example, the following command rebuilds the @code{fftw} and @code{fftwf}
+packages as well as every package that depends on them, up to and including
+@code{octave-cli}, using GCC version 10 (currently GCC 7.5 is used by
+default):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (de "Die neue Paketumwandlungsoption @option{--with-c-toolchain}
+bietet Entwicklern die Möglichkeit, leicht ihre Lieblingspakete mit der
+selbstgewählten Toolchain für C/C++ anstelle der vorgegebenen neu zu
+erstellen.
+
+Zum Beispiel werden mit folgendem Befehl die Pakete @code{fftw} und
+@code{fftwf} sowie alle davon abhängigen Pakete bis einschließlich
+@code{octave-cli} mit Version 10 der GCC erstellt (vorgegeben wäre zurzeit,
+GCC 7.5 zu benutzen):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (es "La nueva opción de transformación de paquetes
+@option{--with-c-toolchain} proporciona a las desarrolladoras una manera
+fácil de reconstruir sus paquetes favoritos con la cadena de herramientas
+de compilación de C/C++ que elijan en vez de la predeterminada.
+
+Por ejemplo, la siguiente orden reconstruye los paquetes @code{fftw} y
+@code{fftwf} así como todos los paquetes que dependen de ellos hasta
+@code{octave-cli}, usando la versión 10 de GCC (el compilador
+predeterminado en estos momentos es GCC 7.5):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--with-c-toolchain} permet aux développeur·euses de recompiler leurs
+paquets préférés avec la chaîne d'outils C/C++ de leur choix à la place de
+celle par défaut.
+
+Par exemple, la commande ci-dessous recompile @code{fftw}, @code{fftwf} et
+tous les paquets qui en dépendent, jusqu'à @code{octave-cli} inclus, avec GCC
+10 (actuellement c'est GCC 7.5 qui est utilisé par défaut):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "8e1907a72430aa989125b053573ef0897c480697")
+        (title (en "Package transformation options now recorded in profiles")
+               (es "Las opciones de transformación de paquetes ahora se
+quedan registradas en el perfil")
+               (de "Paketumwandlungsoptionen werden nun in Profilen gesichert")
+               (fr "Options de transformation sauvegardées dans les profils"))
+        (body
+         (en "When installing packages in a profile, package transformation
+options such as @option{--with-input} are now recorded in the profile.  When
+you eventually run @command{guix upgrade}, those transformations will be
+automatically applied to the upgraded packages.
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (es "Si durante la instalación de paquetes en un perfil se utilizaron
+opciones de transformación de paquetes, como por ejemplo
+@option{--with-input}, éstas se registran en el perfil. Cuando vuelva a
+ejecutar @command{guix upgrade}, dichas transformaciones se aplicarán
+automáticamente a los paquetes actualizados.
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Wenn Sie ein Paket in ein Profil installieren, werden nun
+Paketumwandlungsoptionen wie @option{--with-input} im Profil gespeichert.
+Sobald Sie später @command{guix upgrade} ausführen, werden dieselben
+Umwandlungen automatisch auf die aktualisierten Pakete angewandt.
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (fr "Lorsqu'on installe des paquets dans un profil, les options de
+transformation telles que @option{--with-input} sont désormais enregistrées
+dans le profil.  Quand on le met plus tard à jour avec @command{guix upgrade},
+ces transformations sont automatiquement appliquées aux nouveaux paquets.
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "313f492657f1d0863c641fa5ee7f5b7028e27c94")
+        (title (en "New @option{--image-type} option for @command{guix system disk-image}.")
+               (es "Nueva opción @option{--image-type} para @command{guix system disk-image}.")
+               (de "Neue Option @option{--image-type} für @command{guix system disk-image}.")
+               (fr "Nouvelle option @option{--image-type} pour @command{guix system disk-image}."))
+        (body
+         (en "The @option{--file-system-type} option for @command{guix system
+disk-image} command has been replaced by the new @option{--image-type} option.
+By default, @code{raw} disk images are produced, but @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} and @code{iso9660} image types
+are also available.
+
+The @option{--list-image-types} option lists all the available image types.")
+         (es "La opción @option{--file-system-type} de @command{guix system
+disk-image} se ha sustituido por la nueva opción @option{--image-type}.  De
+manera predeterminada se producen imágenes en formato crudo (@code{raw}) pero
+también están disponibles los tipos de imagen @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} y @code{iso9660}.
+
+La opción @option{--list-image-types} muestra una lista con todos los tipos
+de imagen disponibles.")
+         (de "Anstelle der Befehlszeilenoption @option{--file-system-type} für
+@command{guix system disk-image} gibt es nun die neue Option
+@option{--image-type}.  In der Vorgabeeinstellung @code{raw} werden rohe
+Disk-Images erzeugt, aber es können auch die Abbildtypen @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} und @code{iso9660} ausgewählt
+werden.
+
+Mit der Option @option{--list-image-types} werden alle verfügbaren Abbildtypen
+aufgelistet.")
+         (fr "L'option @option{--file-system-type} pour la commande
+@command{guix system disk-image} a été remplacée par la nouvelle option
+@option{--image-type}. Par défaut, l'option @code{raw}, produisant des images
+disque brutes est sélectionnée. Les options @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} et @code{iso9660} sont également
+disponibles.
+
+La nouvelle option @option{--list-image-types} énumère les types d'image
+disponibles.")))
+
+ (entry (commit "8819551c8d2a12cd4e84e09b51e434d05a012c9d")
+        (title (en "Package transformations now apply to implicit inputs")
+               (es "Las transformaciones de paquetes ahora afectan también
+a las dependencias implícitas")
+               (de "Paketumwandlungen betreffen jetzt auch implizite Eingaben")
+               (fr "Les transformations de paquets s'appliquent aux
+dépendances implicites"))
+        (body
+         (en "Package transformation options such as @option{--with-branch},
+@option{--with-input}, and so on now apply to implicit inputs---previously
+only a package's explicit inputs would be affected.  This allows for things
+such as replacing the Python dependency of a package that uses
+@code{python-build-system}:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Another example is grafting a different version of the GNU C
+Library (@code{glibc} is an implicit input of almost all the packages and is
+``deep down'' in the dependency graph):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more
+info.")
+         (es "Las opciones de transformación de paquetes como
+@option{--with-branch}, @option{--with-input}, etcétera, ahora también
+influyen en las entradas implícitas---antes únicamente las entradas explícitas
+del paquete se veían afectadas. Esto permite, por ejemplo, sustituir la
+dependencia en python de un paquete que use @code{python-build-system}:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Otro ejemplo podría ser el injerto de una versión diferente de la biblioteca
+de C de GNU (@code{glibc} es una entrada implícita de casi todos los paquetes
+y ``muy abajo'' en el grafo de dependencias):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Paketumwandlungsoptionen wie @option{--with-branch},
+@option{--with-input} und so weiter betreffen nun auch implizite Eingaben —
+zuvor haben sie sich nur auf die expliziten Eingaben eines Pakets
+ausgewirkt. Dadurch kann jetzt zum Beispiel die Python-Abhängigkeit eines
+Pakets, welches @code{python-build-system} benutzt, ersetzt werden:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Ein weiteres Beispiel ist, mit einer anderen Version der GNU-C-Bibliothek zu
+veredeln (@code{glibc} ist eine implizite Eingabe fast aller Pakete und steckt
+„ganz tief“ im Abhängigkeitsgraphen):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (fr "Les options de transformation de paquets telles que
+@option{--with-branch} et @option{--with-input} s'appliquent désormais aux
+dépendances implicites — jusque là seules les dépendances explicites des
+paquets étaient prises en compte.  Cela permet certaines choses telles que
+remplacer la dépendance sur Python d'un paquet utilisant
+@code{python-build-system} :
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Un autre exemple est la possibilité de greffer une version différente de la
+bibliothèque C GNU (la @code{glibc} est une dépendance implicite de tous les
+paquets et se trouve « tout en bas » du graphe de dépendance) :
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "f458cfbcc54ed87b1a87dd9e150ea276f17eab74")
+        (title (en "New @option{--without-tests} transformation option")
+               (es "Nueva opción de transformación @option{--without-tests}")
+               (de "Neue Paketumwandlungsoption @option{--without-tests}")
+               (fr "Nouvelle option de transformation @option{--without-tests}"))
+        (body
+         (en "The new @option{--without-tests} package transformation option
+instructs Guix to skip the test suite of a given package.  In the example
+below, @code{guile-gcrypt} is built using a variant of @code{automake} itself
+built without running its (lengthy) test suite:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+This is primarily useful as a way to speed up development cycles, or to work
+around flaky test suites---skipping tests can hide real issues, so use with
+care.  Run @command{info \"(guix) Package Transformation Options\"} for more
+info.")
+         (es "La nueva opción de transformación de paquetes
+@option{--without-tests} indica a Guix que omita la batería de pruebas del
+paquete proporcionado. En el siguiente ejemplo @code{guile-gcrypt} se
+construye usando una variación de @code{automake}, la cual se ha construido
+sin ejecutar su (larga) batería de pruebas:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Esto es principalmente útil como una forma de acelerar ciclos de desarrollo o
+de omitir temporalmente baterías de pruebas problemáticas---omitir las pruebas
+puede ocultar problemas reales, por lo que debe usarse con precaución.
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Mit der neuen Paketumwandlungsoption @option{--without-tests}
+wird Guix angewiesen, den Testkatalog des angegebenen Pakets zu
+überspringen. Im folgenden Beispiel wird @code{guile-gcrypt} mit einer
+Variante von @code{automake} erstellt, die wiederum ohne Durchlauf ihres (viel
+Zeit in Anspruch nehmenden) Testkatalogs erstellt wird:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Der hauptsächliche Nutzen liegt in der Beschleunigung von Entwicklungszyklen
+oder im Umgehen unzuverlässiger Testkataloge. Allerdings kann das Überspringen
+dazu führen, dass echte Probleme verborgen bleiben. Setzen Sie es mit Bedacht
+ein. Führen Sie @command{info \"(guix.de) Paketumwandlungsoptionen\"} aus, um
+mehr Informationen zu erhalten.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--without-tests} demande à Guix de sauter la suite de tests d'un
+paquet.  Dans l'exemple ci-dessous, @code{guile-gcrypt} est construit en
+utilisant une variante de @code{automake} construite sans lancer sa suite de
+tests :
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Cette option est surtout intéressante pour raccourcir le cycle de
+développement ou pour contourner une suite de tests qui n'est pas
+fiable — sauter les tests peut cacher des vrais problèmes, à utiliser avec
+précaution donc.  Voir @command{info \"(guix.fr) Options de transformation de
+paquets\"} pour plus de détails.")))
+
+ (entry (commit "a98712785e0b042a290420fd74e5a4a5da4fc68f")
+        (title (en "New @command{guix git authenticate} command")
+               (es "Nueva orden @command{guix git authenticate}")
+               (de "Neuer Befehl @command{guix git authenticate}")
+               (fr "Nouvelle commande @command{guix git authenticate}"))
+        (body
+         (en "The new @command{guix git authenticate} command authenticates a
+Git repository by verifying commit signatures and ensuring they all come from
+authorized parties, exactly like @command{guix pull} now does.
+
+This command is primarily useful to developers of channels.  It allows them to
+ensure, before pushing, that the channel only contains commits signed with
+authorized keys.  But this command is also useful anytime you use Git and want
+to allow people to authenticate code fetched from your repository.
+
+Run @command{info \"(guix) Invoking guix git authenticate\"} for more info,
+and see @uref{https://guix.gnu.org/blog/2020/securing-updates/} for details on
+these mechanisms.")
+         (es "La nueva orden @command{guix git authenticate} comprueba la
+validez de un repositorio git verificando las firmas de las revisiones y
+comprobando que todas las firmas están autorizadas, exactamente igual que
+@command{guix pull}.
+
+Esta orden es principalmente útil para desarrolladoras de canales. Permite
+asegurar, antes de subir nada al repositorio remoto, que el canal contiene
+únicamente revisiones firmadas por claves autorizadas. No obstante esta orden
+es útil siempre que use git y quiera que otras personas puedan verificar el
+código obtenido de su repositorio.
+
+Ejecute @command{info \"(guix.es) Invocación de guix git authenticate\"}
+para obtener más información y vea detalles sobre estos mecanismos en
+ @uref{https://guix.gnu.org/blog/2020/securing-updates/}.")
+         (de "Mit dem neuen Befehl @command{guix git authenticate} können Sie
+ein Git-Repository authentifizieren. Dazu werden alle Commit-Signaturen
+verifiziert und geprüft, dass jede von einer autorisierten Quelle kommt, genau
+wie es @command{guix pull} nun tut.
+
+Dieser Befehl hilft in erster Linie den Entwicklern von Kanälen. Mit ihm kann
+vor einem Push sichergestellt werden, dass der Kanal nur Commits enthält, die
+mit autorisierten Schlüsseln signiert worden sind. Aber der Befehl kann auch
+helfen, wann immer Sie Git verwenden und ermöglichen wollen, dass Nutzer von
+Ihrem Repository geladenen Code authentifizieren können.
+
+Führen Sie @command{info \"(guix) Invoking guix git authenticate\"} aus, um
+mehr Informationen zu erhalten, und lesen Sie
+@uref{https://guix.gnu.org/blog/2020/securing-updates/} für die Details dieser
+Mechanismen.")
+         (fr "La nouvelle commande @command{guix git authenticate} authentifie
+un dépôt Git en vérifiant les signatures sur les changements (@i{commits}) et
+en s'assurant qu'elles sont autorisées, exactement comme @command{guix pull}
+le fait désormais.
+
+Cette commande est avant tout utile aux personnes développant un canal.  Elle
+leur permet de s'assurer, avant de pousser des changements, que le canal ne
+contient que des changements signés par des clefs autorisées.  Mais cette
+commande peut aussi s'avérer utile dès que tu veux utiliser Git et permettre
+aux autres d'authentifier le code récupéré depuis ton dépôt.
+
+Lance @command{info \"(guix.fr) Invoking guix git authenticate\"} pour plus
+d'informations.  Voir @uref{https://guix.gnu.org/blog/2020/securing-updates/}
+pour en savoir plus sur ces mécanismes.")))
+
+ (entry (commit "43badf261f4688c8a7a7a9004a4bff8acb205835")
+        (title (en "@command{guix pull} authenticates channels")
+               (es "@command{guix pull} verifica los canales")
+               (de "@command{guix pull} authentifiziert Kanäle")
+               (fr "@command{guix pull} authentifie les canaux"))
+        (body
+         (en "The @command{guix pull} and @command{guix time-machine} commands
+now authenticate the source code that they pull, unless the new
+@option{--disable-authentication} option is passed.  What this means is that
+Guix ensures that each commit received is cryptographically signed by an
+authorized developer.  This protects you from attempts to tamper with the Guix
+repository and from attempts to ship malicious code to users.
+
+This feature is currently limited to the @code{guix} channel but will soon be
+available to third-party channel authors.")
+         (es "Las ordenes @command{guix pull} y @command{guix time-machine}
+ahora verifican el código fuente que obtienen, a menos que se proporcione la
+opción @option{--disable-authentication}. Lo que esto significa es que Guix se
+asegura de que cada revisión que recibe está firmada criptográficamente por
+una desarrolladora autorizada. Esto le protege de intentos de modificación del
+repositorio de Guix y de entregas de código con malas intenciones sobre las
+usuarias.
+
+Esta característica está limitada actualmente al canal @code{guix} pero pronto
+estará disponible para autoras de canales independientes.")
+         (de "Die Befehle @command{guix pull} und @command{guix time-machine}
+prüfen nun die Authentizität des heruntergeladenen Quellcodes, außer wenn die
+neue Befehlszeilenoption @option{--disable-authentication} angegeben
+wurde. Das bedeutet, Guix stellt sicher, dass jeder empfangene Commit durch
+einen autorisierten Entwickler kryptografisch signiert wurde. Das schützt Sie
+vor Versuchen, das Guix-Repository zu manipulieren oder bösartigen Code an die
+Nutzer auszuliefern.
+
+Diese Funktionalität ist auf den @code{guix}-Kanal beschränkt, sie wird jedoch
+bald auch Autoren dritter Kanäle zur Verfügung stehen.")
+         (fr "Les commandes @command{guix pull} et @command{guix time-machine}
+authentifient dorénavant le code source qu'elles obtiennent, à moins que la
+nouvelle option @option{--disable-authentication} soit utilisée.  Cela
+signifie que Guix s'assure que chaque soumission (@i{commit}) récupéré dispose
+d'une signature cryptographique par un·e développeur·euse autorisé·e.  Cela te
+protège de tentatives de modifications du dépôt Guix et de tentatives de
+livrer du code malintentionné.
+
+Cette fonctionnalité n'est actuellement disponible que pour le canal
+@code{guix} mais le sera bientôt pour les canaux tiers.")))
+
+ (entry (commit "c924e541390f9595d819edc33c19d979917c15ec")
+        (title (en "@command{guix repl} adds support for running Guile scripts")
+               (es "@command{guix repl} puede ejecutar guiones de Guile")
+               (de "@command{guix repl} kann Guile-Skripte ausführen")
+               (fr "@command{guix repl} permet d'exécuter des scripts en langage Guile"))
+        (body
+         (en "The @command{guix repl} command can now be used to run
+Guile scripts.  Compared to just launching the @command{guile} command,
+@command{guix repl} guarantees that all the Guix modules and all its
+dependencies are available in the search path.  Scripts are run like this:
+
+@example
+guix repl -- my-script,scm --option1 --option2=option-arg arg1 arg2
+@end example
+
+Run @command{info \"(guix) Invoking guix repl\"} for more information.")
+         (es "La orden @command{guix repl} ahora se puede usar para
+ejecutar guiones de Guile. En comparación con únicamente la ejecución
+de la orden @command{guile}, @command{guix repl} garantiza que todos
+los módulos de Guix y sus dependencias están disponibles en la ruta
+ de búsqueda. Los guiones se ejecutan de este modo:
+
+@example
+guix repl -- mi-guion.scm --opcion1 --opcion2=param-op2 param1 param2
+@end example
+
+Ejecute @command{info \"(guix.es) Invocación de guix repl\"} para obtener
+más información.")
+         (de "Der Befehl @command{guix repl} kann jetzt zur Ausführung von
+Guile-Skripten verwendet werden.  Im Vergleich zum Befehl
+@command{guile} garantiert @command{guix repl}, dass alle Guix-Module und
+alle seine Abhängigkeiten im Suchpfad verfügbar sind.  Skripte werden wie
+folgt ausgeführt:
+
+@example
+guix repl -- my-script,scm --option1 --option2 --option2=option-arg arg1 arg2
+@end example
+
+Weitere Informationen erhalten Sie mit
+@command{info \"(guix.de) Aufruf von guix repl\"}.")
+         (fr "La commande @command{guix repl} peut maintenant être utilisée
+pour exécuter des scripts en langage Guile.  Par rapport au simple lancement
+de la commande @command{guile}, @command{guix repl} garantit que tous les
+modules Guix et toutes ses dépendances sont disponibles dans le chemin
+de recherche.  Les scripts sont exécutés comme ceci :
+
+@example
+guix repl -- my-script,scm --option1 --option2=option-arg arg1 arg2
+@end example
+
+Exécutez @command{info \"(guix.fr) Invoquer guix repl\"} pour plus d'informations.")))
+
 (entry (commit "b460ba7992a0b4af2ddb5927dcf062784539ef7b")
        (title (en "Add support to boot from a Btrfs subvolume")
+               (es "Implementado el arranque desde un subvolumen de Btrfs")
               (de "Unterstützung für Systemstart von einem
 Btrfs-Unterlaufwerk hinzugefügt")
               (fr "Ajout du support pour démarrer depuis un sous-volume Btrfs")
@@ -25,6 +640,11 @@ operating system declaration now takes into account the use of a Btrfs
 subvolume for the partition holding @file{/gnu/store}.  Run the command
@command{info \"(guix) Btrfs file system\"} for more information and
 examples.")
+         (es "El fichero de configuración de GRUB producido por la
+declaración de sistema operativo ahora tiene en cuenta el uso de
+subvolúmenes de Btrfs en la partición que contiene @file{/gnu/store}.
+Ejecute la orden @command{info \"(guix.es) Sistema de ficheros Btrfs\"}
+ para obtener más información y ejemplos.")
         (de "Für die Erzeugung einer GRUB-Konfigurationsdatei aus einer
 Betriebssystemdeklaration kann jetzt ein Btrfs-Unterlaufwerk („Subvolume“) für
 die Partition mit @file{/gnu/store} angegeben werden.  Führen Sie
@@ -44,6 +664,8 @@ voorbeelden.")))
 (entry (commit "6456232164890dbf5aa20394ee24637feb4b7b9e")
        (title (en "@command{guix pack -RR} introduces a new execution
 engine")
+               (es "@command{guix pack -RR} introduce un nuevo motor
+de ejecución")
               (de "@command{guix pack -RR} führt neuen Ausführungstreiber
 ein"))
        (body
@@ -64,6 +686,26 @@ export GUIX_EXECUTION_ENGINE
@end example

 Run @command{info \"(guix) Invoking guix pack\"} for more information.")
+         (es "La orden @command{guix pack -RR} le permite crear un
+archivador tar que contiene @dfn{binarios reposicionables}. Hasta ahora
+dichos binarios dependían o bien de los ``espacios de nombres de usuarias
+sin privilegios'' de Linux o en PRoot, cuando estos no estaban
+implementados. No obstante, PRoot introduce una sobrecarga significativa
+en algunos escenarios de trabajo.
+
+Para estos casos @command{guix pack -RR} introduce una tercera opción
+basada en una extensión al enlazador de tiempo de ejecución de GNU (ld.so)
+y en Fakechroot, lo que conlleva muy poca sobrecarga. Puede seleccionar
+la opción más rápida cuando ejecute un binario reposicionable de esta
+manera:
+
+@example
+GUIX_EXECUTION_ENGINE=performance
+export GUIX_EXECUTION_ENGINE
+@end example
+
+Ejecute @command{info \"(guix.es) Invocación de guix pack\"} para
+obtener más información.")
         (de "Mit dem Befehl @command{guix pack -RR} können Sie einen Tarball
 mit @dfn{verschieblichen Binärdateien} erzeugen (englisch „Relocatable
 Binaries“).  Bisher wurden diese entweder in „unprivilegierten
@@ -88,6 +730,7 @@ mehr wissen wollen.")))

 (entry (commit "88a96c568c47c97d05d883ada5afbc4e1200b10f")
        (title (en "New @option{--path} option for @command{guix graph}")
+               (es "Nueva opción @option{--path} para @command{guix graph}")
               (de "Neue Option @option{--path} für @command{guix graph}"))
        (body
         (en "The @command{guix graph} command has a new @option{--path}
@@ -100,6 +743,18 @@ guix graph --path libreoffice libunistring
@end example

 Run @code{info \"(guix) Invoking guix graph\"} for more information.")
+         (es "La orden @command{guix graph} tiene una nueva opción
+@option{--path} que le indica que debe mostrar la ruta más corta entre dos
+paquetes, derivaciones o elementos del almacén. Por ejemplo, la siguiente
+orden muestra la ruta más corta desde el paquete @code{libreoffice} hasta
+@code{libunistring}:
+
+@example
+guix graph --path libreoffice libunistring
+@end example
+
+Ejecute @code{info \"(guix.es) Invocación de guix graph\"} para obtener más
+información.")
         (de "Der Befehl @command{guix graph} verfügt über eine neue
 Befehlszeilenoption @option{--path}, die ihn den kürzesten Pfad zwischen zwei
 Paketen, Ableitungen oder Store-Objekten ausgeben lässt.  Zum Beispiel zeigt
@@ -0,0 +1,28 @@
+#!/sbin/openrc-run
+# GNU Guix --- Functional package management for GNU
+# Copyright © 2020 Morgan Smith <Morgan.J.Smith@outlook.com>
+#
+# This file is part of GNU Guix.
+#
+# GNU Guix is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GNU Guix is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+export GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale
+export LC_ALL=en_US.utf8
+command="@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daemon"
+command_args="--build-users-group=guixbuild"
+command_background="yes"
+pidfile="/var/run/guix-daemon.pid"
+
+output_log="/var/log/guix-daemon-stdout.log"
+error_log="/var/log/guix-daemon-stderr.log"
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -48,11 +49,18 @@ TARGET."
       '("bootstrap-tarballs" "gcc-toolchain" "nss-certs"
         "openssh" "emacs" "vim" "python" "guile" "guix")))

+(define %base-packages/hurd
+  ;; XXX: For now we are less demanding of "i586-gnu".
+  (map specification->package
+       '("coreutils" "grep" "findutils" "gawk" "make"
+         "gcc-toolchain" "tar" "xz")))
+
 (define %system-packages
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
               '("xorg-server" "xfce" "gnome" "mate" "enlightenment"
                 "openbox" "awesome" "i3-wm" "ratpoison"
+                 "emacs" "emacs-exwm" "emacs-desktop-environment"
                 "xlockmore" "slock" "libreoffice"
                 "connman" "network-manager" "network-manager-applet"
                 "openssh" "ntp" "tor"
@@ -92,7 +100,9 @@ TARGET."
  (manifest
   (append-map (lambda (system)
                 (map (cut package->manifest-entry* <> system)
-                      %base-packages))
+                      (if (string=? system "i586-gnu")
+                          %base-packages/hurd
+                          %base-packages)))
               %hydra-supported-systems)))

 (define %system-manifest
@@ -1 +1 @@
-berlin.guixsd.org.pub
+berlin.guix.gnu.org.pub
@@ -1 +1 @@
-berlin.guixsd.org.pub
+berlin.guix.gnu.org.pub
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Joshua S. Grant <jgrant@parenthetical.io>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;;
@@ -20,7 +20,7 @@

 (define-module (gnu)
  #:use-module (guix i18n)
-  #:use-module (guix utils)
+  #:use-module (guix diagnostics)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:use-module (ice-9 match)
@@ -78,10 +78,8 @@
                  (raise
                   (apply
                    make-compound-condition
-                    (condition
-                     (&message
-                      (message (format #f (G_ "module ~a not found")
-                                       module))))
+                    (formatted-message (G_ "module ~a not found")
+                                       module)
                    (condition
                     (&error-location (location location)))
                    (or (and=> (make-hint module) list)
@@ -4,7 +4,9 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019, 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2019 Miguel Ángel Arruga Vivas <rosen644835@gmail.com>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2020 Stefan <stefan-guix@vodafonemail.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -22,14 +24,17 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu bootloader grub)
+  #:use-module (guix build union)
  #:use-module (guix records)
-  #:use-module ((guix utils) #:select (%current-system))
+  #:use-module (guix store)
+  #:use-module (guix utils)
  #:use-module (guix gexp)
  #:use-module (gnu artwork)
  #:use-module (gnu bootloader)
  #:use-module (gnu system uuid)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system keyboard)
+  #:use-module (gnu system locale)
  #:use-module (gnu packages bootloaders)
  #:autoload   (gnu packages gtk) (guile-cairo guile-rsvg)
  #:autoload   (gnu packages xorg) (xkeyboard-config)
@@ -45,8 +50,11 @@
            grub-theme-color-highlight
            grub-theme-gfxmode

+            install-grub-efi-netboot
+
            grub-bootloader
            grub-efi-bootloader
+            grub-efi-netboot-bootloader
            grub-mkrescue-bootloader
            grub-minimal-bootloader

@@ -134,42 +142,44 @@ file with the resolution provided in CONFIG."
            (image->png image #:width width #:height height))
           (_ #f)))))

+(define (grub-locale-directory grub)
+  "Generate a directory with the locales from GRUB."
+  (define builder
+    #~(begin
+        (use-modules (ice-9 ftw))
+        (let ((locale (string-append #$grub "/share/locale"))
+              (out    #$output))
+          (mkdir out)
+          (chdir out)
+          (for-each (lambda (lang)
+                      (let ((file (string-append locale "/" lang
+                                                 "/LC_MESSAGES/grub.mo"))
+                            (dest (string-append lang ".mo")))
+                        (when (file-exists? file)
+                          (copy-file file dest))))
+                    (scandir locale)))))
+  (computed-file "grub-locales" builder))
+
 (define* (eye-candy config store-device store-mount-point
-                    #:key store-directory-prefix system port)
+                    #:key store-directory-prefix port)
  "Return a gexp that writes to PORT (a port-valued gexp) the 'grub.cfg' part
 concerned with graphics mode, background images, colors, and all that.
 STORE-DEVICE designates the device holding the store, and STORE-MOUNT-POINT is
 its mount point; these are used to determine where the background image and
-fonts must be searched for.  SYSTEM must be the target system string---e.g.,
-\"x86_64-linux\".  STORE-DIRECTORY-PREFIX is a directory prefix to prepend to
-any store file name."
-  (define setup-gfxterm-body
-    (let ((gfxmode
-           (or (and-let* ((theme (bootloader-configuration-theme config))
-                          (gfxmode (grub-theme-gfxmode theme)))
-                 (string-join gfxmode ";"))
-               "auto")))
-
-      ;; Intel and EFI systems need to be switched into graphics mode, whereas
-      ;; most other modern architectures have no other mode and therefore
-      ;; don't need to be switched.
-
-      ;; XXX: Do we really need to restrict to x86 systems?  We could imitate
-      ;; what the GRUB default configuration does and decide based on whether
-      ;; a user provided 'gfxterm' in the terminal-outputs field of their
-      ;; bootloader-configuration record.
-      (if (string-match "^(x86_64|i[3-6]86)-" system)
-          (format #f "
-  set gfxmode=~a
-  insmod all_video
-  insmod gfxterm~%" gfxmode)
-          "")))
-
+fonts must be searched for.  STORE-DIRECTORY-PREFIX is a directory prefix to
+prepend to any store file name."
  (define (setup-gfxterm config font-file)
    (if (memq 'gfxterm (bootloader-configuration-terminal-outputs config))
-        #~(format #f "if loadfont ~a; then
-  setup_gfxterm
-fi~%" #+font-file)
+        #~(format #f "
+if loadfont ~a; then
+  set gfxmode=~a
+  insmod all_video
+  insmod gfxterm
+fi~%"
+                  #+font-file
+                  #$(string-join
+                     (grub-theme-gfxmode (bootloader-theme config))
+                     ";"))
        ""))

  (define (theme-colors type)
@@ -179,9 +189,11 @@ fi~%" #+font-file)
                     (symbol->string (assoc-ref colors 'bg)))))

  (define font-file
-    (normalize-file (file-append grub "/share/grub/unicode.pf2")
-                    store-mount-point
-                    store-directory-prefix))
+    (let* ((bootloader (bootloader-configuration-bootloader config))
+           (grub (bootloader-package bootloader)))
+      (normalize-file (file-append grub "/share/grub/unicode.pf2")
+                      store-mount-point
+                      store-directory-prefix)))

  (define image
    (normalize-file (grub-background-image config)
@@ -190,8 +202,6 @@ fi~%" #+font-file)

  (and image
       #~(format #$port "
-function setup_gfxterm {~a}
-
 # Set 'root' to the partition that contains /gnu/store.
 ~a

@@ -206,7 +216,6 @@ else
  set menu_color_normal=cyan/blue
  set menu_color_highlight=white/blue
 fi~%"
-                 #$setup-gfxterm-body
                 #$(grub-root-search store-device font-file)
                 #$(setup-gfxterm config font-file)
                 #$(grub-setup-io config)
@@ -313,11 +322,41 @@ code."
        ((? file-system-label? label)
         (format #f "search --label --set ~a"
                 (file-system-label->string label)))
+        ((? (lambda (device)
+              (and (string? device) (string-contains device ":/"))) nfs-uri)
+         ;; If the device is an NFS share, then we assume that the expected
+         ;; file on that device (e.g. the GRUB background image or the kernel)
+         ;; has to be loaded over the network.  Otherwise we would need an
+         ;; additional device information for some local disk to look for that
+         ;; file, which we do not have.
+         ;;
+         ;; We explicitly set "root=(tftp)" here even though if grub.cfg
+         ;; had been loaded via TFTP, Grub would have set "root=(tftp)"
+         ;; automatically anyway.  The reason is if you have a system that
+         ;; used to be on NFS but now is local, root would be set to local
+         ;; disk.  If you then selected an older system generation that is
+         ;; supposed to boot from network in the Grub boot menu, Grub still
+         ;; wouldn't load those files from network otherwise.
+         ;;
+         ;; TFTP is preferred to HTTP because it is used more widely and
+         ;; specified in standards more widely--especially BOOTP/DHCPv4
+         ;; defines a TFTP server for DHCP option 66, but not HTTP.
+         ;;
+         ;; Note: DHCPv6 specifies option 59 to contain a boot-file-url,
+         ;; which can contain a HTTP or TFTP URL.
+         ;;
+         ;; Note: It is assumed that the file paths are of a similar
+         ;; setup on both the TFTP server and the NFS server (it is
+         ;; not possible to search for files on TFTP).
+         ;;
+         ;; TODO: Allow HTTP.
+         "set root=(tftp)")
        ((or #f (? string?))
         #~(format #f "search --file --set ~a" #$file)))))

 (define* (grub-configuration-file config entries
                                  #:key
+                                  (locale #f)
                                  (system (%current-system))
                                  (old-entries '())
                                  store-directory-prefix)
@@ -380,20 +419,49 @@ menuentry ~s {
                 device
                 mount-point
                 #:store-directory-prefix store-directory-prefix
-                 #:system system
                 #:port #~port)))

