DRAFT substitute: Fetch digests and restore store items from digests.

DRAFT: Tests missing, compression support missing. * guix/scripts/substitute.scm (digest-cache-file, cache-digest!) (digest-request, lookup-digest): New procedures. (fetch-narinfos)[%not-slash]: New variable. [handle-digest-response, handle-response]: New procedures. [do-fetch]: Append digest requests to narinfo requests. Pass 'handle-response' to 'http-multiple-get' instead of 'handle-narinfo-response'. (process-substitution): Rename to... (process-substitution/nar): ... this. Make 'narinfo' a parameter. (http-fetch-files, nar-hash) (process-substitution, process-substitution/digest): New procedures. (guix-substitute): Pass #:delete-entry to 'maybe-remove-expired-cache-entries'. * guix/digests.scm (sexp->digest): New procedure.
DRAFT publish: Handle /digest and /content URLs.
2026-08-01 04:51:30 +02:00 · 2021-01-03 21:49:46 +01:00 · 2021-01-03 21:49:27 +01:00 · 2021-01-03 21:44:58 +01:00 · 2020-12-28 10:54:03 +01:00 · 2020-12-28 09:56:22 +02:00
782 changed files with 296331 additions and 103117 deletions
@@ -8,7 +8,38 @@
     ;; For use with 'bug-reference-prog-mode'.
     (bug-reference-url-format . "http://bugs.gnu.org/%s")
     (bug-reference-bug-regexp
-      . "<https?://\\(debbugs\\|bugs\\)\\.gnu\\.org/\\([0-9]+\\)>")))
+      . "<https?://\\(debbugs\\|bugs\\)\\.gnu\\.org/\\([0-9]+\\)>")
+
+     ;; Emacs-Guix
+     (eval . (setq-local guix-directory
+                         (locate-dominating-file default-directory
+                                                 ".dir-locals.el")))
+
+     ;; Geiser
+     ;; This allows automatically setting the `geiser-guile-load-path'
+     ;; variable when using various Guix checkouts (e.g., via git worktrees).
+     (eval . (let ((root-dir-unexpanded (locate-dominating-file
+                                         default-directory ".dir-locals.el")))
+               ;; While Guix should in theory always have a .dir-locals.el
+               ;; (we are reading this file, after all) there seems to be a
+               ;; strange problem where this code "escapes" to some other buffers,
+               ;; at least vc-mode.  See:
+               ;;   https://lists.gnu.org/archive/html/guix-devel/2020-11/msg00296.html
+               ;; Upstream report: <https://bugs.gnu.org/44698>
+               ;; Hence the following "when", which might otherwise be unnecessary;
+               ;; it prevents causing an error when root-dir-unexpanded is nil.
+               (when root-dir-unexpanded
+                 (let* ((root-dir (expand-file-name root-dir-unexpanded))
+                        ;; Workaround for bug https://issues.guix.gnu.org/43818.
+                        (root-dir* (directory-file-name root-dir)))
+
+                   (unless (boundp 'geiser-guile-load-path)
+                     (defvar geiser-guile-load-path '()))
+                   (make-local-variable 'geiser-guile-load-path)
+                   (require 'cl-lib)
+                   (cl-pushnew root-dir* geiser-guile-load-path
+                               :test #'string-equal)))))))
+
 (c-mode          . ((c-file-style . "gnu")))
 (scheme-mode
  .
@@ -37,7 +68,7 @@
   (eval . (put 'with-file-lock 'scheme-indent-function 1))
   (eval . (put 'with-file-lock/no-wait 'scheme-indent-function 1))
   (eval . (put 'with-profile-lock 'scheme-indent-function 1))
-   (eval . (put 'with-writable-file 'scheme-indent-function 1))
+   (eval . (put 'with-writable-file 'scheme-indent-function 2))

   (eval . (put 'package 'scheme-indent-function 0))
   (eval . (put 'package/inherit 'scheme-indent-function 1))
@@ -90,9 +121,10 @@
   (eval . (put 'let-system 'scheme-indent-function 1))

   (eval . (put 'with-database 'scheme-indent-function 2))
-   (eval . (put 'call-with-transaction 'scheme-indent-function 2))
+   (eval . (put 'call-with-database 'scheme-indent-function 1))
+   (eval . (put 'call-with-transaction 'scheme-indent-function 1))
   (eval . (put 'with-statement 'scheme-indent-function 3))
-   (eval . (put 'call-with-retrying-transaction 'scheme-indent-function 2))
+   (eval . (put 'call-with-retrying-transaction 'scheme-indent-function 1))
   (eval . (put 'call-with-savepoint 'scheme-indent-function 1))
   (eval . (put 'call-with-retrying-savepoint 'scheme-indent-function 1))

@@ -74,6 +74,7 @@
 /etc/guix-publish.conf
 /etc/guix-publish.service
 /etc/init.d/guix-daemon
+/etc/openrc/guix-daemon
 /guix-daemon
 /guix/config.scm
 /libformat.a
@@ -139,9 +140,13 @@ Makefile
 Makefile.in
 config.cache
 stamp-h[0-9]
+.dirstamp
+.deps
 tmp
 /doc/os-config-lightweight-desktop.texi
 /nix/scripts/download
 /.version
 /doc/stamp-[0-9]
 /gnu/packages/bootstrap
+/gnu/packages/aux-files/guile-guile-launcher.o
+/guile
@@ -1,5 +1,5 @@
-;; This is the list of OpenPGP keys currently authorized to sign commits in
-;; this repository.
+;; This file, which is best viewed as -*- Scheme -*-, lists the OpenPGP keys
+;; currently authorized to sign commits in this repository.

 (authorizations
 (version 0)
@@ -75,8 +75,12 @@
  (;; primary: "1BA4 08C5 8BF2 0EA7 3179  635A 865D C0A3 DED9 B5D0"
   "E31D 9DDE EBA5 4A14 8A20  4550 DA45 97F9 47B4 1025"
   (name "jlicht"))
+  ("8141 6036 E81A 5CF7 8F80  1071 ECFC 8398 8B4E 4B9F"
+   (name "jonsger"))
  ("83B6 703A DCCA 3B69 4BCE  2DA6 E6A5 EE3C 1946 7A0D"
   (name "kkebreau"))
+  ("ACC2 3BA0 59F7 CCF4 08F0  43AD 442A 84B8 C70E 2F87"
+   (name "leoprikler"))
  ("45E5 75FA 53EA 8BD6 1BCE  0B4E 3ADC 75F0 13D6 78F9"
   (name "leungbk"))
  (;; primary: "4F71 6F9A 8FA2 C80E F1B5  E1BA 5E35 F231 DE1A C5E0"
@@ -84,6 +88,8 @@
   (name "lfam"))
  ("2AE3 1395 932B E642 FC0E  D99C 9BED 6EDA 32E5 B0BC"
   (name "lsl88"))
+  ("8887 84C4 1459 ACCB 83E7  E84C 634C 6E89 79FA BEC2"
+   (name "m1gu3l"))
  ("CBF5 9755 CBE7 E7EF EF18  3FB1 DD40 9A15 D822 469D"
   (name "marusich"))
  ("BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"
@@ -101,6 +107,9 @@
   (name "ngz"))
  ("CEF4 CB91 4856 BA38 0A20  A7E2 3008 88CB 39C6 3817"
   (name "pelzflorian"))
+  (;; primary: "41CA 12EA DE0C F33F 6885  A58F 5719 6E37 E00B 77FD"
+   "72D5 3D81 8CB6 F4A1 7258  374C A8FC 9E44 7F4F 7D54"
+   (name "planglois"))
  (;; primary: "B68B DF22 73F9 DA0E 63C1  8A32 515B F416 9242 D600"
   "C699 ED09 E51B CE89 FD1D  A078 AAC7 E891 896B 568A"
   (name "pgarlick"))
@@ -13,7 +13,7 @@ Copyright © 2017 Arun Isaac <arunisaac@systemreboot.net>

 * Contributing

-See the manual for useful hacking informations, either by running
+See the manual for useful hacking information, either by running

  info -f doc/guix.info "Contributing"

@@ -39,6 +39,7 @@ do_subst = $(SED)					\
  -e 's,[@]GUILE[@],$(GUILE),g'				\
  -e 's,[@]guilemoduledir[@],$(guilemoduledir),g'	\
  -e 's,[@]guileobjectdir[@],$(guileobjectdir),g'	\
+  -e 's,[@]abs_top_builddir[@],$(abs_top_builddir),g'	\
  -e 's,[@]localedir[@],$(localedir),g'

 scripts/guix: scripts/guix.in Makefile
@@ -47,6 +48,18 @@ scripts/guix: scripts/guix.in Makefile
 	$(AM_V_GEN)$(do_subst) < "$(srcdir)/$@.in" > "$@-t"
 	$(AM_V_at)chmod a+x,a-w "$@-t" && mv -f "$@-t" "$@"

+# This is our variant of the 'guile' executable, one that doesn't complain
+# about locales.
+pkglibexec_PROGRAMS = guile
+guile_SOURCES = gnu/packages/aux-files/guile-launcher.c
+guile_LDADD   = $(GUILE_LIBS)
+guile_CFLAGS  = $(GUILE_CFLAGS)
+
+# Have the 'guix' command refer to our 'guile'.
+install-exec-hook:
+	$(SED) -i "$(DESTDIR)$(bindir)/guix"				\
+	       -e 's,^#![[:graph:]]\+,#!$(pkglibexecdir)/guile,g'
+
 nodist_noinst_SCRIPTS =				\
  pre-inst-env					\
  test-env
@@ -68,7 +81,6 @@ MODULES =					\
  guix/cpio.scm					\
  guix/deprecation.scm				\
  guix/docker.scm	   			\
-  guix/json.scm					\
  guix/records.scm				\
  guix/openpgp.scm				\
  guix/pki.scm					\
@@ -80,6 +92,7 @@ MODULES =					\
  guix/modules.scm				\
  guix/download.scm				\
  guix/discovery.scm				\
+  guix/android-repo-download.scm		\
  guix/bzr-download.scm            		\
  guix/git-download.scm				\
  guix/hg-download.scm				\
@@ -90,9 +103,11 @@ MODULES =					\
  guix/profiles.scm				\
  guix/serialization.scm			\
  guix/nar.scm					\
+  guix/digests.scm				\
  guix/derivations.scm				\
  guix/grafts.scm				\
  guix/repl.scm					\
+  guix/transformations.scm			\
  guix/inferior.scm				\
  guix/describe.scm				\
  guix/quirks.scm				\
@@ -113,6 +128,7 @@ MODULES =					\
  guix/build-system/android-ndk.scm		\
  guix/build-system/ant.scm			\
  guix/build-system/cargo.scm			\
+  guix/build-system/chicken.scm			\
  guix/build-system/clojure.scm			\
  guix/build-system/cmake.scm			\
  guix/build-system/dub.scm			\
@@ -162,6 +178,7 @@ MODULES =					\
  guix/build/download-nar.scm			\
  guix/build/cargo-build-system.scm		\
  guix/build/cargo-utils.scm			\
+  guix/build/chicken-build-system.scm		\
  guix/build/cmake-build-system.scm		\
  guix/build/dub-build-system.scm		\
  guix/build/dune-build-system.scm		\
@@ -170,6 +187,7 @@ MODULES =					\
  guix/build/minify-build-system.scm		\
  guix/build/font-build-system.scm		\
  guix/build/go-build-system.scm		\
+  guix/build/android-repo.scm			\
  guix/build/asdf-build-system.scm		\
  guix/build/bzr.scm				\
  guix/build/copy-build-system.scm		\
@@ -305,6 +323,14 @@ MODULES +=					\

 endif HAVE_GUILE_SSH

+if HAVE_GUILE_AVAHI
+
+MODULES += 					\
+  guix/avahi.scm				\
+  guix/scripts/discover.scm
+
+endif HAVE_GUILE_AVAHI
+
 if BUILD_DAEMON_OFFLOAD

 MODULES +=					\
@@ -331,10 +357,15 @@ dist_noinst_DATA =				\
 AUX_FILES =						\
  gnu/packages/aux-files/chromium/master-preferences.json		\
  gnu/packages/aux-files/emacs/guix-emacs.el		\
-  gnu/packages/aux-files/linux-libre/5.8-arm.conf       \
-  gnu/packages/aux-files/linux-libre/5.8-arm64.conf     \
-  gnu/packages/aux-files/linux-libre/5.8-i686.conf      \
-  gnu/packages/aux-files/linux-libre/5.8-x86_64.conf    \
+  gnu/packages/aux-files/guix.vim			\
+  gnu/packages/aux-files/linux-libre/5.10-arm.conf	\
+  gnu/packages/aux-files/linux-libre/5.10-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/5.10-i686.conf	\
+  gnu/packages/aux-files/linux-libre/5.10-x86_64.conf	\
+  gnu/packages/aux-files/linux-libre/5.9-arm.conf	\
+  gnu/packages/aux-files/linux-libre/5.9-arm64.conf	\
+  gnu/packages/aux-files/linux-libre/5.9-i686.conf	\
+  gnu/packages/aux-files/linux-libre/5.9-x86_64.conf	\
  gnu/packages/aux-files/linux-libre/5.4-arm.conf	\
  gnu/packages/aux-files/linux-libre/5.4-arm64.conf	\
  gnu/packages/aux-files/linux-libre/5.4-i686.conf	\
@@ -394,6 +425,7 @@ SCM_TESTS =					\
  tests/base16.scm				\
  tests/base32.scm				\
  tests/base64.scm				\
+  tests/boot-parameters.scm			\
  tests/bournish.scm				\
  tests/builders.scm				\
  tests/build-utils.scm			\
@@ -442,7 +474,6 @@ SCM_TESTS =					\
  tests/pypi.scm				\
  tests/records.scm				\
  tests/scripts.scm				\
-  tests/scripts-build.scm			\
  tests/search-paths.scm			\
  tests/services.scm				\
  tests/services/linux.scm			\
@@ -459,6 +490,7 @@ SCM_TESTS =					\
  tests/syscalls.scm				\
  tests/system.scm				\
  tests/texlive.scm				\
+  tests/transformations.scm			\
  tests/ui.scm					\
  tests/union.scm				\
  tests/upstream.scm				\
@@ -547,7 +579,7 @@ dist_zshcompletion_DATA = etc/completion/zsh/_guix
 dist_fishcompletion_DATA = etc/completion/fish/guix.fish

 # SELinux policy
-dist_selinux_policy_DATA = etc/guix-daemon.cil
+nodist_selinux_policy_DATA = etc/guix-daemon.cil

 EXTRA_DIST +=						\
  HACKING						\
@@ -555,6 +587,7 @@ EXTRA_DIST +=						\
  TODO							\
  CODE-OF-CONDUCT					\
  .dir-locals.el					\
+  .guix-authorizations					\
  .guix-channel						\
  scripts/guix.in					\
  etc/guix-install.sh					\
@@ -570,6 +603,7 @@ EXTRA_DIST +=						\
  build-aux/hydra/guix-modular.scm			\
  build-aux/cuirass/gnu-system.scm			\
  build-aux/cuirass/guix-modular.scm			\
+  build-aux/cuirass/hurd-manifest.scm			\
  build-aux/cuirass/hydra-to-cuirass.scm		\
  build-aux/check-final-inputs-self-contained.scm	\
  build-aux/check-channel-news.scm			\
@@ -651,9 +685,11 @@ channel_intro_commit = 9edb3f66fd807b096b48283debdcddccfea34bad
 channel_intro_signer = BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA

 # Authenticate the current Git checkout by checking signatures on every commit.
+GUIX_GIT_KEYRING = origin/keyring
 authenticate:
 	$(AM_V_at)echo "Authenticating Git checkout..." ;	\
 	guix git authenticate					\
+	    --keyring=$(GUIX_GIT_KEYRING)			\
 	    --cache-key=channels/guix --stats			\
 	    "$(channel_intro_commit)" "$(channel_intro_signer)"

