gnu: libarchive: Reference libraries absolutely via configure flags.

* gnu/packages/backup.scm (libarchive) [#:configure-flags]: Add 'LIBS' flag. [#:phases] {add--L-in-libarchive-pc}: Delete phase. Change-Id: I85f623043e98b82e46b9afe18c0be53cc7961d4b Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop> Modified-by: Maxim Cournoyer <maxim@guixotic.coop>
gnu: libarchive: Update to 3.8.3.
2026-07-09 05:54:03 +02:00 · 2025-11-20 14:37:54 +09:00 · 2025-11-20 14:20:03 +09:00 · 2025-11-20 14:00:22 +09:00 · 2025-11-20 11:44:20 +09:00 · 2025-11-19 09:42:50 +09:00
543 changed files with 81845 additions and 269123 deletions
@@ -68,7 +68,6 @@
 /doc/stamp-vti
 /doc/version.texi
 /doc/version-*.texi
-/etc/apparmor.d/tunables/guix
 /etc/committer.scm
 /etc/gnu-store.mount
 /etc/guix-daemon.cil
@@ -23,8 +23,6 @@
   (name "cbaines"))
  ("3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"
   (name "civodul"))
-  ("CCB8 1842 F9D7 058E CD67  377A BF5C DF4D F6BF 6682"
-   (name "csantosb"))
  ("510A 8628 E2A7 7678 8F8C  709C 4BC0 2592 5FF8 F4D3"
   (name "cwebber"))
  (;; primary: "295A F991 6F46 F8A1 34B0  29DA 8086 3842 F0FE D83B"
@@ -100,9 +98,6 @@
   ;; <https://lists.gnu.org/archive/html/guix-devel/2020-01/msg00499.html>.
   "1EFB 0909 1F17 D28C CBF9  B13A 53D4 57B2 D636 EE82"
   (name "roptat"))
-  (;; primary: "3AC5 5D0E 1DA7 AF44 3868  11EE 213D C372 0E7A 023C"
-   "6B51 071A 0FB1 52AD ED93  6360 0322 7982 69E4 71C3"
-   (name "Rutherther"))
  ("EAD1 89E4 799B 5E5E B20A  2A19 CDBC 0BD9 5943 A706"
   (name "SameExpert"))
  (;; primary: "D6B0 C593 DA8C 5EDC A44C  7A58 C336 91F7 1188 B004"
@@ -30,7 +30,6 @@ Eric Bavier <bavier@posteo.net> <bavier@member.fsf.org>
 Eric Dvorsak <eric@dvorsak.fr> <yenda1@gmail.com>
 Evgeny Pisemsky <mail@pisemsky.site> <evgeny@pisemsky.com>
 George Clemmer <myglc2@gmail.com>
-Giacomo Leidi <therewasa@fishinthecalculator.me> <goodoldpaul@autistici.org>
 ison <ison@airmail.cc> <ison111@protonmail.com>
 Ivan Vilata i Balaguer <ivan@selidor.net>
 Jakob L. Kreuze <zerodaysfordays@sdf.org> <zerodaysfordays@sdf.lonestar.org>
@@ -59,7 +58,6 @@ Mathieu Othacehe <mathieu.othacehe@parrot.com>
 Mathieu Othacehe <othacehe@gnu.org>
 Matthew James Kraai <kraai@ftbfs.org>
 Maxim Cournoyer <maxim@guixotic.coop> <maxim.cournoyer@gmail.com>
-Nguyễn Gia Phong <cnx@loang.net> <mcsinyx@disroot.org>
 Nikita Karetnikov <nikita@karetnikov.org> <nikita.karetnikov@gmail.com>
 nikita <nikita@n0.is>
 nikita <nikita@n0.is> ng0 <ng0@n0.is>
@@ -21,8 +21,6 @@ guix/build-system/rebar\.scm                       @guix/beam
 guix/import/hexpm\.scm                             @guix/beam
 guix/scripts/import/hexpm\.scm                     @guix/beam

-gnu/packages/bioinformatics\.scm                   @guix/bioinformatics
-
 gnu/packages/commencement\.scm                     @guix/bootstrap
 gnu/packages/mes\.scm                              @guix/bootstrap

@@ -56,7 +54,6 @@ guix/diagnostics\.scm                              @guix/core
 guix/discovery\.scm                                @guix/core
 guix/docker\.scm                                   @guix/core
 guix/download\.scm                                 @guix/core
-guix/elf\.scm                                      @guix/core
 guix/ftp-client\.scm                               @guix/core
 guix/gexp\.scm                                     @guix/core
 guix/git-authenticate\.scm                         @guix/core
@@ -129,7 +126,7 @@ guix/build/gnu-build-system\.scm                   @guix/core-packages
 guix/build/utils\.scm                              @guix/core-packages
 guix/build-system/gnu\.scm                         @guix/core-packages

-gnu/packages/(.*-|)crypto\.scm$                    @guix/crypto
+gnu/packages/crypto\.scm                           @guix/crypto
 gnu/packages/gnupg\.scm                            @guix/crypto
 gnu/packages/nettle\.scm                           @guix/crypto
 gnu/packages/password-utils\.scm                   @guix/crypto
@@ -193,12 +190,6 @@ guix/import/go\.scm                                @guix/go
 guix/scripts/import/go\.scm                        @guix/go
 tests/import/go\.scm                               @guix/go

-gnu/packages/hare\.scm                             @guix/hare
-gnu/packages/hare-apps\.scm                        @guix/hare
-gnu/packages/hare-xyz\.scm                         @guix/hare
-guix/build-system/hare\.scm                        @guix/hare
-guix/build/hare-build-system\.scm                  @guix/hare
-
 gnu/packages/dhall\.scm                            @guix/haskell
 gnu/packages/haskell(-.+|)\.scm$                   @guix/haskell
 gnu/packages/purescript\.scm                       @guix/haskell
@@ -317,8 +308,7 @@ gnu/packages/chez\.scm                             @guix/racket
 gnu/packages/racket\.scm                           @guix/racket

 NEWS                                               @guix/release
-etc/manifests/release-minimal\.scm                 @guix/release
-etc/manifests/release-desktop\.scm                 @guix/release
+etc/manifests/release\.scm                         @guix/release

 gnu/packages/diffoscope\.scm                       @guix/reproduciblebuilds

@@ -202,7 +202,6 @@ MODULES =					\
  guix/ftp-client.scm				\
  guix/http-client.scm				\
  guix/gnupg.scm				\
-  guix/elf.scm					\
  guix/profiling.scm				\
  guix/store.scm				\
  guix/cvs-download.scm				\
@@ -267,6 +266,7 @@ MODULES =					\
  guix/build/kconfig.scm			\
  guix/build/linux-module-build-system.scm	\
  guix/build/store-copy.scm			\
+  guix/build/io.scm				\
  guix/build/json.scm				\
  guix/build/pack.scm				\
  guix/build/utils.scm				\
@@ -456,6 +456,11 @@ AUX_FILES =						\
  gnu/packages/aux-files/linux-libre/6.17-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.17-riscv.conf	\
  gnu/packages/aux-files/linux-libre/6.17-x86_64.conf	\
+  gnu/packages/aux-files/linux-libre/6.16-arm.conf	\
+  gnu/packages/aux-files/linux-libre/6.16-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/6.16-riscv.conf	\
+  gnu/packages/aux-files/linux-libre/6.16-x86_64.conf	\
+  gnu/packages/aux-files/linux-libre/6.16-i686.conf	\
  gnu/packages/aux-files/linux-libre/6.12-arm.conf	\
  gnu/packages/aux-files/linux-libre/6.12-arm64.conf	\
  gnu/packages/aux-files/linux-libre/6.12-i686.conf	\
@@ -746,14 +751,6 @@ dist_fishcompletion_DATA = etc/completion/fish/guix.fish
 # SELinux policy
 nodist_selinux_policy_DATA = etc/guix-daemon.cil

-# AppArmor profiles.
-nodist_apparmor_profile_DATA =	\
-  etc/apparmor.d/guix		\
-  etc/apparmor.d/guix-daemon
-
-nodist_apparmor_profile_tunables_DATA = \
-  etc/apparmor.d/tunables/guix
-
 EXTRA_DIST +=						\
  .dir-locals.el					\
  .guix-authorizations					\
@@ -787,9 +784,7 @@ EXTRA_DIST +=						\
  etc/manifests/disarchive.scm				\
  etc/manifests/hurd.scm				\
  etc/manifests/kernels.scm				\
-  etc/manifests/release-minimal.scm			\
-  etc/manifests/release-desktop.scm			\
-  etc/manifests/release-user-packages.scm		\
+  etc/manifests/release.scm				\
  etc/manifests/source.scm				\
  etc/manifests/system-tests.scm			\
  etc/manifests/time-travel.scm				\
@@ -1142,18 +1137,12 @@ system_flags = $(foreach system,$(1),-s $(system))
 #   5. Build the installation and VM images.  The images will run 'guix'
 #      corresponding to 'vX.Y.Z' + 1 commit, and they will install 'vX.Y.Z'.
 #
-# This is split into two targets, because a commit is made that has to be
-# pushed to Guix.
-# First, 'prepare-release' should be run, doing steps 1 and 2.
-# Then, the resulting commit should be pushed so that it's available
-# to be downloaded for the system images.
-# Afterwards, the 'release' target takes care of the rest.  This 'release'
-# target takes care of everything and copies the resulting files to
-# $(releasedir).
+# This 'release' target takes care of everything and copies the resulting
+# files to $(releasedir).
 #
 # XXX: Depend on 'dist' rather than 'distcheck' to work around the Gettext
 # issue described at <https://savannah.gnu.org/bugs/index.php?51027>.
-prepare-release: dist-with-updated-version all
+release: dist-with-updated-version all
 	@if ! git diff-index --quiet HEAD; then			\
 	  echo "There are uncommitted changes; stopping." >&2 ;	\
 	  exit 1 ;						\
@@ -1171,26 +1160,48 @@ prepare-release: dist-with-updated-version all
 	$(top_builddir)/pre-inst-env guix build guix	\
 	      $(call system_flags,$(SUPPORTED_SYSTEMS))	\
 	      -v1 --no-grafts --fallback
-
-	@echo
-	@echo "First step done! Source tarball is ready in $(releasedir)"
-	@echo "Now push the resulting commit and run `make release`."
-	@echo
-
-# Make sure you've ran prepare-release prior to running release and pushed
-# the commit to Guix. It might be pushed to any branch, such as version-X.Y.Z.
-release: all
-# Build the artifacts for current commit.
-# Use time-machine for provenance.
-	$(MKDIR_P) "$(releasedir)"
-	@echo "Building guix inferior for current commit."
-	COMMIT="$$(git rev-parse HEAD)" &&					\
-	GUIX="$$(guix time-machine --commit=$$COMMIT)/bin/guix" &&		\
-	echo "Building artifacts for current commit: $$COMMIT." &&		\
-	ARTIFACTS="$$($$GUIX build --no-grafts					\
-		-f ./etc/teams/release/artifacts.scm)" &&			\
-	echo "Artifacts built! Copying to $(releasedir)" &&			\
-	cp -f "$$ARTIFACTS"/* "$(releasedir)"
+# Generate the binary release tarballs.
+	rm -f $(BINARY_TARBALLS)
+	$(MAKE) $(BINARY_TARBALLS)
+	for system in $(SUPPORTED_SYSTEMS) ; do					\
+	  mv "guix-binary.$$system.tar.xz"					\
+	      "$(releasedir)/guix-binary-$(PACKAGE_VERSION).$$system.tar.xz" ;	\
+	done
+# Build 'current-guix' to speed things up for the next step.
+	$(top_builddir)/pre-inst-env guix build				\
+	      -e '((@ (gnu packages package-management) current-guix))'	\
+	      $(call system_flags,$(GUIX_SYSTEM_INSTALLER_SYSTEMS))	\
+	      -v1 --no-grafts --fallback
+# Generate the ISO installation images.
+	for system in $(GUIX_SYSTEM_INSTALLER_SYSTEMS) ; do				\
+	  GUIX_DISPLAYED_VERSION="`git describe --match=v* | sed -'es/^v//'`" ;		\
+	  image=`$(top_builddir)/pre-inst-env						\
+	    guix system image -t iso9660						\
+	    --label="GUIX_$${system}_$(VERSION)"					\
+            --system=$$system --fallback						\
+	    gnu/system/install.scm` ;							\
+	  if [ ! -f "$$image" ] ; then							\
+	    echo "failed to produce Guix installation image for $$system" >&2 ;		\
+	    exit 1 ;									\
+	  fi ;										\
+	  cp "$$image" "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso.tmp" ;	\
+	  mv "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso.tmp"			\
+	     "$(releasedir)/$(GUIX_SYSTEM_IMAGE_BASE).$$system.iso" ;			\
+	done
+# Generate the VM images.
+	for system in $(GUIX_SYSTEM_VM_SYSTEMS) ; do					\
+	  GUIX_DISPLAYED_VERSION="`git describe --match=v* | sed -'es/^v//'`" ;		\
+	  image=`$(top_builddir)/pre-inst-env						\
+	    guix system image -t qcow2 $(GUIX_SYSTEM_VM_IMAGE_FLAGS)			\
+	    --save-provenance								\
+	    --system=$$system --fallback						\
+	    gnu/system/examples/vm-image.tmpl` ;					\
+	  if [ ! -f "$$image" ] ; then							\
+	    echo "failed to produce Guix VM image for $$system" >&2 ;			\
+	    exit 1 ;									\
+	  fi ;										\
+	  cp "$$image" "$(releasedir)/$(GUIX_SYSTEM_VM_IMAGE_BASE).$$system.qcow2";	\
+	done
 	@echo
 	@echo "Congratulations!  All the release files are now in $(releasedir)."
 	@echo
@@ -1229,10 +1240,9 @@ assert-no-store-file-names:
 # Make sure installer substitutes are available.  Check only the primary
 # server so that '--display-missing' doesn't print two lists.
 assert-binaries-available: $(GOBJECTS)
-	$(AM_V_at)$(top_builddir)/pre-inst-env					\
-	  guix weather -m "$(top_srcdir)/etc/manifests/release-minimal.scm"	\
-	                -m "$(top_srcdir)/etc/manifests/release-desktop.scm"	\
-	                --substitute-urls="https://ci.guix.gnu.org"		\
+	$(AM_V_at)$(top_builddir)/pre-inst-env				\
+	  guix weather -m "$(top_srcdir)/etc/manifests/release.scm"	\
+	                --substitute-urls="https://ci.guix.gnu.org"	\
 	                --display-missing

 # Make sure the final inputs don't refer to bootstrap tools.
@@ -50,7 +50,7 @@
                                      directory))
                                 ((_ . directory) directory))
                               (derivation->output-paths drv)))))
-              (%final-inputs system)))
+              %final-inputs))

 (define (assert-valid-substitute substitute)
  "Make sure SUBSTITUTE does not refer to any bootstrap inputs, and bail out
@@ -81,15 +81,6 @@ AC_ARG_WITH([selinux-policy-dir],
  [selinux_policydir='${datadir}/selinux/'])
 AC_SUBST([selinux_policydir])

-AC_ARG_WITH([apparmor-profile-dir],
-  AS_HELP_STRING([--with-apparmor-profile-dir=DIR],
-    [name of the AppArmor profile directory]),
-  [apparmor_profiledir="$withval"],
-  [apparmor_profiledir='${sysconfdir}/apparmor.d'])
-AC_SUBST([apparmor_profiledir])
-apparmor_profile_tunablesdir='${apparmor_profiledir}/tunables'
-AC_SUBST([apparmor_profile_tunablesdir])
-
 dnl Better be verbose.
 AC_MSG_CHECKING([for the store directory])
 AC_MSG_RESULT([$storedir])
@@ -317,7 +308,6 @@ AC_CONFIG_FILES([Makefile
                 po/guix/Makefile.in
                 po/packages/Makefile.in
                 etc/guix-daemon.cil
-                 etc/apparmor.d/tunables/guix
                 guix/config.scm])

 AC_CONFIG_FILES([etc/committer.scm], [chmod +x etc/committer.scm])
@@ -72,7 +72,7 @@

 (define %cookbook-languages
  ;; Available translations for the 'guix-cookbook' text domain.
-  '("de" "en" "es" "fr" "it" "ko" "pt_BR" "ru" "sk" "sv" "ta" "zh_CN"))
+  '("de" "en" "es" "fr" "it" "ko" "pt_BR" "ru" "sk" "sv" "zh_CN"))

 (define %languages
  ;; Available translations for the document being built.
@@ -1300,7 +1300,7 @@ must be the Guix top-level source directory, from which PO files are taken."
                                                  language))
                               ".html")))
                         "HTML, entirely on one page"))
-                  ,@(if (member language '("ko" "ru" "ta"))
+                  ,@(if (member language '("ko" "ru"))
                        '()
                        `((li (a (@ (href ,(string-append
                                            #$manual
@@ -134,11 +134,7 @@ C++11 standard.
@section Building from Git

 If you want to hack Guix itself, it is recommended to use the latest
-version from the Git repository@footnote{
-Guix uses @code{master} as the default branch name. A proposal in 2025 to
-change the default branch name to @code{main} did not reach consensus.
-See @uref{https://codeberg.org/guix/guix-consensus-documents/src/branch/main/003-rename-default-branch.md,
-Guix Consensus Document 003}.}:
+version from the Git repository:

@example
 git clone https://git.guix.gnu.org/guix.git
@@ -77,9 +77,8 @@ Italian (@pxref{Top,,, guix-cookbook.it, Ricettario di GNU Guix}),
 Brazilian Portuguese (@pxref{Top,,, guix-cookbook.pt_BR,
 Livro de receitas do GNU Guix}), Russian (@pxref{Top,,, guix-cookbook.ru,
 GNU Guix Рецепты}), Slovak (@pxref{Top,,, guix-cookbook.sk,
-Receptár GNU Guix}), Swedish (@pxref{Top,,, guix-cookbook.sv,
-Kokbok för GNU Guix}), and Tamil (@pxref{Top,,, guix-cookbook.ta,
-GNU Guix கையேடு}).  If you would like to translate
+Receptár GNU Guix}), and Swedish (@pxref{Top,,, guix-cookbook.sv,
+Kokbok för GNU Guix}).  If you would like to translate
 this document in your native language, consider joining
@uref{https://translate.codeberg.org/projects/guix/documentation-cookbook,
 Weblate} (@pxref{Translating Guix,,, guix, GNU Guix Reference
@@ -293,7 +292,7 @@ Examples of valid expressions:
@result{} 17

 (display (string-append "Hello " "Guix" "\n"))
-@print{} Hello Guix
+@print{} Hello Guix!
@result{} #<unspecified>
@end lisp

@@ -505,6 +504,10 @@ selection of documents to learn more about Scheme:
@uref{https://spritely.institute/static/papers/scheme-primer.html, @i{A
 Scheme Primer}}, by Christine Lemmer-Webber and the Spritely Institute.

+@item
+@uref{http://www.troubleshooters.com/codecorn/scheme_guile/hello.htm,
+@i{Scheme at a Glance}}, by Steve Litt.
+
@item
@c There used to be a copy at mitpress.mit.edu but it vanished.
@uref{https://sarabander.github.io/sicp/,
@@ -146,7 +146,6 @@ Copyright @copyright{} 2025 Artur Wroblewski@*
 Copyright @copyright{} 2025 Edouard Klein@*
 Copyright @copyright{} 2025 Rodion Goritskov@*
 Copyright @copyright{} 2025 dan@*
-Copyright @copyright{} 2025 Noé Lopez@*

 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -483,7 +482,6 @@ Home Services
 * Media: Media Home Services.   Services for managing media.
 * Sway: Sway window manager.    Setting up the Sway configuration.
 * Networking: Networking Home Services.  Networking services.
-* Secrets: Secrets Home Services.  Services for storing secrets.
 * Miscellaneous: Miscellaneous Home Services.  More services.

 Platforms
@@ -770,32 +768,40 @@ This section only applies to systems without Guix.  Following it for
 existing Guix installations will overwrite important system files.
@end quotation

-Some GNU/Linux distributions, such as openSUSE, Alpine and NixOS provide
-Guix through their own package managers.  The version of Guix may be
-older than @value{VERSION} but you can update it afterwards by running
-@samp{guix pull}.
+Some GNU/Linux distributions, such as Debian, Ubuntu, and openSUSE
+provide Guix through their own package managers.  The version of Guix
+may be older than @value{VERSION} but you can update it afterwards by
+running @samp{guix pull}.

 We advise system administrators who install Guix, both from the
 installation script or @i{via} the native package manager of their
 foreign distribution, to also regularly read and follow security
 notices, as shown by @command{guix pull}.

+For Debian or derivatives such as Ubuntu or Trisquel, call:
+
+@example
+sudo apt install guix
+@end example
+
+Likewise, on openSUSE:
+
+@example
+sudo zypper install guix
+@end example
+
 If you are running Parabola, after enabling the pcr (Parabola
 Community Repo) repository, you can install Guix with:
@example
 sudo pacman -S guix
@end example

-For other package managers with a @var{guix} package, you should be able
-to install it like any other package.
-
 The Guix project also provides a shell script, @file{guix-install.sh},
 which automates the binary installation process without use of a foreign
 distro package
 manager@footnote{@uref{https://guix.gnu.org/guix-install.sh}}.
 Use of @file{guix-install.sh} requires Bash, GnuPG, GNU@tie{}tar, wget,
-and Xz.  On systems where @code{systemd} is detected, the tool
-@code{newgidmap} from the @code{uidmap} package is also required.
+and Xz.

 The script guides you through the following:

@@ -920,7 +926,6 @@ pre-built binaries.
 * Build Environment Setup::     Preparing the isolated build environment.
 * Daemon Offload Setup::        Offloading builds to remote machines.
 * SELinux Support::             Using an SELinux policy for the daemon.
-* AppArmor Support::            Using an AppArmor profile for the daemon.
@end menu

@node Build Environment Setup
@@ -1030,12 +1035,6 @@ When using this option, you only need to create one user account, and
          --system guix-daemon
@end example

-@quotation Warning
-If the @command{nologin} binary is not found by @command{which nologin},
-you may need to specify its path manually.  This will usually be
-@file{/sbin/nologin} or @file{/usr/sbin/nologin}.
-@end quotation
-
 In this configuration, @file{/gnu/store} is owned by the
@code{guix-daemon} user.

@@ -1099,8 +1098,6 @@ systemctl daemon-reload
 systemctl start guix-daemon
@end example

-If your system has AppArmor enabled, @pxref{AppArmor Support}.
-
@quotation Warning
 The commands above assume that @command{guix pull} was run for the root
 user.  You can check whether this is the case by running this command:
@@ -1287,6 +1284,16 @@ If the machine is running the OpenSSH daemon, @command{sshd}, the host
 key can be found in a file such as
@file{/etc/ssh/ssh_host_ed25519_key.pub}.

+If the machine is running the SSH daemon of GNU@tie{}lsh,
+@command{lshd}, the host key is in @file{/etc/lsh/host-key.pub} or a
+similar file.  It can be converted to the OpenSSH format using
+@command{lsh-export-key} (@pxref{Converting keys,,, lsh, LSH Manual}):
+
+@example
+$ lsh-export-key --openssh < /etc/lsh/host-key.pub
+ssh-rsa AAAAB3NzaC1yc2EAAAAEOp8FoQAAAQEAs1eB46LV@dots{}
+@end example
+
@end table

 A number of optional fields may be specified:
@@ -1530,43 +1537,6 @@ installation time whenever the Guix package that provides the
 effectively running @code{guix-daemon} executable is upgraded.
@end enumerate

-@node AppArmor Support
-@subsection AppArmor Support
-
-@cindex AppArmor
-
-Guix includes an AppArmor profile for the build daemon in
-@file{etc/apparmor.d/guix-daemon} that can be installed on systems with
-strict AppArmor policies to allow it to run unprivileged
-(@pxref{Build Environment Setup}).  Indeed, the unprivileged daemon makes
-use of Linux user namespaces but these are disallowed
-without an AppArmor policy on some systems like Ubuntu.
-
-To know if this applies to you, check if the
-@code{kernel.apparmor_restrict_unprivileged_userns} kernel parameter is
-enabled.
-
-@subsubsection Installing the AppArmor profile
-@cindex AppArmor, profile installation
-
-@quotation Note
-The @code{guix-install.sh} binary installation script offers to perform
-the steps below for you (@pxref{Binary Installation}).
-@end quotation
-
-Run these commands as root to install the profile:
-
-@example
-export apparmor_sources=/var/guix/profiles/per-user/root/current-guix/etc/apparmor.d
-cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix"
-cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon"
-cp -f -t /etc/apparmor.d "$apparmor_sources/guix"
-apparmor_parser -r /etc/apparmor.d/guix-daemon
-apparmor_parser -r /etc/apparmor.d/guix
-@end example
-
-After this, the build daemon will be able to function correctly.
-
@node Invoking guix-daemon
@section Invoking @command{guix-daemon}
@cindex @command{guix-daemon}
@@ -7926,8 +7896,7 @@ package looks like this:
               (base32
                "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"))))
    (build-system gnu-build-system)
-    (arguments
-     (list #:configure-flags #~(list "--enable-silent-rules")))
+    (arguments '(#:configure-flags '("--enable-silent-rules")))
    (inputs (list gawk))
    (synopsis "Hello, GNU world: An example GNU package")
    (description "Guess what GNU Hello prints!")
@@ -7938,22 +7907,15 @@ package looks like this:
@noindent
 Without being a Scheme expert, the reader may have guessed the meaning
 of the various fields here.  This expression binds the variable
-@code{hello} to a @code{<package>} record
+@code{hello} to a @code{<package>} object, which is essentially a record
 (@pxref{SRFI-9, Scheme records,, guile, GNU Guile Reference Manual}).
 This package object can be inspected using procedures found in the
@code{(guix packages)} module; for instance, @code{(package-name hello)}
 returns---surprise!---@code{"hello"}.

-@quotation Quick start
-Impatient?  With luck, you may be able to import part or all of the
-definition of the package you are interested in from another repository,
-using the @code{guix import} command (@pxref{Invoking guix import}).
-
-Alternatively, try out the
-@uref{https://guix-hpc.gitlabpages.inria.fr/guix-packager/,
-Guix-Packager interface} in your web browser to produce a preliminary
-package definition.
-@end quotation
+With luck, you may be able to import part or all of the definition of
+the package you are interested in from another repository, using the
+@code{guix import} command (@pxref{Invoking guix import}).

 In the example above, @code{hello} is defined in a module of its own,
@code{(gnu packages hello)}.  Technically, this is not strictly
@@ -8003,30 +7965,32 @@ The @code{arguments} field specifies options for the build system
@code{gnu-build-system} as a request run @file{configure} with the
@option{--enable-silent-rules} flag.

-The value of the @code{arguments} field is a list of arguments passed to
-the build system and that end up being applied, as with @code{apply}
+@cindex quote
+@cindex quoting
+@findex '
+@findex quote
+@cindex backquote (quasiquote)
+@findex `
+@findex quasiquote
+@cindex comma (unquote)
+@findex ,
+@findex unquote
+What about these quote (@code{'}) characters?  They are Scheme syntax to
+introduce a literal list; @code{'} is synonymous with @code{quote}.
+Sometimes you'll also see @code{`} (a backquote, synonymous with
+@code{quasiquote}) and @code{,} (a comma, synonymous with @code{unquote}).
+@xref{Expression Syntax, quoting,, guile, GNU Guile Reference Manual},
+for details.  Here the value of the @code{arguments} field is a list of
+arguments passed to the build system down the road, as with @code{apply}
 (@pxref{Fly Evaluation, @code{apply},, guile, GNU Guile Reference
 Manual}).

-@cindex keyword arguments, for build systems
 The hash-colon (@code{#:}) sequence defines a Scheme @dfn{keyword}
 (@pxref{Keywords,,, guile, GNU Guile Reference Manual}), and
@code{#:configure-flags} is a keyword used to pass a keyword argument
 to the build system (@pxref{Coding With Keywords,,, guile, GNU Guile
 Reference Manual}).

-@findex #~
-@findex gexp
-@cindex staging, for build system arguments
-@cindex code staging, in package definitions
-What about these hash-tilde (@code{#~}) characters?  This is
-Guix-specific syntax introducing a so-called @dfn{G-expression}
-(@pxref{G-Expressions}), which denotes code that is @dfn{staged} for
-eventual evaluation: this staged code is only evaluated if and when
-attempting to build the package, by the build daemon.  In this example,
-the staged code is the @code{(list @dots{})} expression, which builds a
-list of one element, the configure flag.
-
@item
 The @code{inputs} field specifies inputs to the build process---i.e.,
 build-time or run-time dependencies of the package.  Here, we add
@@ -13303,11 +13267,6 @@ be a list of keywords with values accepted by procedure
@end example
@end deffn

-@deffn {REPL command} graft? @var{graft?}
-Set whether grafts should be performed as part of the build.  Equivalent
-to @code{--no-grafts} argument to @code{guix build}.
-@end deffn
-
@deffn {REPL command} lower @var{object}
 Lower @var{object} into a derivation or store file name and return it.
@end deffn
@@ -18941,8 +18900,8 @@ given location at the time of the unlock attempt.
 ;; Following definition would be equivalent to running:
 ;;   cryptsetup open --key-file /crypto.key /dev/sdb1 data
 (mapped-device
- (source "/dev/sdb1")
- (target "data")
+ (source "/dev/sdb1)
+ (target "data)
 (type luks-device-mapping)
 (arguments '(#:key-file "/crypto.key")))
@end lisp
@@ -18972,7 +18931,7 @@ options, along with @option{--allow-discards}:
  (arguments '(#:allow-discards? #t
               #:extra-options
               ("--perf-no_read_workqueue"
-                "--perf-no_write_workqueue"))))
+                "--perf-no_write_workqueue")))))
@end lisp

@end table
@@ -19895,11 +19854,6 @@ symlink:
 This procedure is meant for @code{/bin/sh}, @code{/usr/bin/env} and
 similar targets.  In particular, use for targets under @code{/etc} might
 not work as expected if the target is managed by Guix in other ways.
-
-The special files persist on your system even after the
-@code{extra-special-file} call has been removed from your system config
-and the system has been reconfigured.  The special files need to be
-removed manually.
@end deffn

@defvar host-name-service-type
@@ -24018,6 +23972,75 @@ Here is a more complex example configuration for illustrative purposes:


 Furthermore, @code{(gnu services ssh)} provides the following services.
+@cindex SSH
+@cindex SSH server
+
+@defvar lsh-service-type
+Type of the service that runs the GNU@tie{}lsh secure shell (SSH)
+daemon, @command{lshd}.  The value for this service is a
+@code{<lsh-configuration>} object.
+@end defvar
+
+@deftp {Data Type} lsh-configuration
+Data type representing the configuration of @command{lshd}.
+
+@table @asis
+@item @code{lsh} (default: @code{lsh}) (type: file-like)
+The package object of the GNU@tie{}lsh secure shell (SSH) daemon.
+
+@item @code{daemonic?} (default: @code{#t}) (type: boolean)
+Whether to detach from the controlling terminal.
+
+@item @code{host-key} (default: @code{"/etc/lsh/host-key"}) (type: string)
+File containing the @dfn{host key}.  This file must be readable by
+root only.
+
+@item @code{interfaces} (default: @code{'()}) (type: list)
+List of host names or addresses that @command{lshd} will listen on.
+If empty, @command{lshd} listens for connections on all the network
+interfaces.
+
+@item @code{port-number} (default: @code{22}) (type: integer)
+Port to listen on.
+
+@item @code{allow-empty-passwords?} (default: @code{#f}) (type: boolean)
+Whether to accept log-ins with empty passwords.
+
+@item @code{root-login?} (default: @code{#f}) (type: boolean)
+Whether to accept log-ins as root.
+
+@item @code{syslog-output?} (default: @code{#t}) (type: boolean)
+Whether to log @command{lshd} standard output to syslogd.
+This will make the service depend on the existence of a syslogd service.
+
+@item @code{pid-file?} (default: @code{#f}) (type: boolean)
+When @code{#t}, @command{lshd} writes its PID to the file specified in
+@var{pid-file}.
+
+@item @code{pid-file} (default: @code{"/var/run/lshd.pid"}) (type: string)
+File that @command{lshd} will write its PID to.
+
+@item @code{x11-forwarding?} (default: @code{#t}) (type: boolean)
+Whether to enable X11 forwarding.
+
+@item @code{tcp/ip-forwarding?} (default: @code{#t}) (type: boolean)
+Whether to enable TCP/IP forwarding.
+
+@item @code{password-authentication?} (default: @code{#t}) (type: boolean)
+Whether to accept log-ins using password authentication.
+
+@item @code{public-key-authentication?} (default: @code{#t}) (type: boolean)
+Whether to accept log-ins using public key authentication.
+
+@item @code{initialize?} (default: @code{#t}) (type: boolean)
+When @code{#f}, it is up to the user to initialize the randomness
+generator (@pxref{lsh-make-seed,,, lsh, LSH Manual}), and to create
+a key pair with the private key stored in file @var{host-key}
+(@pxref{lshd basics,,, lsh, LSH Manual}).
+
+@end table
+@end deftp
+
@cindex SSH
@cindex SSH server
@defvar openssh-service-type
@@ -28384,47 +28407,30 @@ Additional command line options to pass to @code{memcached}.

@subsubheading Redis

-@uref{https://redis.io/, Redis} is an in-memory data store used
-by millions of developers as a cache, vector database, document
-database, streaming engine, and message broker. Redis has built-in
-replication and different levels of on-disk persistence. It supports
-complex data types (for example, strings, hashes, lists, sets, sorted
-sets, and JSON), with atomic operations defined on those data types.
-
@defvar redis-service-type
-Type of the service that runs @command{redis}, an in-memory data store.
-The value for this service is a @code{<redis-configuration>} object.
+This is the service type for the @uref{https://redis.io/, Redis}
+key/value store, whose value is a @code{redis-configuration} object.
@end defvar

-@c %start of fragment
-
@deftp {Data Type} redis-configuration
-Available @code{redis-configuration} fields are:
+Data type representing the configuration of redis.

@table @asis
-@item @code{redis} (default: @code{redis}) (type: package)
+@item @code{redis} (default: @code{redis})
 The Redis package to use.

-@item @code{bind} (default: @code{"127.0.0.1"}) (type: string)
+@item @code{bind} (default: @code{"127.0.0.1"})
 Network interface on which to listen.

-@item @code{port} (default: @code{6379}) (type: number)
+@item @code{port} (default: @code{6379})
 Port on which to accept connections on, a value of 0 will disable
 listening on a TCP socket.

-@item @code{working-directory} (default: @code{"/var/lib/redis"}) (type: string)
+@item @code{working-directory} (default: @code{"/var/lib/redis"})
 Directory in which to store the database and related files.
-
-@item @code{config-file} (type: maybe-string)
-Default location for config file.
-
@end table
-
@end deftp

-
-@c %end of fragment
-
@node Mail Services
@subsection Mail Services

@@ -40983,10 +40989,6 @@ The image type name.  Use @code{'hurd-qcow2} for a 32-bit image or
 The image object representing the disk image of this virtual machine
 (@pxref{System Images}).

-Alternatively, this can be the file name (a string) of an image, which
-is useful if you want the image to persist across service restarts---see
-example below.
-
@item @code{disk-size} (default: @code{'guess})
 The size of the disk image.

@@ -41085,16 +41087,15 @@ with the following non-volatile secrets, unless they already exist:
@end table
@end deftp

-Note that by default the VM image is volatile---i.e., once the service
-is stopped, the contents are lost.  If you want a persistent image
-instead, override the configuration's @code{image} and @code{options}
-without the @option{--snapshot} flag using something along these lines:
+Note that by default the VM image is volatile, i.e., once stopped the
+contents are lost.  If you want a stateful image instead, override the
+configuration's @code{image} and @code{options} without
+the @code{--snapshot} flag using something along these lines:

@lisp
 (service hurd-vm-service-type
         (hurd-vm-configuration
-          ;; Specify an out-of-store, persistent image.
-          (image "/out/of/store/writable/hurd.img")
+          (image   (const "/out/of/store/writable/hurd.img"))
          (options '())))
@end lisp

@@ -45546,7 +45547,7 @@ A string representing the OCI image tag.  Defaults to @code{latest}.
@item @code{value} (type: oci-lowerable-image)
 A @code{manifest} or @code{operating-system} record that will be lowered
 into an OCI compatible tarball.  Otherwise this field's value can be a
-file-like object that evaluates to an OCI compatible tarball.
+gexp or a file-like object that evaluates to an OCI compatible tarball.

@item @code{pack-options} (default: @code{'()}) (type: list)
 An optional set of keyword arguments that will be passed to the
@@ -47841,9 +47842,7 @@ machine.  The @code{grub-bootloader} bootloader is always used
 independently of what is declared in the @code{operating-system} file
 passed as argument.  This is to make it easier to work with QEMU, which
 uses the SeaBIOS BIOS by default, expecting a bootloader to be installed
-in the Master Boot Record (MBR).  In case the virtual machine is
-going to be AArch64, you might want to take a look at @code{qcow2-gpt}
-image type that installs bootloader only in EFI.
+in the Master Boot Record (MBR).

@cindex docker-image, creating docker images
 When using the @code{docker} image type, a Docker image is produced.
@@ -48724,7 +48723,9 @@ particular operating system definition.
@cindex service types
 Technically, developers can define @dfn{service types} to express these
 relations.  There can be any number of services of a given type on the
-system, for instance when running two instances with different parameters.
+system---for instance, a system running two instances of the GNU secure
+shell server (lsh) has two instances of @code{lsh-service-type}, with
+different parameters.

 The following section describes the programming interface for service
 types and services.
@@ -49284,11 +49285,6 @@ daemons are started after all the file systems have been mounted and
 that, during shutdown, they are stopped before attempting to terminate
 remaining user processes.

-Similarly, services that do make mounts during their startup or operation,
-should have @code{user-file-systems} as a requirement. @code{user-processes}
-does depend on @code{user-file-systems} as well.
-So direct requirement only on @code{user-processes} is sufficient.
-
@cindex one-shot services, for the Shepherd
@item @code{one-shot?} (default: @code{#f})
 Whether this service is @dfn{one-shot}.  One-shot services stop immediately
@@ -50363,7 +50359,6 @@ services)}.
 * Niri: Niri window manager.    Setting up the Niri.
 * Sway: Sway window manager.    Setting up the Sway configuration.
 * Networking: Networking Home Services.  Networking services.
-* Secrets: Secrets Home Services.  Services for storing secrets.
 * Miscellaneous: Miscellaneous Home Services.  More services.
@end menu
@c In addition to that Home Services can provide
@@ -51938,94 +51933,6 @@ is passed to the @code{xorg-start-command-xinit} procedure producing the
@command{startx} used.  Default value is @code{(xorg-configuration)}.
@end defvar

-@defvar home-darkman-service-type
-This is the service type for the
-@uref{https://gitlab.com/WhyNotHugo/darkman, Darkman}, a program for
-dark-mode and light-mode transitions on Unix-like desktops.  It invokes
-scripts in @code{$XDG_DATA_DIRS/dark-mode.d} at sundown, and invokes
-scripts in @code{$XDG_DATA_DIRS/light-mode.d} at sunrise.  Darkman tries
-to determine the user's current location from:
-@itemize
-@item The config file.
-@item The cache file from last time it ran.
-@item Using the system geoclue.
-@end itemize
-@end defvar
-
-@deftp {Data Type} home-darkman-configuration
-The configuration record for @code{home-darkman-service-type}.  Its
-available fields are:
-
-@table @asis
-@item @code{darkman} (default: @code{darkman}) (type: file-like)
-The @code{darkman} package to use.
-
-@item @code{latitude} (type: maybe-number)
-Latitude, used at startup or when @code{use-geoclue} is @code{#f}.  More
-than one decimal point is generally not needed.
-
-@item @code{longitude} (type: maybe-number)
-Longitude, used at startup or when @code{use-geoclue} is @code{#f}.
-More than one decimal point is generally not needed.
-
-@item @code{use-geoclue} (default: @code{#f}) (type: boolean)
-Whether to use a local geoclue instance to determine the current
-location.  Setting this to false without explicitly setting latitude and
-longtitude disables automatic transitions entirely.
-
-@item @code{dbus-server} (default: @code{#t}) (type: boolean)
-Whether to expose the current mode via darkman's own D-Bus API.
-
-@item @code{portal} (default: @code{#t}) (type: boolean)
-Whether to expose the current mode via the XDG settings portal D-Bus
-API.
-
-@end table
-@end deftp
-
-@defvar home-gcr-ssh-agent-service-type
-
-GNOME Keyring used to be able to act as a wrapper over
-@command{ssh-agent}.  It would display a graphical password entry
-dialog, including a checkbox to remember the password, which, if
-selected, would allow fully passwordless use of that key.
-
-The SSH functionality is disabled by default in
-@command{gnome-keyring-daemon} builds since version
-@uref{https://gitlab.gnome.org/GNOME/gnome-keyring/-/commit25c5a1982467802fa12c6852b03c57924553ba73,
-1.46}.  It has been
-@uref{https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67, moved}
-into @command{gcr-ssh-agent}, which is part of the @code{gcr} package.
-
-To enable the SSH agent functionality it is sufficient to add the
-following to your Home configuration.
-
-@lisp
-(use-modules (gnu home services gnome) ;for 'home-gcr-ssh-agent-service-type'
-             @dots{})
-
-(home-environment
-  (services
-    (list
-      @dots{}
-      (service home-gcr-ssh-agent-service-type))))
-@end lisp
-@end defvar
-
-@deftp {Data Type} gcr-ssh-agent-configuration
-The configuration record for @code{home-gcr-ssh-agent-service-type}.  Its
-available fields are:
-
-@table @asis
-@item @code{package} (default: @code{gcr}) (type: package)
-The @code{gcr} package to use.
-
-@item @code{log-file} (type: maybe-string)
-Where the service will write its logs.  If unset, it defaults to
-@file{$HOME/.local/state/shepherd/gcr-ssh-agent.log}.
-
-@end table
-@end deftp

@node Guix Home Services
@subsection Guix Home Services
@@ -53501,96 +53408,6 @@ documentation of the system service (@pxref{Networking Services,
@code{syncthing-service-type}}).
@end defvar

-@node Secrets Home Services
-@subsection Secrets Home Services
-
-The @code{(gnu home services secrets)} module provides services pertaining to
-storing secrets, notably including password managers.
-
-@subsubheading Himitsu Services
-
-@uref{https://himitsustore.org/, Himitsu} is a daemon for storing arbitrary
-secrets encrypted by a single password.  The daemon operates alongside a
-prompter, which asks the user for permission when an application requests a
-secret, and for the store password on first use in a session.  Neither Himitsu
-nor its underlying cryptography library have been indepednently audited.
-
-@defvar home-himitsu-service-type
-This service provides the main Himitsu store daemon.  It will not launch unless
-you have a store set up - run @code{himitsu-store -i} after the service is added
-to your profile to create it, and then @code{herd start himitsud} to restart the
-service. Configuration is as follows:
-@end defvar
-
-@deftp {Data Type} home-himitsu-configuration
-@table @asis
-@item @code{package} (default: @code{himitsu})
-Package to find @code{himitsud} in.
-
-@item @code{notify-reuse} (optional)
-Interpreted shell command to run on application access to an already-approved
-secret.
-
-@item @code{prompter} (default: @code{(wrap-himitsu-prompter (file-append hiprompt-gtk "/bin/hiprompt-gtk"))})
-Path to a prompter binary.  Defaults to @code{hiprompt-gtk}, the reference
-implementation.  If your prompter is graphical, you should pass it through the
-provided @code{wrap-himitsu-prompter} procedure, which will autodetect a running
-display to prompt on, due to the Himitsu daemon starting before the display
-server is online.
-
-@item @code{extra-options} (optional)
-List of extra strings or G-expressions to insert verbatim into the Himitsu
-configuration file.  Each list element gets its own line.
-
-@end table
-@end deftp
-
-Himitsu can be used through its command-line tool @code{hiq} or through any
-number of supporting services, providing compatability to other applications.
-Git credential support may be provided simply by adding the @code{himitsu-git}
-package to your profile, but other such supporting services are listed below:
-
-@defvar home-himitsu-ssh-service-type
-This service provides an @code{ssh-agent} implementation that stores keys
-through Himitsu.  You may interact with a running daemon through
-@code{hissh-import} and @code{hissh-export}.
-@end defvar
-
-@deftp {Data Type} home-himitsu-ssh-configuration
-@table @asis
-@item @code{package} (default: @code{himitsu-ssh})
-Package to find @code{hissh-agent} in.
-
-@item @code{persist} (default: @code{'(session 300 refuse)})
-List of options given when prompting to allow this service access to your list
-of keys.  The option chosen decides how long @code{himitsu-ssh} has this access.
-Options can be either @code{'session} (access is retained until the daemon
-closes), @code{'refuse} (access is declined and the prompter will not ask
-again), @code{'skip} (ask again next use), or a numerical access timeout in
-seconds.
-
-@item @code{disclose} (default: @code{'(skip session 300)})
-List of options given when prompting to allow this service use of your secret
-keys.  Has the same format as @code{persist}.
-
-@end table
-@end deftp
-
-@defvar home-himitsu-secret-service-type
-This service provides a
-@uref{https://specifications.freedesktop.org/secret-service/latest/, freedesktop
-Secret Service} implementation, allowing Himitsu to replace
-@pxref{Desktop Services, gnome-keyring-service-type} and
-@pxref{Desktop Services, kwallet-service-type}.
-@end defvar
-
-@deftp {Data Type} home-himitsu-secret-service-configuration
-@table @asis
-@item @code{package} (default: @code{himitsu-secret-service})
-Package to find @code{hisecrets-agent} in.
-
-@end table
-@end deftp

@node Miscellaneous Home Services
@subsection Miscellaneous Home Services
@@ -54507,8 +54324,8 @@ there is no offset applied.
@item @code{file-system} (default: @code{"ext4"})
 The partition file system as a string, defaulting to @code{"ext4"}.

-The supported values are @code{"btrfs"}, @code{"ext4"}, @code{"fat16"},
-@code{"f2fs"}, @code{"fat32"}, @code{"vfat"}, and @code{"swap"}.
+The supported values are @code{"vfat"}, @code{"fat16"}, @code{"fat32"},
+@code{"btrfs"}, and @code{"ext4"}.

@code{"vfat"}, @code{"fat16"}, and @code{"fat32"} partitions without the
@code{'esp} flag are by default LBA compatible.
@@ -54767,18 +54584,7 @@ Build an image based on the @code{efi32-disk-image} image.

@defvar qcow2-image-type
 Build an image based on the @code{mbr-disk-image} image but with the
-@code{compressed-qcow2} image format. The resulting image will have
-an MBR embedded bootloader as well as an EFI bootloader. This image
-is not suitable for architectures that do not support `grub-pc`,
-such as AArch64. See @code{qcow2-gpt-image-type} for an alternative.
-@end defvar
-
-@defvar qcow2-gpt-image-type
-Build an image based on the @code{efi-disk-image} image but with the
-@code{compressed-qcow2} image format. The resulting image will have
-only EFI bootloader, unlike @code{qcow2-image-type}. This image
-is suitable for architectures that do not support `grub-pc`, such
-as AArch64.
+@code{compressed-qcow2} image format.
@end defvar

@defvar iso-image-type
@@ -2,7 +2,7 @@
 # Modified by Ludovic Courtès <ludo@gnu.org> for the GNU Guix manual.
 # Further modified by Tomas Volf <~@wolfsden.cz>.