+  (define locale-config
+    (let* ((entry (first all-entries))
+           (device (menu-entry-device entry))
+           (mount-point (menu-entry-device-mount-point entry))
+           (bootloader (bootloader-configuration-bootloader config))
+           (grub (bootloader-package bootloader)))
+      #~(let ((locale #$(and locale
+                             (locale-definition-source
+                              (locale-name->definition locale))))
+              (locales #$(and locale
+                              (normalize-file (grub-locale-directory grub)
+                                              mount-point
+                                              store-directory-prefix))))
+          (when locale
+            (format port "\
+# Localization configuration.
+~asearch --file --set ~a/en@quot.mo
+set locale_dir=~a
+set lang=~a~%"
+                    ;; Skip the search if there is an image, as it has already
+                    ;; been performed by eye-candy and traversing the store is
+                    ;; an expensive operation.
+                    #$(if (grub-theme-image (bootloader-theme config))
+                          "# "
+                          "")
+                    locales
+                    locales
+                    locale)))))
+
  (define keyboard-layout-config
    (let* ((layout (bootloader-configuration-keyboard-layout config))
           (grub   (bootloader-package
                    (bootloader-configuration-bootloader config)))
           (keymap* (and layout
                         (keyboard-layout-file layout #:grub grub)))
+           (entry (first all-entries))
+           (device (menu-entry-device entry))
+           (mount-point (menu-entry-device-mount-point entry))
           (keymap (and keymap*
-                        (if store-directory-prefix
-                            #~(string-append #$store-directory-prefix
-                                             #$keymap*)
-                            keymap*))))
+                        (normalize-file keymap* mount-point
+                                        store-directory-prefix))))
      #~(when #$keymap
          (format port "\
 insmod keylayouts
@@ -407,6 +475,7 @@ keymap ~a~%" #$keymap))))
 # will be lost upon reconfiguration.
 ")
          #$(sugar)
+          #$locale-config
          #$keyboard-layout-config
          (format port "
 set default=~a
@@ -520,11 +589,108 @@ fi~%"))))
                      "--bootloader-id=Guix"
                      "--efi-directory" target-esp))))

+(define (install-grub-efi-netboot subdir)
+  "Define a grub-efi-netboot bootloader installer for installation in SUBDIR,
+which is usually efi/Guix or efi/boot."
+  (let* ((system (string-split (nix-system->gnu-triplet
+                                (or (%current-target-system)
+                                    (%current-system)))
+                               #\-))
+         (arch (first system))
+         (boot-efi-link (match system
+                          ;; These are the supportend systems and the names
+                          ;; defined by the UEFI standard for removable media.
+                          (("i686" _ ...)        "/bootia32.efi")
+                          (("x86_64" _ ...)      "/bootx64.efi")
+                          (("arm" _ ...)         "/bootarm.efi")
+                          (("aarch64" _ ...)     "/bootaa64.efi")
+                          (("riscv" _ ...)       "/bootriscv32.efi")
+                          (("riscv64" _ ...)     "/bootriscv64.efi")
+                          ;; Other systems are not supported, although defined.
+                          ;; (("riscv128" _ ...) "/bootriscv128.efi")
+                          ;; (("ia64" _ ...)     "/bootia64.efi")
+                          ((_ ...)               #f)))
+         (core-efi (string-append
+                    ;; This is the arch dependent file name of GRUB, e.g.
+                    ;; i368-efi/core.efi or arm64-efi/core.efi.
+                    (match arch
+                      ("i686"    "i386")
+                      ("aarch64" "arm64")
+                      ("riscv"   "riscv32")
+                      (_         arch))
+                    "-efi/core.efi")))
+    (with-imported-modules
+     '((guix build union))
+     #~(lambda (bootloader target mount-point)
+         "Install the BOOTLOADER, which must be the package grub, as e.g.
+bootx64.efi or bootaa64.efi into SUBDIR, which is usually efi/Guix or efi/boot,
+below the directory TARGET for the system whose root is mounted at MOUNT-POINT.
+
+MOUNT-POINT is the last argument in 'guix system init /etc/config.scm mnt/point'
+or '/' for other 'guix system' commands.
+
+TARGET is the target argument given to the bootloader-configuration in
+
+(operating-system
+ (bootloader (bootloader-configuration
+              (target \"/boot\")
+              …))
+ …)
+
+TARGET is required to be an absolute directory name, usually mounted via NFS,
+and finally needs to be provided by a TFTP server as the TFTP root directory.
+
+GRUB will load tftp://server/SUBDIR/grub.cfg and this file will instruct it to
+load more files from the store like tftp://server/gnu/store/…-linux…/Image.
+
+To make this possible two symlinks will be created. The first symlink points
+relatively form MOUNT-POINT/TARGET/SUBDIR/grub.cfg to
+MOUNT-POINT/boot/grub/grub.cfg, and the second symlink points relatively from
+MOUNT-POINT/TARGET/%store-prefix to MOUNT-POINT/%store-prefix.
+
+It is important to note that these symlinks need to be relativ, as the absolute
+paths on the TFTP server side are unknown.
+
+It is also important to note that both symlinks will point outside the TFTP root
+directory and that the TARGET/%store-prefix symlink makes the whole store
+accessible via TFTP. Possibly the TFTP server must be configured
+to allow accesses outside its TFTP root directory. This may need to be
+considered for security aspects."
+         (use-modules ((guix build union) #:select (symlink-relative)))
+         (let* ((net-dir (string-append mount-point target "/"))
+                (sub-dir (string-append net-dir #$subdir "/"))
+                (store (string-append mount-point (%store-prefix)))
+                (store-link (string-append net-dir (%store-prefix)))
+                (grub-cfg (string-append mount-point "/boot/grub/grub.cfg"))
+                (grub-cfg-link (string-append sub-dir (basename grub-cfg)))
+                (boot-efi-link (string-append sub-dir #$boot-efi-link)))
+           ;; Prepare the symlink to the store.
+           (mkdir-p (dirname store-link))
+           (false-if-exception (delete-file store-link))
+           (symlink-relative store store-link)
+           ;; Prepare the symlink to the grub.cfg, which points into the store.
+           (mkdir-p (dirname grub-cfg-link))
+           (false-if-exception (delete-file grub-cfg-link))
+           (symlink-relative grub-cfg grub-cfg-link)
+           ;; Install GRUB, which refers to the grub.cfg, with support for
+           ;; encrypted partitions,
+           (setenv "GRUB_ENABLE_CRYPTODISK" "y")
+           (invoke/quiet (string-append bootloader "/bin/grub-mknetdir")
+                         (string-append "--net-directory=" net-dir)
+                         (string-append "--subdir=" #$subdir))
+           ;; Prepare the bootloader symlink, which points to core.efi of GRUB.
+           (false-if-exception (delete-file boot-efi-link))
+           (symlink #$core-efi boot-efi-link))))))
+


 ;;;
 ;;; Bootloader definitions.
 ;;;
+;;; For all these grub-bootloader variables the path to /boot/grub/grub.cfg
+;;; is fixed.  Inheriting and overwriting the field 'configuration-file' will
+;;; break 'guix system delete-generations', 'guix system switch-generation',
+;;; and 'guix system roll-back'.

 (define grub-bootloader
  (bootloader
@@ -535,12 +701,12 @@ fi~%"))))
   (configuration-file "/boot/grub/grub.cfg")
   (configuration-file-generator grub-configuration-file)))

-(define* grub-minimal-bootloader
+(define grub-minimal-bootloader
  (bootloader
   (inherit grub-bootloader)
   (package grub-minimal)))

-(define* grub-efi-bootloader
+(define grub-efi-bootloader
  (bootloader
   (inherit grub-bootloader)
   (installer install-grub-efi)
@@ -548,7 +714,13 @@ fi~%"))))
   (name 'grub-efi)
   (package grub-efi)))

-(define* grub-mkrescue-bootloader
+(define grub-efi-netboot-bootloader
+  (bootloader
+   (inherit grub-efi-bootloader)
+   (name 'grub-efi-netboot-bootloader)
+   (installer (install-grub-efi-netboot "efi/Guix"))))
+
+(define grub-mkrescue-bootloader
  (bootloader
   (inherit grub-efi-bootloader)
   (package grub-hybrid)))
@@ -45,7 +45,7 @@
            u-boot-wandboard-bootloader))

 (define install-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (if bootloader
        (error "Failed to install U-Boot"))))

@@ -56,74 +56,74 @@
  ;; the MLO and is expected at 0x60000.  Write both first stage ("MLO") and
  ;; second stage ("u-boot.img") images, read in BOOTLOADER directory, to the
  ;; specified DEVICE.
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((mlo (string-append bootloader "/libexec/MLO"))
            (u-boot (string-append bootloader "/libexec/u-boot.img")))
        (write-file-on-device mlo (* 256 512)
-                              device (* 256 512))
+                              image (* 256 512))
        (write-file-on-device u-boot (* 1024 512)
-                              device (* 768 512)))))
+                              image (* 768 512)))))

 (define install-allwinner-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((u-boot (string-append bootloader
                                   "/libexec/u-boot-sunxi-with-spl.bin")))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 8 1024)))))
+                              image (* 8 1024)))))

 (define install-allwinner64-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/spl/sunxi-spl.bin"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 8 1024))
+                              image (* 8 1024))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 40 1024)))))
+                              image (* 40 1024)))))

 (define install-imx-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/SPL"))
            (u-boot (string-append bootloader "/libexec/u-boot.img")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 1 1024))
+                              image (* 1 1024))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 69 1024)))))
+                              image (* 69 1024)))))

 (define install-puma-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/u-boot-spl.rksd"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 512 512)))))
+                              image (* 512 512)))))

 (define install-firefly-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-rock64-rk3328-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-rockpro64-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-pinebook-pro-rk3399-u-boot install-rockpro64-rk3399-u-boot)

@@ -138,28 +138,29 @@
   (inherit extlinux-bootloader)
   (name 'u-boot)
   (package #f)
-   (installer install-u-boot)))
+   (installer #f)
+   (disk-image-installer install-u-boot)))

 (define u-boot-beaglebone-black-bootloader
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-am335x-boneblack)
-   (installer install-beaglebone-black-u-boot)))
+   (disk-image-installer install-beaglebone-black-u-boot)))

 (define u-boot-allwinner-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-allwinner-u-boot)))
+   (disk-image-installer install-allwinner-u-boot)))

 (define u-boot-allwinner64-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-allwinner64-u-boot)))
+   (disk-image-installer install-allwinner64-u-boot)))

 (define u-boot-imx-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-imx-u-boot)))
+   (disk-image-installer install-imx-u-boot)))

 (define u-boot-nintendo-nes-classic-edition-bootloader
  (bootloader
@@ -196,7 +197,7 @@
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-firefly-rk3399)
-   (installer install-firefly-rk3399-u-boot)))
+   (disk-image-installer install-firefly-rk3399-u-boot)))

 (define u-boot-mx6cuboxi-bootloader
  (bootloader
@@ -232,25 +233,25 @@
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-puma-rk3399)
-   (installer install-puma-rk3399-u-boot)))
+   (disk-image-installer install-puma-rk3399-u-boot)))

 (define u-boot-rock64-rk3328-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-rock64-rk3328)
-   (installer install-rock64-rk3328-u-boot)))
+   (disk-image-installer install-rock64-rk3328-u-boot)))

 (define u-boot-rockpro64-rk3399-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-rockpro64-rk3399)
-   (installer install-rockpro64-rk3399-u-boot)))
+   (disk-image-installer install-rockpro64-rk3399-u-boot)))

 (define u-boot-pinebook-pro-rk3399-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-pinebook-pro-rk3399)
-   (installer install-pinebook-pro-rk3399-u-boot)))
+   (disk-image-installer install-pinebook-pro-rk3399-u-boot)))
@@ -321,7 +321,7 @@ improvement."
 (define (boot-time-system)
  "Return the '--system' argument passed on the kernel command line."
  (find-long-option "--system" (if (string-contains %host-type "linux-gnu")
-                                   linux-command-line
+                                   (linux-command-line)
                                   (command-line))))

 (define* (activate-current-system
@@ -22,6 +22,8 @@
  #:use-module (guix utils)
  #:use-module (ice-9 binary-ports)
  #:use-module (ice-9 format)
+  #:use-module (rnrs io ports)
+  #:use-module (rnrs io simple)
  #:export (write-file-on-device
            install-efi-loader))

@@ -35,11 +37,17 @@
  (call-with-input-file file
    (lambda (input)
      (let ((bv (get-bytevector-n input size)))
-        (call-with-output-file device
-          (lambda (output)
-            (seek output offset SEEK_SET)
-            (put-bytevector output bv))
-          #:binary #t)))))
+        (call-with-port
+         ;; Do not use "call-with-output-file" that would truncate the file.
+         (open-file-output-port device
+                                (file-options no-truncate no-fail)
+                                (buffer-mode block)
+                                ;; Use the binary-friendly ISO-8859-1
+                                ;; encoding.
+                                (make-transcoder (latin-1-codec)))
+         (lambda (output)
+           (seek output offset SEEK_SET)
+           (put-bytevector output bv)))))))


 ;;;
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 David Craven <david@craven.ch>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
@@ -179,6 +179,46 @@ if DEVICE does not contain an ext2 file system."
    (2 'reboot-required)
    (_ 'fatal-error)))

+
+;;;
+;;; Linux swap.
+;;;
+
+;; Linux "swap space" is not a file system but it has a UUID and volume name,
+;; like actual file systems, and we want to be able to look up swap partitions
+;; by UUID and by label.
+
+(define %linux-swap-magic
+  (string->utf8 "SWAPSPACE2"))
+
+;; Like 'PAGE_SIZE' in Linux, arch/x86/include/asm/page.h.
+;; XXX: This is always 4K on x86_64, i386, and ARMv7.  However, on AArch64,
+;; this is determined by 'CONFIG_ARM64_PAGE_SHIFT' in the kernel, which is 12
+;; by default (4K) but can be 14 or 16.
+(define %page-size 4096)
+
+(define (linux-swap-superblock? sblock)
+  "Return #t when SBLOCK is an linux-swap superblock."
+  (and (= (bytevector-length sblock) %page-size)
+       (bytevector=? (sub-bytevector sblock (- %page-size 10) 10)
+                     %linux-swap-magic)))
+
+(define (read-linux-swap-superblock device)
+  "Return the raw contents of DEVICE's linux-swap superblock as a bytevector, or #f
+if DEVICE does not contain an linux-swap file system."
+  (read-superblock device 0 %page-size linux-swap-superblock?))
+
+;; See 'union swap_header' in 'include/linux/swap.h'.
+
+(define (linux-swap-superblock-uuid sblock)
+  "Return the UUID of Linux-swap superblock SBLOCK as a 16-byte bytevector."
+  (sub-bytevector sblock (+ 1024 4 4 4) 16))
+
+(define (linux-swap-superblock-volume-name sblock)
+  "Return the label of Linux-swap superblock SBLOCK as a string."
+  (null-terminated-latin1->string
+   (sub-bytevector sblock (+ 1024 4 4 4 16) 16)))
+

 ;;;
 ;;; Btrfs file systems.
@@ -476,6 +516,42 @@ not valid header was found."
  (let ((uuid (sub-bytevector header 168 36)))
    (string->uuid (utf8->string uuid))))

+
+;;;
+;;; NTFS file systems.
+;;;
+
+;; Taken from <linux-libre>/fs/ntfs/layout.h
+
+(define-syntax %ntfs-endianness
+  ;; Endianness of NTFS file systems.
+  (identifier-syntax (endianness little)))
+
+(define (ntfs-superblock? sblock)
+  "Return #t when SBLOCK is a NTFS superblock."
+  (bytevector=? (sub-bytevector sblock 3 8)
+                (string->utf8 "NTFS    ")))
+
+(define (read-ntfs-superblock device)
+  "Return the raw contents of DEVICE's NTFS superblock as a bytevector, or #f
+if DEVICE does not contain a NTFS file system."
+  (read-superblock device 0 511 ntfs-superblock?))
+
+(define (ntfs-superblock-uuid sblock)
+  "Return the UUID of NTFS superblock SBLOCK as a 8-byte bytevector."
+  (sub-bytevector sblock 72 8))
+
+;; TODO: Add ntfs-superblock-volume-name.  The partition label is not stored
+;; in the BOOT SECTOR like the UUID, but in the MASTER FILE TABLE, which seems
+;; way harder to access.
+
+(define (check-ntfs-file-system device)
+  "Return the health of a NTFS file system on DEVICE."
+  (match (status:exit-val
+          (system* "ntfsfix" device))
+    (0 'pass)
+    (_ 'fatal-error)))
+

 ;;;
 ;;; Partition lookup.
@@ -560,6 +636,8 @@ partition field reader that returned a value."
                                iso9660-superblock-volume-name)
        (partition-field-reader read-ext2-superblock
                                ext2-superblock-volume-name)
+        (partition-field-reader read-linux-swap-superblock
+                                linux-swap-superblock-volume-name)
        (partition-field-reader read-btrfs-superblock
                                btrfs-superblock-volume-name)
        (partition-field-reader read-fat32-superblock
@@ -576,6 +654,8 @@ partition field reader that returned a value."
                                iso9660-superblock-uuid)
        (partition-field-reader read-ext2-superblock
                                ext2-superblock-uuid)
+        (partition-field-reader read-linux-swap-superblock
+                                linux-swap-superblock-uuid)
        (partition-field-reader read-btrfs-superblock
                                btrfs-superblock-uuid)
        (partition-field-reader read-fat32-superblock
@@ -585,7 +665,9 @@ partition field reader that returned a value."
        (partition-field-reader read-jfs-superblock
                                jfs-superblock-uuid)
        (partition-field-reader read-f2fs-superblock
-                                f2fs-superblock-uuid)))
+                                f2fs-superblock-uuid)
+        (partition-field-reader read-ntfs-superblock
+                                ntfs-superblock-uuid)))

 (define read-partition-label
  (cut read-partition-field <> %partition-label-readers))
@@ -637,7 +719,8 @@ were found."

 (define (canonicalize-device-spec spec)
  "Return the device name corresponding to SPEC, which can be a <uuid>, a
-<file-system-label>, or a string (typically a /dev file name)."
+<file-system-label>, or a string (typically a /dev file name or an nfs-root
+containing ':/')."
  (define max-trials
    ;; Number of times we retry partition label resolution, 1 second per
    ;; trial.  Note: somebody reported a delay of 16 seconds (!) before their
@@ -684,6 +767,7 @@ were found."
     ((string-suffix? "fat" type) check-fat-file-system)
     ((string-prefix? "jfs" type) check-jfs-file-system)
     ((string-prefix? "f2fs" type) check-f2fs-file-system)
+     ((string-prefix? "ntfs" type) check-ntfs-file-system)
     ((string-prefix? "nfs" type) (const 'pass))
     (else #f)))

@@ -775,26 +859,33 @@ corresponds to the symbols listed in FLAGS."
    (when (file-system-check? fs)
      (check-file-system source type))

-    ;; Create the mount point.  Most of the time this is a directory, but
-    ;; in the case of a bind mount, a regular file or socket may be needed.
-    (if (and (= MS_BIND (logand flags MS_BIND))
-             (not (file-is-directory? source)))
-        (unless (file-exists? mount-point)
-          (mkdir-p (dirname mount-point))
-          (call-with-output-file mount-point (const #t)))
-        (mkdir-p mount-point))
+    (catch 'system-error
+      (lambda ()
+        ;; Create the mount point.  Most of the time this is a directory, but
+        ;; in the case of a bind mount, a regular file or socket may be
+        ;; needed.
+        (if (and (= MS_BIND (logand flags MS_BIND))
+                 (not (file-is-directory? source)))
+            (unless (file-exists? mount-point)
+              (mkdir-p (dirname mount-point))
+              (call-with-output-file mount-point (const #t)))
+            (mkdir-p mount-point))

-    (cond
-     ((string-prefix? "nfs" type)
-      (mount-nfs source mount-point type flags options))
-     (else
-      (mount source mount-point type flags options)))
+        (cond
+         ((string-prefix? "nfs" type)
+          (mount-nfs source mount-point type flags options))
+         (else
+          (mount source mount-point type flags options)))

-    ;; For read-only bind mounts, an extra remount is needed, as per
-    ;; <http://lwn.net/Articles/281157/>, which still applies to Linux 4.0.
-    (when (and (= MS_BIND (logand flags MS_BIND))
-               (= MS_RDONLY (logand flags MS_RDONLY)))
-      (let ((flags (logior MS_BIND MS_REMOUNT MS_RDONLY)))
-        (mount source mount-point type flags #f)))))
+        ;; For read-only bind mounts, an extra remount is needed, as per
+        ;; <http://lwn.net/Articles/281157/>, which still applies to Linux
+        ;; 4.0.
+        (when (and (= MS_BIND (logand flags MS_BIND))
+                   (= MS_RDONLY (logand flags MS_RDONLY)))
+          (let ((flags (logior MS_BIND MS_REMOUNT MS_RDONLY)))
+            (mount source mount-point type flags #f))))
+      (lambda args
+        (or (file-system-mount-may-fail? fs)
+            (apply throw args))))))

 ;;; file-systems.scm ends here
@@ -107,13 +107,17 @@ Return the value associated with OPTION, or #f on failure."
  ;; settings?
  )

-(define (xattr-translator? file-name)
+(define (passive-translator-xattr? file-name)
  "Return true if FILE-NAME has an extended @code{gnu.translator} attribute
 set."
-  (false-if-exception
-   (not (string-null? (getxattr file-name "gnu.translator")))))
+  (catch 'system-error
+    (lambda _ (not (string-null? (getxattr file-name "gnu.translator"))))
+    (lambda args
+      (if (= ENODATA (system-error-errno args))
+          #f
+          (apply throw args)))))

-(define (showtrans-translator? file-name)
+(define (passive-translator-installed? file-name)
  "Return true if @file{showtrans} finds a translator installed on FILE-NAME."
  (with-output-to-port (%make-void-port "w")
    (lambda _
@@ -124,10 +128,10 @@ set."
 (define (translated? file-name)
  "Return true if a translator is installed on FILE-NAME."
  (if (string-contains %host-type "linux-gnu")
-      (xattr-translator? file-name)
-      (showtrans-translator? file-name)))
+      (passive-translator-xattr? file-name)
+      (passive-translator-installed? file-name)))

-(define* (setup-translator file-name command #:optional (mode #o600))
+(define* (set-translator file-name command #:optional (mode #o600))
  "Setup translator COMMAND on FILE-NAME."
  (unless (translated? file-name)
    (let ((dir (dirname file-name)))
@@ -147,19 +151,33 @@ set."
                  (strerror errno) file-name)
          (format (current-error-port) "Ignoring...Good Luck!\n"))))))

+(define-syntax-rule (false-if-EEXIST exp)
+  "Evaluate EXP but return #f if it raises to 'system-error with EEXIST."
+  (catch 'system-error
+    (lambda () exp)
+    (lambda args
+      (if (= EEXIST (system-error-errno args))
+          #f
+          (apply throw args)))))
+
 (define* (set-hurd-device-translators #:optional (root "/"))
  "Make some of the device nodes needed on GNU/Hurd."

  (define (scope dir)
    (string-append root (if (string-suffix? "/" root) "" "/") dir))

-  (define scope-setup-translator
+  (define scope-set-translator
    (match-lambda
      ((file-name command)
-       (scope-setup-translator (list file-name command #o600)))
+       (scope-set-translator (list file-name command #o600)))
      ((file-name command mode)
       (let ((mount-point (scope file-name)))
-         (setup-translator mount-point command mode)))))
+         (set-translator mount-point command mode)))))
+
+  (define (mkdir* dir)
+    (let ((dir (scope dir)))
+     (unless (file-exists? dir)
+       (mkdir-p dir))))

  (define servers
    '(("servers/crash-dump-core" ("/hurd/crash" "--dump-core"))
@@ -173,7 +191,8 @@ set."
                                  "10.0.2.15" ;the default QEMU guest IP
                                  "--netmask" "255.255.255.0"
                                  "--gateway" "10.0.2.2"
-                                  "--ipv6" "/servers/socket/16"))))
+                                  "--ipv6" "/servers/socket/16"))
+      ("proc"                    ("/hurd/procfs" "--stat-mode=444"))))

  (define devices
    '(("dev/full"    ("/hurd/null"     "--full")            #o666)
@@ -192,6 +211,9 @@ set."
      ("dev/vcs"     ("/hurd/console"))
      ("dev/tty"     ("/hurd/magic"    "tty")               #o666)

+      ;; 'fd_to_filename' in libc expects it.
+      ("dev/fd"      ("/hurd/magic"    "--directory" "fd")  #o555)
+
      ("dev/tty1"    ("/hurd/term"     "/dev/tty1" "hurdio" "/dev/vcs/1/console")
                                                            #o666)
      ("dev/tty2"    ("/hurd/term"     "/dev/tty2" "hurdio" "/dev/vcs/2/console")
@@ -213,18 +235,23 @@ set."
      ("dev/ttyp2"   ("/hurd/term"     "/dev/ttyp2" "pty-slave" "/dev/ptyp2")
                                                            #o666)))

-  (for-each scope-setup-translator servers)
-  (false-if-exception (mkdir-p (scope "dev/vcs/1")))
-  (false-if-exception (mkdir-p (scope "dev/vcs/2")))
-  (false-if-exception (mkdir-p (scope "dev/vcs/3")))
-  (false-if-exception (rename-file "/dev/console" "/dev/console-"))
-  (for-each scope-setup-translator devices)
+  (for-each scope-set-translator servers)
+  (mkdir* "dev/vcs/1")
+  (mkdir* "dev/vcs/2")
+  (mkdir* "dev/vcs/2")
+  (rename-file (scope "dev/console") (scope "dev/console-"))
+  (for-each scope-set-translator devices)

-  (false-if-exception (symlink "/dev/random" "/dev/urandom"))
-  (false-if-exception (mkdir-p "/dev/fd"))
-  (false-if-exception (symlink "/dev/fd/0"   "/dev/stdin"))
-  (false-if-exception (symlink "/dev/fd/1"   "/dev/stdout"))
-  (false-if-exception (symlink "/dev/fd/2"   "/dev/stderr")))
+  (false-if-EEXIST (symlink "/dev/random" (scope "dev/urandom")))
+  (false-if-EEXIST (symlink "/dev/fd/0" (scope "dev/stdin")))
+  (false-if-EEXIST (symlink "/dev/fd/1" (scope "dev/stdout")))
+  (false-if-EEXIST (symlink "/dev/fd/2" (scope "dev/stderr")))
+  (false-if-EEXIST (symlink "crash-dump-core" (scope "servers/crash")))
+
+  ;; Make sure /etc/mtab is a symlink to /proc/mounts.
+  (false-if-exception (delete-file (scope "etc/mtab")))
+  (mkdir* (scope "etc"))
+  (symlink "/proc/mounts" (scope "etc/mtab")))


 (define* (boot-hurd-system #:key (on-error 'debug))
@@ -37,6 +37,7 @@
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:export (make-partition-image
+            convert-disk-image
            genimage
            initialize-efi-partition
            initialize-root-partition
@@ -77,7 +78,7 @@ take the partition metadata size into account, take a 25% margin."
        (uuid (partition-uuid partition))
        (journal-options "lazy_itable_init=1,lazy_journal_init=1"))
    (apply invoke
-           `("mke2fs" "-t" ,fs "-d" ,root
+           `("fakeroot" "mke2fs" "-t" ,fs "-d" ,root
             "-L" ,label "-U" ,(uuid->string uuid)
             "-E" ,(format #f "root_owner=~a:~a,~a"
                           owner-uid owner-gid journal-options)
@@ -93,7 +94,8 @@ take the partition metadata size into account, take a 25% margin."
  "Handle the creation of VFAT partition images.  See 'make-partition-image'."
  (let ((size (partition-size partition))
        (label (partition-label partition)))
-    (invoke "mkdosfs" "-n" label "-C" target "-F" "16" "-S" "1024"
+    (invoke "fakeroot" "mkdosfs" "-n" label "-C" target
+            "-F" "16" "-S" "1024"
            (size-in-kib
             (if (eq? size 'guess)
                 (estimate-partition-size root)
@@ -116,33 +118,46 @@ ROOT directory to populate the image."
     ((string=? type "vfat")
      (make-vfat-image partition target root))
     (else
-      (format (current-error-port)
-              "Unsupported partition type~%.")))))
+      (raise (condition
+              (&message
+               (message "unsupported partition type"))))))))

-(define* (genimage config target)
+(define (convert-disk-image image format output)
+  "Convert IMAGE to OUTPUT according to the given FORMAT."
+  (case format
+    ((compressed-qcow2)
+     (invoke "qemu-img" "convert" "-c" "-f" "raw"
+             "-O" "qcow2" image output))
+    (else
+     (copy-file image output))))
+
+(define* (genimage config)
  "Use genimage to generate in TARGET directory, the image described in the
 given CONFIG file."
  ;; genimage needs a 'root' directory.
  (mkdir "root")
-  (invoke "genimage" "--config" config
-          "--outputpath" target))
+  (invoke "genimage" "--config" config))

 (define* (register-closure prefix closure
                           #:key
                           (deduplicate? #t) (reset-timestamps? #t)
-                           (schema (sql-schema)))
+                           (schema (sql-schema))
+                           (wal-mode? #t))
  "Register CLOSURE in PREFIX, where PREFIX is the directory name of the
 target store and CLOSURE is the name of a file containing a reference graph as
 produced by #:references-graphs..  As a side effect, if RESET-TIMESTAMPS? is
 true, reset timestamps on store files and, if DEDUPLICATE? is true,
-deduplicates files common to CLOSURE and the rest of PREFIX."
+deduplicates files common to CLOSURE and the rest of PREFIX.  Pass WAL-MODE?
+to call-with-database."
  (let ((items (call-with-input-file closure read-reference-graph)))
-    (register-items items
-                    #:prefix prefix
-                    #:deduplicate? deduplicate?
-                    #:reset-timestamps? reset-timestamps?
-                    #:registration-time %epoch
-                    #:schema schema)))
+    (parameterize ((sql-schema schema))
+      (with-database (store-database-file #:prefix prefix) db
+       #:wal-mode? wal-mode?
+       (register-items db items
+                       #:prefix prefix
+                       #:deduplicate? deduplicate?
+                       #:reset-timestamps? reset-timestamps?
+                       #:registration-time %epoch)))))

 (define* (initialize-efi-partition root
                                   #:key
@@ -161,28 +176,31 @@ deduplicates files common to CLOSURE and the rest of PREFIX."
                                    references-graphs
                                    (register-closures? #t)
                                    system-directory
-                                    (make-device-nodes
-                                     make-essential-device-nodes)
+                                    make-device-nodes
+                                    (wal-mode? #t)
                                    #:allow-other-keys)
  "Initialize the given ROOT directory. Use BOOTCFG and BOOTCFG-LOCATION to
 install the bootloader configuration.

 If REGISTER-CLOSURES? is true, register REFERENCES-GRAPHS in the store.  If
 DEDUPLICATE? is true, then also deduplicate files common to CLOSURES and the
-rest of the store when registering the closures. SYSTEM-DIRECTORY is the name
-of the directory of the 'system' derivation."
+rest of the store when registering the closures.  SYSTEM-DIRECTORY is the name
+of the directory of the 'system' derivation.  Pass WAL-MODE? to
+register-closure."
  (populate-root-file-system system-directory root)
  (populate-store references-graphs root)

  ;; Populate /dev.
-  (make-device-nodes root)
+  (when make-device-nodes
+    (make-device-nodes root))

  (when register-closures?
    (for-each (lambda (closure)
                (register-closure root
                                  closure
                                  #:reset-timestamps? #t
-                                  #:deduplicate? deduplicate?))
+                                  #:deduplicate? deduplicate?
+                                  #:wal-mode? wal-mode?))
              references-graphs))

  (when bootloader-installer
@@ -18,6 +18,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu build install)
+  #:use-module (guix build syscalls)
  #:use-module (guix build utils)
  #:use-module (guix build store-copy)
  #:use-module (srfi srfi-26)
@@ -26,7 +27,9 @@
            evaluate-populate-directive
            populate-root-file-system
            install-database-and-gc-roots
-            populate-single-profile-directory))
+            populate-single-profile-directory
+            mount-cow-store
+            unmount-cow-store))

 ;;; Commentary:
 ;;;
@@ -229,4 +232,43 @@ This is used to create the self-contained tarballs with 'guix pack'."
    (_
     #t)))

+(define (mount-cow-store target backing-directory)
+  "Make the store copy-on-write, using TARGET as the backing store.  This is
+useful when TARGET is on a hard disk, whereas the current store is on a RAM
+disk."
+  (define (set-store-permissions directory)
+    "Set the right perms on DIRECTORY to use it as the store."
+    (chown directory 0 30000)      ;use the fixed 'guixbuild' GID
+    (chmod directory #o1775))
+
+  (let ((tmpdir (string-append target "/tmp")))
+    (mkdir-p tmpdir)
+    (mount tmpdir "/tmp" "none" MS_BIND))
+
+  (let* ((rw-dir (string-append target backing-directory))
+         (work-dir (string-append rw-dir "/../.overlayfs-workdir")))
+    (mkdir-p rw-dir)
+    (mkdir-p work-dir)
+    (mkdir-p "/.rw-store")
+    (set-store-permissions rw-dir)
+    (set-store-permissions "/.rw-store")
+
+    ;; Mount the overlay, then atomically make it the store.
+    (mount "none" "/.rw-store" "overlay" 0
+           (string-append "lowerdir=" (%store-directory) ","
+                          "upperdir=" rw-dir ","
+                          "workdir=" work-dir))
+    (mount "/.rw-store" (%store-directory) "" MS_MOVE)
+    (rmdir "/.rw-store")))
+
+(define (unmount-cow-store target backing-directory)
+  "Unmount copy-on-write store."
+  (let ((tmp-dir "/remove"))
+    (mkdir-p tmp-dir)
+    (mount (%store-directory) tmp-dir "" MS_MOVE)
+    (umount tmp-dir)
+    (rmdir tmp-dir)
+    (delete-file-recursively
+     (string-append target backing-directory))))
+
 ;;; install.scm ends here
@@ -469,9 +469,10 @@ upon error."