@@ -687,12 +723,11 @@ AM_DISTCHECK_CONFIGURE_FLAGS =			\
  --localstatedir="$$dc_install_base/var"	\
  --with-libgcrypt-prefix="$(LIBGCRYPT_PREFIX)"	\
  --with-libgcrypt-libdir="$(LIBGCRYPT_LIBDIR)"	\
-  --with-nix-prefix="$(NIX_PREFIX)"		\
  --enable-daemon				\
  ac_cv_guix_test_root="$(GUIX_TEST_ROOT)"

 # Name of the 'guix' package shipped in the binary tarball.
-GUIX_FOR_BINARY_TARBALL = guile3.0-guix
+GUIX_FOR_BINARY_TARBALL = guix

 # The self-contained tarball.
 guix-binary.%.tar.xz:
@@ -712,8 +747,8 @@ distcheck-hook: assert-binaries-available assert-final-inputs-self-contained

 EXTRA_DIST += $(top_srcdir)/.version
 BUILT_SOURCES += $(top_srcdir)/.version
-$(top_srcdir)/.version:
-	echo $(VERSION) > "$@-t" && mv "$@-t" "$@"
+$(top_srcdir)/.version: config.status
+	$(AM_V_GEN)echo $(VERSION) > "$@-t" && mv "$@-t" "$@"

 gen-tarball-version:
 	echo $(VERSION) > "$(distdir)/.tarball-version"
@@ -808,9 +843,10 @@ release: dist-with-updated-version
 	$(MKDIR_P) "$(releasedir)"
 	rm -f "$(releasedir)"/*
 	mv $(SOURCE_TARBALLS) "$(releasedir)"
-	$(top_builddir)/pre-inst-env "$(GUILE)"			\
-	   $(top_srcdir)/build-aux/update-guix-package.scm	\
-	   "`git rev-parse HEAD`" "$(PACKAGE_VERSION)"
+	GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT=yes \
+	$(top_builddir)/pre-inst-env "$(GUILE)"	\
+		$(top_srcdir)/build-aux/update-guix-package.scm	\
+	   	"`git rev-parse HEAD`" "$(PACKAGE_VERSION)"
 	git add $(top_srcdir)/gnu/packages/package-management.scm
 	git commit -m "gnu: guix: Update to $(PACKAGE_VERSION)."
 	$(top_builddir)/pre-inst-env guix build $(GUIX_FOR_BINARY_TARBALL)	\
@@ -822,9 +858,10 @@ release: dist-with-updated-version
 	  mv "guix-binary.$$system.tar.xz"					\
 	      "$(releasedir)/guix-binary-$(PACKAGE_VERSION).$$system.tar.xz" ;	\
 	done
-	$(top_builddir)/pre-inst-env "$(GUILE)"			\
-	   $(top_srcdir)/build-aux/update-guix-package.scm	\
-	   "`git rev-parse HEAD`"
+	GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT=yes \
+	$(top_builddir)/pre-inst-env "$(GUILE)"	\
+		$(top_srcdir)/build-aux/update-guix-package.scm	\
+		"`git rev-parse HEAD`"
 	git add $(top_srcdir)/gnu/packages/package-management.scm
 	git commit -m "gnu: guix: Update to `git rev-parse HEAD | cut -c1-7`."
 	$(top_builddir)/pre-inst-env guix build guix			\
@@ -832,8 +869,8 @@ release: dist-with-updated-version
 	      -v1 --no-grafts --fallback
 	for system in $(GUIX_SYSTEM_SUPPORTED_SYSTEMS) ; do				\
 	  image=`$(top_builddir)/pre-inst-env						\
-	    guix system disk-image							\
-	    --file-system-type=iso9660							\
+	    guix system disk-image -t iso9660                                           \
+	    --label="GUIX_$${system}_$(VERSION)"					\
            --system=$$system --fallback						\
 	    gnu/system/install.scm` ;							\
 	  if [ ! -f "$$image" ] ; then							\
@@ -11,6 +11,160 @@ Copyright © 2016, 2017, 2018 Ricardo Wurmus <rekado@elephly.net>

 Please send Guix bug reports to bug-guix@gnu.org.

+* Changes in 1.2.0 (since 1.1.0)
+
+** Package management
+*** ‘guix pull’ now crytographically authenticates channels
+*** ‘guix describe -f channels’ now shows “channel introductions”
+*** ‘guix describe -f channels-sans-intro’ omits channel introductions
+*** New ‘guix git authenticate’ command, to authenticate Git checkouts
+*** ‘guix pull’ and ‘guix system reconfigure’ detect attempts to downgrade
+*** New ‘--allow-downgrades’ option for ‘guix pull’ and ‘guix system’
+*** Guix build time reduced thanks to Guile 3.0.4’s “baseline compiler”
+*** New ‘--with-debug-info’ package transformation option
+*** New ‘--with-c-toolchain’ package transformation option
+*** New ‘--without-tests’ package transformation option
+*** ‘--with-input’ & co. now also apply to implicit dependencies
+*** Package transformation options are now recorded in profiles
+*** New fakechroot “execution engine” for packs produced by ‘guix pack -RR’
+*** New ‘--cache-bypass-threshold’ option for ‘guix publish’
+*** New ‘--diff’ option for ‘guix challenge’, to compare substitutes
+*** New ‘--exclude’ option for ‘guix lint’, to exclude checkers
+*** New ‘check-for-collisions’ checker in ‘guix lint’
+*** All of Guix and Guix System now runs on Guile 3.0
+*** ‘guix pull’ and ‘--with-git-url’ now support authenticated SSH repos
+*** ‘guix pull’ now honors $http_proxy and $https_proxy
+*** New ‘--path’ option for ‘guix graph’, showing the shortest path
+*** ‘guix repl’ can now be passed a script to execute
+*** ‘guix help’ finally shows command descriptions
+*** ‘guix install’ etc. no longer list items to download by default
+*** ‘guix search’ etc. now automatically invoke the pager
+*** New ‘--hash’ option for ‘guix hash’
+*** New ‘--list-formats’ option for ‘guix describe’
+*** New “Getting Started” section in the manual
+
+** Distribution
+*** Bootstrap binary seeds reduced to 60 MiB on x86_64/i686
+*** New ‘--target’ option for ‘guix system’, for cross-compilation
+*** New ‘--image-type’ option for ‘guix system disk-image’
+*** New ‘--label’ option for ‘guix system disk-image’
+*** Guix System can now boot from a Btrfs subvolume
+*** New ‘hurd’ field of ‘operating-system’, for GNU/Hurd support
+*** Guix System can be cross-compiled to GNU/Hurd with ‘--target=i586-pc-gnu’
+*** New ‘hurd-vm-service-type’ to spawn a GNU/Hurd VM on GNU/Linux
+*** /etc/guix/acl on Guix System is now built from the OS configuration
+*** ‘rottlog-service-type’ is now part of ‘%base-services’
+*** Linux-libre modules are now gzip-compressed
+*** The efivarfs file system is now part of ‘%base-file-systems’
+*** mcron job specs are now statically checked at OS build time
+*** ‘swap-devices’ field of ‘operating-system’ can contains UUIDs and labels
+*** Graphical installer uses UUIDs for unencrypted swap partitions
+*** Graphical installer now supports NTFS file systems
+*** File systems UUIDs and labels now recognized for F2FS and NTFS
+*** Root file system can now be on NFS
+*** New services
+
+autossh, ganeti, gmnisrv, guix-build-coordinator,
+guix-build-coordinator-agent, guix-build-coordinator-queue-builds, hostapd,
+hurd-console, hurd-getty, hurd-vm, lxqt, rshiny, secret-service,
+simulated-wifi, udev-rules, unattended-upgrade, webssh, zram
+
+*** 1999 new packages
+*** 3652 package updates
+
+Noteworthy updates:
+bash 5.0.16, binutils 2.34, cups 2.3.3, emacs 27.1, enlightenment 0.24.2,
+gcc-toolchain 10.2.0, gdb 10.1, ghc 8.8.3, gimp 2.10.22, glibc 2.31,
+gnome 3.34.2, gnupg 2.2.23, go 1.14.10, guile 3.0.4,
+icecat 78.4.0-guix0-preview1, inkscape 1.0.1, julia 1.5.2,
+libreoffice 6.4.6.2, linux-libre 5.9.3, mate 1.24.1, ocaml 4.09.0,
+openjdk 14.0, perl 5.30.2, python2 2.7.17, python 3.8.2, racket 7.8,
+rust 1.46.0, r 4.0.3, sbcl 2.0.10, shepherd 0.8.1, xfce 4.14.2,
+xorg-server 1.20.8
+
+
+** Programming interfaces
+*** New ‘maven-build-system’, for packages built with Maven
+*** ‘haskell-build-system’ now always adds a “static” output
+*** New (gnu image) module, to build system images
+*** New (guix git-authenticate) module, for Git checkout authentication
+*** New (guix openpgp) module with a minimal OpenPGP implementation
+*** New (guix transformations) module, for package transformations
+*** New (gnu services hurd) module providing GNU/Hurd services
+*** (guix json) removed in favor of Guile-JSON’s (json) module
+*** (guix zlib) and (guix lzlib) removed in favor of Guile-{Zlib,Lzlib}
+*** ‘local-file’ warns about non-literal relative file names
+*** Daemon now supports more hash algorithms: SHA3 and BLAKE2s
+*** New <content-hash> record type for use in ‘origin’
+*** New ‘let-system’ for in (guix gexp), for system-dependent code
+*** New lowerable <profile> record type in (guix profiles)
+*** (gnu build secret-service) can share secrets with a guest OS
+*** “Programming Interface” section of the manual greatly expounded
+
+** Noteworthy bug fixes
+*** ‘guix pull’ now shows a progress bar while fetching from Git
+    (<https://bugs.gnu.org/39260>)
+*** ‘guix copy’ and ‘guix deploy’ show a progress bar while copying
+*** Bootloader messages are now localized
+    (<https://issues.guix.gnu.org/35394>)
+*** ‘guix system reconfigure’ now starts services not currently running
+    (<https://bugs.gnu.org/43720>)
+*** Desktop environments now detect newly installed applications
+    (<https://bugs.gnu.org/35594>)
+*** Offloading and copying small items is now much faster
+    (<https://issues.guix.gnu.org/43340>)
+*** GCC switched back to C_INCLUDE_PATH & co. from CPATH
+    (<https://bugs.gnu.org/30756>)
+*** Graphical installer no longer hangs while connecting to WiFi network
+    (<https://issues.guix.gnu.org/40682>)
+*** GNU Aspell truly honors ASPELL_DICT_DIR (<https://bugs.gnu.org/29686>)
+*** Fix overly aggressive memoization of “commencement” packages
+    (<https://bugs.gnu.org/40482>)
+*** Duplicate /etc entries are now reported (<https://bugs.gnu.org/40729>)
+*** ‘guix pack -R’ wrapper correctly reports exit code
+    (<https://bugs.gnu.org/40816>)
+*** Fix time travel to pre-Guile 3.0 revisions
+    (<https://bugs.gnu.org/41028>)
+*** ‘package-grafts’ returns grafts for all the relevant outputs
+    (<https://bugs.gnu.org/41796>)
+*** ‘guix pull’ and related commands authenticate Git checkouts
+    (<https://bugs.gnu.org/22883>)
+*** Fix GNU libstdc++ misconfiguration in recent ‘gcc-toolchain’ versions
+    (<https://bugs.gnu.org/42392>)
+*** ‘guix pack -R’ wraps propagated inputs as well
+    (<https://bugs.gnu.org/42510>)
+*** ‘guix pack -R’ wrapper leaves root available to child processes
+    (<https://bugs.gnu.org/44261>)
+*** ‘lib/guix/package.cache’ generated by ‘guix pull’ is now bit-reproducible
+    (<https://bugs.gnu.org/42009>)
+*** Graphical installer now properly detects disks containing an LVM partition
+    (<https://issues.guix.gnu.org/42683>)
+*** Fix possible crash when copying store items over SSH
+    (<https://bugs.gnu.org/42740>)
+*** ‘gcc’ is now a “deprecated” alias for ‘gcc-toolchain’
+    (<https://bugs.gnu.org/43303>)
+*** ‘package-input-rewriting’ & co. no longer yield unnecessary rebuilds
+    (<https://bugs.gnu.org/42156>)
+*** Offloading better normalizes build machine load
+    (<https://issues.guix.gnu.org/43773>)
+*** ‘guix build --check’ now honors ‘--rounds’
+    (<https://issues.guix.gnu.org/40144>)
+*** ‘guix-install.sh’ now installs shell completion files
+    (<https://bugs.gnu.org/43744>)
+*** ‘guix-install.sh’ now warns about lack of ‘nscd’
+    (<https://bugs.gnu.org/43744>)
+
+** Native language support
+*** Updated translations of the manual
+
+The manual is fully translated into French, German, and Spanish, and has
+preliminary translations into Chinese and Russian.
+
+*** Updated translations of messages
+
+This version of Guix is fully translated in French, German, and Spanish, and
+partially translated in 11 other languages.
+
 * Changes in 1.1.0 (since 1.0.1)
 ** Package management
 *** New ‘guix deploy’ command to deploy several machines at once
@@ -33,25 +33,14 @@ See the manual for the installation instructions, either by running

 or by checking the [[https://guix.gnu.org/manual/en/html_node/Installation.html][web copy of the manual]].

-For information on installation from a Git checkout, please see the section
-"Building from Git" in the manual.
+* Building from Git

-* Installing Guix from Guix
+For information on building Guix from a Git checkout, please see the relevant
+section in the manual, either by running

-You can re-build and re-install Guix using a system that already runs Guix.
-To do so:
+  info -f doc/guix.info "Building from Git"

-  - Start a shell with the development environment for Guix:
-
-      guix environment guix
-
-  - Re-run the 'configure' script passing it the option
-    '--localstatedir=/somewhere', where '/somewhere' is the 'localstatedir'
-    value of the currently installed Guix (failing to do that would lead the
-    new Guix to consider the store to be empty!).  We recommend to use the
-    value '/var'.
-
-  - Run "make", "make check", and "make install".
+or by checking the [[https://guix.gnu.org/manual/en/html_node/Building-from-Git.html][web_copy of the manual]].