-htmlxrefversion=2025-11-29.21; # UTC
+htmlxrefversion=2025-08-31.16; # UTC

 # Copyright 2010-2020, 2022 Free Software Foundation, Inc.
 #
@@ -453,8 +453,6 @@ GUIX_COOKBOOK = ${GUIX_ROOT}/cookbook
 guix-cookbook.sk	node    ${GUIX_COOKBOOK}/sk/html_node/
 guix-cookbook.sv	mono    ${GUIX_COOKBOOK}/sv/guix-cookbook.sv.html
 guix-cookbook.sv	node    ${GUIX_COOKBOOK}/sv/html_node/
- guix-cookbook.ta	mono    ${GUIX_COOKBOOK}/ta/guix-cookbook.ta.html
- guix-cookbook.ta	node    ${GUIX_COOKBOOK}/ta/html_node/
 guix-cookbook		mono    ${GUIX_COOKBOOK}/en/guix-cookbook.html
 guix-cookbook		node	${GUIX_COOKBOOK}/en/html_node/
 guix-cookbook.zh_CN	mono    ${GUIX_COOKBOOK}/zh-cn/guix-cookbook.zh_CN.html
@@ -26,7 +26,7 @@

 # If adding a language, update the following variables, and info_TEXINFOS.
 MANUAL_LANGUAGES = de es fr it pt_BR ru zh_CN
-COOKBOOK_LANGUAGES = de es fr it ko pt_BR ru sk sv ta zh_CN
+COOKBOOK_LANGUAGES = de es fr it ko pt_BR ru sk sv zh_CN

 # Arg1: A list of languages codes.
 # Arg2: The file name stem.
@@ -52,7 +52,6 @@ info_TEXINFOS = %D%/guix.texi			\
  %D%/guix-cookbook.ru.texi			\
  %D%/guix-cookbook.sk.texi			\
  %D%/guix-cookbook.sv.texi			\
-  %D%/guix-cookbook.ta.texi			\
  %D%/guix-cookbook.zh_CN.texi

 %C%_guix_TEXINFOS = \
@@ -1,12 +0,0 @@
-abi <abi/4.0>,
-
-include <tunables/global>
-include <tunables/guix>
-
-# There’s no point in confining the guix executable, since it can run
-# any user code and so everything is expected.  We just need to
-# explicitely enable userns for systems with the
-# kernel.apparmor_restrict_unprivileged_userns sysctl.
-profile guix @{guix_storedir}/{*-guix-command,*-guix-*/bin/guix} flags=(unconfined) {
-  userns,
-}
@@ -1,88 +0,0 @@
-abi <abi/4.0>,
-
-include <tunables/global>
-include <tunables/guix>
-
-profile guix-daemon @{guix_storedir}/*-{guix-daemon,guix}-*/bin/guix-daemon flags=(enforce,attach_disconnected.path=/disconnected) {
-  include <abstractions/base>
-
-  userns,
-  signal,
-  capability sys_admin,
-  capability net_admin,
-  capability sys_chroot,
-  capability setgid,
-  capability chown,
-  network dgram,
-  umount,
-  mount,
-  pivot_root,
-  # Paths inside build chroot
-  /real-root/ w,
-  / w,
-
-  @{guix_localstatedir}/guix/** rwk,
-  /var/log/guix/** w,
-  owner @{PROC}/@{pid}/{fd/,environ} r,
-  owner @{PROC}/@{pid}/oom_score_adj w,
-  owner @{PROC}/@{pid}/uid_map rw,
-  owner @{PROC}/@{pid}/gid_map rw,
-  owner @{PROC}/@{pid}/setgroups w,
-  @{guix_storedir}/ r,
-  @{guix_storedir}/** rwlmk,
-  @{guix_storedir}/*/bin/guile cx -> guix-builder,
-  @{guix_storedir}/*-guix-command cx -> guix-helper,
-  @{guix_storedir}/*-guix-*/bin/guix cx -> guix-helper,
-  @{etc_rw}/nsswitch.conf r,
-  @{etc_rw}/passwd r,
-  @{etc_rw}/group r,
-  owner /tmp/** rwl,
-  owner /var/tmp/** rwl,
-
-  /usr/bin/newgidmap Ux,
-
-  # Site-specific additions and overrides. See local/README for details.
-  include if exists <local/guix-daemon>
-
-  profile guix-builder flags=(enforce,attach_disconnected.path=/disconnected) {
-    include <abstractions/base>
-
-    signal (receive),
-
-    @{guix_storedir}/** rwlmkux,
-
-    owner /tmp/** rw,
-
-    @{PROC}/@{pid}/fd/ r,
-
-    /disconnected/** rw,
-  }
-
-  # This is for any time guix is called by the daemon as a helper:
-  # - guix download
-  # - guix discover
-  # - guix gc --list-busy
-  # - probably more?
-  profile guix-helper flags=(enforce,attach_disconnected.path=/disconnected) {
-    include <abstractions/base>
-    include <abstractions/nameservice>
-
-    signal (receive),
-    ptrace (read) peer=guix-daemon,
-
-    /disconnected/run/dbus/system_bus_socket rw,
-    dbus (send, receive),
-    @{guix_localstatedir}/guix/discover/ rw,
-    @{guix_localstatedir}/guix/discover/* rw,
-
-    @{guix_localstatedir}/guix/substitute/ rw,
-    @{guix_localstatedir}/guix/substitute/** rwk,
-
-    @{guix_sysconfdir}/guix/** r,
-
-    @{guix_storedir}/** rwlmix,
-
-    @{PROC}/ r,
-    owner @{PROC}/@{pid}/{fd/,environ} r,
-  }
-}
@@ -1,5 +0,0 @@
-@{guix_storedir} = @storedir@
-@{guix_sysconfdir} = @guix_sysconfdir@
-@{guix_localstatedir} = @guix_localstatedir@
-
-include if exists <tunables/guix.d>
@@ -303,23 +303,22 @@ corresponding to the top-level definition containing the staged changes."
                (or (equal? old-values new-values)
                    (let ((removed (lset-difference equal? old-values new-values))
                          (added (lset-difference equal? new-values old-values)))
-                      (unless (and (null? added) (null? removed))
-                        (format port
-                                "[~a]: ~a~%" field
-                                (break-string
-                                 ;; A dependency can be a list of (pkg output).
-                                 (match (list (map object->string removed)
-                                              (map object->string added))
-                                   ((() added)
-                                    (format #f "Add ~a."
-                                            (listify added)))
-                                   ((removed ())
-                                    (format #f "Remove ~a."
-                                            (listify removed)))
-                                   ((removed added)
-                                    (format #f "Remove ~a; add ~a."
-                                            (listify removed)
-                                            (listify added)))))))))))
+                      (format port
+                              "[~a]: ~a~%" field
+                              (break-string
+                               ;; A dependency can be a list of (pkg output).
+                               (match (list (map object->string removed)
+                                            (map object->string added))
+                                 ((() added)
+                                  (format #f "Add ~a."
+                                          (listify added)))
+                                 ((removed ())
+                                  (format #f "Remove ~a."
+                                          (listify removed)))
+                                 ((removed added)
+                                  (format #f "Remove ~a; add ~a."
+                                          (listify removed)
+                                          (listify added))))))))))
            '(inputs propagated-inputs native-inputs)))

 (define* (add-commit-message file-name variable-name
@@ -175,10 +175,6 @@
         (file (execute
                execute_no_trans read write open entrypoint map
                getattr link unlink)))
-  ;; Needed to execute the 'newgidmap' helper.
-  (allow guix_daemon_t
-         bin_t
-         (file (execute execute_no_trans map)))

  ;; Remounting /gnu/store read-write.
  (allow guix_daemon_t
@@ -189,9 +185,6 @@
  (allow guix_daemon_t
         root_t
         (dir (mounton)))
-  (allow init_t
-         guix_daemon.guix_store_content_t
-         (dir (mounton)))
  (allow guix_daemon_t
         fs_t
         (filesystem (getattr)))
@@ -326,7 +319,7 @@
                map
                getattr setattr
                unlink
-                open read write append)))
+                open read write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
         (lnk_file (create getattr rename unlink read)))
@@ -368,14 +361,6 @@
         self
         (netlink_route_socket (bind create getattr nlmsg_read read write getopt)))

-  ;; Allow use of user namespaces
-  (allow guix_daemon_t
-         self
-         (cap_userns (setgid sys_admin net_admin sys_chroot)))
-  (allow guix_daemon_t
-         self
-         (user_namespace (create)))
-
  ;; Socket operations
  (allow guix_daemon_t
         guix_daemon_socket_t
@@ -455,27 +440,6 @@
         vnc_port_t
         (tcp_socket (name_bind)))

-  ;; 'guix gc' needs to go through /proc entries for all processes that are
-  ;; running.  Strictly speaking, it means guix-daemon needs access to all
-  ;; process types in the SELinux policy.  In practice, only processes from
-  ;; programs in the /gnu/store are relevant for finding roots for garbage
-  ;; collection.  Since Guix currently doesn't install any SELinux policy for
-  ;; its packages, we can assume that all the processes it needs to access run
-  ;; as unconfined_t.
-  ;;
-  ;; FIXME: This doesn't stop 'guix gc' from generating a lot of unnecessary
-  ;; AVC denied audit messages.  Perhaps guix-daemon could test whether it has
-  ;; access to the proc entry before trying to access it?
-  (allow guix_daemon_t
-         unconfined_t
-         (dir (search)))
-  (allow guix_daemon_t
-         unconfined_t
-         (file (read)))
-  (allow guix_daemon_t
-         unconfined_t
-         (lnk_file (read)))
-
  ;; I guess sometimes it needs random numbers
  (allow guix_daemon_t
         random_device_t
@@ -14,12 +14,6 @@ ExecStart=@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daem
    --substitute-urls='@GUIX_SUBSTITUTE_URLS@'
 Environment='GUIX_STATE_DIRECTORY=@localstatedir@/guix' 'GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale' LC_ALL=en_US.utf8

-# Stop the gnu-store.mount so that the daemon can capture the store as
-# read-write in its private mount namespace.
-# See <https://codeberg.org/guix/guix/issues/4744>.
-ExecStartPre=-+systemctl stop gnu-store.mount
-ExecStartPost=-+systemctl start gnu-store.mount --no-block
-
 # Run under a dedicated unprivileged user account.
 User=guix-daemon

@@ -17,7 +17,6 @@
 # Copyright © 2024 Tomas Volf <~@wolfsden.cz>
 # Copyright © 2024 Richard Sent <richard@freakingpenguin.com>
 # Copyright © 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
-# Copyright © 2025 Noé Lopez <noelopez@free.fr>
 #
 # This file is part of GNU Guix.
 #
@@ -106,11 +105,10 @@ DEBUG=0
 GNU_URL="https://ftpmirror.gnu.org/gnu/guix/"

 # The following associative array holds set of GPG keys used to sign the
-# releases, keyed by their corresponding Codeberg user name.
+# releases, keyed by their corresponding Savannah user ID.
 declare -A GPG_SIGNING_KEYS
-GPG_SIGNING_KEYS["civodul"]=3CE464558A84FDC69DB40CFB090B11993D9AEBB5  # ludo
-GPG_SIGNING_KEYS["apteryx"]=27D586A4F8900854329FF09F1260E46482E63562 # maxim
-PUBLIC_KEYSERVERS="keys.openpgp.org pgpkeys.eu keyserver.ubuntu.com"
+GPG_SIGNING_KEYS[15145]=3CE464558A84FDC69DB40CFB090B11993D9AEBB5  # ludo
+GPG_SIGNING_KEYS[127547]=27D586A4F8900854329FF09F1260E46482E63562 # maxim

 # ------------------------------------------------------------------------------
 #+UTILITIES
@@ -205,7 +203,6 @@ chk_gpg_keyring()

    for user_id in "${!GPG_SIGNING_KEYS[@]}"; do
        gpg_key_id=${GPG_SIGNING_KEYS[$user_id]}
-        codeberg_username=$user_id
        # Without --dry-run this command will create a ~/.gnupg owned by root on
        # systems where gpg has never been used, causing errors and confusion.
        if gpg --dry-run --list-keys "$gpg_key_id" >/dev/null 2>&1; then
@@ -214,39 +211,20 @@ chk_gpg_keyring()
        if prompt_yes_no "${INF}The following OpenPGP public key is \
 required to verify the Guix binary signature: $gpg_key_id.
 Would you like me to fetch it for you?"; then
-            if wget "https://codeberg.org/$codeberg_username.gpg" \
-                   --tries=1 --timeout=30 --no-verbose -O- | gpg --import -; then
-                continue
-            fi
-            
-            key_obtained=false
-            # Try to fetch keys from an available keyserver
-            for key_server in $PUBLIC_KEYSERVERS; do
-                if gpg --keyserver $key_server --recv-key $gpg_key_id; then
-                    key_obtained=true
-                    break
-                fi
-            done
-            
-            if $key_obtained; then
+            # Use a reasonable time-out here so users don't report silent
+            # ‘freezes’ when Savannah goes out to lunch, as has happened.
+            if wget "https://sv.gnu.org/people/viewgpg.php?user_id=$user_id" \
+                    --timeout=30 --no-verbose -O- | gpg --import -; then
                continue
            fi
        fi
 	# If we reach this point, the key is (still) missing.  Report further
 	# missing keys, if any, but then abort the installation.
        _err "Missing OpenPGP public key ($gpg_key_id).
-Fetch it with codeberg username:
+Fetch it with this command:

-  wget \"https://codeberg.org/$codeberg_username.gpg\" -O - | \
-sudo -i gpg --import -
-
-If this fails, try to fetch it via a keyserver:
-
-  for key_server in $PUBLIC_KEYSERVERS; do
-      if sudo -i gpg --keyserver $key_server --recv-key $gpg_key_id; then
-          break
-      fi
-  done"
+  wget \"https://sv.gnu.org/people/viewgpg.php?user_id=$user_id\" -O - | \
+sudo -i gpg --import -"
        exit_flag=yes
    done
    if [ "$exit_flag" = yes ]; then
@@ -795,6 +773,10 @@ export PATH="$GUIX_PROFILE/bin${PATH:+:}$PATH"
 # trailing colon so the system default search path is used.
 export INFOPATH="$GUIX_PROFILE/share/info:$INFOPATH"
 export MANPATH="$GUIX_PROFILE/share/man:$MANPATH"
+# Expose the latest Guix modules to Guile so guix shell and repls spawned by
+# e.g. Geiser work out of the box.
+export GUILE_LOAD_PATH="$GUIX_PROFILE/share/guile/site/3.0${GUILE_LOAD_PATH:+:}$GUILE_LOAD_PATH"
+export GUILE_LOAD_COMPILED_PATH="$GUIX_PROFILE/lib/guile/3.0/site-ccache${GUILE_LOAD_COMPILED_PATH:+:}$GUILE_LOAD_COMPILED_PATH"

 # User's default profile, if it exists
 GUIX_PROFILE="$HOME/.guix-profile"
@@ -816,11 +798,6 @@ if [ -L "$GUIX_PROFILE" ]; then
    *$GUIX_PROFILE/share/man*) ;;
    *) export MANPATH="$GUIX_PROFILE/share/man:$MANPATH"
  esac
-
-  case $XDG_DATA_DIRS in
-    *$GUIX_PROFILE/share*) ;;
-    *) export XDG_DATA_DIRS="$GUIX_PROFILE/share:$XDG_DATA_DIRS"
-  esac
 fi

 # NOTE: Guix Home handles its own profile initialization in ~/.profile. See
@@ -915,64 +892,6 @@ sys_maybe_setup_selinux()
    restorecon -R /gnu /var/guix
 }

-sys_maybe_setup_apparmor()
-{
-    if ! [ -f /sys/module/apparmor/parameters/enabled ]
-    then
-        return
-    fi
-
-    if ! command -v apparmor_parser &> /dev/null
-    then
-        return
-    fi
-
-    prompt_yes_no "Install AppArmor profile that might be required to run guix-daemon?" \
-        || return 0
-
-    local var_guix=/var/guix/profiles/per-user/root/current-guix
-    local apparmor_sources="${var_guix}/etc/apparmor.d/"
-
-    if ! [ -d "$apparmor_sources" ]
-    then
-        _err "This version of Guix doesn’t contain AppArmor profiles."
-        return
-    fi
-
-    cp -f -t /etc/apparmor.d/tunables "$apparmor_sources/tunables/guix"
-    cp -f -t /etc/apparmor.d "$apparmor_sources/guix-daemon"
-    cp -f -t /etc/apparmor.d "$apparmor_sources/guix"
-    apparmor_parser --warn=all -r /etc/apparmor.d/guix-daemon
-    apparmor_parser --warn=all -r /etc/apparmor.d/guix
-
-    _msg_pass "apparmor profiles installed and loaded"
-}
-
-sys_delete_apparmor_profiles()
-{
-    # Not a big deal if the apparmor_parser commands fail as they only apply
-    # for the current boot, we still want to go on and remove the files.
-    if [ -f "/etc/apparmor.d/guix" ]
-    then
-        _msg_info "removing /etc/apparmor.d/guix"
-        apparmor_parser -R /etc/apparmor.d/guix || true
-        rm -f "/etc/apparmor.d/guix"
-    fi
-
-    if [ -f "/etc/apparmor.d/guix-daemon" ]
-    then
-        _msg_info "removing /etc/apparmor.d/guix-daemon"
-        apparmor_parser -R /etc/apparmor.d/guix-daemon || true
-        rm -f "/etc/apparmor.d/guix-daemon"
-    fi
-
-    if [ -f "/etc/apparmor.d/tunables/guix" ]
-    then
-        _msg_info "removing /etc/apparmor.d/tunables/guix"
-        rm -f "/etc/apparmor.d/tunables/guix"
-    fi
-}
-
 sys_delete_init_profile()
 {
    _msg_info "removing /etc/profile.d/zzz-guix.sh"
@@ -1050,6 +969,7 @@ main_install()
    chk_init_sys
    add_init_sys_require
    chk_require "${REQUIRE[@]}"
+    chk_gpg_keyring
    chk_sys_arch
    chk_sys_nscd
    chk_existing
@@ -1060,7 +980,6 @@ main_install()
    tmp_path="$(mktemp -t -d guix.XXXXXX)"

    if [ -z "${GUIX_BINARY_FILE_NAME}" ]; then
-        chk_gpg_keyring
        guix_get_bin_list "${GNU_URL}"
        guix_get_bin "${GNU_URL}" "${BIN_VER}" "$tmp_path"
        GUIX_BINARY_FILE_NAME=${BIN_VER}.tar.xz
@@ -1075,7 +994,6 @@ main_install()
    sys_create_store "${GUIX_BINARY_FILE_NAME}" "${tmp_path}"
    sys_create_build_user
    sys_maybe_setup_selinux
-    sys_maybe_setup_apparmor
    sys_enable_guix_daemon
    sys_authorize_build_farms
    sys_create_init_profile
@@ -1109,7 +1027,6 @@ main_uninstall()
    sys_delete_guix_daemon
    # stop people from accessing their profiles.
    sys_delete_user_profiles
-    sys_delete_apparmor_profiles
    # kill guix off all the guts of guix
    sys_delete_store
    # clean up the system
@@ -71,21 +71,18 @@ TARGET."
         "connman" "network-manager" "wpa-supplicant" "isc-dhcp" "cups"
         "linux-libre" "grub-hybrid")))

-(define (%system-gui-packages target)
+(define %system-gui-packages
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
               '(;; build system `python' does not support cross builds
-                                        ;"gnome" "xfce" "mate" "openbox"
+                 ;"gnome" "xfce" "mate" "openbox"
                 "awesome"
                 "i3-wm" "i3status" "dmenu" "st"
                 "ratpoison" "xterm"
                 ;; build system `emacs' does not support cross builds
-                                        ;"emacs-exwm" "emacs-desktop-environment"
+                 ;"emacs-exwm" "emacs-desktop-environment"
                 "emacs"))
-          ;; NOTE: %default-xorg-modules depends on system.
-          (parameterize
-              ((%current-target-system target))
-            %default-xorg-modules)))
+          %default-xorg-modules))

 (define %packages-to-cross-build
  ;; Packages that must be cross-buildable from x86_64-linux.
@@ -154,8 +151,7 @@ TARGET."
                                 ;; With a graphical environment:
                                 (if (or (target-x86-32? target)
                                         (target-aarch64? target))
-                                     ;; %system-gui-packages depends on the system.
-                                     (%system-gui-packages target)
+                                     %system-gui-packages
                                     '()))))
                  (fold delete (map platform-system->target (systems))
                        '(;; Disable cross-compilation to self:
@@ -1,167 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This file returns a manifest containing packages which are needed by the
-;;; installer.
-
-(use-modules (guix packages)
-             (gnu packages)
-             ((gnu services xorg) #:select (%default-xorg-modules))
-             (guix profiles)
-             (guix utils)
-             (srfi srfi-1))
-
-(define %desktop-packages
-  (append
-   %default-xorg-modules
-   (map specification->package
-        (list
-         ;; etc-service
-         "net-base"
-         "tzdata"
-         ;; boot-file-system-utilities-service
-         "e2fsprogs"
-         ;; plasma-deskto-sservice-type
-         "plasma"
-         ;; gnome-desktop-service
-         "gnome"
-         ;; xfce-desktop-service
-         "xfce"
-         ;; mate-desktop-service
-         "mate"
-         ;; set-xorg-configuration-service
-         "font-alias"
-         "font-misc-misc"
-         "font-adobe75dpi"
-         "xorg-server"
-         ;; screen-locker-service
-         "slock"
-         "xlockmore"
-         ;; mtp-service
-         "libmtp"
-         ;; sane-service
-         "sane"
-         "sane-backends"
-         ;; mount-setuid-helpers-service
-         "nfs-utils"
-         "ntfs-3g"
-         ;; guix-artwork-service
-         "guix-backgrounds"
-         "guix-icons"
-         ;; vte-integration-service
-         "vte"
-         ;; network-manager-applet-service
-         "network-manager-applet"
-         ;; modem-manager-service
-         "modem-manager"
-         ;; usb-modeswitch-service
-         "usb-modeswitch"
-         "usb-modeswitch-data"
-         ;; avahi-service
-         "avahi"
-         ;; udisks-service
-         "udisks"
-         ;; cups-pk-helper-service
-         "cups-pk-helper"
-         ;; colord-service
-         "colord"
-         ;; geoclue-service
-         "geoclue"
-         ;; polkit-service
-         "polkit"
-         ;; elogind-service
-         "elogind"
-         ;; dbus-service
-         ;; ntp-service
-         "ntp"
-         ;; alsa-service
-         "alsa-plugins"
-         ;; mingetty-service
-         "mingetty"
-         ;; etc-bashrc-d-service
-         "bash-completion"
-         ;; udev-service
-         "eudev"
-         "lvm2"
-         "alsa-utils"
-         "crda"
-         ;; sysctl-service
-         "procps"
-         ;; special-files-service
-         "coreutils"
-         "grub-pc"
-         "less"
-         "mg"
-         "nano"
-         "nvi"
-         "man-db"
-         "info-reader"
-         "kbd"
-         "guile-readline"
-         "guile-colorized"
-         "pciutils"
-         "usbutils"
-         "util-linux-with-udev"
-         "kmod"
-         "isc-dhcp"
-         "iproute2"
-         "wget"
-         "nss-certs"
-         "iw"
-         "wireless-tools"
-         "psmisc"
-         "which"
-         "guile"
-         "findutils"
-         "grep"
-         "sed"
-         "diffutils"
-         "patch"
-         "gawk"
-         "tar"
-         "gzip"
-         "bzip2"
-         "lzip"
-         "xz"
-         "zstd"
-         ;; packages
-         "sway"
-         "foot"
-         "wmenu"
-         "icewm"
-         "openbox"
-         "awesome"
-         "i3-wm"
-         "i3status"
-         "dmenu"
-         "st"
-         "ratpoison"
-         "xterm"
-         "emacs"
-         "emacs-exwm"
-         "emacs-desktop-environment"))))
-
-(define %desktop-manifest
-  (manifest
-   ;; Some of %SYSTEM-PACKAGES are currently unsupported on some
-   ;; systems--e.g., GNOME on 32-bit, due to Rust.  Filter them out.
-   (filter-map (lambda (package)
-                 (and (supported-package? package (%current-system))
-                      (package->manifest-entry package)))
-               (append %desktop-packages))))
-
-%desktop-manifest
@@ -1,165 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Noé Lopez <noelopez@free.fr>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This manifest is a list of packages that user care about (collected via an
-;;; online form).  It corresponds to the “Important packages” of GCD 005.
-
-(specifications->manifest
- (list
-  "0ad"
-  "agda"
-  "alacritty"
-  "ardour"
-  "autoconf"
-  "automake"
-  "blender"
-  "borg"
-  "btrfs-progs"
-  "certbot"
-  "chez-scheme"
-  "clang-toolchain"
-  "cryptsetup"
-  "dillo"
-  "direnv"
-  "docker-cli"
-  "dovecot"
-  "emacs"
-  "emacs-exwm"
-  "emacs-pgtk"
-  "evince"
-  "fcitx5"
-  "file"
-  "fish"
-  "foot"
-  "fzf"
-  "gajim"
-  "gallery-dl"
-  "gcc-toolchain"
-  "getmail6"
-  "gettext"
-  "ghc-xmonad-contrib"
-  "gimp"
-  "git"
-  "gmp"
-  "gnome"
-  "gnupg"
-  "godot"
-  "gpaste"
-  "guile"
-  "guile-json"
-  "hatch"
-  "help2man"
-  "helvum"
-  "hexchat"
-  "hyprland"
-  "icecat"
-  "idris"
-  "imagemagick"
-  "imapfilter"
-  "jami"
-  "k3b"
-  "kakoune"
-  "keepassxc"
-  "krita"
-  "ksoloti-patcher"
-  "libreoffice"
-  "librewolf"
-  "libsecret"
-  "libtool"
-  "libvirt"
-  "llama-cpp"
-  "mariadb"
-  "luanti"
-  "mpc"
-  "mpfr"
-  "mplayer"
-  "mpv"
-  "mullvadbrowser"
-  "neovim"
-  "nginx"
-  "niri"
-  "nix"
-  "node"
-  "notmuch"
-  "obs"
-  "offlineimap3"
-  "opencv"
-  "openmpi"
-  "opensmtpd"
-  "openssh"
-  "openttd"
-  "pandoc"
-  "password-store"
-  "pavucontrol"
-  "php"
-  "picard"
-  "pipewire"
-  "pkg-config"
-  "plasma"
-  "plasma-desktop"
-  "po4a"
-  "podman"
-  "postgresql"
-  "python"
-  "python-lxml"
-  "python-pycryptodome"
-  "qemu"
-  "ranger"
-  "retroarch"
-  ;;"rocm"
-  "rofi"
-  "rspamd"
-  "rsync"
-  "screen"
-  "slurm"
-  "sqlite"
-  "sqlitebrowser"
-  "strace"
-  "strawberry"
-  "syncthing"
-  "taisei"
-  "telegram-desktop"
-  "texlive-babel"
-  "texlive-babel-english"
-  "texlive-babel-french"
-  "texlive-babel-german"
-  "texlive-collection-latex"
-  "texlive-collection-latexrecommended"
-  "texlive-collection-xetex"
-  "texlive-pdfjam"
-  "tmux"
-  "tuba"
-  "ungoogled-chromium"
-  "unison"
-  "unzip"
-  "uv"
-  "viewnior"
-  "virt-manager"
-  "waybar"
-  "wine"
-  "wine64"
-  "wireguard-tools"
-  "xmobar"
-  "xmonad"
-  "xournal"
-  "xournalpp"
-  "xpdf"
-  "yt-dlp"
-  "zig"
-  "zip"
-  "zsh"))
@@ -23,9 +23,7 @@
 ;;; installer.

 (use-modules (guix packages)
-             (gnu packages)
-             ((gnu system) #:select (%base-packages %base-firmware))
-             (guix profiles)
+             ((gnu services xorg) #:select (%default-xorg-modules))
             (guix utils)
             (srfi srfi-1))

@@ -46,14 +44,16 @@ TARGET."
 (define %system-packages
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
-               '("guix" "shepherd" "guile-static-initrd"
-                 "openssh" "tor" "ntp" "gpm" "mingetty"
+               '("guix" "shepherd"
+                 "gnome" "xfce" "mate"
+                 "icewm" "openbox" "awesome"
+                 "i3-wm" "i3status" "dmenu" "st"
+                 "ratpoison" "xterm"
+                 "emacs" "emacs-exwm" "emacs-desktop-environment"
+                 "openssh" "tor" "ntp" "gpm"
                 "connman" "network-manager" "wpa-supplicant" "isc-dhcp" "cups"
-                 "linux-libre" "grub-hybrid"
-                 ;; privileged programs
-                 "shadow" "sudo" "fuse" "inetutils" "util-linux"))
-          %base-firmware
-          %base-packages))
+                 "linux-libre" "grub-hybrid"))
+          %default-xorg-modules))

 (define %bootloader-packages
  ;; The bootloaders offered by the Guix System installer.
@@ -42,69 +42,6 @@
 (channel-news
 (version 0)

- (entry (commit "d3b79beaa806452dceaffb8b211b69dc4c346aba")
-        (title
-         (en "Linux-libre 5.4 no longer supported")
-         (de "Linux-libre 5.4 nicht mehr unterstützt")
-         (pt "Linux-libre 5.4 não é mais suportado"))
-        (body
-         (en "The linux-libre 5.4 kernel series is no longer supported
-upstream and will be removed from GNU Guix soon:
-
-https://www.kernel.org/category/releases.html
-
-This kernel series was first added to Guix in 2019 by Mark Weaver, at version
-5.4.5.  After ~297 updates delivered to Guix users, we have deployed the final
-update, 5.4.302.
-
-The next kernel series removals are scheduled for December 2026, when the Linux
-long-term support team is planning to stop supporting four different kernel
-series: 6.12, 6.6, 5.15, and 5.10.")
-         (de "Die Versionsreihe 5.4 des Linux-libre-Kernels wird von dessen
-Anbieter nicht mehr unterstützt und wird bald aus GNU Guix entfernt werden:
-
-https://www.kernel.org/category/releases.html
-
-Diese Kernel-Reihe wurde ursprünglich 2019 zu Guix hinzugefügt von Mark Weaver
-mit Version 5.4.5.  Nach ~297 Aktualisierungen, die Guix seinen Nutzern
-bereitgestellt hat, haben wir nun die letzte Aktualisierung
-ausgeliefert, 5.4.302.
-
-Der weitere Plan von Linux’ Team für Langzeitunterstützung sieht vor, als
-Nächstes die Unterstützung für vier verschiedene Kernel-Reihen im Dezember 2026
-zu beenden: 6.12, 6.6, 5.15 und 5.10.")
-         (pt "A série 5.4 do kernel linux-libre não é mais suportada pelo
-fornecedor e será removida do GNU Guix em breve:
-
-https://www.kernel.org/category/releases.html
-
-Esta série de kernels foi adicionada inicialmente ao Guix em 2019 por Mark
-Weaver, na versão 5.4.5.  Após ~297 atualizações entregues aos usuários do
-Guix, implantamos a atualização final, 5.4.302.
-
-As próximas remoções de séries do kernel estão agendadas para dezembro de
-2026, quando o time de suporte de longo prazo planeja interromper o suporte a
-quatro séries diferentes do kernel: 6.12, 6.6, 5.15 e 5.10.")))
-
- (entry (commit "14bb0192fde79909999c3880b6b66aa22499eb11")
-        (title
-         (en "Linux-libre 6.16 removed from Guix")
-         (de "Linux-libre 6.16 wurde aus Guix entfernt")
-         (pt "Linux-libre 6.16 removido do Guix")
-         (zh "Linux-libre 6.16 已从 Guix 中移除"))
-        (body
-         (en "The linux-libre 6.16 kernel series has been removed from Guix, as
-it is no longer supported upstream.  The 6.17 kernel series is now the
-default.")
-         (de "Die Versionsreihe 6.16 des Linux-libre-Kernels wurde aus GNU Guix
-entfernt, weil sie von dessen Anbieter nicht mehr unterstützt wird.
-Kernel-Versionsreihe 6.17 ist jetzt vorgegeben.")
-         (pt "A série 6.16 do kernel linux-libre foi removida do Guix, dado
-que não é mais suportada pelo fornecedor.  A série 6.17 é o padrão atual")
-         (zh "由于上游不再支持，GNU Guix 已移除 6.16 系列的 linux-libre 内核。6.17
-内核系列现已成为默认版本。")))
-
-
 (entry (commit "8daae75de3670594dfcb63b6ae6f1603ca6f7971")
        (title
         (en "Fundraising to sustain and strengthen Guix")
@@ -15,7 +15,6 @@ exec $pre_inst_env_maybe guix repl -- "$0" "$@"
 ;;; Copyright © 2025 Jelle Licht <jlicht@fsfe.org>
 ;;; Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
 ;;; Copyright © 2025 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2025 jgart <jgart@dismail.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -480,11 +479,6 @@ of Rebar and Mix build systems and Hex.pm importer."
                      "guix/import/hexpm.scm"
                      "guix/scripts/import/hexpm.scm")))

-(define-team bioinformatics
-  (team 'bioinformatics
-        #:name "Bioinformatics team"
-        #:scope (list "gnu/packages/bioinformatics.scm")))
-
 (define-team bootstrap
  (team 'bootstrap
        #:name "Bootstrap"
@@ -531,7 +525,6 @@ of Rebar and Mix build systems and Hex.pm importer."
              "guix/discovery.scm"
              "guix/docker.scm"
              "guix/download.scm"
-              "guix/elf.scm"
              "guix/ftp-client.scm"
              "guix/gexp.scm"
              "guix/git-authenticate.scm"
@@ -698,15 +691,6 @@ GLib/GIO, GTK, GStreamer and Webkit."
                      "guix/scripts/import/go.scm"
                      "tests/import/go.scm")))

-(define-team hare
-  (team 'hare
-        #:name "Hare"
-        #:scope (list "gnu/packages/hare.scm"
-                      "gnu/packages/hare-apps.scm"
-                      "gnu/packages/hare-xyz.scm"
-                      "guix/build-system/hare.scm"
-                      "guix/build/hare-build-system.scm")))
-
 (define-team haskell
  (team 'haskell
        #:name "Haskell team"
@@ -939,8 +923,7 @@ importer."
        "The current release team.  Members are expected to change with each
 release."
        #:scope (list "NEWS"
-                      "etc/manifests/release-minimal.scm"
-                      "etc/manifests/release-desktop.scm")))
+                      "etc/manifests/release.scm")))

 (define-team reproduciblebuilds
  (team 'reproduciblebuilds
@@ -977,13 +960,14 @@ release."
        #:name "Crypto team"
        #:description
        "Secrets, passwords, cryptography and security related packages."
-        #:scope (list (make-regexp* "^gnu/packages/(.*-|)crypto\\.scm$")
-                      "gnu/packages/gnupg.scm"
-                      "gnu/packages/nettle.scm"
-                      "gnu/packages/password-utils.scm"
-                      "gnu/packages/security-token.scm"
-                      "gnu/packages/ssh.scm"
-                      "gnu/packages/tls.scm")))
+        #:scope (list
+                 "gnu/packages/crypto.scm"
+                 "gnu/packages/gnupg.scm"
+                 "gnu/packages/nettle.scm"
+                 "gnu/packages/password-utils.scm"
+                 "gnu/packages/security-token.scm"
+                 "gnu/packages/ssh.scm"
+                 "gnu/packages/tls.scm")))

 (define-team science
  (team 'science
@@ -1097,6 +1081,11 @@ the \"texlive\" importer."
                       "bavier")
  science)

+(define-member (person "Lars-Dominik Braun"
+                       "lars@6xq.net"
+                       "ldb")
+  python haskell)
+
 (define-member (person "Jonathan Brielmaier"
                       "jonathan.brielmaier@web.de"
                       "jonsger")
@@ -1141,7 +1130,7 @@ the \"texlive\" importer."
 (define-member (person "jgart"
                       "jgart@dismail.de"
                       "jgart")
-  hare lisp mentors)
+  lisp mentors)

 (define-member (person "Guillaume Le Vaillant"
                       "glv@posteo.net"
@@ -1176,7 +1165,7 @@ the \"texlive\" importer."
 (define-member (person "Ricardo Wurmus"
                       "rekado@elephly.net"
                       "rekado")
-  bioinformatics r sugar)
+  r sugar)

 (define-member (person "Christopher Baines"
                       "guix@cbaines.net"
@@ -1276,9 +1265,9 @@ the \"texlive\" importer."
  games)

 (define-member (person "Laurent Gatto"
-                       "lgatto@protonmail.ch"
+                       "laurent.gatto@gmail.com"
                       "lgatto")
-  r bioinformatics)
+  r)

 (define-member (person "Nicolas Goaziou"
                       "guix@nicolasgoaziou.fr"
@@ -1327,7 +1316,8 @@ the \"texlive\" importer."

 (define-member (person "Hilton Chain"
                       "hako@ultrarare.space"
-                       "hako"))
+                       "hako")
+  emacs home localization mozilla rust zig)

 (define-member (person "Noé Lopez"
                       "noelopez@free.fr"
@@ -1364,7 +1354,7 @@ the \"texlive\" importer."
  hurd)

 (define-member (person "Giacomo Leidi"
-                       "therewasa@fishinthecalculator.me"
+                       "goodoldpaul@autistici.org"
                       "fishinthecalculator")
  audio beam)

@@ -1391,7 +1381,7 @@ the \"texlive\" importer."
 (define-member (person "Danny Milosavljevic"
                       "dannym@friendly-machines.com"
                       "daym")
-  bootstrap hpc python rust science)
+  bootstrap hpc rust science)

 (define-member (person "Andy Tai"
                       "atai@atai.org"
@@ -1408,16 +1398,6 @@ the \"texlive\" importer."
                       "delitrem")
  beam)

-(define-member (person "Nguyễn Gia Phong"
-                       "cnx@loang.net"
-                       "cnx")
-  python)
-
-(define-member (person "Lilah Tascheter"
-                       "lilah@lunabee.space"
-                       "tinystar")
-  hare)
-

 (define (find-team name)
  (or (hash-ref %teams (string->symbol name))
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -52,8 +52,7 @@
 tools/versions-stable")))

 (define (fetch-releng-content)
-  "Return a string corresponding to the content of the %GNOME-RELENG-VERSIONS-URI
-file."
+  "Return an input port to the %GNOME-RELENG-VERSIONS-URI file."
  (call-with-port (http-fetch/cached (%gnome-releng-versions-uri))
    get-string-all))

@@ -76,8 +75,8 @@ NL < '\n'")
  '(("adwaita-fonts" . "font-adwaita")))

 (define (parse-releng data)
-  "Return the complete parse tree for DATA, a string representing the content of
-a GNOME releng file."
+  "Return DATA, a string representing the content of a GNOME releng file, and
+return the complete parse tree."
  (let ((tree (peg:tree (match-pattern releng data))))
    (match tree
      (#f (raise-exception (make-releng-parser-error)))
@@ -1,34 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 jgart <jgart@dismail.de>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This file returns a manifest of packages built using the hare-build-system.
-;;; It is used to assist continuous integration of the hare-team branch.
-
-(use-modules (guix packages)
-             (guix profiles)
-             (guix build-system))
-
-(manifest
-  (map package->manifest-entry
-       (fold-packages
-         (lambda (package lst)
-           (if (or (eq? 'hare (build-system-name (package-build-system package)))
-                   (string=? "hare" (package-name package)))
-               (cons package lst)
-             lst))
-         '())))
@@ -1,40 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 jgart <jgart@dismail.de>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This file returns a manifest of packages built using any one of the 
-;;; asdf build systems. It is used to assist continuous integration of 
-;;; the lisp-team branch.
-
-(use-modules (guix packages)
-             (guix profiles)
-             (guix build-system))
-
-(manifest
- (map package->manifest-entry
-      (fold-packages
-       (lambda (package lst)
-         (if (or (eq? 'asdf/sbcl (build-system-name (package-build-system package)))
-                 (eq? 'asdf/ecl (build-system-name (package-build-system package)))
-                 (eq? 'asdf/clasp (build-system-name (package-build-system package)))
-                 (string=? "clasp-cl" (package-name package))
-                 (string=? "ecl" (package-name package))
-                 (string=? "sbcl" (package-name package)))
-             (cons package lst)
-             lst))
-       '())))
-
@@ -1,35 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 jgart <jgart@dismail.de>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This file returns a manifest of packages built using the python-build-system.
-;;; It is used to assist continuous integration of the python-team branch.
-
-(use-modules (guix packages)
-             (guix profiles)
-             (guix build-system))
-
-(manifest
-  (map package->manifest-entry
-       (fold-packages
-         (lambda (package lst)
-           (if (or (eq? 'python (build-system-name (package-build-system package)))
-                   (eq? 'pyproject (build-system-name (package-build-system package)))
-                   (string=? "python" (package-name package)))
-               (cons package lst)
-             lst))
-         '())))
@@ -1,412 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; This manifest returns build artfacts for all supported systems.  This can be
-;;; controlled by SUPPORTED_SYSTEMS environment variable.  For the list of
-;;; artifacts produced, see artifacts-for-system and the `<thing>-for-system?`
-;;; procedures.  NOTE: the --system argument does not change the system for which
-;;; the resulting package is built. They return different definitions of the
-;;; images. To change the system, pass different SUPPORTED_SYSTEMS.
-
-(use-modules (gnu compression)
-             (gnu image)
-             (gnu packages graphviz)
-             (gnu packages imagemagick)
-             (gnu packages package-management)
-             (gnu packages perl)
-             (gnu services)
-             (gnu system image)
-             (gnu system install)
-             (gnu system)
-             (guix build-system gnu)
-             (guix build-system trivial)
-             (guix channels)
-             (guix gexp)
-             (guix git)
-             (guix grafts)
-             (guix memoization)
-             (guix monads)
-             (guix packages)
-             (guix profiles)
-             (guix records)
-             (guix scripts pack)
-             (guix store)
-             (guix ui)
-             (guix utils)
-             (ice-9 format)
-             (ice-9 match)
-             (srfi srfi-9)
-             (srfi srfi-26)
-             (srfi srfi-35))
-
-;; For easier testing, use (snapshot) guix package from (gnu packages
-;; package-management). Otherwise, the package is updated to current commit and
-;; might not be substitutable, leading to longer build times.
-(define %use-snapshot-package?
-  (string=? (or (getenv "GUIX_USE_SNAPSHOT_PACKAGE") "no") "yes"))
-
-(define (%guix-version)
-  ;; NOTE: while package-version guix is not correct in general,
-  ;; it is correct for the release itself. At that time, the
-  ;; guix package is updated to vX.Y.Z and it's the version
-  ;; we want to use.
-  (package-version guix))
-
-(define (%vm-image-path)
-  (search-path %load-path "gnu/system/examples/vm-image.tmpl"))
-
-(define (%vm-image-efi-path)
-  (search-path %load-path "gnu/system/examples/vm-image-efi.tmpl"))
-
-;; monadic record and gexp-compiler
-;; taken from Inria
-;; https://gitlab.inria.fr/numpex-pc5/wp3/guix-images/-/blob/17bf4585abc2d637faa5d339436e778b7c9fb1ce/modules/guix-hpc/packs.scm
-
-;; XXX: The <monadic> hack below will hopefully become unnecessary once the
-;; (guix scripts pack) interface switches to declarative style--i.e.,
-;; file-like objects.
-
-(define-record-type <monadic>
-  (monadic->declarative mvalue)
-  monadic?
-  (mvalue monadic-value))
-
-(define-gexp-compiler (monadic-compiler (monadic <monadic>) system target)
-  (monadic-value monadic))
-
-;; The tarball should be the same for every system.
-;; Still, we need to decide what system to build it
-;; for, so use the one that CI has most resources for.
-(define (source-tarball-for-system? system)
-  (member system
-        '("x86_64-linux")))
-
-(define (iso-for-system? system)
-  (member system
-        '("x86_64-linux" "i686-linux" "aarch64-linux")))
-
-(define (qcow2-for-system? system)
-  (member system
-        '("x86_64-linux" "aarch64-linux")))
-
-(define* (qcow2-gpt-for-system? system)
-  (string=? system "aarch64-linux"))
-
-(define (copy-/etc/config.scm config)
-  "Copy the configuration.scm of the operating system to /etc/config.scm, for
-user's convenience. The file has to be writable, not a link to the store, so
-etc-service-type can't be used here. CONFIG is a pair of strings, (FROM . TO).
-The config will be copied from FROM to TO."
-  (match config
-    ((from . to)
-     (with-imported-modules '((guix build utils))
-       #~(begin
-           (use-modules (guix build utils))
-           (when (not (file-exists? #$to))
-             (copy-file #$from #$to)
-             (make-file-writable #$to)))))
-    (_ (raise
-        (formatted-message-string
-         (G_ "unexpected config parameter, should be pair of strings: ~a"
-             config))))))
-
-(define copy-/etc/config.scm-service-type
-  (service-type (name 'copy-/etc/config.scm)
-                (description
-                 "Copy the system configuration file to /etc/config.scm.")
-                (extensions (list (service-extension activation-service-type
-                                                     copy-/etc/config.scm)))
-                (default-value (cons "/run/current-system/configuration.scm"
-                                     "/etc/config.scm"))))
-
-(define (operating-system-with-/etc/config.scm os)
-  "Copy the system configuration file to writable /etc/config.scm on first boot."
-  (operating-system
-    (inherit os)
-    (services (cons (service copy-/etc/config.scm-service-type)
-                    (operating-system-user-services os)))))
-
-(define (simple-provenance-entry config-file)
-  "Return system entries describing the operating system config, provided
-through CONFIG-FILE."
-  (mbegin %store-monad
-    (return `(("configuration.scm"
-               ,(local-file (assume-valid-file-name config-file)
-                            "configuration.scm"))))))
-
-;; This is mostly taken from provenance-service-type from (gnu services),
-;; but it provides only configuration.scm, not channels.scm. This is
-;; to get the same derivations for both Cuirass and local builds.
-;; In the future, provenance-service-type could be adapted to support
-;; this use case as well.
-(define simple-provenance-service-type
-  (service-type (name 'provenance)
-                (extensions
-                 (list (service-extension system-service-type
-                                          simple-provenance-entry)))
-                (default-value #f)                ;the OS config file
-                (description
-                 "Store configuration.scm of the system in the system
-itself.")))
-
-(define* (operating-system-with-simple-provenance
-          os
-          #:optional
-          (config-file
-           (operating-system-configuration-file
-            os)))
-  "Return a variant of OS that stores its CONFIG-FILE.  This is similar to
-`operating-system-with-provenance`, but it does copy only the
-configuration.scm."
-  (operating-system
-    (inherit os)
-    (services (cons (service simple-provenance-service-type config-file)
-                    (operating-system-user-services os)))))
-
-(define (guix-package-commit guix)
-  ;; Extract the commit of the GUIX package.
-  (match (package-source guix)
-    ((? channel? source)
-     (channel-commit source))
-    (_
-     (apply (lambda* (#:key commit #:allow-other-keys) commit)
-            (package-arguments guix)))))
-
-;; NOTE: Normally, we would use (current-guix), along with url
-;; overriden to the upstream repository to not leak our local checkout.
-;; But currently, the (current-guix) derivation has to be computed through
-;; QEMU for systems other than your host system. This takes a lot of time,
-;; it takes at least half an hour to get the derivations.
-(define (guix-package/with-commit guix commit)
-  "Use the guix from (gnu packages package-management),
-but override its commit to the specified version. Make sure
-to also override the channel commit to have the correct
-provenance."
-  (let ((scm-version (car (string-split (package-version guix) #\-))))
-    (package
-      (inherit guix)
-      (version (string-append scm-version "." (string-take commit 7)))
-      (source (git-checkout
-                (url (channel-url %default-guix-channel))
-                (commit commit)))
-      (arguments
-       (substitute-keyword-arguments (package-arguments guix)
-         ((#:configure-flags flags '())
-          #~(cons*
-             (string-append "--with-channel-commit=" #$commit)
-             (filter (lambda (flag)
-                       (not (string-prefix? "--with-channel-commit=" flag)))
-                     #$flags))))))))
-
-(define guix-for-images
-  (mlambda (system)
-    (cond
-     ;; For testing purposes, use the guix package directly.
-     (%use-snapshot-package? guix)
-     ;; Normally, update the guix package to current commit.
-     (else
-      (guix-package/with-commit guix (guix-package-commit (current-guix)))))))
-
-(define %binary-tarball-compression "xz")
-
-;; Like guix pack -C xz -s --localstatedir --profile-name=current-guix guix
-(define* (binary-tarball-for-system system #:key (extra-packages '()))
-  (let* ((base-name (string-append "guix-binary-" (%guix-version) "." system))
-         (manifest (packages->manifest (cons* guix extra-packages)))
-         (profile (profile (content manifest)))
-         (inputs `(("profile" ,profile)))
-         (compression %binary-tarball-compression))
-    (manifest-entry
-      (name (string-append base-name ".tar." compression))
-      (version (%guix-version))
-      (item (monadic->declarative
-             (self-contained-tarball
-              base-name profile
-              #:profile-name "current-guix"
-              #:compressor (lookup-compressor compression)
-              #:localstatedir? #t))))))
-
-;; Like guix system image -t iso9660 \
-;; --label="GUIX_$${system}_$(VERSION)" gnu/system/install.scm
-(define* (iso-for-system system)
-  (let* ((name (string-append
-                "guix-system-install-" (%guix-version) "." system ".iso"))
-         (base-os (make-installation-os
-                   #:grub-displayed-version (%guix-version)
-                   #:efi-only? (string=? system "aarch64-linux")))
-         (base-image (os->image base-os #:type iso-image-type))
-         (label (string-append "GUIX_" system "_"
-                               (if (> (string-length (%guix-version)) 7)
-                                   (string-take (%guix-version) 7)
-                                   (%guix-version)))))
-    (manifest-entry
-     (name name)
-     (version (%guix-version))
-     (item (system-image
-            (image-with-label
-             (image
-               (inherit base-image)
-               (name (string->symbol name)))
-             label))))))
-
-;; Like guix system image -t qcow2 gnu/system/examples/vm-image.tmpl
-(define* (qcow2-for-system system)
-  (let* ((name (string-append
-                "guix-system-vm-image-" (%guix-version) "." system ".qcow2"))
-         (base-os-path
-          (if (qcow2-gpt-for-system? system)
-              (%vm-image-efi-path)
-              (%vm-image-path)))
-         (target-image-type
-          (if (qcow2-gpt-for-system? system)
-              qcow2-gpt-image-type
-              qcow2-image-type))
-         (base-os
-          (operating-system-with-/etc/config.scm
-           (operating-system-with-simple-provenance
-            (load base-os-path) base-os-path)))
-         (base-image (os->image base-os #:type target-image-type)))
-    (manifest-entry
-     (name name)
-     (version (%guix-version))
-     (item (system-image
-             (image
-               (inherit base-image)
-               (volatile-root? #f)
-               (name (string->symbol name))))))))
-
-(define* (guix-source-tarball)
-  (let ((guix (package
-                (inherit guix)
-                (native-inputs
-                 (modify-inputs (package-native-inputs guix)
-                   ;; graphviz-minimal -> graphviz
-                   (replace "graphviz" graphviz)
-                   (append imagemagick)
-                   (append perl))))))
-    (manifest-entry
-      (name (string-append "guix-" (%guix-version) ".tar.gz"))
-      (version (package-version guix))
-      (item (dist-package
-             guix
-             ;; Guix is built from git source, not from tarball.
-             ;; So it's fine to use its source directly.
-             (package-source guix))))))
-
-(define* (manifest-entry-with-parameters system entry
-                                         #:key
-                                         (guix-for-images-proc guix-for-images))
-  (manifest-entry
-    (inherit entry)
-    (item
-     (with-parameters
-         ((%current-system system)
-          (%current-target-system #f)
-          (current-guix-package (guix-for-images-proc system)))
-       (manifest-entry-item entry)))))
-
-(define* (manifest-with-parameters system manifest
-                                   #:key
-                                   (guix-for-images-proc guix-for-images))
-  "Returns entries in the manifest accompanied with %current-system,
-%current-target-sytem and current-guix-package parameters."
-  (make-manifest
-   (map (cut manifest-entry-with-parameters system <>
-             #:guix-for-images-proc guix-for-images-proc)
-        (manifest-entries manifest))))
-
-(define (artifacts-for-system/nonparameterized system)
-  "Get all artifacts for given system.  This will always include the
-guix-binary tarball and optionally iso and/or qcow2 images."
-  (manifest
-   (append
-    (list
-     (binary-tarball-for-system system))
-    ;; TODO: After source tarball generation is ready, uncomment.
-    ;; (if (source-tarball-for-system? system)
-    ;;     (list (guix-source-tarball))
-    ;;     '())
-    (if (iso-for-system? system)
-        (list (iso-for-system system))
-        '())
-    (if (qcow2-for-system? system)
-        (list (qcow2-for-system system))
-        '()))))
-
-(define* (artifacts-for-system system
-                               #:key
-                               (guix-for-images-proc guix-for-images))
-  "Collects all artifacts for a system.  Gives them the proper %current-system
-and %current-target-system parameters, so the --system passed on CLI is
-irrelevant."
-  ;; NOTE: parameterizing current system, because the tarball seems to somehow
-  ;; depend on it early on. I haven't investigated it, but seems like a bug. Could
-  ;; it be the gexp->derivation + monadic->declarative, not passing down the
-  ;; system?  Symptom: guix build --system=x86_64 -m artifacts-manifest.scm and
-  ;; guix build --system=i686-linux -m artifacts-manifest.scm gives out different
-  ;; results without the parameterization.
-  (parameterize
-      ((%current-system system)
-       (%current-target-system #f)
-       (current-guix-package (guix-for-images-proc system)))
-    (manifest-with-parameters
-     system
-     (artifacts-for-system/nonparameterized system)
-     #:guix-for-images-proc guix-for-images-proc)))
-
-(define (manifest->union manifest)
-  "Makes a union that will be a folder with all the entries symlinked.  This
-is different from a profile as it expects the entries are just simple files
-and symlinks them by their manifest-entry-name."
-  (let ((entries (manifest-entries manifest)))
-    (computed-file
-     "artifacts-union"
-     (with-imported-modules '((guix build union)
-                              (guix build utils))
-       #~(begin
-           (use-modules (guix build utils))
-
-           (mkdir-p #$output)
-
-           (for-each
-            (lambda* (entry)
-              (symlink (cdr entry)
-                       (string-append #$output "/" (car entry))))
-            (list #$@(map (lambda (entry)
-                            #~(cons
-                               #$(manifest-entry-name entry)
-                               #$(manifest-entry-item entry)))
-                          entries))))))))
-
-(define %supported-systems
-  (or (and
-       (getenv "SUPPORTED_SYSTEMS")
-       (string-split (getenv "SUPPORTED_SYSTEMS") #\ ))
-      '("x86_64-linux" "i686-linux"
-        "armhf-linux" "aarch64-linux"
-        "powerpc64le-linux" "riscv64-linux")))
-
-(define supported-systems-union-manifest
-  (concatenate-manifests
-   (map artifacts-for-system
-        %supported-systems)))
-
-(when %use-snapshot-package?
-  (warning (G_ "building images using the 'guix' package (snapshot)~%")))
-(info (G_ "producing artifacts for the following systems: ~a~%")
-          %supported-systems)
-supported-systems-union-manifest
@@ -1,26 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-;;; Produce a single directory with all the artifacts inside of it, with proper
-;;; names. They can then be easily copied to releasedir in Makefile. The files are
-;;; symlinked to save space, but they should be copied out of the store as regular
-;;; files.
-
-(load "artifacts-manifest.scm")
-
-(manifest->union
- supported-systems-union-manifest)
@@ -1,94 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-(use-modules (guix packages)
-             (guix gexp)
-             (gnu services)
-             (gnu tests install)
-             (ice-9 match)
-             (guix utils)
-             (srfi srfi-26)
-             (srfi srfi-1))
-
-;; TODO find a better way to check for thunked fields
-(define* (thunked-field? field obj)
-  (and
-   (procedure? obj)
-   (eq?
-    (car (procedure-minimum-arity obj))
-    1)
-   ; Uhhh
-   (string-suffix? "(x)>"
-                   (format #f "~a" obj))))
-
-;; Prints names of all packages, prepending the service they
-;; come from.
-(define* (print-all-packages obj #:optional (pred package?))
-  (match obj
-    ((? pred)
-     (format #t "\"~a\"~%" (package-name obj))
-     (list obj))
-    ((? gexp?)
-     (list))
-    ((a . b)
-     (append (print-all-packages a pred)
-           (print-all-packages b pred)))
-    ((_ ...)
-     (apply append
-            (map (cut print-all-packages <> pred)
-                 obj)))
-    (#(_ ...)
-     (print-all-packages (vector->list obj) proc))
-    ((or (? service-type?)
-         (? origin?))
-     (list))
-    ((? record?)
-      (let* ((record-type (record-type-descriptor obj))
-             (record-fields (record-type-fields record-type)))
-        (when (service? obj)
-          (format #t ";; ~a-service~%" (service-type-name (service-kind obj))))
-        (apply append
-               (map (lambda (field)
-                      (let* ((accessor (record-accessor record-type field))
-                             (field-obj (accessor obj)))
-                        (if (thunked-field? field field-obj)
-                            (print-all-packages (field-obj obj) pred)
-                            (print-all-packages field-obj pred))))
-                    record-fields))))
-    ((? parameter?)
-     (list))
-    (_
-     (list))))
-
-(define full-installer-os
-  ((@@ (gnu tests install) installation-target-desktop-os-for-gui-tests)))
-
-(define minimal-installer-os
-  ((@@ (gnu tests install) installation-target-os-for-gui-tests)))
-
-(display "Full os packages:")
-(print-all-packages full-installer-os)
-(display "Minimal os packages:")
-(print-all-packages minimal-installer-os)
-
-;; Note that the printed packages will contain duplicates.
-;; I recommend to first put packages out of the profile service
-;; and out of packages field (they will be above service packages)
-;; at the bottom of the list and then filtering only unique lines, ie.
-;; with `awk '!a[$0]++'`. And lastly removing services that no longer
-;; have packages and also the packages that are already in minimal manifest
-;; (in case of desktop manifest)
@@ -65,7 +65,6 @@
            grub-efi-bootloader
            grub-efi-removable-bootloader
            grub-efi32-bootloader
-            grub-efi32-removable-bootloader
            grub-efi-netboot-bootloader
            grub-efi-netboot-removable-bootloader
            grub-mkrescue-bootloader
@@ -845,13 +844,6 @@ symlink to the store is not needed in this case."
   (name 'grub-efi32)
   (package grub-efi32)))