  (define (device-string->file-system-device device-string)
    ;; The "--root=SPEC" kernel command-line option always provides a
-    ;; string, but the string can represent a device, a UUID, or a
-    ;; label.  So check for all three.
+    ;; string, but the string can represent a device, an nfs-root, a UUID, or a
+    ;; label.  So check for all four.
    (cond ((string-prefix? "/" device-string) device-string)
+          ((string-contains device-string ":/") device-string) ; nfs-root
          ((uuid device-string) => identity)
          (else (file-system-label device-string))))

@@ -170,7 +170,8 @@ for the process."
    (pivot-root root put-old)
    (chdir "/")
    (umount "real-root" MNT_DETACH)
-    (rmdir "real-root")))
+    (rmdir "real-root")
+    (chmod "/" #o755)))

 (define* (initialize-user-namespace pid host-uids
                                    #:key (guest-uid 0) (guest-gid 0))
@@ -243,7 +244,8 @@ that host UIDs (respectively GIDs) map to in the namespace."
             (match (read child)
               ('ready
                (purify-environment)
-                (when (memq 'mnt namespaces)
+                (when (and (memq 'mnt namespaces)
+                           (not (string=? root "/")))
                  (catch #t
                    (lambda ()
                      (mount-file-systems root mounts
@@ -24,6 +24,7 @@
  #:use-module (guix build syscalls)
  #:use-module ((guix build utils) #:select (find-files invoke))
  #:use-module (guix build union)
+  #:autoload   (zlib) (call-with-gzip-input-port)
  #:use-module (rnrs io ports)
  #:use-module (rnrs bytevectors)
  #:use-module (srfi srfi-1)
@@ -94,10 +95,28 @@ string list."
    (cons (string->symbol (string-take str =))
          (string-drop str (+ 1 =)))))

+;; Matches kernel modules, without compression, with GZIP compression or with
+;; XZ compression.
+(define module-regex "\\.ko(\\.gz|\\.xz)?$")
+
 (define (modinfo-section-contents file)
  "Return the contents of the '.modinfo' section of FILE as a list of
 key/value pairs.."
-  (let* ((bv      (call-with-input-file file get-bytevector-all))
+  (define (get-bytevector file)
+    (cond
+     ((string-suffix? ".ko.gz" file)
+      (let ((port (open-file file "r0")))
+        (dynamic-wind
+          (lambda ()
+            #t)
+          (lambda ()
+            (call-with-gzip-input-port port get-bytevector-all))
+          (lambda ()
+            (close-port port)))))
+     (else
+      (call-with-input-file file get-bytevector-all))))
+
+  (let* ((bv      (get-bytevector file))
         (elf     (parse-elf bv))
         (section (elf-section-by-name elf ".modinfo"))
         (modinfo (section-contents elf section)))
@@ -110,7 +129,7 @@ key/value pairs.."
 (define (module-formal-name file)
  "Return the module name of FILE as it appears in its info section.  Usually
 the module name is the same as the base name of FILE, modulo hyphens and minus
-the \".ko\" extension."
+the \".ko[.gz|.xz]\" extension."
  (match (assq 'name (modinfo-section-contents file))
    (('name . name) name)
    (#f #f)))
@@ -171,14 +190,25 @@ modules that can be postloaded, of the soft dependencies of module FILE."
                 (_ #f))
                (modinfo-section-contents file))))

-(define dot-ko
-  (cut string-append <> ".ko"))
+(define (strip-extension filename)
+  (let ((extension (string-index filename #\.)))
+    (if extension
+        (string-take filename extension)
+        filename)))

-(define (ensure-dot-ko name)
-  "Return NAME with a '.ko' prefix appended, unless it already has it."
-  (if (string-suffix? ".ko" name)
+(define (dot-ko name compression)
+  (let ((suffix (match compression
+                  ('xz   ".ko.xz")
+                  ('gzip ".ko.gz")
+                  (else  ".ko"))))
+    (string-append name suffix)))
+
+(define (ensure-dot-ko name compression)
+  "Return NAME with a '.ko[.gz|.xz]' suffix appended, unless it already has
+it."
+  (if (string-contains name ".ko")
      name
-      (dot-ko name)))
+      (dot-ko name compression)))

 (define (normalize-module-name module)
  "Return the \"canonical\" name for MODULE, replacing hyphens with
@@ -191,9 +221,9 @@ underscores."
              module))

 (define (file-name->module-name file)
-  "Return the module name corresponding to FILE, stripping the trailing '.ko'
-and normalizing it."
-  (normalize-module-name (basename file ".ko")))
+  "Return the module name corresponding to FILE, stripping the trailing
+'.ko[.gz|.xz]' and normalizing it."
+  (normalize-module-name (strip-extension (basename file))))

 (define (find-module-file directory module)
  "Lookup module NAME under DIRECTORY, and return its absolute file name.
@@ -208,19 +238,19 @@ whereas file names often, but not always, use hyphens.  Examples:
    ;; List of possible file names.  XXX: It would of course be cleaner to
    ;; have a database that maps module names to file names and vice versa,
    ;; but everyone seems to be doing hacks like this one.  Oh well!
-    (map ensure-dot-ko
-         (delete-duplicates
-          (list module
-                (normalize-module-name module)
-                (string-map (lambda (chr) ;converse of 'normalize-module-name'
-                              (case chr
-                                ((#\_) #\-)
-                                (else chr)))
-                            module)))))
+    (delete-duplicates
+     (list module
+           (normalize-module-name module)
+           (string-map (lambda (chr) ;converse of 'normalize-module-name'
+                         (case chr
+                           ((#\_) #\-)
+                           (else chr)))
+                       module))))

  (match (find-files directory
                     (lambda (file stat)
-                       (member (basename file) names)))
+                       (member (strip-extension
+                                (basename file)) names)))
    ((file)
     file)
    (()
@@ -290,8 +320,8 @@ not a file name."
                             (recursive? #t)
                             (lookup-module dot-ko)
                             (black-list (module-black-list)))
-  "Load Linux module from FILE, the name of a '.ko' file; return true on
-success, false otherwise.  When RECURSIVE? is true, load its dependencies
+  "Load Linux module from FILE, the name of a '.ko[.gz|.xz]' file; return true
+on success, false otherwise.  When RECURSIVE? is true, load its dependencies
 first (à la 'modprobe'.)  The actual files containing modules depended on are
 obtained by calling LOOKUP-MODULE with the module name.  Modules whose name
 appears in BLACK-LIST are not loaded."
@@ -523,16 +553,29 @@ are required to access DEVICE."
 ;;; Module databases.
 ;;;

-(define (module-name->file-name/guess directory name)
+(define* (module-name->file-name/guess directory name
+                                       #:key compression)
  "Guess the file name corresponding to NAME, a module name.  That doesn't
 always work because sometimes underscores in NAME map to hyphens (e.g.,
-\"input-leds.ko\"), sometimes not (e.g., \"mac_hid.ko\")."
-  (string-append directory "/" (ensure-dot-ko name)))
+\"input-leds.ko\"), sometimes not (e.g., \"mac_hid.ko\").  If the module is
+compressed then COMPRESSED can be set to 'xz or 'gzip, depending on the
+compression type."
+  (string-append directory "/" (ensure-dot-ko name compression)))

 (define (module-name-lookup directory)
  "Return a one argument procedure that takes a module name (e.g.,
 \"input_leds\") and returns its absolute file name (e.g.,
 \"/.../input-leds.ko\")."
+  (define (guess-file-name name)
+    (let ((names (list
+                  (module-name->file-name/guess directory name)
+                  (module-name->file-name/guess directory name
+                                                #:compression 'xz)
+                  (module-name->file-name/guess directory name
+                                                #:compression 'gzip))))
+      (or (find file-exists? names)
+          (first names))))
+
  (catch 'system-error
    (lambda ()
      (define mapping
@@ -541,23 +584,23 @@ always work because sometimes underscores in NAME map to hyphens (e.g.,

      (lambda (name)
        (or (assoc-ref mapping name)
-            (module-name->file-name/guess directory name))))
+            (guess-file-name name))))
    (lambda args
      (if (= ENOENT (system-error-errno args))
-          (cut module-name->file-name/guess directory <>)
+          (cut guess-file-name <>)
          (apply throw args)))))

 (define (write-module-name-database directory)
  "Write a database that maps \"module names\" as they appear in the relevant
-ELF section of '.ko' files, to actual file names.  This format is
+ELF section of '.ko[.gz|.xz]' files, to actual file names.  This format is
 Guix-specific.  It aims to deal with inconsistent naming, in particular
 hyphens vs. underscores."
  (define mapping
    (map (lambda (file)
           (match (module-formal-name file)
-             (#f   (cons (basename file ".ko") file))
+             (#f   (cons (strip-extension (basename file)) file))
             (name (cons name file))))
-         (find-files directory "\\.ko$")))
+         (find-files directory module-regex)))

  (call-with-output-file (string-append directory "/modules.name")
    (lambda (port)
@@ -569,12 +612,12 @@ hyphens vs. underscores."
      (pretty-print mapping port))))

 (define (write-module-alias-database directory)
-  "Traverse the '.ko' files in DIRECTORY and create the corresponding
+  "Traverse the '.ko[.gz|.xz]' files in DIRECTORY and create the corresponding
 'modules.alias' file."
  (define aliases
    (map (lambda (file)
           (cons (file-name->module-name file) (module-aliases file)))
-         (find-files directory "\\.ko$")))
+         (find-files directory module-regex)))

  (call-with-output-file (string-append directory "/modules.alias")
    (lambda (port)
@@ -616,7 +659,7 @@ are found, return a tuple (DEVNAME TYPE MAJOR MINOR), otherwise return #f."
  (char-set-complement (char-set #\-)))

 (define (write-module-device-database directory)
-  "Traverse the '.ko' files in DIRECTORY and create the corresponding
+  "Traverse the '.ko[.gz|.xz]' files in DIRECTORY and create the corresponding
 'modules.devname' file.  This file contains information about modules that can
 be loaded on-demand, such as file system modules."
  (define aliases
@@ -624,7 +667,7 @@ be loaded on-demand, such as file system modules."
                  (match (aliases->device-tuple (module-aliases file))
                    (#f #f)
                    (tuple (cons (file-name->module-name file) tuple))))
-                (find-files directory "\\.ko$")))
+                (find-files directory module-regex)))

  (call-with-output-file (string-append directory "/modules.devname")
    (lambda (port)
@@ -0,0 +1,190 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build secret-service)
+  #:use-module (guix build utils)
+
+  #:use-module (srfi srfi-26)
+  #:use-module (rnrs bytevectors)
+  #:use-module (ice-9 binary-ports)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 rdelim)
+
+  #:export (secret-service-receive-secrets
+            secret-service-send-secrets))
+
+;;; Commentary:
+;;;
+;;; Utility procedures for copying secrets into a VM.
+;;;
+;;; Code:
+
+(define-syntax log
+  (lambda (s)
+    "Log the given message."
+    (syntax-case s ()
+      ((_ fmt args ...)
+       (with-syntax ((fmt (string-append "secret service: "
+                                         (syntax->datum #'fmt))))
+         ;; Log to the current output port.  That way, when
+         ;; 'secret-service-send-secrets' is called from shepherd, output goes
+         ;; to syslog.
+         #'(format (current-output-port) fmt args ...))))))
+
+(define* (secret-service-send-secrets port secret-root
+                                      #:key (retry 60)
+                                      (handshake-timeout 120))
+  "Copy all files under SECRET-ROOT using TCP to secret-service listening at
+local PORT.  If connect fails, sleep 1s and retry RETRY times; once connected,
+wait for at most HANDSHAKE-TIMEOUT seconds for handshake to complete.  Return
+#f on failure."
+  (define (file->file+size+mode file-name)
+    (let ((stat (stat file-name))
+          (target (substring file-name (string-length secret-root))))
+      (list target (stat:size stat) (stat:mode stat))))
+
+  (define (send-files sock)
+    (let* ((files (if secret-root (find-files secret-root) '()))
+           (files-sizes-modes (map file->file+size+mode files))
+           (secrets `(secrets
+                      (version 0)
+                      (files ,files-sizes-modes))))
+      (write secrets sock)
+      (for-each (lambda (file)
+                  (call-with-input-file file
+                    (lambda (input)
+                      (dump-port input sock))))
+                files)))
+
+  (log "sending secrets to ~a~%" port)
+  (let ((sock (socket AF_INET SOCK_STREAM 0))
+        (addr (make-socket-address AF_INET INADDR_LOOPBACK port)))
+    ;; Connect to QEMU on the forwarded port.  The 'connect' call succeeds as
+    ;; soon as QEMU is ready, even if there's no server listening on the
+    ;; forward port inside the guest.
+    (let loop ((retry retry))
+      (catch 'system-error
+        (cute connect sock addr)
+        (lambda (key . args)
+          (when (zero? retry)
+            (apply throw key args))
+          (log "retrying connection [~a attempts left]~%"
+               (- retry 1))
+          (sleep 1)
+          (loop (1- retry)))))
+
+    (log "connected; waiting for handshake...~%")
+
+    ;; Wait for "hello" message from the server.  This is the only way to know
+    ;; that we're really connected to the server inside the guest.
+    (match (select (list sock) '() '() handshake-timeout)
+      (((_) () ())
+       (match (read sock)
+         (('secret-service-server ('version version ...))
+          (log "sending files from ~s...~%" secret-root)
+          (send-files sock)
+          (log "done sending files to port ~a~%" port)
+          (close-port sock)
+          secret-root)
+         (x
+          (log "invalid handshake ~s~%" x)
+          (close-port sock)
+          #f)))
+      ((() () ())                                 ;timeout
+       (log "timeout while sending files to ~a~%" port)
+       (close-port sock)
+       #f))))
+
+(define (secret-service-receive-secrets port)
+  "Listen to local PORT and wait for a secret service client to send secrets.
+Write them to the file system.  Return the list of files installed on success,
+and #f otherwise."
+
+  (define (wait-for-client port)
+    ;; Wait for a TCP connection on PORT.  Note: We cannot use the
+    ;; virtio-serial ports, which would be safer, because they are
+    ;; (presumably) unsupported on GNU/Hurd.
+    (let ((sock (socket AF_INET SOCK_STREAM 0)))
+      (bind sock AF_INET INADDR_ANY port)
+      (listen sock 1)
+      (log "waiting for secrets on port ~a...~%" port)
+      (match (select (list sock) '() '() 60)
+        (((_) () ())
+         (match (accept sock)
+           ((client . address)
+            (log "client connection from ~a~%"
+                 (inet-ntop (sockaddr:fam address)
+                            (sockaddr:addr address)))
+
+            ;; Send a "hello" message.  This allows the client running on the
+            ;; host to know that it's now actually connected to server running
+            ;; in the guest.
+            (write '(secret-service-server (version 0)) client)
+            (force-output client)
+            (close-port sock)
+            client)))
+        ((() () ())
+         (log "did not receive any secrets; time out~%")
+         (close-port sock)
+         #f))))
+
+  ;; TODO: Remove when (@ (guix build utils) dump-port) has a 'size'
+  ;; parameter.
+  (define (dump in out size)
+    ;; Copy SIZE bytes from IN to OUT.
+    (define buf-size 65536)
+    (define buf (make-bytevector buf-size))
+
+    (let loop ((left size))
+      (if (<= left 0)
+          0
+          (let ((read (get-bytevector-n! in buf 0 (min left buf-size))))
+            (if (eof-object? read)
+                left
+                (begin
+                  (put-bytevector out buf 0 read)
+                  (loop (- left read))))))))
+
+  (define (read-secrets port)
+    ;; Read secret files from PORT and install them.
+    (match (false-if-exception (read port))
+      (('secrets ('version 0)
+                 ('files ((files sizes modes) ...)))
+       (for-each (lambda (file size mode)
+                   (log "installing file '~a' (~a bytes)...~%"
+                        file size)
+                   (mkdir-p (dirname file))
+                   (call-with-output-file file
+                     (lambda (output)
+                       (dump port output size)
+                       (chmod file mode))))
+                 files sizes modes)
+       (log "received ~a secret files~%" (length files))
+       files)
+      (_
+       (log "invalid secrets received~%")
+       #f)))
+
+  (let* ((port   (wait-for-client port))
+         (result (and=> port read-secrets)))
+    (when port
+      (close-port port))
+    result))
+
+;;; secret-service.scm ends here
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Mathieu Othacehe <othacehe@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,8 +22,10 @@
  #:use-module (gnu build linux-container)
  #:use-module (guix build utils)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
  #:use-module (ice-9 match)
-  #:export (make-forkexec-constructor/container))
+  #:export (make-forkexec-constructor/container
+            fork+exec-command/container))

 ;;; Commentary:
 ;;;
@@ -91,7 +94,11 @@

 ;; XXX: Lazy-bind the Shepherd to avoid a compile-time dependency.
 (module-autoload! (current-module)
-                  '(shepherd service) '(read-pid-file exec-command))
+                  '(shepherd service)
+                  '(fork+exec-command read-pid-file exec-command
+                    %precious-signals))
+(module-autoload! (current-module)
+                  '(shepherd system) '(unblock-signals))

 (define* (read-pid-file/container pid pid-file #:key (max-delay 5))
  "Read PID-FILE in the container namespaces of PID, which exists in a
@@ -101,7 +108,8 @@ separate mount and PID name space.  Return the \"outer\" PID. "
             (read-pid-file pid-file
                            #:max-delay max-delay)))
    (#f
-     (catch-system-error (kill pid SIGTERM))
+     ;; Send SIGTERM to the whole process group.
+     (catch-system-error (kill (- pid) SIGTERM))
     #f)
    ((? integer? container-pid)
     ;; XXX: When COMMAND is started in a separate PID namespace, its
@@ -158,6 +166,14 @@ namespace, in addition to essential bind-mounts such /proc."
    (let ((pid (run-container container-directory
                              mounts namespaces 1
                              (lambda ()
+                                ;; First restore the default handlers.
+                                (for-each (cut sigaction <> SIG_DFL)
+                                          %precious-signals)
+
+                                ;; Unblock any signals that have been blocked
+                                ;; by the parent process.
+                                (unblock-signals %precious-signals)
+
                                (mkdir-p "/var/run")
                                (clean-up pid-file)

@@ -175,6 +191,35 @@ namespace, in addition to essential bind-mounts such /proc."
              (read-pid-file pid-file #:max-delay pid-file-timeout))
          pid))))

+(define* (fork+exec-command/container command
+                                      #:key pid
+                                      #:allow-other-keys
+                                      #:rest args)
+  "This is a variant of 'fork+exec-command' procedure, that joins the
+namespaces of process PID beforehand.  If there is no support for containers,
+on Hurd systems for instance, fallback to direct forking."
+  (define (strip-pid args)
+    ;; TODO: Replace with 'strip-keyword-arguments' when that no longer pulls
+    ;; in (guix config).
+    (let loop ((args args)
+               (result '()))
+      (match args
+        (()
+         (reverse result))
+        ((#:pid _ . rest)
+         (loop rest result))
+        ((head . rest)
+         (loop rest (cons head result))))))
+
+  (let ((container-support?
+         (file-exists? "/proc/self/ns"))
+        (fork-proc (lambda ()
+                     (apply fork+exec-command command
+                            (strip-pid args)))))
+    (if container-support?
+        (container-excursion* pid fork-proc)
+        (fork-proc))))
+
 ;; Local Variables:
 ;; eval: (put 'container-excursion* 'scheme-indent-function 1)
 ;; End:
@@ -223,12 +223,13 @@ produced by #:references-graphs..  As a side effect, if RESET-TIMESTAMPS? is
 true, reset timestamps on store files and, if DEDUPLICATE? is true,
 deduplicates files common to CLOSURE and the rest of PREFIX."
  (let ((items (call-with-input-file closure read-reference-graph)))
-    (register-items items
-                    #:prefix prefix
-                    #:deduplicate? deduplicate?
-                    #:reset-timestamps? reset-timestamps?
-                    #:registration-time %epoch
-                    #:schema schema)))
+    (parameterize ((sql-schema schema))
+      (with-database (store-database-file #:prefix prefix) db
+        (register-items db items
+                        #:prefix prefix
+                        #:deduplicate? deduplicate?
+                        #:reset-timestamps? reset-timestamps?
+                        #:registration-time %epoch)))))


 ;;;
@@ -1,7 +1,8 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2017 Jan Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2017, 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2018, 2019 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2020 Julien Lepiller <julien@lepiller.eu>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,6 +26,7 @@
  #:use-module (guix profiles)
  #:use-module (guix packages)
  #:use-module (guix channels)
+  #:use-module (guix config)
  #:use-module (guix derivations)
  #:use-module (guix build-system)
  #:use-module (guix monads)
@@ -53,6 +55,8 @@
  #:use-module (gnu system image)
  #:use-module (gnu system vm)
  #:use-module (gnu system install)
+  #:use-module (gnu system images hurd)
+  #:use-module (gnu system images pine64)
  #:use-module (gnu tests)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
@@ -72,28 +76,36 @@
                         #:optional (package-derivation package-derivation))
  "Convert PACKAGE to an alist suitable for Hydra."
  (parameterize ((%graft? #f))
-    `((derivation . ,(derivation-file-name
-                      (package-derivation store package system
-                                          #:graft? #f)))
-      (description . ,(package-synopsis package))
-      (long-description . ,(package-description package))
+    (let ((drv (package-derivation store package system
+                                   #:graft? #f)))
+      `((derivation . ,(derivation-file-name drv))
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
+        (description . ,(package-synopsis package))
+        (long-description . ,(package-description package))

-      ;; XXX: Hydra ignores licenses that are not a <license> structure or a
-      ;; list thereof.
-      (license . ,(let loop ((license (package-license package)))
-                    (match license
-                      ((? license?)
-                       (license-name license))
-                      ((lst ...)
-                       (map loop license)))))
+        ;; XXX: Hydra ignores licenses that are not a <license> structure or a
+        ;; list thereof.
+        (license . ,(let loop ((license (package-license package)))
+                      (match license
+                        ((? license?)
+                         (license-name license))
+                        ((lst ...)
+                         (map loop license)))))

-      (home-page . ,(package-home-page package))
-      (maintainers . ("bug-guix@gnu.org"))
-      (max-silent-time . ,(or (assoc-ref (package-properties package)
-                                         'max-silent-time)
-                              3600))              ;1 hour by default
-      (timeout . ,(or (assoc-ref (package-properties package) 'timeout)
-                      72000)))))                  ;20 hours by default
+        (home-page . ,(package-home-page package))
+        (maintainers . ("bug-guix@gnu.org"))
+        (max-silent-time . ,(or (assoc-ref (package-properties package)
+                                           'max-silent-time)
+                                3600))              ;1 hour by default
+        (timeout . ,(or (assoc-ref (package-properties package) 'timeout)
+                        72000))))))                  ;20 hours by default

 (define (package-job store job-name package system)
  "Return a job called JOB-NAME that builds PACKAGE on SYSTEM."
@@ -115,7 +127,7 @@ SYSTEM."
  ;; Note: Don't put the '-final' package variants because (1) that's
  ;; implicit, and (2) they cannot be cross-built (due to the explicit input
  ;; chain.)
-  (list gcc-4.8 gcc-4.9 gcc-5 glibc binutils
+  (list gcc-7 gcc-8 gcc-9 gcc-10 glibc binutils
        gmp mpfr mpc coreutils findutils diffutils patch sed grep
        gawk gnu-gettext hello guile-2.0 guile-2.2 zlib gzip xz
        %bootstrap-binaries-tarball
@@ -185,18 +197,30 @@ SYSTEM."
              (remove (either from-32-to-64? same? pointless?)
                      %cross-targets)))

-(define %guixsd-supported-systems
-  '("x86_64-linux" "i686-linux" "armhf-linux"))
+;; Architectures that are able to build or cross-build Guix System images.
+;; This does not mean that other architectures are not supported, only that
+;; they are often not fast enough to support Guix System images building.
+(define %guix-system-supported-systems
+  '("x86_64-linux" "i686-linux"))

-(define %u-boot-systems
-  '("armhf-linux"))
+(define %guix-system-images
+  (list hurd-barebones-qcow2-image
+        pine64-barebones-raw-image))

-(define (qemu-jobs store system)
-  "Return a list of jobs that build QEMU images for SYSTEM."
+(define (image-jobs store system)
+  "Return a list of jobs that build images for SYSTEM."
  (define (->alist drv)
    `((derivation . ,(derivation-file-name drv))
-      (description . "Stand-alone QEMU image of the GNU system")
-      (long-description . "This is a demo stand-alone QEMU image of the GNU
+      (log . ,(log-file store (derivation-file-name drv)))
+      (outputs . ,(filter-map (lambda (res)
+                                (match res
+                                  ((name . path)
+                                   `(,name . ,path))))
+                              (derivation->output-paths drv)))
+      (nix-name . ,(derivation-name drv))
+      (system . ,(derivation-system drv))
+      (description . "Stand-alone image of the GNU system")
+      (long-description . "This is a demo stand-alone image of the GNU
 system.")
      (license . ,(license-name gpl3+))
      (max-silent-time . 600)
@@ -211,29 +235,37 @@ system.")
                   (parameterize ((%graft? #f))
                     (->alist drv))))))

+  (define (build-image image)
+    (run-with-store store
+      (mbegin %store-monad
+        (set-guile-for-build (default-guile))
+        (lower-object (system-image image)))))
+
  (define MiB
    (expt 2 20))

-  (if (member system %guixsd-supported-systems)
-      (list (->job 'usb-image
-                   (run-with-store store
-                     (mbegin %store-monad
-                       (set-guile-for-build (default-guile))
-                       (lower-object
-                        (system-image
-                         (image
-                          (inherit efi-disk-image)
-                          (size (* 1500 MiB))
-                          (operating-system installation-os)))))))
-            (->job 'iso9660-image
-                   (run-with-store store
-                     (mbegin %store-monad
-                       (set-guile-for-build (default-guile))
-                       (lower-object
-                        (system-image
-                         (image
-                          (inherit iso9660-image)
-                          (operating-system installation-os))))))))
+  (if (member system %guix-system-supported-systems)
+      `(,(->job 'usb-image
+                (build-image
+                 (image
+                  (inherit efi-disk-image)
+                  (operating-system installation-os))))
+        ,(->job 'iso9660-image
+                (build-image
+                 (image
+                  (inherit (image-with-label
+                             iso9660-image
+                             (string-append "GUIX_" system "_"
+                                            (if (> (string-length %guix-version) 7)
+                                                (substring %guix-version 0 7)
+                                                %guix-version))))
+                  (operating-system installation-os))))
+        ;; Only cross-compile Guix System images from x86_64-linux for now.
+        ,@(if (string=? system "x86_64-linux")
+              (map (lambda (image)
+                     (->job (image-name image) (build-image image)))
+                   %guix-system-images)
+              '()))
      '()))

 (define channel-build-system
@@ -290,6 +322,14 @@ system.")
            (system-test-value test))))

      `((derivation . ,(derivation-file-name drv))
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
        (description . ,(format #f "Guix '~a' system test"
                                (system-test-name test)))
        (long-description . ,(system-test-description test))
@@ -305,11 +345,7 @@ system.")
                                "." system))))
      (cons name (test->thunk test))))

-  (if (and (member system %guixsd-supported-systems)
-
-           ;; XXX: Our build farm has too few ARMv7 machines and they are very
-           ;; slow, so skip system tests there.
-           (not (string=? system "armhf-linux")))
+  (if (member system %guix-system-supported-systems)
      ;; Override the value of 'current-guix' used by system tests.  Using a
      ;; channel instance makes tests that rely on 'current-guix' less
      ;; expensive.  It also makes sure we get a valid Guix package when this
@@ -323,6 +359,14 @@ system.")
  "Return Hydra jobs to build the self-contained Guix binary tarball."
  (define (->alist drv)
    `((derivation . ,(derivation-file-name drv))
+      (log . ,(log-file store (derivation-file-name drv)))
+      (outputs . ,(filter-map (lambda (res)
+                                (match res
+                                  ((name . path)
+                                   `(,name . ,path))))
+                              (derivation->output-paths drv)))
+      (nix-name . ,(derivation-name drv))
+      (system . ,(derivation-system drv))
      (description . "Stand-alone binary Guix tarball")
      (long-description . "This is a tarball containing binaries of Guix and
 all its dependencies, and ready to be installed on \"foreign\" distributions.")
@@ -486,7 +530,7 @@ Return #f if no such checkout is found."
                                  (package->job store package
                                                system))))
                       (append (filter-map job all)
-                               (qemu-jobs store system)
+                               (image-jobs store system)
                               (system-test-jobs store system
                                                 #:source source
                                                 #:commit commit)
@@ -501,20 +545,16 @@ Return #f if no such checkout is found."
                             (cross-jobs store system)))
                    ((hello)
                     ;; Build hello package only.
-                     (if (string=? system (%current-system))
-                         (let ((hello (specification->package "hello")))
-                           (list (package-job store (job-name hello) hello system)))
-                         '()))
+                     (let ((hello (specification->package "hello")))
+                       (list (package-job store (job-name hello) hello system))))
                    ((list)
                     ;; Build selected list of packages only.
-                     (if (string=? system (%current-system))
-                         (let* ((names (assoc-ref arguments 'subset))
-                                (packages (map specification->package names)))
-                           (map (lambda (package)
-                                    (package-job store (job-name package)
-                                                 package system))
-                                  packages))
-                         '()))
+                     (let* ((names (assoc-ref arguments 'subset))
+                            (packages (map specification->package names)))
+                       (map (lambda (package)
+                              (package-job store (job-name package)
+                                           package system))
+                            packages)))
                    ((manifests)
                     ;; Build packages in the list of manifests.
                     (let* ((manifests (arguments->manifests arguments))
@@ -33,12 +33,20 @@
            image
            image-name
            image-format
+            image-target
            image-size
            image-operating-system
            image-partitions
            image-compression?
            image-volatile-root?
-            image-substitutable?))
+            image-substitutable?
+
+            image-type
+            image-type?
+            image-type-name
+            image-type-constructor
+
+            os->image))


 ;;;
@@ -66,7 +74,11 @@
 (define-record-type* <image>
  image make-image
  image?
+  (name               image-name ;symbol
+                      (default #f))
  (format             image-format) ;symbol
+  (target             image-target
+                      (default #f))
  (size               image-size  ;size in bytes as integer
                      (default 'guess))
  (operating-system   image-operating-system  ;<operating-system>
@@ -79,3 +91,23 @@
                      (default #t))
  (substitutable?     image-substitutable? ;boolean
                      (default #t)))
+
+
+;;;
+;;; Image type.
+;;;
+
+(define-record-type* <image-type>
+  image-type make-image-type
+  image-type?
+  (name           image-type-name) ;symbol
+  (constructor    image-type-constructor)) ;<operating-system> -> <image>
+
+
+;;;
+;;; Image creation.
+;;;
+
+(define* (os->image os #:key type)
+  (let ((constructor (image-type-constructor type)))
+    (constructor os)))
@@ -71,7 +71,7 @@
    (_ #f)))

 (define* (build-compiled-file name locale-builder)
-  "Return a file-like object that evalutes the gexp LOCALE-BUILDER and store
+  "Return a file-like object that evaluates the gexp LOCALE-BUILDER and store
 its result in the scheme file NAME. The derivation will also build a compiled
 version of this file."
  (define set-utf8-locale
@@ -308,7 +308,8 @@ selected keymap."
    ;; translated.
    #~(begin
        (bindtextdomain "guix" (string-append #$guix "/share/locale"))
-        (textdomain "guix")))
+        (textdomain "guix")
+        (setlocale LC_ALL "")))