 * How It Works

@@ -0,0 +1,74 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+;;; Commentary:
+;;;
+;;; This file defines a manifest with a selection of packages for Cuirass to
+;;; build for GNU/Hurd.
+;;;
+;;; Code:
+
+(use-modules (gnu)
+             (gnu system hurd)
+             (guix packages)
+             (guix utils)
+             (ice-9 match)
+             (srfi srfi-1))
+
+(use-package-modules
+ base commencement compression file gawk gdb gettext guile
+ hurd less m4 package-management python ssh version-control)
+
+(define (input->package input)
+  "Return the INPUT as package, or #f."
+  (match input
+    ((label (and (? package?) package))
+     package)
+    ((label (and (? package?) package . output))
+     (cons package output))
+    (_ #f)))
+
+(define guix-dependencies
+  (filter-map input->package
+              (fold alist-delete (package-direct-inputs guix)
+                    '("glibc-utf8-locales" "graphviz" "po4a"))))
+
+(define (package-without-tests p)
+  (package/inherit p
+    (arguments
+     (substitute-keyword-arguments (package-arguments p)
+       ((#:tests? _ #f) #f)))))
+
+(packages->manifest
+ (cons*
+  ;; where it all starts
+  hello
+
+  ;; development utililities
+  diffutils file findutils gawk grep gzip less m4 openssh-sans-x tar xz
+
+  ;; development packages
+  gcc-toolchain gdb-minimal git-minimal gnu-make
+
+  ;; guix environment guix --without-tests=python-minimal --without-tests=gettext-minimal
+  (package-without-tests gettext-minimal)
+  (package-without-tests python-minimal)
+
+  (append
+   guix-dependencies
+   (delete guile-3.0 %base-packages/hurd))))
@@ -43,17 +43,25 @@ for SYSTEM.  Use VERSION as the version identifier."
    (define build
      (primitive-load (string-append source "/build-aux/build-self.scm")))

-    `((derivation . ,(derivation-file-name
-                      (run-with-store store
-                        (build source #:version version #:system system
-                               #:pull-version 1
-                               #:guile-version "2.2")))) ;the latest 2.2.x
-      (description . "Modular Guix")
-      (long-description
-       . "This is the modular Guix package as produced by 'guix pull'.")
-      (license . ,license:gpl3+)
-      (home-page . ,%guix-home-page-url)
-      (maintainers . (,%guix-bug-report-address)))))
+    (let ((drv (run-with-store store
+                 (build source #:version version #:system system
+                        #:pull-version 1
+                        #:guile-version "2.2"))))
+      `((derivation . ,(derivation-file-name drv)) ;the latest 2.2.x
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
+        (description . "Modular Guix")
+        (long-description
+         . "This is the modular Guix package as produced by 'guix pull'.")
+        (license . ,license:gpl3+)
+        (home-page . ,%guix-home-page-url)
+        (maintainers . (,%guix-bug-report-address))))))

 (define (hydra-jobs store arguments)
  "Return Hydra jobs."
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,20 +25,25 @@
 ;;; Code:

 (use-modules (guix)
+             (guix ui)
             (guix git-download)
             (guix upstream)
             (guix utils)
             (guix base32)
             (guix build utils)
+             (guix scripts hash)
             (gnu packages package-management)
-             (ice-9 match))
+             (ice-9 match)
+             (ice-9 popen)
+             (ice-9 regex)
+             (ice-9 textual-ports)
+             (srfi srfi-1)
+             (srfi srfi-2)
+             (srfi srfi-26))

 (define %top-srcdir
  (string-append (current-source-directory) "/.."))

-(define version-controlled?
-  (git-predicate %top-srcdir))
-
 (define (package-definition-location)
  "Return the source properties of the definition of the 'guix' package."
  (call-with-input-file (location-file (package-location guix))
@@ -101,44 +107,107 @@ COMMIT."
      (exp
       (error "'guix' package definition is not as expected" exp)))))

+(define (git-add-worktree directory commit)
+  "Create a new git worktree at DIRECTORY, detached on commit COMMIT."
+  (invoke "git" "worktree" "add" "--detach" directory commit))
+
+(define (call-with-temporary-git-worktree commit proc)
+  "Execute PROC in the context of a temporary git worktree created from
+COMMIT.  PROC receives the temporary directory file name as an argument."
+  (call-with-temporary-directory
+   (lambda (tmp-directory)
+     (dynamic-wind
+       (lambda ()
+         #t)
+       (lambda ()
+         (git-add-worktree tmp-directory commit)
+         (proc tmp-directory))
+       (lambda ()
+         (invoke "git" "worktree" "remove" "--force" tmp-directory))))))
+
+(define %savannah-guix-git-repo-push-url-regexp
+  "git.(savannah|sv).gnu.org:?/srv/git/guix.git \\(push\\)")
+
+(define-syntax-rule (with-input-pipe-to-string prog arg ...)
+  (let* ((input-pipe (open-pipe* OPEN_READ prog arg ...))
+	 (output (get-string-all input-pipe))
+	 (exit-val (status:exit-val (close-pipe input-pipe))))
+    (unless (zero? exit-val)
+      (error (format #f "Command ~s exited with non-zero exit status: ~s"
+                     (string-join (list prog arg ...)) exit-val)))
+    (string-trim-both output)))
+
+(define (find-origin-remote)
+  "Find the name of the git remote with the Savannah Guix git repo URL."
+  (and-let* ((remotes (string-split (with-input-pipe-to-string
+                                     "git" "remote" "-v")
+                                    #\newline))
+             (origin-entry (find (cut string-match
+                                      %savannah-guix-git-repo-push-url-regexp
+                                      <>)
+                                 remotes)))
+    (first (string-split origin-entry #\tab))))
+
+(define (commit-already-pushed? remote commit)
+  "True if COMMIT is found in the REMOTE repository."
+  (not (string-null? (with-input-pipe-to-string
+                      "git" "branch" "-r" "--contains" commit
+                      (string-append remote "/master")))))
+
+(define (keep-source-in-store store source)
+  "Add SOURCE to the store under the name that the 'guix' package expects."
+
+  ;; Add SOURCE to the store, but this time under the real name used in the
+  ;; 'origin'.  This allows us to build the package without having to make a
+  ;; real checkout; thus, it also works when working on a private branch.
+  (reload-module
+   (resolve-module '(gnu packages package-management)))
+
+  (let* ((source (add-to-store store
+                               (origin-file-name (package-source guix))
+                               #t "sha256" source
+                               #:select? (git-predicate source)))
+         (root   (store-path-package-name source)))
+
+    ;; Add an indirect GC root for SOURCE in the current directory.
+    (false-if-exception (delete-file root))
+    (symlink source root)
+    (add-indirect-root store
+                       (string-append (getcwd) "/" root))
+
+    (info (G_ "source code kept in ~a (GC root: ~a)~%")
+          source root)))
+

 (define (main . args)
  (match args
    ((commit version)
-     (with-store store
-       (let* ((source   (add-to-store store
-                                      "guix-checkout" ;dummy name
-                                      #t "sha256" %top-srcdir
-                                      #:select? version-controlled?))
-              (hash     (query-path-hash store source))
-              (location (package-definition-location))
-              (old-hash (content-hash-value
-                          (origin-hash (package-source guix)))))
-         (edit-expression location
-                          (update-definition commit hash
-                                             #:old-hash old-hash
-                                             #:version version))
-
-         ;; Re-add SOURCE to the store, but this time under the real name used
-         ;; in the 'origin'.  This allows us to build the package without
-         ;; having to make a real checkout; thus, it also works when working
-         ;; on a private branch.
-         (reload-module
-          (resolve-module '(gnu packages package-management)))
-
-         (let* ((source (add-to-store store
-                                      (origin-file-name (package-source guix))
-                                      #t "sha256" source))
-                (root   (store-path-package-name source)))
-
-           ;; Add an indirect GC root for SOURCE in the current directory.
-           (false-if-exception (delete-file root))
-           (symlink source root)
-           (add-indirect-root store
-                              (string-append (getcwd) "/" root))
-
-           (format #t "source code for commit ~a: ~a (GC root: ~a)~%"
-                   commit source root)))))
+     (with-directory-excursion %top-srcdir
+       (or (getenv "GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT")
+           (let ((remote (find-origin-remote)))
+             (unless remote
+               (leave (G_ "Failed to find the origin git remote.~%")))
+             (commit-already-pushed? remote commit))
+           (leave (G_ "Commit ~a is not pushed upstream.  Aborting.~%") commit))
+       (call-with-temporary-git-worktree commit
+           (lambda (tmp-directory)
+             (let* ((hash (nix-base32-string->bytevector
+                           (string-trim-both
+                            (with-output-to-string
+		              (lambda ()
+		                (guix-hash "-rx" tmp-directory))))))
+                    (location (package-definition-location))
+                    (old-hash (content-hash-value
+                               (origin-hash (package-source guix)))))
+               (edit-expression location
+                                (update-definition commit hash
+                                                   #:old-hash old-hash
+                                                   #:version version))
+               ;; When GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT is set, the sources are
+               ;; added to the store.  This is used as part of 'make release'.
+               (when (getenv "GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT")
+                 (with-store store
+                   (keep-source-in-store store tmp-directory))))))))
    ((commit)
     ;; Automatically deduce the version and revision numbers.
     (main commit #f))))
@@ -13,7 +13,7 @@ if test "x$guix_build_daemon" = "xyes"; then
  GUIX_ASSERT_CXX11

  AC_PROG_RANLIB
-  AC_CONFIG_HEADER([nix/config.h])
+  AC_CONFIG_HEADERS([nix/config.h])

  dnl Use 64-bit file system calls so that we can support files > 2 GiB.
  AC_SYS_LARGEFILE
@@ -34,7 +34,6 @@ if test "x$guix_build_daemon" = "xyes"; then
  dnl Look for SQLite, a required dependency.
  PKG_CHECK_MODULES([SQLITE3], [sqlite3 >= 3.6.19])

-  AC_DEFINE([NIX_VERSION], ["0.0.0"], [Fake Nix version number.])
  AC_DEFINE_UNQUOTED([SYSTEM], ["$guix_system"],
    [Guix host system type--i.e., platform and OS kernel tuple.])

@@ -1,7 +1,7 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.

-AC_PREREQ(2.68)
+AC_PREREQ([2.69])
 AC_INIT([GNU Guix],
  [m4_esyscmd([build-aux/git-version-gen .tarball-version])],
  [bug-guix@gnu.org], [guix],
@@ -29,35 +29,35 @@ GUIX_ASSERT_SUPPORTED_SYSTEM
 AM_CONDITIONAL([CROSS_COMPILING], [test "x$cross_compiling" = "xyes"])

 AC_ARG_WITH(store-dir,
-  AC_HELP_STRING([--with-store-dir=PATH],
+  AS_HELP_STRING([--with-store-dir=PATH],
    [file name of the store (defaults to /gnu/store)]),
  [storedir="$withval"],
  [storedir="/gnu/store"])
 AC_SUBST(storedir)

 AC_ARG_WITH([bash-completion-dir],
-  AC_HELP_STRING([--with-bash-completion-dir=DIR],
+  AS_HELP_STRING([--with-bash-completion-dir=DIR],
    [name of the Bash completion directory]),
  [bashcompletiondir="$withval"],
  [bashcompletiondir='${sysconfdir}/bash_completion.d'])
 AC_SUBST([bashcompletiondir])

 AC_ARG_WITH([zsh-completion-dir],
-  AC_HELP_STRING([--with-zsh-completion-dir=DIR],
+  AS_HELP_STRING([--with-zsh-completion-dir=DIR],
    [name of the Zsh completion directory]),
  [zshcompletiondir="$withval"],
  [zshcompletiondir='${datadir}/zsh/site-functions'])
 AC_SUBST([zshcompletiondir])

 AC_ARG_WITH([fish-completion-dir],
-  AC_HELP_STRING([--with-fish-completion-dir=DIR],
+  AS_HELP_STRING([--with-fish-completion-dir=DIR],
    [name of the Fish completion directory]),
  [fishcompletiondir="$withval"],
  [fishcompletiondir='${datadir}/fish/vendor_completions.d'])
 AC_SUBST([fishcompletiondir])

 AC_ARG_WITH([selinux-policy-dir],
-  AC_HELP_STRING([--with-selinux-policy-dir=DIR],
+  AS_HELP_STRING([--with-selinux-policy-dir=DIR],
    [name of the SELinux policy directory]),
  [selinux_policydir="$withval"],
  [selinux_policydir='${datadir}/selinux/'])
@@ -102,9 +102,12 @@ if test "x$GUILD" = "x"; then
 fi

 if test "x$GUILE_EFFECTIVE_VERSION" = "x2.2"; then
-  PKG_CHECK_MODULES([GUILE], [guile-2.2 >= 2.2.3])
+  PKG_CHECK_MODULES([GUILE], [guile-2.2 >= 2.2.6])
 fi

+dnl Get CFLAGS and LDFLAGS for libguile.
+GUILE_FLAGS
+
 dnl Installation directories for .scm and .go files.
 guilemoduledir="${datarootdir}/guile/site/$GUILE_EFFECTIVE_VERSION"
 guileobjectdir="${libdir}/guile/$GUILE_EFFECTIVE_VERSION/site-ccache"
@@ -141,6 +144,11 @@ if test "x$guix_cv_have_recent_guile_gcrypt" != "xyes"; then
  AC_MSG_ERROR([A recent Guile-Gcrypt could not be found; please install it.])
 fi

+GUIX_CHECK_GUILE_GIT
+if test "x$guix_cv_have_recent_guile_git" != "xyes"; then
+  AC_MSG_ERROR([A recent Guile-Git could not be found; please install it.])
+fi
+
 dnl Check for Guile-zlib.
 GUILE_MODULE_AVAILABLE([have_guile_zlib], [(zlib)])
 if test "x$have_guile_zlib" != "xyes"; then
@@ -153,6 +161,11 @@ if test "x$have_guile_lzlib" != "xyes"; then
  AC_MSG_ERROR([Guile-lzlib is missing; please install it.])
 fi

+dnl Check for Guile-Avahi.
+GUILE_MODULE_AVAILABLE([have_guile_avahi], [(avahi)])
+AM_CONDITIONAL([HAVE_GUILE_AVAHI],
+  [test "x$have_guile_avahi" = "xyes"])
+
 dnl Guile-newt is used by the graphical installer.
 GUILE_MODULE_AVAILABLE([have_guile_newt], [(newt)])

@@ -181,19 +194,6 @@ AC_SUBST([GZIP])
 AC_SUBST([BZIP2])
 AC_SUBST([XZ])

-AC_ARG_WITH([nix-prefix],
-  [AS_HELP_STRING([--with-nix-prefix=DIR],
-    [search for Nix in DIR (for testing purposes and '--disable-daemon' builds)])],
-  [case "$withval" in
-    yes|no) ;;
-    *)
-      NIX_PREFIX="$withval"
-      PATH="$NIX_PREFIX/bin:$PATH"; export PATH
-      AC_SUBST([NIX_PREFIX])
-      ;;
-   esac],
-  [])
-
 AC_ARG_WITH([nixpkgs],
  [AS_HELP_STRING([--with-nixpkgs=DIR],
    [search for Nixpkgs in DIR (for testing purposes only)])],
@@ -33,6 +33,7 @@
             (guix utils)
             (git)
             (gnu packages base)
+             (gnu packages compression)
             (gnu packages gawk)
             (gnu packages gettext)
             (gnu packages guile)
@@ -40,7 +41,10 @@
             (gnu packages iso-codes)
             (gnu packages texinfo)
             (gnu packages tex)
+             (ice-9 match)
+             (srfi srfi-1)
             (srfi srfi-19)
+             (srfi srfi-26)
             (srfi srfi-71))

 (define file-append*
@@ -204,9 +208,172 @@ content=\"width=device-width, initial-scale=1\" />"))
               (setenv "XFAIL_TESTS" "htmlprag.scm")
               #t))))))))