-(define grub-efi32-removable-bootloader
-  (bootloader
-   (inherit grub-efi32-bootloader)
-   (name 'grub-efi32-removable-bootloader)
-   (installer (make-grub-efi-installer #:removable? #t
-                                       #:efi32? #t))))
-
 (define (make-grub-efi-netboot-bootloader name subdir)
  (bootloader
   (name name)
@@ -359,7 +359,7 @@ to it atomically and set the appropriate permissions."
  (left    unused-subid-range-left   ;previous unused subuid range or #f
           (default #f))
  (min     unused-subid-range-min    ;lower bound of this unused subuid range
-           (default 0))
+           (default %subordinate-id-min))
  (max     unused-subid-range-max    ;upper bound
           (default %subordinate-id-max))
  (right   unused-subid-range-right  ;next unused subuid range or #f
@@ -555,10 +555,7 @@ will be marked as used in it."
  (define actual-range
    (subid-range
     (inherit range)
-     ;; New IDs are only allocated between %subordinate-id-min and
-     ;; %subordinate-id-max.
-     (start
-      (max allocation-start %subordinate-id-min))))
+     (start allocation-start)))

  (if (within-interval? allocation actual-range)
      (values
@@ -606,6 +603,13 @@ is visited to find the best unused range that can hold RANGE."
  (define range-end
    (subid-range-end range))

+  (unless (and (subordinate-id? range-start)
+               (subordinate-id? range-end))
+    (raise
+     (condition
+      (&invalid-subid-range-error
+       (range range)))))
+
  (define less?
    (< range-end allocation-start))
  (define more?
@@ -798,23 +802,12 @@ new UIDs."
 (define* (allocate-subids ranges #:optional (current-ranges '()))
  "Return a list of subids entries for RANGES, a list of <subid-range>.  IDs
 found in CURRENT-RANGES, a list of subid entries, are reused."
-  ;; Ranges from disk must always have a start.
  (let ((generic (any (compose not subid-range-has-start?) current-ranges)))
    (when generic
      (raise
       (condition
        (&specific-subid-range-expected-error
         (range generic))))))
-  (for-each
-   (lambda (range)
-     ;; New ranges must always be included in the current supported set.
-     (unless (or (not (subid-range-has-start? range))
-                 (and (subordinate-id? (subid-range-start range))
-                      (subordinate-id? (subid-range-end range))))
-       (raise
-        (condition (&invalid-subid-range-error (range range))))))
-   ranges)
-
  (define sorted-ranges
    (stable-sort ranges
                 subid-range-less))
@@ -11,7 +11,6 @@
 ;;; Copyright © 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
-;;; Copyright © 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -279,17 +278,6 @@ they already exist."

  (for-each ensure-user-home users))

-(define* (canonicalize-path* file)
-  "A safe version of `canonicalize-path' that warns rather than raises on errors.
-`canonicalize-path' uses `realpath(2)', which can return various errors like
-EINVAL, ELOOP, etc."
-  (or (false-if-exception (canonicalize-path file))
-      (begin
-        (format (current-warning-port)
-                "warning: could not canonicalize file `~a'; using as-is~%"
-                file)
-        file)))
-
 (define (activate-etc etc)
  "Install ETC, a directory in the store, as the source of static files for
 /etc."
@@ -312,28 +300,26 @@ EINVAL, ELOOP, etc."
  (rm-f "/etc/ssl")
  (symlink "/run/current-system/profile/etc/ssl" "/etc/ssl")

+  (rm-f "/etc/static")
+  (symlink etc "/etc/static")
  (for-each (lambda (file)
              (let ((target (string-append "/etc/" file))
-                    ;; Canonicalize the file names to resolve any symlinks, to
-                    ;; ensure /etc/localtime points to a timezone data file in
-                    ;; the store containing the timezone name.  This is done
-                    ;; for compatibility with software expecting this systemd
-                    ;; convention to be followed.
-                    (source (canonicalize-path* (string-append etc "/" file))))
+                    (source (string-append "/etc/static/" file)))
                (rm-f target)
-                (cond ((string=? (basename target) "sudoers")
-                       (begin
-                         ;; /etc/sudoers must be a regular file.
-                         (copy-file source target)
-                         ;; XXX: dirty hack to meet sudo's expectations
-                         (chmod target #o440)))
-                      ((string=? (basename target) "hosts")
-                       ;; /etc/hosts must be a regular file, as some software
-                       ;; like vpn-slice expect to be able to write to it.
-                       (copy-file source target))
-                      (else             ;usual case
-                       (symlink source target)))))
+
+                ;; Things such as /etc/sudoers must be regular files, not
+                ;; symlinks; furthermore, they could be modified behind our
+                ;; back---e.g., with 'visudo'.  Thus, make a copy instead of
+                ;; symlinking them.
+                (if (file-is-directory? source)
+                    (symlink source target)
+                    (copy-file source target))
+
+                ;; XXX: Dirty hack to meet sudo's expectations.
+                (when (string=? (basename target) "sudoers")
+                  (chmod target #o440))))
            (scandir etc (negate dot-or-dot-dot?)
+
                     ;; The default is 'string-locale<?', but we don't have
                     ;; it when run from the initrd's statically-linked
                     ;; Guile.
@@ -91,7 +91,7 @@ each retry."
              ((sleep*) delay)            ;else wait and retry
              (loop (+ 1 attempts)))
            (error "maximum number of retry attempts reached"
-                   (quote (begin body ...)) args))))))
+                   (quote body ...) args))))))


 ;;;
@@ -1,12 +1,12 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013-2020, 2025 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016 Christine Lemmer-Webber <cwebber@dustycloud.org>
 ;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2020, 2022 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2022 Pavel Shlyak <p.shlyak@pantherx.org>
-;;; Copyright © 2022, 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
+;;; Copyright © 2022 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2023 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -66,14 +66,12 @@
  (number->string
   (inexact->exact (ceiling (/ size 1024)))))

-(define* (estimate-partition-size root #:optional (margin .25))
+(define (estimate-partition-size root)
  "Given the ROOT directory, evaluate and return its size.  As this doesn't
-take the partition metadata size into account, take a MARGIN.  As this in
+take the partition metadata size into account, take a 25% margin.  As this in
 turn doesn't take any constant overhead into account, force a 1-MiB minimum."
  (max (ash 1 20)
-       ;; without inexact->exact, 'guess can result in an error like that:
-       ;; "Wrong type (expecting exact integer): 7179941140.0".
-       (inexact->exact (round (* (+ 1. margin) (file-size root))))))
+       (* 1.25 (file-size root))))

 (define* (make-btrfs-image partition target root)
  "Handle the creation of BTRFS partition images. See
@@ -118,43 +116,7 @@ turn doesn't take any constant overhead into account, force a 1-MiB minimum."
                      (size-in-kib
                       (if (eq? size 'guess)
                           (estimate-partition-size root)
-                           size)))))
-
-    ;; 'mke2fs' does not create directory indexes by default, meaning that
-    ;; directories have a limit of 65,000 sub-directories, which can be
-    ;; problematic for the store.  To avoid that, run 'e2fsck -D' to create
-    ;; those directory indexes.  See
-    ;; <https://github.com/tytso/e2fsprogs/issues/257>.
-    (invoke "e2fsck" "-fDy" target)))
-
-(define* (make-f2fs-image partition target root
-                          #:key
-                          (owner-uid 0)
-                          (owner-gid 0))
-  "Handle the creation of F2FS partition images.  See 'make-partition-image'."
-  (let ((size (partition-size partition))
-        (label (partition-label partition))
-        (uuid (partition-uuid partition))
-        (fs-options (partition-file-system-options partition)))
-    ;; The mkfs.f2fs utility can't create files, so we need to create one
-    ;; before running it.
-    (call-with-output-file target (const #t))
-    (truncate-file
-     target
-     (if (eq? size 'guess)
-         ;; The F2FS filesystem has more overhead than other filesystems like
-         ;; BTRFS and ext4.
-         (estimate-partition-size root .50)
-         size))
-    (apply invoke "fakeroot" "mkfs.f2fs"
-           "-l" label
-           "-R" (format #f "~a:~a" owner-uid owner-gid)
-           `(,@(if uuid
-                   `("-U" ,(uuid->string uuid))
-                   '())
-             ,@fs-options
-             ,target))
-    (invoke "fakeroot" "sload.f2fs" "-P" "-f" root target)))
+                           size)))))))

 (define* (make-vfat-image partition target root fs-bits)
  "Handle the creation of VFAT partition images.  See 'make-partition-image'."
@@ -182,23 +144,6 @@ turn doesn't take any constant overhead into account, force a 1-MiB minimum."
                          (string-append "::" file))))
              (scandir root))))

-(define* (make-swap-image partition target)
-  "Make a swap partition of a certain size."
-  (let ((size (partition-size partition))
-        (label (partition-label partition))
-        (uuid (partition-uuid partition))
-        (fs-options (partition-file-system-options partition)))
-    (apply invoke "fakeroot" "mkswap"
-           "--pagesize" "4096"
-           "--endianness" "little"
-           "-L" label
-           "--file" target
-           "--size" (number->string size)
-           `(,@(if uuid
-                   `("-U" ,(uuid->string uuid))
-                   '())
-             ,@fs-options))))
-
 (define* (make-unformatted-image partition target)
  "Make an unformatted partition of a certain size."
  (let ((size (partition-size partition)))
@@ -217,14 +162,10 @@ ROOT directory to populate the image."
      (make-btrfs-image partition target root))
     ((string-prefix? "ext" type)
      (make-ext-image partition target root))
-     ((string=? "f2fs" type)
-      (make-f2fs-image partition target root))
     ((or (string=? type "vfat") (string=? type "fat16"))
      (make-vfat-image partition target root 16))
     ((string=? type "fat32")
      (make-vfat-image partition target root 32))
-     ((string=? "swap" type)
-      (make-swap-image partition target))
     ((string=? type "unformatted")
      (make-unformatted-image partition target))
     (else
@@ -428,11 +369,7 @@ GRUB configuration and OS-DRV as the stuff in it."
                   "-not" "-wholename" "/System/*"
                   "-not" "-name" "unicode.pf2"
                   "-not" "-name" "bzImage"
-                   "-not" "-name" "zImage"
-                   "-not" "-name" "Image"
-                   "-not" "-name" "vmlinuz"
-                   "-not" "-name" "*.gz"   ; initrd
-                   "-not" "-name" "*.zst"  ; all man pages
+                   "-not" "-name" "*.gz"   ; initrd & all man pages
                   "-not" "-name" "*.png"  ; includes grub-image.png
                   "-exec" "set_filter" "--zisofs"
                   "--")
@@ -21,7 +21,6 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu build linux-modules)
-  #:use-module (guix elf)
  #:use-module (guix glob)
  #:use-module (guix build syscalls)
  #:use-module ((guix build utils) #:select (find-files invoke))
@@ -39,6 +38,7 @@
  #:use-module (ice-9 match)
  #:use-module (ice-9 rdelim)
  #:autoload   (ice-9 pretty-print) (pretty-print)
+  #:use-module (system vm elf)
  #:export (dot-ko
            ensure-dot-ko
            module-formal-name
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2025 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -3,7 +3,6 @@
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2023 conses <contact@conses.eu>
 ;;; Copyright © 2023 Janneke Nieuwenhuizen <janneke@gnu.org>
-;;; Copyright © 2025 dan <i@dan.games>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -26,7 +25,7 @@
  #:use-module (gnu services configuration)
  #:use-module (gnu services xorg)
  #:autoload   (gnu packages glib)    (dbus)
-  #:autoload   (gnu packages xdisorg) (darkman redshift unclutter)
+  #:autoload   (gnu packages xdisorg) (redshift unclutter)
  #:autoload   (gnu packages xorg) (setxkbmap xmodmap)
  #:use-module (guix records)
  #:use-module (guix gexp)
@@ -47,11 +46,7 @@
            home-xmodmap-configuration
            home-xmodmap-service-type

-            home-startx-command-service-type
-
-            home-darkman-configuration
-            home-darkman-configuration?
-            home-darkman-service-type))
+            home-startx-command-service-type))


 ;;;
@@ -452,93 +447,3 @@ buttons under the Xorg display server via user-defined expressions.")))

 (define-service-type-mapping
  startx-command-service-type => home-startx-command-service-type)
-
-
-;;;
-;;; Darkman.
-;;;
-
-(define-maybe number)
-
-(define (serialize-number field value)
-  (string-append (match field
-                   ('latitude "lat")
-                   ('longitude "lng")
-                   (_ (symbol->string field)))
-                 ": " (number->string value) "\n"))
-
-(define (serialize-boolean field value)
-  (string-append (match field
-                   ('use-geoclue "usegeoclue")
-                   ('dbus-server "dbusserver")
-                   (_ "portal"))
-                 ": " (if value "true" "false") "\n"))
-
-(define-configuration home-darkman-configuration
-  (darkman
-   (file-like darkman)
-   "The @code{darkman} package to use.")
-
-  (latitude
-   maybe-number
-   "Latitude, used at startup or when @code{use-geoclue} is @code{#f}.  More than
-one decimal point is generally not needed.")
-
-  (longitude
-   maybe-number
-   "Longitude, used at startup or when @code{use-geoclue} is @code{#f}.  More than
-one decimal point is generally not needed.")
-
-  (use-geoclue
-   (boolean #f)
-   "Whether to use a local geoclue instance to determine the current location.
-Setting this to false without explicitly setting latitude and longtitude
-disables automatic transitions entirely.")
-
-  (dbus-server
-   (boolean #t)
-   "Whether to expose the current mode via darkman's own D-Bus API.")
-
-  (portal
-   (boolean #t)
-   "Whether to expose the current mode via the XDG settings portal D-Bus API."))
-
-(define (serialize-home-darkman-configuration config)
-  (mixed-text-file
-   "config.yaml"
-   (serialize-configuration config home-darkman-configuration-fields)))
-
-(define (home-darkman-configuration-files config)
-  `(("darkman/config.yaml" ,(serialize-home-darkman-configuration config))))
-
-(define (home-darkman-profile-service config)
-  (list (home-darkman-configuration-darkman config)))
-
-(define (home-darkman-shepherd-service config)
-  (list
-   (shepherd-service
-     (provision '(darkman))
-     (requirement '(dbus))
-     (modules '((shepherd support)))      ;for '%user-log-dir'
-     (start #~(make-forkexec-constructor
-               (list #$(file-append (home-darkman-configuration-darkman config)
-                                    "/bin/darkman")
-                     "run")
-               #:log-file
-               (string-append %user-log-dir "/darkman.log")))
-     (stop #~(make-kill-destructor)))))
-
-(define home-darkman-service-type
-  (service-type
-    (name 'home-darkman)
-    (extensions
-     (list (service-extension home-shepherd-service-type
-                              home-darkman-shepherd-service)
-           (service-extension home-xdg-configuration-files-service-type
-                              home-darkman-configuration-files)
-           (service-extension home-profile-service-type
-                              home-darkman-profile-service)))
-    (default-value (home-darkman-configuration))
-    (description "Run the @code{darkman} daemon, which will invoke scripts in
-$XDG_DATA_DIRS/dark-mode.d/ when sundown, and invoke scripts in
-$XDG_DATA_DIRS/light-mode.d/ when sunrise.")))
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2024 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -1,7 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2021 Andrew Tropin <andrew@trop.in>
 ;;; Copyright © 2021 Xinglu Chen <public@yoctocell.xyz>
-;;; Copyright © 2023 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2023 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2023 Andrew Patterson <andrewpatt7@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -1,104 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify
-;;; it under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation, either version 3 of the License, or
-;;; (at your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful,
-;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-
-(define-module (gnu home services gnome)
-  #:use-module (guix gexp)
-  #:use-module (guix packages)
-  #:use-module (gnu packages admin)
-  #:use-module (gnu packages gnome)
-  #:use-module (gnu system accounts)
-  #:use-module (gnu services configuration)
-  #:use-module (gnu home services)
-  #:use-module (gnu home services shepherd)
-  #:export (gcr-ssh-agent-configuration
-            gcr-ssh-agent-configuration?
-            gcr-ssh-agent-configuration-fields
-            gcr-ssh-agent-configuration-package
-            gcr-ssh-agent-configuration-log-file
-
-            home-gcr-ssh-agent-log-file
-            home-gcr-ssh-agent-shepherd-service
-
-            home-gcr-ssh-agent-service-type))
-
-(define-maybe/no-serialization string)
-
-(define-configuration/no-serialization gcr-ssh-agent-configuration
-  (package
-   (package gcr)
-   "The @code{gcr} package to use.")
-  (log-file
-   (maybe-string)
-   "Where the service will write its logs.  If unset, it defaults to
-@file{$HOME/.local/state/shepherd/gcr-ssh-agent.log}."))
-
-(define (home-gcr-ssh-agent-log-file config)
-  (define maybe-log-file (gcr-ssh-agent-configuration-log-file config))
-  (if (maybe-value-set? maybe-log-file)
-      maybe-log-file
-      #~(string-append %user-log-dir "/gcr-ssh-agent.log")))
-
-(define (home-gcr-ssh-agent-shepherd-service config)
-  (let ((package
-          (gcr-ssh-agent-configuration-package config))
-        (log-file (home-gcr-ssh-agent-log-file config)))
-    (list
-     (shepherd-service
-       (provision '(gcr-ssh-agent ssh-agent))
-       (modules
-        ;;for '%user-log-dir' and '%user-runtime-dir'
-        '((shepherd support)))
-       (start
-        #~(let* ((socket-directory
-                  (string-append %user-runtime-dir
-                                 "/gcr"))
-                 (socket-endpoint
-                  (endpoint
-                   (make-socket-address
-                    AF_UNIX
-                    (string-append socket-directory "/ssh"))
-                   #:name "ssh"
-                   #:socket-directory-permissions #o700)))
-            (make-systemd-constructor
-             (list #$(file-append package
-                                  "/libexec/gcr-ssh-agent")
-                   "-d" socket-directory)
-             (list socket-endpoint)
-             ;; With #:lazy-start #t the first ssh connection
-             ;; hangs indefinitely.
-             #:lazy-start? #f
-             #:log-file #$log-file)))
-       (stop #~(make-systemd-destructor))))))
-
-(define (home-gcr-ssh-agent-environment-variables config)
-  `(("SSH_AUTH_SOCK" . "${XDG_RUNTIME_DIR}/gcr/ssh")))
-
-(define home-gcr-ssh-agent-service-type
-  (service-type
-   (name 'home-gcr-ssh-agent)
-   (extensions
-    (list (service-extension
-           home-shepherd-service-type
-           home-gcr-ssh-agent-shepherd-service)
-          (service-extension home-environment-variables-service-type
-                             home-gcr-ssh-agent-environment-variables)))
-   (default-value (gcr-ssh-agent-configuration))
-   (description
-    "Provides @code{gcr-ssh-agent} Shepherd service and installs
-@code{gcr} in the system profile.")))
@@ -1,221 +0,0 @@
-;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2025 Lilah Tascheter <lilah@lunabee.space>
-;;;
-;;; This file is part of GNU Guix.
-;;;
-;;; GNU Guix is free software; you can redistribute it and/or modify it
-;;; under the terms of the GNU General Public License as published by
-;;; the Free Software Foundation; either version 3 of the License, or (at
-;;; your option) any later version.
-;;;
-;;; GNU Guix is distributed in the hope that it will be useful, but
-;;; WITHOUT ANY WARRANTY; without even the implied warranty of
-;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;;; GNU General Public License for more details.
-;;;
-;;; You should have received a copy of the GNU General Public License
-;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
-
-(define-module (gnu home services secrets)
-  #:use-module (gnu home services)
-  #:use-module (gnu home services shepherd)
-  #:use-module (gnu packages password-utils)
-  #:use-module (gnu services)
-  #:use-module (gnu services configuration)
-  #:use-module (gnu services shepherd)
-  #:use-module (guix gexp)
-  #:use-module (srfi srfi-1)
-  #:export (wrap-himitsu-prompter
-            home-himitsu-configuration
-            home-himitsu-service-type
-
-            home-himitsu-ssh-configuration
-            home-himitsu-ssh-service-type
-
-            home-himitsu-secret-service-configuration
-            home-himitsu-secret-service-type))
-
-;;
-;; himitsu
-;;
-
-(define (wrap-himitsu-prompter prompter)
-  "Wraps a prompter to autodetect DISPLAY and WAYLAND_DISPLAY, necessary since
-shepherd typically starts before a graphical session."
-  (program-file "himitsu-wrapped-prompter"
-    #~(begin (use-modules (ice-9 ftw) (ice-9 match) (srfi srfi-26))
-        (unless (or (getenv "DISPLAY") (getenv "WAYLAND_DISPLAY"))
-          (for-each (lambda (dir pat cont)
-                      (match (scandir dir (cut regexp-exec pat <>) string<?)
-                        ((file . _) (cont file)) (_ #f)))
-            (list "/tmp/.X11-unix" (or (getenv "XDG_RUNTIME_DIR")
-                                     (string-append "/run/user/" (getuid))))
-            (map make-regexp '("^X[0-9]+$" "^wayland-[0-9]+$"))
-            (list (lambda (f)
-                    (setenv "DISPLAY" (string-append ":" (string-drop f 1))))
-                  (cut setenv "WAYLAND_DISPLAY" <>))))
-        (apply execl #$prompter #$prompter (cdr (command-line))))))
-
-(define-maybe string (prefix himitsu-))
-
-(define (string-or-gexp? s)
-  (or (string? s) (gexp? s)))
-
-(define list-of-strings-or-gexps? (list-of string-or-gexp?))
-
-(define (himitsu-serialize-string label val)
-  #~(format #f "~a=~a~%" '#$label #$val))
-
-(define himitsu-serialize-file-like himitsu-serialize-string)
-
-(define (himitsu-serialize-list-of-strings-or-gexps label vals)
-  #~(string-join (list #$@vals) "\n" 'suffix))
-
-(define-configuration home-himitsu-configuration
-  (package (file-like himitsu) "himitsu package to use." empty-serializer)
-  (notify-reuse maybe-string "Command run to notify the user upon use of a
-secret it was already authorized to use. Limited shell expansion available.")
-  (prompter (file-like (wrap-himitsu-prompter
-                         (file-append hiprompt-gtk "/bin/hiprompt-gtk")))
-"himitsu prompter to use to request user authorization for secret access.")
-  (extra-options (list-of-strings-or-gexps '()) "A list of extra options, one
-per line, to put verbatim into the config file.")
-  (prefix himitsu-))
-
-(define (himitsu-serialize config)
-  (mixed-text-file "himitsu.ini" "[himitsud]\n"
-    (serialize-configuration config home-himitsu-configuration-fields)))
-
-(define (himitsu-shepherd-service config)
-  (define start
-    #~(lambda _
-        (let ((data (or (getenv "XDG_DATA_HOME")
-                        (string-append user-homedir "/.local/share"))))
-          (if (directory-exists? (string-append data "/himitsu"))
-            (fork+exec-command
-              (list #$(let ((pkg (home-himitsu-configuration-package config)))
-                        (file-append pkg "/bin/himitsud"))
-                    "-C" #$(himitsu-serialize config))
-              #:log-file (string-append %user-log-dir "/himitsu.log"))
-            (error "Himitsu store must exist before the service can run! Try \
-running 'himitsu-store -i' first?")))))
-  (list (shepherd-service
-          (documentation "Run the Himitsu secret service manager.")
-          (provision '(himitsud))
-          (modules (cons* '(shepherd support) %default-modules))
-          (start start)
-          (stop #~(make-kill-destructor)))))
-
-;; we need to install the file or else himitsu-store will gen it
-(define (himitsu-xdg-configuration-service config)
-  `(("himitsu/config.ini" ,(himitsu-serialize config))))
-
-(define home-himitsu-service-type
-  (service-type
-    (name 'himitsu)
-    (extensions
-      (list (service-extension home-shepherd-service-type
-                               himitsu-shepherd-service)
-            (service-extension home-xdg-configuration-files-service-type
-                               himitsu-xdg-configuration-service)
-            (service-extension home-profile-service-type
-                               (const (list himitsu)))))
-    (compose concatenate)
-    (extend (lambda (config exts)
-              (let ((opts (home-himitsu-configuration-extra-options config)))
-                (home-himitsu-configuration
-                  (inherit config)
-                  (extra-options (append exts opts))))))
-    (default-value (home-himitsu-configuration))
-    (description "Run the Himitsu secret storage manager upon login. You
-should create the Himitsu database in advance.")))
-
-;;
-;; himitsu-ssh
-;;
-
-(define (remember-option? opt)
-  (or (number? opt) (memq opt '(session skip refuse))))
-
-(define list-of-remember-options? (list-of remember-option?))
-
-(define (himitsu-serialize-list-of-remember-options label val)
-  (himitsu-serialize-string label
-    (string-join (map (lambda (x) (cond ((number? x) (number->string x))
-                                        ((symbol? x) (symbol->string x))))
-                      val)
-                 ",")))
-
-(define-configuration home-himitsu-ssh-configuration
-  (package (file-like himitsu-ssh) "himitsu-ssh package to use."
-           empty-serializer)
-  (persist (list-of-remember-options '(session 300 refuse)) "List of options
-given when prompting to allow himitsu-ssh to see your keys. The option chosen
-decides how long himitsu-ssh has this access. Options can be either 'session,
-'refuse, 'skip, or a timeout in seconds. 'session means until the daemon
-closes, 'refuse to decline and never ask again, and 'skip means to ask again
-next use.")
-  (disclose (list-of-remember-options '(skip session 300)) "List of options
-given when prompting to allow himitsu-ssh use of your keys. The format is the
-same has persist.")
-  (prefix himitsu-))
-
-(define (himitsu-ssh-shepherd-service config)
-  (let* ((package (home-himitsu-ssh-configuration-package config))
-         (binary (file-append package "/bin/hissh-agent")))
-    (list (shepherd-service
-            (documentation "Start the Himitsu ssh-agent implementation.")
-            (provision '(himitsu-ssh ssh-agent))
-            (requirement '(himitsud))
-            (start #~(make-forkexec-constructor (list #$binary)))
-            (stop #~(make-kill-destructor))))))
-
-(define (himitsu-ssh-himitsu.ini config)
-  (list "[ssh.remember]"
-        (serialize-configuration config home-himitsu-ssh-configuration-fields)))
-
-(define (himitsu-ssh-environment-variables _)
-  '(("SSH_AUTH_SOCK" . "${XDG_RUNTIME_DIR:-/run/user/$UID}/hissh-agent")))
-
-(define home-himitsu-ssh-service-type
-  (service-type
-    (name 'himitsu-ssh)
-    (extensions (list (service-extension home-shepherd-service-type
-                                         himitsu-ssh-shepherd-service)
-                      (service-extension home-himitsu-service-type
-                                         himitsu-ssh-himitsu.ini)
-                      (service-extension home-environment-variables-service-type
-                                         himitsu-ssh-environment-variables)
-                      (service-extension home-profile-service-type
-                                         (const (list himitsu-ssh)))))
-    (default-value (home-himitsu-ssh-configuration))
-    (description "Add support for ssh to store keys in Himitsu.")))
-
-;;
-;; himitsu-secret-service
-;;
-
-(define-configuration home-himitsu-secret-service-configuration
-  (package (file-like himitsu-secret-service) "himitsu-secret-service package to
-use." empty-serializer)
-  (prefix himitsu-))
-
-(define (himitsu-secret-service-shepherd-service config)
-  (let* ((package (home-himitsu-secret-service-configuration-package config))
-         (binary (file-append package "/bin/hisecrets-agent")))
-    (list (shepherd-service
-            (documentation "Start the Himitsu secret-service implementation.")
-            (provision '(himitsu-secret-service secret-service))
-            (requirement '(himitsud dbus))
-            (start #~(make-forkexec-constructor (list #$binary)))
-            (stop #~(make-kill-destructor))))))
-
-(define home-himitsu-secret-service-type
-  (service-type
-    (name 'himitsu-secret-service)
-    (extensions
-      (list (service-extension home-shepherd-service-type
-                               himitsu-secret-service-shepherd-service)))
-    (default-value (home-himitsu-secret-service-configuration))
-    (description "Add support to Himitsu for the freedesktop.org
-secret-service protocol.")))
@@ -367,13 +367,14 @@ purposes."
     'unknown)
    ((channels ...)
     (map (lambda (channel)
-            ;; NOTE: URL is not logged to synchronize the derivations
-            ;; coming out of pre-inst-env, time-machine and Cuirass
-            ;; for generating release artifacts.
-            `(channel ,(channel-name channel) ,(channel-commit channel)))
+            (let* ((uri (string->uri (channel-url channel)))
+                   (url (if (or (not uri) (eq? 'file (uri-scheme uri)))
+                            "local checkout"
+                            (channel-url channel))))
+             `(channel ,(channel-name channel) ,url ,(channel-commit channel))))
          channels))))

-(define* (installer-program #:key dry-run? (guix-for-installer (current-guix)))
+(define* (installer-program #:key dry-run?)
  "Return a file-like object that runs the given INSTALLER."
  (define init-gettext
    ;; Initialize gettext support, so that installer messages can be
@@ -422,7 +423,7 @@ purposes."
                           guile-gnutls
                           guile-zlib           ;for (gnu build linux-modules)
                           guile-zstd           ;for (gnu build linux-modules)
-                           guix-for-installer)
+                           (current-guix))
      (with-imported-modules `(,@(source-module-closure
                                  `(,@modules
                                    (gnu services herd)
@@ -35,7 +35,7 @@
 # Copyright © 2020 Ryan Prior <rprior@protonmail.com>
 # Copyright © 2020 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
 # Copyright © 2020, 2021 Brice Waegeneire <brice@waegenei.re>
-# Copyright © 2020, 2023, 2025 Tanguy Le Carrour <tanguy@bioneland.org>
+# Copyright © 2020, 2023 Tanguy Le Carrour <tanguy@bioneland.org>
 # Copyright © 2020 Martin Becze <mjbecze@riseup.net>
 # Copyright © 2020 Malte Frank Gerdes <mate.f.gerdes@gmail.com>
 # Copyright © 2020, 2023 Vinicius Monego <monego@posteo.net>
@@ -73,7 +73,6 @@
 # Copyright © 2024 James Smith <jsubuntuxp@disroot.org>
 # Copyright © 2025 Nigko Yerden <nigko.yerden@gmail.com>
 # Copyright © 2025 Cayetano Santos <csantosb@inventati.org>
-# Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 #
 # This file is part of GNU Guix.
 #
@@ -113,7 +112,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/home/services/dotfiles.scm		\
  %D%/home/services/symlink-manager.scm		\
  %D%/home/services/fontutils.scm		\
-  %D%/home/services/gnome.scm			\
  %D%/home/services/gnupg.scm			\
  %D%/home/services/guix.scm			\
  %D%/home/services/mail.scm			\
@@ -123,7 +121,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/home/services/music.scm			\
  %D%/home/services/niri.scm			\
  %D%/home/services/pm.scm			\
-  %D%/home/services/secrets.scm			\
  %D%/home/services/shells.scm			\
  %D%/home/services/shepherd.scm		\
  %D%/home/services/sound.scm			\
@@ -308,6 +305,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/game-development.scm		\
  %D%/packages/games.scm			\
  %D%/packages/gawk.scm				\
+  %D%/packages/gcal.scm				\
  %D%/packages/gcc.scm				\
  %D%/packages/gd.scm				\
  %D%/packages/gdb.scm				\
@@ -343,7 +341,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/gperf.scm			\
  %D%/packages/gpodder.scm			\
  %D%/packages/gps.scm				\
-  %D%/packages/graal.scm			\
  %D%/packages/graph.scm			\
  %D%/packages/graphics.scm			\
  %D%/packages/graphviz.scm			\
@@ -359,8 +356,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/gxmessage.scm			\
  %D%/packages/hardware.scm			\
  %D%/packages/hare.scm				\
-  %D%/packages/hare-apps.scm			\
-  %D%/packages/hare-xyz.scm			\
  %D%/packages/haskell.scm			\
  %D%/packages/haskell-apps.scm			\
  %D%/packages/haskell-check.scm		\
@@ -551,7 +546,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/php.scm				\
  %D%/packages/php-xyz.scm			\
  %D%/packages/piet.scm			\
-  %D%/packages/diagram.scm			\
+  %D%/packages/pikchr.scm			\
  %D%/packages/pkg-config.scm			\
  %D%/packages/plan9.scm			\
  %D%/packages/plotutils.scm			\
@@ -698,6 +693,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/vpn.scm				\
  %D%/packages/vulkan.scm			\
  %D%/packages/w3m.scm				\
+  %D%/packages/wdiff.scm			\
  %D%/packages/weather.scm			\
  %D%/packages/web.scm				\
  %D%/packages/web-browsers.scm			\
@@ -804,7 +800,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/system/uuid.scm				\
  %D%/system/vm.scm				\
 						\
-  %D%/system/images/a20-olinuxino-lime2.scm			\
  %D%/system/images/hurd.scm			\
  %D%/system/images/novena.scm			\
  %D%/system/images/orangepi-r1-plus-lts-rk3328.scm	\
@@ -992,7 +987,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/akonadi-not-relocatable.patch		\
  %D%/packages/patches/akonadi-timestamps.patch		\
  %D%/packages/patches/alure-dumb-2.patch			\
-  %D%/packages/patches/amd-smi-python.patch			\
  %D%/packages/patches/ibus-anthy-fix-tests.patch		\
  %D%/packages/patches/ibus-table-paths.patch			\
  %D%/packages/patches/anki-mpv-args.patch			\
@@ -1081,6 +1075,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/calls-disable-application-test.patch	\
  %D%/packages/patches/calls-disable-sip-test.patch		\
  %D%/packages/patches/camlboot-dynamically-allocate-stack-signal.patch	\
+  %D%/packages/patches/capnproto-fix-test.patch		\
  %D%/packages/patches/capstone-fix-python-constants.patch	\
  %D%/packages/patches/catdoc-CVE-2017-11110.patch		\
  %D%/packages/patches/chez-irregex-import-cond-expand.patch	\
@@ -1089,7 +1084,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/cdparanoia-fpic.patch			\
  %D%/packages/patches/cdrkit-libre-cross-compile.patch	\
  %D%/packages/patches/cdrtools-3.01-mkisofs-isoinfo.patch 	\
-  %D%/packages/patches/ceph-fix-cmake.patch                     \
+  %D%/packages/patches/ceph-disable-cpu-optimizations.patch	\
+  %D%/packages/patches/ceph-fix-for-newer-boost.patch		\
  %D%/packages/patches/cf-tool-add-languages.patch		\
  %D%/packages/patches/chmlib-inttypes.patch			\
  %D%/packages/patches/cl-asdf-config-directories.patch		\
@@ -1145,7 +1141,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/clucene-contribs-lib.patch               \
  %D%/packages/patches/csvkit-set-locale-for-tests.patch			\
  %D%/packages/patches/ctranslate2-local-build.patch		\
-  %D%/packages/patches/ctune-cmake-disable-git-clone.patch		\
  %D%/packages/patches/cube-nocheck.patch			\
  %D%/packages/patches/cups-relax-root-ownership-check.patch		\
  %D%/packages/patches/cura-engine-gcc-14.patch			\
@@ -1202,7 +1197,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/duc-fix-test-sh.patch                    \
  %D%/packages/patches/dune-common-skip-failing-tests.patch	\
  %D%/packages/patches/durden-shadow-arcan.patch		\
-  %D%/packages/patches/dvdbackup-with-libdvdread-6.1.0+.patch	\
  %D%/packages/patches/dvd+rw-tools-add-include.patch 		\
  %D%/packages/patches/dwarves-threading-reproducibility.patch	\
  %D%/packages/patches/efivar-fix-fprint-format.patch		\
@@ -1217,7 +1211,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/emacs-all-the-icons-remove-duplicate-rs.patch	\
  %D%/packages/patches/emacs-deferred-fix-number-of-arguments.patch	\
  %D%/packages/patches/emacs-disable-jit-compilation.patch			\
-  %D%/packages/patches/emacs-elisp-autofmt-fix-region-send.patch	\
  %D%/packages/patches/emacs-exec-path.patch			\
  %D%/packages/patches/emacs-fix-scheme-indent-function.patch	\
  %D%/packages/patches/emacs-gnus-alias-reference-signature.patch	\
@@ -1287,7 +1280,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/ffmpeg-jami-remove-mjpeg-log.patch	\
  %D%/packages/patches/ffmpeg-jami-screen-sharing-x11-fix.patch	\
  %D%/packages/patches/ffmpeg-4-binutils-2.41.patch	\
-  %D%/packages/patches/ffmpeg-svt-av1-v3.patch			\
  %D%/packages/patches/fgallery-also-look-for-7z.patch		\
  %D%/packages/patches/fifengine-boost-compat.patch		\
  %D%/packages/patches/fifengine-python-3.9-compat.patch	\
@@ -1301,6 +1293,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/flatpak-fix-fonts-icons.patch	\
  %D%/packages/patches/flatpak-fix-icon-validation.patch	\
  %D%/packages/patches/flatpak-unset-gdk-pixbuf-for-sandbox.patch	\
+  %D%/packages/patches/flex-fix-make-dependencies.patch         \
  %D%/packages/patches/fluxbox-1.3.7-no-dynamic-cursor.patch	\
  %D%/packages/patches/fluxbox-1.3.7-gcc.patch			\
  %D%/packages/patches/fmt-9-overspecified-tests.patch	\
@@ -1443,7 +1436,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghostscript-no-header-creationdate.patch \
  %D%/packages/patches/gimp-fix-metadata-editor.patch		\
  %D%/packages/patches/gimp-fix-tiff-load.patch			\
-  %D%/packages/patches/git-clar-path-max.patch			\
  %D%/packages/patches/git-filter-repo-generate-doc.patch	\
  %D%/packages/patches/gklib-suitesparse.patch			\
  %D%/packages/patches/glib-appinfo-watch.patch			\
@@ -1524,7 +1516,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/gpaste-fix-paths.patch			\
  %D%/packages/patches/gpm-glibc-2.26.patch			\
  %D%/packages/patches/gpodder-disable-updater.patch		\
-  %D%/packages/patches/graalvm-mx-check-failed-after-join.patch	\
  %D%/packages/patches/grantlee-fix-i586-precision.patch	\
  %D%/packages/patches/grantlee-register-metaenumvariable.patch	\
  %D%/packages/patches/grep-timing-sensitive-test.patch		\
@@ -1597,9 +1588,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/hurd-refcounts-assert.patch		\
  %D%/packages/patches/hurd-rumpdisk-no-hd.patch		\
  %D%/packages/patches/hurd-startup.patch			\
-  %D%/packages/patches/hurd-proc-zombies.patch			\
  %D%/packages/patches/hwloc-1-test-btrfs.patch			\
-  %D%/packages/patches/i3lock-blur-fix-build-on-gcc-10.patch	\
  %D%/packages/patches/i7z-gcc-10.patch				\
  %D%/packages/patches/icecat-adjust-mozilla-desktop.patch      \
  %D%/packages/patches/icecat-makeicecat.patch			\
@@ -1659,9 +1648,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/jfsutils-gcc-compat.patch		\
  %D%/packages/patches/jfsutils-include-systypes.patch		\
  %D%/packages/patches/john-the-ripper-jumbo-with-gcc-11.patch	\
-  %D%/packages/patches/json-c-0.12-CVE-2020-12762.patch		\
  %D%/packages/patches/json-c-0.13-CVE-2020-12762.patch		\
-  %D%/packages/patches/jsonnet-include-cstdint-for-gcc-13-builds.patch	\
+  %D%/packages/patches/json-c-0.12-CVE-2020-12762.patch		\
  %D%/packages/patches/julia-SOURCE_DATE_EPOCH-mtime.patch	\
  %D%/packages/patches/julia-Use-MPFR-4.2.patch	                \
  %D%/packages/patches/komikku-python-3.11-compat.patch	                \
@@ -1707,7 +1695,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/kinit-kdeinit-extra_libs.patch		\
  %D%/packages/patches/kio-search-smbd-on-PATH.patch		\
  %D%/packages/patches/kismet-unbundle-boost.patch		\
-  %D%/packages/patches/kissfft-tflite-micro.patch               \
  %D%/packages/patches/kitty-fix-wayland-protocols.patch	\
  %D%/packages/patches/kmod-module-directory.patch		\
  %D%/packages/patches/kmscon-runtime-keymap-switch.patch	\
@@ -1736,7 +1723,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/libbraiding-no-s.patch                   \
  %D%/packages/patches/libcaca-CVE-2021-3410-pt1.patch		\
  %D%/packages/patches/libcaca-CVE-2021-3410-pt2.patch		\
-  %D%/packages/patches/libcap-magic-glibc-constant.patch	\
  %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
  %D%/packages/patches/libcanberra-wayland-crash.patch \
  %D%/packages/patches/libcroco-CVE-2020-12825.patch		\
@@ -1775,6 +1761,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/libmpeg2-global-symbol-test.patch	\
  %D%/packages/patches/liblinphone-jsoncpp.patch		\
  %D%/packages/patches/libphonenumber-reproducible-build.patch	\
+  %D%/packages/patches/plotutils-c23.patch                      \
+  %D%/packages/patches/plotutils-configure-c99.patch            \
+  %D%/packages/patches/plotutils-cxx17-fix.patch                \
+  %D%/packages/patches/plotutils-format-security.patch          \
+  %D%/packages/patches/plotutils-libxmi.patch                   \
+  %D%/packages/patches/plotutils-makefile.patch                 \
+  %D%/packages/patches/plotutils-rangecheck.patch               \
  %D%/packages/patches/libqalculate-3.8.0-libcurl-ssl-fix.patch	\
  %D%/packages/patches/libquicktime-ffmpeg.patch 		\
  %D%/packages/patches/libsecret-fix-test-paths.patch		\
@@ -1790,8 +1783,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/libtiff-CVE-2022-34526.patch		\
  %D%/packages/patches/libtirpc-CVE-2021-46828.patch		\
  %D%/packages/patches/libtirpc-hurd.patch			\
-  %D%/packages/patches/libtool-grep-compat.patch		\
-  %D%/packages/patches/libtool-skip-tests2.patch		\
  %D%/packages/patches/libtree-fix-check-non-x86.patch		\
  %D%/packages/patches/libusb-0.1-disable-tests.patch		\
  %D%/packages/patches/libusb-for-axoloti.patch			\
@@ -1800,6 +1791,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/libvdpau-va-gl-unbundle.patch		\
  %D%/packages/patches/libvpx-CVE-2016-2818.patch		\
  %D%/packages/patches/libxcb-path-max.patch			\
+  %D%/packages/patches/libxmi-gcc15.patch 			\
+  %D%/packages/patches/libxmi-implicit.patch			\
  %D%/packages/patches/libxml2-xpath0-Add-option-xpath0.patch	\
  %D%/packages/patches/libwpd-gcc-compat.patch			\
  %D%/packages/patches/libxt-guix-search-paths.patch		\
@@ -1822,6 +1815,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/lirc-reproducible-build.patch		\
  %D%/packages/patches/llvm-13-gcc-14.patch			\
  %D%/packages/patches/lm-sensors-hwmon-attrs.patch		\
+  %D%/packages/patches/lsh-fix-x11-forwarding.patch		\
  %D%/packages/patches/lsof-compat-linux-6.9.patch		\
  %D%/packages/patches/lsof-fatal-test-failures.patch		\
  %D%/packages/patches/lua-CVE-2014-5461.patch                      \
@@ -1882,6 +1876,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/mpc123-initialize-ao.patch		\
  %D%/packages/patches/mpg321-CVE-2019-14247.patch		\
  %D%/packages/patches/mpg321-gcc-10.patch			\
+  %D%/packages/patches/mpv-0.40.0-fix-ffmpeg-8.0.patch		\
  %D%/packages/patches/modglue-fix-build.patch		\
  %D%/packages/patches/modem-manager-fix-test-wrapper.patch	\
  %D%/packages/patches/module-init-tools-moduledir.patch	\
@@ -1947,7 +1942,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/nss-3.115-disable-broken-tests.patch     \
  %D%/packages/patches/nss-3.115-disable-pkix-ocsp-tests.patch  \
  %D%/packages/patches/ntp-fix-dereferencing-the-wrong-variable.patch   \
-  %D%/packages/patches/nvi-add-function-prototypes.patch	\
  %D%/packages/patches/nvi-assume-preserve-path.patch		\
  %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
  %D%/packages/patches/nvi-db4.patch				\
@@ -2052,12 +2046,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-clarabel-blas.patch		\
  %D%/packages/patches/python-docrepr-fix-tests.patch		\
  %D%/packages/patches/python-feedparser-missing-import.patch	\
-  %D%/packages/patches/python-gpg-setup-72.patch                \
  %D%/packages/patches/python-hdmedians-replace-nose.patch	\
  %D%/packages/patches/python-louvain-fix-test.patch		\
  %D%/packages/patches/python-matplotlib-fix-legend-loc-best-test.patch	\
  %D%/packages/patches/python-mohawk-pytest.patch	\
-  %D%/packages/patches/python-msal-requests.patch	\
  %D%/packages/patches/python-norns-nose.patch			\
  %D%/packages/patches/python-numpy-gcc-14.patch		\
  %D%/packages/patches/python-random2-getrandbits-test.patch		\
@@ -2077,7 +2069,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/qtdeclarative-5-disable-qmlcache.patch	\
  %D%/packages/patches/qtdeclarative-disable-qmlcache.patch	\
  %D%/packages/patches/qtlocation-5.15.8-mapboxgl-gcc13.patch	\
-  %D%/packages/patches/qtwebengine-revert-egl.patch		\
  %D%/packages/patches/quodlibet-disable-bundled-packages.patch	\
  %D%/packages/patches/qxlsx-fix-include-directory.patch	\
  %D%/packages/patches/schiffbruch-fix-build-for-gcc-13.patch	\
@@ -2149,7 +2140,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/psm-ldflags.patch			\
  %D%/packages/patches/psm-repro.patch				\
  %D%/packages/patches/pstoedit-fix-gcc12.patch			\
-  %D%/packages/patches/pstoedit-fix-plainC.patch		\
  %D%/packages/patches/pstoedit-pkglibdir.patch			\
  %D%/packages/patches/pulseaudio-fix-mult-test.patch		\
  %D%/packages/patches/pulseaudio-longer-test-timeout.patch	\
@@ -2216,20 +2206,19 @@ dist_patch_DATA =						\
  %D%/packages/patches/qtbase-qmake-fix-includedir.patch 	\
  %D%/packages/patches/qtbase-qmlimportscanner-qml-import-path.patch 	\
  %D%/packages/patches/qtbase-moc-ignore-gcc-macro.patch	\
-  %D%/packages/patches/qtbase-patch-libvulkan.patch		\
  %D%/packages/patches/qtbase-qmake-use-libname.patch		\
  %D%/packages/patches/qtbase-5-use-TZDIR.patch			\
  %D%/packages/patches/qtscript-disable-tests.patch		\
  %D%/packages/patches/quagga-reproducible-build.patch          \
+  %D%/packages/patches/quickswitch-fix-dmenu-check.patch	\
  %D%/packages/patches/quilt-grep-compat.patch 			\
  %D%/packages/patches/qmk-firmware-fix-hacker-dvorak.patch 	\
  %D%/packages/patches/qtwayland-dont-recreate-callbacks.patch	\
  %D%/packages/patches/qtwayland-cleanup-callbacks.patch	\
  %D%/packages/patches/qtwayland-update-wayland-xml.patch	\
+  %D%/packages/patches/qtwebengine-fix-dependencies.patch       \
  %D%/packages/patches/qtwebsockets-6.9-fix-tst_QWebSocket.patch\
  %D%/packages/patches/rabbitmq-defaults.patch		\
-  %D%/packages/patches/radare2-fix-meson-build-to-use-sys-qjs.patch	\
-  %D%/packages/patches/radare2-fix-meson-build-to-use-sys-sdb.patch	\
  %D%/packages/patches/ragel-char-signedness.patch		\
  %D%/packages/patches/randomjungle-disable-static-build.patch	\
  %D%/packages/patches/rapidcheck-fix-libs.patch		\
@@ -2237,8 +2226,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/retroarch-unbundle-spirv-cross.patch	\
  %D%/packages/patches/rct-add-missing-headers.patch		\
  %D%/packages/patches/readline-link-ncurses.patch		\
-  %D%/packages/patches/renpy-python-3.11-compat.patch			\
-  %D%/packages/patches/renpy-fix-integer-slots.patch			\
+  %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
+  %D%/packages/patches/renpy-use-system-fribidi.patch		\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
  %D%/packages/patches/rdkit-unbundle-external-dependencies.patch	\
  %D%/packages/patches/r-httpuv-1.6.6-unvendor-libuv.patch	\
@@ -2257,7 +2246,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/remake-impure-dirs.patch			\
  %D%/packages/patches/restartd-update-robust.patch             \
  %D%/packages/patches/restic-0.9.6-fix-tests-for-go1.15.patch	\
-  %D%/packages/patches/rlwrap-no-rbgen.patch	\
  %D%/packages/patches/rng-tools-revert-build-randstat.patch	\
  %D%/packages/patches/rocclr-5.6.0-enable-gfx800.patch		\
  %D%/packages/patches/rocm-opencl-runtime-4.3-noclinfo.patch 	\
@@ -2284,6 +2272,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/rxvt-unicode-fix-cursor-position.patch	\
  %D%/packages/patches/s7-flint-3.patch                      	\
  %D%/packages/patches/safeint-disable-tests.patch		\
+  %D%/packages/patches/sage-safeguard-sage-getargspec-cython.patch \
  %D%/packages/patches/sajson-for-gemmi-numbers-as-strings.patch	\
  %D%/packages/patches/sajson-build-with-gcc10.patch		\
  %D%/packages/patches/sane-look-for-plugins-in-SANE_BACKEND_LIB_PATH.patch	\
@@ -2322,7 +2311,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/slim-login.patch				\
  %D%/packages/patches/slim-display.patch			\
  %D%/packages/patches/slurm-23-salloc-fallback-shell.patch	\
-  %D%/packages/patches/slurm-drmaa-25.patch			\
  %D%/packages/patches/stex-copy-from-immutable-store.patch	\
  %D%/packages/patches/sysdig-shared-falcosecurity-libs.patch	\
  %D%/packages/patches/syslinux-gcc10.patch			\
@@ -2378,7 +2366,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/texi2html-document-encoding.patch	\
  %D%/packages/patches/texi2html-i18n.patch			\
  %D%/packages/patches/texmacs-wayland-hidpi.patch	\
-  %D%/packages/patches/tflite-micro_disable_download.patch 	\
+  %D%/packages/patches/texlive-bin-luaoutputdir-test.patch      \
  %D%/packages/patches/thefuck-test-environ.patch		\
  %D%/packages/patches/thefuck-remove-broken-tests.patch	\
  %D%/packages/patches/tidy-CVE-2015-5522+5523.patch		\
@@ -2461,7 +2449,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/vcmi-disable-privacy-breach.patch	\
  %D%/packages/patches/vinagre-newer-freerdp.patch             \
  %D%/packages/patches/vinagre-newer-rdp-parameters.patch      \
-  %D%/packages/patches/vlc-livemedia-2024.11.28.patch          \
  %D%/packages/patches/vsearch-unbundle-cityhash.patch		\
  %D%/packages/patches/vst3sdk-3.7.7-allow-winelib-compilation.patch	\
  %D%/packages/patches/vte-CVE-2012-2738-pt1.patch			\
@@ -2483,16 +2470,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/wmctrl-64-fix.patch			\
  %D%/packages/patches/wmfire-dont-inline-draw-fire.patch	\
  %D%/packages/patches/wmfire-update-for-new-gdk-versions.patch	\
+  %D%/packages/patches/woof-doom-unbundle-spng-miniz.patch	\
  %D%/packages/patches/wordnet-CVE-2008-2149.patch			\
  %D%/packages/patches/wordnet-CVE-2008-3908-pt1.patch			\
  %D%/packages/patches/wordnet-CVE-2008-3908-pt2.patch			\
  %D%/packages/patches/wpa-supplicant-dbus-group-policy.patch		\
-  %D%/packages/patches/x2goclient-fix-makefile.patch            \
  %D%/packages/patches/x265-arm-flags.patch			\
-  %D%/packages/patches/x265-4-arm-flags.patch			\
  %D%/packages/patches/xdg-desktop-portal-disable-portal-tests.patch\
  %D%/packages/patches/xdg-desktop-portal-disable-configuration-search-exit.patch\
-  %D%/packages/patches/xdg-desktop-portal-1.20.3-disable-configuration-search-exit.patch\
  %D%/packages/patches/xdg-desktop-portal-wlr-harcoded-length.patch\
  %D%/packages/patches/xf86-video-siliconmotion-fix-ftbfs.patch \
  %D%/packages/patches/xfig-Enable-error-message-for-missing-libraries.patch		\
@@ -651,7 +651,7 @@ fdisk -l /dev/sda"
     (format #f "#!/usr/bin/env bash
 set -eo pipefail
 apt-get update
-apt-get install cloud-initramfs-growroot uidmap --assume-yes"))
+apt-get install cloud-initramfs-growroot --assume-yes"))
    (format #t "successfully installed rescue system packages on '~a'\n" name)))