  (define set-installer-path
    ;; Add the specified binary to PATH for later use by the installer.
@@ -318,8 +319,10 @@ selected keymap."
                       cryptsetup
                       dosfstools ;mkfs.fat
                       e2fsprogs ;mkfs.ext4
+                       lvm2-static ;dmsetup
                       btrfs-progs
                       jfsutils ;jfs_mkfs
+                       ntfs-3g ;mkfs.ntfs
                       kbd ;chvt
                       guix ;guix system init call
                       util-linux ;mkwap
@@ -440,5 +443,6 @@ selected keymap."
       ;; some reason, unicode support is not correctly installed
       ;; when calling this in 'installer-builder'.
       (setenv "LANG" "en_US.UTF-8")
-       (execl #$(program-file "installer-real" installer-builder)
+       (execl #$(program-file "installer-real" installer-builder
+                              #:guile guile-3.0-latest)
              "installer-real"))))
@@ -180,7 +180,7 @@ Return the corresponding association list of '((KEY . VALUE) (KEY2 . VALUE2)
 (define (connman-state)
  "Return the state of connman. The nominal states are 'offline, 'idle,
 'ready, 'oneline.  If an unexpected state is read, 'unknown is
-returned. Finally, an error is raised if the comman output could not be
+returned. Finally, an error is raised if the connman output could not be
 parsed, usually because the connman daemon is not responding."
  (let* ((output (connman "state"))
         (state-keys (parse-keys output)))
@@ -26,6 +26,8 @@
  #:use-module (guix build syscalls)
  #:use-module (guix build utils)
  #:use-module (gnu build accounts)
+  #:use-module (gnu build install)
+  #:use-module (gnu build linux-container)
  #:use-module ((gnu system shadow) #:prefix sys:)
  #:use-module (rnrs io ports)
  #:use-module (srfi srfi-1)
@@ -127,58 +129,38 @@ USERS."
                   (lambda (port)
                     (match (string-tokenize (read-string port) %not-nul)
                       ((argv0 _ ...)
-                        (unless (member (pk (basename argv0)) spare)
+                        (unless (member (basename argv0) spare)
                          (syslog "Killing process ~a (~a)~%" pid argv0)
                          (kill pid SIGKILL)))
                       (_ #f))))))
              pids)))

-(define (umount-cow-store)
-  "Remove the store overlay and the bind-mount on /tmp created by the
-cow-store service.  This procedure is very fragile and a better approach would
-be much appreciated."
+(define (call-with-mnt-container thunk)
+  "This is a variant of call-with-container. Run THUNK in a new container
+process, within a separate MNT namespace. The container is not jailed so that
+it can interact with the rest of the system."
+  (let ((pid (run-container "/" '() '(mnt) 1 thunk)))
+    ;; Catch SIGINT and kill the container process.
+    (sigaction SIGINT
+      (lambda (signum)
+        (false-if-exception
+         (kill pid SIGKILL))))

-  ;; Remove when integrated in (gnu services herd).
-  (define (restart-service name)
-    (with-shepherd-action name ('restart) result
-      result))
-
-  (catch #t
-    (lambda ()
-      (let ((tmp-dir "/remove"))
-        (syslog "Unmounting cow-store.~%")
-
-        (mkdir-p tmp-dir)
-        (mount (%store-directory) tmp-dir "" MS_MOVE)
-
-        ;; The guix-daemon has possibly opened files from the cow-store,
-        ;; restart it.
-        (restart-service 'guix-daemon)
-
-        ;; Kill all processes started while the cow-store was active (logins
-        ;; on other TTYs for instance).
-        (kill-cow-users tmp-dir)
-
-        ;; Try to umount the store overlay. Some process such as udevd
-        ;; workers might still be active, so do some retries.
-        (let loop ((try 5))
-          (sleep 1)
-          (let ((umounted? (false-if-exception (umount tmp-dir))))
-            (if (and (not umounted?) (> try 0))
-                (loop (- try 1))
-                (if umounted?
-                    (syslog "Umounted ~a successfully.~%" tmp-dir)
-                    (syslog "Failed to umount ~a.~%" tmp-dir)))))
-
-        (umount "/tmp")))
-    (lambda args
-      (syslog "~a~%" args))))
+    (match (waitpid pid)
+      ((_ . status) status))))

 (define* (install-system locale #:key (users '()))
  "Create /etc/shadow and /etc/passwd on the installation target for USERS.
 Start COW-STORE service on target directory and launch guix install command in
 a subshell.  LOCALE must be the locale name under which that command will run,
 or #f.  Return #t on success and #f on failure."
+  (define backing-directory
+    ;; Sub-directory used as the backing store for copy-on-write.
+    "/tmp/guix-inst")
+
+  (define (assert-exit x)
+    (primitive-exit (if x 0 1)))
+
  (let* ((options         (catch 'system-error
                            (lambda ()
                              ;; If this file exists, it can provide
@@ -191,7 +173,11 @@ or #f.  Return #t on success and #f on failure."
                                        "--fallback")
                                  options
                                  (list (%installer-configuration-file)
-                                        (%installer-target-dir)))))
+                                        (%installer-target-dir))))
+         (database-dir    "/var/guix/db")
+         (database-file   (string-append database-dir "/db.sqlite"))
+         (saved-database  (string-append database-dir "/db.save"))
+         (ret             #f))
    (mkdir-p (%installer-target-dir))

    ;; We want to initialize user passwords but we don't want to store them in
@@ -201,16 +187,49 @@ or #f.  Return #t on success and #f on failure."
    ;; passwords that we've put in there.
    (create-user-database users (%installer-target-dir))

-    (dynamic-wind
-      (lambda ()
-        (start-service 'cow-store (list (%installer-target-dir))))
-      (lambda ()
-        (run-command install-command #:locale locale))
-      (lambda ()
-        (stop-service 'cow-store)
-        ;; Remove the store overlay created at cow-store service start.
-        ;; Failing to do that will result in further umount calls to fail
-        ;; because the target device is seen as busy. See:
-        ;; https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00161.html.
-        (umount-cow-store)
-        #f))))
+    ;; When the store overlay is mounted, other processes such as kmscon, udev
+    ;; and guix-daemon may open files from the store, preventing the
+    ;; underlying install support from being umounted. See:
+    ;; https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00161.html.
+    ;;
+    ;; To avoid this situation, mount the store overlay inside a container,
+    ;; and run the installation from within that container.
+    (zero?
+     (call-with-mnt-container
+       (lambda ()
+         (dynamic-wind
+           (lambda ()
+             ;; Save the database, so that it can be restored once the
+             ;; cow-store is umounted.
+             (copy-file database-file saved-database)
+             (mount-cow-store (%installer-target-dir) backing-directory))
+           (lambda ()
+             ;; We need to drag the guix-daemon to the container MNT
+             ;; namespace, so that it can operate on the cow-store.
+             (stop-service 'guix-daemon)
+             (start-service 'guix-daemon (list (number->string (getpid))))
+
+             (setvbuf (current-output-port) 'none)
+             (setvbuf (current-error-port) 'none)
+
+             ;; If there are any connected clients, assume that we are running
+             ;; installation tests. In that case, dump the standard and error
+             ;; outputs to syslog.
+             (set! ret
+                   (if (not (null? (current-clients)))
+                       (with-output-to-file "/dev/console"
+                         (lambda ()
+                           (with-error-to-file "/dev/console"
+                             (lambda ()
+                               (run-command install-command
+                                            #:locale locale)))))
+                       (run-command install-command #:locale locale))))
+           (lambda ()
+             ;; Restart guix-daemon so that it does no keep the MNT namespace
+             ;; alive.
+             (restart-service 'guix-daemon)
+             (copy-file saved-database database-file)
+
+             ;; Finally umount the cow-store and exit the container.
+             (unmount-cow-store (%installer-target-dir) backing-directory)
+             (assert-exit ret))))))))
@@ -46,6 +46,7 @@
  (newt-init)
  (clear-screen)
  (set-screen-size!)
+  (syslog "Display is ~ax~a.~%" (screen-columns) (screen-rows))
  (push-help-line
   (format #f (G_ "Press <F1> for installation parameters."))))

@@ -107,7 +108,7 @@ problem. The backtrace is displayed below. Please report it by email to \
  (run-user-page))

 (define (partition-page)
-  (run-partioning-page))
+  (run-partitioning-page))

 (define (services-page)
  (run-services-page))
@@ -77,7 +77,7 @@ connection is pending."
      #:title (G_ "Ethernet connection")
      #:listbox-items services
      #:listbox-item->text ethernet-service->text
-      #:listbox-height (min (+ (length services) 2) 10)
+      #:listbox-height (min (+ (length services) 2) 5)
      #:button-text (G_ "Exit")
      #:button-callback-procedure
      (lambda _
@@ -25,9 +25,11 @@
  #:use-module (gnu installer newt page)
  #:use-module (gnu installer newt utils)
  #:use-module (guix i18n)
+  #:use-module (guix colors)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:use-module (ice-9 match)
+  #:use-module ((ice-9 rdelim) #:select (read-line))
  #:use-module (newt)
  #:export (run-final-page))

@@ -38,9 +40,8 @@
      file))

 (define* (run-config-display-page #:key locale)
-  (let ((width (%configuration-file-width))
-        (height (nearest-exact-integer
-                 (/ (screen-rows) 2))))
+  (let ((width (max 70 (- (screen-columns) 20)))
+        (height (default-listbox-height)))
    (run-file-textbox-page
     #:info-text (format #f (G_ "\
 We're now ready to proceed with the installation! \
@@ -106,6 +107,19 @@ a specific step, or restart the installer."))
    install-ok?))

 (define (run-final-page result prev-steps)
+  (define (wait-for-clients)
+    (unless (null? (current-clients))
+      (syslog "waiting with clients before starting final step~%")
+      (send-to-clients '(starting-final-step))
+      (match (select (current-clients) '() '())
+        (((port _ ...) _ _)
+         (read-line port)))))
+
+  ;; Before generating the configuration file, give clients a chance to do
+  ;; things such as changing the swap partition label.
+  (wait-for-clients)
+
+  (syslog "proceeding with final step~%")
  (let* ((configuration   (format-configuration prev-steps result))
         (user-partitions (result-step result 'partition))
         (locale          (result-step result 'locale))
@@ -106,7 +106,7 @@ symbol.")
 territory, codeset and modifier. Use SUPPORTED-LOCALES as the list of glibc
 available locales. ISO639-LANGUAGES is an association list associating a
 locale code to a locale name. ISO3166-TERRITORIES is an association list
-associating a territory code with a territory name. The formated locale, under
+associating a territory code with a territory name. The formatted locale, under
 glibc format is returned."

  (define (break-on-locale-found locales)
@@ -80,7 +80,7 @@ network devices were found. Do you want to continue anyway?"))
      #:title (G_ "Internet access")
      #:listbox-items items
      #:listbox-item->text technology->text
-      #:listbox-height (min (+ (length items) 2) 10)
+      #:listbox-height (min (+ (length items) 2) 5)
      #:button-text (G_ "Exit")
      #:button-callback-procedure
      (lambda _
@@ -32,7 +32,9 @@
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:use-module (newt)
-  #:export (draw-info-page
+  #:export (default-listbox-height
+
+            draw-info-page
            draw-connecting-page
            run-input-page
            run-error-page
@@ -168,6 +170,10 @@ Like 'run-form', return two values: the exit reason, and an \"argument\"."
        (_
         (values reason argument))))))

+(define (default-listbox-height)
+  "Return the default listbox height."
+  (max 5 (- (screen-rows) 20)))
+
 (define (draw-info-page text title)
  "Draw an informative page with the given TEXT as content.  Set the title of
 this page to TITLE."
@@ -339,7 +345,8 @@ of the page is set to TITLE."
                                     (info-textbox-width 50)
                                     listbox-items
                                     listbox-item->text
-                                     (listbox-height 20)
+                                     (listbox-height
+                                      (default-listbox-height))
                                     (listbox-default-item #f)
                                     (listbox-allow-multiple? #f)
                                     (sort-listbox-items? #t)
@@ -25,6 +25,7 @@
  #:use-module (gnu installer newt page)
  #:use-module (gnu installer newt utils)
  #:use-module (guix i18n)
+  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
@@ -32,7 +33,7 @@
  #:use-module (srfi srfi-35)
  #:use-module (newt)
  #:use-module (parted)
-  #:export (run-partioning-page))
+  #:export (run-partitioning-page))

 (define (button-exit-action)
  "Raise the &installer-step-abort condition."
@@ -56,11 +57,17 @@
                  #:button-callback-procedure button-exit-action)))
    (car result)))

-(define (draw-formatting-page)
+(define (draw-formatting-page partitions)
  "Draw a page asking for confirmation, and then indicating that partitions
 are being formatted."
-  (run-confirmation-page (G_ "We are about to format your hard disk.  All \
-its data will be lost.  Do you wish to continue?")
+  ;; TRANSLATORS: The ~{ and ~} format specifiers are used to iterate the list
+  ;; of device names of the user partitions that will be formatted.
+  (run-confirmation-page (format #f (G_ "We are about to write the configured \
+partition table to the disk and format the partitions listed below.  Their \
+data will be lost.  Do you wish to continue?~%~{ - ~a~%~}")
+                                 (map user-partition-file-name
+                                      (filter user-partition-need-formatting?
+                                              partitions)))
                         (G_ "Format disk?")
                         #:exit-button-procedure button-exit-action)
  (draw-info-page
@@ -121,7 +128,7 @@ Be careful, all data on the disk will be lost.")
  (run-listbox-selection-page
   #:info-text (G_ "Please select the file-system type for this partition.")
   #:title (G_ "File-system type")
-   #:listbox-items '(ext4 btrfs fat16 fat32 jfs swap)
+   #:listbox-items '(ext4 btrfs fat16 fat32 jfs ntfs swap)
   #:listbox-item->text user-fs-type-name
   #:sort-listbox-items? #f
   #:button-text (G_ "Exit")
@@ -674,7 +681,7 @@ by pressing the Exit button.~%~%")))
                      (G_ "Guided partitioning")
                      (G_ "Manual partitioning"))
          #:info-textbox-width 76         ;we need a lot of room for INFO-TEXT
-          #:listbox-height 12
+          #:listbox-height (max 5 (- (screen-rows) 30))
          #:listbox-items (disk-items)
          #:listbox-item->text cdr
          #:sort-listbox-items? #f
@@ -725,7 +732,7 @@ by pressing the Exit button.~%~%")))
          (run-disk-page result-disks new-user-partitions
                         #:guided? guided?)))))

-(define (run-partioning-page)
+(define (run-partitioning-page)
  "Run a page asking the user for a partitioning method."
  (define (run-page devices)
    (let* ((items
@@ -773,9 +780,12 @@ by pressing the Exit button.~%~%")))
         (user-partitions (run-page non-install-devices))
         (user-partitions-with-pass (prompt-luks-passwords
                                     user-partitions))
-         (form (draw-formatting-page)))
+         (form (draw-formatting-page user-partitions)))
    ;; Make sure the disks are not in use before proceeding to formatting.
    (free-parted non-install-devices)
    (format-user-partitions user-partitions-with-pass)
+    (syslog "formatted ~a user partitions~%"
+            (length user-partitions-with-pass))
+
    (destroy-form-and-pop form)
    user-partitions))
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
-;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -40,7 +41,7 @@ choose the one to use on the log-in screen.")
     #:items items
     #:selection (map system-service-recommended? items)
     #:item->text system-service-name             ;no i18n for DE names
-     #:checkbox-tree-height 8
+     #:checkbox-tree-height 9
     #:exit-button-callback-procedure
     (lambda ()
       (raise
@@ -76,6 +77,7 @@ system.")
 We recommend NetworkManager or Connman for a WiFi-capable laptop; the DHCP \
 client may be enough for a server.")
     #:info-textbox-width 70
+     #:listbox-height 7
     #:listbox-items (filter (lambda (service)
                               (eq? 'network-management
                                    (system-service-type service)))
@@ -38,6 +38,9 @@
 (define info-textbox-width (make-parameter 70))
 (define options-listbox-height (make-parameter 5))

+(define (display-logo?)
+  (> (screen-rows) 35))
+
 (define* (run-menu-page title info-text logo
                        #:key
                        listbox-items
@@ -55,7 +58,10 @@ we want this page to occupy all the screen space available."
         items))

  (let* ((logo-textbox
-          (make-textbox -1 -1 (logo-width) (logo-height) 0))
+          (make-textbox -1 -1
+                        (if (display-logo?) (logo-width) 0)
+                        (if (display-logo?) (logo-height) 0)
+                        0))
         (info-textbox
          (make-reflowed-textbox -1 -1
                                 info-text
@@ -165,7 +165,8 @@ of <service-item> records present in LISTBOX."
 (define service-name-max-length (make-parameter 20))

 ;; Height of the listbox displaying wifi services.
-(define wifi-listbox-height (make-parameter 20))
+(define wifi-listbox-height (make-parameter
+                             (default-listbox-height)))

 ;; Information textbox width.
 (define info-textbox-width (make-parameter 40))
@@ -36,10 +36,12 @@
  #:use-module (guix utils)
  #:use-module (guix i18n)
  #:use-module (parted)
+  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
  #:use-module (ice-9 regex)
  #:use-module (rnrs io ports)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-19)
  #:use-module (srfi srfi-26)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
@@ -222,7 +224,8 @@ inferior to MAX-SIZE, #f otherwise."
    ((btrfs) "btrfs")
    ((fat16) "fat16")
    ((fat32) "fat32")
-    ((jfs) "jfs")
+    ((jfs)   "jfs")
+    ((ntfs)  "ntfs")
    ((swap)  "linux-swap")))

 (define (user-fs-type->mount-type fs-type)
@@ -232,7 +235,8 @@ inferior to MAX-SIZE, #f otherwise."
    ((btrfs) "btrfs")
    ((fat16) "fat")
    ((fat32) "vfat")
-    ((jfs) "jfs")))
+    ((jfs)   "jfs")
+    ((ntfs)  "ntfs")))

 (define (partition-filesystem-user-type partition)
  "Return the filesystem type of PARTITION, to be stored in the FS-TYPE field
@@ -246,6 +250,7 @@ of <user-partition> record."
            ((string=? name "fat16") 'fat16)
            ((string=? name "fat32") 'fat32)
            ((string=? name "jfs") 'jfs)
+            ((string=? name "ntfs") 'ntfs)
            ((or (string=? name "swsusp")
                 (string=? name "linux-swap(v0)")
                 (string=? name "linux-swap(v1)"))
@@ -314,7 +319,7 @@ PARTED-OBJECT field equals PARTITION, return #f if not found."
 fail. See rereadpt function in wipefs.c of util-linux for an explanation."
  ;; Kernel always return EINVAL for BLKRRPART on loopdevices.
  (and (not (string-match "/dev/loop*" file-name))
-       (let loop ((try 4))
+       (let loop ((try 16))
         (usleep 250000)
         (let ((in-use? (device-in-use? file-name)))
           (if (and in-use? (> try 0))
@@ -327,18 +332,20 @@ fail. See rereadpt function in wipefs.c of util-linux for an explanation."
  (device-sync device)
  (device-close device))

+(define (remove-logical-devices)
+  "Remove all active logical devices."
+  (with-null-output-ports
+   (invoke "dmsetup" "remove_all")))
+
 (define (non-install-devices)
  "Return all the available devices, except the busy one, allegedly the
 install device. DEVICE-IS-BUSY? is a parted call, checking if the device is
-mounted. The install image uses an overlayfs so the install device does not
-appear as mounted and won't be considered as busy. So use also DEVICE-IN-USE?
-from (guix build syscalls) module, who will try to re-read the device's
-partition table to determine whether or not it is already used (like sfdisk
-from util-linux)."
+mounted."
+  ;; FIXME: The install image uses an overlayfs so the install device does not
+  ;; appear as mounted and won't be considered as busy.
  (remove (lambda (device)
            (let ((file-name (device-path device)))
-              (or (device-is-busy? device)
-                  (with-delay-device-in-use? file-name))))
+              (device-is-busy? device)))
          (devices)))


@@ -518,56 +525,54 @@ determined by MAX-LENGTH-COLUMN procedure."
         (size (user-partition-size user-partition))
         (mount-point (user-partition-mount-point user-partition)))
    `(,@(if has-name?
-            `((name . ,(string-append "Name: " (or name "None"))))
+            `((name . ,(format #f (G_ "Name: ~a")
+                               (or name (G_ "None")))))
            '())
      ,@(if (and has-extended?
                 (freespace-partition? partition)
                 (not (eq? type 'logical)))
-            `((type . ,(string-append "Type: " type-name)))
+            `((type . ,(format #f (G_ "Type: ~a") type-name)))
            '())
      ,@(if (eq? type 'extended)
            '()
-            `((fs-type . ,(string-append "Filesystem type: " fs-type-name))))
+            `((fs-type . ,(format #f (G_ "File system type: ~a")
+                                  fs-type-name))))
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap)
                (not has-extended?))
            '()
-            `((bootable . ,(string-append "Bootable flag: "
-                                          (if bootable? "On" "Off")))))
+            `((bootable . ,(format #f (G_ "Bootable flag: ~:[off~;on~]")
+                                   bootable?))))
      ,@(if (and (not has-extended?)
                 (not (eq? fs-type 'swap)))
-            `((esp? . ,(string-append "ESP flag: "
-                                      (if esp? "On" "Off"))))
+            `((esp? . ,(format #f (G_ "ESP flag: ~:[off~;on~]") esp?)))
            '())
      ,@(if (freespace-partition? partition)
            (let ((size-formatted
-                   (or size (unit-format device
+                   (or size (unit-format device   ;XXX: i18n
                                         (partition-length partition)))))
-              `((size . ,(string-append "Size : " size-formatted))))
+              `((size . ,(format #f (G_ "Size: ~a") size-formatted))))
            '())
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap))
            '()
            `((crypt-label
-               . ,(string-append
-                   "Encryption: "
-                   (if crypt-label
-                       (format #f "Yes (label ~a)" crypt-label)
-                       "No")))))
+               . ,(format #f (G_ "Encryption: ~:[No~a~;Yes (label '~a')~]")
+                          crypt-label (or crypt-label "")))))
      ,@(if (or (freespace-partition? partition)
                (eq? fs-type 'swap))
            '()
            `((need-formatting?
-               . ,(string-append "Format the partition? : "
-                                 (if need-formatting? "Yes" "No")))))
+               . ,(format #f (G_ "Format the partition? ~:[No~;Yes~]")
+                          need-formatting?))))
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap))
            '()
            `((mount-point
-               . ,(string-append "Mount point : "
-                                 (or mount-point
-                                     (and esp? (default-esp-mount-point))
-                                     "None"))))))))
+               . ,(format #f (G_ "Mount point: ~a")
+                          (or mount-point
+                              (and esp? (default-esp-mount-point))
+                              (G_ "None")))))))))


 ;;
@@ -751,11 +756,33 @@ cause them to cross."
                                                      dev-constraint))
              (no-constraint (constraint-any device))
              ;; Try to create a partition with an optimal alignment
-              ;; constraint. If it fails, fallback to creating a partition with
-              ;; no specific constraint.
+              ;; constraint. If it fails, fallback to creating a partition
+              ;; with no specific constraint.
+              (partition-constraint-ok?
+               (disk-add-partition disk partition final-constraint))
+              (partition-no-contraint-ok?
+               (or partition-constraint-ok?
+                   (disk-add-partition disk partition no-constraint)))
              (partition-ok?
-               (or (disk-add-partition disk partition final-constraint)
-                   (disk-add-partition disk partition no-constraint))))
+               (or partition-constraint-ok? partition-no-contraint-ok?)))
+         (syslog "Creating partition:
+~/type: ~a
+~/filesystem-type: ~a
+~/start: ~a
+~/end: ~a
+~/start-range: [~a, ~a]
+~/end-range: [~a, ~a]
+~/constraint: ~a
+~/no-constraint: ~a
+"
+                 partition-type
+                 (filesystem-type-name filesystem-type)
+                 start-sector*
+                 end-sector
+                 (geometry-start start-range) (geometry-end start-range)
+                 (geometry-start end-range) (geometry-end end-range)
+                 partition-constraint-ok?
+                 partition-no-contraint-ok?)
         ;; Set the partition name if supported.
         (when (and partition-ok? has-name? name)
           (partition-set-name partition name))
@@ -903,13 +930,13 @@ exists."

    (let* ((start-partition
            (and (not has-extended?)
-                 (not esp-partition)
                 (if (efi-installation?)
-                     (user-partition
-                      (fs-type 'fat32)
-                      (esp? #t)
-                      (size new-esp-size)
-                      (mount-point (default-esp-mount-point)))
+                     (and (not esp-partition)
+                          (user-partition
+                           (fs-type 'fat32)
+                           (esp? #t)
+                           (size new-esp-size)
+                           (mount-point (default-esp-mount-point))))
                     (user-partition
                      (fs-type 'ext4)
                      (bootable? #t)
@@ -1040,6 +1067,11 @@ bit bucket."
  (with-null-output-ports
   (invoke "jfs_mkfs" "-f" partition)))

+(define (create-ntfs-file-system partition)
+  "Create a JFS file-system for PARTITION file-name."
+  (with-null-output-ports
+   (invoke "mkfs.ntfs" "-F" "-f" partition)))
+
 (define (create-swap-partition partition)
  "Set up swap area on PARTITION file-name."
  (with-null-output-ports
@@ -1117,6 +1149,10 @@ NEED-FORMATING? field set to #t."
          (and need-formatting?
               (not (eq? type 'extended))
               (create-jfs-file-system file-name)))
+         ((ntfs)
+          (and need-formatting?
+               (not (eq? type 'extended))
+               (create-ntfs-file-system file-name)))
         ((swap)
          (create-swap-partition file-name))
         (else
@@ -1184,13 +1220,13 @@ the FS-TYPE field set to 'swap, return the empty list if none found."
          user-partitions))

 (define (start-swapping user-partitions)
-  "Start swaping on <user-partition> records with FS-TYPE equal to 'swap."
+  "Start swapping on <user-partition> records with FS-TYPE equal to 'swap."
  (let* ((swap-user-partitions (find-swap-user-partitions user-partitions))
         (swap-devices (map user-partition-file-name swap-user-partitions)))
    (for-each swapon swap-devices)))

 (define (stop-swapping user-partitions)
-  "Stop swaping on <user-partition> records with FS-TYPE equal to 'swap."
+  "Stop swapping on <user-partition> records with FS-TYPE equal to 'swap."
  (let* ((swap-user-partitions (find-swap-user-partitions user-partitions))
         (swap-devices (map user-partition-file-name swap-user-partitions)))
    (for-each swapoff swap-devices)))
@@ -1310,7 +1346,12 @@ USER-PARTITIONS, or return nothing."
      ,@(initrd-configuration user-partitions)
      ,@(if (null? swap-devices)
            '()
-            `((swap-devices (list ,@swap-devices))))
+            (let* ((uuids (map (lambda (file)
+                                 (uuid->string (read-partition-uuid file)))
+                               swap-devices)))
+              `((swap-devices (list ,@(map (lambda (uuid)
+                                             `(uuid ,uuid))
+                                           uuids))))))
      ,@(if (null? encrypted-partitions)
            '()
            `((mapped-devices
@@ -1328,6 +1369,9 @@ USER-PARTITIONS, or return nothing."
 (define (init-parted)
  "Initialize libparted support."
  (probe-all-devices!)
+  ;; Remove all logical devices, otherwise "device-is-busy?" will report true
+  ;; on all devices containaing active logical volumes.
+  (remove-logical-devices)
  (exception-set-handler (lambda (exception)
                           EXCEPTION-OPTION-UNHANDLED)))

@@ -1344,9 +1388,12 @@ the devices not to be used before returning."
  (let ((device-file-names (map device-path devices)))
    (for-each force-device-sync devices)
    (for-each (lambda (file-name)
-                (let ((in-use? (with-delay-device-in-use? file-name)))
-                  (and in-use?
-                       (error
-                        (format #f (G_ "Device ~a is still in use.")
-                                file-name)))))
+                (let/time ((time in-use?
+                                 (with-delay-device-in-use? file-name)))
+                  (if in-use?
+                      (error
+                       (format #f (G_ "Device ~a is still in use.")
+                               file-name))
+                      (syslog "Syncing ~a took ~a seconds.~%"
+                              file-name (time-second time)))))
              device-file-names)))
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -82,6 +83,11 @@
      (name "ratpoison")
      (packages '((specification->package "ratpoison")
                  (specification->package "xterm"))))
+     (desktop-environment
+      (name "Emacs EXWM")
+      (packages '((specification->package "emacs")
+                  (specification->package "emacs-exwm")
+                  (specification->package "emacs-desktop-environment"))))

     ;; Networking.
     (system-service
@@ -50,7 +50,6 @@

            %installer-configuration-file
            %installer-target-dir
-            %configuration-file-width
            format-configuration
            configuration->file))

@@ -88,7 +87,7 @@
                              (rewind-strategy 'previous)
                              (menu-proc (const #f)))
  "Run the COMPUTE procedure of all <installer-step> records in STEPS
-sequencially. If the &installer-step-abort condition is raised, fallback to a
+sequentially.  If the &installer-step-abort condition is raised, fallback to a
 previous install-step, accordingly to the specified REWIND-STRATEGY.

 REWIND-STRATEGY possible values are 'previous, 'menu and 'start.  If 'previous
@@ -218,7 +217,6 @@ stored in RESULTS. Return #f otherwise."