+(define (normalize-language-code language)        ;XXX: deduplicate
+  ;; Normalize LANGUAGE.  For instance, "zh_CN" becomes "zh-cn".
+  (string-map (match-lambda
+                (#\_ #\-)
+                (chr chr))
+              (string-downcase language)))
+
+(define* (html-manual-identifier-index manual base-url
+                                       #:key
+                                       (name "html-manual-identifier-index"))
+  "Return an index of all the identifiers that appear in MANUAL, a
+makeinfo-generated manual.  The index is a file that contains an alist; each
+key is an identifier and the associated value is the URL reference pointing to
+that identifier.  The URL is constructed by concatenating BASE-URL to the
+actual file name."
+  (define build
+    (with-extensions (list guile-lib/htmlprag-fixed)
+      (with-imported-modules '((guix build utils))
+        #~(begin
+            (use-modules (guix build utils)
+                         (htmlprag)
+                         (srfi srfi-1)
+                         (srfi srfi-26)
+                         (ice-9 ftw)
+                         (ice-9 match)
+                         (ice-9 threads)
+                         (ice-9 pretty-print))
+
+            (define file-url
+              (let ((prefix (string-append #$manual "/")))
+                (lambda (file)
+                  ;; Return the URL for FILE.
+                  (let ((file (string-drop file (string-length prefix)))
+                        (base #$base-url))
+                    (if (string-null? base)
+                        file
+                        (string-append base "/" file))))))
+
+            (define (underscore-decode str)
+              ;; Decode STR, an "underscore-encoded" string as produced by
+              ;; makeinfo for indexes, such as "_0025base_002dservices" for
+              ;; "%base-services".
+              (let loop ((str str)
+                         (result '()))
+                (match (string-index str #\_)
+                  (#f
+                   (string-concatenate-reverse (cons str result)))
+                  (index
+                   (let ((char (string->number
+                                (substring str (+ index 1) (+ index 5))
+                                16)))
+                     (loop (string-drop str (+ index 5))
+                           (append (list (string (integer->char char))
+                                         (string-take str index))
+                                   result)))))))
+
+            (define (anchor-id->key id)
+              ;; Convert ID, an anchor ID such as
+              ;; "index-pam_002dlimits_002dservice" to the corresponding key,
+              ;; "pam-limits-service" in this example.  Drop the suffix of
+              ;; duplicate anchor IDs like "operating_002dsystem-1".
+              (let ((id (if (any (cut string-suffix? <> id)
+                                 '("-1" "-2" "-3" "-4" "-5"))
+                            (string-drop-right id 2)
+                            id)))
+                (underscore-decode
+                 (string-drop id (string-length "index-")))))
+
+            (define* (collect-anchors file #:optional (anchors '()))
+              ;; Collect the anchors that appear in FILE, a makeinfo-generated
+              ;; file.  Grab those from <dt> tags, which corresponds to
+              ;; Texinfo @deftp, @defvr, etc.  Return ANCHORS augmented with
+              ;; more name/reference pairs.
+              (define string-or-entity?
+                (match-lambda
+                  ((? string?) #t)
+                  (('*ENTITY* _ ...) #t)
+                  (_ #f)))
+
+              (define (worthy-entry? lst)
+                ;; Attempt to match:
+                ;;   Scheme Variable: <strong>x</strong>
+                ;; but not:
+                ;;   <code>cups-configuration</code> parameter: …
+                (let loop ((lst lst))
+                  (match lst
+                    (((? string-or-entity?) rest ...)
+                     (loop rest))
+                    ((('strong _ ...) _ ...)
+                     #t)
+                    ((('span ('@ ('class "symbol-definition-category"))
+                             (? string-or-entity?) ...) rest ...)
+                     #t)
+                    (x
+                     #f))))
+
+              (let ((shtml (call-with-input-file file html->shtml)))
+                (let loop ((shtml shtml)
+                           (anchors anchors))
+                  (match shtml
+                    (('dt ('@ ('id id) _ ...) rest ...)
+                     (if (and (string-prefix? "index-" id)
+                              (worthy-entry? rest))
+                         (alist-cons (anchor-id->key id)
+                                     (string-append (file-url file)
+                                                    "#" id)
+                                     anchors)
+                         anchors))
+                    ((tag ('@ _ ...) body ...)
+                     (fold loop anchors body))
+                    ((tag body ...)
+                     (fold loop anchors body))
+                    (_ anchors)))))
+
+            (define (html-files directory)
+              ;; Return the list of HTML files under DIRECTORY.
+              (map (cut string-append directory "/" <>)
+                   (scandir #$manual (lambda (file)
+                                       (string-suffix? ".html" file)))))
+
+            (define anchors
+              (sort (concatenate
+                     (n-par-map (parallel-job-count)
+                                (cut collect-anchors <>)
+                                (html-files #$manual)))
+                    (match-lambda*
+                      (((key1 . url1) (key2 . url2))
+                       (if (string=? key1 key2)
+                           (string<? url1 url2)
+                           (string<? key1 key2))))))
+
+            (call-with-output-file #$output
+              (lambda (port)
+                (display ";; Identifier index for the manual.\n\n"
+                         port)
+                (pretty-print anchors port)))))))
+
+  (computed-file name build))
+
+(define* (html-identifier-indexes manual directory-suffix
+                                  #:key (languages %languages)
+                                  (manual-name %manual)
+                                  (base-url (const "")))
+  (map (lambda (language)
+         (let ((language (normalize-language-code language)))
+           (list language
+                 (html-manual-identifier-index
+                  (file-append manual "/" language directory-suffix)
+                  (base-url language)
+                  #:name (string-append manual-name "-html-index-"
+                                        language)))))
+       languages))
+
 (define* (syntax-highlighted-html input
                                  #:key
                                  (name "highlighted-syntax")
+                                  (languages %languages)
+                                  (mono-node-indexes
+                                   (html-identifier-indexes input ""
+                                                            #:languages
+                                                            languages))
+                                  (split-node-indexes
+                                   (html-identifier-indexes input
+                                                            "/html_node"
+                                                            #:languages
+                                                            languages))
                                  (syntax-css-url
                                   "/static/base/css/code.css"))
  "Return a derivation called NAME that processes all the HTML files in INPUT
@@ -310,10 +477,25 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                   (loop rest (cons (entity->string entity) strings)))
                  ((('span _ lst ...) . rest)     ;for <span class="roman">
                   (loop (append lst rest) strings))
+                  ((('var name) . rest)           ;for @var{name} within @lisp
+                   (loop rest (cons name strings))) ;XXX: losing formatting
                  (something
                   (pk 'unsupported-code-snippet something)
                   (primitive-exit 1)))))

+            (define (highlight-definition id category symbol args)
+              ;; Produce stylable HTML for the given definition (an @deftp,
+              ;; @deffn, or similar).
+              `(dt (@ (id ,id) (class "symbol-definition"))
+                   (span (@ (class "symbol-definition-category"))
+                         ,@category)
+                   (span (@ (class "symbol-definition-prototype"))
+                         ,symbol " " ,@args)))
+
+            (define (space? obj)
+              (and (string? obj)
+                   (string-every char-set:whitespace obj)))
+
            (define (syntax-highlight sxml anchors)
              ;; Recurse over SXML and syntax-highlight code snippets.
              (let loop ((sxml sxml))
@@ -332,6 +514,15 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                             (highlight lex-scheme
                                        (concatenate-snippets code-snippet)))
                            anchors)))
+
+                  ;; Replace the ugly <strong> used for @deffn etc., which
+                  ;; translate to <dt>, with more stylable markup.
+                  (('dt (@ ('id id)) category ... ('strong thing))
+                   (highlight-definition id category thing '()))
+                  (('dt (@ ('id id)) category ... ('strong thing)
+                        (? space?) ('em args ...))
+                   (highlight-definition id category thing args))
+
                  ((tag ('@ attributes ...) body ...)
                   `(,tag (@ ,@attributes) ,@(map loop body)))
                  ((tag body ...)
@@ -339,78 +530,6 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
                  ((? string? str)
                   str))))

-            (define (underscore-decode str)
-              ;; Decode STR, an "underscore-encoded" string as produced by
-              ;; makeinfo for indexes, such as "_0025base_002dservices" for
-              ;; "%base-services".
-              (let loop ((str str)
-                         (result '()))
-                (match (string-index str #\_)
-                  (#f
-                   (string-concatenate-reverse (cons str result)))
-                  (index
-                   (let ((char (string->number
-                                (substring str (+ index 1) (+ index 5))
-                                16)))
-                     (loop (string-drop str (+ index 5))
-                           (append (list (string (integer->char char))
-                                         (string-take str index))
-                                   result)))))))
-
-            (define (anchor-id->key id)
-              ;; Convert ID, an anchor ID such as
-              ;; "index-pam_002dlimits_002dservice" to the corresponding key,
-              ;; "pam-limits-service" in this example.  Drop the suffix of
-              ;; duplicate anchor IDs like "operating_002dsystem-1".
-              (let ((id (if (any (cut string-suffix? <> id)
-                                 '("-1" "-2" "-3" "-4" "-5"))
-                            (string-drop-right id 2)
-                            id)))
-                (underscore-decode
-                 (string-drop id (string-length "index-")))))
-
-            (define* (collect-anchors file #:optional (vhash vlist-null))
-              ;; Collect the anchors that appear in FILE, a makeinfo-generated
-              ;; file.  Grab those from <dt> tags, which corresponds to
-              ;; Texinfo @deftp, @defvr, etc.  Return VHASH augmented with
-              ;; more name/reference pairs.
-              (define string-or-entity?
-                (match-lambda
-                  ((? string?) #t)
-                  (('*ENTITY* _ ...) #t)
-                  (_ #f)))
-
-              (define (worthy-entry? lst)
-                ;; Attempt to match:
-                ;;   Scheme Variable: <strong>x</strong>
-                ;; but not:
-                ;;   <code>cups-configuration</code> parameter: …
-                (let loop ((lst lst))
-                  (match lst
-                    (((? string-or-entity?) rest ...)
-                     (loop rest))
-                    ((('strong _ ...) _ ...)
-                     #t)
-                    (_ #f))))
-
-              (let ((shtml (call-with-input-file file html->shtml)))
-                (let loop ((shtml shtml)
-                           (vhash vhash))
-                  (match shtml
-                    (('dt ('@ ('id id)) rest ...)
-                     (if (and (string-prefix? "index-" id)
-                              (worthy-entry? rest))
-                         (vhash-cons (anchor-id->key id)
-                                     (string-append (basename file)
-                                                    "#" id)
-                                     vhash)
-                         vhash))
-                    ((tag ('@ _ ...) body ...)
-                     (fold loop vhash body))
-                    ((tag body ...)
-                     (fold loop vhash body))
-                    (_ vhash)))))
-
            (define (process-html file anchors)
              ;; Parse FILE and perform syntax highlighting for its Scheme
              ;; snippets.  Install the result to #$output.
@@ -442,38 +561,59 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
            (define (html? file stat)
              (string-suffix? ".html" file))

+            (define language+node-anchors
+              (match-lambda
+                ((language files ...)
+                 (cons language
+                       (fold (lambda (file vhash)
+                               (let ((alist (call-with-input-file file read)))
+                                 ;; Use 'fold-right' so that the first entry
+                                 ;; wins (e.g., "car" from "Pairs" rather than
+                                 ;; from "rnrs base" in the Guile manual).
+                                 (fold-right (match-lambda*
+                                               (((key . value) vhash)
+                                                (vhash-cons key value vhash)))
+                                             vhash
+                                             alist)))
+                             vlist-null
+                             files)))))
+
+            (define mono-node-anchors
+              ;; List of language/vhash pairs, where each vhash maps an
+              ;; identifier to the corresponding URL in a single-page manual.
+              (map language+node-anchors '#$mono-node-indexes))
+
+            (define multi-node-anchors
+              ;; Likewise for split-node manuals.
+              (map language+node-anchors '#$split-node-indexes))
+
            ;; Install a UTF-8 locale so we can process UTF-8 files.
            (setenv "GUIX_LOCPATH"
                    #+(file-append glibc-utf8-locales "/lib/locale"))
            (setlocale LC_ALL "en_US.utf8")

            ;; First process the mono-node 'guix.html' files.
-            (n-par-for-each (parallel-job-count)
-                            (lambda (mono)
-                              (let ((anchors (collect-anchors mono)))
-                                (process-html mono anchors)))
-                            (find-files
-                             #$input
-                             "^guix(-cookbook|)(\\.[a-zA-Z_-]+)?\\.html$"))
+            (for-each (match-lambda
+                        ((language . anchors)
+                         (let ((files (find-files
+                                       (string-append #$input "/" language)
+                                       "^guix(-cookbook|)(\\.[a-zA-Z_-]+)?\\.html$")))
+                           (n-par-for-each (parallel-job-count)
+                                           (cut process-html <> anchors)
+                                           files))))
+                      mono-node-anchors)

-            ;; Next process the multi-node HTML files in two phases: (1)
-            ;; collect the list of anchors, and (2) perform
-            ;; syntax-highlighting.
-            (let* ((multi   (find-files #$input "^html_node$"
-                                        #:directories? #t))
-                   (anchors (n-par-map (parallel-job-count)
-                                       (lambda (multi)
-                                         (cons multi
-                                               (fold collect-anchors vlist-null
-                                                     (find-files multi html?))))
-                                       multi)))
-              (n-par-for-each (parallel-job-count)
-                              (lambda (file)
-                                (let ((anchors (assoc-ref anchors (dirname file))))
-                                  (process-html file anchors)))
-                              (append-map (lambda (multi)
-                                            (find-files multi html?))
-                                          multi)))
+            ;; Process the multi-node HTML files.
+            (for-each (match-lambda
+                        ((language . anchors)
+                         (let ((files (find-files
+                                       (string-append #$input "/" language
+                                                      "/html_node")
+                                       "\\.html$")))
+                           (n-par-for-each (parallel-job-count)
+                                           (cut process-html <> anchors)
+                                           files))))
+                      multi-node-anchors)

            ;; Last, copy non-HTML files as is.
            (for-each copy-as-is
@@ -484,6 +624,8 @@ its <pre class=\"lisp\"> blocks (as produced by 'makeinfo --html')."
 (define* (html-manual source #:key (languages %languages)
                      (version "0.0")
                      (manual %manual)
+                      (mono-node-indexes (map list languages))
+                      (split-node-indexes (map list languages))
                      (date 1)
                      (options %makeinfo-html-options))
  "Return the HTML manuals built from SOURCE for all LANGUAGES, with the given
@@ -572,6 +714,8 @@ makeinfo OPTIONS."
  (let* ((name   (string-append manual "-html-manual"))
         (manual (computed-file name build)))
    (syntax-highlighted-html manual
+                             #:mono-node-indexes mono-node-indexes
+                             #:split-node-indexes split-node-indexes
                             #:name (string-append name "-highlighted"))))

 (define* (pdf-manual source #:key (languages %languages)
@@ -918,6 +1062,8 @@ languages:\n"
                          #:key (languages %languages)
                          (version "0.0")
                          (date (time-second (current-time time-utc)))
+                          (mono-node-indexes (map list %languages))
+                          (split-node-indexes (map list %languages))
                          (manual %manual))
  "Return the union of the HTML and PDF manuals, as well as the indexes."
  (directory-union (string-append manual "-manual")
@@ -928,7 +1074,12 @@ languages:\n"
                                #:version version
                                #:manual manual))
                        (list html-manual-indexes
-                              html-manual pdf-manual))
+                              (lambda (source . args)
+                                (apply html-manual source
+                                       #:mono-node-indexes mono-node-indexes
+                                       #:split-node-indexes split-node-indexes
+                                       args))
+                              pdf-manual))
                   #:copy? #t))

 (define (latest-commit+date directory)
@@ -941,18 +1092,146 @@ commit date (an integer)."
    ;; TODO: Use (git describe) when it's widely available.
    (values (oid->string oid) (commit-time commit))))

+
+;;;
+;;; Guile manual.
+;;;
+
+(define guile-manual
+  ;; The Guile manual as HTML, including both the mono-node "guile.html" and
+  ;; the split-node "html_node" directory.
+  (let ((guile guile-3.0-latest))
+    (computed-file (string-append "guile-manual-" (package-version guile))
+                   (with-imported-modules '((guix build utils))
+                     #~(begin
+                         (use-modules (guix build utils)
+                                      (ice-9 match))
+
+                         (setenv "PATH"
+                                 (string-append #+tar "/bin:"
+                                                #+xz "/bin:"
+                                                #+texinfo "/bin"))
+                         (invoke "tar" "xf" #$(package-source guile))
+                         (mkdir-p (string-append #$output "/en/html_node"))
+
+                         (let* ((texi (find-files "." "^guile\\.texi$"))
+                                (documentation (match texi
+                                                 ((file) (dirname file)))))
+                           (with-directory-excursion documentation
+                             (invoke "makeinfo" "--html" "--no-split"
+                                     "-o" (string-append #$output
+                                                         "/en/guile.html")
+                                     "guile.texi")
+                             (invoke "makeinfo" "--html" "-o" "split"
+                                     "guile.texi")
+                             (copy-recursively
+                              "split"
+                              (string-append #$output "/en/html_node")))))))))
+
+(define %guile-manual-base-url
+  "https://www.gnu.org/software/guile/manual")
+
+(define (for-all-languages index)
+  (map (lambda (language)
+         (list language index))
+       %languages))
+
+(define guile-mono-node-indexes
+  ;; The Guile manual is only available in English so use the same index in
+  ;; all languages.
+  (for-all-languages
+   (html-manual-identifier-index (file-append guile-manual "/en")
+                                 %guile-manual-base-url
+                                 #:name "guile-html-index-en")))
+
+(define guile-split-node-indexes
+  (for-all-languages
+   (html-manual-identifier-index (file-append guile-manual "/en/html_node")
+                                 (string-append %guile-manual-base-url
+                                                "/html_node")
+                                 #:name "guile-html-index-en")))
+
+(define (merge-index-alists alist1 alist2)
+  "Merge ALIST1 and ALIST2, both of which are list of tuples like:
+
+  (LANGUAGE INDEX1 INDEX2 ...)
+
+where LANGUAGE is a string like \"en\" and INDEX1 etc. are indexes as returned
+by 'html-identifier-indexes'."
+  (let ((languages (delete-duplicates
+                    (append (match alist1
+                              (((languages . _) ...)
+                               languages))
+                            (match alist2
+                              (((languages . _) ...)
+                               languages))))))
+    (map (lambda (language)
+           (cons language
+                 (append (or (assoc-ref alist1 language) '())
+                         (or (assoc-ref alist2 language) '()))))
+         languages)))
+