 (define (hetzner-machine-delete machine server)
@@ -30,20 +30,17 @@
  #:use-module (gnu packages check)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages perl)
-  #:use-module (gnu packages python-build)
  #:use-module (guix packages)
  #:use-module (guix download)
-  #:use-module (guix gexp)
  #:use-module (gnu packages)
  #:use-module (guix build-system gnu)
-  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module (guix utils))

 (define-public acl
  (package
    (name "acl")
-    (version "2.3.1")
+    (version "2.3.2")
    (source
     (origin
      (method url-fetch)
@@ -51,7 +48,7 @@
                          version ".tar.gz"))
      (sha256
       (base32
-        "1bqi7hj0xkpivwg7lx5cv3yvs9ks1i6azvpgbvfpzcq1i736233n"))))
+        "0z1gi82zc2xcbchfagd7apn2s7camaagj8y6hmysl1wpcanxnasz"))))
    (build-system gnu-build-system)
    (arguments
     `(#:modules ((ice-9 ftw)
@@ -98,28 +95,33 @@
 (define-public python-pylibacl
  (package
    (name "python-pylibacl")
-    (version "0.7.3")
+    (version "0.6.0")
    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "pylibacl" version))
-       (sha256
-        (base32 "08pr5cbipij3j591bihh72r5h14lyrspy24qwmfjsn0c1rcgp7wx"))))
-    (build-system pyproject-build-system)
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "pylibacl" version))
+        (sha256
+          (base32
+            "1zyrk2m20p5b6bdwxhrwib273i6i71zyr5hzssbxfqis5qra9848"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'disable-tests
-            (lambda* (#:key outputs inputs #:allow-other-keys)
-              ;; These tests operate on real files, but our tmpfs does not support
-              ;; ACLs.
-              (substitute* "tests/test_acls.py"
-                (("( *)def test_applyto(_extended(_mixed)?)?" match indent)
-                 (string-append indent "@pytest.mark.skip(reason=\"guix\")\n"
-                                match))))))))
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'disable-tests
+           (lambda* (#:key outputs inputs #:allow-other-keys)
+             ;; These tests operate on real files, but our tmpfs does not support
+             ;; ACLs.
+             (substitute* "tests/test_acls.py"
+               (("( *)def test_applyto(_extended(_mixed)?)?" match indent)
+                (string-append indent "@pytest.mark.skip(reason=\"guix\")\n"
+                               match)))))
+         (replace 'check
+           (lambda* (#:key inputs outputs tests? #:allow-other-keys)
+             (when tests?
+               (add-installed-pythonpath inputs outputs)
+               (invoke "pytest" "tests")))))))
    (inputs (list acl))
-    (native-inputs (list python-pytest python-setuptools))
+    (native-inputs (list python-pytest))
    (home-page "https://pylibacl.k1024.org/")
    (synopsis "POSIX.1e @acronym{ACLs, access control lists} for Python")
    (description
@@ -77,8 +77,6 @@
 ;;; Copyright © 2025 Dariqq <dariqq@posteo.net>
 ;;; Copyright © 2024 nik gaffney <nik@fo.am>
 ;;; Copyright © 2025 Simon Streit <simon@netpanic.org>
-;;; Copyright © 2025 Luca Kredel <luca.kredel@web.de>
-;;; Copyright © 2025 ROCKTAKEY <rocktakey@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -191,7 +189,6 @@
  #:use-module (gnu packages polkit)
  #:use-module (gnu packages python)
  #:use-module (gnu packages python-build)
-  #:use-module (gnu packages python-check)
  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages qt)
@@ -377,34 +374,23 @@ service.")
  (package
    (name "hungrycat")
    (version "0.4.2")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/jwilk/hungrycat/")
-              (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0llfb7kh2k53aqwc1fagw77fmwhvwdxd5qlg0fyrhqq298gj8wif"))))
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/jwilk/hungrycat/"
+                                  "releases/download/" version "/"
+                                  "hungrycat-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0xy9l4hky85h3rgdmqmhcnx0q1hq0brskr8lzw2lz6lh7pxlxmyw"))))
    (build-system gnu-build-system)
-    (arguments
-     (list
-      ;; tests: Files=2, Tests=2334,  1 wallclock secs
-      #:test-target "test"
-      #:make-flags
-      #~(list (string-append "CC=" #$(cc-for-target)))
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'build 'build-doc
-            (lambda _
-              (invoke "make" "-C" "doc"))))))
    (native-inputs
-     (list automake
-           autoconf
-           cppcheck
-           perl
-           perl-ipc-run
-           python-docutils))
+     ;; For tests.
+     `(("python" ,python-wrapper)
+       ("python-nose" ,python-nose)
+       ("perl" ,perl)
+       ("perl-ipc-run" ,perl-ipc-run)))
+    (arguments
+     `(#:test-target "test"))
    (synopsis "Single tool that combines @command{cat} & @command{rm}")
    (description
     "hungrycat prints the contents of a file to standard output, while
@@ -597,44 +583,24 @@ interface and is based on GNU Guile.")
 (define-public shepherd-1.0
  (package
    (inherit shepherd-0.10)
-    (version "1.0.9")
+    (version "1.0.8")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/shepherd/shepherd-"
                                  version ".tar.gz"))
              (sha256
               (base32
-                "1mh080060lnycys8yq6kkiy363wif8dsip3nyklgd3a1r22wb274"))))
+                "1xbzf7vmanb36hfb0kc9a240x7xnkynsfs6hcz2kj0xzf19h1srv"))))
    (arguments
-     (list
-      #:configure-flags
-      #~(list "--localstatedir=/var"
-              ;; Gzip and zstd are used by the log rotation service.
-              (string-append "--with-gzip=" #$(this-package-input "gzip")
-                             "/bin/gzip")
-              (string-append "--with-zstd=" #$(this-package-input "zstd")
-                             "/bin/zstd"))
-      #:make-flags #~'("GUILE_AUTO_COMPILE=0")
-      #:phases (if (%current-target-system)
-                   #~(modify-phases %standard-phases
-                       (add-before 'configure 'set-fibers-directory
-                         (lambda* (#:key inputs  #:allow-other-keys)
-                           ;; When cross-compiling, refer to the target
-                           ;; Fibers, not the native one.
-                           (let ((fibers
-                                  (search-input-file
-                                   inputs
-                                   "share/guile/site/3.0/fibers.scm"))
-                                 (fibers-go
-                                  (search-input-file
-                                   inputs
-                                   "lib/guile/3.0/site-ccache/fibers.go")))
-                             (substitute* '("herd.in" "shepherd.in")
-                               (("%FIBERS_SOURCE_DIRECTORY%")
-                                (dirname fibers))
-                               (("%FIBERS_OBJECT_DIRECTORY%")
-                                (dirname fibers-go)))))))
-                   #~%standard-phases)))
+     (substitute-keyword-arguments (package-arguments shepherd-0.10)
+       ((#:configure-flags flags #~'())
+        #~(list "--localstatedir=/var"
+
+                ;; Gzip and zstd are used by the log rotation service.
+                (string-append "--with-gzip=" #$(this-package-input "gzip")
+                               "/bin/gzip")
+                (string-append "--with-zstd=" #$(this-package-input "zstd")
+                               "/bin/zstd")))))
    (native-inputs
     (modify-inputs (package-native-inputs shepherd-0.10)
       (replace "guile-fibers"
@@ -1975,7 +1941,7 @@ maintenance releases.")
 (define-public dhcpcd
  (package
    (name "dhcpcd")
-    (version "10.3.0")
+    (version "10.2.3")
    (source
     (origin
       (method git-fetch)
@@ -1984,7 +1950,7 @@ maintenance releases.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "058k8wbzbjb6mm6qklv40z1y4k6sdb4ysap1xk6pny1m1f9xkdax"))))
+        (base32 "01bqs71s2gixsir1cpnk6sm4k9dpdkrgp1r8cpbac50d6hwlxln3"))))
    (inputs (list bash-minimal coreutils-minimal eudev sed))
    (build-system gnu-build-system)
    (arguments
@@ -2248,7 +2214,7 @@ by bandwidth they use.")
           perl-test-pod
           perl-test-pod-coverage
           perl-test-trap
-           perl-tidy))
+           perltidy))
    (inputs
     (list bash-minimal                 ;for wrap-program
           perl-exception-class
@@ -2984,7 +2950,7 @@ system is under heavy load.")
 (define-public stress-ng
  (package
    (name "stress-ng")
-    (version "0.19.06")
+    (version "0.19.03")
    (source
     (origin
       (method git-fetch)
@@ -2993,7 +2959,7 @@ system is under heavy load.")
             (commit (string-append "V" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0fxyxxswkx5ay8i2w8ajsiagkysh8d41l88vls9c4rc35wxzhwf6"))))
+        (base32 "1phrmjvvjn55pyfljfkk604d8q8wn17l416v91hskj98v7b7yhck"))))
    (build-system gnu-build-system)
    (arguments
     ;; XXX The test suite seems to cause instability on the VisionFive 2
@@ -3175,34 +3141,29 @@ various ways that may be running with too much privilege.")
 (define-public smartmontools
  (package
    (name "smartmontools")
-    (version "7.5")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/smartmontools/smartmontools")
-             (commit (string-append "RELEASE_"
-                                    (string-replace-substring version "." "_")))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "00c58xcqv73lzxf0baly2q0sqkyd2vncv93iabjj7jkvbzf7nqpz"))))
+    (version "7.4")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "mirror://sourceforge/smartmontools/smartmontools/"
+                    version "/smartmontools-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0gcrzcb4g7f994n6nws26g6x15yjija1gyzd359sjv7r3xj1z9p9"))))
    (build-system gnu-build-system)
    (arguments
     (list
      #:make-flags
      #~(list "BUILD_INFO=\"(Guix)\"")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'chdir
-            (lambda _
-              (chdir "smartmontools"))))
      #:configure-flags
      #~(list (format #f "--with-scriptpath=~{~a:~}$PATH"
                      (map (lambda (pkg)
                             (in-vicinity pkg "bin"))
                           '#$(list (this-package-input "coreutils-minimal")
                                    (this-package-input "sed")))))))
-    (inputs (list automake autoconf coreutils-minimal libcap-ng sed))
+    (inputs (list coreutils-minimal
+                  libcap-ng
+                  sed))
    (home-page "https://www.smartmontools.org/")
    (synopsis "S.M.A.R.T. harddisk control and monitoring tools")
    (description
@@ -3216,7 +3177,7 @@ degradation and failure.")
 (define-public fdupes
  (package
    (name "fdupes")
-    (version "2.4.0")
+    (version "2.3.2")
    (source
     (origin
       (method url-fetch)
@@ -3224,7 +3185,7 @@ degradation and failure.")
                           "releases/download/v" version "/"
                           "fdupes-" version ".tar.gz"))
       (sha256
-        (base32 "0dhpgcylf99cnxz8h4i4dhv2i3124cs0n8lssbhwn783knijfysj"))))
+        (base32 "1irab60gkjmnvk1l0x92cb5vh9zw9g0vgr3s82mir93zpvn8v3c0"))))
    (build-system gnu-build-system)
    (inputs
     (list ncurses pcre2 sqlite))
@@ -3374,17 +3335,7 @@ provides the following commands:
       (uri (pypi-uri "ansible" version))
       (sha256
        (base32 "0apj783acx4jzkf3bnibn4y5jc6jd8ly7l0rdqq8f1jpgxal933x"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      ;; XXX: All tests errored with:
-      ;; from ...common.utils import (
-      ;; E ImportError: attempted relative import with no known parent package
-      ;;
-      ;; tests: 17 skipped, 1 warning, 1132 errors
-      #:tests? #f))
-    (native-inputs
-     (list python-setuptools))
+    (build-system python-build-system)
    (propagated-inputs (list ansible-core))
    ;; The Ansible collections are found by ansible-core via the Python search
    ;; path; the following search path ensures that they are found even when
@@ -4717,7 +4668,7 @@ information tool.")
 (define-public fastfetch-minimal
  (package
    (name "fastfetch-minimal")
-    (version "2.55.1")
+    (version "2.55.0")
    (source
     (origin
       (method git-fetch)
@@ -4726,7 +4677,7 @@ information tool.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0a2a8rp75nx16gvq0918999hifr2lph8dagpfipmyflaa5awlw54"))
+        (base32 "1vqw0r0h8clb302bzbmfxpkz54kx6sd661nm50vvhijham8x7mlb"))
       (modules '((guix build utils)))
       (snippet '(begin
                   (delete-file-recursively "src/3rdparty")))))
@@ -6662,11 +6613,10 @@ file or files to several hosts.")
                              (install-file "man-page/dust.1"
                                            (string-append share "/man/man1"))
                              (mkdir-p (string-append out
-                                        "/share/bash-completion/completions"))
-                              (copy-file
-                               "completions/dust.bash"
-                               (string-append
-                                out "/share/bash-completion/completions/dust"))
+                                        "/etc/bash_completion.d"))
+                              (copy-file "completions/dust.bash"
+                                         (string-append out
+                                          "/etc/bash_completion.d/dust"))
                              (install-file "completions/dust.fish"
                                            (string-append share
                                             "/fish/vendor_completions.d"))
@@ -6951,41 +6901,6 @@ with which other processes.  It provides more usable versions of @command{ps},
 network, which causes enabled computers to power on.")
    (license license:gpl2+)))

-(define-public witr
-  (package
-    (name "witr")
-    (version "0.1.1")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/pranshuparmar/witr")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "016yiwn0b00ynllka6h2w6gk2yjzj5nx2xf26shb0cz4crdwww0d"))))
-    (build-system go-build-system)
-    (arguments
-     (list
-      #:install-source? #f
-      #:import-path "github.com/pranshuparmar/witr/cmd/witr"
-      #:unpack-path "github.com/pranshuparmar/witr"
-      #:build-flags #~(list "-ldflags"
-                            (string-append "-X main.version=" #$version))))
-    (home-page "https://github.com/pranshuparmar/witr")
-    (synopsis "Utility to show why the process is running")
-    (description
-     "The @dfn{witr} (why-is-this-running), is a utility to show:
-@enumerate
-@item What is running?
-@item How did it start?
-@item What is keeping it running?
-@item What context does it belong to?
-@end enumerate
-It shows which process uses the port, and its information like process tree,
-working directory, user, pid, command, and so on.")
-    (license license:asl2.0)))
-
 (define-public xfel
  (package
    (name "xfel")
@@ -300,38 +300,6 @@ barcodes of the modern ECC200 variety.  libdmtx is a shared library, allowing
 C/C++ programs to use its capabilities without restrictions or overhead.")
    (license license:bsd-3)))

-(define-public dmtx-utils
-  (package
-    (name "dmtx-utils")
-    (version "0.7.6")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/dmtx/dmtx-utils/")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        "06m3qncqdlcnmw83n95yrx2alaq6bld320ax26z4ndnla41yk0p4")))
-    (build-system gnu-build-system)
-    (native-inputs (list autoconf automake libtool pkg-config))
-    (inputs (list libdmtx imagemagick libjpeg-turbo))
-    (home-page "https://github.com/dmtx/dmtx-utils/")
-    (synopsis "Utilities for working with Data Matrix barcodes")
-    (description
-     "libdmtx is a software library that enables programs to read and write Data
-Matrix barcodes of the modern ECC200 variety.  This package, dmtx-utils,
-provides command line utilities that allow scripts and command line users to
-use libdmtx functionality.
-
-This package includes the following programs:
-@enumerate
-@item @code{dmtxquery}: Extract information from dmtxread output.
-@item @code{dmtxread}: Scan Data Matrix barcodes.
-@item @code{dmtxwrite}: Create Data Matrix barcodes.
-@end enumerate")
-    (license (list license:lgpl2.1 license:gpl2))))
-
 ;; XXX: qt variant utils are broken: zbarcam-qt fails with segmentation fault.
 (define-public zbar
  (package
@@ -21,7 +21,6 @@
 ;;; Copyright © 2025 Nigko Yerden <nigko.yerden@gmail.com>
 ;;; Copyright © 2025 Skylar Hill <stellarskylark@posteo.net>
 ;;; Copyright © 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
-;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -61,7 +60,6 @@
  #:use-module (gnu packages image)
  #:use-module (gnu packages java)
  #:use-module (gnu packages libffi)
-  #:use-module (gnu packages linux)
  #:use-module (gnu packages maths)
  #:use-module (gnu packages mpi)
  #:use-module (gnu packages multiprecision)
@@ -269,7 +267,7 @@ the real span of the lattice.")
 (define-public pari-gp
  (package
    (name "pari-gp")
-    (version "2.17.3")
+    (version "2.17.2")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -277,7 +275,7 @@ the real span of the lattice.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "1jrd8q8bii109i01qjsc15948a47cn1kcg7jw0kqsijcb36lz74d"))))
+                "0qahws0jmmqv3v611zdwhvg0rz5a678lhi8z51x16yzrbj7mfc3x"))))
    (build-system gnu-build-system)
    (native-inputs (list (texlive-local-tree)))
    (inputs (list gmp libx11 perl readline))
@@ -498,20 +496,25 @@ or text interfaces) or as a C++ library.")
 (define-public flint
  (package
   (name "flint")
-   (version "3.4.0")
+   (version "3.2.1")
   (source
    (origin
      (method url-fetch)
      (uri (string-append "https://flintlib.org/download/flint-"
                          version ".tar.gz"))
      (sha256
-       (base32 "0csa8n7d4l3mh892q36nhiv1r7bkb168vszz79p95bfy0jc6g5wl"))))
+       (base32 "0gyjbkhwrmx2vgb1gailnmmzacl4aikzgi70dzmpf8lpfxny8yya"))))
   (build-system gnu-build-system)
+   (inputs
+    (list ntl))
   (propagated-inputs
    (list gmp mpfr)) ; header files included by flint.h or mpfr_mat.h
   (arguments
+      ;; Parallel tests failed in the past on ARM, this may need to be
+      ;; tested again.
+    `(#:parallel-tests? #f
      ;; Prevent build machine specifics from ending up in the binary.
-    '(#:configure-flags '("--disable-assembly")))
+      #:configure-flags '("--disable-assembly")))
   (synopsis "Fast library for number theory")
   (description
    "FLINT is a C library for number theory.  It supports arithmetic
@@ -529,31 +532,19 @@ fast arithmetic.")
   (properties
    '((release-monitoring-url . "http://flintlib.org/downloads.html")))))

-(define-public flint-3.3
-  (package
-   (inherit flint)
-   (version "3.3.1")
-   (source
-    (origin
-      (method url-fetch)
-      (uri (string-append "https://flintlib.org/download/flint-"
-                          version ".tar.gz"))
-      (sha256
-       (base32 "1yzasdcv90f6w926p9g92cli2daxvb0mh2s1w1qskkvn618hxmv4"))))))
-
 (define-public python-flint
  (package
    (name "python-flint")
-    (version "0.8.0")
+    (version "0.7.1")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
-              (url "https://github.com/fredrik-johansson/python-flint")
-              (commit version)))
+             (url "https://github.com/fredrik-johansson/python-flint")
+             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1xdclpxpas29v3g14z2fxqf7hv4a6iq7bknl9d9r1510dcpxm67a"))))
+        (base32 "09nsys2cajxsfh2c13nf98a2kwnm0msmab9f9zcjpkndj4ir453a"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -565,7 +556,7 @@ fast arithmetic.")
           python-pytest))
    (inputs
     (list gmp
-           flint-3.3))
+           flint))
    (propagated-inputs
     (list python-numpy))
    (home-page "https://fredrikj.net/python-flint/")
@@ -627,7 +618,7 @@ matrices, and polynomials over the integers and over finite fields.")
 (define-public singular
  (package
   (name "singular")
-   (version "4.4.1p5")
+   (version "4.4.1")
   (source
    (origin
      (method url-fetch)
@@ -643,7 +634,7 @@ matrices, and polynomials over the integers and over finite fields.")
                      "/singular-" version ".tar.gz"))
            (sha256
              (base32
-               "1pwygpmhf4sddf1v5x5fr1kbbkb29wlfd5yyj7lryvhbs45s9rdw"))))
+               "16xlhar1krlskh9gxbw1gw4qi8248c95w71vzxdw72avs2pblkva"))))
   (build-system gnu-build-system)
   (arguments
    (list
@@ -817,80 +808,6 @@ a C program.")
 principle, 'Keep It Simple, Stupid.'")
    (license license:bsd-3)))

-(define-public kissfft-for-tflite-micro
-  (package
-    (inherit kissfft)
-    (name "kissfft-for-tflite-micro")
-    (version "130")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/mborgerding/kissfft")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        "137h3pkn6jmc3pcgnqsq481f6jjblx7ygw9gyipgcdysmnhrwiv2")
-       (patches (search-patches "kissfft-tflite-micro.patch"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (delete 'build)
-          (replace 'install
-            (lambda _
-              (for-each (lambda (f)
-                          (install-file f
-                                        (string-append #$output "/include")))
-                        '("kiss_fft.h" "kissfft.hh"))
-              (for-each (lambda (f)
-                          (install-file f
-                                        (string-append #$output
-                                                       "/include/tools")))
-                        (find-files "tools"))))
-          (replace 'check
-            (lambda* (#:key tests? #:allow-other-keys)
-              (when tests?
-                (invoke "make" "CC=gcc" "testall")))))))
-    (native-inputs (list procps))
-    (inputs (list fftw))))
-
-(define-public clac
-  (package
-    (name "clac")
-    (version "0.3.4")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/soveran/clac")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        "0crpm5rxxipiz6kqs5ip900d77vvnslyjn5f6nj0lrc86bkbgi8d")))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:test-target "test"
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (add-before 'build 'set-env
-            (lambda _
-              (setenv "CC" "gcc")
-              (setenv "PREFIX" #$output))))))
-    (home-page "https://github.com/soveran/clac")
-    (synopsis "Command-line, stack-based calculator with postfix notation")
-    (description
-     "Clac is a command line, stack-based calculator with postfix notation
-that displays the stack contents at all times.  As you type, the stack
-changes are reflected immediately.")
-    ;; Bundles two dependencies, both also BSD-2. SDS is not yet packaged.
-    ;; linenoise is packaged, but the package doesn't provide shared
-    ;; object files so we have to build it anyway.
-    (license license:bsd-2)))
 (define-public fftw
  (package
    (name "fftw")
@@ -1984,14 +1901,14 @@ no more than about 20 bits long).")
 (define-public r-dtt
  (package
    (name "r-dtt")
-    (version "0.1-2.1")
+    (version "0.1-2")
    (source
      (origin
        (method url-fetch)
        (uri (cran-uri "dtt" version))
        (sha256
          (base32
-            "113qb6fjp08gcmv4cgq3cm2fk6k3r3j1wfsrygq8889i2bq4a073"))))
+            "0n8gj5iylfagdbaqirpykb01a9difsy4zl6qq55f0ghvazxqdvmn"))))
    (properties `((upstream-name . "dtt")))
    (build-system r-build-system)
    (home-page "https://www.r-project.org")
@@ -2298,3 +2215,38 @@ systems.  This encompasses:
@item the computation of the dimension and the degree of the solution set.
@end itemize")
    (license license:gpl2+)))
+
+(define-public clac
+  (package
+    (name "clac")
+    (version "0.3.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/soveran/clac")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        "0crpm5rxxipiz6kqs5ip900d77vvnslyjn5f6nj0lrc86bkbgi8d")))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:test-target "test"
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (add-before 'build 'set-env
+            (lambda _
+              (setenv "CC" "gcc")
+              (setenv "PREFIX" #$output))))))
+    (home-page "https://github.com/soveran/clac")
+    (synopsis "Command-line, stack-based calculator with postfix notation")
+    (description
+     "Clac is a command line, stack-based calculator with postfix notation
+that displays the stack contents at all times.  As you type, the stack
+changes are reflected immediately.")
+    ;; Bundles two dependencies, both also BSD-2. SDS is not yet packaged.
+    ;; linenoise is packaged, but the package doesn't provide shared
+    ;; object files so we have to build it anyway.
+    (license license:bsd-2)))
@@ -1306,58 +1306,50 @@ emulator inside the comfort of Emacs.")
  (package
    (name "enjarify")
    (version "1.0.3")
+    (home-page "https://github.com/Storyyeller/enjarify")
    (source
     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/Storyyeller/enjarify")
-              (commit version)))
-       (file-name (git-file-name name version))
-       (patches
-        (search-patches "enjarify-setup-py.patch"))
-       (sha256
-        (base32 "1nam7h1g4f1h6jla4qcjjagnyvd24dv6d5445w04q8hx07nxdapk"))))
-    (build-system pyproject-build-system)
+      (method git-fetch)
+      (uri (git-reference
+            (url home-page)
+            (commit version)))
+      (file-name (git-file-name name version))
+      (patches
+       (search-patches "enjarify-setup-py.patch"))
+      (sha256
+       (base32
+        "1nam7h1g4f1h6jla4qcjjagnyvd24dv6d5445w04q8hx07nxdapk"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'fix-tests
-            (lambda _
-              (substitute* "enjarify/runtests.py"
-                (("from \\.main") "from enjarify.main")
-                (("from \\.jvm") "from enjarify.jvm"))
-              ;; Upstream adjusted this test in commit:
-              ;; 3ae884a6485af82d300515813f537685b08dd800
-              (substitute* "tests/test2/expected.txt"
-                (("^20") "0"))
-              ;; Upstream removed this argument in order to support 32-bit
-              ;; architectures.  commit:
-              ;; 4be0111d879aa95fdc0d9f24fe529f8c664d4093
-              (substitute* "enjarify/runtests.py"
-                (("java -Xss515m") "java "))))
-          (add-after 'install 'install-enjarify-wrapper
-            (lambda _
-              (let ((bin (string-append #$output "/bin")))
-                (install-file "enjarify.sh" bin)
-                (symlink (string-append bin "/enjarify.sh")
-                         (string-append bin "/enjarify")))))
-          (replace 'check
-            (lambda* (#:key tests? test-flags #:allow-other-keys)
-              (when tests?
-                (invoke "python" "-m" "enjarify.runtests")))))))
-    (native-inputs
-     (list openjdk12
-           python-setuptools))
-    (home-page "https://github.com/Storyyeller/enjarify")
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-before 'check 'fixup-expected-test-results
+           ;; Upstream adjusted this test in commit:
+           ;; 3ae884a6485af82d300515813f537685b08dd800
+           (lambda _
+             (substitute* "tests/test2/expected.txt"
+               (("^20") "0"))
+             #t))
+         (add-before 'check 'drop-java-xss-argument
+           ;; Upstream removed this argument in order to support 32-bit
+           ;; architectures.  commit: 4be0111d879aa95fdc0d9f24fe529f8c664d4093
+           (lambda _
+             (substitute* "enjarify/runtests.py"
+               (("java -Xss515m") "java "))
+             #t))
+         (add-after 'install 'install-enjarify-wrapper
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((out (assoc-ref outputs "out")))
+                 (mkdir-p (string-append out "/bin/"))
+                 (copy-file "enjarify.sh" (string-append out "/bin/enjarify"))
+                 #t))))))
+    (native-inputs (list openjdk12))
    (synopsis "Translate Dalvik bytecode to equivalent Java bytecode")
-    (description
-     "Android applications are Java programs that run on a customized virtual
-machine, which is part of the Android operating system, the Dalvik VM.  Their
-bytecode differs from the bytecode of normal Java applications.  Enjarify can
-translate the Dalvik bytecode back to equivalent Java bytecode, which
-simplifies the analysis of Android applications.  It's an alternative fork of
-not maintained Goole's project https://github.com/google/enjarify.")
+    (description "Android applications are Java programs that run on a
+customized virtual machine, which is part of the Android operating system, the
+Dalvik VM.  Their bytecode differs from the bytecode of normal Java
+applications.  Enjarify can translate the Dalvik bytecode back to equivalent
+Java bytecode, which simplifies the analysis of Android applications.")
    (license license:asl2.0)))

 (define-public android-file-transfer
@@ -83,7 +83,6 @@
                  (guix build cmake-build-system)
                  (guix build utils))
      #:phases
-      (with-extensions (list (cargo-guile-json))
      #~(modify-phases %standard-phases
          (add-after 'unpack 'prepare-cargo-build-system
            (lambda args
@@ -112,7 +111,7 @@
                (substitute* "unit_tests/CMakeLists.txt"
                  (("clamd_test\\.py" test)
                   (string-append
-                    test " -k \"not test_clamd_08_VirusEvent\""))))))))))
+                    test " -k \"not test_clamd_08_VirusEvent\"")))))))))
    (native-inputs
     (append
      (list pkg-config
@@ -15,7 +15,7 @@
 ;;; Copyright © 2021 Sergiu Ivanov <sivanov@colimite.fr>
 ;;; Copyright © 2023 Yovan Naumovski <yovan@gorski.stream>
 ;;; Copyright © 2023 Zheng Junjie <873216071@qq.com>
-;;; Copyright © 2024, 2025 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2024 Maxim Cournoyer <maxim@guixotic.coop>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -482,34 +482,3 @@ European languages.")
                      (for-each (cut install-file <> include-dir)
                                '("config.h" "defhash.h" "ispell.h"
                                  "libispell.h" "local.h")))))))))))))
-
-(define-public spell
-  (package
-    (name "spell")
-    (version "1.1")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "mirror://gnu/spell/spell-" version ".tar.gz"))
-       (sha256
-        (base32 "0i4pqbhzkv5y4c2j7ajx713jykxsnn4dqdcqfvzn04xkgra47hkw"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list #:phases
-           #~(modify-phases %standard-phases
-               (add-after 'unpack 'patch-commands
-                 (lambda* (#:key inputs #:allow-other-keys)
-                   (substitute* "spell.c"
-                     (("aspell")
-                      (search-input-file inputs "bin/aspell"))
-                     (("ispell_prog = \"ispell\"")
-                      (format #f "ispell_prog = ~s"
-                              (search-input-file inputs "bin/ispell")))))))))
-    (inputs (list aspell ispell))
-    (synopsis "Spell checking")
-    (description
-     "Spell is a command-line spell-checking program.  It reads through
-a text input and prints each misspelled word on a line of its own.  It is
-implemented as a wrapper for GNU aspell or ispell.")
-    (home-page "https://savannah.gnu.org/projects/spell/")
-    (license gpl3+)))
@@ -31,7 +31,7 @@
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
 ;;; Copyright © 2020, 2021 Guillaume Le Vaillant <glv@posteo.net>
 ;;; Copyright © 2020 Jonathan Frederickson <jonathan@terracrypt.net>
-;;; Copyright © 2020, 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2020, 2024 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2020, 2021, 2023 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2020 Michael Rohleder <mike@rohleder.de>
 ;;; Copyright © 2021 jgart <jgart@dismail.de>
@@ -58,7 +58,6 @@
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2025 Antoine Côté <antoine.cote@posteo.net>
 ;;; Copyright © 2025 Isidor Zeuner <guix@quidecco.pl>
-;;; Copyright © 2025 Evgenii Klimov <eugene.dev@lipklim.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -250,39 +249,6 @@ promoting the market for advanced audio.")
    (home-page "https://www.khronos.org/opensles/")
    (license (license:non-copyleft "file:///LICENSE.txt"))))

-(define-public python-sounddevice
-  (package
-    (name "python-sounddevice")
-    (version "0.5.3")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "sounddevice" version))
-       (sha256
-        (base32 "0b4vcaj79sy9aqsrgcszkp35x2fc0i4pqzk96d2viflg35h2pb6b"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list #:tests? #false		; no tests
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-after 'patch-generated-file-shebangs 'add-path-to-portaudio
-                 (lambda* (#:key inputs #:allow-other-keys)
-                   (substitute* "sounddevice.py"
-                     (("_find_library\\(_libname\\)")
-                      (string-append "\""
-                                     (search-input-file inputs
-                                                        "/lib/libportaudio.so.2")
-                                     "\""))))))))
-    (inputs (list portaudio))
-    (propagated-inputs (list python-cffi python-numpy))
-    (native-inputs (list python-setuptools))
-    (home-page "https://python-sounddevice.readthedocs.io/")
-    (synopsis "Play and record sound with Python")
-    (description "This Python module provides bindings for the PortAudio
-library and a few convenience functions to play and record NumPy arrays
-containing audio signals.")
-    (license license:expat)))
-
 (define-public wildmidi
  (package
    (name "wildmidi")
@@ -814,7 +780,7 @@ streams from live audio.")
 (define-public dsp
  (package
    (name "dsp")
-    (version "2.0")
+    (version "1.9")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -823,7 +789,7 @@ streams from live audio.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1kzjv972qbvzh7nml3brrdf6qmjmcapldbikbn2gxhpmkgxzhhar"))))
+                "0iksmianwig7w78hqip2a8yy6r63sv8cv9pis8qxny6w1xap6njb"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -1224,7 +1190,7 @@ engineers, musicians, soundtrack editors and composers.")
 (define-public audacity
  (package
    (name "audacity")
-    (version "3.7.7")
+    (version "3.7.4")
    (source
     (origin
       (method git-fetch)
@@ -1233,7 +1199,7 @@ engineers, musicians, soundtrack editors and composers.")
             (commit (string-append "Audacity-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0h2xdhbx6bjhlk2mxqalpbpzjcdj0sb8wf1rp3vj0fbgvxy1y92k"))
+        (base32 "184hak52p00qid0i581gky7076fl5rjxwqly0fw7ix8yi6j8li4h"))
       (patches (search-patches "audacity-ffmpeg-fallback.patch"))
       (modules '((guix build utils)))
       (snippet
@@ -1961,7 +1927,7 @@ synthesis.")
 (define-public snapcast
  (package
    (name "snapcast")
-    (version "0.34.0")
+    (version "0.32.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1970,7 +1936,7 @@ synthesis.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0jqzzjw1njixapj89yvgbhk7yrfc14xsfd94pf6z6lfna8c01yq4"))))
+                "06hllji1621f29g6ymbysi1vkndjsrwj63f5ph30f6kvv3c8sqx4"))))
    (build-system cmake-build-system)
    (arguments '(#:tests? #f))                    ;no included tests
    (inputs
@@ -2078,8 +2044,6 @@ emulation (valve, tape), bit fiddling (decimator, pointer-cast), etc.")
       (sha256
        (base32 "0g0yfmwmrkvrkvynx84bays6jph3wq2hq1md5ylr7n5a8g0c17hn"))))
    (build-system cmake-build-system)
-    (arguments
-     (list #:tests? #f))
    (native-inputs
     (list boost pkg-config))
    (inputs
@@ -2902,7 +2866,7 @@ partial release of the General MIDI sound set.")
                    (("'rU'") "'r'")))))))
    (inputs
     (list libsndfile
-           boost-1.83
+           boost
           curl
           avahi
           eigen
@@ -4472,7 +4436,7 @@ link REQUIRED)"))))))
                  eudev                 ;for user interactions with devices
                  avahi                 ;zeroconf service discovery support
                  icu4c
-                  boost-1.83
+                  boost
                  boost-sync
                  yaml-cpp
                  python-wrapper        ;there were warnings in the build process
@@ -4654,21 +4618,21 @@ tempo and pitch of an audio recording independently of one another.")
 (define-public rtmidi
  (package
    (name "rtmidi")
-    (version "6.0.0")
+    (version "5.0.0")
    (source (origin
              (method url-fetch)
-              (uri (string-append "https://caml.music.mcgill.ca/~gary/rtmidi"
+              (uri (string-append "https://www.music.mcgill.ca/~gary/rtmidi"
                                  "/release/rtmidi-" version ".tar.gz"))
              (file-name (string-append "rtmidi-" version ".tar.gz"))
              (sha256
               (base32
-                "0nyvck6qlncbfpplgxspjk77fmi05w78ik0cf8039hj29gvcqq2r"))))
+                "1ff2yfq3k4l209fr71v3w98fpjjv1chs09vkbmxj03lcikahxns8"))))
    (build-system gnu-build-system)
    (inputs
     (list alsa-lib jack-2))
    (native-inputs
     (list autoconf automake libtool pkg-config))
-    (home-page "https://caml.music.mcgill.ca/~gary/rtmidi")
+    (home-page "https://www.music.mcgill.ca/~gary/rtmidi")
    (synopsis "Cross-platform MIDI library for C++")
    (description
     "RtMidi is a set of C++ classes (RtMidiIn, RtMidiOut, and API specific
@@ -6194,41 +6158,6 @@ the following features:
 ")
    (license license:lgpl3+)))

-(define-public normalize
-  (package
-    (name "normalize")
-    (version "0.7.7")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append
-             "http://download.savannah.gnu.org/releases/normalize/normalize-"
-             version ".tar.gz"))
-       (sha256
-        (base32 "1n5khss10vjjp6w69q9qcl4kqfkd0pr555lgqghrchn6rjms4mb0"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:make-flags
-      #~(list "CFLAGS=-g -O2 -Wno-error=implicit-function-declaration")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'patch-shell-path
-            (lambda* (#:key inputs #:allow-other-keys)
-              (substitute* "test/Makefile.in"
-                (("/bin/sh")
-                 (search-input-file inputs "/bin/sh"))))))))
-    (inputs (list libmad))
-    (home-page "https://normalize.nongnu.org/")
-    (synopsis "Audio track volume normalizer")
-    (description
-     "@code{normalize} is an audio track normalizer.
-For a collection of tracks with varying volumes, it is able to
-make the loudness consistent between them.  This is helpful
-when making mixtapes, for example.
-It can work with WAV and MP3 files.")
-    (license license:gpl2)))
-
 (define-public lv2-speech-denoiser
  (let ((commit "04cfba929630404f8d4f4ca5bac8d9b09a99152f")
        (revision "1"))
@@ -7735,7 +7664,7 @@ and DSD streams.")
 (define-public qpwgraph
  (package
    (name "qpwgraph")
-    (version "0.9.7")
+    (version "0.9.6")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -7744,7 +7673,7 @@ and DSD streams.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1j3na9svy0rvz84rl9g2szl3rqxfyi5rqk1i12hdiwnyi6q7ppxi"))))
+                "17f84qp0vphw0qbgi4yzvws19cw1lppn5r35niy032gw8qr7l6nf"))))
    (build-system cmake-build-system)
    (arguments
     (list #:tests? #f))                ; no tests
@@ -7940,7 +7869,7 @@ verifies checksums.")
           fmt
           gsl
           gtk
-           nlohmann-json
+           json-modern-cxx ;nlohmann_json
           libadwaita
           libbs2b
           libebur128
@@ -221,13 +221,8 @@ YubiKey into your existing user authentication infrastructure.")
       (sha256
        (base32 "1mdj1wj0adcnx354fs17928yn2xfr1hj5mfraq282dagi873sqw3"))))
    (build-system gnu-build-system)
-    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'force-reconfigure
-           (lambda _ (delete-file "configure"))))))
    (native-inputs
-     (list autoconf automake libtool pkg-config))
+     (list pkg-config))
    (inputs
     (list linux-pam))
    (home-page "https://pamtester.sourceforge.net/")
@@ -157,7 +157,7 @@ know anything about Autoconf or M4.")
       (base32
        "0niz4852fgyavfh3gr4h4kzalk01nk70v6vfsja6r3ap349mr25s"))))))

-(define-public autoconf autoconf-2.69)
+(define-public autoconf autoconf-2.72)

 (define-public autoconf-2.68
  (package (inherit autoconf)
@@ -438,14 +438,14 @@ Makefile, simplifying the entire process for the developer.")
 (define-public automake
  (package/inherit automake-1.16.5
    (name "automake")
-    (version "1.17")
+    (version "1.18.1")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/automake/automake-"
                                  version ".tar.xz"))
              (sha256
               (base32
-                "146rkdcwri2dkwn3pjrjs9v0wm4xyav9vvq4yw5vj4qy87yc2849"))
+                "11v8ckqx7z8hv4mq9dnhg58cwnssaa7l9136yndbhlc34xis72hn"))
              (patches
               (search-patches "automake-skip-amhello-tests.patch"))))
    (arguments
@@ -483,16 +483,14 @@ Makefile, simplifying the entire process for the developer.")
 (define-public libtool
  (package
    (name "libtool")
-    (version "2.4.7")
+    (version "2.5.4")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/libtool/libtool-"
                                  version ".tar.xz"))
              (sha256
               (base32
-                "0pb3l4x37k6fj1lwnpzws55gi3pxl0hx56jm4bzmbrkw0mzj2zsg"))
-              (patches (search-patches "libtool-skip-tests2.patch"
-                                       "libtool-grep-compat.patch"))))
+                "0xb64rhambx6mhxwr613xgyad7ybs5hgmpmd9gccf2vbcrh5h7zq"))))
    (build-system gnu-build-system)
    (propagated-inputs (list m4))
    (native-inputs
@@ -518,6 +516,12 @@ Makefile, simplifying the entire process for the developer.")