 (define %installer-configuration-file (make-parameter "/mnt/etc/config.scm"))
 (define %installer-target-dir (make-parameter "/mnt"))
-(define %configuration-file-width (make-parameter 79))

 (define (format-configuration steps results)
  "Return the list resulting from the application of the procedure defined in
@@ -286,8 +286,9 @@ instrumented for further testing."
                               edit-configuration-file))
  "Converse over PORT to choose the partitioning method.  When ENCRYPTED? is
 true, choose full-disk encryption with PASSPHRASE as the LUKS passphrase.
-This conversation goes past the final dialog box that shows the configuration
-file, actually starting the installation process."
+This conversation stops when the user partitions have been formatted, right
+before the installer generates the configuration file and shows it in a dialog
+box."
  (converse port
    ((list-selection (title "Partitioning method")
                     (multiple-choices? #f)
@@ -330,15 +331,29 @@ file, actually starting the installation process."
     #t)
    ((info (title "Preparing partitions") _ ...)
     (values))                                    ;nothing to return
+    ((starting-final-step)
+     ;; Do not return anything.  The reply will be sent by
+     ;; 'conclude-installation' and in the meantime the installer just waits
+     ;; for us, giving us a chance to do things such as changing partition
+     ;; UUIDs before it generates the configuration file.
+     (values))))
+
+(define (conclude-installation port)
+  "Conclude the installation by checking over PORT that we get the generated
+configuration file, accepting it and starting the installation, and then
+receiving the final messages once the 'guix system init' process has
+completed."
+  ;; Assume the previous message received was 'starting-final-step'; here we
+  ;; send the reply to that message, which lets the installer continue.
+  (write #t port)
+  (newline port)
+  (force-output port)
+
+  (converse port
    ((file-dialog (title "Configuration file")
                  (text _)
                  (file ,configuration-file))
-     (edit-configuration-file configuration-file))))
-
-(define (conclude-installation port)
-  "Conclude the installation by checking over PORT that we get the final
-messages once the 'guix system init' process has completed."
-  (converse port
+     (edit-configuration-file configuration-file))
    ((pause)                                      ;"Press Enter to continue."
     #t)
    ((installation-complete)                      ;congratulations!
@@ -22,6 +22,7 @@
  #:use-module (guix build utils)
  #:use-module (guix i18n)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-19)
  #:use-module (srfi srfi-34)
  #:use-module (ice-9 match)
  #:use-module (ice-9 rdelim)
@@ -36,6 +37,8 @@

            syslog-port
            syslog
+            call-with-time
+            let/time

            with-server-socket
            current-server-socket
@@ -117,6 +120,17 @@ COMMAND exited successfully, #f otherwise."
 ;;; Logging.
 ;;;

+(define (call-with-time thunk kont)
+  "Call THUNK and pass KONT the elapsed time followed by THUNK's return
+values."
+  (let* ((start  (current-time time-monotonic))
+         (result (call-with-values thunk list))
+         (end    (current-time time-monotonic)))
+    (apply kont (time-difference end start) result)))
+
+(define-syntax-rule (let/time ((time result exp)) body ...)
+  (call-with-time (lambda () exp) (lambda (time result) body ...)))
+
 (define (open-syslog-port)
  "Return an open port (a socket) to /dev/log or #f if that wasn't possible."
  (let ((sock (socket AF_UNIX SOCK_DGRAM 0)))
@@ -1,6 +1,6 @@
 # GNU Guix --- Functional package management for GNU
 # Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
-# Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019 Andreas Enge <andreas@enge.fr>
+# Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Andreas Enge <andreas@enge.fr>
 # Copyright © 2016 Mathieu Lirzin <mthl@gnu.org>
 # Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Mark H Weaver <mhw@netris.org>
 # Copyright © 2016 Chris Marusich <cmmarusich@gmail.com>
@@ -20,11 +20,11 @@
 # Copyright © 2018, 2019, 2020 Oleg Pykhalov <go.wigust@gmail.com>
 # Copyright © 2018 Stefan Stefanović <stefanx2ovic@gmail.com>
 # Copyright © 2018, 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
-# Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
+# Copyright © 2019, 2020 Guillaume Le Vaillant <glv@posteo.net>
 # Copyright © 2019, 2020 John Soo <jsoo1@asu.edu>
 # Copyright © 2019 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 # Copyright © 2019 Evan Straw <evan.straw99@gmail.com>
-# Copyright © 2019 Brett Gilio <brettg@gnu.org>
+# Copyright © 2019, 2020 Brett Gilio <brettg@gnu.org>
 # Copyright © 2019 Amin Bandali <bandali@gnu.org>
 # Copyright © 2020 Brendan Tildesley <mail@brendan.scot>
 # Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
@@ -35,6 +35,9 @@
 # Copyright © 2020 Ryan Prior <rprior@protonmail.com>
 # Copyright © 2020 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
 # Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
+# Copyright © 2020 Tanguy Le Carrour <tanguy@bioneland.org>
+# Copyright © 2020 Martin Becze <mjbecze@riseup.net>
+# Copyright © 2020 Malte Frank Gerdes <mate.f.gerdes@gmail.com>
 #
 # This file is part of GNU Guix.
 #
@@ -131,8 +134,10 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/commencement.scm			\
  %D%/packages/compression.scm			\
  %D%/packages/compton.scm 			\
+  %D%/packages/configuration-management.scm	\
  %D%/packages/conky.scm			\
  %D%/packages/connman.scm			\
+  %D%/packages/convmv.scm			\
  %D%/packages/cook.scm				\
  %D%/packages/coq.scm				\
  %D%/packages/cpio.scm				\
@@ -140,6 +145,8 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/cppi.scm				\
  %D%/packages/cran.scm				\
  %D%/packages/crates-io.scm			\
+  %D%/packages/crates-graphics.scm		\
+  %D%/packages/crates-gtk.scm			\
  %D%/packages/cross-base.scm			\
  %D%/packages/crypto.scm			\
  %D%/packages/cryptsetup.scm			\
@@ -339,6 +346,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/lout.scm				\
  %D%/packages/logging.scm			\
  %D%/packages/logo.scm				\
+  %D%/packages/loko.scm				\
  %D%/packages/lolcode.scm                      \
  %D%/packages/lsof.scm				\
  %D%/packages/lua.scm				\
@@ -357,9 +365,11 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/maths.scm			\
  %D%/packages/matrix.scm			\
  %D%/packages/maven.scm			\
+  %D%/packages/maven-parent-pom.scm		\
  %D%/packages/mc.scm				\
  %D%/packages/mcrypt.scm			\
  %D%/packages/medical.scm			\
+  %D%/packages/mercury.scm			\
  %D%/packages/mes.scm				\
  %D%/packages/messaging.scm			\
  %D%/packages/mingw.scm			\
@@ -384,6 +394,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/networking.scm			\
  %D%/packages/nfs.scm                          \
  %D%/packages/nickle.scm                       \
+  %D%/packages/nicotine.scm                     \
  %D%/packages/nim.scm  			\
  %D%/packages/ninja.scm			\
  %D%/packages/node.scm				\
@@ -401,18 +412,21 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/openbox.scm			\
  %D%/packages/opencog.scm			\
  %D%/packages/openldap.scm			\
+  %D%/packages/openpgp.scm			\
  %D%/packages/openstack.scm			\
  %D%/packages/orpheus.scm			\
  %D%/packages/ots.scm				\
  %D%/packages/package-management.scm		\
  %D%/packages/pantheon.scm			\
  %D%/packages/parallel.scm			\
+  %D%/packages/pascal.scm			\
  %D%/packages/password-utils.scm		\
  %D%/packages/patchutils.scm			\
  %D%/packages/pciutils.scm			\
  %D%/packages/pcre.scm				\
  %D%/packages/pdf.scm				\
  %D%/packages/pem.scm				\
+  %D%/packages/pep.scm				\
  %D%/packages/perl.scm				\
  %D%/packages/perl-check.scm			\
  %D%/packages/perl-compression.scm		\
@@ -421,6 +435,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/photo.scm			\
  %D%/packages/phabricator.scm 			\
  %D%/packages/php.scm				\
+  %D%/packages/piet.scm			\
  %D%/packages/pkg-config.scm			\
  %D%/packages/plotutils.scm			\
  %D%/packages/poedit.scm				\
@@ -432,6 +447,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/pth.scm				\
  %D%/packages/pulseaudio.scm			\
  %D%/packages/pumpio.scm			\
+  %D%/packages/presentation.scm		\
  %D%/packages/pretty-print.scm			\
  %D%/packages/protobuf.scm			\
  %D%/packages/pure.scm				\
@@ -450,6 +466,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/radio.scm			\
  %D%/packages/ragel.scm			\
  %D%/packages/rails.scm			\
+  %D%/packages/raspberry-pi.scm			\
  %D%/packages/ratpoison.scm			\
  %D%/packages/rcm.scm				\
  %D%/packages/rdesktop.scm			\
@@ -501,6 +518,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/stalonetray.scm			\
  %D%/packages/statistics.scm			\
  %D%/packages/stb.scm				\
+  %D%/packages/stenography.scm			\
  %D%/packages/storage.scm			\
  %D%/packages/suckless.scm			\
  %D%/packages/swig.scm				\
@@ -535,6 +553,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/vim.scm				\
  %D%/packages/virtualization.scm		\
  %D%/packages/visidata.scm			\
+  %D%/packages/vlang.scm			\
  %D%/packages/vnc.scm				\
  %D%/packages/vpn.scm				\
  %D%/packages/vulkan.scm			\
@@ -580,6 +599,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/services/docker.scm			\
  %D%/services/authentication.scm		\
  %D%/services/games.scm			\
+  %D%/services/ganeti.scm			\
  %D%/services/getmail.scm				\
  %D%/services/guix.scm			\
  %D%/services/hurd.scm				\
@@ -595,6 +615,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/services/nix.scm				\
  %D%/services/nfs.scm			\
  %D%/services/pam-mount.scm			\
+  %D%/services/science.scm			\
  %D%/services/security-token.scm		\
  %D%/services/shepherd.scm			\
  %D%/services/sound.scm			\
@@ -628,9 +649,10 @@ GNU_SYSTEM_MODULES =				\
  %D%/system/uuid.scm				\
  %D%/system/vm.scm				\
 						\
+  %D%/system/images/hurd.scm			\
+  %D%/system/images/pine64.scm			\
+						\
  %D%/machine.scm				\
-  %D%/machine/digital-ocean.scm			\
-  %D%/machine/ssh.scm				\
 						\
  %D%/build/accounts.scm			\
  %D%/build/activation.scm			\
@@ -645,6 +667,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/build/linux-initrd.scm			\
  %D%/build/linux-modules.scm			\
  %D%/build/marionette.scm			\
+  %D%/build/secret-service.scm			\
  %D%/build/vm.scm				\
 						\
  %D%/tests.scm					\
@@ -655,6 +678,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/tests/desktop.scm				\
  %D%/tests/dict.scm				\
  %D%/tests/docker.scm				\
+  %D%/tests/ganeti.scm				\
  %D%/tests/guix.scm				\
  %D%/tests/monitoring.scm                      \
  %D%/tests/nfs.scm				\
@@ -664,6 +688,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/tests/mail.scm				\
  %D%/tests/messaging.scm			\
  %D%/tests/networking.scm			\
+  %D%/tests/package-management.scm		\
  %D%/tests/reconfigure.scm			\
  %D%/tests/rsync.scm				\
  %D%/tests/security-token.scm			\
@@ -708,6 +733,14 @@ INSTALLER_MODULES =                             \
  %D%/installer/newt/welcome.scm		\
  %D%/installer/newt/wifi.scm

+if HAVE_GUILE_SSH
+
+GNU_SYSTEM_MODULES +=         			\
+  %D%/machine/digital-ocean.scm			\
+  %D%/machine/ssh.scm
+
+endif HAVE_GUILE_SSH
+
 # Always ship the installer modules but compile them only when
 # ENABLE_INSTALLER is true.
 if ENABLE_INSTALLER
@@ -750,6 +783,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/akonadi-not-relocatable.patch		\
  %D%/packages/patches/akonadi-timestamps.patch		\
  %D%/packages/patches/allegro-mesa-18.2.5-and-later.patch	\
+  %D%/packages/patches/alsa-modular-synth-fix-vocoder.patch	\
  %D%/packages/patches/amule-crypto-6.patch			\
  %D%/packages/patches/anki-mpv-args.patch			\
  %D%/packages/patches/antiword-CVE-2014-8123.patch			\
@@ -766,14 +800,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/audiofile-CVE-2015-7747.patch		\
  %D%/packages/patches/audiofile-CVE-2018-13440.patch		\
  %D%/packages/patches/audiofile-CVE-2018-17095.patch		\
-  %D%/packages/patches/audiofile-Check-the-number-of-coefficients.patch \
+  %D%/packages/patches/audiofile-check-number-of-coefficients.patch \
  %D%/packages/patches/audiofile-Fail-on-error-in-parseFormat.patch \
  %D%/packages/patches/audiofile-Fix-index-overflow-in-IMA.cpp.patch \
-  %D%/packages/patches/audiofile-Fix-multiply-overflow-sfconvert.patch \
-  %D%/packages/patches/audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch \
-  %D%/packages/patches/audiofile-division-by-zero-BlockCodec-runPull.patch \
-  %D%/packages/patches/audiofile-hurd.patch \
-  %D%/packages/patches/audiofile-signature-of-multiplyCheckOverflow.patch \
+  %D%/packages/patches/audiofile-multiply-overflow.patch	\
+  %D%/packages/patches/audiofile-overflow-in-MSADPCM.patch	\
+  %D%/packages/patches/audiofile-division-by-zero.patch 	\
+  %D%/packages/patches/audiofile-hurd.patch 			\
+  %D%/packages/patches/audiofile-function-signature.patch	\
  %D%/packages/patches/automake-skip-amhello-tests.patch	\
  %D%/packages/patches/avahi-localstatedir.patch		\
  %D%/packages/patches/avogadro-boost148.patch			\
@@ -788,11 +822,21 @@ dist_patch_DATA =						\
  %D%/packages/patches/bastet-change-source-of-unordered_set.patch	\
  %D%/packages/patches/bazaar-CVE-2017-14176.patch		\
  %D%/packages/patches/bc-fix-cross-compilation.patch		\
+  %D%/packages/patches/bsd-games-2.17-64bit.patch		\
+  %D%/packages/patches/bsd-games-add-configure-config.patch	\
+  %D%/packages/patches/bsd-games-add-wrapper.patch		\
+  %D%/packages/patches/bsd-games-bad-ntohl-cast.patch		\
+  %D%/packages/patches/bsd-games-dont-install-empty-files.patch	\
+  %D%/packages/patches/bsd-games-gamescreen.h.patch		\
+  %D%/packages/patches/bsd-games-getline.patch			\
+  %D%/packages/patches/bsd-games-null-check.patch		\
+  %D%/packages/patches/bsd-games-number.c-and-test.patch	\
+  %D%/packages/patches/bsd-games-prevent-name-collisions.patch	\
+  %D%/packages/patches/bsd-games-stdio.h.patch			\
  %D%/packages/patches/beancount-disable-googleapis-fonts.patch	\
  %D%/packages/patches/beets-werkzeug-compat.patch		\
  %D%/packages/patches/behave-skip-a-couple-of-tests.patch	\
  %D%/packages/patches/beignet-correct-file-names.patch		\
-  %D%/packages/patches/benchmark-unbundle-googletest.patch	\
  %D%/packages/patches/biber-fix-encoding-write.patch		\
  %D%/packages/patches/biber-sortinithash.patch			\
  %D%/packages/patches/bidiv-update-fribidi.patch		\
@@ -801,13 +845,16 @@ dist_patch_DATA =						\
  %D%/packages/patches/binutils-mingw-w64-timestamp.patch	\
  %D%/packages/patches/binutils-mingw-w64-deterministic.patch	\
  %D%/packages/patches/bitcoin-core-python-compat.patch		\
+  %D%/packages/patches/blender-2.79-gcc8.patch			\
+  %D%/packages/patches/blender-2.79-gcc9.patch			\
  %D%/packages/patches/blender-2.79-newer-ffmpeg.patch		\
+  %D%/packages/patches/blender-2.79-oiio2.patch			\
  %D%/packages/patches/blender-2.79-python-3.7-fix.patch	\
-  %D%/packages/patches/bluez-CVE-2020-0556.patch		\
+  %D%/packages/patches/blender-2.79-python-3.8-fix.patch	\
+  %D%/packages/patches/bpftrace-disable-bfd-disasm.patch	\
+  %D%/packages/patches/busybox-1.31.1-fix-build-with-glibc-2.31.patch \
  %D%/packages/patches/byobu-writable-status.patch		\
-  %D%/packages/patches/calibre-msgpack-compat.patch		\
  %D%/packages/patches/calibre-no-updates-dialog.patch		\
-  %D%/packages/patches/calibre-remove-test-bs4.patch		\
  %D%/packages/patches/calibre-remove-test-sqlite.patch		\
  %D%/packages/patches/calibre-remove-test-unrar.patch		\
  %D%/packages/patches/casync-renameat2-declaration.patch	\
@@ -826,9 +873,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/clang-7.0-libc-search-path.patch		\
  %D%/packages/patches/clang-9.0-libc-search-path.patch		\
  %D%/packages/patches/clang-10.0-libc-search-path.patch	\
+  %D%/packages/patches/clang-11.0-libc-search-path.patch	\
  %D%/packages/patches/clang-runtime-asan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-esan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-9-libsanitizer-mode-field.patch	\
+  %D%/packages/patches/clang-runtime-3.5-libsanitizer-mode-field.patch	\
  %D%/packages/patches/clang-runtime-3.9-libsanitizer-mode-field.patch	\
  %D%/packages/patches/clang-runtime-3.8-libsanitizer-mode-field.patch	\
  %D%/packages/patches/classpath-aarch64-support.patch		\
@@ -860,13 +909,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/dbus-CVE-2020-12049.patch		\
  %D%/packages/patches/dbus-c++-gcc-compat.patch		\
  %D%/packages/patches/dbus-c++-threading-mutex.patch		\
+  %D%/packages/patches/dbxfs-remove-sentry-sdk.patch		\
  %D%/packages/patches/dconf-meson-0.52.patch			\
  %D%/packages/patches/debops-constants-for-external-program-names.patch \
  %D%/packages/patches/debops-debops-defaults-fall-back-to-less.patch \
+  %D%/packages/patches/dee-vapi.patch			\
  %D%/packages/patches/desmume-gcc6-fixes.patch			\
  %D%/packages/patches/desmume-gcc7-fixes.patch			\
  %D%/packages/patches/dfu-programmer-fix-libusb.patch		\
-  %D%/packages/patches/dhall-remove-network-tests.patch		\
  %D%/packages/patches/diffutils-gets-undeclared.patch		\
  %D%/packages/patches/dkimproxy-add-ipv6-support.patch		\
  %D%/packages/patches/docbook-xsl-nonrecursive-string-subst.patch	\
@@ -880,20 +930,26 @@ dist_patch_DATA =						\
  %D%/packages/patches/dstat-skip-devices-without-io.patch	\
  %D%/packages/patches/dune-istl-2.7-fix-non-mpi-tests.patch	\
  %D%/packages/patches/dvd+rw-tools-add-include.patch 		\
+  %D%/packages/patches/ecl-16-format-directive-limit.patch	\
+  %D%/packages/patches/ecl-16-ignore-stderr-write-error.patch	\
+  %D%/packages/patches/ecl-16-libffi.patch			\
  %D%/packages/patches/eigen-stabilise-sparseqr-test.patch	\
  %D%/packages/patches/einstein-build.patch			\
  %D%/packages/patches/elfutils-tests-ptrace.patch		\
  %D%/packages/patches/elixir-path-length.patch			\
  %D%/packages/patches/elm-compiler-disable-reactor.patch	\
  %D%/packages/patches/elm-compiler-fix-map-key.patch		\
-  %D%/packages/patches/emacs27-exec-path.patch			\
  %D%/packages/patches/emacs-exec-path.patch			\
+  %D%/packages/patches/emacs-exwm-fix-fullscreen-states.patch	\
  %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
+  %D%/packages/patches/emacs-ignore-empty-xim-styles.patch	\
  %D%/packages/patches/emacs-json-reformat-fix-tests.patch	\
  %D%/packages/patches/emacs-highlight-stages-add-gexp.patch	\
+  %D%/packages/patches/emacs-hyperbole-toggle-messaging.patch	\
  %D%/packages/patches/emacs-libgit-use-system-libgit2.patch    \
  %D%/packages/patches/emacs-scheme-complete-scheme-r5rs-info.patch	\
  %D%/packages/patches/emacs-source-date-epoch.patch		\
+  %D%/packages/patches/emacs-telega-patch-server-functions.patch	\
  %D%/packages/patches/emacs-telega-test-env.patch		\
  %D%/packages/patches/emacs-undohist-ignored.patch	\
  %D%/packages/patches/emacs-wordnut-require-adaptive-wrap.patch	\
@@ -904,10 +960,12 @@ dist_patch_DATA =						\
  %D%/packages/patches/evilwm-lost-focus-bug.patch		\
  %D%/packages/patches/evolution-data-server-locales.patch	\
  %D%/packages/patches/evolution-data-server-libical-compat.patch	\
+  %D%/packages/patches/exercism-disable-self-update.patch	\
  %D%/packages/patches/exiv2-CVE-2017-14860.patch		\
  %D%/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch	\
  %D%/packages/patches/extempore-unbundle-external-dependencies.patch	\
  %D%/packages/patches/extundelete-e2fsprogs-1.44.patch		\
+  %D%/packages/patches/farstream-make.patch                          \
  %D%/packages/patches/fastcap-mulGlobal.patch			\
  %D%/packages/patches/fastcap-mulSetup.patch			\
  %D%/packages/patches/fasthenry-spAllocate.patch		\
@@ -916,20 +974,30 @@ dist_patch_DATA =						\
  %D%/packages/patches/fasthenry-spSolve.patch			\
  %D%/packages/patches/fasthenry-spFactor.patch			\
  %D%/packages/patches/fbreader-curl-7.62.patch		\
-  %D%/packages/patches/ffmpeg-prefer-dav1d.patch		\
  %D%/packages/patches/fifengine-swig-compat.patch		\
  %D%/packages/patches/fifo-map-fix-flags-for-gcc.patch		\
  %D%/packages/patches/fifo-map-remove-catch.hpp.patch		\
  %D%/packages/patches/findutils-localstatedir.patch		\
  %D%/packages/patches/findutils-test-rwlock-threads.patch	\
  %D%/packages/patches/flann-cmake-3.11.patch			\
-  %D%/packages/patches/flint-ldconfig.patch			\
  %D%/packages/patches/foobillard++-pkg-config.patch		\
  %D%/packages/patches/foomatic-filters-CVE-2015-8327.patch	\
  %D%/packages/patches/foomatic-filters-CVE-2015-8560.patch	\
  %D%/packages/patches/fontconfig-hurd-path-max.patch		\
+  %D%/packages/patches/fpc-reproducibility.patch		\
+  %D%/packages/patches/fplll-std-fenv.patch     		\
+  %D%/packages/patches/freedink-engine-fix-sdl-hints.patch	\
  %D%/packages/patches/freeimage-unbundle.patch		\
  %D%/packages/patches/fuse-overlapping-headers.patch				\
+  %D%/packages/patches/ganeti-deterministic-manual.patch	\
+  %D%/packages/patches/ganeti-disable-version-symlinks.patch	\
+  %D%/packages/patches/ganeti-drbd-compat.patch			\
+  %D%/packages/patches/ganeti-haskell-pythondir.patch		\
+  %D%/packages/patches/ganeti-os-disk-size.patch		\
+  %D%/packages/patches/ganeti-preserve-PYTHONPATH.patch		\
+  %D%/packages/patches/ganeti-shepherd-master-failover.patch	\
+  %D%/packages/patches/ganeti-shepherd-support.patch		\
+  %D%/packages/patches/gash-utils-ls-test.patch			\
  %D%/packages/patches/gawk-shell.patch				\
  %D%/packages/patches/gcc-arm-bug-71399.patch			\
  %D%/packages/patches/gcc-arm-link-spec-fix.patch		\
@@ -968,6 +1036,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/gd-fix-tests-on-i686.patch		\
  %D%/packages/patches/gd-brect-bounds.patch			\
  %D%/packages/patches/gdm-default-session.patch		\
+  %D%/packages/patches/genimage-signedness.patch		\
  %D%/packages/patches/geoclue-config.patch			\
  %D%/packages/patches/ghc-8.0-fall-back-to-madv_dontneed.patch	\
  %D%/packages/patches/ghc-testsuite-dlopen-pie.patch		\
@@ -981,15 +1050,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghostscript-no-header-id.patch		\
  %D%/packages/patches/ghostscript-no-header-uuid.patch		\
  %D%/packages/patches/ghostscript-no-header-creationdate.patch \
+  %D%/packages/patches/glib-appinfo-watch.patch			\
  %D%/packages/patches/glib-tests-timer.patch			\
-  %D%/packages/patches/glibc-CVE-2015-5180.patch		\
-  %D%/packages/patches/glibc-CVE-2015-7547.patch		\
-  %D%/packages/patches/glibc-CVE-2016-3075.patch		\
-  %D%/packages/patches/glibc-CVE-2016-3706.patch		\
-  %D%/packages/patches/glibc-CVE-2016-4429.patch		\
-  %D%/packages/patches/glibc-CVE-2017-1000366-pt1.patch		\
-  %D%/packages/patches/glibc-CVE-2017-1000366-pt2.patch		\
-  %D%/packages/patches/glibc-CVE-2017-1000366-pt3.patch		\
  %D%/packages/patches/glibc-CVE-2018-11236.patch		\
  %D%/packages/patches/glibc-CVE-2018-11237.patch		\
  %D%/packages/patches/glibc-CVE-2019-7309.patch		\
@@ -1011,9 +1073,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/glibc-ldd-x86_64.patch			\
  %D%/packages/patches/glibc-locales.patch			\
  %D%/packages/patches/glibc-locales-2.28.patch			\
-  %D%/packages/patches/glibc-o-largefile.patch			\
  %D%/packages/patches/glibc-reinstate-prlimit64-fallback.patch	\
-  %D%/packages/patches/glibc-vectorized-strcspn-guards.patch	\
  %D%/packages/patches/glibc-versioned-locpath.patch		\
  %D%/packages/patches/glibc-2.27-git-fixes.patch		\
  %D%/packages/patches/glibc-2.28-git-fixes.patch		\
@@ -1026,6 +1086,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/gmp-faulty-test.patch			\
  %D%/packages/patches/gnome-shell-theme.patch			\
  %D%/packages/patches/gnome-shell-disable-test.patch		\
+  %D%/packages/patches/gnome-settings-daemon-gc.patch		\
  %D%/packages/patches/gnome-todo-delete-esource-duplicate.patch \
  %D%/packages/patches/gnome-tweaks-search-paths.patch		\
  %D%/packages/patches/gnupg-default-pinentry.patch		\
@@ -1036,13 +1097,16 @@ dist_patch_DATA =						\
  %D%/packages/patches/gobject-introspection-girepository.patch	\
  %D%/packages/patches/go-skip-gc-test.patch			\
  %D%/packages/patches/gpm-glibc-2.26.patch			\
+  %D%/packages/patches/gpodder-disable-updater.patch		\
  %D%/packages/patches/gpsbabel-minizip.patch     		\
  %D%/packages/patches/gpsbabel-qstring.patch     		\
  %D%/packages/patches/grantlee-merge-theme-dirs.patch		\
  %D%/packages/patches/grep-timing-sensitive-test.patch		\
+  %D%/packages/patches/grim-revert-output-rotation.patch	\
  %D%/packages/patches/grocsvs-dont-use-admiral.patch		\
  %D%/packages/patches/gromacs-tinyxml2.patch			\
  %D%/packages/patches/groovy-add-exceptionutilsgenerator.patch	\
+  %D%/packages/patches/grub-cross-system-i686.patch		\
  %D%/packages/patches/grub-efi-fat-serial-number.patch		\
  %D%/packages/patches/grub-setup-root.patch			\
  %D%/packages/patches/grub-verifiers-Blocklist-fallout-cleanup.patch \
@@ -1060,7 +1124,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/guile-present-coding.patch		\
  %D%/packages/patches/guile-rsvg-pkgconfig.patch		\
  %D%/packages/patches/guile-emacs-fix-configure.patch		\
-  %D%/packages/patches/guile-sqlite3-fix-cross-compilation.patch \
  %D%/packages/patches/gtk2-respect-GUIX_GTK2_PATH.patch	\
  %D%/packages/patches/gtk2-respect-GUIX_GTK2_IM_MODULE_FILE.patch \
  %D%/packages/patches/gtk2-theme-paths.patch			\
@@ -1068,6 +1131,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/gtk3-respect-GUIX_GTK3_IM_MODULE_FILE.patch \
  %D%/packages/patches/gtkglext-disable-disable-deprecated.patch \
  %D%/packages/patches/gtksourceview-2-add-default-directory.patch \
+  %D%/packages/patches/gvfs-add-support-for-libplist-2.2.patch	\
  %D%/packages/patches/gzdoom-search-in-installed-share.patch	\
  %D%/packages/patches/gzdoom-find-system-libgme.patch	\
  %D%/packages/patches/hdf4-architectures.patch 		\
@@ -1087,6 +1151,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/hubbub-sort-entities.patch		\
  %D%/packages/patches/hurd-cross.patch				\
  %D%/packages/patches/hurd-xattr.patch				\
+  %D%/packages/patches/hplip-fix-bug-1898438.patch		\
  %D%/packages/patches/hplip-remove-imageprocessor.patch	\
  %D%/packages/patches/hydra-disable-darcs-test.patch		\
  %D%/packages/patches/icecat-makeicecat.patch			\
@@ -1100,14 +1165,21 @@ dist_patch_DATA =						\
  %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
  %D%/packages/patches/id3lib-UTF16-writing-bug.patch			\
  %D%/packages/patches/ilmbase-fix-tests.patch			\
-  %D%/packages/patches/ilmbase-fix-test-arm.patch		\
  %D%/packages/patches/inetutils-hurd.patch			\
  %D%/packages/patches/inkscape-poppler-0.76.patch		\
+  %D%/packages/patches/intel-xed-fix-nondeterminism.patch	\
  %D%/packages/patches/intltool-perl-compatibility.patch	\
+  %D%/packages/patches/iputils-libcap-compat.patch		\
  %D%/packages/patches/irrlicht-use-system-libs.patch		\
  %D%/packages/patches/isl-0.11.1-aarch64-support.patch	\
+  %D%/packages/patches/json-c-CVE-2020-12762.patch		\
+  %D%/packages/patches/json-c-0.13-CVE-2020-12762.patch	\
+  %D%/packages/patches/json-c-0.12-CVE-2020-12762.patch	\
  %D%/packages/patches/jacal-fix-texinfo.patch			\
+  %D%/packages/patches/jamvm-2.0.0-disable-branch-patching.patch	\
  %D%/packages/patches/jamvm-arm.patch				\
+  %D%/packages/patches/java-antlr4-Add-standalone-generator.patch	\
+  %D%/packages/patches/java-antlr4-fix-code-too-large.java	\
  %D%/packages/patches/java-apache-ivy-port-to-latest-bouncycastle.patch	\
  %D%/packages/patches/java-commons-collections-fix-java8.patch \
  %D%/packages/patches/java-jeromq-fix-tests.patch		\
@@ -1123,10 +1195,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/jsoncpp-fix-inverted-case.patch		\
  %D%/packages/patches/julia-SOURCE_DATE_EPOCH-mtime.patch	\
  %D%/packages/patches/kdbusaddons-kinit-file-name.patch	\
+  %D%/packages/patches/libffi-3.3-powerpc-fixes.patch		\
  %D%/packages/patches/libvirt-create-machine-cgroup.patch	\
  %D%/packages/patches/libziparchive-add-includes.patch		\
  %D%/packages/patches/localed-xorg-keyboard.patch		\
-  %D%/packages/patches/kdepim-runtime-Fix-missing-link-libraries.patch \
  %D%/packages/patches/kdiagram-Fix-missing-link-libraries.patch \
  %D%/packages/patches/kiki-level-selection-crash.patch		\
  %D%/packages/patches/kiki-makefile.patch			\
@@ -1139,6 +1211,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/kmod-module-directory.patch		\
  %D%/packages/patches/kmscon-runtime-keymap-switch.patch	\
  %D%/packages/patches/kpackage-allow-external-paths.patch	\
+  %D%/packages/patches/kpackage-fix-KF5PackageMacros.cmake.patch \
  %D%/packages/patches/kmplayer-aarch64.patch			\
  %D%/packages/patches/kmplayer-upstream_Fix-build-with-Qt-5.9.patch	\
  %D%/packages/patches/kobodeluxe-paths.patch			\
@@ -1150,7 +1223,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/kodi-increase-test-timeout.patch		\
  %D%/packages/patches/kodi-set-libcurl-ssl-parameters.patch		\
  %D%/packages/patches/kodi-skip-test-449.patch		\
-  %D%/packages/patches/konversation-Fix-build-with-Qt-5.11.patch	\
  %D%/packages/patches/laby-make-install.patch			\
  %D%/packages/patches/lcalc-default-parameters-1.patch		\
  %D%/packages/patches/lcalc-default-parameters-2.patch		\
@@ -1159,11 +1231,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/lcms-CVE-2018-16435.patch		\
  %D%/packages/patches/ldc-bootstrap-disable-tests.patch	\
  %D%/packages/patches/ldc-disable-phobos-tests.patch		\
+  %D%/packages/patches/ldns-drill-examples.patch		\
  %D%/packages/patches/leela-zero-gtest.patch			\
  %D%/packages/patches/less-hurd-path-max.patch			\
-  %D%/packages/patches/lib2geom-enable-assertions.patch		\
-  %D%/packages/patches/lib2geom-link-tests-against-glib.patch	\
-  %D%/packages/patches/lib2geom-use-system-googletest.patch	\
+  %D%/packages/patches/lib2geom-fix-tests.patch			\
  %D%/packages/patches/liba52-enable-pic.patch			\
  %D%/packages/patches/liba52-link-with-libm.patch		\
  %D%/packages/patches/liba52-set-soname.patch			\
@@ -1172,14 +1243,17 @@ dist_patch_DATA =						\
  %D%/packages/patches/libbase-use-own-logging.patch		\
  %D%/packages/patches/libbonobo-activation-test-race.patch	\
  %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
-  %D%/packages/patches/libdrm-symbol-check.patch		\
-  %D%/packages/patches/libextractor-exiv2.patch			\
+  %D%/packages/patches/libcanberra-wayland-crash.patch \
+  %D%/packages/patches/libdrm-realpath-virtio.patch		\
  %D%/packages/patches/libgeotiff-adapt-test-script-for-proj-6.2.patch		\
  %D%/packages/patches/libgit2-mtime-0.patch			\
  %D%/packages/patches/libgnome-encoding.patch			\
  %D%/packages/patches/libgnomeui-utf8.patch			\
  %D%/packages/patches/libjxr-fix-function-signature.patch	\
  %D%/packages/patches/libjxr-fix-typos.patch			\
+  %D%/packages/patches/libofa-ftbfs-1.diff		\
+  %D%/packages/patches/libofa-curl.diff		\
+  %D%/packages/patches/libofa-ftbfs-2.diff		\
  %D%/packages/patches/libotr-test-auth-fix.patch		\
  %D%/packages/patches/libksieve-Fix-missing-link-libraries.patch \
  %D%/packages/patches/libmad-armv7-thumb-pt1.patch		\
@@ -1193,7 +1267,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/libmygpo-qt-fix-qt-5.11.patch		\
  %D%/packages/patches/libmygpo-qt-missing-qt5-modules.patch	\
  %D%/packages/patches/libqalculate-3.8.0-libcurl-ssl-fix.patch	\
-  %D%/packages/patches/libreoffice-poppler-compat.patch		\
+  %D%/packages/patches/libquicktime-ffmpeg.patch 		\
  %D%/packages/patches/libsndfile-armhf-type-checks.patch	\
  %D%/packages/patches/libsndfile-CVE-2017-8361-8363-8365.patch	\
  %D%/packages/patches/libsndfile-CVE-2017-8362.patch		\
@@ -1211,8 +1285,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/libutils-add-includes.patch		\
  %D%/packages/patches/libutils-remove-damaging-includes.patch	\
  %D%/packages/patches/libvdpau-va-gl-unbundle.patch		\
-  %D%/packages/patches/libvnc-CVE-2018-20750.patch		\
-  %D%/packages/patches/libvnc-CVE-2019-15681.patch		\
  %D%/packages/patches/libvpx-CVE-2016-2818.patch		\
  %D%/packages/patches/libxslt-generated-ids.patch		\
  %D%/packages/patches/libxt-guix-search-paths.patch		\
@@ -1221,6 +1293,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/lierolibre-newer-libconfig.patch		\
  %D%/packages/patches/lierolibre-remove-arch-warning.patch	\
  %D%/packages/patches/lierolibre-try-building-other-arch.patch	\
+  %D%/packages/patches/linbox-fix-pkgconfig.patch		\
  %D%/packages/patches/linkchecker-tests-require-network.patch	\
  %D%/packages/patches/linphoneqt-tabbutton.patch		\
  %D%/packages/patches/linux-libre-support-for-Pinebook-Pro.patch \
@@ -1228,9 +1301,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/lirc-localstatedir.patch			\
  %D%/packages/patches/lirc-reproducible-build.patch		\
  %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
+  %D%/packages/patches/llvm-9-fix-bitcast-miscompilation.patch	\
+  %D%/packages/patches/llvm-9-fix-lpad-miscompilation.patch	\
+  %D%/packages/patches/llvm-9-fix-scev-miscompilation.patch	\
  %D%/packages/patches/lm-sensors-hwmon-attrs.patch		\
  %D%/packages/patches/lrcalc-includes.patch    		\
  %D%/packages/patches/lrzip-CVE-2017-8842.patch		\
+  %D%/packages/patches/lsh-fix-x11-forwarding.patch		\
  %D%/packages/patches/lua-CVE-2014-5461.patch                      \
  %D%/packages/patches/lua-pkgconfig.patch                      \
  %D%/packages/patches/lua51-liblua-so.patch                    \
@@ -1238,19 +1315,21 @@ dist_patch_DATA =						\
  %D%/packages/patches/lua-liblua-so.patch                      \
  %D%/packages/patches/luajit-no_ldconfig.patch			\
  %D%/packages/patches/luit-posix.patch				\
-  %D%/packages/patches/luminance-hdr-qt-printer.patch		\
  %D%/packages/patches/lvm2-static-link.patch			\
+  %D%/packages/patches/mailutils-fix-uninitialized-variable.patch	\
  %D%/packages/patches/make-impure-dirs.patch			\
  %D%/packages/patches/mariadb-client-test-32bit.patch		\
  %D%/packages/patches/mars-install.patch			\
  %D%/packages/patches/mars-sfml-2.3.patch			\
  %D%/packages/patches/maxima-defsystem-mkdir.patch		\
+  %D%/packages/patches/maven-enforcer-api-fix-old-dependencies.patch	\
  %D%/packages/patches/maven-generate-component-xml.patch		\
  %D%/packages/patches/maven-generate-javax-inject-named.patch		\
  %D%/packages/patches/mcrypt-CVE-2012-4409.patch			\
  %D%/packages/patches/mcrypt-CVE-2012-4426.patch			\
  %D%/packages/patches/mcrypt-CVE-2012-4527.patch			\
  %D%/packages/patches/libmemcached-build-with-gcc7.patch	\
+  %D%/packages/patches/libmhash-hmac-fix-uaf.patch		\
  %D%/packages/patches/mediastreamer2-srtp2.patch		\
  %D%/packages/patches/mesa-skip-disk-cache-test.patch		\
  %D%/packages/patches/mescc-tools-boot.patch			\
@@ -1289,26 +1368,26 @@ dist_patch_DATA =						\
  %D%/packages/patches/m4-gnulib-libio.patch			\
  %D%/packages/patches/ncompress-fix-softlinks.patch		\
  %D%/packages/patches/netcdf-date-time.patch			\
-  %D%/packages/patches/netcdf-tst_h_par.patch			\
  %D%/packages/patches/netpbm-CVE-2017-2586.patch		\
  %D%/packages/patches/netpbm-CVE-2017-2587.patch		\
  %D%/packages/patches/netsurf-message-timestamp.patch		\
  %D%/packages/patches/netsurf-system-utf8proc.patch		\
  %D%/packages/patches/netsurf-y2038-tests.patch		\
  %D%/packages/patches/netsurf-longer-test-timeout.patch	\
+  %D%/packages/patches/nfs4-acl-tools-0.3.7-fixpaths.patch	\
  %D%/packages/patches/ngircd-handle-zombies.patch		\
  %D%/packages/patches/network-manager-plugin-path.patch	\
+  %D%/packages/patches/nginx-socket-cloexec.patch		\
  %D%/packages/patches/nsis-env-passthru.patch			\
-  %D%/packages/patches/nss-CVE-2020-12399.patch			\
  %D%/packages/patches/nss-increase-test-timeout.patch		\
  %D%/packages/patches/nss-pkgconfig.patch			\
+  %D%/packages/patches/nss-3.56-pkgconfig.patch			\
  %D%/packages/patches/ntfs-3g-CVE-2019-9755.patch		\
  %D%/packages/patches/nvi-assume-preserve-path.patch		\
  %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
  %D%/packages/patches/nvi-db4.patch				\
  %D%/packages/patches/nyacc-binary-literals.patch		\
  %D%/packages/patches/oath-toolkit-glibc-compat.patch		\
-  %D%/packages/patches/ocaml-bisect-fix-camlp4-in-another-directory.patch	\
  %D%/packages/patches/ocaml-bitstring-fix-configure.patch \
  %D%/packages/patches/ocaml-CVE-2015-8869.patch		\
  %D%/packages/patches/ocaml-Add-a-.file-directive.patch	\
@@ -1318,17 +1397,18 @@ dist_patch_DATA =						\
  %D%/packages/patches/ocaml-dose3-dont-make-printconf.patch	\
  %D%/packages/patches/ocaml-dose3-Install-mli-cmx-etc.patch	\
  %D%/packages/patches/omake-fix-non-determinism.patch	\
-  %D%/packages/patches/ola-readdir-r.patch			\
  %D%/packages/patches/openbabel-fix-crash-on-nwchem-output.patch	\
  %D%/packages/patches/opencascade-oce-glibc-2.26.patch		\
+  %D%/packages/patches/opencv-fix-build-of-grfmt_jpeg2000.cpp.patch	\
  %D%/packages/patches/opencv-rgbd-aarch64-test-fix.patch	\
+  %D%/packages/patches/opendht-fix-jami.patch			\
  %D%/packages/patches/openfoam-4.1-cleanup.patch			\
  %D%/packages/patches/openjdk-10-idlj-reproducibility.patch	\
  %D%/packages/patches/openmpi-mtl-priorities.patch		\
-  %D%/packages/patches/openocd-nrf52.patch			\
  %D%/packages/patches/openssh-hurd.patch			\
  %D%/packages/patches/openresolv-restartcmd-guix.patch	\
  %D%/packages/patches/openscad-parser-boost-1.72.patch	\
+  %D%/packages/patches/opensles-add-license-file.patch			\
  %D%/packages/patches/openssl-runpath.patch			\
  %D%/packages/patches/openssl-1.1-c-rehash-in.patch		\
  %D%/packages/patches/openssl-c-rehash-in.patch		\
@@ -1345,12 +1425,17 @@ dist_patch_DATA =						\
  %D%/packages/patches/pam-mount-luks2-support.patch		\
  %D%/packages/patches/pango-skip-libthai-test.patch		\
  %D%/packages/patches/pciutils-hurd-configure.patch		\
+  %D%/packages/patches/plasma-framework-fix-KF5PlasmaMacros.cmake.patch \
+  %D%/packages/patches/ppsspp-disable-upgrade-and-gold.patch		\
+  %D%/packages/patches/samba-fix-fcntl-hint-detection.patch		\
  %D%/packages/patches/sdl-pango-api_additions.patch		\
  %D%/packages/patches/sdl-pango-blit_overflow.patch		\
  %D%/packages/patches/sdl-pango-fillrect_crash.patch		\
  %D%/packages/patches/sdl-pango-header-guard.patch		\
  %D%/packages/patches/sdl-pango-matrix_declarations.patch	\
  %D%/packages/patches/sdl-pango-sans-serif.patch		\
+  %D%/packages/patches/sqlite-hurd.patch			\
+  %D%/packages/patches/sunxi-tools-remove-sys-io.patch	\
  %D%/packages/patches/patchutils-test-perms.patch		\
  %D%/packages/patches/patch-hurd-path-max.patch		\
  %D%/packages/patches/perl-autosplit-default-time.patch	\
@@ -1365,6 +1450,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/perl-module-pluggable-search.patch	\
  %D%/packages/patches/perl-reproducible-build-date.patch	\
  %D%/packages/patches/perl-www-curl-remove-symbol.patch	\
+  %D%/packages/patches/picard-fix-id3-rename-test.patch		\
  %D%/packages/patches/picprog-non-intel-support.patch		\
  %D%/packages/patches/pidgin-add-search-path.patch		\
  %D%/packages/patches/pidgin-libnm.patch			\
@@ -1377,10 +1463,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/pingus-boost-headers.patch		\
  %D%/packages/patches/pingus-sdl-libs-config.patch		\
  %D%/packages/patches/pixman-CVE-2016-5296.patch		\
+  %D%/packages/patches/pjproject-correct-the-cflags-field.patch \
+  %D%/packages/patches/pjproject-fix-pkg-config-ldflags.patch	\
  %D%/packages/patches/plink-1.07-unclobber-i.patch		\
  %D%/packages/patches/plink-endian-detection.patch		\
  %D%/packages/patches/plib-CVE-2011-4620.patch		\
  %D%/packages/patches/plib-CVE-2012-4552.patch		\
+  %D%/packages/patches/plotutils-spline-test.patch		\
  %D%/packages/patches/podofo-cmake-3.12.patch			\
  %D%/packages/patches/portaudio-audacity-compat.patch		\
  %D%/packages/patches/portmidi-modular-build.patch		\
@@ -1401,7 +1490,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/pygpgme-disable-problematic-tests.patch  \
  %D%/packages/patches/pyqt-configure.patch			\
  %D%/packages/patches/pyqt-public-sip.patch			\
-  %D%/packages/patches/pyqt-unbundled-qt.patch			\
  %D%/packages/patches/python-2-deterministic-build-info.patch	\
  %D%/packages/patches/python-2.7-adjust-tests.patch		\
  %D%/packages/patches/python-2.7-search-paths.patch		\
@@ -1414,7 +1502,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-3.8-fix-tests.patch		\
  %D%/packages/patches/python-CVE-2018-14647.patch		\
  %D%/packages/patches/python-aiohttp-3.6.2-no-warning-fail.patch	\
-  %D%/packages/patches/python-alembic-exceptions-cause.patch	\
+  %D%/packages/patches/python-aionotify-0.2.0-py3.8.patch	\
  %D%/packages/patches/python-argcomplete-1.11.1-fish31.patch	\
  %D%/packages/patches/python-axolotl-AES-fix.patch		\
  %D%/packages/patches/python-cairocffi-dlopen-path.patch	\
@@ -1427,33 +1515,37 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-pep8-stdlib-tokenize-compat.patch \
  %D%/packages/patches/python-pyfakefs-remove-bad-test.patch	\
  %D%/packages/patches/python-flint-includes.patch		\
-  %D%/packages/patches/python-jedi-sort-project-test.patch	\
  %D%/packages/patches/python-libxml2-utf8.patch		\
+  %D%/packages/patches/python-memcached-syntax-warnings.patch	\
  %D%/packages/patches/python-mox3-python3.6-compat.patch	\
  %D%/packages/patches/python-testtools.patch			\
+  %D%/packages/patches/python-onnx-use-system-googletest.patch	\
  %D%/packages/patches/python-packaging-test-arch.patch		\
  %D%/packages/patches/python2-parameterized-docstring-test.patch	\
  %D%/packages/patches/python-paste-remove-timing-test.patch	\
  %D%/packages/patches/python-pycrypto-CVE-2013-7459.patch	\
  %D%/packages/patches/python-pycrypto-time-clock.patch		\
-  %D%/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \
+  %D%/packages/patches/python2-pygobject-2-deprecation.patch	\
  %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch	\
-  %D%/packages/patches/python-robotframework-honor-source-date-epoch.patch \
+  %D%/packages/patches/python-robotframework-source-date-epoch.patch \
  %D%/packages/patches/python-shouldbe-0.1.2-cpy3.8.patch	\
-  %D%/packages/patches/python-slugify-depend-on-unidecode.patch	\
  %D%/packages/patches/python2-subprocess32-disable-input-test.patch	\
+  %D%/packages/patches/python-tinycss2-flake8-compat.patch	\
  %D%/packages/patches/python-unittest2-python3-compat.patch	\
  %D%/packages/patches/python-unittest2-remove-argparse.patch	\
  %D%/packages/patches/python-waitress-fix-tests.patch		\
  %D%/packages/patches/pypy3-7.3.1-fix-tests.patch		\
+  %D%/packages/patches/qemu-build-info-manual.patch		\
  %D%/packages/patches/qemu-glibc-2.27.patch 			\
  %D%/packages/patches/qrcodegen-cpp-make-install.patch		\
  %D%/packages/patches/qt4-ldflags.patch			\
+  %D%/packages/patches/qtbase-absolute-runpath.patch		\
+  %D%/packages/patches/qtbase-fix-krita-deadlock.patch		\
  %D%/packages/patches/qtbase-moc-ignore-gcc-macro.patch	\
  %D%/packages/patches/qtbase-use-TZDIR.patch			\
-  %D%/packages/patches/qtbase-QTBUG-81715.patch			\
  %D%/packages/patches/qtscript-disable-tests.patch		\
  %D%/packages/patches/quagga-reproducible-build.patch          \
+  %D%/packages/patches/quassel-qt-514-compat.patch		\
  %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
  %D%/packages/patches/qtwebkit-pbutils-include.patch		\
  %D%/packages/patches/randomjungle-disable-static-build.patch	\
@@ -1462,23 +1554,30 @@ dist_patch_DATA =						\
  %D%/packages/patches/raptor2-heap-overflow.patch		\
  %D%/packages/patches/ratpoints-sturm_and_rp_private.patch	\
  %D%/packages/patches/ratpoison-shell.patch			\
-  %D%/packages/patches/rcs-5.9.4-noreturn.patch			\
+  %D%/packages/patches/rcs-5.10.0-no-stdin.patch		\
  %D%/packages/patches/rct-add-missing-headers.patch		\
  %D%/packages/patches/readline-link-ncurses.patch		\
  %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
+  %D%/packages/patches/r-httpuv-1.5.4-unvendor-libuv.patch	\
  %D%/packages/patches/ri-li-modernize_cpp.patch		\
  %D%/packages/patches/ripperx-missing-file.patch		\
  %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
  %D%/packages/patches/rtags-separate-rct.patch			\
  %D%/packages/patches/racket-store-checksum-override.patch	\
+  %D%/packages/patches/remake-impure-dirs.patch			\
  %D%/packages/patches/retroarch-disable-online-updater.patch	\
+  %D%/packages/patches/rnp-add-version.cmake.patch		\
+  %D%/packages/patches/rnp-disable-ruby-rnp-tests.patch		\
+  %D%/packages/patches/rnp-unbundle-googletest.patch		\
  %D%/packages/patches/ruby-rack-ignore-failing-test.patch	\
+  %D%/packages/patches/ruby-rubocop-break-dependency-cycle.patch\
  %D%/packages/patches/ruby-sanitize-system-libxml.patch	\
  %D%/packages/patches/ruby-tzinfo-data-ignore-broken-test.patch\
  %D%/packages/patches/runc-CVE-2019-5736.patch			\
  %D%/packages/patches/rust-1.19-mrustc.patch			\
  %D%/packages/patches/rust-1.25-accept-more-detailed-gdb-lines.patch \
+  %D%/packages/patches/rust-1.45-linker-locale.patch		\
  %D%/packages/patches/rust-bootstrap-stage0-test.patch		\
  %D%/packages/patches/rust-coresimd-doctest.patch		\
  %D%/packages/patches/rust-nettle-disable-vendor.patch		 \
@@ -1486,6 +1585,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/rust-reproducible-builds.patch		 \
  %D%/packages/patches/rust-openssl-sys-no-vendor.patch	\
  %D%/packages/patches/rxvt-unicode-escape-sequences.patch	\
+  %D%/packages/patches/sbcl-geco-fix-organism-class.patch	\
  %D%/packages/patches/sbcl-graph-asdf-definitions.patch	\
  %D%/packages/patches/scalapack-blacs-mpi-deprecations.patch	\
  %D%/packages/patches/scheme48-tests.patch			\
@@ -1494,6 +1594,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/screen-hurd-path-max.patch		\
  %D%/packages/patches/scribus-1.5.5-poppler-0.86-build-fix.patch	\
  %D%/packages/patches/sdl-libx11-1.6.patch			\
+  %D%/packages/patches/seed-webkit.patch			\
  %D%/packages/patches/seq24-rename-mutex.patch			\
  %D%/packages/patches/sharutils-CVE-2018-1000097.patch		\
  %D%/packages/patches/shadow-hurd-pctrl.patch			\
@@ -1505,7 +1606,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/slim-login.patch				\
  %D%/packages/patches/slim-display.patch			\
  %D%/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch	\
-  %D%/packages/patches/sooperlooper-build-with-wx-30.patch 	\
+  %D%/packages/patches/sphinxbase-fix-doxygen.patch		\
+  %D%/packages/patches/sssd-fix-samba.patch			\
+  %D%/packages/patches/sssd-system-directories.patch		\
  %D%/packages/patches/steghide-fixes.patch			\
  %D%/packages/patches/suitesparse-mongoose-cmake.patch		\
  %D%/packages/patches/superlu-dist-awpm-grid.patch		\
@@ -1521,6 +1624,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/t1lib-CVE-2011-0764.patch		\
  %D%/packages/patches/t1lib-CVE-2011-1552+.patch		\
  %D%/packages/patches/t4k-common-libpng16.patch		\
+  %D%/packages/patches/tao-add-missing-headers.patch		\
+  %D%/packages/patches/tao-fix-parser-types.patch		\
  %D%/packages/patches/tar-remove-wholesparse-check.patch	\
  %D%/packages/patches/tar-skip-unreliable-tests.patch		\
  %D%/packages/patches/tcc-boot-0.9.27.patch			\
@@ -1541,21 +1646,19 @@ dist_patch_DATA =						\
  %D%/packages/patches/tipp10-fix-compiling.patch		\
  %D%/packages/patches/tipp10-remove-license-code.patch		\
  %D%/packages/patches/tk-find-library.patch			\
-  %D%/packages/patches/transmission-CVE-2018-10756.patch	\
+  %D%/packages/patches/transcode-ffmpeg.patch	\
  %D%/packages/patches/ttf2eot-cstddef.patch			\
-  %D%/packages/patches/ttfautohint-source-date-epoch.patch	\
  %D%/packages/patches/tomb-fix-errors-on-open.patch		\
+  %D%/packages/patches/tup-unbundle-dependencies.patch		\
  %D%/packages/patches/tuxpaint-stamps-path.patch		\
  %D%/packages/patches/twinkle-bcg729.patch			\
  %D%/packages/patches/u-boot-riscv64-fix-extlinux.patch	\
-  %D%/packages/patches/u-boot-DT-for-Pinebook-Pro.patch		\
-  %D%/packages/patches/u-boot-add-boe-nv140fhmn49-display.patch	\
-  %D%/packages/patches/u-boot-gpio-keys-binding-cons.patch	\
-  %D%/packages/patches/u-boot-leds-common-binding-con.patch	\
-  %D%/packages/patches/u-boot-support-Pinebook-Pro-laptop.patch	\
-  %D%/packages/patches/u-boot-video-rockchip-fix-build.patch	\
  %D%/packages/patches/ucx-tcp-iface-ioctl.patch		\
  %D%/packages/patches/udiskie-no-appindicator.patch		\
+  %D%/packages/patches/ungoogled-chromium-extension-search-path.patch	\
+  %D%/packages/patches/ungoogled-chromium-system-nspr.patch	\
+  %D%/packages/patches/unison-fix-ocaml-4.08.patch		\
+  %D%/packages/patches/unknown-horizons-python-3.8-distro.patch	\
  %D%/packages/patches/unzip-CVE-2014-8139.patch		\
  %D%/packages/patches/unzip-CVE-2014-8140.patch		\
  %D%/packages/patches/unzip-CVE-2014-8141.patch		\
@@ -1576,6 +1679,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/vboot-utils-fix-format-load-address.patch	\
  %D%/packages/patches/vboot-utils-fix-tests-show-contents.patch	\
  %D%/packages/patches/vboot-utils-skip-test-workbuf.patch	\
+  %D%/packages/patches/vcflib-use-shared-libraries.patch	\
  %D%/packages/patches/vigra-python-compat.patch		\
  %D%/packages/patches/vinagre-newer-freerdp.patch             \
  %D%/packages/patches/vinagre-newer-rdp-parameters.patch      \
@@ -1589,11 +1693,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/warsow-qfusion-fix-bool-return-type.patch	\
  %D%/packages/patches/weasyprint-library-paths.patch		\
  %D%/packages/patches/webkitgtk-share-store.patch		\
+  %D%/packages/patches/webkitgtk-bind-all-fonts.patch		\
  %D%/packages/patches/websocketpp-fix-for-cmake-3.15.patch	\
+  %D%/packages/patches/wgetpaste-update-bpaste.patch		\
  %D%/packages/patches/wicd-bitrate-none-fix.patch		\
  %D%/packages/patches/wicd-get-selected-profile-fix.patch	\
  %D%/packages/patches/wicd-urwid-1.3.patch			\
  %D%/packages/patches/wicd-wpa2-ttls.patch			\
+  %D%/packages/patches/widelands-system-wide_minizip.patch	\
  %D%/packages/patches/wmctrl-64-fix.patch			\
  %D%/packages/patches/wmfire-update-for-new-gdk-versions.patch	\
  %D%/packages/patches/wordnet-CVE-2008-2149.patch			\
@@ -1601,22 +1708,20 @@ dist_patch_DATA =						\
  %D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch			\
  %D%/packages/patches/x265-arm-flags.patch			\
  %D%/packages/patches/xf86-video-ark-remove-mibstore.patch	\
-  %D%/packages/patches/xf86-video-geode-glibc-2.20.patch	\
  %D%/packages/patches/xf86-video-mach64-glibc-2.20.patch	\
  %D%/packages/patches/xf86-video-savage-xorg-compat.patch 	\
  %D%/packages/patches/xf86-video-siliconmotion-fix-ftbfs.patch \
-  %D%/packages/patches/xf86-video-sis-xorg-compat.patch 	\
  %D%/packages/patches/xf86-video-tga-remove-mibstore.patch	\
  %D%/packages/patches/xf86-video-voodoo-pcitag.patch		\
  %D%/packages/patches/xfce4-panel-plugins.patch		\
  %D%/packages/patches/xfce4-settings-defaults.patch		\
-  %D%/packages/patches/xmoto-utf8.patch				\
-  %D%/packages/patches/xmoto-remove-glext.patch			\
-  %D%/packages/patches/xmoto-reproducible.patch			\
+  %D%/packages/patches/xmonad-dynamic-linking.patch		\
  %D%/packages/patches/xplanet-1.3.1-cxx11-eof.patch		\
  %D%/packages/patches/xplanet-1.3.1-libdisplay_DisplayOutput.cpp.patch	\
  %D%/packages/patches/xplanet-1.3.1-libimage_gif.c.patch	\
  %D%/packages/patches/xplanet-1.3.1-xpUtil-Add2017LeapSecond.cpp.patch	\
+  %D%/packages/patches/xpra-4.0.1-systemd-run.patch	\
+  %D%/packages/patches/xpra-4.0.4-norequests.patch	\
  %D%/packages/patches/xsane-fix-memory-leak.patch		\
  %D%/packages/patches/xsane-fix-pdf-floats.patch		\
  %D%/packages/patches/xsane-fix-snprintf-buffer-length.patch	\
@@ -23,7 +23,7 @@
  #:use-module (guix monads)
  #:use-module (guix records)
  #:use-module (guix store)
-  #:use-module ((guix utils) #:select (source-properties->location))
+  #:use-module ((guix diagnostics) #:select (source-properties->location))
  #:use-module (srfi srfi-35)
  #:export (environment-type
            environment-type?
@@ -26,6 +26,7 @@
  #:use-module (guix base32)
  #:use-module (guix derivations)
  #:use-module (guix i18n)
+  #:use-module ((guix diagnostics) #:select (formatted-message))
  #:use-module (guix import json)
  #:use-module (guix monads)
  #:use-module (guix records)
@@ -414,9 +415,7 @@ one procured from https://cloud.digitalocean.com/account/api/tokens.")))))))
  (let ((config (machine-configuration machine))
        (environment (environment-type-name (machine-environment machine))))
    (unless (and config (digital-ocean-configuration? config))
-      (raise (condition
-              (&message
-               (message (format #f (G_ "unsupported machine configuration '~a'
+      (raise (formatted-message (G_ "unsupported machine configuration '~a' \
 for environment of type '~a'")
                                config
-                                environment))))))))
+                                environment)))))
@@ -24,6 +24,7 @@
  #:use-module (gnu system)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system uuid)
+  #:use-module ((gnu services) #:select (sexp->system-provenance))
  #:use-module (guix diagnostics)
  #:use-module (guix gexp)
  #:use-module (guix i18n)
@@ -36,7 +37,9 @@
  #:use-module (guix ssh)
  #:use-module (guix store)
  #:use-module (guix utils)
+  #:use-module ((guix self) #:select (make-config.scm))
  #:use-module (gcrypt pk-crypto)
+  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
  #:use-module (ice-9 textual-ports)
  #:use-module (srfi srfi-1)
@@ -54,6 +57,7 @@
            machine-ssh-configuration-host-name
            machine-ssh-configuration-build-locally?
            machine-ssh-configuration-authorize?
+            machine-ssh-configuration-allow-downgrades?
            machine-ssh-configuration-port
            machine-ssh-configuration-user
            machine-ssh-configuration-host-key
@@ -82,6 +86,8 @@
                  (default #t))
  (authorize?     machine-ssh-configuration-authorize?     ; boolean
                  (default #t))
+  (allow-downgrades? machine-ssh-configuration-allow-downgrades? ; boolean
+                     (default #f))
  (port           machine-ssh-configuration-port           ; integer
                  (default 22))
  (user           machine-ssh-configuration-user           ; string
@@ -167,6 +173,8 @@ exist on the machine."
              (and (file-system-mount? fs)
                   (not (member (file-system-type fs)
                                %pseudo-file-system-types))
+                   ;; Don't try to validate network file systems.
+                   (not (string-prefix? "nfs" (file-system-type fs)))
                   (not (memq 'bind-mount (file-system-flags fs)))))
            (operating-system-file-systems (machine-operating-system machine))))