 (let* ((root (canonicalize-path
              (string-append (current-source-directory) "/..")))
-       (commit date (latest-commit+date root)))
+       (commit date (latest-commit+date root))
+       (version (or (getenv "GUIX_MANUAL_VERSION")
+                    (string-take commit 7)))
+       (select? (let ((vcs? (git-predicate root)))
+                  (lambda (file stat)
+                    (and (vcs? file stat)
+                         ;; Filter out this file.
+                         (not (string=? (basename file) "build.scm"))))))
+       (source (local-file root "guix" #:recursive? #t
+                           #:select? select?)))
+
+  (define guix-manual
+    (html-manual source
+                 #:manual "guix"
+                 #:version version
+                 #:date date))
+
+  (define guix-mono-node-indexes
+    ;; Alist of indexes for GUIX-MANUAL, where each key is a language code and
+    ;; each value is a file-like object containing the identifier index.
+    (html-identifier-indexes guix-manual ""
+                             #:manual-name "guix"
+                             #:base-url (if (string=? %manual "guix")
+                                            (const "")
+                                            (cut string-append
+                                              "/manual/devel/" <>))
+                             #:languages %languages))
+
+  (define guix-split-node-indexes
+    ;; Likewise for the split-node variant of GUIX-MANUAL.
+    (html-identifier-indexes guix-manual "/html_node"
+                             #:manual-name "guix"
+                             #:base-url (if (string=? %manual "guix")
+                                            (const "")
+                                            (cut string-append
+                                              "/manual/devel/" <>
+                                              "/html_node"))
+                             #:languages %languages))
+
+  (define mono-node-indexes
+    (merge-index-alists guix-mono-node-indexes guile-mono-node-indexes))
+
+  (define split-node-indexes
+    (merge-index-alists guix-split-node-indexes guile-split-node-indexes))
+
  (format (current-error-port)
          "building manual from work tree around commit ~a, ~a~%"
          commit
          (let* ((time (make-time time-utc 0 date))
                 (date (time-utc->date time)))
            (date->string date "~e ~B ~Y")))
-  (pdf+html-manual (local-file root "guix" #:recursive? #t
-                               #:select? (git-predicate root))
-                   #:version (or (getenv "GUIX_MANUAL_VERSION")
-                                 (string-take commit 7))
+
+  (pdf+html-manual source
+                   ;; Always use the identifier indexes of GUIX-MANUAL and
+                   ;; GUILE-MANUAL.  Both "guix" and "guix-cookbook" can
+                   ;; contain links to definitions that appear in either of
+                   ;; these two manuals.
+                   #:mono-node-indexes mono-node-indexes
+                   #:split-node-indexes split-node-indexes
+                   #:version version
                   #:date date))
@@ -28,6 +28,7 @@ choice.
 * Submitting Patches::          Share your work.
 * Tracking Bugs and Patches::   Using Debbugs.
 * Commit Access::               Pushing to the official repository.
+* Updating the Guix Package::   Updating the Guix package definition.
@end menu

@node Building from Git
@@ -121,8 +122,9 @@ more information.
 Then, run @command{./configure} as usual.  Make sure to pass
@code{--localstatedir=@var{directory}} where @var{directory} is the
@code{localstatedir} value used by your current installation (@pxref{The
-Store}, for information about this).  We recommend to use the value
-@code{/var}.
+Store}, for information about this), usually @file{/var}.  Note that you
+will probably not run @command{make install} at the end (you don't have
+to) but it's still important to pass the right @code{localstatedir}.

 Finally, you have to invoke @code{make check} to run tests
 (@pxref{Running the Test Suite}).  If anything
@@ -138,6 +140,16 @@ make authenticate

 The first run takes a couple of minutes, but subsequent runs are faster.

+Or, when your configuration for your local Git repository doesn't match
+the default one, you can provide the reference for the @code{keyring}
+branch through the variable @code{GUIX_GIT_KEYRING}.  The following
+example assumes that you have a Git remote called @samp{myremote}
+pointing to the official repository:
+
+@example
+make authenticate GUIX_GIT_KEYRING=myremote/keyring
+@end example
+
@quotation Note
 You are advised to run @command{make authenticate} after every
@command{git pull} invocation.  This ensures you keep receiving valid
@@ -159,13 +171,11 @@ with all the dependencies available (@pxref{Building from Git}), and then
 simply prefix each command with
@command{./pre-inst-env} (the @file{pre-inst-env} script lives in the
 top build tree of Guix; it is generated by @command{./configure}).
-An example@footnote{The @option{-E} flag to
-@command{sudo} guarantees that @code{GUILE_LOAD_PATH} is correctly set
-such that @command{guix-daemon} and the tools it uses can find the Guile
-modules they need.}:
+As an example, here is how you would build the @code{hello} package as
+defined in your working tree (this assumes @command{guix-daemon} is
+already running on your system; it's OK if it's a different version):

@example
-$ sudo -E ./pre-inst-env guix-daemon --build-users-group=guixbuild
 $ ./pre-inst-env guix build hello
@end example

@@ -200,6 +210,17 @@ scheme@@(guile-user)> (length snakes)
 $1 = 361
@end example

+If you are hacking on the daemon and its supporting code or if
+@command{guix-daemon} is not already running on your system, you can
+launch it straight from the build tree@footnote{The @option{-E} flag to
+@command{sudo} guarantees that @code{GUILE_LOAD_PATH} is correctly set
+such that @command{guix-daemon} and the tools it uses can find the Guile
+modules they need.}:
+
+@example
+$ sudo -E ./pre-inst-env guix-daemon --build-users-group=guixbuild
+@end example
+
 The @command{pre-inst-env} script sets up all the environment variables
 necessary to support this, including @env{PATH} and @env{GUILE_LOAD_PATH}.

@@ -353,7 +374,7 @@ Once your package builds correctly, please send us a patch
 (@pxref{Submitting Patches}).  Well, if you need help, we will be happy to
 help you too.  Once the patch is committed in the Guix repository, the
 new package automatically gets built on the supported platforms by
-@url{@value{SUBSTITUTE-SERVER}, our continuous integration system}.
+@url{@value{SUBSTITUTE-URL}, our continuous integration system}.

@cindex substituter
 Users can obtain the new package definition simply by running
@@ -369,6 +390,8 @@ needed is to review and apply the patch.
 * Package Naming::              What's in a name?
 * Version Numbers::             When the name is not enough.
 * Synopses and Descriptions::   Helping users find the right package.
+* Snippets versus Phases::      Whether to use a snippet, or a build phase.
+* Emacs Packages::              Your Elisp fix.
 * Python Modules::              A touch of British comedy.
 * Perl Modules::                Little pearls.
 * Java Packages::               Coffee break.
@@ -593,12 +616,66 @@ to make recommendations or instructions visible to them by inserting
 special comments like this (@pxref{xgettext Invocation,,, gettext, GNU
 Gettext}):

-@example
+@lisp
 ;; TRANSLATORS: "X11 resize-and-rotate" should not be translated.
 (description "ARandR is designed to provide a simple visual front end
 for the X11 resize-and-rotate (RandR) extension. @dots{}")
-@end example
+@end lisp

+@node Snippets versus Phases
+@subsection Snippets versus Phases
+
+@cindex snippets, when to use
+The boundary between using an origin snippet versus a build phase to
+modify the sources of a package can be elusive.  Origin snippets are
+typically used to remove unwanted files such as bundled libraries,
+nonfree sources, or to apply simple substitutions.  The source derived
+from an origin should produce a source that can be used to build the
+package on any system that the upstream package supports (i.e., act as
+the corresponding source).  In particular, origin snippets must not
+embed store items in the sources; such patching should rather be done
+using build phases.  Refer to the @code{origin} record documentation for
+more information (@pxref{origin Reference}).
+
+@node Emacs Packages
+@subsection Emacs Packages
+
+@cindex emacs, packaging
+@cindex elisp, packaging
+Emacs packages should preferably use the Emacs build system
+(@pxref{emacs-build-system}), for uniformity and the benefits provided
+by its build phases, such as the auto-generation of the autoloads file
+and the byte compilation of the sources.  Because there is no
+standardized way to run a test suite for Emacs packages, tests are
+disabled by default.  When a test suite is available, it should be
+enabled by setting the @code{#:tests?} argument to @code{#true}.  By
+default, the command to run the test is @command{make check}, but any
+command can be specified via the @code{#:test-command} argument.  The
+@code{#:test-command} argument expects a list containing a command and
+its arguments, to be invoked during the @code{check} phase.
+
+The Elisp dependencies of Emacs packages are typically provided as
+@code{propagated-inputs} when required at run time.  As for other
+packages, build or test dependencies should be specified as
+@code{native-inputs}.
+
+Emacs packages sometimes depend on resources directories that should be
+installed along the Elisp files.  The @code{#:include} argument can be
+used for that purpose, by specifying a list of regexps to match.  The
+best practice when using the @code{#:include} argument is to extend
+rather than override its default value (accessible via the
+@code{%default-include} variable).  As an example, a yasnippet extension
+package typically include a @file{snippets} directory, which could be
+copied to the installation directory using:
+
+@lisp
+#:include (cons "^snippets/" %default-include))
+@end lisp
+
+When encountering problems, it is wise to check for the presence of the
+@code{Package-Requires} extension header in the package main source
+file, and whether any dependencies and their versions listed therein are
+satisfied.

@node Python Modules
@subsection Python Modules
@@ -828,7 +905,8 @@ to proper type error reports.
 Guix code should define appropriate data types (for instance, using
@code{define-record-type*}) rather than abuse lists.  In addition, it
 should use pattern matching, via Guile’s @code{(ice-9 match)} module,
-especially when matching lists.
+especially when matching lists (@pxref{Pattern Matching,,, guile, GNU
+Guile Reference Manual}).

@node Formatting Code
@subsection Formatting Code
@@ -972,7 +1050,7 @@ to other packages unwillingly retained.  It may also help determine
 whether to split the package (@pxref{Packages with Multiple Outputs}),
 and which optional dependencies should be used.  In particular, avoid adding
@code{texlive} as a dependency: because of its extreme size, use
-@code{texlive-tiny} or @code{texlive-union} instead.
+the @code{texlive-tiny} package or @code{texlive-union} procedure instead.

@item
 For important changes, check that dependent package (if applicable) are
@@ -1001,7 +1079,7 @@ changes).  This branch is intended to be merged in @code{master} every
 6 months or so.
@end table

-All these branches are @uref{@value{SUBSTITUTE-SERVER},
+All these branches are @uref{@value{SUBSTITUTE-URL},
 tracked by our build farm} and merged into @code{master} once
 everything has been successfully built.  This allows us to fix issues
 before they hit users, and to reduce the window during which pre-built
@@ -1298,3 +1376,40 @@ only push their own awesome changes, but also offer some of their time
@emph{reviewing} and pushing other people's changes.  As a committer,
 you're welcome to use your expertise and commit rights to help other
 contributors, too!
+
+@node Updating the Guix Package
+@section Updating the Guix Package
+
+@cindex update-guix-package, updating the guix package
+It is sometimes desirable to update the @code{guix} package itself (the
+package defined in @code{(gnu packages package-management)}), for
+example to make new daemon features available for use by the
+@code{guix-service-type} service type.  In order to simplify this task,
+the following command can be used:
+
+@example
+make update-guix-package
+@end example
+
+The @code{update-guix-package} make target will use the last known
+@emph{commit} corresponding to @code{HEAD} in your Guix checkout,
+compute the hash of the Guix sources corresponding to that commit and
+update the @code{commit}, @code{revision} and hash of the @code{guix}
+package definition.
+
+To validate that the updated @code{guix} package hashes are correct and
+that it can be built successfully, the following command can be run from
+the directory of your Guix checkout:
+
+@example
+./pre-inst-env guix build guix
+@end example
+
+To guard against accidentally updating the @code{guix} package to a
+commit that others can't refer to, a check is made that the commit used
+has already been pushed to the Savannah-hosted Guix git repository.
+
+This check can be disabled, @emph{at your own peril}, by setting the
+@code{GUIX_ALLOW_ME_TO_USE_PRIVATE_COMMIT} environment variable.  When
+this variable is set, the updated package source is also added to the
+store.  This is used as part of the release process of Guix.
@@ -16,6 +16,7 @@ Copyright @copyright{} 2020 Matthew Brooks@*
 Copyright @copyright{} 2020 Marcin Karpezo@*
 Copyright @copyright{} 2020 Brice Waegeneire@*
 Copyright @copyright{} 2020 André Batista@*
+Copyright @copyright{} 2020 Christopher Lemmer Webber

 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@@ -127,8 +128,9 @@ REPL.
@item
 Scheme syntax boils down to a tree of expressions (or @emph{s-expression} in
 Lisp lingo).  An expression can be a literal such as numbers and strings, or a
-compound which is a parenthesized list of compounds and literals.  @code{#t}
-and @code{#f} stand for the Booleans ``true'' and ``false'', respectively.
+compound which is a parenthesized list of compounds and literals.  @code{#true}
+and @code{#false} (abbreviated @code{#t} and @code{#f}) stand for the
+Booleans ``true'' and ``false'', respectively.

 Examples of valid expressions:

@@ -248,8 +250,10 @@ definitions.
@end lisp

@item
-The keyword syntax is @code{#:}; it is used to create unique identifiers.
-@pxref{Keywords,,, guile, GNU Guile Reference Manual}.
+@dfn{Keywords} are typically used to identify the named parameters of a
+procedure.  They are prefixed by @code{#:} (hash, colon) followed by
+alphanumeric characters: @code{#:like-this}.
+@xref{Keywords,,, guile, GNU Guile Reference Manual}.

@item
 The percentage @code{%} is typically used for read-only global variables in
@@ -790,11 +794,11 @@ another, more sophisticated package (slightly modified from the source):
                (snippet '(begin
                            ;; Remove bundled software.
                            (delete-file-recursively "deps")
-                            #t))))
+                            #true))))
      (build-system cmake-build-system)
      (outputs '("out" "debug"))
      (arguments
-       `(#:tests? #t                            ; Run the test suite (this is the default)
+       `(#:tests? #true                         ; Run the test suite (this is the default)
         #:configure-flags '("-DUSE_SHA1DC=ON") ; SHA-1 collision detection
         #:phases
         (modify-phases %standard-phases
@@ -805,12 +809,12 @@ another, more sophisticated package (slightly modified from the source):
               (substitute* "tests/clar/fs.h"
                 (("/bin/cp") (which "cp"))
                 (("/bin/rm") (which "rm")))
-               #t))
+               #true))
           ;; Run checks more verbosely.
           (replace 'check
             (lambda _ (invoke "./libgit2_clar" "-v" "-Q")))
           (add-after 'unpack 'make-files-writable-for-tests
-               (lambda _ (for-each make-file-writable (find-files "." ".*")))))))
+             (lambda _ (for-each make-file-writable (find-files "." ".*")))))))
      (inputs
       `(("libssh2" ,libssh2)
         ("http-parser" ,http-parser)
@@ -1028,7 +1032,7 @@ If you want to know more about what happens during those phases, consult the
 associated procedures.