       #:phases
       (modify-phases %standard-phases
+         (add-after 'unpack 'skip-some-tests-on-extra-archs
+           (lambda _
+             (with-directory-excursion "tests"
+               (substitute* '("demo.at" "testsuite")
+                 (("hppa\\*\\|amd64\\*\\|x86_64\\*\\|s390\\*" all)
+                  (string-append all "|arm*|mips*|riscv*"))))))
         (add-before 'check 'pre-check
           (lambda* (#:key inputs native-inputs parallel-tests? #:allow-other-keys)
             ;; Run the test suite in parallel, if possible.
@@ -205,24 +205,11 @@ mirror_directory (const char *source, const char *target,
 	  /* Create the mount point.  */
 	  int err = firmlink (abs_source, entry, new_entry);

-	  int is_directory = 0;
-	  if (entry->d_type == DT_UNKNOWN)
-	    {
-	      struct stat statbuf;
-	      if (fstatat (dir_fd, entry->d_name, &statbuf,
-			   AT_SYMLINK_NOFOLLOW) < 0)
-		assert_perror (errno);
-	      if ((statbuf.st_mode & S_IFMT) == S_IFDIR)
-		is_directory = 1;
-	    }
-	  else if (entry->d_type == DT_DIR)
-	    is_directory = 1;
-
 	  /* It used to be that only directories could be bind-mounted.  Thus,
 	     keep going if we fail to bind-mount a non-directory entry.
 	     That's OK because regular files in the root file system are
 	     usually uninteresting.  */
-	  if (err != 0 && is_directory == 0)
+	  if (err != 0 && entry->d_type != DT_DIR)
 	    assert_perror (errno);

 	  free (new_entry);
@@ -21,10 +21,10 @@
 ;;; Copyright © 2021 Timothy Sample <samplet@ngyro.com>
 ;;; Copyright © 2021 Brice Waegeneire <brice@waegenei.re>
 ;;; Copyright © 2021 Sarah Morgensen <iskarian@mgsn.dev>
-;;; Copyright © 2022 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2022, 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2022 Feng Shu <tumashu@163.com>
 ;;; Copyright © 2023 Timo Wilken <guix@twilken.net>
-;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
+;;; Copyright © 2023-2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024 jgart <jgart@dismail.de>
 ;;; Copyright © 2025 Kjartan Oli Agustsson <kjartanoli@outlook.com>
 ;;; Copyright © 2025 mstenek <mstenek@disroot.org>
@@ -54,7 +54,6 @@
  #:use-module (guix build-system qt)
  #:use-module (guix download)
  #:use-module (guix gexp)
-  #:use-module (guix gexp)
  #:use-module (guix git-download)
  #:use-module (guix packages)
  #:use-module (guix utils)
@@ -109,7 +108,8 @@
  #:use-module (gnu packages time)
  #:use-module (gnu packages tls)
  #:use-module (gnu packages valgrind)
-  #:use-module (gnu packages xml))
+  #:use-module (gnu packages xml)
+  #:use-module (ice-9 format))

 (define-public duplicity
  (package
@@ -264,7 +264,7 @@ backups (called chunks) to allow easy burning to CD/DVD.")
 (define-public libarchive
  (package
    (name "libarchive")
-    (version "3.7.7")
+    (version "3.8.3")
    (source
     (origin
       (method url-fetch)
@@ -275,7 +275,7 @@ backups (called chunks) to allow easy burning to CD/DVD.")
                                 version ".tar.xz")))
       (sha256
        (base32
-         "1vps57mrpqmrk4zayh5g5amqfq7031s5zzkkxsm7r71rqf1wv6l7"))))
+         "124pp4w6n8xqdwjswc5d4d6kkrgxv67f9xlhgg7934zii4mizqlh"))))
    (build-system gnu-build-system)
    (inputs
     (list bzip2
@@ -287,63 +287,52 @@ backups (called chunks) to allow easy burning to CD/DVD.")
           `(,zstd "lib")))
    (arguments
     (list
+      ;; Embed absolute references to inputs to avoid propagation.
      #:configure-flags
-      #~'("--disable-static"
-          ;; Because of the circular dependency, we cannot use openssl here.
-          ;; Explicitly disable openssl to avoid unnecessary dependencies in the
-          ;; pc file.
-          "--without-openssl")
+      #~(list "--disable-static"
+              (format #f "LIBS=~{-L~a/lib~^ ~}"
+                      '#$(map (lambda (x)
+                                (this-package-input (car x)))
+                              (package-inputs this-package)))
+              ;; Because of the circular dependency, we cannot use openssl here.
+              ;; Explicitly disable openssl to avoid unnecessary dependencies in the
+              ;; pc file.
+              "--without-openssl")
      #:phases
      #~(modify-phases %standard-phases
-          (add-before 'build 'patch-pwd
+          (add-before 'build 'patch-commands
            (lambda _
              (substitute* "Makefile"
-                (("/bin/pwd") (which "pwd")))))
+                (("/bin/pwd") (which "pwd")))
+              (substitute* "test_utils/test_main.c"
+                (("/bin/sh") (which "sh")))))
          (replace 'check
-            (lambda* (#:key tests? #:allow-other-keys)
+            (lambda* (#:key parallel-build? tests? #:allow-other-keys)
              (if tests?
-		  ;; XXX: The test_owner_parse, test_read_disk, and
-		  ;; test_write_disk_lookup tests expect user 'root' to
-		  ;; exist, but the chroot's /etc/passwd doesn't have
-		  ;; it.  Turn off those tests.
                  (begin
-		    ;; The tests allow one to disable tests matching a globbing pattern.
-		    (invoke "make"
+                    ;; These environment variables are taken from
+                    ;; <https://raw.githubusercontent.com/libarchive/libarchive/refs/heads/master/.github/workflows/ci.yml>
+                    (setenv "SKIP_OPEN_FD_ERR_TEST" "1")
+                    (setenv "IGNORE_TRAVERSALS_TEST4" "1")
+
+		    ;; XXX: The test_owner_parse, test_read_disk, and
+		    ;; test_write_disk_lookup tests expect user 'root' to
+		    ;; exist, but the chroot's /etc/passwd doesn't have it
+		    ;; (see:
+		    ;; <https://github.com/libarchive/libarchive/issues/2794>).
+		    (invoke "make" "-j" (number->string
+                                         (if parallel-build?
+                                             (parallel-job-count)
+                                             1))
 			    "libarchive_test"
 			    "bsdcpio_test"
 			    "bsdtar_test")
-
 		    ;; XXX: This glob disables too much.
 		    (invoke "./libarchive_test" "^test_*_disk*")
 		    (invoke "./bsdcpio_test" "^test_owner_parse")
 		    (invoke "./bsdtar_test"))
                  ;; Tests may be disabled if cross-compiling.
-                  (format #t "Test suite not run.~%"))))
-          (add-after 'install 'add--L-in-libarchive-pc
-            (lambda* (#:key inputs outputs #:allow-other-keys)
-              (let* ((out     #$output)
-                     (lib     (string-append out "/lib"))
-                     (nettle  (assoc-ref inputs "nettle"))
-                     (libxml2 (assoc-ref inputs "libxml2"))
-                     (xz      (assoc-ref inputs "xz"))
-                     (zlib    (assoc-ref inputs "zlib"))
-                     (zstd    (assoc-ref inputs "zstd"))
-                     (bzip2   (assoc-ref inputs "bzip2")))
-                ;; Embed absolute references to these inputs to avoid propagation.
-                (substitute* (list (string-append lib "/pkgconfig/libarchive.pc")
-                                   (string-append lib "/libarchive.la"))
-                  (("-lnettle")
-                   (string-append "-L" nettle "/lib -lnettle"))
-                  (("-lxml2")
-                   (string-append "-L" libxml2 "/lib -lxml2"))
-                  (("-llzma")
-                   (string-append "-L" xz "/lib -llzma"))
-                  (("-lz")
-                   (string-append "-L" zlib "/lib -lz"))
-                  (("-lzstd")
-                   (string-append "-L" zstd "/lib -lzstd"))
-                  (("-lbz2")
-                   (string-append "-L" bzip2 "/lib -lbz2")))))))))
+                  (format #t "Test suite not run.~%")))))))
    (home-page "https://libarchive.org/")
    (synopsis "Multi-format archive and compression library")
    (description
@@ -574,13 +563,13 @@ rsnapshot uses hard links to deduplicate identical files.")
 (define-public borg
  (package
    (name "borg")
-    (version "1.4.3")
+    (version "1.4.1")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "borgbackup" version))
       (sha256
-        (base32 "07s4jqcv03s98hi6lvqpvmnnhl532qnvv11mjy2xc08rbmsgmfvr"))
+        (base32 "0f9qj05i02aj17lhk97fqyknb1jx3h9xr8d569mhp44xq7qziyxq"))
       (snippet
        #~(begin
            ;; Delete files generated by Cython.  We used to have a regex that
@@ -1001,6 +990,38 @@ restic's REST backend API.  It provides a secure and efficient way to backup
 data remotely, using the restic backup client and a @code{rest:} URL.")
    (license license:bsd-2)))

+(define-public zbackup
+  (package
+    (name "zbackup")
+    (version "1.4.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/zbackup/zbackup")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "14l1kyxg7pccpax3d6qcpmdycb70kn3fxp1a59w64hqy2493hngl"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:tests? #f))                    ;no test
+    (inputs
+     (list lzo libressl protobuf-3.6 xz zlib))
+    (home-page "http://zbackup.org")
+    (synopsis "Versatile deduplicating backup tool")
+    (description
+     "ZBackup is a globally-deduplicating backup tool, based on the
+ideas found in Rsync.  Feed a large @file{.tar} into it, and it will
+store duplicate regions of it only once, then compress and optionally
+encrypt the result.  Feed another @file{.tar} file, and it will also
+re-use any data found in any previous backups.  This way only new
+changes are stored, and as long as the files are not very different,
+the amount of storage required is very low.  Any of the backup files
+stored previously can be read back in full at any time.  The program
+is format-agnostic, so you can feed virtually any files to it.")
+    (license license:gpl2+)))
+
 (define-public dump
  (package
    (name "dump")
@@ -1209,42 +1230,39 @@ compression parameters used by Gzip.")
 (define-public borgmatic
  (package
    (name "borgmatic")
-    (version "2.0.13")
+    (version "2.0.7")
    (source
     (origin
-       ;; PyPI archive does not contain NEWS file needed for one test.
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://projects.torsion.org/borgmatic-collective/borgmatic")
-              (commit version)))
-       (file-name (git-file-name name version))
+       (method url-fetch)
+       (uri (pypi-uri "borgmatic" version))
       (sha256
-        (base32
-         "05w3j4knhsg4w0a0yrz8c7lvz3vp3nf95ddmql9i8mqknjqddm1v"))))
+        (base32 "01l44ny2zyn7x1hhbvhhhwr12jipcjxl3j1cz13kf6c3bdfwms8y"))))
    (build-system pyproject-build-system)
    (arguments
     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'configure
-            (lambda* (#:key inputs #:allow-other-keys)
-              ;; Set absolute store path to borg.
-              (substitute* "borgmatic/commands/borgmatic.py"
-                (("\\.get\\('local_path', 'borg'\\)")
-                 (string-append ".get('local_path', '"
-                                (search-input-file inputs "bin/borg")
-                                "')")))
-              (substitute* "tests/unit/commands/test_borgmatic.py"
-                (("(module.get_local_path.+ == )'borg'" all start)
-                 (string-append start "'"
-                                (search-input-file inputs "bin/borg")
-                                "'")))))
-          (add-before 'check 'set-path
-            (lambda _
-              ;; Tests require the installed executable.
-              (setenv "PATH"
-                      (string-append #$output "/bin" ":"
-                                     (getenv "PATH"))))))))
+      ;; XXX: all tests fail with error: AttributeError: module
+      ;; '_pytest.runner' has no attribute 'call_runtest_hook'.
+      #:tests? #f
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'unpack 'configure
+                     (lambda* (#:key inputs #:allow-other-keys)
+                       ;; Set absolute store path to borg.
+                       (substitute* "borgmatic/commands/borgmatic.py"
+                         (("\\.get\\('local_path', 'borg'\\)")
+                          (string-append ".get('local_path', '"
+                                         (search-input-file inputs "bin/borg")
+                                         "')")))
+                       (substitute* "tests/unit/commands/test_borgmatic.py"
+                         (("(module.get_local_path.+ == )'borg'" all start)
+                          (string-append start "'"
+                                         (search-input-file inputs "bin/borg")
+                                         "'")))))
+                   (add-before 'check 'set-path
+                     (lambda _
+                         ;; Tests require the installed executable.
+                         (setenv "PATH"
+                                 (string-append #$output "/bin" ":"
+                                                (getenv "PATH"))))))))
    (native-inputs
     (list python-flexmock
           python-pytest
@@ -1269,7 +1287,7 @@ borgmatic is powered by borg.")
 (define-public vorta
  (package
    (name "vorta")
-    (version "0.11.1")
+    (version "0.10.3")
    ;; The test folder is not included in the PyPI archive.
    (source (origin
              (method git-fetch)
@@ -1279,7 +1297,7 @@ borgmatic is powered by borg.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "16r9ch80i6nfngah634id16fqnmn62ayh60j62zxn5cfivcn3wsq"))))
+                "0b4042a0lpbmwlmbh5559b2x9vr2055w6jjrs7088n45d7rkn4sn"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@@ -107,6 +107,7 @@
              (sha256
               (base32
                "1aqq1379syjckf0wdn9vs6wfbapnj9zfikhiykf29k4jq9nrk6js"))))
+    (outputs (list "out" "debug"))
    (build-system gnu-build-system)
    (synopsis "Example GNU package")
    (description
@@ -264,12 +265,6 @@ implementation offers several extensions over the standard utility.")
                     ",!chained renames"
                     ",!Directory"
                     "'"))))
-          ;; 'storing sparse files > 8G' fails on powerpc-linux, likely
-          ;; due to the small HDD and RAM present on these devices.
-          ((target-ppc32?)
-           '(#:make-flags (list (string-append "TESTSUITEFLAGS= -k "
-                                               "'!tricky time stamps"
-                                               ",!storing sparse files > 8G'"))))
          ;; https://lists.gnu.org/archive/html/bug-tar/2021-10/msg00007.html
          ;; tar-1.34 isn't aware of 64-bit time_t and upstream suggests
          ;; skipping the test for this release on 32-bit systems.
@@ -700,62 +695,75 @@ change.  GNU make offers many powerful extensions over the standard utility.")

 (define-public binutils
  (package
-   (name "binutils")
-   (version "2.44")
-   (source
-    (origin
-      (method url-fetch)
-      (uri (string-append "mirror://gnu/binutils/binutils-"
-                          version ".tar.bz2"))
-      (sha256
-       (base32 "0fnwaasfglbphqzvz5n25js9gl695p7pjbmb1z81g8gsc6k90qzn"))
-      (patches (search-patches
-                "binutils-2.41-fix-cross.patch"
-                "binutils-loongson-workaround.patch"))))
-   (build-system gnu-build-system)
-   (arguments
-    (list #:out-of-source? #t ;recommended in the README
-          #:configure-flags #~'(;; Add `-static-libgcc' to not retain a dependency
-                                ;; on GCC when bootstrapping.
-                                "LDFLAGS=-static-libgcc"
+    (name "binutils")
+    (version "2.44")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://gnu/binutils/binutils-"
+                           version ".tar.bz2"))
+       (sha256
+        (base32 "0fnwaasfglbphqzvz5n25js9gl695p7pjbmb1z81g8gsc6k90qzn"))
+       (patches (search-patches
+                 "binutils-2.41-fix-cross.patch"
+                 "binutils-loongson-workaround.patch"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:out-of-source? #t          ;recommended in the README
+           #:configure-flags
+           #~'( ;; Add `-static-libgcc' to not retain a dependency
+               ;; on GCC when bootstrapping.
+               "LDFLAGS=-static-libgcc"

-                                ;; Turn on --enable-new-dtags by default to make the
-                                ;; linker set RUNPATH instead of RPATH on binaries.
-                                ;; This is important because RUNPATH can be overriden
-                                ;; using LD_LIBRARY_PATH at runtime.
-                                "--enable-new-dtags"
+               ;; Turn on --enable-new-dtags by default to make the
+               ;; linker set RUNPATH instead of RPATH on binaries.
+               ;; This is important because RUNPATH can be overriden
+               ;; using LD_LIBRARY_PATH at runtime.
+               "--enable-new-dtags"

-                                ;; Don't search under /usr/lib & co.
-                                "--with-lib-path=/no-ld-lib-path"
+               ;; Don't search under /usr/lib & co.
+               "--with-lib-path=/no-ld-lib-path"

-                                ;; Install BFD.  It ends up in a hidden directory,
-                                ;; but it's here.
-                                "--enable-install-libbfd"
+               ;; Install BFD.  It ends up in a hidden directory,
+               ;; but it's here.
+               "--enable-install-libbfd"

-                                ;; Make sure 'ar' and 'ranlib' produce archives in a
-                                ;; deterministic fashion.
-                                "--enable-deterministic-archives"
+               ;; Make sure 'ar' and 'ranlib' produce archives in a
+               ;; deterministic fashion.
+               "--enable-deterministic-archives"

-                                "--enable-64-bit-bfd"
-                                "--enable-compressed-debug-sections=all"
-                                "--enable-lto"
-                                "--enable-separate-code"
-                                "--enable-threads")
+               "--enable-64-bit-bfd"
+               ;; Note: Do not enable compression here, as dwz cannot process
+               ;; compressed debug sections.
+               "--enable-lto"
+               "--enable-separate-code"
+               "--enable-threads")
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'unpack 'use-zstd-compression-level-19
+                 (lambda _
+                   ;; The default level (3) is hard-coded.  Use a higher level to
+                   ;; compact debug sections as much as possible.
+                   (substitute* "bfd/compress.c"
+                     (("ZSTD_CLEVEL_DEFAULT") "19")))))

-          ;; For some reason, the build machinery insists on rebuilding .info
-          ;; files, even though they're already provided by the tarball.
-          #:make-flags #~'("MAKEINFO=true")))
-   (native-inputs (list bison))                   ;needed to build 'gprofng'
-   (synopsis "Binary utilities: bfd gas gprof ld")
-   (description
-    "GNU Binutils is a collection of tools for working with binary files.
+           ;; For some reason, the build machinery insists on rebuilding .info
+           ;; files, even though they're already provided by the tarball.
+           #:make-flags #~'("MAKEINFO=true")))
+    (native-inputs
+     (list bison                        ;needed to build 'gprofng'
+           pkg-config))
+    (inputs (list `(,zstd "lib")))
+    (synopsis "Binary utilities: bfd gas gprof ld")
+    (description
+     "GNU Binutils is a collection of tools for working with binary files.
 Perhaps the most notable are \"ld\", a linker, and \"as\", an assembler.
 Other tools include programs to display binary profiling information, list
 the strings in a binary file, and utilities for working with archives.  The
 \"bfd\" library for working with executable and object formats is also
 included.")
-   (license gpl3+)
-   (home-page "https://www.gnu.org/software/binutils/")))
+    (license gpl3+)
+    (home-page "https://www.gnu.org/software/binutils/")))

 ;; FIXME: ath9k-firmware-htc-binutils.patch do not apply on 2.34 because of a
 ;; big refactoring of xtensa-modules.c (commit 567607c11fbf7105 upstream).
@@ -797,10 +805,22 @@ included.")
                 (delete "LDFLAGS=-static-libgcc" #$flags)))
       ((#:phases phases '%standard-phases)
        #~(modify-phases #$phases
+            (add-after 'unpack 'use-zstd-compression-level-19-for-gold
+              (lambda _
+                ;; The default level (3) is hard-coded.  Use a higher level to
+                ;; compact debug sections as much as possible.
+                (substitute* "gold/compressed_output.cc"
+                  (("ZSTD_CLEVEL_DEFAULT") "19"))))
           (add-after 'patch-source-shebangs 'patch-more-shebangs
             (lambda _
               (substitute* "gold/Makefile.in"
                 (("/bin/sh") (which "sh")))))
+           (add-before 'check 'set-LD_LIBRARY_PATH
+             (lambda* (#:key inputs #:allow-other-keys)
+               ;; Some test binaries are linked with gold, which lack RUNPATH
+               ;; info due to not being linked with our ld-wrapper script.
+               (setenv "LD_LIBRARY_PATH"
+                       (dirname (search-input-file inputs "lib/libzstd.so")))))
           ;; Multiple failing tests on some architectures in the gold testsuite.
           #$@(if (or (target-arm?)
                      (target-ppc32?))
@@ -1646,15 +1666,15 @@ command.")
    (name "tzdata")
    ;; This package should be kept in sync with python-pytz and python-tzdata
    ;; in (gnu packages time).
-    (version "2025a")
+    (version "2025b")
    (source (origin
-             (method url-fetch)
-             (uri (string-append
-                   "https://data.iana.org/time-zones/releases/tzdata"
-                   version ".tar.gz"))
-             (sha256
-              (base32
-               "1l7hnlgc4wgy2gmaj5zmswpzbyq23h7vsndnw2zhwibw5k3wnpsd"))))
+              (method url-fetch)
+              (uri (string-append
+                    "https://data.iana.org/time-zones/releases/tzdata"
+                    version ".tar.gz"))
+              (sha256
+               (base32
+                "0x0lswl5v3q3ml8ig4djc76p9zc593xajzp22x881isz6h9h908i"))))
    (build-system gnu-build-system)
    (arguments
     (list #:tests? #f
@@ -1713,7 +1733,9 @@ command.")
                     (copy-recursively (string-append out "/share/zoneinfo-leaps")
                                       (string-append out "/share/zoneinfo/right"))
                     (delete-file-recursively
-                      (string-append out "/share/zoneinfo-leaps")))))
+                      (string-append out "/share/zoneinfo-leaps"))
+                     (install-file "leap-seconds.list"
+                                   (string-append out "/share/zoneinfo")))))
               (delete 'configure))))
    (inputs (list (origin
                    (method url-fetch)
@@ -1722,7 +1744,7 @@ command.")
                          version ".tar.gz"))
                    (sha256
                     (base32
-                      "0qahpwp1zlyvi7qrlm4r74pmj3c7sx3jlg9xw2siwj3nkzapk5hi")))))
+                      "1v1mw6599afdcmf5dal7zvjbl3caibkzmlw7kka71vi56pdzxy05")))))
    (home-page "https://www.iana.org/time-zones")
    (synopsis "Database of current and historical time zones")
    (description "The Time Zone Database (often called tz or zoneinfo)
@@ -1742,20 +1764,6 @@ and daylight-saving rules.")
 ;;; package.
 (define-public tzdata-for-tests tzdata)

-;;; TODO: Move the 'install-leap-seconds' phase into the main package's
-;;; 'post-install' phase on the next rebuild cycle.
-(define-public tzdata/leap-seconds
-  (hidden-package
-    (package/inherit tzdata
-      (arguments
-        (substitute-keyword-arguments (package-arguments tzdata)
-          ((#:phases phases)
-           #~(modify-phases #$phases
-               (add-after 'post-install 'install-leap-seconds
-                 (lambda _
-                   (install-file "leap-seconds.list"
-                     (string-append #$output "/share/zoneinfo")))))))))))
-
 (define-public libiconv
  (package
    (name "libiconv")
@@ -66,7 +66,7 @@

 (define (patch-url seqno)
  "Return the URL of Bash patch number SEQNO."
-  (format #f "mirror://gnu/bash/bash-5.2-patches/bash52-~3,'0d" seqno))
+  (format #f "mirror://gnu/bash/bash-5.3-patches/bash53-~3,'0d" seqno))

 (define (bash-patch seqno sha256-bv)
  "Return the origin of Bash patch SEQNO, with expected hash SHA256-BV."
@@ -79,47 +79,13 @@
  (list (bash-patch seqno (base32 hash))
        ...))

-(define %patch-series-5.2
-  ;; This is the current patches series for 5.2, generated using
+(define %patch-series-5.3
+  ;; This is the current patches series for 5.3, generated using
  ;; 'download-patches' below.
  (patch-series
-   (1 "02iibpd3jq8p1bhdzgik8ps6gi1145vr463a82gj1hivjbp2ybzl")
-   (2 "1f6p1z85qh1lavdp3xikgp0bfv0vqhvgpgwmdzlywl35hwdmxk25")
-   (3 "1zxsi869jd90hksx3nyypgyqwrxhw2ws3r6hmk76yc1lsgdhq2ba")
-   (4 "04i5liw5cg6dqkdxfgazqc2jrw40bmclx3dx45bwy259pcj7g0iq")
-   (5 "0mykflv9qnbx3jz71l4f7isadiw9knm4qimqkwsv9cv88dafpq7c")
-   (6 "13265akl8w6zyrg0l7f0x6arjgqjhllcwl6lk46rl53x4mm5dq6i")
-   (7 "146lrwkn5wgxzs6vx34wl47g69zsxdy032k40qzi626b47ya6015")
-   (8 "1s5i8hcayrv25lc8fxcr431v634yx5sii53b8fmip789s0pxjjvb")
-   (9 "1kfk25151ka9wkmk1myf12irgcmvhsd8b0nfifvhrszah9w82npr")
-   (10 "1kf1jrwm30js0v3d1r2rk4x09s1pyjp70wnd1qqhf9bmkw15ww67")
-   (11 "1x5nkvbj6hci7gx42q7qa72hg2a9wwxh85dk79gn521ypwjmy6w3")
-   (12 "0b6lcwzm7v5bzjiwaz2c8n5aj77w8ckhp2vwk4v3zsdq3z70gc9g")
-   (13 "1rkwpibd6j2ghppfhqsva2jm4kdni6b7jpdsxdps52643gc4yjq9")
-   (14 "09766vqqw4ffnmysm725v35qkhp1g9j4qgqag941xvq655pj9y9y")
-   (15 "12im449abnq5gaqjmdxr5i38kmp02fa8l8wffad3jryvd58r0wzg")
-   (16 "05arb0hzmng03cr357lf6p8af0x2a1pznsd3psll03nibfy56n0m")
-   (17 "129cvx4gfz8n23iw1lhbknbw86fyw6vh60jqj1wj3d5pr75wwj0w")
-   (18 "105am94qxjc27gga4a8asvsi01090xwjfim3s16lafwjvm4xsha6")
-   (19 "10njgv5mrc5rhsp5lvxcbm0pnzn59a8spi2nhdasifyl1a32cp1j")
-   (20 "07f0wlmqjdfarp44w3gj9gdqbqm5x20rvlhpn34ngklmxcm2bz5n")
-   (21 "1kahfqqalcwi4m73pg3ssz6lh0kcqsqax09myac7a15d2y0vhd43")
-   (22 "0w74aym0g1fh48864a3qxh89f26iaq7wsbg7244c6kjr94527dbq")
-   (23 "1lywjqbc36j5pdzfcvnz1zy30j76aqmsm190p888av0hw815b45g")
-   (24 "1hq23djqbr7s9y2324jq9mxr5bwdkmgizn3zgpchbsqp054k85cp")
-   (25 "0x9hc4silzl4d3zw4p43i5dm7w86k50j47f87lracwfgwy3z8f2i")
-   (26 "1b1fhm1dsi67r8ip17s0xvx2qq31fsxc1g9n3r931dd0k9a1zvln")
-   (27 "0fdbhvs9dkf4knncifh98a76q4gylhyvfrffq5p9q3ag5q58jap1")
-   (28 "1hdacd6sssjshmry1sscdnxxfb2r51bvdyghlfjaqgc9l85phhk0")
-   (29 "11wrlb20w6v89b96krg0gwxipwhvrda6rq1y9f972m32gsrsqp0j")
-   (30 "13v9fqgim082dmvkslsr0hs793yzhsij2s91mjswsfhj1qip7zy3")
-   (31 "15d7rddj6spwc1fy997lxx6zvzq0zbxgf2h20mhi4wgp5nzbglf2")
-   (32 "05ia6yf32hjprmyyxqawhgckxs3684ikfx8xg08zfgx9xkd7g73v")
-   (33 "1qm2aad9mf2xah6xwchga7s5pk3v308mrv9lgh50d65d236ccgh1")
-   (34 "0bi38dhkkwpm2qrzp8zpykglq6gibvv2n9f8m59gwj406cxvp7w9")
-   (35 "1r8k34y82v02yfkgws17j7i53ybb74dqnwl2jjiv0av9z93hl6l2")
-   (36 "0mwhr9hfbh2czf8klbxg6nbd2g9xl9kygvgk061vird56r4kzj8m")
-   (37 "156sbi3srzkyxajkmhb7iigq0j4nvwnpsbw88xdsxn95a4xiqb4a")))
+   (1 "0zr8wgg1gb67vxn7ws971n1znrdinczymc688ndnpy2a6qs88q0z")
+   (2 "009051z55plsy4jmmjdb3ys7li2jraynz99qg7n6a1qk025591g3")
+   (3 "1vb0gnrkmz49rcfpxjcxy0v0k5278wrlkljk9gc20nizvk3xjigj")))

 (define (download-patches store count)
  "Download COUNT Bash patches into store.  Return a list of
@@ -157,7 +123,7 @@ number/base32-hash tuples, directly usable in the 'patch-series' form."
               " -Wl,-rpath -Wl,"
               (assoc-ref %build-inputs "ncurses")
               "/lib")))
-         (version "5.2"))
+         (version "5.3"))
    (package
     (name "bash")
     (source (origin
@@ -166,11 +132,11 @@ number/base32-hash tuples, directly usable in the 'patch-series' form."
                    "mirror://gnu/bash/bash-" version ".tar.gz"))
              (sha256
               (base32
-                "1yrjmf0mqg2q8pqphjlark0mcmgf88b0acq7bqf4gx3zvxkc2fd1"))
+                "1fii1xaxbng9x0klxmxkm0xhmycngfz72jsgyrna4sgqcmlxhp0d"))
              (patch-flags '("-p0"))
              (patches (cons (search-patch "bash-linux-pgrp-pipe.patch")
-                             %patch-series-5.2))))
-     (version (string-append version "." (number->string (length %patch-series-5.2))))
+                             %patch-series-5.3))))
+     (version (string-append version "." (number->string (length %patch-series-5.3))))
     (build-system gnu-build-system)

      (outputs '("out"
@@ -435,8 +435,9 @@ setup against another one.")
    (native-inputs
     (list coreutils
           python-lxml
-           python-pynose
-           python-setuptools))
+           python-nose
+           python-setuptools
+           python-wheel))
    (home-page "https://github.com/sosy-lab/benchexec/")
    (synopsis "Framework for Reliable Benchmarking")
    (description
@@ -86,7 +86,6 @@
  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-web)
  #:use-module (gnu packages python-xyz)
-  #:use-module (gnu packages serialization)
  #:use-module (gnu packages qt)
  #:use-module (gnu packages sqlite)
  #:use-module (gnu packages ssh)
@@ -226,7 +225,7 @@ of the Transmission BitTorrent client, using its HTTP RPC protocol.")
 (define-public stig
  (package
    (name "stig")
-    (version "0.14.1a0")
+    (version "0.14.0a0")
    (source
     (origin
       (method git-fetch)
@@ -235,18 +234,7 @@ of the Transmission BitTorrent client, using its HTTP RPC protocol.")
              (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0196brcasdyn0mx3h2cqlgrx8x9fyv2n7bmx13nj58vnf3y4c1hg"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:tests? #f ;tests require network access
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'loosen-version-restrictions
-            (lambda _
-              (substitute* "setup.py"
-                (("urwidtrees==1.0.3")
-                 "urwidtrees>=1.0.3")))))))
+        (base32 "1jfcgncva94pyzjifar1l6wlmb7aylg0l4fxljc83rkbj1a2aan0"))))
    (propagated-inputs
     (list python-urwid
           python-urwidtrees
@@ -257,12 +245,20 @@ of the Transmission BitTorrent client, using its HTTP RPC protocol.")
           python-natsort
           python-async-timeout
           python-setproctitle))
+    (arguments
+     (list
+      #:tests? #f ;tests require network access
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'unpack 'loosen-version-restrictions
+                     (lambda _
+                       (substitute* "setup.py"
+                         (("urwidtrees==1.0.3") "urwidtrees>=1.0.3")))))))
    (inputs (list python))
-    (native-inputs (list python-setuptools))
+    (build-system python-build-system)
    (synopsis "TUI and CLI for the BitTorrent client Transmission")
    (description
-     "Stig is a @acronym{TUI, Text User Interface} and @acronym{CLI, Command
-Line Interface} client for the BitTorrent client Transmission.")
+     "Stig is a @acronym{TUI, Text User Interface} and @acronym{CLI, Command Line
+Interface} client for the BitTorrent client Transmission.")
    (home-page "https://github.com/rndusr/stig")
    (license l:gpl3)))

@@ -527,7 +523,7 @@ and will take advantage of multiple processor cores where possible.")
                          "-E" exclude-regex
                          "-j" jobs
                          "--output-on-failure"))))))))
-    (inputs (list boost-1.83 openssl))
+    (inputs (list boost openssl))
    (native-inputs
     (list libfaketime
           python-wrapper
@@ -540,6 +536,20 @@ focusing on efficiency and scalability.  It runs on embedded devices as well as
 desktops.")
    (license l:bsd-2)))

+(define-public libtorrent-rasterbar-1.2
+  (package
+    (inherit libtorrent-rasterbar)
+    (version "1.2.20")
+    (source
+     (origin
+       (method url-fetch)
+       (uri
+        (string-append "https://github.com/arvidn/libtorrent/"
+                       "releases/download/v" version "/"
+                       "libtorrent-rasterbar-" version ".tar.gz"))
+       (sha256
+        (base32 "1z5rdynzxcm6wb7v48ssfbwjairbjacb8rjix5fn70fw4668xgyc"))))))
+
 (define-public qbittorrent
  (package
    (name "qbittorrent")
@@ -32,7 +32,6 @@
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system copy)
-  #:use-module (guix build-system emacs)
  #:use-module (guix build-system gnu)
  #:use-module (guix deprecation)
  #:use-module (guix download)
@@ -159,6 +158,9 @@ core computer science concepts such as abstraction in programming,
 metalinguistic abstraction, recursion, interpreters, and modular programming.")
      (license license:cc-by-sa4.0))))

+;; It may be removed after 2025-12-19.
+(define-deprecated/public-alias sicp book-sicp)
+
 (define-public book-sparc
  (package
    (name "book-sparc")
@@ -331,40 +333,3 @@ display bibles, commentaries, dictionaries, and other texts and images.
 Xiphos includes features such as searching, biblesync, bookmarks,
 parallel study, and original language study.")
    (license license:gpl2+)))
-
-(define-public book-emacs-lisp-elements
-  (package
-    (name "book-emacs-lisp-elements")
-    (version "2.0.1")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/protesilaos/emacs-lisp-elements")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0774zycgx3zspn6f8pszap1751xgrlv2h3x66kksnj589nfnwzil"))))
-    (build-system emacs-build-system)
-    (arguments
-     (list
-      #:tests? #f ;No code —no tests
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'install 'makeinfo
-            (lambda _
-              (emacs-makeinfo "elispelem.org"))))))
-    (native-inputs (list texinfo))
-    (home-page "https://protesilaos.com/emacs/emacs-lisp-elements")
-    (synopsis "Overview of the Emacs Lisp programming language")
-    (description
-     "Emacs Lisp Elements is a book written by Protesilaos Stavrou, providing
-a big picture view of the @acronym{Elisp, Emacs Lisp} programming language by
-combining prose with code.  This book aims to provide an idea of how Elisp
-works by showing some of the main concepts and patterns encountered in
-everyday Elisp code.
-
-This book is not intended as a replacement for the built-in Emacs Lisp
-Reference Manual, but instead to give readers enough information to reason
-about Elisp code.")
-    (license license:fdl1.3+)))
@@ -8,10 +8,10 @@
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
 ;;; Copyright © 2018, 2019, 2021 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2018, 2020, 2023, 2025 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2018, 2020, 2023 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2018, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2019 Mathieu Othacehe <m.othacehe@gmail.com>
-;;; Copyright © 2019, 2020 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2019, 2020 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2020, 2022 Marius Bakke <marius@gnu.org>
 ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 ;;; Copyright © 2020, 2025 Janneke Nieuwenhuizen <janneke@gnu.org>
@@ -69,15 +69,22 @@
 (define-public boost
  (package
    (name "boost")
-    (version "1.89.0")
+    (version "1.83.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://archives.boost.io/release/"
                                  version "/source/boost_"
                                  (version-with-underscores version) ".tar.bz2"))
+              (patches
+                (append
+                 (search-patches "boost-fix-duplicate-definitions-bug.patch")
+                 (list (boost-patch
+                        "0001-unordered-fix-copy-assign.patch" version
+                        "09j61m5xh7099k5na9i43x5rra51znf7vm2nyh89yqpizcll9q66"))))
+              (patch-flags '("-p2"))
              (sha256
               (base32
-                "0yhcb8dn7g5k9dfr54j99wpd4qwk59g1lpp8z0ag7d114si3z8w5"))))
+                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34"))))
    (build-system gnu-build-system)
    (inputs
     (append
@@ -126,54 +133,16 @@
                        "binary-format=elf"
                        "target-os=linux"
                        #$@(cond
-                            ((string-prefix? "x86_64" (%current-target-system))
-                             #~()) ; Implies boost.stacktrace.from_exception=on
-                            ;;; Note: With llvm's libc++, enabling that for
-                            ;;; non-x86_64 non-mingw32 would be a bad idea.
-                            ;;; libc++'s backtrace is not thread-safe and
-                            ;;; would leak then.
-                            ;;;
-                            ;;; We disable it here completely.  Alternatively,
-                            ;;; we could disable it only if the user used
-                            ;;; (package-with-c-toolchain ... clang) or
-                            ;;; otherwise has libc++ in their dependencies.
-                            ;;;
-                            ;;; In the latter case, we would have to set
-                            ;;; BOOST_STACKTRACE_LIBCXX_RUNTIME_MAY_CAUSE_MEMORY_LEAK
-                            ;;; and that seems ill-advised (if a future
-                            ;;; update broke it in other ways, we would
-                            ;;; be blind to it).
-                            ;;;
-                            ;;; See also:
-                            ;;; <https://codeberg.org/guix/guix/issues/4541>.
                            ((string-prefix? "arm" (%current-target-system))
                             #~("abi=aapcs"
                                "address-model=32"
-                                "architecture=arm"
-                                ;; See also:
-                                ;; <https://codeberg.org/guix/guix/issues/4541>.
-                                "boost.stacktrace.from_exception=off"))
+                                "architecture=arm"))
                            ((string-prefix? "aarch64" (%current-target-system))
                             #~("abi=aapcs"
                                "address-model=64"
-                                "architecture=arm"
-                                ;; See also:
-                                ;; <https://codeberg.org/guix/guix/issues/4541>.
-                                "boost.stacktrace.from_exception=off"))
-                            (else
-                             ;; See also:
-                             ;; <https://codeberg.org/guix/guix/issues/4541>.
-                             #~("boost.stacktrace.from_exception=off"))))
-                     ;; Not cross-compiling.
-                     #~(#$@(cond
-                         ((string-suffix? "mingw32" (%current-system))
-                          #~()) ; Implies boost.stacktrace.from_exception=on
-                         ((string-prefix? "x86_64" (%current-system))
-                          #~()) ; Implies boost.stacktrace.from_exception=on
-                         (else
-                          ;; See also:
-                          ;; <https://codeberg.org/guix/guix/issues/4541>.
-                          #~("boost.stacktrace.from_exception=off"))))))
+                                "architecture=arm"))
+                            (else #~())))
+                     #~()))
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'patch-shells
@@ -239,22 +208,7 @@ across a broad spectrum of applications.")
    (license (license:x11-style "https://www.boost.org/LICENSE_1_0.txt"
                                "Some components have other similar licences."))))

-(define-public boost-1.88
-  (package
-    (inherit boost)
-    (name "boost")
-    (version "1.88.0")
-    (source (origin
-              (inherit (package-source boost))
-              (uri (string-append
-                    "https://archives.boost.io/release/"
-                    version "/source/boost_"
-                    (version-with-underscores version) ".tar.bz2"))
-              (sha256
-               (base32
-                "0yrgn6syk260ckq9ld44vjv1bl6bamhy3jbp10kikcipcv0d5na6"))))))
-
-(define-public boost-1.83
+(define-public boost-for-source-highlight
  (hidden-package (package (inherit boost)
    (name "boost")
    (version "1.83.0")
@@ -270,33 +224,7 @@ across a broad spectrum of applications.")
              (patch-flags '("-p2"))
              (sha256
               (base32
-                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34"))))
-    (arguments
-     (substitute-keyword-arguments (package-arguments boost)
-      ((#:make-flags _ #f)
-       #~(list "threading=multi" "link=shared"
-              ;; Set the RUNPATH to $libdir so that the libs find each other.
-              (string-append "linkflags=-Wl,-rpath="
-                             #$output "/lib")
-              #$@(if (%current-target-system)
-                     #~("--user-config=user-config.jam"
-                        ;; Python is not supported when cross-compiling.
-                        "--without-python"
-                        "binary-format=elf"
-                        "target-os=linux"
-                        #$@(cond
-                            ((string-prefix? "arm" (%current-target-system))
-                             #~("abi=aapcs"
-                                "address-model=32"
-                                "architecture=arm"))
-                            ((string-prefix? "aarch64" (%current-target-system))
-                             #~("abi=aapcs"
-                                "address-model=64"
-                                "architecture=arm"))
-                            (else
-                             #~())))
-                     ;; Not cross-compiling.
-                     #~()))))))))
+                "13iviiwk1srpw9dmiwabkxv56v0pl0zggjp8zxy1419k5zzfsy34")))))))

 (define-deprecated-package boost-with-python3
  boost)
@@ -364,7 +292,7 @@ across a broad spectrum of applications.")