@@ -178,11 +186,9 @@ exist on the machine."
                            (lambda args
                              (system-error-errno args)))))
      (when (number? errno)
-        (raise (condition
-                (&message
-                 (message (format #f (G_ "device '~a' not found: ~a")
+        (raise (formatted-message (G_ "device '~a' not found: ~a")
                                  (file-system-device fs)
-                                  (strerror errno)))))))))
+                                  (strerror errno))))))

  (define (check-labeled-file-system fs)
    (define remote-exp
@@ -195,11 +201,9 @@ exist on the machine."

    (remote-let ((result remote-exp))
      (unless result
-        (raise (condition
-                (&message
-                 (message (format #f (G_ "no file system with label '~a'")
+        (raise (formatted-message (G_ "no file system with label '~a'")
                                  (file-system-label->string
-                                   (file-system-device fs))))))))))
+                                   (file-system-device fs)))))))

  (define (check-uuid-file-system fs)
    (define remote-exp
@@ -210,17 +214,14 @@ exist on the machine."
            (use-modules (gnu build file-systems)
                         (gnu system uuid))

-            (define uuid
-              (string->uuid #$(uuid->string (file-system-device fs))))
-
-            (find-partition-by-uuid uuid))))
+            (let ((uuid (uuid #$(uuid->string (file-system-device fs))
+                              '#$(uuid-type (file-system-device fs)))))
+              (find-partition-by-uuid uuid)))))

    (remote-let ((result remote-exp))
      (unless result
-        (raise (condition
-                (&message
-                 (message (format #f (G_ "no file system with UUID '~a'")
-                                  (uuid->string (file-system-device fs))))))))))
+        (raise (formatted-message (G_ "no file system with UUID '~a'")
+                                  (uuid->string (file-system-device fs)))))))

  (append (map check-literal-file-system
               (filter (lambda (fs)
@@ -277,6 +278,27 @@ not available in the initrd."

  (map missing-modules file-systems))

+(define* (machine-check-forward-update machine)
+  "Check whether we are making a forward update for MACHINE.  Depending on its
+'allow-upgrades?' field, raise an error or display a warning if we are
+potentially downgrading it."
+  (define config
+    (machine-configuration machine))
+
+  (define validate-reconfigure
+    (if (machine-ssh-configuration-allow-downgrades? config)
+        warn-about-backward-reconfigure
+        ensure-forward-reconfigure))
+
+  (remote-let ((provenance #~(call-with-input-file
+                                 "/run/current-system/provenance"
+                               read)))
+    (define channels
+      (sexp->system-provenance provenance))
+
+    (check-forward-update validate-reconfigure
+                          #:current-channels channels)))
+
 (define (machine-check-building-for-appropriate-system machine)
  "Raise a '&message' error condition if MACHINE is configured to be built
 locally and the 'system' field does not match the '%current-system' reported
@@ -285,19 +307,18 @@ by MACHINE."
        (system (remote-system (machine-ssh-session machine))))
    (when (and (machine-ssh-configuration-build-locally? config)
               (not (string= system (machine-ssh-configuration-system config))))
-      (raise (condition
-              (&message
-               (message (format #f (G_ "incorrect target system\
+      (raise (formatted-message (G_ "incorrect target system\
 ('~a' was given, while the system reports that it is '~a')~%")
                                (machine-ssh-configuration-system config)
-                                system))))))))
+                                system)))))

 (define (check-deployment-sanity machine)
  "Raise a '&message' error condition if it is clear that deploying MACHINE's
 'system' declaration would fail."
  (define assertions
    (append (machine-check-file-system-availability machine)
-            (machine-check-initrd-modules machine)))
+            (machine-check-initrd-modules machine)
+            (list (machine-check-forward-update machine))))

  (define aggregate-exp
    ;; Gather all the expressions so that a single round-trip is enough to
@@ -333,8 +354,9 @@ of MACHINE's system profile, ordered from most recent to oldest."