 For instance, as of this writing the definition of @code{unpack} for the GNU build
-system is
+system is:

@lisp
 (define* (unpack #:key source #:allow-other-keys)
@@ -1043,13 +1047,13 @@ working directory."
        ;; Preserve timestamps (set to the Epoch) on the copied tree so that
        ;; things work deterministically.
        (copy-recursively source "."
-                          #:keep-mtime? #t))
+                          #:keep-mtime? #true))
      (begin
        (if (string-suffix? ".zip" source)
            (invoke "unzip" source)
            (invoke "tar" "xvf" source))
        (chdir (first-subdirectory "."))))
-  #t)
+  #true)
@end lisp

 Note the @code{chdir} call: it changes the working directory to where the source was
@@ -1065,16 +1069,16 @@ the following forms:

@itemize
@item
-@code{(add-before PHASE NEW-PHASE PROCEDURE)}: Run @code{PROCEDURE} named @code{NEW-PHASE} before @code{PHASE}.
+@code{(add-before @var{phase} @var{new-phase} @var{procedure})}: Run @var{procedure} named @var{new-phase} before @var{phase}.
@item
-@code{(add-after PHASE NEW-PHASE PROCEDURE)}: Same, but afterwards.
+@code{(add-after @var{phase} @var{new-phase} @var{procedure})}: Same, but afterwards.
@item
-@code{(replace PHASE PROCEDURE)}.
+@code{(replace @var{phase} @var{procedure})}.
@item
-@code{(delete PHASE)}.
+@code{(delete @var{phase})}.
@end itemize

-The @code{PROCEDURE} supports the keyword arguments @code{inputs} and @code{outputs}.  Each
+The @var{procedure} supports the keyword arguments @code{inputs} and @code{outputs}.  Each
 input (whether @emph{native}, @emph{propagated} or not) and output directory is referenced
 by their name in those variables.  Thus @code{(assoc-ref outputs "out")} is the store
 directory of the main output of the package.  A phase procedure may look like
@@ -1082,16 +1086,16 @@ this:

@lisp
 (lambda* (#:key inputs outputs #:allow-other-keys)
-  (let (((bash-directory (assoc-ref inputs "bash"))
-         (output-directory (assoc-ref outputs "out"))
-         (doc-directory (assoc-ref outputs "doc"))
-  ; ...
-  #t)
+  (let ((bash-directory (assoc-ref inputs "bash"))
+        (output-directory (assoc-ref outputs "out"))
+        (doc-directory (assoc-ref outputs "doc")))
+    ;; ...
+    #true))
@end lisp

-The procedure must return @code{#t} on success.  It's brittle to rely on the return
+The procedure must return @code{#true} on success.  It's brittle to rely on the return
 value of the last expression used to tweak the phase because there is no
-guarantee it would be a @code{#t}.  Hence the trailing @code{#t} to ensure the right value
+guarantee it would be a @code{#true}.  Hence the trailing @code{#true} to ensure the right value
 is returned on success.

@subsubsection Code staging
@@ -1117,7 +1121,7 @@ Some of those functions can be found in
@samp{$GUIX_CHECKOUT/guix/guix/build/utils.scm}.  Most of them mirror the behaviour
 of the traditional Unix system commands:

-@table @asis
+@table @code
@item which
 Like the @samp{which} system command.
@item find-files
@@ -1141,6 +1145,9 @@ then restore the previous working directory.
 A ``@command{sed}-like'' function.
@end table

+@xref{Build Utilities,,, guix, GNU Guix Reference Manual}, for more
+information on these utilities.
+
@subsubsection Module prefix

 The license in our last example needs a prefix: this is because of how the
@@ -1348,8 +1355,10 @@ reference.
 * Customizing the Kernel::       Creating and using a custom Linux kernel on Guix System.
 * Connecting to Wireguard VPN::  Connecting to a Wireguard VPN.
 * Customizing a Window Manager:: Handle customization of a Window manager on Guix System.
+* Running Guix on a Linode Server:: Running Guix on a Linode Server
 * Setting up a bind mount:: Setting up a bind mount in the file-systems definition.
 * Getting substitutes from Tor:: Configuring Guix daemon to get substitutes through Tor.
+* Setting up NGINX with Lua:: Configuring NGINX web-server to load Lua modules.
@end menu

@node Customizing the Kernel
@@ -1382,8 +1391,8 @@ creates a package.
                           #:key
                           ;; A function that takes an arch and a variant.
                           ;; See kernel-config for an example.
-                           (extra-version #f)
-                           (configuration-file #f)
+                           (extra-version #false)
+                           (configuration-file #false)
                           (defconfig "defconfig")
                           (extra-options %default-extra-linux-options)
                           (patches (list %boot-logo-patch)))
@@ -1426,7 +1435,7 @@ the @code{make-linux-libre} package definition:
      (begin
        (copy-file config ".config")
        (chmod ".config" #o666))
-      (invoke "make" ,defconfig))
+      (invoke "make" ,defconfig)))
@end lisp

 Below is a sample kernel package.  The @code{linux-libre} package is nothing
@@ -1457,7 +1466,7 @@ it:
@lisp
 (define %default-extra-linux-options
  `(;; https://lists.gnu.org/archive/html/guix-devel/2014-04/msg00039.html
-   ("CONFIG_DEVPTS_MULTIPLE_INSTANCES" . #t)
+   ("CONFIG_DEVPTS_MULTIPLE_INSTANCES" . #true)
   ;; Modules required for initrd:
   ("CONFIG_NET_9P" . m)
   ("CONFIG_NET_9P_VIRTIO" . m)
@@ -1474,9 +1483,9 @@ it:
  (string-join (map (match-lambda
                      ((option . 'm)
                       (string-append option "=m"))
-                      ((option . #t)
+                      ((option . #true)
                       (string-append option "=y"))
-                      ((option . #f)
+                      ((option . #false)
                       (string-append option "=n")))
                    options)
               "\n"))
@@ -1492,7 +1501,7 @@ And in the custom configure script from the `make-linux-libre` package:
  (display extra-configuration port)
  (close-port port))

-(invoke "make" "oldconfig"))))
+(invoke "make" "oldconfig")
@end lisp

 So by not providing a configuration-file the @file{.config} starts blank, and
@@ -1760,6 +1769,246 @@ your screen but not suspend it, it's a good idea to notify xss-lock about this s
 confusion occurs. This can be done by executing @code{xset s activate} immediately
 before you execute slock.

+@node Running Guix on a Linode Server
+@section Running Guix on a Linode Server
+@cindex linode, Linode
+
+To run Guix on a server hosted by @uref{https://www.linode.com, Linode},
+start with a recommended Debian server.  We recommend using the default
+distro as a way to bootstrap Guix. Create your SSH keys.
+
+@example
+ssh-keygen
+@end example
+
+Be sure to add your SSH key for easy login to the remote server.
+This is trivially done via Linode's graphical interface for adding
+SSH keys.  Go to your profile and click add SSH Key.
+Copy into it the output of:
+
+@example
+cat ~/.ssh/<username>_rsa.pub
+@end example
+
+Power the Linode down. In the Linode's Disks/Configurations tab, resize
+the Debian disk to be smaller. 30 GB is recommended.
+
+In the Linode settings, "Add a disk", with the following:
+@itemize @bullet
+@item
+Label: "Guix"
+
+@item
+Filesystem: ext4
+
+@item
+Set it to the remaining size
+@end itemize
+
+On the "configuration" field that comes with the default image, press
+"..." and select "Edit", then on that menu add to @file{/dev/sdc} the "Guix"
+label.
+
+Now "Add a Configuration", with the following:
+@itemize @bullet
+@item
+Label: Guix
+
+@item
+Kernel:GRUB 2 (it's at the bottom!  This step is @b{IMPORTANT!})
+
+@item
+Block device assignment:
+
+@item
+@file{/dev/sda}: Guix
+
+@item
+@file{/dev/sdb}: swap
+
+@item
+Root device: @file{/dev/sda}
+
+@item
+Turn off all the filesystem/boot helpers
+@end itemize
+
+Now power it back up, picking the Debian configuration.  Once it's
+booted up, ssh in your server via @code{ssh
+root@@@var{<your-server-IP-here>}}. (You can find your server IP address in
+your Linode Summary section.) Now you can run the "install guix from
+@pxref{Binary Installation,,, guix, GNU Guix}" steps:
+
+@example
+sudo apt-get install gpg
+wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | gpg --import -
+wget https://git.savannah.gnu.org/cgit/guix.git/plain/etc/guix-install.sh
+chmod +x guix-install.sh
+./guix-install.sh
+guix pull
+@end example
+
+Now it's time to write out a config for the server.  The key information
+is below. Save the resulting file as @file{guix-config.scm}.
+
+@lisp
+(use-modules (gnu)
+             (guix modules))
+(use-service-modules networking
+                     ssh)
+(use-package-modules admin
+                     certs
+                     package-management
+                     ssh
+                     tls)
+
+(operating-system
+  (host-name "my-server")
+  (timezone "America/New_York")
+  (locale "en_US.UTF-8")
+  ;; This goofy code will generate the grub.cfg
+  ;; without installing the grub bootloader on disk.
+  (bootloader (bootloader-configuration
+               (bootloader
+                (bootloader
+                 (inherit grub-bootloader)
+                 (installer #~(const #true))))))
+  (file-systems (cons (file-system
+                        (device "/dev/sda")
+                        (mount-point "/")
+                        (type "ext4"))
+                      %base-file-systems))
+
+
+  (swap-devices (list "/dev/sdb"))
+
+
+  (initrd-modules (cons "virtio_scsi"    ; Needed to find the disk
+                        %base-initrd-modules))
+
+  (users (cons (user-account
+                (name "janedoe")
+                (group "users")
+                ;; Adding the account to the "wheel" group
+                ;; makes it a sudoer.
+                (supplementary-groups '("wheel"))
+                (home-directory "/home/janedoe"))
+               %base-user-accounts))
+
+  (packages (cons* nss-certs            ;for HTTPS access
+                   openssh-sans-x
+                   %base-packages))
+
+  (services (cons*
+             (service dhcp-client-service-type)
+             (service openssh-service-type
+                      (openssh-configuration
+                       (openssh openssh-sans-x)
+                       (password-authentication? #false)
+                       (authorized-keys
+                        `(("janedoe" ,(local-file "janedoe_rsa.pub"))
+                          ("root" ,(local-file "janedoe_rsa.pub"))))))
+             %base-services)))
+@end lisp
+
+Replace the following fields in the above configuration:
+@lisp
+(host-name "my-server")       ; replace with your server name
+; if you chose a linode server outside the U.S., then
+; use tzselect to find a correct timezone string
+(timezone "America/New_York") ; if needed replace timezone
+(name "janedoe")              ; replace with your username
+("janedoe" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key
+("root" ,(local-file "janedoe_rsa.pub")) ; replace with your ssh key
+@end lisp
+
+The last line in the above example lets you log into the server as root
+and set the initial root password.  After you have done this, you may
+delete that line from your configuration and reconfigure to prevent root
+login.
+
+Save your ssh public key (eg: @file{~/.ssh/id_rsa.pub}) as
+@file{@var{<your-username-here>}_rsa.pub} and your
+@file{guix-config.scm} in the same directory.  In a new terminal run
+these commands.
+
+@example
+sftp root@@<remote server ip address>
+put /home/<username>/ssh/id_rsa.pub .
+put /path/to/linode/guix-config.scm .
+@end example
+
+In your first terminal, mount the guix drive:
+
+@example
+mkdir /mnt/guix
+mount /dev/sdc /mnt/guix
+@end example
+
+Due to the way we set things up above, we do not install GRUB
+completely.  Instead we install only our grub configuration file.  So we
+need to copy over some of the other GRUB stuff that is already there:
+
+@example
+mkdir -p /mnt/guix/boot/grub
+cp -r /boot/grub/* /mnt/guix/boot/grub/
+@end example
+
+Now initialize the Guix installation:
+
+@example
+guix system init guix-config.scm /mnt/guix
+@end example
+
+Ok, power it down!
+Now from the Linode console, select boot and select "Guix".
+
+Once it boots, you should be able to log in via SSH!  (The server config
+will have changed though.)  You may encounter an error like:
+
+@example
+$ ssh root@@<server ip address>
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
+@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
+IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
+Someone could be eavesdropping on you right now (man-in-the-middle attack)!
+It is also possible that a host key has just been changed.
+The fingerprint for the ECDSA key sent by the remote host is
+SHA256:0B+wp33w57AnKQuHCvQP0+ZdKaqYrI/kyU7CfVbS7R4.
+Please contact your system administrator.
+Add correct host key in /home/joshua/.ssh/known_hosts to get rid of this message.
+Offending ECDSA key in /home/joshua/.ssh/known_hosts:3
+ECDSA host key for 198.58.98.76 has changed and you have requested strict checking.
+Host key verification failed.
+@end example
+
+Either delete @file{~/.ssh/known_hosts} file, or delete the offending line
+starting with your server IP address.
+
+Be sure to set your password and root's password.
+
+@example
+ssh root@@<remote ip address>
+passwd  ; for the root password
+passwd <username> ; for the user password
+@end example
+
+You may not be able to run the above commands at this point.  If you
+have issues remotely logging into your linode box via SSH, then you may
+still need to set your root and user password initially by clicking on
+the ``Launch Console'' option in your linode.  Choose the ``Glish''
+instead of ``Weblish''.  Now you should be able to ssh into the machine.
+
+Horray!  At this point you can shut down the server, delete the
+Debian disk, and resize the Guix to the rest of the size.
+Congratulations!
+
+By the way, if you save it as a disk image right at this point, you'll
+have an easy time spinning up new Guix images!  You may need to
+down-size the Guix image to 6144MB, to save it as an image.  Then you
+can resize it again to the max size.
+
@node Setting up a bind mount
@section Setting up a bind mount

@@ -1871,6 +2120,63 @@ sudo herd set-http-proxy guix-daemon http://localhost:9250
 guix build --substitute-urls=https://bp7o7ckwlewr4slm.onion …
@end example

+@node Setting up NGINX with Lua
+@section Setting up NGINX with Lua
+@cindex nginx, lua, openresty, resty
+
+NGINX could be extended with Lua scripts.
+
+Guix provides NGINX service with ability to load Lua module and specific
+Lua packages, and reply to requests by evaluating Lua scripts.
+
+The following example demonstrates system definition with configuration
+to evaluate @file{index.lua} Lua script on HTTP request to
+@uref{http://localhost/hello} endpoint:
+
+@example
+local shell = require "resty.shell"
+
+local stdin = ""
+local timeout = 1000  -- ms
+local max_size = 4096  -- byte
+
+local ok, stdout, stderr, reason, status =
+   shell.run([[/run/current-system/profile/bin/ls /tmp]], stdin, timeout, max_size)
+
+ngx.say(stdout)
+@end example
+
+@lisp
+(use-modules (gnu))
+(use-service-modules #;… web)
+(use-package-modules #;… lua)
+(operating-system
+  ;; …
+  (services
+   ;; …
+   (service nginx-service-type
+            (nginx-configuration
+             (modules
+              (list
+               (file-append nginx-lua-module "/etc/nginx/modules/ngx_http_lua_module.so")))
+             (lua-package-path (list lua-resty-core
+                                     lua-resty-lrucache
+                                     lua-resty-signal
+                                     lua-tablepool
+                                     lua-resty-shell))
+             (lua-package-cpath (list lua-resty-signal))
+             (server-blocks
+              (list (nginx-server-configuration
+                     (server-name '("localhost"))
+                     (listen '("80"))
+                     (root "/etc")
+                     (locations (list
+                                 (nginx-location-configuration
+                                  (uri "/hello")
+                                  (body (list #~(format #f "content_by_lua_file ~s;"
+                                                        #$(local-file "index.lua"))))))))))))))
+@end lisp
+
@c *********************************************************************
@node Advanced package management
@chapter Advanced package management
@@ -1939,7 +2245,7 @@ section on @ref{Reproducible profiles}.