 (define-public boost-numpy
  (package
-    (inherit boost-1.83)
+    (inherit boost)
    (name "boost-numpy")
    (native-inputs
     (modify-inputs (package-native-inputs boost)
@@ -471,7 +399,7 @@ signals and slots system.")
    (build-system gnu-build-system)
    (native-inputs (list autoconf automake))
    (propagated-inputs
-      (list boost-1.83)) ; inclusion of header files
+      (list boost)) ; inclusion of header files
    (home-page "https://gitlab.com/mdds/mdds")
    (synopsis "Multi-dimensional C++ data structures and indexing algorithms")
    (description "Mdds (multi-dimensional data structure) provides a
@@ -24,7 +24,6 @@
 ;;; Copyright © 2025 Esther Flashner <esther@flashner.co.il>
 ;;; Copyright © 2025 André Batista <nandre@riseup.net>
 ;;; Copyright © 2025 dan <i@dan.games>
-;;; Copyright © 2025 Jiyu Software <info@jiyu.dev>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -864,17 +863,7 @@ tree binary files.  These are board description files used by Linux and BSD.")
       (sha256
        (base32 "1i1v86bnixh8hyqbwwr5iwdnnadmg2fqxw9g526fvclsbvl8lz0v"))
       (patches (search-patches "u-boot-allow-disabling-openssl.patch"
-                                "u-boot-rockchip-inno-usb.patch"))
-       (snippet
-        ;; Remove non-free binary licenses, blobs and microcode.
-        #~(begin
-           (use-modules (guix build utils))
-           (for-each delete-file
-                   '("Licenses/r8a779x_usb3.txt"
-                     "drivers/usb/host/xhci-rcar-r8a779x_usb3_v3.h"
-                     "arch/mips/mach-octeon/include/mach/cvmx-pki-cluster.h"))
-           (for-each delete-file
-                   (find-files "arch/x86/dts/microcode/" "\\.dtsi$"))))))
+                                "u-boot-rockchip-inno-usb.patch"))))
    (build-system gnu-build-system)
    (native-inputs
     (list bison
@@ -918,7 +907,7 @@ also initializes the boards (RAM etc).")
                     (lambda* (#:key make-flags #:allow-other-keys)
                       (let* ((info-dir (string-append #$output "/share/info"))
                              (info (string-append info-dir
-                                                   "/DasUBoot.info.gz")))
+                                                   "/DasUBoot.info.zst")))
                         (with-directory-excursion "doc/output"
                           (apply invoke "make" "-C" "texinfo" "install-info"
                                  (string-append "infodir=" info-dir)
@@ -2,7 +2,6 @@
 ;;; Copyright © 2022 Christopher Rodriguez <yewscion@gmail.com>
 ;;; Copyright © 2022 Liliana Marie Prikler <liliana.prikler@gmail.com>
 ;;; Copyright © 2025 Lee Thompson <lee.p.thomp@gmail.com>
-;;; © 2025 case_lambda <case_lambda@disroot.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -37,71 +36,77 @@
  #:use-module (gnu packages compression))

 (define-public dbqn
-  (package
-    (name "dbqn")
-    (version "0.2.2")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/dzaima/BQN")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1zy3y9wbmaw0mrd2sp7d1r912gvs9k0mzw5d3drgmbzkbvpd6iq1"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:imported-modules `((guix build ant-build-system)
-                           ,@%default-gnu-imported-modules)
-      #:modules '((guix build gnu-build-system)
-                  ((guix build ant-build-system)
-                   #:prefix ant:)
-                  (guix build utils))
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (replace 'build
-            (lambda _
-              (invoke "./build")))
-          (replace 'check
-            (lambda* (#:key tests? #:allow-other-keys)
-              (if tests?
-                  (invoke "./BQN" "./test/test")
-                  (begin
-                    (display "test suite not run")
-                    (newline)))))
-          (add-after 'install 'reorder-jar-content
-            (assoc-ref ant:%standard-phases
-                       'reorder-jar-content))
-          (add-after 'reorder-jar-content 'generate-jar-indices
-            (assoc-ref ant:%standard-phases
-                       'generate-jar-indices))
-          (add-after 'generate-jar-indices 'strip-jar-timestamps
-            (assoc-ref ant:%standard-phases
-                       'strip-jar-timestamps))
-          (replace 'install
-            (lambda* (#:key inputs #:allow-other-keys)
-              (let ((dest-jar (string-append #$output "/share/java")))
-                (rename-file "BQN" "dbqn")
-                (substitute* "dbqn"
-                  (("java")
-                   (search-input-file inputs "/bin/java"))
-                  (("BQN.jar")
-                   (string-append dest-jar "/BQN.jar")))
-                (install-file "BQN.jar" dest-jar)
-                (install-file "dbqn"
-                              (string-append #$output "/bin"))))))))
-    (native-inputs (list `(,icedtea-8 "jdk") zip))
-    (inputs (list bash-minimal icedtea-8))
-    (synopsis "BQN implementation based on dzaima/APL")
-    (description
-     "dbqn is a Java implementation of the
+  (let ((commit "88f2b43966a75cc2c382421218eb30003bb16f4a")
+        (revision "1"))
+    (package
+      (name "dbqn")
+      (version (git-version "0.2.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/dzaima/BQN")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "06mzvv7kmandhgwb6jwz3rivsj4ic549sy8afnb5zr6mfn5isyg5"))))
+      (build-system gnu-build-system)
+      (arguments
+       (list
+        #:imported-modules `(,@%default-gnu-imported-modules
+                             (guix build ant-build-system))
+        #:modules `((guix build gnu-build-system)
+                    ((guix build ant-build-system)
+                     #:prefix ant:)
+                    (guix build utils))
+        #:phases #~(modify-phases %standard-phases
+                     (delete 'configure)
+                     (replace 'build
+                       (lambda* _
+                         (invoke "./build")
+                         (chmod "./BQN" #o755)))
+                     (replace 'check
+                       (lambda* (#:key tests? #:allow-other-keys)
+                         (when tests?
+                           (system "./BQN ./test/test"))))
+                     (add-after 'install 'reorder-jar-content
+                       (lambda* (#:key outputs #:allow-other-keys)
+                         (apply (assoc-ref ant:%standard-phases
+                                           'reorder-jar-content)
+                                #:outputs (list outputs))))
+                     (add-after 'reorder-jar-content 'jar-indices
+                       (lambda* (#:key outputs #:allow-other-keys)
+                         (apply (assoc-ref ant:%standard-phases
+                                           'generate-jar-indices)
+                                #:outputs (list outputs))))
+                     (add-after 'jar-indices 'fix-jar-timestamps
+                       (lambda* (#:key outputs #:allow-other-keys)
+                         (apply (assoc-ref ant:%standard-phases
+                                           'reorder-jar-content)
+                                #:outputs (list outputs))))
+                     (replace 'install
+                       (lambda* (#:key outputs #:allow-other-keys)
+                         (let* ((out (assoc-ref outputs "out"))
+                                (dest-bin (string-append out "/bin"))
+                                (dest-jar (string-append out "/share/java")))
+                           (mkdir-p dest-bin)
+                           (mkdir-p dest-jar)
+                           (rename-file "BQN" "dbqn")
+                           (install-file "dbqn" dest-bin)
+                           (install-file "BQN.jar" dest-jar)
+                           (substitute* (string-append dest-bin "/dbqn")
+                             (("BQN.jar")
+                              (string-append dest-jar "/BQN.jar")))))))))
+      (native-inputs (list `(,icedtea-8 "jdk") zip))
+      (inputs (list icedtea-8 bash-minimal))
+      (synopsis "BQN implementation based on dzaima/APL")
+      (description
+       "dbqn is a Java implementation of the
@uref{https://mlochbaum.github.io/BQN/, BQN programming language} that does
 not need to be bootstrapped, based on an earlier Java implementation of APL by
 the same author.")
-    (home-page "https://github.com/dzaima/BQN")
-    (license license:expat)))
+      (home-page "https://github.com/dzaima/BQN")
+      (license license:expat))))

 (define bqn-sources
  ;; Aside from dbqn above, the main bqn repository is used by other
@@ -328,7 +328,7 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
 (define noscript
  (package
    (name "noscript")
-    (version "13.2.2")
+    (version "13.2.1")
    (source (origin
              (method url-fetch/zipbomb)
              (uri (string-append
@@ -336,7 +336,7 @@ with the @uref{https://keepassxc.org, KeePassXC} password manager.")
                    ".xpi"))
              (sha256
               (base32
-                "0w2w0a76dk01bkh83mqwgs9ky02rjqk15z5sxg4a6mw0hpr81bpm"))))
+                "16p63kg7zwnfss9sb3j2kn9m7dx9prh09h4vbz3b0pg5s7rrf0hr"))))
    (build-system copy-build-system)
    (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
    (arguments
@@ -21,7 +21,6 @@
 ;;; Copyright © 2022, 2023 Juliana Sims <juli@incana.org>
 ;;; Copyright © 2024 Evgeny Pisemsky <mail@pisemsky.site>
 ;;; Copyright © 2024 Janneke Nieuwenhuizen <janneke@gnu.org>
-;;; Copyright © 2025 Anderson Torres <anderson.torres.8519@gmail.com>
 ;;; Copyright © 2025 Aiden Isik <aidenisik+git@member.fsf.org>
 ;;; Copyright © 2025 Josep Bigorra <jjbigorra@gmail.com>
 ;;; Copyright © 2025 John Kehayias <john.kehayias@protonmail.com>
@@ -100,40 +99,6 @@
  #:use-module (gnu packages version-control)
  #:use-module (gnu packages xml))

-(define-public acr
-  (package
-    (name "acr")
-    (version "2.2.4")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/radareorg/acr")
-              (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32
-         "1qd7p50b9gkh2ihf7gs6xpdkb5jk8frg90ajqlw1pbza8735f9q1"))
-       (snippet
-        #~(begin
-            (delete-file "configure")))))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:tests? #f                     ; No tests
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'bootstrap)
-          (add-after 'patch-source-shebangs 'bootstrap-after-patch-source-shebangs
-            (assoc-ref %standard-phases 'bootstrap)))))
-    (synopsis "Autoconf replacement written in pure Bash")
-    (description
-     "@acronym{ACR, Autoconf Replacement} tries to replace autoconf
-functionality generating a full-compatible configure script, but relying on
-Bourne shell script instead of m4.")
-    (home-page "https://github.com/radareorg/acr")
-    (license license:gpl2)))
-
 (define-public bam
  (package
    (name "bam")
@@ -419,6 +384,7 @@ resembles Python.")
           python-cython
           python-gitpython
           python-pytest
+           python-pytest-cov
           python-pytest-mock))
    (home-page "https://github.com/mesonbuild/meson-python")
    (synopsis "Meson-based build backend for Python")
@@ -1151,7 +1117,7 @@ maintenance-related files, for convenience.")
 (define-public maak
  (package
    (name "maak")
-    (version "0.2.12")
+    (version "0.2.9")
    (source
     (origin
       (method git-fetch)
@@ -1160,7 +1126,7 @@ maintenance-related files, for convenience.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0566damp7339n8rs2dvvq80h07amygnn3nakj2wwav2fmb1yzgx1"))))
+        (base32 "0108sj9rdqwprcx2ihlsfhbqiig08kah3k2yxc5w0yxzxdh8hzwv"))))
    (build-system guile-build-system)
    (arguments
     (list
@@ -51,7 +51,6 @@
  #:use-module (guix build-system copy)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system meson)
-  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module (guix store)
  #:use-module (gnu packages)
@@ -73,7 +72,6 @@
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages pcre)
  #:use-module (gnu packages python)
-  #:use-module (gnu packages python-build)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages gettext)
@@ -468,26 +466,23 @@ language as input.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1rihvlg11nzk70kfzz4i3gi5izcy46w05ismcx04p5j1hlim0brb"))))
-    (build-system pyproject-build-system)
+        (base32
+         "1rihvlg11nzk70kfzz4i3gi5izcy46w05ismcx04p5j1hlim0brb"))))
+    (build-system python-build-system)
    (arguments
     (list
-      #:test-backend #~'unittest
-      #:test-flags #~(list "discover" "-s" "tests" "-p" "*.py")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'unbundle-ply
-            (lambda _
-              (rmdir "pcpp/ply")
-              (substitute* "setup.py"
-                (("'pcpp/ply/ply'")
-                 "")))))))
-    (native-inputs (list python-setuptools))
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'unpack 'unbundle-ply
+                     (lambda _
+                       (rmdir "pcpp/ply")
+                       (substitute* "setup.py"
+                         (("'pcpp/ply/ply'") "")))))))
+    (native-inputs (list python-pytest))
    (propagated-inputs (list python-ply))
    (home-page "https://github.com/ned14/pcpp")
    (synopsis "C99 preprocessor written in Python")
-    (description
-     "This package provides a C99 preprocessor written in pure Python.")
+    (description "This package provides a C99 preprocessor written in pure
+Python.")
    (license license:bsd-3)))

 (define-public aml
@@ -1442,7 +1437,7 @@ Telemetry Transport (MQTT) publish-subscribe messaging protocol.")
 (define-public mimalloc
  (package
    (name "mimalloc")
-    (version "3.1.5")
+    (version "3.0.9")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1451,7 +1446,7 @@ Telemetry Transport (MQTT) publish-subscribe messaging protocol.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0a3z1vi3n4w6n1iz4yqnvllrlpqb2dc2a54wn2s52js541zsfkky"))))
+                "0y249bmzx6rmc1m8a29d0x2cd52nik2dwqpzg9hd1xkvl9b8z7jc"))))
    (build-system cmake-build-system)
    (arguments
     `(#:build-type "Release"
@@ -1,5 +1,4 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2018 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
 ;;; Copyright © 2015, 2016, 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Kei Kebreau <kkebreau@posteo.net>
@@ -11,13 +10,11 @@
 ;;; Copyright © 2020 Brendan Tildesley <mail@brendan.scot>
 ;;; Copyright © 2020 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2020 Peng Mei Yu <pengmeiyu@riseup.net>
-;;; Copyright © 2021 Petr Hodina <phodina@protonmail.com>
 ;;; Copyright © 2021 Wamm K. D. <jaft.r@outlook.com>
 ;;; Copyright © 2022 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2025 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2025 Ashish SHUKLA <ashish.is@lostca.se>
-;;; Copyright © 2025 Andy Tai <atai@atai.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -108,33 +105,6 @@ https://www.agendadulibre.org are in French and the adl-submit tool is only
 available in French.")
      (license license:gpl2))))

-(define-public date2name
-  (let ((commit "50cc8d3957fc0bdc26c65042ab8f0d9f05610283")
-        (revision "2"))
-    (package
-      (name "date2name")
-      (version (git-version "0.0" revision commit))
-      (source
-       (origin
-         (method git-fetch)
-         (uri (git-reference
-                (url "https://github.com/novoid/date2name")
-                (commit commit)))
-         (file-name (git-file-name name version))
-         (sha256
-          (base32 "16m24dvyg93rpa94401cladjvj5pk3ds5y6sbz54xygdpg9qf8qm"))))
-      (build-system pyproject-build-system)
-      (native-inputs
-       (list python-poetry-core
-             python-pytest))
-      (home-page "https://github.com/novoid/date2name")
-      (synopsis "Handling time-stamps and date-stamps in file names")
-      (description
-       "By default, date2name gets the modification time of matching files and
-directories and adds a datestamp in standard ISO 8601+ format YYYY-MM-DD at
-the beginning of the file or directory name.")
-      (license license:gpl3+))))
-
 (define-public date
  (package
    (name "date")
@@ -490,55 +460,6 @@ traditional Chinese characters.")
    ;; 'Lesser GPL version 2 or later'.
    (license (list license:gpl2+ license:lgpl2.1+))))

-(define-public gcal
-  (package
-    (name "gcal")
-    (version "4.2.0")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://www.alteholz.dev/gnu/gcal-"
-                           version ".tar.xz"))
-       (sha256
-        (base32
-         "1p3q6his31bxs24nsgpfavw3nlhalqf0zak4f3b530p725s2vgfq"))
-       (snippet
-        #~(begin
-            (use-modules (guix build utils))
-            ;; Adjust the bundled gnulib to work with glibc 2.28.  See e.g.
-            ;; "m4-gnulib-libio.patch".  This is a phase rather than patch
-            ;; or snippet to work around <https://bugs.gnu.org/32347>.
-            (substitute* (find-files "lib" "\\.c$")
-              (("#if defined _IO_ftrylockfile")
-               "#if defined _IO_EOF_SEEN"))
-            (substitute* "lib/stdio-impl.h"
-              (("^/\\* BSD stdio derived implementations")
-               (string-append
-                "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
-                "# define _IO_IN_BACKUP 0x100\n"
-                "#endif\n\n"
-                "/* BSD stdio derived implementations")))
-            #t))))
-    (build-system gnu-build-system)
-    (arguments
-     (list
-      #:configure-flags
-      #~(list "LDFLAGS=-lm")))
-    (native-inputs
-     (list check
-           pkg-config))
-    (home-page "https://www.gnu.org/software/gcal/")
-    (synopsis "Calculating and printing a wide variety of calendars")
-    (description
-     "Gcal is a program to calculate and print calendars on the
-command-line.  Calendars can be printed in 1-month, 3-month or whole-year
-views.  In addition, eternal holiday lists can be generated for many
-countries, which can be complemented by user-made lists of fixed dates to
-make an agenda.  Gcal can also calculate astronomical data, such as the
-phases of the moon, and supports alternative calendar formats: Julian,
-Gregorian, Islamic, Chinese and more.")
-    (license license:gpl3+)))
-
 (define-public gsimplecal
  (let ((version "2.4.1"))
    (package
@@ -569,7 +490,7 @@ configured to show the current time in different timezones.")
 (define-public hebcal
  (package
    (name "hebcal")
-    (version "5.9.4")
+    (version "5.8.7")
    (source
     (origin
       (method git-fetch)
@@ -578,7 +499,7 @@ configured to show the current time in different timezones.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0hw4485s83amvl03y33zkxi9ka9yq6rvbdsw20m6fc4m2bj8lb79"))))
+        (base32 "1a1b9jip1ha6bzv6xg9fx47q167yzgbxjvrp5zngv175nzl9427j"))))
    (build-system go-build-system)
    (arguments
     (list
@@ -3,7 +3,6 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2021 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2021 Raghav Gururajan <rg@raghavgururajan.name>
-;;; Copyright © 2025 Luca Kredel <luca.kredel@web.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,14 +29,11 @@
  #:use-module (guix build-system copy)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system trivial)
-  #:use-module (guix build-system go)
  #:use-module (gnu packages)
  #:use-module (gnu packages nss)
  #:use-module (gnu packages curl)
  #:use-module (gnu packages python)
  #:use-module (gnu packages perl)
-  #:use-module (gnu packages golang-crypto)
-  #:use-module (gnu packages golang-build)
  #:use-module (gnu packages tls))

 (define-public certdata2pem
@@ -227,33 +223,3 @@ port forwarding to your local machine.")
 Let's Encrypt root and intermediate certificates.  It is intended to be used
 within Guix.")
    (license license:public-domain)))
-
-(define-public mkcert
-  (package
-    (name "mkcert")
-    (version "1.4.4")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/FiloSottile/mkcert")
-             (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0ms9mjspiwlsgsnir0ccj3w8vhvrphf5i6k9q3hrz47y2a6igh0l"))))
-    (build-system go-build-system)
-    (arguments
-     (list
-      #:import-path "filippo.io/mkcert"
-      #:build-flags
-      #~(list (string-append "-ldflags=-X main.Version="
-                             #$version))))
-    (native-inputs (list go-golang-org-x-net
-                         go-software-sslmate-com-src-go-pkcs12))
-    (synopsis "Zero-config tool to make locally trusted development
-     certificates")
-    (description
-     "mkcert is a simple tool for making locally-trusted development
-     certificates.  It requires no configuration.")
-    (home-page "https://github.com/FiloSottile/mkcert")
-    (license license:bsd-3)))
@@ -49,7 +49,7 @@
 ;;; Copyright © 2023 Reza Housseini <reza@housseini.me>
 ;;; Copyright © 2023 Hilton Chain <hako@ultrarare.space>
 ;;; Copyright © 2023, 2024 Troy Figiel <troy@troyfigiel.com>
-;;; Copyright © 2024 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2024 Navid Afkhami <navid.afkhami@mdc-berlin.de>
 ;;; Copyright © 2024, 2025 gemmaro <gemmaro.dev@gmail.com>
@@ -377,11 +377,11 @@ source code editors and IDEs.")
          (add-after 'install 'install-man
            (lambda* (#:key import-path #:allow-other-keys)
              (with-directory-excursion (string-append "src/" import-path)
-                (let ((man-dir (string-append #$output "/share/man/man1")))
+                (let ((man-dir (string-append #$output "/share/man")))
                  (mkdir-p man-dir)
                  (invoke "go-md2man"
                          "-in" "man/man1/checkmake.1.md"
-                          "-out" (string-append man-dir "/checkmake.1")))))))))
+                          "-out" (string-append man-dir "/man1")))))))))
    (native-inputs
     (list go-github-com-docopt-docopt-go
           go-github-com-go-ini-ini
@@ -832,20 +832,7 @@ format.")
    (build-system cmake-build-system)
    (arguments
     '(#:parallel-tests? #f
-       #:configure-flags '("-DBUILD_TESTS=ON"
-                           "-DUSE_BUNDLED_TINYXML2=OFF")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-testcondition-test
-           (lambda _
-             (substitute* "test/testcondition.cpp"
-               (("test.cpp:4\\] -> \\[test.cpp:6")
-                "test.cpp:4:25] -> [test.cpp:6:18")
-               (("test.cpp:3\\] -> \\[test.cpp:5(.*false)"_ rest)
-                (string-append "test.cpp:3:22] -> [test.cpp:5:22" rest
-                               " [knownConditionTrueFalse]"))))))))
-    (inputs
-     (list tinyxml2))
+       #:configure-flags '("-DBUILD_TESTS=ON")))
    (home-page "https://cppcheck.sourceforge.io")
    (synopsis "Static C/C++ code analyzer")
    (description "Cppcheck is a static code analyzer for C and C++.  Unlike
@@ -903,49 +890,46 @@ favourite continuous integration framework.  Among Cukinia features are:
 (define-public cxxtest
  (package
    (name "cxxtest")
-    ;; 4.4 is from 2014, there is some move on master branch but still no
-    ;; fresh tag, see: <https://github.com/CxxTest/cxxtest/issues/156>.
    (version "4.4")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "mirror://sourceforge/cxxtest/cxxtest/" version
-                           "/cxxtest-" version ".tar.gz"))
-       (sha256
-        (base32 "1n7pbj4z9ivx005hqvivj9ddhq8awynzg6jishfbypf6j7ply58w"))))
-    (build-system pyproject-build-system)
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "mirror://sourceforge/cxxtest/cxxtest/"
+                                  version "/cxxtest-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1n7pbj4z9ivx005hqvivj9ddhq8awynzg6jishfbypf6j7ply58w"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      ;; XXX: There are SCons and CMake tests, but not pytest ones.
-      #:tests? #f
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'chdir-to-source
-            (lambda _
-              (chdir "python")))
-          (add-after 'install 'install-headers
-            (lambda* (#:key outputs #:allow-other-keys)
-              (let ((include-dir (string-append #$output "/include/cxxtest")))
-                (for-each (lambda (header-file)
-                            (install-file header-file include-dir))
-                          (find-files "../cxxtest")))))
-          (add-after 'install 'install-doc
-            (lambda* (#:key outputs #:allow-other-keys)
-              (let ((doc-dir (string-append #$output "/share/doc/cxxtest")))
-                (install-file "../README" doc-dir)
-                (install-file "../doc/guide.txt" doc-dir)
-                (copy-recursively "../sample"
-                                  (string-append doc-dir "/sample"))))))))
-    (native-inputs (list python-setuptools))
-    (propagated-inputs (list python-ply))
-    (home-page
-     "https://web.archive.org/web/20230604070022/http://cxxtest.com/")
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'chdir-to-source
+           (lambda _
+             (chdir "python")
+             #t))
+         (add-after 'install 'install-headers
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (include-dir (string-append out "/include/cxxtest")))
+               (for-each (lambda (header-file)
+                           (install-file header-file include-dir))
+                         (find-files "../cxxtest"))
+               #t)))
+         (add-after 'install 'install-doc
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (doc-dir (string-append out "/share/doc/cxxtest")))
+               (install-file "../README" doc-dir)
+               (install-file "../doc/guide.txt" doc-dir)
+               (copy-recursively "../sample" (string-append doc-dir "/sample"))
+               #t))))))
+    (propagated-inputs
+     (list python-ply))
+    (home-page "https://web.archive.org/web/20230604070022/http://cxxtest.com/")
    (synopsis "Unit testing framework for C++")
-    (description
-     "CxxTest is a unit testing framework for C++ that is similar in spirit to
-JUnit, CppUnit, and xUnit.  CxxTest does not require precompiling a CxxTest
-testing library, it employs no advanced features of C++ (e.g. RTTI) and it
-supports a very flexible form of test discovery.")
+    (description "CxxTest is a unit testing framework for C++ that is similar
+in spirit to JUnit, CppUnit, and xUnit.  CxxTest does not require precompiling
+a CxxTest testing library, it employs no advanced features of C++ (e.g. RTTI)
+and it supports a very flexible form of test discovery.")
    (license license:lgpl3+)))

 (define-public doctest
@@ -1008,7 +992,7 @@ has been designed to be fast, light and unintrusive.")
 (define-public kyua
  (package
    (name "kyua")
-    (version "0.14.1")
+    (version "0.13")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1017,7 +1001,7 @@ has been designed to be fast, light and unintrusive.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0w238ynhnjz7p2v8fbgxv35kl1x7a4vs86227qhb4gxncr75nsbl"))))
+                "1jzdal9smhmivj18683a5gy8jd2p1dbni7kcpaxq4g9jgjdidcrq"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -1042,6 +1026,16 @@ has been designed to be fast, light and unintrusive.")
                 (format #f "chdir(~s)" (dirname (which "ls"))))
                (("\"/bin/ls\"")
                 (string-append "\"" (which "ls") "\"")))))
+          (add-before 'check 'prepare-for-tests
+            (lambda _
+              ;; The test suite expects HOME to be writable.
+              (setenv "HOME" "/tmp")
+              ;; Generate the autom4te-generated testsuite script, which
+              ;; contains a '/bin/sh' shebang.
+              (invoke "make" "bootstrap/testsuite")
+              (substitute* "bootstrap/testsuite"
+                (("/bin/sh")
+                 (which "sh")))))
          (add-after 'unpack 'disable-problematic-tests
            (lambda _
              ;; The stacktrace tests expect core files to be dumped to the
@@ -1050,8 +1044,12 @@ has been designed to be fast, light and unintrusive.")
              ;; https://github.com/freebsd/kyua/issues/214).
              (substitute* "utils/Kyuafile"
                ((".*atf_test_program.*stacktrace_test.*")
-                 "")))))))
-    (native-inputs (list autoconf automake gdb-minimal libtool pkg-config))
+                 ""))))
+          (add-after 'install 'delete-installed-tests
+            (lambda _
+              ;; Delete 200 MiB of tests.
+              (delete-file-recursively (string-append #$output "/tests")))))))
+    (native-inputs (list autoconf automake gdb-minimal pkg-config))
    (inputs (list atf lutok sqlite))
    (home-page "https://github.com/freebsd/kyua")
    (synopsis "Testing framework for infrastructure software")
@@ -1065,16 +1063,16 @@ report generation engine.")
 (define-public googletest
  (package
    (name "googletest")
-    (version "1.17.0")
+    (version "1.12.1")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/google/googletest")
-             (commit (string-append "v" version))))
+             (commit (string-append "release-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1zn701fgmbk29y45p49sajaswm01i2bv89ds2kkbiq8i0p2cr08w"))))
+        (base32 "1cv55x3amwrvfan9pr8dfnicwr8r6ar3yf6cg9v6nykd6m2v3qsv"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f
@@ -1088,6 +1086,21 @@ discovery, death tests, assertions, parameterized tests and XML test report
 generation.")
    (license license:bsd-3)))

+(define-public googletest-1.17
+  (package
+    (inherit googletest)
+    (name "googletest")
+    (version "1.17.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+              (url "https://github.com/google/googletest")
+              (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zn701fgmbk29y45p49sajaswm01i2bv89ds2kkbiq8i0p2cr08w"))))))
+
 (define-public googletest-1.13
  (package
    (inherit googletest)
@@ -1103,21 +1116,6 @@ generation.")
       (sha256
        (base32 "1x5lr1k4kgw3i8d7c12vp759p0w8c8r2y8lwvqswswxvwygw8lid"))))))

-(define-public googletest-1.12
-  (package
-    (inherit googletest-1.13)
-    (name "googletest")
-    (version "1.12.1")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/google/googletest")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1cv55x3amwrvfan9pr8dfnicwr8r6ar3yf6cg9v6nykd6m2v3qsv"))))))
-
 (define-public googletest-1.8
  (package
    (inherit googletest)
@@ -1477,22 +1475,19 @@ for every Python test framework.  It supports nose, py.test, and unittest.")
 (define-public python-minimock
  (package
    (name "python-minimock")
-    (version "1.3.0")
+    (version "1.2.8")
    (source
     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/lowks/minimock")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
+       (method url-fetch)
+       (uri (pypi-uri "MiniMock" version))
       (sha256
-        (base32 "0mby3y78w8zka3dwp2dnsq3a0bq9nxr5g0h538p6zbyjrqly5paj"))))
-    (build-system pyproject-build-system)
-    (native-inputs (list python-pynose python-setuptools))
-    (home-page "https://github.com/lowks/minimock")
+        (base32
+         "0k2sxb1ibnyg05iblz7zhbv825f1zk9906rab7883iqgvzmdzpsz"))))
+    (build-system python-build-system)
+    (home-page "https://pypi.org/project/MiniMock")
    (synopsis "Simple Python library for using mock objects")
-    (description
-     "MiniMock is a simple library for building mock objects with doctest.")
+    (description "MiniMock is a simple library for building mock objects with
+doctest.")
    (license license:expat)))

 (define-public python-mock
@@ -2405,84 +2400,76 @@ since the last commit or what tests are currently failing.")
       (method url-fetch)
       (uri (pypi-uri "coverage" version))
       (sha256
-        (base32 "0l403f6d59q8rik9vvzb6982qad0zrfj87dqydzsz8hwmh2dayqn"))))
+        (base32
+         "0l403f6d59q8rik9vvzb6982qad0zrfj87dqydzsz8hwmh2dayqn"))))
    (build-system pyproject-build-system)
    (arguments
     (list
-      ;; tests: 1303 passed, 23 skipped
      #:test-flags
-      #~(list "--numprocesses" (number->string (min 8 (parallel-job-count)))
-              #$@(map (lambda (file) (string-append "--ignore=tests/" file))
-                      ;; XXX: The most of the tests fail.
-                      (list "test_process.py"
-                            ;; Unable to properly compare reports.
-                            "test_report.py"
-                            ;; Network connection is required
-                            "test_venv.py"))
-              #$@(map (lambda (test) (string-append "--deselect="
-                                                    "tests/test_python.py::"
-                                                    "GetZipBytesTest::"
-                                                    "test_get_encoded_zip_files"
-                                                    test))
-                      ;; > assert zip_data is not None
-                      ;; E assert None is not None
-                      (list "[utf-8]@get_zip_bytes_test"
-                            "[gb2312]@get_zip_bytes_test"
-                            "[hebrew]@get_zip_bytes_test"
-                            "[shift_jis]@get_zip_bytes_test"
-                            "[cp1252]@get_zip_bytes_test"))
-              #$@(map (lambda (test) (string-append "--deselect=tests/test_"
-                                                    test))
-                      ;; AssertionError
-                      (list "api.py::RelativePathTest::test_files_up_one_level"
-                            "concurrency.py::SigtermTest::\
-test_sigterm_multiprocessing_saves_data"
-                            "oddball.py::DoctestTest::test_doctest"
-                            "oddball.py::MockingProtectionTest::\
-test_os_path_exists"
-                            "plugins.py::PluginTest::\
-test_local_files_are_importable"
-                            "regions.py::test_real_code_regions"
-                            "setup.py::SetupPyTest::test_metadata"
-                            "testing.py::test_all_our_source_files"
-                            "xml.py::XmlReportTest::test_no_duplicate_packages"
-                            ;; FileNotFoundError
-                            "setup.py::SetupPyTest::test_more_metadata"
-                            ;; ModuleNotFoundError
-                            "filereporter.py::FileReporterTest::test_zipfile"
-                            ;; OSError
-                            "annotate.py::AnnotationGoldTest::test_multi"))
-              #$@(if (or (equal? (%current-system) "riscv64-linux")
-                         (equal? (%current-system) "aarch64-linux"))
-                     ;; Thypothesis.errors.FailedHealthCheck: Data generation
-                     ;; is extremely slow.
-                     (map (lambda (test) (string-append "--deselect="
-                                                        "tests/test_numbits.py"
-                                                        test))
-                          (list "NumbitsOpTest::test_any_intersection"
-                                "NumbitsOpTest::test_conversion"
-                                "NumbitsOpTest::test_union"))
-                     '()))
+      #~(list
+         "--numprocesses" (number->string (parallel-job-count))
+         ;; TODO: Rework this test options by utilizing "-k" option.
+         ;;
+         ;; 1201 passed, 19 skipped, 389 warnings
+         ;; XXX: Unable to properly compare reports.
+         "--ignore=tests/test_report.py"
+         ;; XXX: PyTracer or missing dependencies.
+         "--ignore=tests/test_venv.py"
+         "--ignore=tests/test_plugins.py"
+         "--ignore=tests/test_debug.py"
+         "--ignore=tests/test_core.py"
+         ;; XXX: Unclear why these fail.
+         "--ignore=tests/test_python.py"
+         "--deselect=tests/test_concurrency.py\
+::SigtermTest::test_sigterm_multiprocessing_saves_data"
+         ;; XXX: Unexpected paths order.
+         "--ignore=tests/test_process.py"
+         ;; XXX: PermissionError
+         "--deselect=tests/test_annotate.py::AnnotationGoldTest::test_multi"
+         ;; XXX: Needs C extension
+         "--deselect=tests/test_cmdline.py::CmdLineStdoutTest::test_version"
+         "--deselect=tests/test_api.py::NamespaceModuleTest::test_bug_572"
+         ;; XXX: Finds more files at toplevel
+         "--deselect=tests/test_api.py::RelativePathTest::test_files_up_one_level"
+         "--deselect=tests/test_xml.py::XmlReportTest::test_no_duplicate_packages"
+         ;; XXX: zip1 module missing.
+         "--deselect=tests/test_filereporter.py::FileReporterTest::test_zipfile"
+         ;; No module named 'coverage.tracer'
+         "--deselect=tests/test_api.py::ApiTest::test_completely_zero_reporting"
+         "--deselect=tests/test_api.py::ApiTest::test_warnings"
+         "--deselect=tests/test_oddball.py::RecursionTest::test_long_recursion_recovery"
+         ;; XXX: Checking coverage for too much files, not only the target one.
+         "--deselect=tests/test_oddball.py::DoctestTest::test_doctest"
+         ;; Module sys has no Python source
+         "--deselect=tests/test_api.py::ApiTest::test_warnings_suppressed"
+         ;; prevent FAILs on slow riscv64 SBCs
+         #$@(if (equal? (%current-system) "riscv64-linux")
+                '("--deselect=tests/test_numbits.py::NumbitsOpTest::test_union"
+                  "--deselect=tests/test_numbits.py::NumbitsOpTest::test_any_intersection")
+                '())
+         ;; Fails some "'p1c' not in 'Name" assertions (see:
+         ;; <https://github.com/nedbat/coveragepy/issues/2050#issuecomment-3489704251>).
+         "--ignore=tests/test_api.py"
+         ;; This tests fails due to missing file tests/actual/testing/getty.
+         "-k" "not test_good_needs_scrubs")
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'unpack 'fix-pytest-config
+          (add-after 'unpack 'patch-pyproject
            (lambda _
              (substitute* "pyproject.toml"
-                (("-q -n auto ") ""))))
-          (add-before 'check 'pre-check
+                ;; Just run pytest with no frills.
+                (("addopts.*") ""))))
+          (add-before 'check 'fix-conftest
+            ;; It tries to scan the whole sys.path and "find some place to
+            ;; write to".
            (lambda _
-              ;; WARNING: The directory '/homeless-shelter/.cache/pip' or its
-              ;; parent directory is not owned or is not writable by the
-              ;; current user. The cache has been disabled. Check the
-              ;; permissions and owner of that directory. If executing pip
-              ;; with sudo, you should use sudo's -H flag.
-              (setenv "HOME" "/tmp")
-              ;; This would otherwise interfere with finding the installed
-              ;; coverage when running tests.
-              (delete-file-recursively "coverage"))))))
+              (with-output-to-file (string-append (getcwd) "/test.pth")
+                (lambda _ (display "")))
+              (substitute* "tests/conftest.py"
+                (("map(Path, sys.path)") (format #f "[~s]" (getcwd)))))))))
    (native-inputs
     (list python-pytest
-           python-pytest-xdist  ;some tests need xdist_group
+           python-pytest-xdist ; hardcoded in tests/conftests.py
           python-flaky
           python-setuptools))
    (home-page "https://coverage.readthedocs.io")
@@ -2773,11 +2760,9 @@ failures.")
       (sha256
        (base32 "0gxsr0wk8kzf8rqfnhy84yh1zi0b55j76c0m9n006d8q4bzy1v25"))))
    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags #~(list "-k" "not test_coverage_explicit")))
    (native-inputs
     (list python-pytest
+           python-pytest-cov
           python-setuptools
           python-setuptools-scm))
    (propagated-inputs
@@ -3151,6 +3136,57 @@ non-technical or business participants in a software project.  Behave uses
 tests written in a natural language style, backed up by Python code.")
    (license license:x11)))

+(define-public python-behave-web-api
+  (package
+    (name "python-behave-web-api")
+    (version "2.0.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "behave-web-api" version))
+       (sha256
+        (base32
+         "04p5sp6wck3mafj634w1fpvfhxm170l5q3hfb9d06pi71ql606n6"))))
+    (build-system pyproject-build-system)
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'fix-dependencies
+           (lambda _
+             (substitute* "setup.py"
+               (("'wheel'") "")                ; We don't use it.
+               (("'ordereddict==1.1'") ""))    ; Python >= 2.7 has it built-in.
+             #t)))))
+    (native-inputs
+     (list python-pytest
+           python-setuptools
+           python-wheel))
+    (propagated-inputs
+     (list behave python-requests))
+    (home-page "https://github.com/jefersondaniel/behave-web-api")
+    (synopsis "Provides testing for JSON APIs with Behave for Python")
+    (description "This package provides testing utility modules for testing
+JSON APIs with Behave.")
+    (license license:expat)))
+
+(define-public python-nose-timer
+  (package
+    (name "python-nose-timer")
+    (version "0.7.5")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "nose-timer" version))
+        (sha256
+          (base32 "05wzkc88vbzw62pqkvhl33211b90kns0lny70b7qw62rcg4flzk4"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     (list python-nose python-termcolor))
+    (home-page "https://github.com/mahmoudimus/nose-timer")
+    (synopsis "Timer plugin for nosetests")
+    (description "Shows how much time was needed to run individual tests.")
+    (license license:expat)))
+
 (define-public python-freezegun
  (package
    (name "python-freezegun")
@@ -3722,6 +3758,28 @@ system.  The code under test requires no modification to work with pyfakefs.")
 asynchronous code in Python (asyncio).")
    (license license:expat)))

+(define-public python-pytest-dependency
+  (package
+    (name "python-pytest-dependency")
+    (version "0.5.1")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "pytest-dependency" version))
+        (sha256
+          (base32
+            "0swl3mxca7nnjbb5grfzrm3fa2750h9vjsha0f2kyrljc6895a62"))))
+    (build-system python-build-system)
+    (propagated-inputs
+      (list python-pytest))
+    (home-page
+      "https://github.com/RKrahl/pytest-dependency")
+    (synopsis "Manage dependencies of tests")
+    (description "This pytest plugin manages dependencies of tests.  It allows
+to mark some tests as dependent from other tests.  These tests will then be
+skipped if any of the dependencies did fail or has been skipped.")
+    (license license:asl2.0)))
+
 (define-public python-pytest-datadir
  (package
    (name "python-pytest-datadir")
@@ -855,7 +855,6 @@ dependency graph expansion and the creation of classpaths.")
       #:doc-dirs '()
       ;; FIXME: Could not initialize class org.eclipse.aether.transport.http.SslSocketFactory
       #:tests? #f
-       #:jdk ,openjdk11
       #:phases
       (modify-phases %standard-phases
         ;; FIXME: Currently, the S3 transporter depends on ClojureScript,
@@ -46,7 +46,6 @@
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system copy)
  #:use-module (guix build-system emacs)
-  #:use-module (guix build-system pyproject)
  #:use-module (guix build-system python)
  #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR $SSL_CERT_FILE))
  #:use-module (gnu packages)
@@ -181,7 +180,7 @@ using the CMake build system.")
 (define-public cmake-bootstrap
  (package
    (name "cmake-bootstrap")
-    (version "3.31.10")
+    (version "3.31.8")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://cmake.org/files/v"
@@ -189,7 +188,7 @@ using the CMake build system.")
                                  "/cmake-" version ".tar.gz"))
              (sha256
               (base32
-                "0a9y7nqr27rl8acvjyj8s57q87bdjxa9w2g5mphsh7ylsvgzl1ng"))))
+                "1akcmx9w5wbygq088hrr13l6n4b5npqvh9jk20934bfwhg5f7kg3"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -368,7 +367,7 @@ and workspaces that can be used in the compiler environment of your choice.")
  (package
    (inherit cmake-minimal)
    (name "cmake")
-    (version "4.1.3")
+    (version "4.0.3")
    (source (origin
              (inherit (package-source cmake-minimal))
              (method url-fetch)
@@ -383,7 +382,7 @@ and workspaces that can be used in the compiler environment of your choice.")
                                  ,@rest))))
              (sha256
               (base32
-                "125yhgkmh5ap14w9yyh442manbb7k96dws4pa3hz32qp7njpjn3n"))))
+                "1yrzkwkr2nxl8hcjkk333l9ycbw9prkg363k4km609kknyvkfdcd"))))
    (outputs '("out" "doc"))
    (arguments
     (substitute-keyword-arguments (package-arguments cmake-minimal)
@@ -461,40 +460,14 @@ and workspaces that can be used in the compiler environment of your choice.")
       (uri (pypi-uri "cmakelang" version))
       (sha256
        (base32 "0zz6g1ignqanl4ja9f5nrlk5f3mvv7cp5y9yswjd0m06n23jx603"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:tests? #f        ;no test data in pypi archive
-      #:modules '((guix build pyproject-build-system)
-                  (guix build utils)
-                  (ice-9 textual-ports))
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'adjust-setup.py
-            (lambda _
-              (substitute* "setup.py"
-                (("cmakelang/doc/README.rst")
-                 "README.rst"))
-              ;; XXX: setup.py has multiple setup() calls, breaking the 'build
-              ;; phase ; in this case the package is wrong, but conveniently
-              ;; our goal is the first setup() call, so discard what comes from
-              ;; the second one.
-              (rename-file "setup.py" "setup.py.bak")
-              (call-with-input-file "setup.py.bak"
-                (lambda (in)
-                  (call-with-output-file "setup.py"
-                    (lambda (out)
-                      (let loop ((line (get-line in))
-                                 (setup-seen #f))
-                        (unless (or (eof-object? line)
-                                    (and (string-prefix? "setup(" line)
-                                         setup-seen))
-                          (display line out)
-                          (newline out)
-                          (loop (get-line in)
-                                (or setup-seen
-                                    (string-prefix? "setup(" line))))))))))))))
-    (native-inputs (list python-setuptools))
+    (build-system python-build-system)
+    (arguments (list #:tests? #f        ;no test data in pypi archive
+                     #:phases #~(modify-phases %standard-phases
+                                  (add-after 'unpack 'adjust-setup.py
+                                    (lambda _
+                                      (substitute* "setup.py"
+                                        (("cmakelang/doc/README.rst")
+                                         "README.rst")))))))
    (inputs (list python-jinja2 python-pyyaml python-six))
    (home-page "https://github.com/cheshirekow/cmake_format/")
    (synopsis "Language tools for CMake (format, lint, etc.)")
@@ -1032,7 +1032,7 @@ extensions over the standard utility.")
                                          "/share/sourcetrail/user/projects")))
                                (copy-recursively src dst)
                                (delete-file-recursively src))))))))
-    (inputs (list boost-1.83
+    (inputs (list boost
                  clang-19
                  expected-lite
                  qt5compat
@@ -9,7 +9,7 @@
 ;;; Copyright © 2019-2022 Marius Bakke <marius@gnu.org>
 ;;; Copyright © 2020, 2022 Timothy Sample <samplet@ngyro.com>
 ;;; Copyright © 2020 Guy Fleury Iteriteka <gfleury@disroot.org>
-;;; Copyright © 2021 Maxim Cournoyer <maxim@guixotic.coop>
+;;; Copyright © 2021, 2025 Maxim Cournoyer <maxim@guixotic.coop>
 ;;; Copyright © 2021 Chris Marusich <cmmarusich@gmail.com>
 ;;; Copyright © 2021 Julien Lepiller <julien@lepiller.eu>
 ;;; Copyright © 2021 Pierre Langlois <pierre.langlois@gmx.com>
@@ -38,6 +38,8 @@
  #:use-module (gnu packages base)
  #:use-module (gnu packages bash)
  #:use-module (gnu packages c)
+  #:use-module (gnu packages digest)
+  #:use-module (gnu packages elf)
  #:use-module (gnu packages gcc)
  #:use-module (gnu packages m4)
  #:use-module (gnu packages gawk)
@@ -1239,7 +1241,8 @@ ac_cv_c_float_format='IEEE (little-endian)'
              "--build=i686-unknown-linux-gnu"
              "--host=i686-unknown-linux-gnu"
              "--with-sysroot=/"
-              ,(string-append "--prefix=" out))))))))
+              ,(string-append "--prefix=" out))))))
+    (properties '((max-silent-time . 7200)))))

 (define gnu-make-mesboot
  (package
@@ -1837,7 +1840,8 @@ exec " gcc "/bin/" program
                      (format (current-error-port) "C_INCLUDE_PATH=~a\n" (getenv "C_INCLUDE_PATH"))
                      (format (current-error-port) "CPLUS_INCLUDE_PATH=~a\n" (getenv "CPLUS_INCLUDE_PATH"))
                      (format (current-error-port) "LIBRARY_PATH=~a\n"
-                              (getenv "LIBRARY_PATH"))))))))))))
+                              (getenv "LIBRARY_PATH"))))))))))
+    (properties '((timeout . 72000)))))    ;20 hours

 (define gcc-mesboot-wrapper
  ;; We need this so gcc-mesboot can be used to create shared binaries that
@@ -2248,40 +2252,40 @@ exec " gcc "/bin/" program
    (source (bootstrap-origin (package-source binutils)))
    (name "binutils-cross-boot0")
    (arguments
-     (append (list #:guile %bootstrap-guile
-                   #:implicit-inputs? #f
+     (ensure-keyword-arguments
+      (substitute-keyword-arguments (package-arguments binutils)
+        ((#:modules modules '((guix build gnu-build-system)
+                              (guix build utils)))
+         (cons '(ice-9 ftw) modules))
+        ((#:configure-flags cf ''())
+         #~(append (list #$(string-append "--target="
+                                          (boot-triplet))
+                         "--disable-gprofng") ;requires Bison
+                   #$cf))
+        ((#:phases phases '%standard-phases)
+         #~(modify-phases #$phases
+             (add-after 'install 'add-symlinks
+               (lambda* (#:key outputs #:allow-other-keys)
+                 ;; The cross-gcc invokes 'as', 'ld', etc, without the
+                 ;; triplet prefix, so add symlinks.
+                 (let ((out (assoc-ref outputs "out"))
+                       (triplet-prefix (string-append #$(boot-triplet)
+                                                      "-")))
+                   (define (has-triplet-prefix? name)
+                     (string-prefix? triplet-prefix name))
+                   (define (remove-triplet-prefix name)
+                     (substring name
+                                (string-length triplet-prefix)))

-                   #:modules '((guix build gnu-build-system)
-                               (guix build utils)
-                               (ice-9 ftw)) ; for 'scandir'
-                   #:phases
-                   #~(modify-phases %standard-phases
-                       (add-after 'install 'add-symlinks
-                         (lambda* (#:key outputs #:allow-other-keys)
-                           ;; The cross-gcc invokes 'as', 'ld', etc, without the
-                           ;; triplet prefix, so add symlinks.
-                           (let ((out (assoc-ref outputs "out"))
-                                 (triplet-prefix (string-append #$(boot-triplet)
-                                                                "-")))
-                             (define (has-triplet-prefix? name)
-                               (string-prefix? triplet-prefix name))
-                             (define (remove-triplet-prefix name)
-                               (substring name
-                                          (string-length triplet-prefix)))
-
-                             (with-directory-excursion (string-append out "/bin")
-                               (for-each (lambda (name)
-                                           (symlink name
-                                                    (remove-triplet-prefix name)))
-                                         (scandir "."
-                                                  has-triplet-prefix?))))))))
-             (substitute-keyword-arguments (package-arguments binutils)
-               ((#:configure-flags cf)
-                #~(append (list #$(string-append "--target="
-                                                 (boot-triplet))
-                                "--disable-gprofng") ;requires Bison
-                          #$cf)))))
-    (native-inputs '())                           ;no Bison
+                   (with-directory-excursion (string-append out "/bin")
+                     (for-each (lambda (name)
+                                 (symlink name
+                                          (remove-triplet-prefix name)))
+                               (scandir "."
+                                        has-triplet-prefix?)))))))))
+      (list #:guile %bootstrap-guile
+            #:implicit-inputs? #f)))
+    (native-inputs '())                 ;no Bison
    (inputs (%boot0-inputs))))

 (define libstdc++-boot0
@@ -3241,7 +3245,8 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
                                            "libstdc++")
                                          ,@(if (target-powerpc? (%current-system))
                                                (list static-bash-for-glibc)
-                                                '())))
+                                                '())
+                                          ,(gexp-input zstd-final "lib")))
             (substitute-keyword-arguments (package-arguments binutils)
               ((#:configure-flags flags #~'())
                ;; For gprofng, tell the build system where to look for libstdc++.
@@ -3251,13 +3256,58 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
                                                  "libstdc++")
                                               "/lib")))))))
    (native-inputs (list bison-boot0
+                         pkg-config-final ;to detect zstd
                         libstdc++))              ;for gprofng
    (inputs
-     (match (%current-system)
-       ((? target-powerpc?)
-        `(("bash" ,static-bash-for-glibc)
-          ,@(%boot2-inputs)))
-       (_ (%boot2-inputs))))))
+     (modify-inputs (match (%current-system)
+                      ((? target-powerpc?)
+                       `(("bash" ,static-bash-for-glibc)
+                         ,@(%boot2-inputs)))
+                      (_ (%boot2-inputs)))
+       (append `(,zstd-final "lib"))))))
+
+(define dwz-final
+  (package
+    (inherit dwz)
+    (source (bootstrap-origin (package-source dwz)))
+    (arguments
+     (ensure-keyword-arguments
+      (package-arguments dwz)
+      (list #:guile %bootstrap-guile
+            #:implicit-inputs? #f
+            #:tests? #f
+            #:allowed-references (list "out" glibc-final
+                                       elfutils-final
+                                       (gexp-input gcc-final "lib")
+                                       xxhash-final
+                                       xz-final
+                                       zlib-final))))
+    (native-inputs (list pkg-config-final)) ;without test inputs
+    (inputs (modify-inputs (%boot6-inputs)
+              (append elfutils-final
+                      xxhash-final)))))
+
+(define elfutils-final
+  (package
+    (inherit elfutils)
+    (source (bootstrap-origin (package-source elfutils)))
+    (arguments
+     (ensure-keyword-arguments
+      (package-arguments elfutils)
+      (list #:guile %bootstrap-guile
+            #:implicit-inputs? #f
+            ;; There is no bunzip2 in the Hurd bootstrap binaries.
+            #:tests? (not (target-hurd?))
+            #:allowed-references (list "out" "bin"
+                                       bash-final
+                                       (gexp-input gcc-final "lib")
+                                       glibc-final
+                                       xz-final
+                                       zlib-final))))
+    (native-inputs (list m4-boot0))
+    (inputs (modify-inputs (%boot6-inputs)
+              (append xz-final
+                      zlib-final)))))

 (define zlib-final
  ;; Zlib used by GCC-FINAL.
@@ -3271,6 +3321,32 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
       ,@(package-arguments zlib)))
    (inputs (%boot2-inputs))))