  (define remote-exp
    (with-extensions (list guile-gcrypt)
-      (with-imported-modules (source-module-closure '((guix config)
-                                                      (guix profiles)))
+      (with-imported-modules (source-module-closure
+                              `(((guix config) => ,(make-config.scm))
+                                (guix profiles)))
        #~(begin
            (use-modules (guix config)
                         (guix profiles)
@@ -402,11 +424,9 @@ environment type of 'managed-host."
  (when (machine-ssh-configuration-authorize?
         (machine-configuration machine))
    (unless (file-exists? %public-key-file)
-      (raise (condition
-              (&message
-               (message (format #f (G_ "no signing key '~a'. \
+      (raise (formatted-message (G_ "no signing key '~a'. \
 have you run 'guix archive --generate-key?'")
-                                %public-key-file))))))
+                                %public-key-file)))
    (remote-authorize-signing-key (call-with-input-file %public-key-file
                                    (lambda (port)
                                      (string->canonical-sexp
@@ -462,6 +482,10 @@ an environment type of 'managed-host."
                                 (raise roll-back-failure)))
                       (entries -> (map boot-parameters->menu-entry
                                        (list (second boot-parameters))))
+                       (locale -> (boot-parameters-locale
+                                   (second boot-parameters)))
+                       (store-dir -> (boot-parameters-store-directory-prefix
+                                      (second boot-parameters)))
                       (old-entries -> (map boot-parameters->menu-entry
                                            (drop boot-parameters 2)))
                       (bootloader -> (operating-system-bootloader
@@ -471,6 +495,8 @@ an environment type of 'managed-host."
                                   (bootloader-configuration-bootloader
                                    bootloader))
                                  bootloader entries
+                                  #:locale locale
+                                  #:store-directory-prefix store-dir
                                  #:old-entries old-entries)))
                       (remote-result (machine-remote-eval machine remote-exp)))
    (when (eqv? 'error remote-result)
@@ -497,9 +523,11 @@ connection to the host.")))
  (let ((config (machine-configuration machine))
        (environment (environment-type-name (machine-environment machine))))
    (unless (and config (machine-ssh-configuration? config))
-      (raise (condition
-              (&message
-               (message (format #f (G_ "unsupported machine configuration '~a'
+      (raise (formatted-message (G_ "unsupported machine configuration '~a'
 for environment of type '~a'")
                                config
-                                environment))))))))
+                                environment)))))
+
+;; Local Variables:
+;; eval: (put 'remote-let 'scheme-indent-function 1)
+;; End:
@@ -24,6 +24,7 @@
  #:use-module (guix packages)
  #:use-module (guix ui)
  #:use-module (guix utils)
+  #:use-module (guix diagnostics)
  #:use-module (guix discovery)
  #:use-module (guix memoization)
  #:use-module ((guix build utils)
@@ -92,9 +93,8 @@
 (define (search-patch file-name)
  "Search the patch FILE-NAME.  Raise an error if not found."
  (or (search-path (%patch-path) file-name)
-      (raise (condition
-              (&message (message (format #f (G_ "~a: patch not found")
-                                         file-name)))))))
+      (raise (formatted-message (G_ "~a: patch not found")
+                                file-name))))

 (define-syntax-rule (search-patches file-name ...)
  "Return the list of absolute file names corresponding to each
@@ -381,39 +381,59 @@ reducing the memory footprint."
  (define cache-file
    (string-append directory %package-cache-file))

-  (define (expand-cache module symbol variable result+seen)
-    (match (false-if-exception (variable-ref variable))
-      ((? package? package)
-       (match result+seen
-         ((result . seen)
-          (if (or (vhash-assq package seen)
-                  (hidden-package? package))
-              (cons result seen)
-              (cons (cons `#(,(package-name package)
-                             ,(package-version package)
-                             ,(module-name module)
-                             ,symbol
-                             ,(package-outputs package)
-                             ,(->bool (supported-package? package))
-                             ,(->bool (package-superseded package))
-                             ,@(let ((loc (package-location package)))
-                                 (if loc
-                                     `(,(location-file loc)
-                                       ,(location-line loc)
-                                       ,(location-column loc))
-                                     '(#f #f #f))))
-                          result)
-                    (vhash-consq package #t seen))))))
-      (_
-       result+seen)))
+  (define expand-cache
+    (match-lambda*
+      (((module symbol variable) (result . seen))
+       (let ((package (variable-ref variable)))
+         (if (or (vhash-assq package seen)
+                 (hidden-package? package))
+             (cons result seen)
+             (cons (cons `#(,(package-name package)
+                            ,(package-version package)
+                            ,(module-name module)
+                            ,symbol
+                            ,(package-outputs package)
+                            ,(->bool (supported-package? package))
+                            ,(->bool (package-superseded package))
+                            ,@(let ((loc (package-location package)))
+                                (if loc
+                                    `(,(location-file loc)
+                                      ,(location-line loc)
+                                      ,(location-column loc))
+                                    '(#f #f #f))))
+                         result)
+                   (vhash-consq package #t seen)))))))

-  (define exp
-    (first
-     (fold-module-public-variables* expand-cache
-                                    (cons '() vlist-null)
+  (define entry-key
+    (match-lambda
+      ((module symbol variable)
+       (let ((value (variable-ref variable)))
+         (string-append (package-name value) (package-version value)
+                        (object->string module)
+                        (symbol->string symbol))))))
+
+  (define (entry<? a b)
+    (string<? (entry-key a) (entry-key b)))
+
+  (define variables
+    ;; First sort variables so that 'expand-cache' later dismisses
+    ;; already-seen package objects in a deterministic fashion.
+    (sort
+     (fold-module-public-variables* (lambda (module symbol variable lst)
+                                      (let ((value (false-if-exception
+                                                    (variable-ref variable))))
+                                        (if (package? value)
+                                            (cons (list module symbol variable)
+                                                  lst)
+                                            lst)))
+                                    '()
                                    (all-modules (%package-module-path)
                                                 #:warn
-                                                 warn-about-load-error))))
+                                                 warn-about-load-error))
+     entry<?))
+
+  (define exp
+    (first (fold expand-cache (cons '() vlist-null) variables)))

  (mkdir-p (dirname cache-file))
  (call-with-output-file cache-file
@@ -19,6 +19,7 @@

 (define-module (gnu packages abduco)
  #:use-module (guix build-system gnu)
+  #:use-module (guix utils)
  #:use-module (guix download)
  #:use-module (guix licenses)
  #:use-module (guix packages))
@@ -37,7 +38,7 @@
              "1x1m58ckwsprljgmdy93mvgjyg9x3cqrzdf3mysp0mx97zhhj2f9"))))
   (build-system gnu-build-system)
   (arguments
-    `(#:make-flags (list "CC=gcc"
+    `(#:make-flags (list (string-append "CC=" ,(cc-for-target))
                         (string-append "PREFIX=" (assoc-ref %outputs "out")))
      #:phases (modify-phases %standard-phases
                 (delete 'configure)
@@ -3,6 +3,7 @@
 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Andrew Miloradovsky <andrew@interpretmath.pw>
+;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,12 +22,31 @@

 (define-module (gnu packages accessibility)
  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix utils)
  #:use-module (guix packages)
  #:use-module (guix download)
  #:use-module (guix git-download)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system glib-or-gtk)
  #:use-module (gnu packages)
+  #:use-module (gnu packages lisp)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages ocaml)
+  #:use-module (gnu packages pcre)
+  #:use-module (gnu packages polkit)
+  #:use-module (gnu packages ncurses)
+  #:use-module (gnu packages music)
+  #:use-module (gnu packages language)
+  #:use-module (gnu packages icu4c)
+  #:use-module (gnu packages speech)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu packages documentation)
+  #:use-module (gnu packages swig)
+  #:use-module (gnu packages libusb)
+  #:use-module (gnu packages java)
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-xyz)
+  #:use-module (gnu packages tcl)
  #:use-module (gnu packages xml)
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages gstreamer)
@@ -37,6 +57,154 @@
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages libusb))

+(define-public libbraille
+  (package
+    (name "libbraille")
+    (version "0.19.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append "https://sourceforge.net/projects/" name "/files/" name "/"
+                       name "-" version "/" name "-" version ".tar.gz"))
+       (sha256
+        (base32 "05g8r0ypazqn10i7k48iibs8bzc3scdfcnhcykab8j16lhzd27d0"))))
+    (build-system glib-or-gtk-build-system)
+    (outputs '("out" "bin"))
+    (arguments
+     `(#:tests? #f                      ; Tests require drivers
+       #:configure-flags
+       (list
+        "--disable-static"
+        "--enable-fake")))
+    (native-inputs
+     `(("latex2html" ,latex2html)
+       ("pkg-config" ,pkg-config)
+       ("python" ,python-wrapper)
+       ("swig" ,swig)))
+    (inputs
+     `(("glib" ,glib)
+       ("gtk+" ,gtk+-2)
+       ("libusb" ,libusb-compat)))
+    (synopsis "Portable Braille Library")
+    (description "Libbraille is a library to easily access Braille displays and
+terminals.")
+    (home-page "https://libbraille.org")
+    (license license:lgpl2.1+)))
+
+(define-public brltty
+  (package
+    (name "brltty")
+    (version "6.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append "https://brltty.app/archive/"
+                       name "-" version ".tar.gz"))
+       (sha256
+        (base32 "0nk54chr7z2w579vyiak9xk2avhnvrx7x2l5sk8nyw2zplchkx9q"))))
+    (build-system glib-or-gtk-build-system)
+    (arguments
+     `(#:tests? #f                      ; No target
+       #:configure-flags
+       (list
+        (string-append "--with-tcl-config="
+                       (assoc-ref %build-inputs "tcl")
+                       "/lib/tclConfig.sh")
+        (string-append "--with-libbraille="
+                       (assoc-ref %build-inputs "libbraille"))
+        (string-append "--with-espeak_ng="
+                       (assoc-ref %build-inputs "espeak-ng"))
+        (string-append "--with-espeak="
+                       (assoc-ref %build-inputs "espeak"))
+        (string-append "--with-flite="
+                       (assoc-ref %build-inputs "flite"))
+        ;; Required for RUNPATH validation.
+        (string-append "LDFLAGS=-Wl,-rpath="
+                       (assoc-ref %outputs "out")
+                       "/lib"))
+       #:make-flags
+       (list
+        (string-append "JAVA_JAR_DIR="
+                       (assoc-ref %outputs "out"))
+        (string-append "JAVA_JNI_DIR="
+                       (assoc-ref %outputs "out"))
+        (string-append "OCAML_DESTDIR="
+                       (assoc-ref %outputs "out")
+                       "/lib")
+        (string-append "PYTHON_PREFIX="
+                       (assoc-ref %outputs "out"))
+        "PYTHON_ROOT=/"
+        (string-append "TCL_DIR="
+                       (assoc-ref %outputs "out")
+                       "/lib"))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-errors
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* "configure"
+               (("/sbin/ldconfig")
+                (which "true")))
+             ;; Make Python bindings use rpath.
+             (substitute* "Bindings/Python/setup.py.in"
+               (("extra_compile_args =")
+                (string-append "extra_link_args = ['-Wl,-rpath="
+                               (assoc-ref outputs "out")
+                               "/lib'], "
+                               "extra_compile_args = ")))
+             #t)))))
+    (native-inputs
+     `(("clisp" ,clisp)
+       ("cython" ,python-cython)
+       ("doxygen" ,doxygen)
+       ("gettext" ,gettext-minimal)
+       ("java" ,icedtea "jdk")
+       ;; ("linuxdoc" ,linuxdoc-tools)
+       ("ocaml" ,ocaml)
+       ("ocamlfind" ,ocaml-findlib)
+       ("pkg-config" ,pkg-config)
+       ("python" ,python-wrapper)
+       ("tcl" ,tcl)))
+    (inputs
+     `(("alsa" ,alsa-lib)
+       ("atspi2" ,at-spi2-core)
+       ("bluez" ,bluez)
+       ("dbus" ,dbus)
+       ("espeak" ,espeak)
+       ("espeak-ng" ,espeak-ng)
+       ("expat" ,expat)
+       ("festival" ,festival)
+       ("flite" ,flite)
+       ("glib" ,glib)
+       ("gpm" ,gpm)
+       ("iconv" ,libiconv)
+       ("icu" ,icu4c)
+       ("libbraille" ,libbraille)
+       ("libpcre2" ,pcre2)
+       ("linux-headers" ,linux-libre-headers)
+       ("louis" ,liblouis)
+       ("ncurses" ,ncurses)
+       ("polkit" ,polkit)
+       ("speech-dispatcher" ,speech-dispatcher)
+       ("util-linux" ,util-linux)
+       ("util-linux:lib" ,util-linux "lib")
+       ("x11" ,libx11)
+       ("xaw" ,libxaw)
+       ("xaw3d" ,libxaw3d)
+       ("xext" ,libxext)
+       ("xfixes" ,libxfixes)
+       ("xt" ,libxt)
+       ("xtst" ,libxtst)))
+    (synopsis "Braille TTY")
+    (description "BRLTTY is a background process (daemon) which provides access
+to the Linux/Unix console (when in text mode) for a blind person using a
+refreshable braille display.  It drives the braille display, and provides
+complete screen review functionality.  Some speech capability has also been
+incorporated.")
+    (home-page "https://brltty.app/")
+    (license license:lgpl2.1+)))
+
 (define-public florence
  (package
    (name "florence")
@@ -105,7 +273,7 @@ available to help to click.")
       `(("hidapi" ,hidapi)))
      (arguments
       `(#:tests? #f ; no tests
-         #:make-flags (list "CC=gcc")
+         #:make-flags (list (string-append "CC=" ,(cc-for-target)))
         #:phases (modify-phases %standard-phases
                    (delete 'configure)
                    ;; Install target in the Makefile does not work for Guix
@@ -141,7 +309,7 @@ devices have vendorId:productId = 0c45:7403 or 0c45:7404.")
    (arguments
     `(#:tests? #f ; none included
       #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
             (string-append "prefix=" (assoc-ref %outputs "out")))
       #:phases
       (modify-phases %standard-phases
@@ -5,6 +5,7 @@
 ;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,6 +26,7 @@
  #:use-module (guix licenses)
  #:use-module (gnu packages attr)
  #:use-module (gnu packages base)
+  #:use-module (gnu packages hurd)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages perl)
  #:use-module (guix packages)
@@ -49,6 +51,8 @@
     `(#:modules ((ice-9 ftw)
                  ,@%gnu-build-system-modules)
       #:configure-flags '("--disable-static")
+       #:tests? ,(not (or (%current-target-system)
+                          (hurd-target?)))
       #:phases
       (modify-phases %standard-phases
         ;; XXX After repacking the sources the timestamps are reset to the
@@ -38,7 +38,7 @@
      (source (origin
                (method git-fetch)
                (uri (git-reference
-                      (url "https://github.com/AdaCore/langkit.git")
+                      (url "https://github.com/AdaCore/langkit")
                      (commit commit)))
                (sha256
                 (base32
@@ -70,7 +70,7 @@ Ada library with bindings for the C and Python programming languages.")
      (source (origin
                (method git-fetch)
                (uri (git-reference
-                      (url "https://github.com/AdaCore/libadalang.git")
+                      (url "https://github.com/AdaCore/libadalang")
                      (commit commit)))
                (sha256
                 (base32
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2015, 2016, 2018 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2018, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019 Marius Bakke <mbakke@fastmail.com>
 ;;;
@@ -25,22 +25,23 @@
  #:use-module (guix download)
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system gnu)
+  #:use-module (gnu packages m4)
  #:use-module (gnu packages pkg-config))

 (define-public adns
  (package
    (name "adns")
-    (version "1.5.1")
+    (version "1.6.0")
    (source (origin
              (method url-fetch)
              (uri (list (string-append "mirror://gnu/adns/adns-"
                                        version ".tar.gz")
                         (string-append
-                          "http://www.chiark.greenend.org.uk/~ian/adns/ftp/adns-"
-                          version ".tar.gz")))
+                           "https://www.chiark.greenend.org.uk/~ian/adns/ftp/adns-"
+                           version ".tar.gz")))
              (sha256
               (base32
-                "1ssfh94ck6kn98nf2yy6743srpgqgd167va5ja3bwx42igqjc42v"))))
+                "1pi0xl07pav4zm2jrbrfpv43s1r1q1y12awgak8k7q41m5jp4hpv"))))
    (build-system gnu-build-system)
    (arguments
     ;; Make sure the programs under bin/ fine libadns.so.
@@ -50,6 +51,8 @@

       ;; XXX: Tests expect real name resolution to work.
       #:tests? #f))
+    (native-inputs
+     `(("m4" ,m4)))
    (home-page "https://www.gnu.org/software/adns/")
    (synopsis "Asynchronous DNS client library and utilities")
    (description
@@ -79,6 +79,11 @@
                  (ice-9 match))
       #:phases
       (modify-phases %standard-phases
+         ;; This allows us to call the 'agda' binary before installing.
+         (add-after 'unpack 'set-ld-library-path
+           (lambda _
+             (setenv "LD_LIBRARY_PATH" (string-append (getcwd) "/dist/build"))
+             #t))
         ;; FIXME: This is a copy of the standard configure phase with a tiny
         ;; difference: this package needs the -package-db flag to be passed
         ;; to "runhaskell" in addition to the "configure" action, because
@@ -90,30 +95,25 @@
                     #:allow-other-keys)
             (let* ((out (assoc-ref outputs "out"))
                    (name-version (strip-store-file-name out))
-                    (input-dirs (match inputs
-                                  (((_ . dir) ...)
-                                   dir)
-                                  (_ '())))
                    (ghc-path (getenv "GHC_PACKAGE_PATH"))
-                    (params (append `(,(string-append "--prefix=" out))
-                                    `(,(string-append "--libdir=" out "/lib"))
-                                    `(,(string-append "--bindir=" out "/bin"))
-                                    `(,(string-append
-                                        "--docdir=" out
-                                        "/share/doc/" name-version))
-                                    '("--libsubdir=$compiler/$pkg-$version")
-                                    '("--package-db=../package.conf.d")
-                                    '("--global")
-                                    `(,@(map
-                                         (cut string-append "--extra-include-dirs=" <>)
-                                         (search-path-as-list '("include") input-dirs)))
-                                    `(,@(map
-                                         (cut string-append "--extra-lib-dirs=" <>)
-                                         (search-path-as-list '("lib") input-dirs)))
-                                    (if tests?
-                                        '("--enable-tests")
-                                        '())
-                                    configure-flags)))
+                    (params
+                     `(,(string-append "--prefix=" out)
+                       ,(string-append "--libdir=" out "/lib")
+                       ,(string-append "--docdir=" out
+                                       "/share/doc/" name-version)
+                       "--libsubdir=$compiler/$pkg-$version"
+                       "--package-db=../package.conf.d"
+                       "--global"
+                       ,@(if tests?
+                             '("--enable-tests")
+                             '())
+                       ;; Build and link with shared libraries
+                       "--enable-shared"
+                       "--enable-executable-dynamic"
+                       "--ghc-option=-fPIC"
+                       ,(string-append "--ghc-option=-optl=-Wl,-rpath=" out
+                                       "/lib/$compiler/$pkg-$version")
+                       ,@configure-flags)))
               (unsetenv "GHC_PACKAGE_PATH")
               (apply invoke "runhaskell" "-package-db=../package.conf.d"
                      "Setup.hs" "configure" params)
@@ -28,6 +28,7 @@
  #:use-module (guix download)
  #:use-module (guix git-download)
  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages check)
  #:use-module (gnu packages imagemagick)
  #:use-module (gnu packages glib)
  #:use-module (gnu packages gtk)
@@ -37,8 +38,52 @@
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages qt)
  #:use-module (gnu packages video)
+  #:use-module (guix build-system cmake)
  #:use-module (guix build-system gnu))

+(define-public zxing-cpp
+  (package
+    (name "zxing-cpp")
+    (version "1.0.8")
+    (source
+     (origin
+       (method git-fetch)
+       (uri
+        (git-reference
+         (url "https://github.com/nu-book/zxing-cpp.git")
+         (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "011sq8wcjfxbnd8sj6bf2fgkamlp8gj6q835g61c952npvwsnl71"))))
+    (native-inputs
+     `(("googletest-source" ,(package-source googletest))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:out-of-source? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'unpack-googletest
+           ;; Copy the googletest sources to where the CMake build expects them.
+           (lambda* (#:key inputs #:allow-other-keys)
+             (let ((source (assoc-ref inputs "googletest-source"))
+                   (target "test/unit/googletest-src"))
+               (mkdir-p target)
+               (copy-recursively source target)
+               ;; Disable downloading via ExternalProject.
+               (substitute* "test/unit/CMakeLists.txt.in"
+                (("ExternalProject_Add\\(") "message("))
+               #t)))
+         (replace 'check
+           (lambda _
+             (with-directory-excursion "test/unit"
+               (invoke "cmake" ".")
+               (invoke "make")
+               (invoke "./ZXingUnitTest"))
+             #t)))))
+    (synopsis "C++ port of ZXing")
+    (description "ZXing-CPP is a barcode scanning library.")
+    (home-page "https://github.com/nu-book/zxing-cpp")
+    (license license:asl2.0)))

 (define-public barcode
  (package
@@ -91,7 +136,7 @@ characters, and is highly robust.")
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/dmtx/libdmtx.git")
+             (url "https://github.com/dmtx/libdmtx")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
@@ -163,7 +208,7 @@ Python as well as GUI widgets for GTK and Qt.")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                     (url "https://github.com/nayuki/QR-Code-generator.git")
+                     (url "https://github.com/nayuki/QR-Code-generator")
                     (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (patches (search-patches "qrcodegen-cpp-make-install.patch"))
@@ -4,7 +4,7 @@
 ;;; Copyright © 2016, 2017, 2018, 2019, 2020 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2014, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2016, 2018, 2019 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2017, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017, 2019 Eric Bavier <bavier@member.fsf.org>
@@ -12,6 +12,7 @@
 ;;; Copyright © 2020 Björn Höfling <bjoern.hoefling@bjoernhoefling.de>
 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
+;;; Copyright © 2020 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -43,9 +44,11 @@
  #:use-module (gnu packages graphviz)
  #:use-module (gnu packages image)
  #:use-module (gnu packages java)
+  #:use-module (gnu packages llvm)
  #:use-module (gnu packages maths)
  #:use-module (gnu packages mpi)
  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages ocaml)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages pulseaudio)
@@ -72,7 +75,7 @@
 (define-public mpfrcx
  (package
   (name "mpfrcx")
-   (version "0.5")
+   (version "0.6")
   (source (origin
            (method url-fetch)
            (uri (string-append
@@ -80,7 +83,7 @@
                  version ".tar.gz"))
            (sha256
             (base32
-              "1s968480ymv6w0rnvfp9mxvx98hvi29fkvw8nk4ggzc6azxgwybs"))))
+              "0gz5rma9al2jrifpknqkcnd9dkf8l05jcxy3s4ghwhd4y3h5dwia"))))
   (build-system gnu-build-system)
   (propagated-inputs
     `(("gmp" ,gmp)
@@ -121,15 +124,15 @@ greatest common divisor operations.")
 (define-public cm
  (package
   (name "cm")
-   (version "0.3")
+   (version "0.3.1")
   (source (origin
            (method url-fetch)
            (uri (string-append
-                  "http://www.multiprecision.org/cm/download/cm-"
+                  "http://www.multiprecision.org/downloads/cm-"
                  version ".tar.gz"))
            (sha256
             (base32
-              "1nf5kr0nqmhbzrsrinky18z0ighjpsmb5cr8zyg8jf04bfbyrfmc"))))
+              "0qq6b1kwb1byj8ws33ya5awq0ilkpm32037pi1l4cf2737fg9m42"))))
   (build-system gnu-build-system)
   (propagated-inputs
     `(("mpfrcx" ,mpfrcx)
@@ -149,22 +152,24 @@ line applications.")
 (define-public fplll
  (package
    (name "fplll")
-    (version "5.2.1")
+    (version "5.3.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/fplll/fplll.git")
+                    (url "https://github.com/fplll/fplll")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "015qmrd7nfaysbv1hbwiprz9g6hnww1y1z1xw8f43ysb7k1b5nbg"))))
+                "06nyfidagp8pc2kfcw88ldgb2b1xm0a8z31n0sln7j72ihlmd8zj"))
+              (patches (search-patches "fplll-std-fenv.patch"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("autoconf" ,autoconf)
       ("automake" ,automake)
-       ("libtool" ,libtool)))
-    (inputs
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)))
+    (propagated-inputs ; header files pulled in by fplll/defs.h
     `(("gmp" ,gmp)
       ("mpfr" ,mpfr)))
    (home-page "https://github.com/fplll/fplll")
@@ -196,19 +201,19 @@ the real span of the lattice.")
 (define-public python-fpylll
  (package
    (name "python-fpylll")
-    (version "0.4.1")
+    (version "0.5.2")
    (source
     (origin
       ;; Pypi contains and older release, so we use a tagged release from
       ;; Github instead.
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/fplll/fpylll.git")
+             (url "https://github.com/fplll/fpylll")
             (commit (string-append version "dev"))))
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "01x2sqdv0sbjj4g4waj0hj4rcn4bq7h17442xaqwbznym9azmn9w"))))
+         "1a25iibihph626jl4wbs4b77xc4a2c4nfc2ypscf9wpani3dnhjf"))))
    (build-system python-build-system)
    (inputs
     `(("fplll" ,fplll)
@@ -229,7 +234,7 @@ the real span of the lattice.")
 (define-public pari-gp
  (package
    (name "pari-gp")
-    (version "2.11.4")
+    (version "2.13.0")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -237,7 +242,7 @@ the real span of the lattice.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "070bjw4kg7r6lqs1hfs08n5fmjv90cpwflp3wr04hbrmyz28zj5z"))))
+                "14xs90wrw8mbdx08hxlbhiahp6kgjq6yh27zjw7fvhfjx5nr84f8"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("texlive" ,(texlive-union
@@ -271,7 +276,7 @@ PARI is also available as a C library to allow for faster computations.")
 (define-public gp2c
  (package
   (name "gp2c")
-   (version "0.0.11pl3")
+   (version "0.0.11pl4")
   (source (origin
            (method url-fetch)
            (uri (string-append
@@ -279,7 +284,7 @@ PARI is also available as a C library to allow for faster computations.")
                  version ".tar.gz"))
            (sha256
              (base32
-                "0yymbrgyjw500hqgmkj5m4nmscd7c9rs9w2c96lxgrcyab8krhrm"))))
+                "1cnnh7diqc97q76q5pyhpbljbhc0sz8mlrbqgiwi0sjkgh8iqsj0"))))
   (build-system gnu-build-system)
   (native-inputs `(("perl" ,perl)))
   (inputs `(("pari-gp" ,pari-gp)))
@@ -344,12 +349,13 @@ varieties, i.e. Jacobians of hyperelliptic curves.
 It can also be used to compute theta constants at arbitrary
 precision.")
   (license license:gpl3+)
-   (home-page "http://cmh.gforge.inria.fr/")))
+   (home-page
+     "https://gitlab.inria.fr/cmh/cmh#cmh-computation-of-genus-2-class-polynomials")))

 (define-public giac
  (package
    (name "giac")
-    (version "1.5.0-87")
+    (version "1.6.0-25")
    (source
     (origin
       (method url-fetch)
@@ -361,7 +367,7 @@ precision.")
                           "~parisse/debian/dists/stable/main/source/"
                           "giac_" version ".tar.gz"))
       (sha256
-        (base32 "1d0h1yb7qvh9x7wwv9yrzmcp712f49w1iljkxp4y6g9pzsmg1mmv"))))
+        (base32 "11kik2csdg9wy0npiih21kaag0nc89i9ldgk7ak7gvf9ycddm6mh"))))
    (build-system gnu-build-system)
    (arguments
     `(#:modules ((ice-9 ftw)
@@ -372,7 +378,8 @@ precision.")
         (add-after 'unpack 'patch-bin-cp
           ;; Some Makefiles contain hard-coded "/bin/cp".
           (lambda _
-             (substitute* (find-files "doc" "^Makefile")
+             (substitute* (cons "micropython-1.12/xcas/Makefile"
+                                (find-files "doc" "^Makefile"))
               (("/bin/cp") (which "cp")))
             #t))
         (add-after 'unpack 'disable-failing-test
@@ -401,7 +408,7 @@ precision.")
               (delete-file (string-append out "/bin/xcasnew"))
               #t))))))
    (inputs
-     ;;; TODO: Add libnauty.
+     ;; TODO: Add libnauty, unbundle "libmicropython.a".
     `(("fltk" ,fltk)
       ("glpk" ,glpk)
       ("gmp" ,gmp)
@@ -425,6 +432,8 @@ precision.")
    (native-inputs
     `(("bison" ,bison)
       ("flex" ,flex)
+       ("hevea" ,hevea)
+       ("python" ,python-wrapper)
       ("readline" ,readline)
       ("texlive" ,texlive-tiny)))
    (home-page "https://www-fourier.ujf-grenoble.fr/~parisse/giac.html")
@@ -438,34 +447,41 @@ or text interfaces) or as a C++ library.")
 (define-public flint
  (package
   (name "flint")
-   (version "2.5.2")
-   (source (origin
-            (method url-fetch)
-            (uri (string-append
-                  "http://flintlib.org/flint-"
-                  version ".tar.gz"))
-            (sha256 (base32
-                     "11syazv1a8rrnac3wj3hnyhhflpqcmq02q8pqk2m6g2k6h0gxwfb"))
-            (patches (search-patches "flint-ldconfig.patch"))))
+   (version "2.6.3")
+   (source
+    (origin
+      (method url-fetch)
+      (uri (string-append "http://flintlib.org/flint-" version ".tar.gz"))
+      (sha256
+       (base32 "1qrf6hzbbmg7mhkhbb0bab8z2xpdnba5cj4kmmf72lzs0457a6nf"))))
   (build-system gnu-build-system)
+   (inputs
+    `(("ntl" ,ntl)))
   (propagated-inputs
    `(("gmp" ,gmp)
      ("mpfr" ,mpfr))) ; header files from both are included by flint/arith.h
   (arguments
-    `(#:parallel-tests? #f ; seems to be necessary on arm
+    `(#:parallel-tests? #f              ; seems to be necessary on arm
      #:phases
       (modify-phases %standard-phases
+         (add-before 'configure 'newer-c++
+           (lambda _
+             (substitute* "configure"
+               (("-ansi") ""))
+             #t))
         (replace 'configure
           (lambda* (#:key inputs outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out"))
                   (gmp (assoc-ref inputs "gmp"))
-                   (mpfr (assoc-ref inputs "mpfr")))
-               ;; do not pass "--enable-fast-install", which makes the
-               ;; homebrew configure process fail
+                   (mpfr (assoc-ref inputs "mpfr"))
+                   (ntl (assoc-ref inputs "ntl")))
+               ;; Do not pass "--enable-fast-install", which makes the
+               ;; homebrew configure process fail.
               (invoke "./configure"
                       (string-append "--prefix=" out)
                       (string-append "--with-gmp=" gmp)
-                       (string-append "--with-mpfr=" mpfr))
+                       (string-append "--with-mpfr=" mpfr)
+                       (string-append "--with-ntl=" ntl))
               #t))))))
   (synopsis "Fast library for number theory")
   (description
@@ -479,22 +495,22 @@ Operations that can be performed include conversions, arithmetic,
 GCDs, factoring, solving linear systems, and evaluating special
 functions.  In addition, FLINT provides various low-level routines for
 fast arithmetic.")
-   (license license:gpl2+)
+   (license license:lgpl2.1+)
   (home-page "http://flintlib.org/")))

 (define-public arb
  (package
    (name "arb")
-    (version "2.17.0")
+    (version "2.18.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/fredrik-johansson/arb.git")
+                    (url "https://github.com/fredrik-johansson/arb")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "05lpy3hkl5f8ik19aw40cqydrb932xaf2n8hbq9ib5dnk7f010p1"))))
+                "15fx3dcbzgwddw9p1nysmx0dbh058afv5m8cj5pdjkcmcl7kw7z9"))))
    (build-system gnu-build-system)
    (propagated-inputs
     `(("flint" ,flint)))               ; flint.h is included by arf.h
@@ -533,7 +549,7 @@ real and complex numbers, with automatic, rigorous error control.")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/fredrik-johansson/python-flint.git")
+                    (url "https://github.com/fredrik-johansson/python-flint")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
@@ -609,7 +625,7 @@ matrices, and polynomials over the integers and over finite fields.")
 (define-public singular
  (package
   (name "singular")
-   (version "4.1.3p1")
+   (version "4.1.3p2")
   (source
    (origin
      (method url-fetch)
@@ -623,7 +639,7 @@ matrices, and polynomials over the integers and over finite fields.")
                        #\.) "-")
                      "/singular-" version ".tar.gz"))
             (sha256 (base32
-                      "1f02mrjwh7pd3pydfvjxsw5rph2qmkg1idwqrdsax924sa77sljw"))))
+                      "1524yrni7gh0hir5ckridq671q5s6avfjdsdyahj51kzdl3wcypf"))))
   (build-system gnu-build-system)
   (native-inputs
    `(("doxygen" ,doxygen)
@@ -726,7 +742,7 @@ syntax is similar to that of C, so basic usage is familiar.  It also includes
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/extemporelang/kiss_fft.git")
+                    (url "https://github.com/extemporelang/kiss_fft")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
@@ -832,7 +848,7 @@ cosine/ sine transforms or DCT/DST).")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/vkostyukov/la4j.git")
+                    (url "https://github.com/vkostyukov/la4j")
                    (commit version)))
              (file-name (string-append name "-" version "-checkout"))
              (sha256
@@ -946,6 +962,46 @@ minimization and curve fitting.  It is mature code, based on decades-old
 algorithms from the FORTRAN library MINPACK.")
    (license license:bsd-2)))