@item
 Easier upgrades and maintenance: Multiple profiles make it easy to keep
-package listings at hand and make upgrades completely friction-less.
+package listings at hand and make upgrades completely frictionless.
@end itemize

 Concretely, here follows some typical profiles:
@@ -96,14 +96,16 @@ define xref_command
 cat "$@.tmp" | egrep '@p?x?ref' -A1 | sed 'N;s|--\n||g;P;D' | sed 's|^| |g' | \
        tr -d '\012' | sed 's|\(@p\?x\?ref\)|\n\1|g' | egrep '@p?x?ref' | \
        sed 's|^.*@p\?x\?ref{\([^,}]*\).*$$|\1|g' | sort | uniq | while read e; do \
-  line=$$(grep -n "^msgid \"$$e\"" "$<" | cut -f1 --delimiter=":") ;\
-  ((line++)) ;\
-  if [ "$$line" != "1" ]; then \
-    translation=$$(head -n $$line "$<" | tail -1 | grep msgstr | sed 's|msgstr "\(.*\)"|\1|') ;\
-    if [ "$$translation" != "" ]; then \
-	  sed "N;s@\(p\?x\?ref\){$$(echo $$e | sed 's| |[\\n ]|g')\(,\|}\)@\1{$$translation\2@g;P;D" -i "$@.tmp" ;\
-    fi ;\
-  fi ;\
+    if [ -n "$$e" ]; then \
+      line=$$(grep -n "^msgid \"$$e\"" "$<" | cut -f1 --delimiter=":") ;\
+      ((line++)) ;\
+      if [ "$$line" != "1" ]; then \
+	translation=$$(head -n "$$line" "$<" | tail -1 | grep msgstr | sed 's|msgstr "\(.*\)"|\1|') ;\
+	if [ "$$translation" != "" ]; then \
+	      sed "N;s@\(p\?x\?ref\){$$(echo $$e | sed 's| |[\\n ]|g')\(,\|}\)@\1{$$translation\2@g;P;D" -i "$@.tmp" ;\
+	fi ;\
+      fi ;\
+   fi ;\
 done
 endef

@@ -175,8 +175,8 @@ corresponding to the top-level definition containing the staged changes."
              (let ((old-values (get-values old field))
                    (new-values (get-values new field)))
                (or (equal? old-values new-values)
-                    (let ((removed (lset-difference eq? old-values new-values))
-                          (added (lset-difference eq? new-values old-values)))
+                    (let ((removed (lset-difference equal? old-values new-values))
+                          (added (lset-difference equal? new-values old-values)))
                      (format port
                              "[~a]: ~a~%" field
                              (match (list (map symbol->string removed)
@@ -19,6 +19,20 @@
 # Bash completion for Guix commands.

 declare _guix_available_packages
+declare _guix_commands
+
+_guix_complete_command ()
+{
+    local word_at_point="${COMP_WORDS[$COMP_CWORD]}"
+    if [ -z "$_guix_commands" ]
+    then
+	# Cache the list of commands to speed things up.
+	_guix_commands="$(guix --help 2> /dev/null  \
+                                     | grep '^    ' \
+				     | sed '-es/^ *\([a-z-]\+\).*$/\1/g')"
+    fi
+    COMPREPLY=($(compgen -W "$_guix_commands" -- "$word_at_point"))
+}

 _guix_complete_subcommand ()
 {
@@ -97,6 +111,24 @@ _guix_is_removing ()
    $result
 }

+_guix_is_dash_f ()
+{
+    [ "${COMP_WORDS[$COMP_CWORD - 1]}" = "-f" ] \
+	|| { case "${COMP_WORDS[$COMP_CWORD]}" in
+		 --file=*|--install-from-file=*) true;;
+		 *)                              false;;
+	     esac }
+}
+
+_guix_is_dash_l ()
+{
+    [ "${COMP_WORDS[$COMP_CWORD - 1]}" = "-l" ] \
+	|| { case "${COMP_WORDS[$COMP_CWORD]}" in
+		 --load=*) true;;
+		 *)        false;;
+	     esac }
+}
+
 _guix_is_dash_L ()
 {
    [ "${COMP_WORDS[$COMP_CWORD - 1]}" = "-L" ] \
@@ -146,19 +178,6 @@ _guix_complete_pid ()
    COMPREPLY=($(compgen -W "$pids" -- "$1"))
 }

-declare _guix_subcommands
-
-_guix_complete_subcommand ()
-{
-    if [ -z "$_guix_subcommands" ]
-    then
-	# Cache the list of subcommands to speed things up.
-	_guix_subcommands="$(guix --help 2> /dev/null \
-                                     | grep '^  ' | cut -c 2-)"
-    fi
-    COMPREPLY=($(compgen -W "$_guix_subcommands" -- "$word_at_point"))
-}
-
 _guix_complete ()
 {
    local word_count=${#COMP_WORDS[*]}
@@ -176,12 +195,12 @@ _guix_complete ()

    case $COMP_CWORD in
 	1)
-	    _guix_complete_subcommand
+	    _guix_complete_command
 	    ;;
 	*)
 	    if _guix_is_command "package"
 	    then
-		if _guix_is_dash_L || _guix_is_dash_m
+		if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_p || _guix_is_dash_f
 		then
 		    _guix_complete_file
 		elif _guix_is_removing
@@ -216,7 +235,7 @@ _guix_complete ()
 		fi
            elif _guix_is_command "build"
            then
-                if _guix_is_dash_L || _guix_is_dash_m
+                if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_f
                then
                    _guix_complete_file
 		else
@@ -224,7 +243,7 @@ _guix_complete ()
                fi
 	    elif _guix_is_command "environment"
 	    then
-                if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_p
+                if _guix_is_dash_L || _guix_is_dash_m || _guix_is_dash_p || _guix_is_dash_l
                then
                    _guix_complete_file
 		else
@@ -251,7 +270,7 @@ _guix_complete ()
                then
                    _guix_complete_file
 		else
-		    _guix_complete_subcommand
+		    _guix_complete_command
                fi
 	    elif _guix_is_command "container"
 	    then
@@ -20,13 +20,26 @@
 #
 #   <local ref> <local sha1> <remote ref> <remote sha1>

-# Only use the hook when pushing to Savannah.
-case "$2" in
-    *.gnu.org*)
-	exec make authenticate check-channel-news
-	exit 127
-	;;
-    *)
-	exit 0
-	;;
-esac
+# This is the "empty hash" used by Git when pushing a branch deletion.
+z40=0000000000000000000000000000000000000000
+
+while read local_ref local_hash remote_ref remote_hash
+do
+	# When deleting a remote branch, no commits are pushed to the remote, and
+	# thus there are no signatures to be verified.
+	if [ "$local_hash" != $z40 ]
+	then
+		# Only use the hook when pushing to Savannah.
+		case "$2" in
+		    *.gnu.org*)
+			exec make authenticate check-channel-news
+			exit 127
+			;;
+		    *)
+			exit 0
+			;;
+		esac
+	fi
+done
+
+exit 0
@@ -1,6 +1,8 @@
 ; -*- lisp -*-
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2020 Daniel Brooks <db48x@db48x.net>
+;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,6 +23,18 @@
 ;; Intermediate Language (CIL).  It refers to types that must be defined in
 ;; the system's base policy.

+;; If you, like me, need advice about fixing an SELinux policy, I recommend
+;; reading https://danwalsh.livejournal.com/55324.html
+
+;; In particular, you can run semanage permissive -a guix_daemon.guix_daemon_t
+;; to allow guix-daemon to do whatever it wants. SELinux will still check its
+;; permissions, and when it doesn't have permission it will still send an
+;; audit message to your system logs. This lets you know what permissions it
+;; ought to have. Use ausearch --raw to find the permissions violations, then
+;; pipe that to audit2allow to generate an updated policy. You'll still need
+;; to translate that policy into CIL in order to update this file, but that's
+;; fairly straight-forward. Annoying, but easy.
+
 (block guix_daemon
  ;; Require existing types
  (typeattributeset cil_gen_require init_t)
@@ -34,14 +48,19 @@
  (roletype object_r guix_daemon_t)
  (type guix_daemon_conf_t)
  (roletype object_r guix_daemon_conf_t)
+  (typeattributeset file_type guix_daemon_conf_t)
  (type guix_daemon_exec_t)
  (roletype object_r guix_daemon_exec_t)
+  (typeattributeset file_type guix_daemon_exec_t)
  (type guix_daemon_socket_t)
  (roletype object_r guix_daemon_socket_t)
+  (typeattributeset file_type guix_daemon_socket_t)
  (type guix_store_content_t)
  (roletype object_r guix_store_content_t)
+  (typeattributeset file_type guix_store_content_t)
  (type guix_profiles_t)
  (roletype object_r guix_profiles_t)
+  (typeattributeset file_type guix_profiles_t)

  ;; These types are domains, thereby allowing process rules
  (typeattributeset domain (guix_daemon_t guix_daemon_exec_t))
@@ -55,6 +74,30 @@
  (typetransition guix_store_content_t guix_daemon_exec_t
                  process guix_daemon_t)

+  (roletype system_r guix_daemon_t)
+
+  ;; allow init_t to read and execute guix files
+  (allow init_t
+         guix_profiles_t
+         (lnk_file (read)))
+  (allow init_t
+         guix_daemon_exec_t
+         (file (execute)))
+  (allow init_t
+         guix_daemon_t
+         (process (transition)))
+  (allow init_t
+         guix_store_content_t
+         (lnk_file (read)))
+  (allow init_t
+         guix_store_content_t
+         (file (open read execute)))
+
+  ;; guix-daemon needs to know the names of users
+  (allow guix_daemon_t
+         passwd_file_t
+         (file (getattr open read)))
+
  ;; Permit communication with NSCD
  (allow guix_daemon_t
         nscd_var_run_t
@@ -71,25 +114,46 @@
  (allow guix_daemon_t
         nscd_t
         (unix_stream_socket (connectto)))
+  (allow guix_daemon_t nscd_t
+         (nscd (getgrp gethost getpwd getserv shmemgrp shmemhost shmempwd shmemserv)))
+
+  ;; permit downloading packages via HTTP(s)
+  (allow guix_daemon_t http_port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t ftp_port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t ephemeral_port_t
+         (tcp_socket (name_connect)))

  ;; Permit logging and temp file access
  (allow guix_daemon_t
         tmp_t
-         (lnk_file (setattr unlink)))
+         (lnk_file (create rename setattr unlink)))
  (allow guix_daemon_t
         tmp_t
-         (dir (create
-               rmdir
+         (file (link
+                rename create execute execute_no_trans write
+                unlink setattr map relabelto relabelfrom)))
+  (allow guix_daemon_t
+         tmp_t
+         (fifo_file (open read write create getattr ioctl setattr unlink)))
+  (allow guix_daemon_t
+         tmp_t
+         (dir (create rename
+               rmdir relabelto relabelfrom reparent
               add_name remove_name
               open read write
               getattr setattr
               search)))
+  (allow guix_daemon_t
+         tmp_t
+         (sock_file (create getattr setattr unlink write)))
  (allow guix_daemon_t
         var_log_t
         (file (create getattr open write)))
  (allow guix_daemon_t
         var_log_t
-         (dir (getattr write add_name)))
+         (dir (getattr create write add_name)))
  (allow guix_daemon_t
         var_run_t
         (lnk_file (read)))
@@ -100,10 +164,12 @@
  ;; Spawning processes, execute helpers
  (allow guix_daemon_t
         self
-         (process (fork)))
+         (process (fork execmem setrlimit setpgid setsched)))
  (allow guix_daemon_t
         guix_daemon_exec_t
-         (file (execute execute_no_trans read open)))
+         (file (execute
+                execute_no_trans read write open entrypoint map
+                getattr link unlink)))

  ;; TODO: unknown
  (allow guix_daemon_t
@@ -119,38 +185,51 @@
  ;; Build isolation
  (allow guix_daemon_t
         guix_store_content_t
-         (file (mounton)))
+         (file (ioctl mounton)))
  (allow guix_store_content_t
         fs_t
         (filesystem (associate)))
  (allow guix_daemon_t
         guix_store_content_t
-         (dir (mounton)))
+         (dir (read mounton)))
  (allow guix_daemon_t
         guix_daemon_t
         (capability (net_admin
                      fsetid fowner
                      chown setuid setgid
                      dac_override dac_read_search
-                      sys_chroot)))
+                      sys_chroot
+                      sys_admin)))
  (allow guix_daemon_t
         fs_t
         (filesystem (unmount)))
+  (allow guix_daemon_t
+         devpts_t
+         (dir (search)))
  (allow guix_daemon_t
         devpts_t
         (filesystem (mount)))
  (allow guix_daemon_t
         devpts_t
-         (chr_file (setattr getattr)))
+         (chr_file (ioctl open read write setattr getattr)))
  (allow guix_daemon_t
         tmpfs_t
-         (filesystem (mount)))
+         (filesystem (getattr mount)))
  (allow guix_daemon_t
         tmpfs_t
-         (dir (getattr)))
+         (file (create open read unlink write)))
+  (allow guix_daemon_t
+         tmpfs_t
+         (dir (getattr add_name remove_name write)))
  (allow guix_daemon_t
         proc_t
-         (filesystem (mount)))
+         (file (getattr open read)))
+  (allow guix_daemon_t
+         proc_t
+         (dir (read)))
+  (allow guix_daemon_t
+         proc_t
+         (filesystem (associate mount)))
  (allow guix_daemon_t
         null_device_t
         (chr_file (getattr open read write)))
@@ -179,7 +258,7 @@
               search rename
               add_name remove_name
               open write
-               rmdir)))
+               rmdir relabelfrom)))
  (allow guix_daemon_t
         guix_store_content_t
         (file (create
@@ -189,7 +268,8 @@
                link unlink
                map
                rename
-                open read write)))
+                append
+                open read write relabelfrom)))
  (allow guix_daemon_t
         guix_store_content_t
         (lnk_file (create
@@ -197,17 +277,23 @@
                    link unlink
                    read
                    rename)))
+  (allow guix_daemon_t
+         guix_store_content_t
+         (fifo_file (create getattr open read unlink write)))
+  (allow guix_daemon_t
+         guix_store_content_t
+         (sock_file (create getattr setattr unlink write)))

  ;; Access to configuration files and directories
  (allow guix_daemon_t
         guix_daemon_conf_t
-         (dir (search
+         (dir (search create
               setattr getattr
               add_name remove_name
               open read write)))
  (allow guix_daemon_t
         guix_daemon_conf_t
-         (file (create
+         (file (create rename
                lock
                map
                getattr setattr
@@ -216,11 +302,17 @@
  (allow guix_daemon_t
         guix_daemon_conf_t
         (lnk_file (create getattr rename unlink)))
+  (allow guix_daemon_t net_conf_t
+         (file (getattr open read)))
+  (allow guix_daemon_t net_conf_t
+         (lnk_file (read)))
+  (allow guix_daemon_t NetworkManager_var_run_t
+         (dir (search)))

  ;; Access to profiles
  (allow guix_daemon_t
         guix_profiles_t
-         (dir (getattr setattr read open)))
+         (dir (search getattr setattr read write open create add_name)))
  (allow guix_daemon_t
         guix_profiles_t
         (lnk_file (read getattr)))
@@ -233,8 +325,22 @@
  (allow guix_daemon_t
         user_home_t
         (dir (search)))
+  (allow guix_daemon_t
+         cache_home_t
+         (dir (search)))
+
+  ;; self upgrades
+  (allow guix_daemon_t
+         self
+         (dir (add_name write)))
+  (allow guix_daemon_t
+         self
+         (netlink_route_socket (bind create getattr nlmsg_read read write getopt)))