+(define zstd-final
+  ;; Zstd used by BINUTILS-FINAL.
+  (package
+    (inherit zstd)
+    (source (bootstrap-origin (package-source zstd)))
+    (arguments
+     (substitute-keyword-arguments
+         (ensure-keyword-arguments
+          (package-arguments zstd)
+          (list #:guile %bootstrap-guile
+                #:implicit-inputs? #f
+                #:allowed-references (list "out" "lib" glibc-final)))
+       ((#:phases phases '%standard-phases)
+        #~(modify-phases #$phases
+            ;; Avoid retaining references to bash & grep in the zstdless
+            ;; script.
+            (delete 'patch-command-file-names)
+            (add-after 'install 'unpatch-bash-shebangs
+              (lambda _
+                (with-directory-excursion (string-append #$output "/bin")
+                  (substitute* '("zstdgrep" "zstdless")
+                    (("#!/gnu/store/.*/bin/sh")
+                     "#!/bin/sh")))))
+            (delete 'patch-shebangs)))))
+    (inputs (%boot2-inputs))))
+
 (define/system-dependent ld-wrapper-boot3
  ;; A linker wrapper that uses the bootstrap Guile.
  (make-ld-wrapper "ld-wrapper-boot3"
@@ -3485,24 +3561,26 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
 (define %boot5-inputs %boot4-inputs)
 (define with-boot5 with-boot4)

+(define pkg-config-final
+  (package
+    (inherit %pkg-config)               ;the native pkg-config
+    (arguments
+     (ensure-keyword-arguments
+      (package-arguments %pkg-config)
+      (list #:implicit-inputs? #f
+            #:guile %bootstrap-guile)))
+    (inputs (%boot2-inputs))))
+
 (define (make-gnu-make-final)
  "Compute the final GNU Make, which uses the final Guile."
-  (let ((pkg-config (package
-                      (inherit %pkg-config)       ;the native pkg-config
-                      (inputs `(("guile" ,guile-final)
-                                ,@(%boot5-inputs)))
-                      (arguments
-                       `(#:implicit-inputs? #f
-                         ,@(package-arguments %pkg-config))))))
-    (package
-      (inherit (package-with-bootstrap-guile gnu-make))
-      (inputs `(("guile" ,guile-final)
-                ,@(%boot5-inputs)))
-      (native-inputs `(("pkg-config" ,pkg-config)))
-      (arguments
-       `(#:implicit-inputs? #f
-         ,@(package-arguments gnu-make))))))
-
+  (package
+    (inherit (package-with-bootstrap-guile gnu-make))
+    (inputs `(("guile" ,guile-final)
+              ,@(%boot5-inputs)))
+    (native-inputs `(("pkg-config" ,pkg-config-final)))
+    (arguments
+     `(#:implicit-inputs? #f
+       ,@(package-arguments gnu-make)))))

 (define coreutils-final
  ;; The final Coreutils.  Treat them specially because some packages, such as
@@ -3549,6 +3627,9 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
  (let ((sed (with-boot6 (package-with-bootstrap-guile sed))))
    (package/inherit sed (native-inputs `(("perl" ,perl-boot0))))))

+(define xxhash-final
+  ((compose with-boot6 package-with-bootstrap-guile) xxhash))
+
 (define-public %final-inputs
  ;; The 'glibc-final' package is not the same depending on what system is
  ;; targeted, so this whole list must be parameterized.
@@ -3574,19 +3655,20 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
                              (native-inputs
                               (list (if (target-hurd?)
                                         glibc-utf8-locales-final/hurd
-                                         glibc-utf8-locales-final)))))
-                   ("zstd" ,zstd)))
+                                         glibc-utf8-locales-final)))))))
          ("sed" ,sed-final)
          ("grep" ,grep-final)
          ("xz" ,xz-final)
          ("coreutils" ,coreutils-final)
+          ("dwz" ,dwz-final)
          ("make" ,(make-gnu-make-final))
          ("bash" ,bash-final)
          ("ld-wrapper" ,ld-wrapper)
          ("binutils" ,binutils-final)
          ("gcc" ,gcc-final)
          ("libc" ,glibc-final)
-          ("libc:static" ,glibc-final "static"))))))
+          ("libc:static" ,glibc-final "static")
+          ("zstd" ,zstd-final))))))

 (define-public canonical-package
  (let ((name->package (mlambda (system)
@@ -84,7 +84,6 @@
  #:use-module (gnu packages boost)
  #:use-module (gnu packages check)
  #:use-module (gnu packages cpp)
-  #:use-module (gnu packages crypto)
  #:use-module (gnu packages curl)
  #:use-module (gnu packages documentation)
  #:use-module (gnu packages file)
@@ -96,7 +95,6 @@
  #:use-module (gnu packages gtk)
  #:use-module (gnu packages java)
  #:use-module (gnu packages llvm)
-  #:use-module (gnu packages linux)
  #:use-module (gnu packages man)
  #:use-module (gnu packages maths)
  #:use-module (gnu packages perl)
@@ -553,7 +551,7 @@ formats, including zstd, xz, gzip, and bgzf.")
 (define-public xz
  (package
   (name "xz")
-   (version "5.4.5")
+   (version "5.8.1")
   (source (origin
            (method url-fetch)
            (uri (list (string-append "http://tukaani.org/xz/xz-" version
@@ -562,7 +560,7 @@ formats, including zstd, xz, gzip, and bgzf.")
                                      version ".tar.gz")))
            (sha256
             (base32
-              "1mmpwl4kg1vs6n653gkaldyn43dpbjh8gpk7sk0gps5f6jwr0p0k"))))
+              "0hsmg58a27jd1vq0lc6yp405978c1nfhqwndl7f10v1mk6sjay2h"))))
   (build-system gnu-build-system)
   (arguments
    `(#:phases
@@ -599,21 +597,6 @@ than gzip and 15 % smaller output than bzip2.")
   (license (list license:gpl2+ license:lgpl2.1+)) ; bits of both
   (home-page "https://tukaani.org/xz/")))

-(define-public xz-for-graal-truffle
-  (package
-   (inherit xz)
-   (name "xz-for-graal-truffle")
-   (version "5.6.2")
-   (source (origin
-            (method url-fetch)
-            (uri (list (string-append "http://tukaani.org/xz/xz-" version
-                                      ".tar.gz")
-                       (string-append "http://multiprecision.org/guix/xz-"
-                                      version ".tar.gz")))
-            (sha256
-             (base32
-              "06a585qzn2qlwdv44w7x6p6x8qmbqrqzlz29y8108vyqw7021zcb"))))))
-
 (define-public heatshrink
  (package
    (name "heatshrink")
@@ -764,14 +747,14 @@ archiving.  Lzip is a clean implementation of the LZMA algorithm.")
 (define-public lziprecover
  (package
    (name "lziprecover")
-    (version "1.25")
+    (version "1.23")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://savannah/lzip/lziprecover/"
                                  "lziprecover-" version ".tar.gz"))
              (sha256
               (base32
-                "0icbzw7kmp4rn711sh3f0w3sxlxly6q6dc8d7pp6dqhag2f2yfag"))))
+                "0wmmyi03fv2lflsir5ldrsv04q57k3hmlqajzb1m3p86gwbh967j"))))
    (build-system gnu-build-system)
    (arguments
     ;; The configure script doesn't recognise the --build or --host
@@ -779,7 +762,6 @@ archiving.  Lzip is a clean implementation of the LZMA algorithm.")
     `(,@(if (%current-target-system)
             `(#:make-flags (list ,(string-append "CXX=" (cxx-for-target))))
             '())))
-    (native-inputs (list lzip))
    (home-page "https://www.nongnu.org/lzip/lziprecover.html")
    (synopsis "Recover and decompress data from damaged lzip files")
    (description
@@ -1057,14 +1039,14 @@ decompression of some loosely related file formats used by Microsoft.")
 (define-public lz4
  (package
    (name "lz4")
-    (version "1.10.0")
+    (version "1.9.3")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference (url "https://github.com/lz4/lz4")
                           (commit (string-append "v" version))))
       (sha256
-        (base32 "12sfwid95zhk2r2ijpwwknc5a2xlll2s9xhf0s21ca2jkygvblgx"))
+        (base32 "1w02kazh1fps3sji2sn89fz862j1199c5ajrqcgl1bnlxj09kcbz"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (outputs (list "out" "static"))
@@ -1794,14 +1776,14 @@ or junctions, and always follows hard links.")
 (define-public zstd
  (package
    (name "zstd")
-    (version "1.5.6")
+    (version "1.5.7")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://github.com/facebook/zstd/releases/download/"
                           "v" version "/zstd-" version ".tar.gz"))
       (sha256
-        (base32 "1h83si7s70jy7mcy0mv1c9mbkz66qqpawxs0zkmc3b1ayinf0acc"))))
+	(base32 "18vgkvh7w6zw4jn2aj1mp0yv98m4fk52ay6da0wh4pm194gyaczb"))))
    (build-system gnu-build-system)
    (outputs '("out"                    ;1.5MiB executables and documentation
               "lib"                    ;1.2MiB shared library and headers
@@ -1868,6 +1850,10 @@ or junctions, and always follows hard links.")
                            ;; This isn't picked up correctly in the Makefiles.
                            "EXT=.exe")
                          '())
+                   #$@(if (target-hurd?)
+                          ;; Uses symbols from pthread.
+                          `("PCMTLIB=-pthread")
+                          '())
                   ;; Auto-detection is over-engineered and buggy.
                   "PCLIBDIR=lib"
                   "PCINCDIR=include"
@@ -1895,31 +1881,17 @@ speed.")
                   license:public-domain ; zlibWrapper/examples/fitblk*
                   license:zlib))))      ; zlibWrapper/{gz*.c,gzguts.h}

-(define-public zstd-1.5.7
-  (package
-    (inherit zstd)
-    ;; Don't hide this package from the UI.
-    (properties '())
-    (version "1.5.7")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (string-append "https://github.com/facebook/zstd/releases/download/"
-                           "v" version "/zstd-" version ".tar.gz"))
-       (sha256
-        (base32 "18vgkvh7w6zw4jn2aj1mp0yv98m4fk52ay6da0wh4pm194gyaczb"))))))
-
 (define-public pzstd
-  (package/inherit zstd-1.5.7
+  (package/inherit zstd
    (name "pzstd")
    (outputs '("out"))
    (inputs
     `(,@(if (%current-target-system)
-             `(("googletest" ,googletest-1.8))
+             `(("googletest" ,googletest))
             '())))
    (native-inputs
     `(,@(if (%current-system)
-             `(("googletest" ,googletest-1.8))
+             `(("googletest" ,googletest))
             '())))
    (arguments
     `(#:phases
@@ -2322,14 +2294,14 @@ corrupted input.")
 (define-public plzip
  (package
    (name "plzip")
-    (version "1.12")
+    (version "1.11")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "mirror://savannah/lzip/plzip/"
                           "plzip-" version ".tar.gz"))
       (sha256
-        (base32 "0c5fmp7hkb41ybc5gmrj96xz7g74mmpfhya2ha6asm51dynimmsh"))))
+        (base32 "0sv2sp0ppxkdds4qiwb3ddvlv22ydv61n3hk74rkh8ljbkjcpqyq"))))
    (build-system gnu-build-system)
    (arguments
     (list #:configure-flags
@@ -2367,7 +2339,7 @@ single-member files which can't be decompressed in parallel.")
   (build-system cmake-build-system)
   (arguments
    `(#:tests? #f))
-   (inputs (list boost-1.83 xz))
+   (inputs (list boost xz))
   (native-inputs (list pkg-config))
   (home-page "https://constexpr.org/innoextract/")
   (synopsis "Tool for extracting Inno Setup installers")
@@ -2527,46 +2499,6 @@ download times, and other distribution and storage costs.")
    (properties `((lint-hidden-cve . ("CVE-2023-23456" "CVE-2023-23457"))))
    (license license:gpl2+)))

-(define-public qatzip
-  (package
-    (name "qatzip")
-    (version "1.3.1")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/intel/QATzip")
-                     (commit (string-append "v" version))))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "0c7kph69cf48gr97j3gzh1zwd58wxmp64vfv34z4r9ixj3lh6ziz"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list #:phases
-           #~(modify-phases %standard-phases
-               (replace 'bootstrap
-                 (lambda _
-                   ;; The script has a broken shebang (see:
-                   ;; <https://github.com/intel/QATzip/issues/143>).
-                   (invoke "sh" "autogen.sh"))))))
-    (native-inputs (list autoconf automake libtool))
-    (inputs (list numactl qatlib))
-    (propagated-inputs (list lz4 zlib)) ;in Requires of qatzip.pc
-    (home-page "https://github.com/intel/QATzip")
-    (synopsis "Compression Library accelerated by Intel QuickAssist Technology")
-    (description "QATzip is a library which builds on top of the
- Intel QuickAssist Technology user space library, to provide extended
-accelerated compression and decompression services by offloading the actual
-compression and decompression request(s) to the Intel Chipset Series.  QATzip
-produces data using the standard gzip format (RFC1952) with extended headers
-or lz4 blocks with lz4 frame format.  The data can be decompressed with a
-compliant gzip or lz4 implementation.  QATzip is designed to take full
-advantage of the performance provided by Intel QuickAssist Technology.")
-    (license license:bsd-3)
-    ;; This package only supports hardware that exists on the x86_64 platform,
-    ;; and is not portable.
-    (supported-systems (list "x86_64-linux"))))
-
 (define-public quazip
  (package
    (name "quazip")
@@ -8,8 +8,6 @@
 ;;; Copyright © 2024, 2025 Tomas Volf <~@wolfsden.cz>
 ;;; Copyright © 2024 Foundation Devices, Inc. <hello@foundation.xyz>
 ;;; Copyright © 2024 Jean-Pierre De Jesus DIAZ <jean@foundation.xyz>
-;;; Copyright © 2025 Tomas Volf <~@wolfsden.cz>
-;;; Copyright © 2025 Foster Hangdaan <foster@hangdaan.email>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -77,7 +75,7 @@
 (define-public crun
  (package
    (name "crun")
-    (version "1.25.1")
+    (version "1.24")
    (source
     (origin
       (method url-fetch)
@@ -87,7 +85,7 @@
             "/crun-" version ".tar.gz"))
       (sha256
        (base32
-         "02kksvnja234k8mpq5j7yms8npbpvh8iz3k03h21lwcqzqsb88rx"))))
+         "0lnfvwxq14pyqyxx56bdr7k4h3l99imc9vynxram7fh0chxf7dlh"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -458,77 +456,49 @@ configure network interfaces in Linux containers.")
  (package
    (name "gvisor-tap-vsock")
    (version "0.8.7")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/containers/gvisor-tap-vsock")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1p9vypphssvqfcm3y2nc7b9v0wcc2smkrqq8k60vskaiza89974k"))
-       (modules '((guix build utils)))
-       (snippet
-        #~(begin
-            (delete-file-recursively "vendor")
-            ;; Submodules with their own go.mod files and packaged separately:
-            ;;
-            ;; - github.com/containers/gvisor-tap-vsock/tools
-            (delete-file-recursively "tools")))))
-    (build-system go-build-system)
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/containers/gvisor-tap-vsock")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1p9vypphssvqfcm3y2nc7b9v0wcc2smkrqq8k60vskaiza89974k"))))
+    (build-system gnu-build-system)
    (arguments
     (list
-      #:install-source? #f
-      #:import-path "github.com/containers/gvisor-tap-vsock/cmd/gvproxy"
-      #:unpack-path "github.com/containers/gvisor-tap-vsock"
-      #:build-flags
-      #~(list (string-append "-ldflags="
-                             "-X github.com/containers/gvisor-tap-vsock"
-                             "/pkg/types.gitVersion=" #$version))
-      #:test-flags
-      ;; serve UDP error: *net.OpError read udp 127.0.0.1:5354: use of closed
-      ;; network connection
-      #~(list "-skip" "TestSuite")
-      #:test-subdirs
-      #~(list "../../...")       ;test the whole libary
+      #:make-flags `(list ,(string-append "GIT_VERSION=v" version))
+      #:test-target "test"
      #:phases
      #~(modify-phases %standard-phases
-          (add-after 'unpack 'prune-tests
-            (lambda* (#:key unpack-path #:allow-other-keys)
-              (with-directory-excursion (string-append "src/" unpack-path)
-                ;; Requires working DNS.
-                (substitute* "pkg/services/dns/dns_test.go"
-                  (("Should pass DNS requests to default system DNS.*" all)
-                   (string-append all "\n" "ginkgo.Skip(\"No network.\");"))
-                  (("\"redhat.com\",")
-                   "\"localhost\",")
-                  (("\"52.200.142.250\"")
-                   "\"127.0.0.1\""))))))))
-    (native-inputs
-     (list go-github-com-apparentlymart-go-cidr
-           go-github-com-containers-winquit
-           go-github-com-coreos-stream-metadata-go
-           go-github-com-dustin-go-humanize
-           go-github-com-google-gopacket
-           go-github-com-insomniacslk-dhcp
-           ;; go-github-com-linuxkit-virtsock  ;Windows only
-           go-github-com-mdlayher-vsock
-           ;; go-github-com-microsoft-go-winio ;Windows only
-           go-github-com-miekg-dns
-           go-github-com-onsi-ginkgo
-           go-github-com-onsi-gomega
-           go-github-com-opencontainers-go-digest
-           go-github-com-pkg-errors
-           go-github-com-sirupsen-logrus
-           go-github-com-songgao-packets
-           go-github-com-songgao-water
-           go-github-com-stretchr-testify
-           go-github-com-vishvananda-netlink
-           go-golang-org-x-crypto
-           go-golang-org-x-mod
-           go-golang-org-x-sync
-           go-golang-org-x-sys
-           go-gvisor-dev-gvisor))
+          (delete 'configure)
+          ;; Add -trimpath flag to avoid keeping references to go package
+          ;; in the store.
+          (add-after 'unpack 'patch-go-reference
+            (lambda _
+              (substitute* "Makefile"
+                (("go build") "go build -trimpath"))))
+          (add-before 'build 'setenv
+            (lambda _
+              ;; For golang toolchain.
+              (setenv "HOME" "/tmp")))
+          (add-before 'check 'prune-tests
+            (lambda _
+              ;; Requires internet connection to fetch QEMU image.
+              (invoke "rm" "-r" "test-qemu")
+              ;; Requires working DNS.
+              (substitute* "pkg/services/dns/dns_test.go"
+                (("Should pass DNS requests to default system DNS.*" all)
+                 (string-append all "\n" "ginkgo.Skip(\"No network.\");"))
+                (("\"redhat.com\",")
+                 "\"localhost\",")
+                (("\"52.200.142.250\"")
+                 "\"127.0.0.1\""))))
+          (replace 'install
+            (lambda _
+              (install-file "bin/gvproxy" (string-append #$output "/bin")))))))
+    (native-inputs (list go-1.23))
    (home-page "https://github.com/containers/gvisor-tap-vsock")
    (synopsis "Network stack for virtualization based on gVisor")
    (description "This package provides a replacement for @code{libslirp} and
@@ -572,7 +542,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
 (define-public podman
  (package
    (name "podman")
-    (version "5.7.1")
+    (version "5.6.1")
    (outputs '("out" "docker"))
    (properties
     `((output-synopsis "docker" "docker alias for podman")
@@ -585,7 +555,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
             (url "https://github.com/containers/podman")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "16lb58r8vkngics6fn1b3six8bl3nrl9awrnq6ivdv1grfgy9z61"))
+        (base32 "1k8dppbni8wbzxqqaknp08h687qw884wn7bkpiwmbw9np261fl4b"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -616,7 +586,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
                (invoke "make" "remotesystem"))))
          (add-after 'unpack 'fix-hardcoded-paths
            (lambda _
-              (substitute* "vendor/go.podman.io/common/pkg/config/config_linux.go"
+              (substitute* "vendor/github.com/containers/common/pkg/config/config_linux.go"
                (("/usr/local/libexec/podman")
                 (string-append #$output "/libexec/podman"))
                (("/usr/local/lib/podman")
@@ -677,7 +647,7 @@ Its main purpose is to support the key usage by @code{docker-init}:
     (list grep
           bats
           git-minimal/pinned
-           go-1.24
+           go-1.23
           go-md2man
           gettext-minimal ; for envsubst
           mandoc
@@ -703,33 +673,22 @@ To get @code{podman machine} working, install @code{qemu-minimal}, and
 (define-public podman-compose
  (package
    (name "podman-compose")
-    (version "1.5.0")
+    (version "1.2.0")
    (source
     (origin
       (method git-fetch)
       (uri (git-reference
-              (url "https://github.com/containers/podman-compose")
-              (commit (string-append "v" version))))
+             (url "https://github.com/containers/podman-compose")
+             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "08pz9axvgfyr0jd8rlndmhh8147s864mz17ng6qs07831g9ylj80"))))
+        (base32 "06vm088q1x7j929n93ylq3bav716bqh6l79agj8sgzsqxjsmli73"))))
    (build-system pyproject-build-system)
    (arguments
     (list
-      ;; Only run tests in `tests/unit`, skipping the ones in
-      ;; `tests/integration`. The integration tests need an environment with
-      ;; the ability to manage containers and volumes using the `podman`
-      ;; command.
-      ;;
-      ;; tests: 378 tests
-      #:test-backend #~'unittest
-      #:test-flags #~(list "discover" "tests/unit")))
-    (native-inputs
-     (list python-parameterized
-           python-setuptools))
-    (propagated-inputs
-     (list python-dotenv
-           python-pyyaml))
+      #:test-flags #~(list "pytests")))
+    (native-inputs (list python-pytest python-parameterized python-setuptools python-wheel))
+    (propagated-inputs (list python-dotenv python-pyyaml))
    (home-page "https://github.com/containers/podman-compose")
    (synopsis "Script to run docker-compose.yml using podman")
    (description
@@ -741,7 +700,7 @@ being rootless and not requiring any daemon to be running.")
 (define-public buildah
  (package
    (name "buildah")
-    (version "1.42.1")
+    (version "1.41.4")
    (source
     (origin
       (method git-fetch)
@@ -749,7 +708,7 @@ being rootless and not requiring any daemon to be running.")
             (url "https://github.com/containers/buildah")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "1agblw09yw4pc81c2nsjy3j83gznn4micyjyrgpqxlmp93w5w5h0"))
+        (base32 "0gca1zv98c58z6c06ckgg63mm2305b1qzavxfmlgmj8s4f72g3zh"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
@@ -814,7 +773,7 @@ being rootless and not requiring any daemon to be running.")
                  lvm2))
    (native-inputs
     (list bats
-           go-1.24
+           go-1.23
           go-md2man
           pkg-config))
    (synopsis "Build @acronym{OCI, Open Container Initiative} images")
@@ -139,46 +139,43 @@
  #:use-module (ice-9 match))

 (define-public argagg
-  (package
-    (name "argagg")
-    (version "0.4.7")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/vietjtnguyen/argagg")
-                     (commit version)))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1pr0xqcc3wpwh02fwll3yf67rbxj39wbr2rqdd6bvjalmahg6hqv"))))
-    (build-system cmake-build-system)
-    (outputs '("out" "doc"))
-    (arguments
-     (list
-      #:configure-flags #~(list
-                           (format #f "-DCMAKE_CXX_FLAGS=~a"
-                                   (string-join
-                                    (list "-Wno-error=array-bounds="
-                                          "-Wno-error=sign-conversion"))))
-      #:phases #~(modify-phases %standard-phases
-                   (add-after 'install 'move-doc
-                     (lambda* (#:key outputs #:allow-other-keys)
-                       (let ((name #$(package-name argagg))
-                             (doc (assoc-ref outputs "doc")))
-                         (mkdir-p (string-append doc "/share/doc"))
-                         (rename-file
-                          (string-append #$output "/share/doc/" name)
-                          (string-append doc "/share/doc/" name))))))))
-    (native-inputs (list doxygen))
-    (home-page "https://github.com/vietjtnguyen/argagg")
-    (synopsis "C++11 command line argument parser")
-    (description
-     "ArgAgg is yet another C++ command line argument/option
+  (let ((commit "79e4adfa2c6e2bfbe63da05cc668eb9ad5596748") (revision "0"))
+    (package
+      (name "argagg")
+      (version (git-version "0.4.6" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/vietjtnguyen/argagg")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32
+                  "1flkgh524lq3024p7ld5lg743s1v7qnbmgv77578rzmn2rjzr77n"))))
+      (build-system cmake-build-system)
+      (outputs '("out" "doc"))
+      (arguments
+       `(#:phases (modify-phases %standard-phases
+                    (add-after 'install 'move-doc
+                      (lambda* (#:key outputs #:allow-other-keys)
+                        (let* ((name ,(package-name argagg)) (out (assoc-ref
+                                                                   outputs
+                                                                   "out"))
+                               (doc (assoc-ref outputs "doc")))
+                          (mkdir-p (string-append doc "/share/doc"))
+                          (rename-file
+                           (string-append out "/share/doc/" name)
+                           (string-append doc "/share/doc/" name))))))))
+      (native-inputs (list doxygen))
+      (home-page "https://github.com/vietjtnguyen/argagg")
+      (synopsis "C++11 command line argument parser")
+      (description
+       "ArgAgg is yet another C++ command line argument/option
 parser.  It was written as a simple and idiomatic alternative to other
 frameworks like getopt, Boost program options, TCLAP, and others.  The goal is
 to achieve the majority of argument parsing needs in a simple manner with an
 easy to use API.")
-    (license license:expat)))
+      (license license:expat))))

 (define-public argpp
  ;; XXX: Does not release anymore.
@@ -457,7 +454,7 @@ data structures for C++.")
        (base32 "08w3ppd43wx9vq641ljw5izjd7p5w7drynw13ll9shwy41ydif9n"))))
    (build-system cmake-build-system)
    (native-inputs
-     (list googletest-1.13 pkg-config))
+     (list googletest pkg-config))
    (synopsis "Guidelines Support Library")
    (description "c++-gsl contains functions and types that are suggested for
 use by the C++ Core Guidelines maintained by the Standard C++ Foundation.")
@@ -912,7 +909,7 @@ same name.")
 (define-public google-highway
  (package
    (name "google-highway")
-    (version "1.3.0")
+    (version "1.2.0")
    (source
     (origin
       (method git-fetch)
@@ -921,7 +918,7 @@ same name.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1bl576f3zlygxfmjqs5rrk3sag411hlhx2210lpq461plvvs80zi"))))
+        (base32 "0ykhc6n3ai18dijdmi38fm1d7pa8i6nbgh64jrxd4499k7jhg568"))))
    (build-system cmake-build-system)
    (arguments
     `(#:configure-flags (list "-DHWY_SYSTEM_GTEST=on"
@@ -947,7 +944,7 @@ library for SIMD (Single Instruction, Multiple Data) with runtime dispatch.")
 (define-public hyprgraphics
  (package
    (name "hyprgraphics")
-    (version "0.4.0")
+    (version "0.2.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -958,7 +955,7 @@ library for SIMD (Single Instruction, Multiple Data) with runtime dispatch.")
              (snippet #~(substitute* "CMakeLists.txt" (("libjxl_cms") "")))
              (sha256
               (base32
-                "1jii9l9qbksp6x1vwbm84a985hy9q9xcpl703bliprd5rkpi6w96"))))
+                "1xr2pbawwnnwjwzkgsy9s4wq1j85x4qhj3m4s2pwb9wp6g69da2g"))))
    (build-system cmake-build-system)
    (native-inputs (list gcc-15 pkg-config))
    (inputs (list cairo
@@ -982,7 +979,7 @@ utilities used across the hypr* ecosystem.")
 (define-public hyprlang
  (package
    (name "hyprlang")
-    (version "0.6.7")
+    (version "0.6.4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -991,7 +988,7 @@ utilities used across the hypr* ecosystem.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0n64jq9jdabyx76sax0fb45jg92708488733c2m6zsf84r6nv2g7"))))
+                "080kibsllxfrlck4gix0ygr12gnvf9p9ybi589fsvpab9p9xw857"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -1016,7 +1013,7 @@ language used in Hyprland.")
 (define-public hyprutils
  (package
    (name "hyprutils")
-    (version "0.10.4")
+    (version "0.10.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1025,11 +1022,10 @@ language used in Hyprland.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "08b65pssaci780rgb5qgqc61zvbxmb9qda4gb58j8nh9yi3ya0jx"))))
+                "0l4gdingspjv3fh7zkmdin37bjjxgxnxycn8agv4cr3n0kn9smxg"))))
    (build-system cmake-build-system)
    (arguments
     (list
-      #:tests? #f ; No tests in Release build type
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'fix-cross-compilation
@@ -1496,7 +1492,7 @@ tools (containers, algorithms) used by other QuantStack packages.")
 (define-public ccls
  (package
    (name "ccls")
-    (version "0.20250815.1")
+    (version "0.20250815")
    (source
     (origin
       (method git-fetch)
@@ -1504,7 +1500,7 @@ tools (containers, algorithms) used by other QuantStack packages.")
             (url "https://github.com/MaskRay/ccls")
             (commit version)))
       (sha256
-        (base32 "1jl4jv1z8vxjfmkv2mvii68aqqx2nrcbd6bhzjs5dd65r23bqs6x"))
+        (base32 "1qpshqj08rc2ws5capyv8kl9rndh3sp2bbzambnx2l9b98pnkvj7"))
       (file-name (git-file-name name version))))
    (build-system cmake-build-system)
    (arguments
@@ -1910,7 +1906,7 @@ development of concurrent and multithreaded applications in C++.")
 (define-public taskflow
  (package
    (name "taskflow")
-    (version "3.10.0")
+    (version "3.6.0")
    (source
     (origin
       (method git-fetch)
@@ -1919,7 +1915,7 @@ development of concurrent and multithreaded applications in C++.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "08z7vif8lk4jri9m77j9gqyyv7nwza5qfgab0bk5gl9akb63qh5k"))))
+        (base32 "1cv74l181137lchc1rxygcg401cnq216ymq5qz2njsw99j342br3"))))
    (build-system cmake-build-system)
    (home-page "https://taskflow.github.io/")
    (synopsis
@@ -2134,7 +2130,7 @@ point and then, after each tween step, plugging back the result.")
                (("check_target\\(gtest_main\\)") "")
                (("check_target\\(gmock\\)") "")))))))
    (native-inputs
-     (list googletest-1.12))
+     (list googletest))
    (home-page "https://abseil.io")
    (synopsis "Augmented C++ standard library")
    (description "Abseil is a collection of C++ library code designed to
@@ -2147,7 +2143,7 @@ Google's C++ code base.")
    (package
      (inherit base)
      (name "abseil-cpp")
-      (version "20250814.1")
+      (version "20250127.1")
      (source (origin
                (method git-fetch)
                (uri (git-reference
@@ -2156,7 +2152,7 @@ Google's C++ code base.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "1wm2271hwy2pnfv9b5iy0y9xvbhiwffdf9i6s3dn89k630wh6928"))
+                  "0r2j360csym12jlgmcy92rgwdmng63shchxvfmln3j5402lv0g21"))
                (patches
                 (search-patches "abseil-cpp-20220623.1-no-kepsilon-i686.patch"))))
      (arguments
@@ -2180,28 +2176,7 @@ Google's C++ code base.")
                              (setenv "CTEST_OUTPUT_ON_FAILURE" "1")
                              (invoke "ctest" "-E"
                                      "absl_symbolize_test|absl_log_format_test")))))
-                     #~())))))
-      (native-inputs
-       (modify-inputs (package-native-inputs base)
-         (replace "googletest" googletest))))))
-
-(define-public abseil-cpp-20250127
-  (let ((base abseil-cpp))
-    (package
-      (inherit base)
-      (name "abseil-cpp")
-      (version "20250127.1")
-      (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/abseil/abseil-cpp")
-                      (commit version)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "0r2j360csym12jlgmcy92rgwdmng63shchxvfmln3j5402lv0g21"))
-                (patches
-                 (search-patches "abseil-cpp-20220623.1-no-kepsilon-i686.patch")))))))
+                     #~()))))))))

 (define (abseil-cpp-for-c++-standard base version)
  (hidden-package
@@ -2314,39 +2289,42 @@ parsers according to a Parsing Expression Grammar (PEG).")
    (license license:expat)))

 (define-public lexy
-  (package
-    (name "lexy")
-    (version "2025.05.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/foonathan/lexy")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "14j2z7x2l65q95j5br5nw7awgd87p9m2xw7mma4qspiricd0rniq"))))
-    (build-system cmake-build-system)
-    (arguments
-     (list #:configure-flags #~(list "-DLEXY_BUILD_DOCS=OFF") ; needs Hugo
-           #:phases
-           #~(modify-phases %standard-phases
-               (add-after 'unpack 'fix-dependencies
-                 (lambda _
-                   (substitute* "tests/CMakeLists.txt"
-                     (("^message\\(STATUS \"Fetching doctest\"\\).*") "")
-                     (("^include\\(FetchContent\\).*") "")
-                     (("^FetchContent_Declare\\(doctest .*") "")
-                     (("^FetchContent_MakeAvailable\\(doctest\\)")
-                      "find_package(doctest REQUIRED)")
-                     (("^(target_link_libraries\\(lexy_test_base .*) doctest\\)"
-                       _ prefix)
-                      (string-append prefix ")"))))))))
-    (native-inputs (list doctest))
-    (home-page "https://lexy.foonathan.net/")
-    (synopsis "C++ parser combinator library")
-    (description "lexy is a parser combinator library for C++17 and later.")
-    (license license:boost1.0)))
+  ;; Bug fixes since last release.
+  (let ((commit "34d2adf74a2b25b6bdd760a3bbb931f3fd5e60cd")
+        (revision "0"))
+    (package
+      (name "lexy")
+      (version (git-version "2022.12.1" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/foonathan/lexy")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "1ywcy3wdmqjj5z1w64hk0dwf8iv6p62s48m7l6vn881hfzc8hcxz"))))
+      (build-system cmake-build-system)
+      (arguments
+       (list #:configure-flags #~(list "-DLEXY_BUILD_DOCS=OFF") ; needs Hugo
+             #:phases
+             #~(modify-phases %standard-phases
+                 (add-after 'unpack 'fix-dependencies
+                   (lambda _
+                     (substitute* "tests/CMakeLists.txt"
+                       (("^message\\(STATUS \"Fetching doctest\"\\).*") "")
+                       (("^include\\(FetchContent\\).*") "")
+                       (("^FetchContent_Declare\\(doctest .*") "")
+                       (("^FetchContent_MakeAvailable\\(doctest\\)")
+                        "find_package(doctest REQUIRED)")
+                       (("^(target_link_libraries\\(lexy_test_base .*) doctest\\)"
+                         _ prefix)
+                        (string-append prefix ")"))))))))
+      (native-inputs (list doctest))
+      (home-page "https://lexy.foonathan.net/")
+      (synopsis "C++ parser combinator library")
+      (description "lexy is a parser combinator library for C++17 and later.")
+      (license license:boost1.0))))

 (define-public psascan
  (package
@@ -2412,7 +2390,7 @@ standard GNU style syntax for options.")
 (define-public folly
  (package
    (name "folly")
-    (version "2025.11.10.00")
+    (version "2024.09.09.00")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -2421,7 +2399,7 @@ standard GNU style syntax for options.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "11gdrc2jhb9dzjgpq6h3p5453f8gyvv4ngsnrqi4rylfil8a3b3i"))))
+                "17fdigkaxivbrww5yhz9fh25d8pirqjp126zbv4kg4qsprywfww5"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -2473,22 +2451,17 @@ of C++14 components that complements @code{std} and Boost.")
    (build-system cmake-build-system)
    (arguments
     (list
-      #:configure-flags #~(list "-DENABLE_TESTS=ON" "-DENABLE_CRYPTO=ON"
-                                "-DENABLE_NETSSL=ON")
+      #:configure-flags #~(list "-DENABLE_TESTS=ON")
      #:phases
      #~(modify-phases %standard-phases
          (add-after 'unpack 'disable-problematic-tests
            (lambda _
              (substitute* (list "Foundation/CMakeLists.txt" ; XXX: fails.
-                                 ;; Require network access.
+                                 ;; Require network access
                                 "Net/CMakeLists.txt"
                                 "MongoDB/CMakeLists.txt"
-                                 "Redis/CMakeLists.txt"
-                                 ;; Requires network access and uses certificates
-                                 ;; that will expire.
-                                 "NetSSL_OpenSSL/CMakeLists.txt")
+                                 "Redis/CMakeLists.txt")
                (("ENABLE_TESTS") "FALSE")))))))
-    (inputs (list openssl))
    (home-page "https://pocoproject.org/")
    (synopsis "Portable C++ components")
    (description "This package provides a collection of C++ libraries intended
@@ -2689,7 +2662,7 @@ composable sequential transformations.")
                          (lambda _
                            (delete-file-recursively "test/event_loop")))
                        (replace 'check (assoc-ref gnu:%standard-phases 'check)))))
-   (inputs (list boost-1.83 immer zug))
+   (inputs (list boost immer zug))
   (native-inputs (list catch2 cereal))
   (home-page "https://sinusoid.es/lager")
   (synopsis "Library for value-oriented design")
@@ -3194,7 +3167,6 @@ of reading and writing XML.")
       (sha256
        (base32 "1ddz14699v5lqx3dh0mb7hfffr6fk5zhmzn3z8yxkqqvriqnciim"))
       (modules '((guix build utils)))
-       (patches (search-patches "jsonnet-include-cstdint-for-gcc-13-builds.patch"))
       (snippet
        #~(begin
            (rename-file "third_party/md5" ".md5")
@@ -3312,8 +3284,7 @@ validation.")
                                        "bslh_hash.t"
                                        "bslstl_deque.0[1345].t"
                                        "bslstl_queue.t"
-                                        "bslstl_stack.t"
-                                        "bslstl_string_test.t")
+                                        "bslstl_stack.t")
                                  "|")
      #:modules '((guix build cmake-build-system)
                  ((guix build gnu-build-system) #:prefix gnu:)
@@ -50,7 +50,6 @@
  #:use-module (gnu packages)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages aidc)
-  #:use-module (gnu packages assembly)
  #:use-module (gnu packages attr)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages base)
@@ -80,7 +79,6 @@
  #:use-module (gnu packages perl-check)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages python)
-  #:use-module (gnu packages python-build)
  #:use-module (gnu packages python-xyz)
  #:use-module (gnu packages python-check)
  #:use-module (gnu packages python-crypto)
@@ -104,7 +102,6 @@
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system perl)
  #:use-module (guix build-system python)
-  #:use-module (guix build-system pyproject)
  #:use-module (guix utils)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26))
@@ -135,7 +132,7 @@
               ;; TODO: perhaps infer #:tests?
               (if #$(%current-target-system)
                   "OFF" "ON")))))
-    (native-inputs (list googletest-1.12))
+    (native-inputs (list googletest))
    (home-page "https://github.com/google/crc32c")
    (synopsis "Cyclic redundancy check")
    (description
@@ -254,7 +251,7 @@ communication, encryption, decryption, signatures, etc.")
 (define-public libmd
  (package
    (name "libmd")
-    (version "1.1.0")
+    (version "1.0.4")
    (source (origin
            (method url-fetch)
            (uri
@@ -265,12 +262,11 @@ communication, encryption, decryption, signatures, etc.")
                             version ".tar.xz")))
            (sha256
             (base32
-              "0cmkfq3v0hqzjwpsyp02i3a1z2sfjrdjxky784qsy4sk4x1ammhv"))))
+              "03skgv013v0y9hxh6j143xdwynb5cmbmbdylvvgfsjz38889477m"))))
    (build-system gnu-build-system)
    (arguments
-     (list
-      #:configure-flags
-      #~(list "--disable-static")))
+     `(#:configure-flags
+       (list "--disable-static")))
    (synopsis "Message Digest functions from BSD systems")
    (description
     "The currently provided message digest algorithms are:
@@ -521,14 +517,14 @@ total number of shares generated.")
 (define-public tomb
  (package
    (name "tomb")
-    (version "2.13")
+    (version "2.11")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://files.dyne.org/tomb/releases/"
                           "Tomb-" version ".tar.gz"))
       (sha256
-        (base32 "1405kw0j8i1bqyqbim8530xf6hchpf57r9p1v92aknwyn5wgny0g"))))
+        (base32 "05f34yx91bn9fj7rkabgpzvkw4pa6bg2c1r8cnp72wwnx6bzj97m"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -795,47 +791,6 @@ data on your platform, so the seed itself will be as random as possible.
@end enumerate\n")
    (license license:artistic2.0)))

-(define-public qatlib
-  (package
-    (name "qatlib")
-    (version "25.08.0")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/intel/qatlib/")
-                     (commit version)))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "1hbhrj0wlr68by7gdvsw4nh35rwg4yngn3m7awkx799pbqsw4iyc"))))
-    (build-system gnu-build-system)
-    (arguments
-     (list #:configure-flags #~(list "--disable-static") ;avoid large .a
-           #:phases
-           #~(modify-phases %standard-phases
-               (replace 'bootstrap
-                 (lambda _
-                   ;; The script has a broken shebang (see:
-                   ;; <https://github.com/intel/qatlib/issues/128>).
-                   (invoke "sh" "autogen.sh"))))))
-    (native-inputs (list autoconf autoconf-archive automake libtool nasm))
-    (inputs (list numactl openssl zlib))
-    (propagated-inputs (list openssl))  ;in 'Requires' of libqat.pc
-    (home-page "https://github.com/intel/qatlib")
-    (synopsis "Intel QuickAssist Technology Library (QATlib)")
-    (description "Intel QuickAssist Technology provides hardware acceleration for
-offloading security, authentication and compression services from the CPU,
-thus significantly increasing the performance and efficiency of standard
-platform solutions.  Its services include symmetric encryption and
-authentication, asymmetric encryption, digital signatures, RSA, DH and ECC,
-and lossless data compression.  This package provides user space libraries
-that allow access to Intel QuickAssist devices and expose the Intel
-QuickAssist APIs and sample codes.")
-    (license license:bsd-3)
-    ;; This package only supports hardware that exists on the x86_64 platform,
-    ;; and is not portable.
-    (supported-systems (list "x86_64-linux"))))
-
 (define-public crypto++
  (package
    (name "crypto++")
@@ -1027,16 +982,14 @@ SHA256, SHA512, SHA3, AICH, ED2K, Tiger, DC++ TTH, BitTorrent BTIH, GOST R
 (define-public botan
  (package
    (name "botan")
-    (version "3.9.0")
+    (version "2.19.3")
    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/randombit/botan/")
-                     (commit version)))
-              (file-name (git-file-name name version))
+              (method url-fetch)
+              (uri (string-append "https://botan.randombit.net/releases/"
+                                  "Botan-" version ".tar.xz"))
              (sha256
               (base32
-                "1k5dyn39b77bfawly2yms0crbkn6g7msh16q7bxnh7dra4cnkmsn"))))
+                "0m9dh00zibx13pbjij8lbncf86pix3cxklxmgl47z965k7rlgq6s"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -1077,24 +1030,6 @@ using ctypes is included, and several other language bindings are available.")
    (home-page "https://botan.randombit.net")
    (license license:bsd-2)))

-;; Needed explicitly by biboumi
-(define-public botan-2
-  (hidden-package
-   (package
-     (inherit botan)
-     (name "botan")
-     (version "2.19.3")
-     (source
-      (origin
-        (method git-fetch)
-        (uri (git-reference
-               (url "https://github.com/randombit/botan/")
-               (commit version)))
-        (file-name (git-file-name name version))
-        (sha256
-         (base32
-          "16dsrxb7z245hvbjzapq7qf65ip1fh2390qap30hpfd383dyvilw")))))))
-
 (define-public ccrypt
  (package
    (name "ccrypt")
@@ -1119,8 +1054,8 @@ security.")
    (license license:gpl2)))

 (define-public asignify
-  (let ((commit "d6b3651fa96f05aeefc318f75503fc9ca77b1f58")
-        (revision "2"))
+  (let ((commit "08af003e1f4833713db28b871759d94f9b2b1469")
+        (revision "1"))
    (package
      (name "asignify")
      (version (git-version "1.1" revision commit))
@@ -1132,28 +1067,26 @@ security.")
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "0a6k21gb2n45bj1d2qy34lgi4qsd3ck59jxcycbxafs0wdglsyl9"))))
+                  "1zacpqa8b5lg270z1g06r5ik9vnb91crb4ivyy20381dny82xvr1"))))
      (build-system gnu-build-system)
      (arguments
-       (list
-        #:configure-flags
-        #~(list "--enable-openssl"
-                (string-append "--with-openssl="
-                               #$(this-package-input "openssl")))))
+       `(#:configure-flags
+         (list "--enable-openssl"
+               (string-append "--with-openssl="
+                              (assoc-ref %build-inputs "openssl")))))
      (native-inputs
       (list autoconf automake libtool))
      (inputs
       (list openssl))
      (home-page "https://github.com/vstakhov/asignify")
-      (synopsis
-       "Cryptographic authentication and encryption tool and library")
+      (synopsis "Cryptographic authentication and encryption tool and library")
      (description "Asignify offers public cryptographic signatures and
-encryption with a library or a command-line tool.  The tool is heavily
-inspired by signify as used in OpenBSD.  The main goal of this project is to
-define a high level API for signing files, validating signatures and
-encrypting using public-key cryptography.  Asignify is designed to be portable
-and self-contained with zero external dependencies.  Asignify can verify
-OpenBSD signatures, but it cannot sign messages in OpenBSD format yet.")
+encryption with a library or a command-line tool.  The tool is heavily inspired
+by signify as used in OpenBSD.  The main goal of this project is to define a
+high level API for signing files, validating signatures and encrypting using
+public-key cryptography.  Asignify is designed to be portable and self-contained
+with zero external dependencies.  Asignify can verify OpenBSD signatures, but it
+cannot sign messages in OpenBSD format yet.")
      (license license:bsd-2))))

 (define-public enchive
@@ -1171,19 +1104,17 @@ OpenBSD signatures, but it cannot sign messages in OpenBSD format yet.")
                (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
-     (list
-      #:tests? #f                      ;no check target         '
-      #:make-flags
-      #~(list (string-append "CC=" #$(cc-for-target))
-              (string-append "PREFIX=" #$output))
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (add-after 'install 'post-install
-            (lambda _
-              (install-file
-               "enchive-mode.el"
-               (string-append #$output "/share/emacs/site-lisp")))))))
+     `(#:tests? #f                      ; no check target         '
+       #:make-flags (list ,(string-append "CC=" (cc-for-target))
+                          "PREFIX=$(out)")
+       #:phases (modify-phases %standard-phases
+                  (delete 'configure)
+                  (add-after 'install 'post-install
+                    (lambda _
+                      (let* ((out (assoc-ref %outputs "out"))
+                             (lisp (string-append out "/share/emacs/site-lisp")))
+                        (install-file "enchive-mode.el" lisp)
+                        #t))))))
    (synopsis "Encrypted personal archives")
    (description
     "Enchive is a tool to encrypt files to yourself for long-term
@@ -1339,24 +1270,27 @@ utility/testing functions.")
                "1fb5yi3d2k8kd4zm7liiqagpz610y168xrr1cvn7cbq314jm2my1"))))
    (build-system gnu-build-system)
    (arguments
-     (list
-      #:tests? #f ; No test suite
-      #:make-flags
-      #~(list (string-append "PREFIX=" #$output)
-              ;; Build the program and the docs.
-              "SUBDIRS=src doc")
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure) ; No ./configure script
-          (add-after 'unpack 'patch-path
-            (lambda _
-              (substitute* '("src/Makefile" "doc/Makefile")
-                (("/usr/bin/install")
-                 "install"))))
-          (add-before 'install 'make-output-directories
-            (lambda _
-              (mkdir-p (string-append #$output "/bin"))
-              (mkdir-p (string-append #$output "/share/man/man1")))))))
+     `(#:tests? #f ; No test suite
+       #:make-flags
+       (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
+             ;; Build the program and the docs.
+             "SUBDIRS=src doc")
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure) ; No ./configure script
+         (add-after 'unpack 'patch-path
+           (lambda _
+             (substitute* '("src/Makefile" "doc/Makefile")
+               (("/usr/bin/install")
+                "install"))))
+         (add-before 'install 'make-output-directories
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin"))
+                    (man1 (string-append out "/share/man/man1")))
+               (mkdir-p bin)
+               (mkdir-p man1)
+               #t))))))
    (inputs
     (list libsodium openssl))
    (synopsis "High-performance command-line tool for stream encryption")
@@ -1371,7 +1305,7 @@ quickly by using all your CPU cores and hardware acceleration.")
 (define-public minisign
  (package
    (name "minisign")
-    (version "0.12")
+    (version "0.11")
    (source
     (origin
       (method git-fetch)
@@ -1380,7 +1314,7 @@ quickly by using all your CPU cores and hardware acceleration.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1b7iagx8jdyhvni24qhq13qydsinbh42gvb9dgn8d9vx3f33645a"))))
+        (base32 "1vv2bhhsyhlpnjclfa7gkqgd9xi3jfcdrss7abbdxvvflyrwdk5i"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f))                    ; no test suite
@@ -1403,7 +1337,7 @@ Trusted comments are signed, thus verified, before being displayed.")
 (define-public olm
  (package
    (name "olm")
-    (version "3.2.16")
+    (version "3.2.14")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1411,7 +1345,7 @@ Trusted comments are signed, thus verified, before being displayed.")
                    (commit version)))
              (sha256
               (base32
-                "19yibssxn12q6ddl15nvqzvcf1hwqial48ng6llfafwbkfdb8z95"))
+                "0pj7gs32ixhlls792wah7xf49j5pra0avp7dpvy9cndkdkg6biq5"))
              (file-name (git-file-name name version))
              ;; Delete the bundled blob.  It's free, but unauditable,
              ;; and apparently only required for android.
@@ -1419,60 +1353,58 @@ Trusted comments are signed, thus verified, before being displayed.")
                         "android/gradle/wrapper/gradle-wrapper.jar"))))
    (build-system cmake-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (replace 'check
-            (lambda* (#:key tests? #:allow-other-keys)
-              (when tests?
-                (with-directory-excursion "tests"
-                  (invoke "ctest" "."))))))))
+     `(#:phases
+       (modify-phases %standard-phases
+         (replace 'check
+           (lambda* (#:key tests? #:allow-other-keys)
+             (when tests?
+               (with-directory-excursion "tests"
+                 (invoke "ctest" "."))))))))
    (synopsis "Implementation of the Olm and Megolm cryptographic ratchets")
    (description "The Olm library implements the Double Ratchet
 cryptographic ratchet.  It is written in C and C++11, and exposed as a C
 API.")
-    (home-page "https://gitlab.matrix.org/matrix-org/olm/")
+    (home-page "https://matrix.org/docs/projects/other/olm/")
    (license license:asl2.0)))

 (define-deprecated-package libolm
  olm)

-;; TODO: This is the only Python package here, consider to build from source
-;; directly without inheritance and move to python-crypto module.
 (define-public python-olm
  (package
    ;; python-olm is part of olm and must be updated at the same time.
    (inherit olm)
    (name "python-olm")
-    (build-system pyproject-build-system)
+    (build-system python-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-after 'unpack 'chdir
-            (lambda _
-              (chdir "python")))
-          (add-before 'build 'set-preprocessor
-            (lambda _
-              (setenv "CPP" "gcc -E"))))))
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'chdir
+           (lambda _
+             (chdir "python")))
+         (add-before 'build 'set-preprocessor
+           (lambda* (#:key inputs #:allow-other-keys)
+             (setenv "CPP" "gcc -E")))
+         (replace 'check
+           (lambda* (#:key tests? inputs outputs #:allow-other-keys)
+             (when tests?
+               (add-installed-pythonpath inputs outputs)
+               (invoke "pytest")))))))
    (inputs (list olm))
    (propagated-inputs
     (list python-cffi python-future))
    (native-inputs
-     (list python-aspectlib
-           python-pytest
-           python-pytest-benchmark
-           python-setuptools))
+     (list python-pytest python-pytest-benchmark python-aspectlib))
    (synopsis "Python bindings for Olm")
    (description "The Olm library implements the Double Ratchet
 cryptographic ratchet.  This package contains its Python bindings.")))