+(define-public symengine
+  (package
+    (name "symengine")
+    (version "0.6.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/symengine/symengine")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "129iv9maabmb42ylfdv0l0g94mcbf3y4q3np175008rcqdr8z6h1"))))
+    (build-system cmake-build-system)
+    (arguments
+     '(#:configure-flags
+       ;; These are the suggested build options in the README.
+       '("-DCMAKE_BUILD_TYPE=Release"
+         "-DWITH_GMP=on"
+         "-DWITH_MPFR=on"
+         "-DWITH_MPC=on"
+         "-DINTEGER_CLASS=flint"
+         "-DWITH_LLVM=on"
+         "-DWITH_SYMENGINE_THREAD_SAFE=on"
+         "-DBUILD_SHARED_LIBS=on")))    ;also build libsymengine
+    (native-inputs
+     `(("llvm" ,llvm)))
+    (inputs
+     `(("flint" ,flint)
+       ("gmp" ,gmp)
+       ("mpc" ,mpc)
+       ("mpfr" ,mpfr)))
+    (home-page "https://github.com/symengine/symengine")
+    (synopsis "Fast symbolic manipulation library")
+    (description
+     "SymEngine is a standalone fast C++ symbolic manipulation library.
+Optional thin wrappers allow usage of the library from other languages.")
+    (license (list license:expat        ;SymEngine
+                   license:bsd-3))))    ;3rd party code
+
 (define-public eigen
  (package
    (name "eigen")
@@ -1033,7 +1089,7 @@ features, and more.")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/QuantStack/xtensor.git")
+                    (url "https://github.com/QuantStack/xtensor")
                    (commit version)))
              (sha256
               (base32
@@ -1063,17 +1119,17 @@ xtensor provides:
 (define-public gap
  (package
    (name "gap")
-    (version "4.10.2")
+    (version "4.11.0")
    (source
     (origin
       (method url-fetch)
-       (uri (string-append "https://www.gap-system.org/pub/gap/gap-"
+       (uri (string-append "https://files.gap-system.org/gap-"
                           (version-major+minor version)
                           "/tar.bz2/gap-"
                           version
                           ".tar.bz2"))
       (sha256
-        (base32 "0cp6ddk0469zzv1m1vair6gm27ic6c5m77ri8rn0znq3gaps6x94"))
+        (base32 "00l6hvy4iggnlrib4vp805sxdm3j7n3hzpv5zs9hbiiavh80l1xz"))
       (modules '((guix build utils) (ice-9 ftw) (srfi srfi-1)))
       (snippet
        '(begin
@@ -1085,41 +1141,46 @@ xtensor provides:
           ;; FIXME: This might be fixed in the next release, see
           ;; https://github.com/gap-system/gap/issues/3292
           (delete-file "tst/testinstall/dir.tst")
-           ;; Delete all packages except for a fixed list.
+           ;; Delete all packages except for a fixed list,
+           ;; given by their names up to version numbers.
           (with-directory-excursion "pkg"
             (for-each delete-file-recursively
-               (lset-difference string=? (scandir ".")
+               (lset-difference
+                 (lambda (all keep) (string-prefix? keep all))
+                 (scandir ".")
                 '("." ".."
                   ;; Necessary packages.
-                   "GAPDoc-1.6.2"
-                   "primgrp-3.3.2"
-                   "SmallGrp-1.3"    ; artistic2.0
-                   "transgrp"        ; artistic2.0 for data,
-                                     ; gpl2 or gpl3 for code
-                   ;; Recommanded package.
-                   "io-4.5.4"        ; gpl3+
+                   "GAPDoc-"
+                   "primgrp-"
+                   "SmallGrp-"   ; artistic2.0
+                   "transgrp"    ; artistic2.0 for data,
+                                 ; gpl2 or gpl3 for code
+                   ;; Recommended package.
+                   "io-"         ; gpl3+
                   ;; Optional packages, searched for at start,
                   ;; and their depedencies.
-                   "alnuth-3.1.0"
-                   "autpgrp-1.10"
-                   "crisp-1.4.4"     ; bsd-2
-                   "ctbllib"       ; gpl3+ according to doc/chap0.txt
-                   "FactInt-1.6.2"
+                   "alnuth-"
+                   "autpgrp-"
+                   "crisp-"      ; bsd-2
+                   "ctbllib"     ; gpl3+, clarified in the next release;
+                                 ; see
+                                 ; http://www.math.rwth-aachen.de/~Thomas.Breuer/ctbllib/README.md
+                   "FactInt-"
                   "fga"
-                   "irredsol-1.4"    ; bsd-2
-                   "laguna-3.9.2"
-                   "polenta-1.3.8"
-                   "polycyclic-2.14"
-                   "radiroot-2.8"
-                   "resclasses-4.7.1"
-                   "sophus-1.24"
-                   "tomlib-1.2.7"  ; gpl2+, clarified in the git repository
-                                   ; and the next release
-                   "utils-0.59"))))
+                   "irredsol-"   ; bsd-2
+                   "laguna-"
+                   "polenta-"
+                   "polycyclic-"
+                   "radiroot-"
+                   "resclasses-"
+                   "sophus-"
+                   "tomlib-"
+                   "utils-"))))
           #t))))
    (build-system gnu-build-system)
    (inputs
     `(("gmp" ,gmp)
+       ("readline" ,readline)
       ("zlib" ,zlib)))
    (arguments
     `(#:modules ((ice-9 ftw)
@@ -1146,15 +1207,14 @@ xtensor provides:
           (lambda* (#:key outputs #:allow-other-keys)
             (let* ((out (assoc-ref outputs "out"))
                    (bin (string-append out "/bin"))
-                    (lib (string-append out "/lib"))
                    (prog (string-append bin "/gap"))
                    (prog-real (string-append bin "/.gap-real"))
-                    (share (string-append out "/share/gap"))
-                    (include (string-append out "/include/gap"))
-                    (include-hpc (string-append include "/hpc")))
+                    (share (string-append out "/share/gap")))
               ;; Install only the gap binary; the gac compiler is left
               ;; for maybe later. "Wrap" it in a shell script that calls
               ;; the binary with the correct parameter.
+               ;; The make target install-bin is supposed to do that, but
+               ;; is not currently working.
               (mkdir-p bin)
               (copy-file "gap" prog-real)
               (call-with-output-file prog
@@ -1165,52 +1225,18 @@ xtensor provides:
                           prog-real
                           share)))
               (chmod prog #o755)
-               ;; Install the headers, which are needed by Sage. The
-               ;; Makefile target "install-headers" was available in
-               ;; gap-4.10.0, but has been commented out in gap-4.10.1.
-               (mkdir-p include-hpc)
-               (install-file "gen/config.h" include)
-               (let ((file-name-predicate-without-stat
-                       (lambda (regex)
-                         (cut (file-name-predicate regex) <> #f))))
-                 (with-directory-excursion "src"
-                   (for-each
-                     (cut install-file <> include)
-                     (scandir "."
-                              (file-name-predicate-without-stat ".*\\.h$"))))
-                 (with-directory-excursion "src/hpc"
-                   (for-each
-                     (cut install-file <> include-hpc)
-                     (scandir "."
-                              (file-name-predicate-without-stat ".*\\.h$")))))
-               ;; Install the library, which is needed by Sage. The
-               ;; Makefile target "install-libgap" was available in
-               ;; gap-4.10.0, but has been commented out in gap-4.10.1.
-               ;; Compared to the Makefile, which used libtool, the
-               ;; following approach of copying files and making symlinks
-               ;; is rather pedestrian. There is hope that some later
-               ;; version of gap reinstates and completes the install
-               ;; targets.
-               (invoke "make" "libgap.la")
-               (install-file "libgap.la" lib)
-               (install-file ".libs/libgap.so.0.0.0" lib)
-               (symlink "libgap.so.0.0.0" (string-append lib "/libgap.so")) 
-               (symlink "libgap.so.0.0.0" (string-append lib "/libgap.so.0"))
-               ;; Install a certain number of files and directories to
-               ;; SHARE, where the wrapped shell script expects them.
+               ;; Install the headers and library, which are needed by Sage.
+               (invoke "make" "install-headers")
+               (invoke "make" "install-libgap")
               ;; Remove information on the build directory from sysinfo.gap.
               (substitute* "sysinfo.gap"
                 (("GAP_BIN_DIR=\".*\"") "GAP_BIN_DIR=\"\"")
                 (("GAP_LIB_DIR=\".*\"") "GAP_LIB_DIR=\"\"")
                 (("GAP_CPPFLAGS=\".*\"") "GAP_CPPFLAGS=\"\""))
-               (install-file "sysinfo.gap" share)
-               (copy-recursively "grp" (string-append share "/grp"))
-               (copy-recursively "pkg" (string-append share "/pkg"))
-               ;; The following is not the C library libgap.so, but a
-               ;; library of GAP code.
-               (copy-recursively "lib" (string-append share "/lib"))
-               ;; The gap binary looks for documentation inside SHARE.
-               (copy-recursively "doc" (string-append share "/doc")))
+               (invoke "make" "install-gaproot")
+               ;; Copy the directory of compiled packages; the make target
+               ;; install-pkg is currently empty.
+               (copy-recursively "pkg" (string-append share "/pkg")))
             #t)))))
    (home-page "https://www.gap-system.org/")
    (synopsis
@@ -1314,14 +1340,15 @@ algebra, such as the row echelon form.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "10j6dspbsq7d2l4q3y0c1l1xwmaqqba2fxg59q5bhgk9h5d7q571"))))
+                "10j6dspbsq7d2l4q3y0c1l1xwmaqqba2fxg59q5bhgk9h5d7q571"))
+              (patches (search-patches "linbox-fix-pkgconfig.patch"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("autoconf" ,autoconf)
       ("automake" ,automake)
       ("libtool" ,libtool)
       ("pkg-config" ,pkg-config)))
-    (inputs
+    (propagated-inputs
     `(("fflas-ffpack" ,fflas-ffpack)))
    (synopsis "C++ library for linear algebra over exact rings")
    (description
@@ -1528,7 +1555,7 @@ structure constants of Schubert polynomials.")
         "0akwhhz9b40bz6lrfxpamp7r7wkk48p455qbn04mfnl9a1l6db8x"))))
    (build-system gnu-build-system)
    (inputs
-     `(("gmp", gmp)
+     `(("gmp" ,gmp)
       ("cblas" ,openblas))) ; or any other BLAS library; the documentation
                             ; mentions ATLAS in particular
    (arguments
@@ -5,11 +5,12 @@
 ;;; Copyright © 2017 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2017 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;; Copyright © 2017 Maxim Cournoyer <maxim.cournoyer@gmail.com>
-;;; Copyright © 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
-;;; Copyright © 2019 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2019, 2020 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2020 Sergey Trofimov <sarg@sarg.org.ru>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,8 +31,9 @@
  #:use-module (guix packages)
  #:use-module (guix download)
  #:use-module (guix git-download)
-  #:use-module (guix build-system gnu)
  #:use-module (guix build-system android-ndk)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
  #:use-module (guix build-system python)
  #:use-module (guix build-system trivial)
  #:use-module ((guix licenses) #:prefix license:)
@@ -41,6 +43,7 @@
  #:use-module (gnu packages docker)
  #:use-module (gnu packages gcc)
  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages golang)
  #:use-module (gnu packages java)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages pcre)
@@ -65,7 +68,7 @@
     (origin
      (method git-fetch)
      (uri (git-reference
-            (url "https://github.com/daym/android-make-stub.git")
+            (url "https://github.com/daym/android-make-stub")
            (commit (string-append "v" version))))
      (file-name (string-append "android-make-stub-"
                                version "-checkout"))
@@ -99,7 +102,7 @@ use their packages mostly unmodified in our Android NDK build system.")
     (origin
       (method git-fetch)
       (uri (git-reference
-              (url "https://github.com/google/googletest.git")
+              (url "https://github.com/google/googletest")
              (commit (string-append "release-" version))))
       (file-name (git-file-name name version))
       (sha256
@@ -126,9 +129,9 @@ use their packages mostly unmodified in our Android NDK build system.")
 ;; Big thanks to them for laying the groundwork.

 ;; The version tag is consistent between all repositories.
-(define (android-platform-version) "7.1.2_r36")
+(define-public (android-platform-version) "7.1.2_r36")

-(define (android-platform-system-core version)
+(define-public (android-platform-system-core version)
  (origin
    (method git-fetch)
    (uri (git-reference
@@ -185,7 +188,7 @@ use their packages mostly unmodified in our Android NDK build system.")
     (base32
      checksum))))

-(define android-liblog
+(define-public android-liblog
  (package
    (name "android-liblog")
    (version (android-platform-version))
@@ -201,7 +204,16 @@ use their packages mostly unmodified in our Android NDK build system.")
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
               (symlink "liblog.so.0" (string-append out "/lib/liblog.so"))
-               #t))))))
+               #t)))
+         (add-after 'install 'install-headers
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (copy-recursively
+                 "../include/log" (string-append out "/include/log"))
+               ;; For android/log.h, the only header in the android directory.
+               (copy-recursively
+                 "../include/android" (string-append out "/include/android")))
+             #t)))))
    (home-page "https://developer.android.com/")
    (synopsis "Logging library from the Android platform.")
    (description "@code{liblog} represents an interface to the volatile Android
@@ -229,7 +241,7 @@ in Main, System, Radio and Events sub-logs.")
 various Android core host applications.")
    (license license:asl2.0)))

-(define android-libcutils
+(define-public android-libcutils
  (package
    (name "android-libcutils")
    (version (android-platform-version))
@@ -691,7 +703,7 @@ file system.")
 (define-public android-udev-rules
  (package
    (name "android-udev-rules")
-    (version "20191103")
+    (version "20200613")
    (source
     (origin
       (method git-fetch)
@@ -700,7 +712,7 @@ file system.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0x2f2sv0x0ry7kccp47s0hlxps3hbpg37dj3xjjgpdm5hmn2cjq3"))))
+        (base32 "0cf5br8x6iwxc1cifv0i1klw7skgs8hghdx6qlqby68kyqg81bb2"))))
    (build-system trivial-build-system)
    (native-inputs `(("source" ,source)))
    (arguments
@@ -907,14 +919,14 @@ useful for reverse engineering, analysis of Android applications and more.")
 (define-public fdroidserver
  (package
    (name "fdroidserver")
-    (version "1.1.1")
+    (version "1.1.9")
    (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "fdroidserver" version))
        (sha256
         (base32
-          "0fp7q8faicx6i6wxm717qqaham3jpilb23mvynpz6v73z7hm6wcg"))))
+          "0m07f791z45w7r2dzx4yb6s54b3c3wykm3w9hn25p2jcyax082a2"))))
    (build-system python-build-system)
    (arguments
     `(#:phases
@@ -922,14 +934,20 @@ useful for reverse engineering, analysis of Android applications and more.")
         (add-after 'unpack 'fix-versioning
           (lambda _
             (substitute* "setup.py"
-               (("0.2.1") ,(package-version python-pyasn1-modules)))
+               (("0.2.1") ,(package-version python-pyasn1-modules))
+               ;; The dependency on docker has been removed upstream by
+               ;; a fairly large patch:
+               ;; https://gitlab.com/fdroid/fdroidserver/-/commit/89614851250c79a05db84070feca6dea033af334
+               ;; that is not in a release yet. It appears we can compile with
+               ;; a newer version.
+               (("docker-py >= 1.9, < 2.0") "docker >= 1.9"))
             #t)))))
    (propagated-inputs
     `(("python-androguard" ,python-androguard)
       ("python-apache-libcloud" ,python-apache-libcloud)
       ("python-clint" ,python-clint)
       ("python-defusedxml" ,python-defusedxml)
-       ("python-docker-py" ,python-docker-py)
+       ("python-docker" ,python-docker)
       ("python-gitpython" ,python-gitpython)
       ("python-mwclient" ,python-mwclient)
       ("python-paramiko" ,python-paramiko)
@@ -957,6 +975,36 @@ publishing, or to assist in creating, testing and submitting metadata to the
 main repository.")
    (license license:agpl3+)))

+(define-public fdroidcl
+  (package
+    (name "fdroidcl")
+    (version "0.5.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/mvdan/fdroidcl")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32 "1rxcdyy2j34z0ql9d62w7ivsch9xihjnpb1z9kgy9q46vl8zhhy0"))))
+    (build-system go-build-system)
+    (arguments
+     `(#:import-path "mvdan.cc/fdroidcl"
+       #:tests? #f  ; TODO: Inputs missing.
+       #:install-source? #f))
+    (inputs
+     `(("go-github-com-kr-pretty" ,go-github-com-kr-pretty)))
+    ;(native-inputs
+    ; `(("go-github-com-rogpeppe-go-internal-testscript"
+    ;    ,go-github-com-rogpeppe-go-internal-testscript)))
+    (synopsis "F-Droid desktop client")
+    (description
+     "While the Android client integrates with the system with regular update
+checks and notifications, this is a simple command line client that talks to
+connected devices via ADB.")
+    (home-page "https://github.com/mvdan/fdroidcl")
+    (license license:bsd-3)))
+
 (define-public enjarify
  (package
    (name "enjarify")
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2018, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Pkill -9 <pkill9@runbox.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -201,7 +201,7 @@ contains the graphical user interface for synfig.")
      (source (origin
                (method git-fetch)
                (uri (git-reference
-                      (url "https://github.com/LostMoho/Papagayo.git")
+                      (url "https://github.com/LostMoho/Papagayo")
                      (commit commit)))
                (file-name (git-file-name name version))
                (sha256
@@ -264,7 +264,7 @@ waveform until they line up with the proper sounds.")
 (define-public pencil2d
  (package
    (name "pencil2d")
-    (version "0.6.4")
+    (version "0.6.5")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -273,7 +273,7 @@ waveform until they line up with the proper sounds.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0zi8x0w8n817zds2lyw9l8j33c03kiybkrcyy3s5fg66mchmrwnr"))))
+                "06l60wawkhb3wrsj79p5f7ka5cgcyly36pbvm95fvwbkmlvmjzf1"))))
    (build-system gnu-build-system)
    (inputs
     `(("qtbase" ,qtbase)
@@ -44,14 +44,14 @@
 (define-public clamav
  (package
    (name "clamav")
-    (version "0.102.3")
+    (version "0.103.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.clamav.net/downloads/production/"
                                  "clamav-" version ".tar.gz"))
              (sha256
               (base32
-                "14q6vi178ih60yz4ja33b6181va1dcj8fyscnmxfx2crav250c7d"))
+                "0ih5x1rscg2m64y0z20njj7435q8k7ss575cfw7aipdzfx979a9j"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -59,7 +59,7 @@
                (method git-fetch)
                (file-name (git-file-name name version))
                (uri (git-reference
-                      (url "https://github.com/letoram/arcan.git")
+                      (url "https://github.com/letoram/arcan")
                      (commit commit)))
                (sha256
                 (base32 "1pd0avlzc2rig1hd37zbhc7r2s6fjzdhshfg9l9cfzibl7caclyw"))))
@@ -145,7 +145,7 @@
                            (method git-fetch)
                            (file-name "arcan-openal-0.5.4")
                            (uri (git-reference
-                                  (url "https://github.com/letoram/openal.git")
+                                  (url "https://github.com/letoram/openal")
                                  (commit "1c7302c580964fee9ee9e1d89ff56d24f934bdef")))
                            (sha256
                             (base32
@@ -195,7 +195,7 @@ engine programmable using Lua.")
         (method git-fetch)
         (file-name (git-file-name name version))
         (uri (git-reference
-               (url "https://github.com/letoram/xarcan.git")
+               (url "https://github.com/letoram/xarcan")
               (commit commit)))
         (sha256
          (base32 "0zng7cs6733mnf0p6g5wv02981f2sf567n56csax6cmzb8fpamym"))))
@@ -9,6 +9,8 @@
 ;;; Copyright © 2019 Jens Mølgaard <jens@zete.tk>
 ;;; Copyright © 2020 Timotej Lazar <timotej.lazar@araneo.si>
 ;;; Copyright © 2020 Marcin Karpezo <sirmacik@wioo.waw.pl>
+;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
+;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,7 +35,9 @@
  #:use-module (guix utils)
  #:use-module (gnu packages)
  #:use-module (gnu packages base)
+  #:use-module (gnu packages bison)
  #:use-module (gnu packages compression)
+  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages perl)
  #:use-module (ice-9 match))

@@ -404,8 +408,12 @@ dictionaries, including personal ones.")
                             (find-files "speller"
                                         ,(string-append language ".*\\.dic$"))))

-               (install-file ,(string-append "speller/" language ".aff")
-                             hunspell)
+               ;; Install affix files corresponding to installed dictionaries
+               (for-each (lambda (dic)
+                           (install-file (string-append
+                                           "speller/" (basename dic ".dic") ".aff")
+                                         hunspell))
+                         (find-files hunspell ".*\\.dic$"))
               (symlink hunspell (string-append myspell "/dicts"))
               (for-each (lambda (file)
                           (install-file file doc))
@@ -453,3 +461,50 @@ under permissive licensing terms.  See the 'Copyright' file."))))
 (define-word-list-dictionary hunspell-dict-en-us
  "en_US"
  (synopsis "Hunspell dictionary for United States English"))
+
+(define-public ispell
+  (package
+    (name "ispell")
+    (version "3.4.00")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.cs.hmc.edu/~geoff/tars/ispell-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "1hmfnz55qzfpz7lz0r3m4kkv31smir92ks9s5l1iiwimhr2jxi2x"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:parallel-build? #f
+       #:tests? #f ; no tests
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             ;; Based on local.h.linux
+             (let* ((grep (assoc-ref inputs "grep"))
+                    (out (assoc-ref outputs "out")))
+               (call-with-output-file "local.h"
+                 (lambda (port)
+                   (format port "#define MINIMENU~%")
+                   (format port "#define USG~%")
+                   (format port "#define HAS_RENAME~%")
+                   (format port "#define CC \"gcc\"~%")
+                   (format port "#define POUNDBANG \"#!~a\"~%" (which "sh"))
+                   (format port "#define EGREPCMD \"~a/bin/grep -Ei\"~%" grep)
+                   (format port "#define BINDIR \"~a/bin\"~%" out)
+                   (format port "#define LIBDIR \"~a/lib/ispell\"~%" out)
+                   (format port "#define MAN1DIR \"~a/share/man/man1\"~%" out)
+                   (format port "#define MAN45DIR \"~a/share/man/man5\"~%" out))))
+             #t)))))
+    (inputs
+     `(("grep" ,grep)
+       ("ncurses" ,ncurses)))
+    (native-inputs
+     `(("bison" ,bison)))
+    (synopsis "Interactive spell-checking tool for Unix")
+    (description "Ispell is an interactive spell-checking tool supporting many
+European languages.")
+    (home-page "https://www.cs.hmc.edu/~geoff/ispell.html")
+    (license bsd-3)))
@@ -8,6 +8,7 @@
 ;;; Copyright © 2019 Andy Tai <atai@atai.org>
 ;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
 ;;; Copyright © 2020 Christopher Lemmer Webber <cwebber@dustycloud.org>
+;;; Copyright © 2020 B. Wilson <elaexuotee@wilsonb.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -47,6 +48,7 @@
  #:use-module (gnu packages texinfo)
  #:use-module (gnu packages python)
  #:use-module (gnu packages sphinx)
+  #:use-module (gnu packages shells)
  #:use-module (gnu packages xml)
  #:use-module ((guix utils)
                #:select (%current-system)))
@@ -149,14 +151,14 @@ to the clients.")
 (define-public fasm
  (package
    (name "fasm")
-    (version "1.73.24")
+    (version "1.73.25")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://flatassembler.net/fasm-"
                           version ".tgz"))
       (sha256
-        (base32 "142vxhs8mh8isvlzq7ir0asmqda410phzxmk9gk9b43dldskkj7k"))))
+        (base32 "0k3h61mfwslyb34kf4dnapfwl8jxlmrp4dv666wc057hkj047knn"))))
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f                      ; no tests exist
@@ -259,16 +261,16 @@ runtime")
 (define-public rgbds
  (package
    (name "rgbds")
-    (version "0.4.0")
+    (version "0.4.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/rednex/rgbds.git")
+                    (url "https://github.com/rednex/rgbds")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "15680964nlsa83nqgxk7knxajn98lddz2hg6jnn8ffmnms5wdam7"))))
+                "05djzl3h18zg2z5p2a881wjbmgikzkhf67cgk00frhw4v05sq0lf"))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases
@@ -306,21 +308,21 @@ package for the Game Boy and Game Boy Color.  It consists of:
 (define-public wla-dx
  (package
    (name "wla-dx")
-    (version "9.10")
+    (version "9.11")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/vhelin/wla-dx.git")
+                    (url "https://github.com/vhelin/wla-dx")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "022isf7s9q5i0j4xj69zpp0lgw8p9n37sn7ii25v68r15zaahk2w"))))
+                "0i8pxvyaih79pqnyvqyqd9rwdid91pna76cap0k1n5zhg8xswf2f"))))
    (build-system cmake-build-system)
    (native-inputs
     `(("sphinx" ,python-sphinx)))      ; to generate man pages
    (arguments
-     `(#:tests? #f)) ; no tests
+     `(#:tests? #f))                    ; no tests
    (home-page "https://github.com/vhelin/wla-dx")
    (synopsis "Assemblers for various processors")
    (description "WLA DX is a set of tools to assemble assembly files to
@@ -371,3 +373,129 @@ It understands mnemonics and generates code for NMOS 6502s (such
 as 6502A, 6504, 6507, 6510, 7501, 8500, 8501, 8502 ...),
 CMOS 6502s (65C02 and Rockwell R65C02) and the 65816.")
    (license license:gpl2)))
+
+(define-public armips
+  (package
+    (name "armips")
+    (version "0.11.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/Kingcom/armips")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1c4dhjkvynqn9xm2vcvwzymk7yg8h25alnawkz4z1dnn1z1k3r9g"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda* (#:key inputs #:allow-other-keys)
+             (invoke "./armipstests" "../source/Tests")))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (install-file "armips" (string-append (assoc-ref outputs "out")
+                                                   "/bin"))
+             #t)))))
+    (home-page "https://github.com/Kingcom/armips")
+    (synopsis "Assembler for various ARM and MIPS platforms")
+    (description
+     "armips is an assembler with full support for the MIPS R3000, MIPS R4000,
+Allegrex and RSP instruction sets, partial support for the EmotionEngine
+instruction set, as well as complete support for the ARM7 and ARM9 instruction
+sets, both THUMB and ARM mode.")
+    (license license:expat)))
+
+(define-public intel-xed
+  (package
+    (name "intel-xed")
+    (version "11.2.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/intelxed/xed")
+             (commit version)))
+       (sha256 (base32 "1jffayski2gpd54vaska7fmiwnnia8v3cka4nfyzjgl8xsky9v2s"))
+       (file-name (git-file-name name version))
+       (patches (search-patches "intel-xed-fix-nondeterminism.patch"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("python-wrapper" ,python-wrapper)
+       ("tcsh" ,tcsh)
+       ;; As of the time of writing this comment, mbuild does not exist in the
+       ;; Python Package Index and seems to only be used by intel-xed, so we
+       ;; opt to include it here instead of packaging separately.  Note also
+       ;; that the git repository contains no version tags, so we directly
+       ;; reference the "version" variable from setup.py instead.
+       ("mbuild"
+        ,(let ((name "mbuild")
+               (version "0.2496"))
+           (origin
+             (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/intelxed/mbuild.git")
+                   (commit "5304b94361fccd830c0e2417535a866b79c1c297")))
+             (sha256
+              (base32
+               "0r3avc3035aklqxcnc14rlmmwpj3jp09vbcbwynhvvmcp8srl7dl"))
+             (file-name (git-file-name name version)))))))
+    (outputs '("out" "lib"))
+    (arguments
+     `(#:phases
+       ;; Upstream uses the custom Python build tool `mbuild', so we munge
+       ;; gnu-build-system to fit.  The build process for this package is
+       ;; documented at https://intelxed.github.io/build-manual/.
+       (let* ((build-dir "build")
+              (kit-dir "kit"))
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (replace 'build
+             (lambda* (#:key inputs #:allow-other-keys)
+               (let ((mbuild (assoc-ref inputs "mbuild")))
+                 (setenv "PYTHONPATH" (string-append
+                                       (getenv "PYTHONPATH") ":" mbuild))
+                 (invoke "./mfile.py"
+                         (string-append "--build-dir=" build-dir)
+                         (string-append "--install-dir=" kit-dir)
+                         "examples"
+                         "doc"
+                         "install"))))
+           (replace 'check
+             (lambda _
+               ;; Skip broken test group `tests/tests-avx512pf'.
+               (invoke "tests/run-cmd.py"
+                       (string-append "--build-dir=" kit-dir "/bin")
+                       "--tests" "tests/tests-base"
+                       "--tests" "tests/tests-avx512"
+                       "--tests" "tests/tests-cet"
+                       "--tests" "tests/tests-via"
+                       "--tests" "tests/tests-syntax"
+                       "--tests" "tests/tests-xop")))
+           (replace 'install
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out"))
+                      (lib (assoc-ref outputs "lib")))
+                 (copy-recursively (string-append kit-dir "/bin")
+                                   (string-append out "/bin"))
+                 (copy-recursively (string-append kit-dir "/include")
+                                   (string-append lib "/include"))
+                 (copy-recursively (string-append kit-dir "/lib")
+                                   (string-append lib "/lib"))
+                 #t)))))))
+    (home-page "https://intelxed.github.io/")
+    (synopsis "Encoder and decoder for x86 (IA32 and Intel64) instructions")
+    (description "The Intel X86 Encoder Decoder (XED) is a software library and
+for encoding and decoding X86 (IA32 and Intel64) instructions.  The decoder
+takes sequences of 1-15 bytes along with machine mode information and produces
+a data structure describing the opcode, operands, and flags.  The encoder takes
+a similar data structure and produces a sequence of 1 to 15 bytes.  Disassembly
+is essentially a printing pass on the data structure.
+
+The library and development files are under the @code{lib} output, with a
+family of command line utility wrappers in the default output.  Each of the cli
+tools is named like @code{xed*}.  Documentation for the cli tools is sparse, so
+this is a case where ``the code is the documentation.''")
+    (license license:asl2.0)))
@@ -56,20 +56,20 @@
 (define-public cfitsio
  (package
    (name "cfitsio")
-    (version "3.47")
+    (version "3.49")
    (source
     (origin
       (method url-fetch)
       (uri (string-append
             "http://heasarc.gsfc.nasa.gov/FTP/software/fitsio/c/"
-             name "-" version ".tar.gz"))
+             "cfitsio-" version ".tar.gz"))
       (sha256
-        (base32 "1vzlxnrjckz78p2wf148v2z3krkwnykfqvlj42sz3q711vqid1a1"))))
+        (base32 "1cyl1qksnkl3cq1fzl4dmjvkd6329b57y9iqyv44wjakbh6s4rav"))))
    (build-system gnu-build-system)
    ;; XXX Building with curl currently breaks wcslib.  It doesn't use
    ;; pkg-config and hence won't link with -lcurl.
    (arguments
-     `(#:tests? #f ; no tests
+     `(#:tests? #f                      ; no tests
       #:phases
       (modify-phases %standard-phases
         (add-after 'unpack 'patch-paths
@@ -128,7 +128,7 @@ header.")
 (define-public gnuastro
  (package
    (name "gnuastro")
-    (version "0.12")
+    (version "0.13")
    (source
     (origin
       (method url-fetch)
@@ -136,7 +136,7 @@ header.")
                           version ".tar.lz"))
       (sha256
        (base32
-         "0ypk1c72q778cixfa52vjxzbd5m4qc6hfjgnipy16sfa7mnspmyf"))))
+         "07di6zx2irc5q0zyymx2951ydzxdfjmzd3az5qnk67ncf3hknvj5"))))
    (build-system gnu-build-system)
    (arguments
     '(#:configure-flags '("--disable-static")))
@@ -159,7 +159,7 @@ programs for the manipulation and analysis of astronomical data.")
 (define-public stellarium
  (package
    (name "stellarium")
-    (version "0.20.1")
+    (version "0.20.3")
    (source
     (origin
       (method url-fetch)
@@ -167,7 +167,7 @@ programs for the manipulation and analysis of astronomical data.")
                           "/releases/download/v" version
                           "/stellarium-" version ".tar.gz"))
       (sha256
-        (base32 "034jkrdaaamvbrkfwi3qcl6h8hwfnw2nvf7a82faj55rskcpnkhm"))))
+        (base32 "0z5r7b1ac43l330xphxnw54xg7jm87ajix8yl4hkq82cs5ja7097"))))
    (build-system cmake-build-system)
    (inputs
     `(("qtbase" ,qtbase)
@@ -178,7 +178,7 @@ programs for the manipulation and analysis of astronomical data.")
       ("zlib" ,zlib)))
    (native-inputs
     `(("gettext" ,gettext-minimal)     ; xgettext is used at compile time
-       ("perl" ,perl)                   ; For pod2man
+       ("perl" ,perl)                   ; for pod2man
       ("qtbase" ,qtbase)               ; Qt MOC is needed at compile time
       ("qttools" ,qttools)))
    (arguments
@@ -191,7 +191,7 @@ programs for the manipulation and analysis of astronomical data.")
       #:phases (modify-phases %standard-phases
                  (add-before 'check 'set-offscreen-display
                    (lambda _
-                      ;; make Qt render "offscreen", required for tests
+                      ;; Make Qt render "offscreen", required for tests.
                      (setenv "QT_QPA_PLATFORM" "offscreen")
                      (setenv "HOME" "/tmp")
                      #t)))))
@@ -328,7 +328,7 @@ Mechanics, Astrometry and Astrodynamics library.")
       ("freetype" ,freetype)
       ("pango" ,pango)
       ("giflib" ,giflib)
-       ("libjpeg", libjpeg-turbo)
+       ("libjpeg" ,libjpeg-turbo)
       ("libpng" ,libpng)
       ("libtiff" ,libtiff)
       ("netpbm" ,netpbm)
@@ -101,7 +101,7 @@ and the time-based @dfn{TOTP} algorithm (RFC6238).")
      (source (origin
                (method git-fetch)
                (uri (git-reference
-                      (url "https://github.com/Yubico/yubico-pam.git")
+                      (url "https://github.com/Yubico/yubico-pam")
                      (commit commit)))
                (file-name (git-file-name name version))
                (sha256
@@ -0,0 +1,46 @@
+/* GNU Guix --- Functional package management for GNU
+   Copyright 1996-1997,2000-2001,2006,2008,2011,2013,2018
+      Free Software Foundation, Inc.
+   Copyright (C) 2020 Ludovic Courtès <ludo@gnu.org>
+
+   This file is part of GNU Guix.
+
+   GNU Guix is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or (at
+   your option) any later version.
+
+   GNU Guix is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/* This file implements a variant of the 'guile' executable that does not
+   complain about locale issues.  */
+
+#include <locale.h>
+#include <libguile.h>
+
+static void
+inner_main (void *unused, int argc, char **argv)
+{
+  scm_shell (argc, argv);
+}
+
+int
+main (int argc, char **argv)
+{
+  /* Try to install the current locale; remain silent if it fails.  */
+  if (setlocale (LC_ALL, "") == NULL)
+    /* The 'guix pull'-provided 'guix' includes at least en_US.utf8 so use
+       that.  That gives us UTF-8 support for 'scm_to_locale_string', etc.,
+       which is always preferable over the C locale.  */
+    setlocale (LC_ALL, "en_US.utf8");
+
+  scm_install_gmp_memory_functions = 1;
+  scm_boot_guile (argc, argv, inner_main, 0);
+  return 0; /* never reached */
+}
@@ -305,7 +305,9 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 # CONFIG_TRIM_UNUSED_KSYMS is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
@@ -350,7 +350,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_LBDAF=y
@@ -370,7 +370,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_BLK_SCSI_REQUEST=y
@@ -876,7 +876,9 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 # CONFIG_TRIM_UNUSED_KSYMS is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
@@ -1021,7 +1023,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -750,7 +750,9 @@ CONFIG_MODULE_FORCE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 # CONFIG_TRIM_UNUSED_KSYMS is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
@@ -964,7 +966,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -881,7 +881,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_LBDAF=y
@@ -1051,7 +1053,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -872,7 +872,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_BLK_SCSI_REQUEST=y
@@ -1061,7 +1063,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -302,7 +302,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_LBDAF=y
@@ -315,7 +315,9 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
 # CONFIG_MODULE_SIG is not set
-# CONFIG_MODULE_COMPRESS is not set
+CONFIG_MODULE_COMPRESS=y
+CONFIG_MODULE_COMPRESS_GZIP=y
+# CONFIG_MODULE_COMPRESS_XZ is not set
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_BLOCK=y
 CONFIG_BLK_DEV_BSG=y
--- a/Show More
+++ b/Show More