 (define-public hash-extender
-  (let ((commit "f00b1a02eca02b0907e26726f7efe437bc396aa4")
-        (revision "0"))
+  (let ((commit "cb8aaee49f93e9c0d2f03eb3cafb429c9eed723d")
+        (revision "2"))
    (package
      (name "hash-extender")
-      (version (git-version "0.02" revision commit)) ;from hash_extender.c
+      (version (git-version "0.0" revision commit))
      (source (origin
                (method git-fetch)
                (uri (git-reference
@@ -1480,23 +1412,26 @@ cryptographic ratchet.  This package contains its Python bindings.")))
                      (commit commit)))
                (sha256
                 (base32
-                  "12hh2vs8ppavjj47rgyp60cdw70lm2zqdpdv1zdgb3jgdzkg7bf2"))
+                  "1fj118566hr1wv03az2w0iqknazsqqkak0mvlcvwpgr6midjqi9b"))
                (file-name (git-file-name name version))))
      (build-system gnu-build-system)
      (arguments
-       (list
-        #:phases
-        #~(modify-phases %standard-phases
-            (delete 'configure)
-            ;; See: https://github.com/iagox86/hash_extender/issues/29
-            (delete 'check)
-            (replace 'install
-              (lambda _
-                (install-file "hash_extender" (string-append #$output "/bin"))
-                (install-file
-                 "README.md"
-                 (string-append
-                  #$output "/share/doc/hash-extender-" #$version)))))))
+       `(#:phases
+         (modify-phases %standard-phases
+           (delete 'configure)
+           (replace 'check
+             (lambda _
+               (invoke "./hash_extender_test")))
+           (replace 'install
+             (lambda* (#:key outputs #:allow-other-keys)
+               (let* ((outdir (assoc-ref outputs "out"))
+                      (bindir (string-append outdir "/bin"))
+                      (docdir (string-append outdir
+                                             "/share/doc/hash-extender-"
+                                             ,version)))
+                 (install-file "hash_extender" bindir)
+                 (install-file "README.md" docdir)
+                 #t))))))
      (inputs
       (list openssl))
      (synopsis "Tool for hash length extension attacks")
@@ -1521,16 +1456,18 @@ SHA-256, SHA-512, and WHIRLPOOL hashes.")
              (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
-     (list
-      #:tests? #f ; no test suite
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'configure 'set-cflags
-            (lambda _
-              (setenv "CFLAGS" "-O3")))
-          (replace 'install
-            (lambda _
-              (install-file "mkp224o" (string-append #$output "/bin")))))))
+     `(#:tests? #f ; no test suite
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'configure 'set-cflags
+           (lambda _
+             (setenv "CFLAGS" "-O3")))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((outdir (assoc-ref outputs "out"))
+                    (bindir (string-append outdir "/bin")))
+               (install-file "mkp224o" bindir)
+               #t))))))
    (native-inputs
     (list autoconf))
    (inputs
@@ -1545,7 +1482,7 @@ addresses using a brute-force method.")
 (define-public transcrypt
  (package
    (name "transcrypt")
-    (version "2.3.1")
+    (version "2.1.0")
    (source
     (origin
       (method git-fetch)
@@ -1553,20 +1490,19 @@ addresses using a brute-force method.")
             (url "https://github.com/elasticdog/transcrypt")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "1yp1s69wphhsaks46rfj2ann8z397jgvbbq22ikdwxcw96f49pmk"))
+        (base32 "0bpz1hazbhfb6pqi68x55kq6a31bgh6vwij836slmi4jqiwvnh5a"))
       (file-name (git-file-name name version))))
    (inputs
     (list git openssl))
    (build-system copy-build-system)
    (arguments
-     (list
-      #:install-plan
-      #~'(("transcrypt" "bin/transcrypt")
-          ("man/transcrypt.1" "share/man/man1/transcrypt.1")
-          ("contrib/bash/transcrypt"
-           "share/bash-completion/completions/transcrypt")
-          ("contrib/zsh/_transcrypt"
-           "share/zsh/site-functions/_transcrypt"))))
+     `(#:install-plan
+       '(("transcrypt" "bin/transcrypt")
+         ("man/transcrypt.1" "share/man/man1/transcrypt.1")
+         ("contrib/bash/transcrypt"
+          "share/bash-completion/completions/transcrypt")
+         ("contrib/zsh/_transcrypt"
+          "share/zsh/site-functions/_transcrypt"))))
    (home-page "https://github.com/elasticdog/transcrypt")
    (synopsis "Transparently encrypt files within a git repository")
    (description
@@ -1634,7 +1570,7 @@ non-encrypted files.")
    (native-inputs
     (list pkg-config python-wrapper))
    (inputs
-     (list boost-1.83 curl fuse-2 range-v3 spdlog))
+     (list boost curl fuse-2 range-v3 spdlog))
    (home-page "https://www.cryfs.org/")
    (synopsis "Encrypted FUSE filesystem for the cloud")
    (description "CryFS encrypts your files, so you can safely store them anywhere.
@@ -1648,20 +1584,19 @@ structure.  However CryFS is not considered stable yet by the developers.")
 (define-public b3sum
  (package
    (name "b3sum")
-    (version "1.8.2")
+    (version "1.8.1")
    (source
      (origin
        (method url-fetch)
        (uri (crate-uri "b3sum" version))
        (file-name (string-append name "-" version ".tar.gz"))
        (sha256
-         (base32 "06qc6iv574km4j1ja4qhxyai680jkll58qzpz4mb79c0rk750dpd"))))
+         (base32 "1zfyj3a8s1mg6w6l4j5hchrs8n5mfij92mg9m24pzxfi4da4543a"))))
    (build-system cargo-build-system)
    (arguments
-     (list
-      #:install-source? #f
-      #:phases
-      #~(modify-phases %standard-phases
+      `(#:install-source? #f
+        #:phases
+        (modify-phases %standard-phases
          (add-before 'check 'patch-tests
            (lambda _
              (substitute* "tests/cli_tests.rs"
@@ -1715,7 +1650,7 @@ SunMD5, sha1crypt, NT, bsdicrypt, bigcrypt, and descrypt.")
 (define-public keychain
  (package
    (name "keychain")
-    (version "2.9.6")
+    (version "2.9.5")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1724,23 +1659,21 @@ SunMD5, sha1crypt, NT, bsdicrypt, bigcrypt, and descrypt.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0nj5rq9vzvf5g8axmicy5zfcjir7a6fr1ai4ha3cpqj4zgridga7"))))
+                "1i698n0mp2wxk1yd8lhwq7i1dj5v01li1g9qi047aqc34r4079lq"))))
    (build-system gnu-build-system)
+    (propagated-inputs (list procps))
+    (native-inputs (list perl))
    (arguments
-     (list
-      #:tests? #f ; No test suite
-      #:phases
-      #~(modify-phases %standard-phases
-          (delete 'configure)
-          (replace 'install
-            (lambda _
-              (install-file "keychain" (string-append #$output "/bin/"))
-              (install-file "keychain.1"
-                            (string-append #$output "/share/man/man1")))))))
-    (propagated-inputs
-     (list procps))
-    (native-inputs
-     (list perl))
+     `(#:tests? #f ; No test suite
+       #:phases (modify-phases %standard-phases
+                  (delete 'configure)
+                  (replace 'install
+                    (lambda _
+                      (install-file "keychain"
+                                    (string-append %output "/bin/"))
+                      (install-file "keychain.1"
+                                    (string-append %output "/share/man/man1"))
+                      #t)))))
    (synopsis
     "SSH or GPG agent frontend that can share a single agent on the same
 system")
@@ -5,7 +5,6 @@
 ;;; Copyright © 2021 Raghav Gururajan <rg@raghavgururajan.name>
 ;;; Copyright © 2025 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2025 Sharlatan Hellseher <sharlatanus@gmail.com>
-;;; Copyright © 2025 Artyom V. Poptsov <poptsov.artyom@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -49,7 +48,7 @@
 (define-public blacksmith
  (package
    (name "blacksmith")
-    (version "0.0.2")
+    (version "0.0.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -58,7 +57,7 @@
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "15ib0lal2sdjb4j2a4r3645w5axbd1a6j8w9f0pxr8v3ra9cjp5m"))
+                "0kyp71wndf527dgza5iks5m5vj543mvxp5w7cjd8x0pilmd1xrls"))
              (modules '((guix build utils)))
              (snippet `(begin
                          (delete-file-recursively "external")
@@ -61,13 +61,12 @@
 ;;; Copyright © 2021, 2022 jgart <jgart@dismail.de>
 ;;; Copyright © 2023, 2024 Felix Gruber <felgru@posteo.net>
 ;;; Copyright © 2023 Munyoki Kilyungi <me@bonfacemunyoki.com>
-;;; Copyright © 2023, 2025 Giacomo Leidi <therewasa@fishinthecalculator.me>
+;;; Copyright © 2023, 2025 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2024 Troy Figiel <troy@troyfigiel.com>
 ;;; Copyright © 2024 gemmaro <gemmaro.dev@gmail.com>
 ;;; Copyright © 2025 Ashvith Shetty <ashvithshetty0010@zohomail.in>
 ;;; Copyright © 2025 Philippe Swartvagher <phil.swart@gmx.fr>
 ;;; Copyright © 2025 Simen Endsjø <contact@simendsjo.me>
-;;; Copyright © 2025 bdunahu <bdunahu@operationnull.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -140,7 +139,6 @@
  #:use-module (gnu packages multiprecision)
  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages networking)
-  #:use-module (gnu packages node)
  #:use-module (gnu packages onc-rpc)
  #:use-module (gnu packages openstack)
  #:use-module (gnu packages pantheon)
@@ -2159,27 +2157,6 @@ data in a single database.  RocksDB is partially based on @code{LevelDB}.")
    ;; files carry the 3-clause BSD license.
    (license (list license:gpl2 license:asl2.0 license:bsd-3))))

-(define-public rocksdb-for-ceph
-  (let ((commit "9fa4990159853479a222244574ca41202e4c95c1")
-        (revision "0"))
-    (package
-      (inherit rocksdb)
-      (name "rocksdb-for-ceph")
-      (version (git-version "7.9.2" revision commit))
-      (source (origin
-                (inherit (package-source rocksdb))
-                (uri (git-reference
-                       (url "https://github.com/ceph/rocksdb")
-                       (commit commit)))
-                (file-name (git-file-name name version))
-                (sha256
-                 (base32
-                  "0pdy461m9a48x4i829sirpypdlzf3q79p8iw3dng9wd4r4vyv594"))))
-      (arguments (substitute-keyword-arguments (package-arguments rocksdb)
-                   ((#:configure-flags flags ''())
-                    #~(cons "-DCMAKE_CXX_FLAGS=-Wno-error=maybe-uninitialized"
-                            #$flags)))))))
-
 (define-public sparql-query
  (package
    (name "sparql-query")
@@ -3736,29 +3713,24 @@ for many database kinds that tortoise-orm doesn't need, for example.")
 (define-public python-asyncpg
  (package
    (name "python-asyncpg")
-    ;; asyncpg 0.31.0 requires Cython(>=3.2.1,<4.0.0), got Cython==3.1.2
    (version "0.30.0")
    (source
     (origin
-       ;; git-fetch leads to errors like
-       ;; ValueError: 'asyncpg/pgproto/pgproto.pyx' doesn't match any files
       (method url-fetch)
       (uri (pypi-uri "asyncpg" version))
       (sha256
        (base32 "0lf8xbrsb2ycpqx1vzlb05p48g5sh9zq24a8yh17cw5nia9fjlf5"))))
    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      ;; raises ValueError("Invalid IPv6 URL") ; Maybe due to urllib?
-      #~(list "-k" "not TestConnectParams")))
    (native-inputs
     (list postgresql
           python-cython
           python-pytest
           python-uvloop
           python-distro
-           python-setuptools))
+           python-setuptools
+           python-wheel))
+    (propagated-inputs
+     (list python-async-timeout))
    (home-page "https://github.com/MagicStack/asyncpg")
    (synopsis "Fast PostgreSQL database client library for Python")
    (description "@code{asyncpg} is a database interface library designed
@@ -4366,53 +4338,26 @@ framework.")
 (define-public python-sqlalchemy-utils
  (package
    (name "python-sqlalchemy-utils")
-    (version "0.42.1")
+    (version "0.38.3")
    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/kvesteri/sqlalchemy-utils")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0ny1p352p0dlgrf9fnmzj7ld1rga5zj698qpla1kdaliwwh6xawn"))))
-    (build-system pyproject-build-system)
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "SQLAlchemy-Utils" version))
+        (sha256
+         (base32 "0k8z0mjhvdv302kn0nhci8b2dgw4cn2akprsf37ma1540ykgp6lz"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      #:test-flags
-      ;; XXX: These tests require additional inputs.
-      #~(list "--deselect=tests/test_views.py::TestMySqlTrivialView"
-              "--deselect=tests/functions/test_database.py::\
-TestDatabasePostgresPg8000::test_create_and_drop"
-              "--deselect=tests/functions/test_database.py::\
-TestDatabasePostgresPsycoPG2CFFI::test_create_and_drop")
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'start-postgresql
-            (lambda* (#:key inputs tests? #:allow-other-keys)
-              (when tests?
-                (setenv "TZDIR" (search-input-directory inputs
-                                                        "share/zoneinfo"))
-                (let ((dbdir (string-append (getcwd) "/../pgdir")))
-                  (setenv "SQLALCHEMY_UTILS_TEST_POSTGRESQL_USER"
-                          "nixbld")
-                  (invoke "initdb" "-D" dbdir)
-                  (invoke "pg_ctl" "-D" dbdir
-                          "-o" (string-append "-k " dbdir)
-                          "-l" (string-append dbdir "/db.log")
-                          "start")
-	          (invoke "psql" "-h" dbdir "-d" "postgres"
-                          "-c" "CREATE DATABASE sqlalchemy_utils_test;"))))))))
-    (propagated-inputs (list python-six python-sqlalchemy))
+     '(#:tests? #f)) ; FIXME: Many tests require a running database server.
+       ;; #:phases
+       ;; (modify-phases %standard-phases
+       ;;   (replace 'check
+       ;;     (lambda _
+       ;;       (zero? (system* "py.test" "sqlalchemy_utils" "tests")))))
+    (propagated-inputs
+     (list python-six python-sqlalchemy))
    (native-inputs
-     (list postgresql
-           python-dateutil
-           python-flexmock
-           python-psycopg2
-           python-pytest
-           python-pytz
-           python-setuptools
-           tzdata-for-tests))
+     (list python-dateutil python-flexmock python-psycopg2 python-pytest
+           python-pytz))
    (home-page "https://github.com/kvesteri/sqlalchemy-utils")
    (synopsis "Various utility functions for SQLAlchemy")
    (description
@@ -4514,23 +4459,19 @@ SQLAlchemy Database Toolkit for Python.")
  (package
    (name "python-sqlite-fts4")
    (version "1.0.3")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/simonw/sqlite-fts4")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "05c69n4nrc9srkbih1q1wxlw6n9mb3dm7ysb47ipqjn3rp1aif11"))))
-    (build-system pyproject-build-system)
-    (native-inputs (list python-pytest python-setuptools))
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "sqlite-fts4" version))
+              (sha256
+               (base32
+                "034kx0ac556sywy1p4qcrc36l24w3q0xwswqv2z9s3k8yvm5xc3q"))))
+    (build-system python-build-system)
+    (native-inputs (list python-pytest))
    (home-page "https://github.com/simonw/sqlite-fts4")
    (synopsis "Python functions for working with SQLite FTS4 search")
-    (description
-     "This package provides custom SQLite functions written in Python for
-ranking documents indexed using the SQLite's FTS4 full text search
-extension.")
+    (description "This package provides custom SQLite functions written
+in Python for ranking documents indexed using the SQLite's FTS4 full
+text search extension.")
    (license license:asl2.0)))

 (define-public python-sqlite-utils
@@ -4656,21 +4597,31 @@ into Python.")
 (define-public python-aiosqlite
  (package
    (name "python-aiosqlite")
-    (version "0.21.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/omnilib/aiosqlite")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "1njzxi130bbix53wl0gcsvryk1b2cazq0s2701jbkf6nvr3ywpyy"))))
+    (version "0.18.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/omnilib/aiosqlite")
+                    (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1a8sggh1wwbpl46k5qcfmp97s9hjysna0x7mwwc53kyfm0m95wf8"))))
    (build-system pyproject-build-system)
-    (arguments (list #:test-backend #~'unittest))
-    (native-inputs (list python-flit-core))
+    (arguments
+     (list #:phases #~(modify-phases %standard-phases
+                        (replace 'check
+                          (lambda* (#:key tests? #:allow-other-keys)
+                            (when tests?
+                              (invoke "python" "-m" "coverage" "run" "-m"
+                                      "aiosqlite.tests")
+                              (invoke "python" "-m" "coverage" "report")))))))
+    (native-inputs (list python-flit-core
+                         python-coverage
+                         python-mypy))
    (home-page "https://github.com/jreese/aiosqlite")
-    (synopsis "Asyncio bridge for sqlite3")
+    (synopsis
+     "Asyncio bridge for sqlite3")
    (description
     "The package aiosqlite replicates the standard sqlite3 module, but with
 async versions of all the standard connection and cursor methods, and context
@@ -4680,33 +4631,14 @@ managers for automatically closing connections.")
 (define-public python-databases
  (package
    (name "python-databases")
-    ;; 0.9.0 needs sqlalchemy>=2.0.7
-    ;; 0.8.0 needs sqlalchemy>=1.4.42,<1.5
-    (version "0.8.0")
+    (version "0.7.0")
    (source
     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/encode/databases")
-              (commit version)))
-       (file-name (git-file-name name version))
+       (method url-fetch)
+       (uri (pypi-uri "databases" version))
       (sha256
-        (base32 "183yawn8w561y1ni117rf5zaxm4gqqbcmi9fp52xd5fx2dj8qy3v"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      ;; These need TEST_DATABASE_URLS set.
-      ;; TODO: Use "sqlite:///test.db"? See docs/contributing.md.
-      #~(list "--ignore=tests/test_databases.py"
-              "--ignore=tests/test_integration.py"
-              "--ignore=tests/test_connection_options.py")))
-    (native-inputs
-     (list python-httpx
-           python-psycopg
-           python-pytest
-           python-setuptools
-           python-starlette))
+        (base32 "0x5nqhzgjqimv2ybjbzy5vv0l23g0n1g5f6fnyahbf1f7nfl2bga"))))
+    (build-system python-build-system)
    (propagated-inputs
     (list python-aiosqlite
           python-aiopg
@@ -4723,41 +4655,18 @@ libraries with SQLALchemy.")
 (define-public python-psycopg2
  (package
    (name "python-psycopg2")
-    (version "2.9.11")
+    (version "2.9.6")
    (source
     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/psycopg/psycopg2")
-              (commit version)))
-       (file-name (git-file-name name version))
+       (method url-fetch)
+       (uri (pypi-uri "psycopg2" version))
       (sha256
-        (base32 "04l2yzbl15nrw1pcjfkqycvqn6h9phcdh1xx9ynfy3dzfscq5ly5"))))
-    (build-system pyproject-build-system)
+        (base32 "04chl9f7v7k1zssa40pmk06jvpyqiss2lpjq50dq69nqix0mhlgi"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'start-postgresql
-            (lambda* (#:key inputs tests? #:allow-other-keys)
-              (when tests?
-                (setenv "TZDIR" (search-input-directory inputs
-                                                        "share/zoneinfo"))
-                (let ((dbdir (string-append (getcwd) "/../pgdir")))
-                  (setenv "PSYCOPG2_TESTDB_USER" "nixbld")
-                  (setenv "PSYCOPG2_TESTDB_HOST" dbdir)
-                  (invoke "initdb" "-D" dbdir)
-                  (invoke "pg_ctl" "-D" dbdir
-                          "-o" (string-append "-k " dbdir)
-                          "-l" (string-append dbdir "/db.log")
-                          "start")
-	          (invoke "psql" "-h" dbdir "-d" "postgres"
-                          "-c" "CREATE DATABASE psycopg2_test;"))))))))
-    (native-inputs
-     (list postgresql
-           python-pytest
-           python-setuptools
-           tzdata-for-tests))
+     ;; Tests would require a postgresql database "psycopg2_test"
+     ;; and a running postgresql database management service.
+     '(#:tests? #f)) ; TODO re-enable after providing a test-db.
    (inputs
     (list postgresql)) ; libpq
    (home-page "https://www.psycopg.org/")
@@ -4779,16 +4688,14 @@ libraries with SQLALchemy.")
              (sha256
               (base32
                "1pkx7nj1mhacwpna7ldzqfqxd1xg8826600r0bs9ad1h93f429yh"))))
-    (build-system pyproject-build-system)
+    (build-system python-build-system)
    (arguments
-     (list
-      #:tests? #f                  ;run for psycopg below
-      #:phases
-      #~(modify-phases %standard-phases
-          ;; This module requires 'psycopg', however psycopg needs this
-          ;; for its tests.  Disable sanity check to break the cycle.
-          (delete 'sanity-check))))
-    (native-inputs (list python-setuptools))
+     (list #:tests? #f                  ;run for psycopg below
+           #:phases
+           #~(modify-phases %standard-phases
+               ;; This module requires 'psycopg', however psycopg needs this
+               ;; for its tests.  Disable sanity check to break the cycle.
+               (delete 'sanity-check))))
    (home-page "https://www.psycopg.org/")
    (synopsis "Connection pooler for psycopg")
    (description
@@ -4899,49 +4806,23 @@ from a SQLAlchemy model (or directly from the database).")
 (define-public yoyo-migrations
  (package
    (name "yoyo-migrations")
-    (version "9.0.0")
+    (version "8.2.0")
    (source
     (origin
+       ;; We use the upstream repository, as the tests are not included in the
+       ;; PyPI releases.
       (method hg-fetch)
       (uri (hg-reference
             (url "https://hg.sr.ht/~olly/yoyo")
             (changeset (string-append "v" version "-release"))))
       (file-name (string-append name "-" version "-checkout"))
       (sha256
-        (base32 "0bn4n043y0n4dh7axwavfims2krap5dcmdaxswbadzmis3a4hxyb"))))
-    (build-system pyproject-build-system)
+        (base32 "1al030ix0w63hr4s3mqry6s0mlqdj8p242pdqks06br7c25nx3yj"))))
+    (build-system python-build-system)
    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'start-postgresql
-            (lambda* (#:key inputs tests? #:allow-other-keys)
-              (when tests?
-                (delete-file "test_databases.ini")
-                (call-with-output-file "test_databases.ini"
-                  (lambda (port)
-                    (format port "[DEFAULT]
-postgresql = postgresql://nixbld@/yoyo_test~%")))
-                (setenv "TZDIR" (search-input-directory inputs
-                                                        "share/zoneinfo"))
-                (let ((dbdir (string-append (getcwd) "/../pgdir")))
-                  (setenv "PGHOST" dbdir)
-                  (setenv "PGUSER" "nixbld")
-                  (invoke "initdb" "-D" dbdir)
-                  (invoke "pg_ctl" "-D" dbdir
-                          "-o" (string-append "-k " dbdir)
-                          "-l" (string-append dbdir "/db.log")
-                          "start")
-	          (invoke "psql" "-h" dbdir "-d" "postgres"
-                          "-c" "CREATE DATABASE yoyo_test;"))))))))
-    (native-inputs
-     (list postgresql
-           python-freezegun
-           python-psycopg2
-           python-pytest
-           python-setuptools
-           tms
-           tzdata-for-tests))
+     ;; XXX: Tests require a connection to some pgsql database and psycopg
+     ;; fails to connect to it.
+     '(#:tests? #f))
    (propagated-inputs
     (list python-sqlparse python-tabulate python-importlib-metadata))
    (home-page "https://ollycope.com/software/yoyo/latest/")
@@ -5245,13 +5126,13 @@ provides support for parsing, splitting and formatting SQL statements.")
 (define-public python-sql
  (package
    (name "python-sql")
-    (version "1.7.0")
+    (version "1.6.0")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "python_sql" version))
       (sha256
-        (base32 "09niqspjmsn9wyqadgqjcrsxxa7w4r6dcp21xhi1mimr4ya0p5ky"))))
+        (base32 "0v637qc2g8w155k7crlg70w4bfxznn28c94prlxcax5dx0ja2d2v"))))
    (build-system pyproject-build-system)
    (native-inputs (list python-pytest python-setuptools))
    (home-page "https://python-sql.tryton.org/")
@@ -5263,21 +5144,19 @@ transforms idiomatic python function calls to well-formed SQL queries.")
 (define-public python-pypika
  (package
    (name "python-pypika")
-    (version "0.49.0")
+    (version "0.47.6")
    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-              (url "https://github.com/kayak/pypika")
-              (commit (string-append "v" version))))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0nxm2cxq9sx43g57qxw7kzy8lsl5svq659r3mhxpa9vcbxrjrb1d"))))
-    (build-system pyproject-build-system)
+     (origin (method git-fetch)
+             (uri (git-reference
+                   (url "https://github.com/kayak/pypika")
+                   (commit (string-append "v" version))))
+             (file-name (git-file-name name version))
+             (sha256
+              (base32
+               "001pg36sw9a36zdd1kccbymcxndphjcjbbrsy6ri7ng8h4dgz549"))))
+    (build-system python-build-system)
    (native-inputs
-     (list python-parameterized
-           python-pytest
-           python-setuptools))
+     (list python-parameterized))
    (home-page "https://github.com/kayak/pypika")
    (synopsis "SQL query builder API for Python")
    (description
@@ -5302,8 +5181,6 @@ the SQL language using a syntax that reflects the resulting query.")
    (build-system cmake-build-system)
    (arguments
     (list
-      ;; XXX: Some tests fail on i686, run on 64bit only for now.
-      #:tests? (target-64bit?)
      #:build-type "Release"
      #:configure-flags
      #~(list "-DBUILD_JAVA=OFF"
@@ -5376,7 +5253,7 @@ with integrated support for finding required rows quickly.")
 (define-public apache-arrow
  (package
    (name "apache-arrow")
-    (version "22.0.0")
+    (version "21.0.0")
    (source
     (origin
       (method git-fetch)
@@ -5386,7 +5263,7 @@ with integrated support for finding required rows quickly.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "09ra9p2majsczjq6ygcz2jqafdryvrzahxsbflfqp2z8invsd14b"))))
+         "0lxywrjfwhiznsldpv5bd6g357za5ng64jvy943kp0ndckh5l4g9"))))
    (build-system cmake-build-system)
    (arguments
     (list
@@ -5634,7 +5511,7 @@ algorithm implementations.")
  (package
    (inherit apache-arrow)
    (name "python-pyarrow")
-    (build-system pyproject-build-system)
+    (build-system python-build-system)
    (arguments
     (list
      ;; XXX: Test data is distributed separately in
@@ -5644,6 +5521,7 @@ algorithm implementations.")
      #:tests? #f
      #:phases
      #~(modify-phases %standard-phases
+          (delete 'build) ; XXX the build is performed again during the install phase
          (add-after 'unpack 'enter-source-directory
            (lambda _ (chdir "python")))
          (add-after 'enter-source-directory 'set-version
@@ -5687,8 +5565,7 @@ __version_tuple__ = version_tuple = (~a)~%" version version-tuple))))))
           python-cython
           python-pytest
           python-pytest-runner
-           python-setuptools-scm
-           python-setuptools))
+           python-setuptools-scm))
    (outputs '("out"))
    (home-page "https://arrow.apache.org/docs/python/")
    (synopsis "Python bindings for Apache Arrow")
@@ -5774,31 +5651,16 @@ and @code{intake-parquet}.  It supports the following compression algorithms:
 (define-public python-crate
  (package
    (name "python-crate")
-    (version "2.0.0")
-    (source
-     (origin
-       (method git-fetch)
-       (uri (git-reference
-             (url "https://github.com/crate/crate-python")
-             (commit version)))
-       (file-name (git-file-name name version))
-       (sha256
-        (base32 "0kk84wf7awgspdijycvhkbqvm5llp3wmwxa9n4w3qda861xn6krb"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-flags
-      #~(list "--ignore=tests/testing/test_layer.py" ; Requires crate binary.
-              "--ignore=tests/client/test_http.py"))) ; XXX: fails collection.
-    (native-inputs
-     (list python-orjson
-           python-pytest
-           python-pytz
-           python-setuptools
-           python-sqlalchemy
-           python-verlib2
-           tzdata-for-tests))
-    (propagated-inputs (list python-urllib3))
+    (version "0.23.2")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "crate" version))
+              (sha256
+               (base32
+                "0ngmlvi320c5gsxab0s7qgq0ck4jdlcwvb6lbjhnfprafdp56vvx"))))
+    (build-system python-build-system)
+    (propagated-inputs
+     (list python-urllib3))
    (home-page "https://github.com/crate/crate-python")
    (synopsis "CrateDB Python client")
    (description
@@ -5993,46 +5855,6 @@ with no external dependencies.  The targets are small apps that would
 be blown away by a SQL-DB or an external database server.")
    (license license:expat)))

-(define-public sdb
-  (package
-    (name "sdb")
-    (version "2.2.4")
-    (source (origin
-              (method git-fetch)
-              (uri (git-reference
-                     (url "https://github.com/radareorg/sdb.git")
-                     (commit version)))
-              (file-name (git-file-name name version))
-              (sha256
-               (base32
-                "15pc807s2nmhnr3mspyz9h47rkxkv1r07x959ir17v5b6zs7wxvw"))))
-    (build-system meson-build-system)
-    (arguments
-     (list
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'setenv-cc
-            (lambda _
-              (setenv "CC" #$(cc-for-target))))
-          ;; The provided meson.build uses a Makefile in the source root
-          ;; to run the tests, but resolves its directory relative to
-          ;; the build directory, assuming the build is one level under
-          ;; the source tree. This breaks if the build tree is elsewhere.
-          (add-before 'check 'set-test-workdir-to-source-root
-            (lambda _
-              (substitute* "../source/meson.build"
-                (("workdir: join_paths.*$")
-                 "workdir: meson.project_source_root(),\n")))))))
-    (native-inputs
-     (list node
-           perl
-           python-minimal-wrapper))
-    (home-page "https://github.com/radareorg/sdb")
-    (synopsis "Simple and fast string based key-value database")
-    (description "SDB is a simple key/value database based on djb's cdb disk
-storage that supports JSON and array introspection.")
-    (license license:expat)))
-
 (define-public sequeler
  (package
    (name "sequeler")
@@ -6131,7 +5953,7 @@ compatible with SQLite using a graphical user interface.")
 (define-public sqlitestudio
  (package
    (name "sqlitestudio")
-    (version "3.4.18")
+    (version "3.4.17")
    (source
     (origin
       (method git-fetch)
@@ -6140,7 +5962,7 @@ compatible with SQLite using a graphical user interface.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1chsm4hxy483hz569ywacysg4dh9ijis060s4rgydkgk49bbb2si"))))
+        (base32 "1zb1qr88rwkzmrxc0lm99x8h99hpn5c2wfdpvqzs9f9ph8qvasww"))))
    (build-system gnu-build-system)
    (arguments
     (list
@@ -116,23 +116,13 @@ clients.")
 (define-public xandikos
  (package
    (name "xandikos")
-    (version "0.3.0")
+    (version "0.2.12")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "xandikos" version))
-       (sha256
-        (base32 "10j7qmwcrwql4ah6q8si3nf1ljwrx99w8ipiy85bzjd3qz2vackj"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list
-      #:test-backend #~'unittest
-      #:phases
-      #~(modify-phases %standard-phases
-          (add-before 'check 'check-setup
-            (lambda _
-              (setenv "XANDIKOSPATH" (mkdtemp "/tmp/xandikospath-XXXXXX")))))))
-    (native-inputs (list python-setuptools))
+       (sha256 (base32 "0x6g5s9pkippxg429r9agp3w0xsid2vv1h45wfc3xzdfvgj6ygsr"))))
+    (build-system python-build-system)
    (propagated-inputs
     (list python-aiohttp
           python-defusedxml
@@ -141,6 +131,13 @@ clients.")
           python-jinja2
           python-multidict
           python-vobject))
+    (arguments
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'check-setup
+            (lambda _
+              (setenv "XANDIKOSPATH" (mkdtemp "/tmp/xandikospath-XXXXXX")))))))
    (home-page "https://www.xandikos.org/")
    (synopsis "Lightweight CalDAV/CardDAV server")
    (description
@@ -65,22 +65,23 @@
        (("AC_DEFINE\\(HAVE_SYSTEM_INCLUDE_FILES\\)")
         "AC_DEFINE(HAVE_SYSTEM_INCLUDE_FILES, [], [Description])"))))

-(define-public bdb-5.3
+(define-public bdb-4.8
  (package
    (name "bdb")
-    (version "5.3.28")
+    (version "4.8.30")
+    (license (license:non-copyleft "file://LICENSE"
+                                   "See LICENSE in the distribution."))
    (source (origin
-              (method url-fetch)
-              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
-                                  version ".tar.gz"))
-              (sha256
-               (base32
-                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))
-              (patch-flags '("-p0"))
-              (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))
-              (modules '((guix build utils)
-                         (srfi srfi-1)))
-              (snippet bdb-snippet)))
+             (method url-fetch)
+             (uri (string-append "https://download.oracle.com/berkeley-db/db-"
+                                 version ".tar.gz"))
+             (sha256
+              (base32
+               "0ampbl2f0hb1nix195kz1syrqqxpmvnvnfvphambj7xjrl3iljg0"))
+             (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))
+             (modules '((guix build utils)
+                        (srfi srfi-1)))
+             (snippet bdb-snippet)))
    (build-system gnu-build-system)
    (outputs '("out"                             ; programs, libraries, headers
               "doc"))                           ; 94 MiB of HTML docs
@@ -147,34 +148,45 @@
                     (("rm (.*) configure") "")
                     (("chmod (.*) config.guess(.*)$") ""))
                   (invoke "sh" "s_config"))))))
-    (native-inputs (list autoconf automake-1.16.5 libtool))
+    (native-inputs (list autoconf-2.69 automake-1.16.5 libtool))
    (synopsis "Berkeley database")
    (description
     "Berkeley DB is an embeddable database allowing developers the choice of
 SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
+    ;; Starting with version 6, BDB is distributed under AGPL3. Many individual
+    ;; files are covered by the 3-clause BSD license.
    (home-page
-     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")
-    (license (license:non-copyleft "file://LICENSE"
-                                   "See LICENSE in the distribution."))))
+     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")))
+
+(define-public bdb-5.3
+  (package (inherit bdb-4.8)
+    (name "bdb")
+    (version "5.3.28")
+    (source (origin
+              (inherit (package-source bdb-4.8))
+              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0a1n5hbl7027fbz5lm0vp0zzfp1hmxnz14wx3zl9563h83br5ag0"))
+              (patch-flags '("-p0"))
+              (patches (search-patches "bdb-5.3-atomics-on-gcc-9.patch"))))))

 (define-public bdb-6
-  (package
+  (package (inherit bdb-4.8)
    (name "bdb")
    (version "6.2.32")
    (source (origin
+              (inherit (package-source bdb-4.8))
              (method url-fetch)
              (uri (string-append "https://download.oracle.com/berkeley-db/db-"
                                  version ".tar.gz"))
              (sha256
               (base32
                "1yx8wzhch5wwh016nh0kfxvknjkafv6ybkqh6nh7lxx50jqf5id9"))
-              (modules '((guix build utils)
-                         (srfi srfi-1)))
-              (snippet bdb-snippet)))
-    ;; Copy-paste the arguments from bdb-5.3 and drop the
+              (patches '())))
+    ;; Copy-paste the arguments from bdb-4.8 and drop the
    ;; 'bdb-configure patch phase.
-    (build-system gnu-build-system)
-    (outputs '("out" "doc"))
    (arguments
     (list #:tests? #f                        ; no check target available
           #:disallowed-references '("doc")
@@ -227,13 +239,6 @@ SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
                     (("rm (.*) configure") "")
                     (("chmod (.*) config.guess(.*)$") ""))
                   (invoke "sh" "s_config"))))))
-    (native-inputs (list autoconf automake-1.16.5 libtool))
-    (synopsis "Berkeley database")
-    (description
-     "Berkeley DB is an embeddable database allowing developers the choice of
-SQL, Key/Value, XML/XQuery or Java Object storage for their data model.")
-    (home-page
-     "http://www.oracle.com/us/products/database/berkeley-db/overview/index.html")
    ;; Starting with version 6, BDB is distributed under AGPL3. Many individual
    ;; files are covered by the 3-clause BSD license.
    (license (list license:agpl3+ license:bsd-3))))
@@ -14,7 +14,7 @@
 ;;; Copyright © 2023 Andy Tai <atai@atai.org>
 ;;; Copyright © 2023 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2024 Raven Hallsby <karl@hallsby.com>
-;;; Copyright © 2025 Nguyễn Gia Phong <cnx@loang.net>
+;;; Copyright © 2025 Nguyễn Gia Phong <mcsinyx@disroot.org>
 ;;; Copyright © 2025 Robin Templeton <robin@guixotic.coop>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -529,83 +529,6 @@ server and embedded PowerPC, and S390 guests.")
    ;; Several tests fail on MIPS.
    (supported-systems (delete "mips64el-linux" %supported-systems))))))

-(define-public qemu-for-aflplusplus
-  (let ((base qemu-minimal)
-        (commit "790d2124fd054621d3c0d3ec31bea114b60601f9")
-        (revision "0"))
-    (hidden-package
-     (package
-       (inherit base)
-       (name "qemu")
-       (version (git-version "5.2.50" revision commit))
-       (source
-        (origin
-          (method git-fetch)
-          (uri (git-reference (url "https://github.com/AFLplusplus/qemuafl")
-                              (commit commit)
-                              (recursive? #t)))
-          (file-name (git-file-name name version))
-          (sha256
-           (base32 "1l2kl8768l4mbkiaj63zn6gsdn3qpl3rg7s6h62rmd7599ar3xn3"))))
-       (arguments
-        (substitute-keyword-arguments (package-arguments base)
-          ((#:configure-flags _ #~'())
-           #~(list (string-append
-                    "--target-list="
-                    ;; AFL++ only supports using a single afl-qemu-trace,
-                    ;; so we only build qemu for the native target.
-                    (match #$(let-system system system)
-                      ("aarch64-linux"  "aarch64-linux-user")
-                      ("armhf-linux"    "arm-linux-user")
-                      ("i686-linux"     "i386-linux-user")
-                      ("mips64el-linux" "mips64el-linux-user")
-                      ("powerpc-linux"  "ppc-linux-user")
-                      ("riscv64-linux"  "riscv64-linux-user")
-                      ("x86_64-linux"   "x86_64-linux-user")))))
-          ((#:phases phases)
-           #~(modify-phases #$phases
-               (delete 'replace-firmwares)
-               (delete 'patch-embedded-shebangs)
-               (delete 'fix-optionrom-makefile)
-               (delete 'disable-unusable-tests)
-               (replace 'configure
-                 (lambda* (#:key configure-flags #:allow-other-keys)
-                   ;; The `configure' script doesn't understand some of the
-                   ;; GNU options.  Thus, add a new phase that's compatible.
-                   (setenv "SHELL" (which "bash"))
-                   ;; The binaries need to be linked against -lrt.
-                   (setenv "LDFLAGS" "-lrt")
-                   (apply invoke
-                          "./configure"
-                          (string-append "--cc=" #$(cc-for-target))
-                          ;; Some architectures insist on using HOST_CC
-                          (string-append "--host-cc=" #$(cc-for-target))
-                          "--disable-debug-info" ; save build space
-                          (string-append "--prefix=" #$output)
-                          (string-append "--sysconfdir=/etc")
-                          configure-flags)))
-               (add-after 'install 'install-qasan-header
-                 (lambda _
-                   (install-file "qemuafl/qasan.h"
-                                 (string-append #$output "/include"))))
-               (delete 'delete-firmwares)
-               #$@(if (target-riscv64?)
-                      '((replace 'disable-some-tests
-                          (lambda _
-                            ;; qemu.qmp.QMPConnectError:
-                            ;; Unexpected empty reply from server
-                            (delete-file "tests/qemu-iotests/040")
-                            (delete-file "tests/qemu-iotests/041")
-                            (delete-file "tests/qemu-iotests/256")
-                            ;; No 'PCI' bus found for device 'virtio-scsi-pci'
-                            (delete-file "tests/qemu-iotests/127")
-                            (delete-file "tests/qemu-iotests/267"))))
-                      '())))))
-       (inputs (modify-inputs (package-inputs base)
-                 (delete "dtc")))
-       (home-page "https://github.com/AFLplusplus/qemuafl")
-       (synopsis "QEMU for AFL++")))))
-
 (define-public aflplusplus
  (package
    (inherit american-fuzzy-lop)
@@ -627,47 +550,9 @@ server and embedded PowerPC, and S390 guests.")
                (string-append "DOC_PATH=" #$output "/share/doc/"
                               #$(package-name this-package) "-"
                               #$(package-version this-package))
-                (string-append "CC=" #$(cc-for-target))
-                (string-append "CXX=" #$(cxx-for-target))
-                (string-append "LLVM_CONFIG="
-                               (search-input-file %build-inputs "/bin/llvm-config"))
-                ;; Need to use LLD with the llvm_mode, because LTO in
-                ;; combination with binutils gold is currently broken.
-                ;;
-                ;; See: https://codeberg.org/guix/guix/issues/3307
-                (string-append "AFL_REAL_LD="
-                               (search-input-file %build-inputs "/bin/ld.lld"))
-                (string-append "CLANG_BIN="
-                               (search-input-file %build-inputs "/bin/clang"))
-                (string-append "CLANGPP_BIN="
-                               (search-input-file %build-inputs "/bin/clang++"))
-                "LLVM_LTO=1"
-                "AFL_CLANG_FLTO=-flto=full"))
+                (string-append "CC=" #$(cc-for-target))))
       ((#:phases phases '%standard-phases)
        #~(modify-phases #$phases
-            ;; Ensure that the build fails early if LLVM support fails to
-            ;; compile, makes the build log much easier to understand.
-            (add-after 'unpack 'fatal-llvm-failure
-              (lambda* (#:key inputs #:allow-other-keys)
-                (substitute* "GNUmakefile"
-                  (("-\\$\\(MAKE\\) ..* -f GNUmakefile.llvm$" all)
-                   (substring all 1))))) ; remove the leading '-'
-            ;; GNUmakefile.llvm tries to find clang/clang++ relative to the
-            ;; --bindir reported by llvm-config, but since llvm and clang
-            ;; have different store paths on Guix, this doesn't work here.
-            (add-after 'unpack 'patch-clang-path
-              (lambda* (#:key inputs #:allow-other-keys)
-                (substitute* "GNUmakefile.llvm"
-                  (("^CC *= .*$")
-                   (string-append
-                     "override CC = "
-                     (search-input-file inputs "/bin/clang")
-                     "\n"))
-                  (("^CXX *= .*$")
-                   (string-append
-                     "override CXX = "
-                     (search-input-file inputs "/bin/clang++")
-                     "\n")))))
            ;; For GCC plugins.
            (add-after 'unpack 'patch-gcc-path
              (lambda* (#:key inputs #:allow-other-keys)
@@ -677,25 +562,11 @@ server and embedded PowerPC, and S390 guests.")
                           (search-input-file inputs "bin/gcc")))
                  (("alt_cxx = \"g\\+\\+\";")
                   (format #f "alt_cxx = \"~a\";"
-                           (search-input-file inputs "bin/g++"))))))
-            (add-after 'build 'build-qasan
-              (lambda* (#:key parallel-build? make-flags #:allow-other-keys)
-                (apply invoke "make" "-C" "qemu_mode/libqasan"
-                       "-j" (number->string (if parallel-build?
-                                                (parallel-job-count)
-                                                "1"))
-                       make-flags)))
-            ;; afl-qemu-trace is a symbolic link to QEMU's binary.
-            ;; Substituting its source code with AFL++'s output path
-            ;; would result in a dependency cycle.
-            (add-after 'install-qemu 'wrap-qemu
-              (lambda _
-                (wrap-program (string-append #$output "/bin/afl-qemu-trace")
-                  `("AFL_PATH" = (,(string-append #$output "/lib/afl"))))))))))
+                           (search-input-file inputs "bin/g++"))))))))))
    ;; According to the Dockerfile, GCC 12 is producing compile errors for some
    ;; targets, so explicitly use GCC 11 here.
-    (inputs (list llvm-20 clang-20 lld-20 gcc gmp python qemu-for-aflplusplus))
-    (native-inputs (list gcc))
+    (inputs (list gcc-11 gmp python qemu))
+    (native-inputs (list gcc-11))
    (home-page "https://aflplus.plus/")
    (description
     "AFLplusplus is a security-oriented fuzzer that employs a novel type of
@@ -2,7 +2,7 @@
 ;;; Copyright © 2014-2016, 2018, 2021, 2024, 2025 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016-2018, 2020-2023, 2025 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
-;;; Copyright © 2017-2019, 2021, 2025 Nicolas Goaziou <mail@nicolasgoaziou.fr>
+;;; Copyright © 2017, 2018, 2019, 2021 Nicolas Goaziou <mail@nicolasgoaziou.fr>
 ;;; Copyright © 2018, 2019, 2020, 2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Pierre-Antoine Rouby <contact@parouby.fr>
 ;;; Copyright © 2018 Arun Isaac <arunisaac@systemreboot.net>
@@ -411,19 +411,15 @@ It comes with a German-English dictionary with approximately 270,000 entries.")
 (define-public grammalecte
  (package
    (name "grammalecte")
-    (version "2.3.0")
+    (version "2.1.1")
    (source
     (origin
       (method url-fetch/zipbomb)
-       (uri (string-append "https://grammalecte.net/zip/"
+       (uri (string-append "https://grammalecte.net/grammalecte/zip/"
                           "Grammalecte-fr-v" version ".zip"))
       (sha256
-        (base32 "0kv8h0116sfcrqnpd3jv2b098ychda7v27fciq1phxw50jbj395a"))))
-    (build-system pyproject-build-system)
-    (arguments
-     (list #:test-backend #~'unittest))
-    (native-inputs
-     (list python-setuptools))
+        (base32 "076jv3ywdgqqzg92bfbagc7ypy08xjq5zn4vgna6j9350fkfqhzn"))))
+    (build-system python-build-system)
    (home-page "https://grammalecte.net")
    (synopsis "French spelling and grammar checker")
    (description "Grammalecte is a grammar checker for the French language,
--- a/Show More
+++ b/Show More