  ;; Socket operations
+  (allow guix_daemon_t
+         guix_daemon_socket_t
+         (sock_file (unlink)))
  (allow guix_daemon_t
         init_t
         (fd (use)))
@@ -253,12 +359,75 @@
                              read write
                              connect bind accept
                              getopt setopt)))
+  (allow guix_daemon_t
+         self
+         (tcp_socket (accept listen bind connect create setopt getopt getattr ioctl read write shutdown)))
+  (allow guix_daemon_t
+         unreserved_port_t
+         (tcp_socket (name_bind name_connect accept listen)))
+  (allow guix_daemon_t
+         self
+         (udp_socket (connect getattr bind getopt setopt read write)))
  (allow guix_daemon_t
         self
         (fifo_file (write read)))
  (allow guix_daemon_t
         self
         (udp_socket (ioctl create)))
+  (allow guix_daemon_t
+         self
+         (unix_stream_socket (connectto)))
+  (allow guix_daemon_t
+         self
+         (unix_dgram_socket (create bind connect sendto read write)))
+
+  ;; For some esoteric build jobs (i.e. running PostgreSQL, etc).
+  (allow guix_daemon_t
+         self
+         (capability (kill)))
+  (allow guix_daemon_t
+         node_t
+         (tcp_socket (node_bind)))
+  (allow guix_daemon_t
+         node_t
+         (udp_socket (node_bind)))
+  (allow guix_daemon_t
+         port_t
+         (tcp_socket (name_connect)))
+  (allow guix_daemon_t
+         tmpfs_t
+         (file (map read write link getattr)))
+  (allow guix_daemon_t
+         usermodehelper_t
+         (file (read)))
+  (allow guix_daemon_t
+         hugetlbfs_t
+         (file (map read write)))
+  (allow guix_daemon_t
+         proc_net_t
+         (file (read)))
+  (allow guix_daemon_t
+         postgresql_port_t
+         (tcp_socket (name_connect name_bind)))
+  (allow guix_daemon_t
+         rtp_media_port_t
+         (udp_socket (name_bind)))
+  (allow guix_daemon_t
+         vnc_port_t
+         (tcp_socket (name_bind)))
+
+  ;; I guess sometimes it needs random numbers
+  (allow guix_daemon_t
+         random_device_t
+         (chr_file (read)))
+
+  ;; guix system vm
+  (allow guix_daemon_t
+         kvm_device_t
+         (chr_file (ioctl open read write)))
+  (allow guix_daemon_t
+         kernel_t
+         (system (ipc_info)))

  ;; Label file system
  (filecon "@guix_sysconfdir@/guix(/.*)?"
@@ -277,5 +446,7 @@
           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@storedir@/.+-(guix-.+|profile)/bin/guix-daemon"
           file (system_u object_r guix_daemon_exec_t (low low)))
+  (filecon "@storedir@/[a-z0-9]+-guix-daemon"
+           file (system_u object_r guix_daemon_exec_t (low low)))
  (filecon "@guix_localstatedir@/guix/daemon-socket/socket"
           any (system_u object_r guix_daemon_socket_t (low low))))
@@ -4,6 +4,9 @@
 # Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 # Copyright © 2018 Efraim Flashner <efraim@flashner.co.il>
 # Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+# Copyright © 2020 Morgan Smith <Morgan.J.Smith@outlook.com>
+# Copyright © 2020 Simon Tournier <zimon.toutoune@gmail.com>
+# Copyright © 2020 Daniel Brooks <db48x@db48x.net>
 #
 # This file is part of GNU Guix.
 #
@@ -53,10 +56,12 @@ REQUIRE=(

 PAS=$'[ \033[32;1mPASS\033[0m ] '
 ERR=$'[ \033[31;1mFAIL\033[0m ] '
+WAR=$'[ \033[33;1mWARN\033[0m ] '
 INF="[ INFO ] "

 DEBUG=0
 GNU_URL="https://ftp.gnu.org/gnu/guix/"
+#GNU_URL="https://alpha.gnu.org/gnu/guix/"
 OPENPGP_SIGNING_KEY_ID="3CE464558A84FDC69DB40CFB090B11993D9AEBB5"

 # This script needs to know where root's home directory is.  However, we
@@ -111,7 +116,7 @@ chk_gpg_keyring()
    # systems where gpg has never been used, causing errors and confusion.
    gpg --dry-run --list-keys ${OPENPGP_SIGNING_KEY_ID} >/dev/null 2>&1 || (
        _err "${ERR}Missing OpenPGP public key.  Fetch it with this command:"
-        echo "  wget https://sv.gnu.org/people/viewgpg.php?user_id=15145 -qO - | sudo -i gpg --import -"
+        echo "  wget 'https://sv.gnu.org/people/viewgpg.php?user_id=15145' -qO - | sudo -i gpg --import -"
        exit 1
    )
 }
@@ -150,6 +155,10 @@ chk_init_sys()
        _msg "${INF}init system is: sysv-init"
        INIT_SYS="sysv-init"
        return 0
+    elif [[ $(openrc --version 2>/dev/null) =~ \(OpenRC\) ]]; then
+        _msg "${INF}init system is: OpenRC"
+        INIT_SYS="openrc"
+        return 0
    else
        INIT_SYS="NA"
        _err "${ERR}Init system could not be detected."
@@ -174,9 +183,9 @@ chk_sys_arch()
        aarch64)
            local arch=aarch64
            ;;
-	armv7l)
-	    local arch=armhf
-	    ;;
+        armv7l)
+            local arch=armhf
+            ;;
        *)
            _err "${ERR}Unsupported CPU type: ${arch}"
            exit 1
@@ -194,6 +203,19 @@ chk_sys_arch()
    ARCH_OS="${arch}-${os}"
 }

+chk_sys_nscd()
+{ # Check if nscd is up and suggest to start it or install it
+    if [ "$(type -P pidof)" ]; then
+        if [ ! "$(pidof nscd)" ]; then
+            _msg "${WAR}We recommend installing and/or starting your distribution 'nscd' service"
+            _msg "${WAR}Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
+        fi
+    else
+        _msg "${INF}We cannot determine if your distribution 'nscd' service is running"
+        _msg "${INF}Please read 'info guix \"Application Setup\"' about \"Name Service Switch\""
+    fi
+}
+
 # ------------------------------------------------------------------------------
 #+MAIN

@@ -208,11 +230,11 @@ guix_get_bin_list()

    # Filter only version and architecture
    bin_ver_ls=("$(wget -qO- "$gnu_url" \
-        | sed -n -e 's/.*guix-binary-\([0-9.]*\)\..*.tar.xz.*/\1/p' \
+        | sed -n -e 's/.*guix-binary-\([0-9.]*[a-z0-9]*\)\..*.tar.xz.*/\1/p' \
        | sort -Vu)")

-    latest_ver="$(echo "$bin_ver_ls" \
-                       | grep -oP "([0-9]{1,2}\.){2}[0-9]{1,2}" \
+    latest_ver="$(echo "${bin_ver_ls[0]}" \
+                       | grep -oE "([0-9]{1,2}\.){2}[0-9]{1,2}[a-z0-9]*" \
                       | tail -n1)"

    default_ver="guix-binary-${latest_ver}.${ARCH_OS}"
@@ -225,7 +247,7 @@ guix_get_bin_list()
    fi

    # Use default to download according to the list and local ARCH_OS.
-    BIN_VER="$default_ver"
+    BIN_VER="${default_ver}"
 }

 guix_get_bin()
@@ -249,7 +271,7 @@ guix_get_bin()
        exit 1
    fi

-    pushd $dl_path >/dev/null
+    pushd "${dl_path}" >/dev/null
    gpg --verify "${bin_ver}.tar.xz.sig" >/dev/null 2>&1
    if [[ "$?" -eq 0 ]]; then
        _msg "${PAS}Signature is valid."
@@ -268,8 +290,7 @@ sys_create_store()
    _debug "--- [ $FUNCNAME ] ---"

    cd "$tmp_path"
-    tar --warning=no-timestamp \
-        --extract \
+    tar --extract \
        --file "$pkg" &&
    _msg "${PAS}unpacked archive"

@@ -358,15 +379,15 @@ sys_enable_guix_daemon()
                 /etc/systemd/system/;
              chmod 664 /etc/systemd/system/guix-daemon.service;

-	      # Work around <https://bugs.gnu.org/36074>, present in 1.0.1.
-	      sed -i /etc/systemd/system/guix-daemon.service \
-	          -e "s/GUIX_LOCPATH='/'GUIX_LOCPATH=/";
+              # Work around <https://bugs.gnu.org/36074>, present in 1.0.1.
+              sed -i /etc/systemd/system/guix-daemon.service \
+                  -e "s/GUIX_LOCPATH='/'GUIX_LOCPATH=/";

-	      # Work around <https://bugs.gnu.org/35671>, present in 1.0.1.
-	      if ! grep en_US /etc/systemd/system/guix-daemon.service >/dev/null;
-	      then sed -i /etc/systemd/system/guix-daemon.service \
-		       -e 's/^Environment=\(.*\)$/Environment=\1 LC_ALL=en_US.UTF-8';
-	      fi;
+              # Work around <https://bugs.gnu.org/35671>, present in 1.0.1.
+              if ! grep en_US /etc/systemd/system/guix-daemon.service >/dev/null;
+              then sed -i /etc/systemd/system/guix-daemon.service \
+                       -e 's/^Environment=\(.*\)$/Environment=\1 LC_ALL=en_US.UTF-8';
+              fi;

              systemctl daemon-reload &&
                  systemctl enable guix-daemon &&
@@ -384,6 +405,16 @@ sys_enable_guix_daemon()
                  service guix-daemon start; } &&
                _msg "${PAS}enabled Guix daemon via sysv"
            ;;
+        openrc)
+            { mkdir -p /etc/init.d;
+              cp "${ROOT_HOME}/.config/guix/current/etc/openrc/guix-daemon" \
+                 /etc/init.d/guix-daemon;
+              chmod 775 /etc/init.d/guix-daemon;
+
+              rc-update add guix-daemon default &&
+                  rc-service guix-daemon start; } &&
+                _msg "${PAS}enabled Guix daemon via OpenRC"
+            ;;
        NA|*)
            _msg "${ERR}unsupported init system; run the daemon manually:"
            echo "  ${ROOT_HOME}/.config/guix/current/bin/guix-daemon --build-users-group=guixbuild"
@@ -396,7 +427,7 @@ sys_enable_guix_daemon()
    ln -sf "${var_guix}/bin/guix"  "$local_bin"

    [ -e "$info_path" ] || mkdir -p "$info_path"
-    for i in ${var_guix}/share/info/*; do
+    for i in "${var_guix}"/share/info/*; do
        ln -sf "$i" "$info_path"
    done
 }
@@ -445,6 +476,26 @@ export XDG_DATA_DIRS="$GUIX_PROFILE/share:${XDG_DATA_DIRS:-/usr/local/share/:/us
 EOF
 }

+sys_create_shell_completion()
+{ # Symlink supported shell completions system-wide
+
+    var_guix=/var/guix/profiles/per-user/root/current-guix
+    bash_completion=/etc/bash_completion.d
+    zsh_completion=/usr/share/zsh/site-functions
+    fish_completion=/usr/share/fish/vendor_completions.d
+
+    { # Just in case
+        for dir_shell in $bash_completion $zsh_completion $fish_completion; do
+            [ -d "$dir_shell" ] || mkdir -p $dir_shell
+        done;
+
+        ln -sf ${var_guix}/etc/bash_completion.d/* "$bash_completion";
+        ln -sf ${var_guix}/share/zsh/site-functions/* "$zsh_completion";
+        ln -sf ${var_guix}/share/fish/vendor_completions.d/* "$fish_completion"; } &&
+        _msg "${PAS}installed shell completion"
+}
+
+
 welcome()
 {
    cat<<"EOF"
@@ -488,6 +539,7 @@ main()
    chk_gpg_keyring
    chk_init_sys
    chk_sys_arch
+    chk_sys_nscd

    _msg "${INF}system is ${ARCH_OS}"

@@ -502,6 +554,7 @@ main()
    sys_enable_guix_daemon
    sys_authorize_build_farms
    sys_create_init_profile
+    sys_create_shell_completion

    _msg "${INF}cleaning up ${tmp_path}"
    rm -r "${tmp_path}"
@@ -2,6 +2,11 @@
 ;;
 ;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;; Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+;; Copyright © 2019, 2020 Miguel Ángel Arruga Vivas <rosen644835@gmail.com>
+;; Copyright © 2019, 2020 Konrad Hinsen <konrad.hinsen@fastmail.net>
+;; Copyright © 2019, 2020 Julien Lepiller <julien@lepiller.eu>
+;; Copyright © 2019, 2020 Florian Pelz <pelzflorian@pelzflorian.de>
+;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com>
 ;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
@@ -13,8 +18,572 @@
 (channel-news
 (version 0)

+ (entry (commit "e38d90d497e19e00263fa28961c688a433154386")
+        (title (en "New @option{--with-patch} package transformation option")
+               (de "Neue Paketumwandlungsoption @option{--with-patch}")
+               (fr "Nouvelle option de transformation @option{--with-patch}"))
+        (body
+         (en "The new @option{--with-patch} package transformation option
+applies patches to the specified packages before building them.  The example
+below builds the GNU Core Utilities against a patched C library (glibc):
+
+@example
+guix build coreutils --with-patch=glibc=./glibc-frob.patch
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (de "Die neue Paketumwandlungsoption @option{--with-patch} wendet
+Patches auf die angegebenen Pakete an, bevor sie erstellt werden. Das folgende
+Beispiel lässt die GNU Core Utilities mit einer gepatchten
+C-Bibliothek (glibc) erstellen:
+
+@example
+guix build coreutils --with-patch=glibc=./glibc-frob.patch
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--with-patch} applique des modifications (@i{patches}) aux paquets
+spécifiés avant de les compiler.  L'exemple suivant compile les utilitaires de
+base GNU avec une bibliothèque C (glibc) modifiée :
+
+@example
+guix build coreutils --with-patch=glibc=./glibc-frob.patch
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "79f9dee3c4c0e6d21066f142116a537207ae7ba4")
+        (title (en "Local substitute servers discovery is now supported")
+               (de "Substitutserver können jetzt im lokalen Netz erkannt werden")
+               (es "Los servidores de sustituciones se pueden descubrir localmente")
+               (fr "La découverte des serveurs de substituts locaux est désormais supportée"))
+        (body
+         (en "The @command{guix-daemon} can now discover local substitute
+servers when the @option{--discover} option is passed.  Only the substitute
+servers started with the @option{--advertise} option will be discovered.  The
+network discovery is based on mDNS and DNS-SD protocols, using Guile-Avahi
+library for now.")
+         (de "Mit dem @command{guix-daemon} können jetzt lokal laufende
+Substitutserver erkannt werden, wenn die Befehlszeilenoption
+@option{--discover} übergeben wurde.  Nur solche Substitutserver werden
+gefunden, die mit der Befehlszeilenoption @option{--advertise} gestartet
+wurden.  Die Ermittlung im Netzwerk verfügbarer Substitutserver baut auf den
+Protokollen mDNS und DNS-SD auf.  Derzeit wird dazu die Bibliothek Guile-Avahi
+benutzt.")
+         (es "El daemon @command{guix-daemon} ahora puede descubrir servidores
+de sustituciones locales cuando se le proporciona la opción
+@option{--discover}.  Únicamente se descubrirán los servidores de
+sustituciones que se hayan arrancado con la opción @option{--advertise}. La
+búsqueda en la red se basa en los protocolos mDNS y DNS-SD, actualmente
+mediante el uso de la biblioteca Guile-Avahi.")
+         (fr "Le @command{guix-daemon} peut désormais découvrir les serveurs
+de substituts locaux lorsque l'option @option{--discover} est passée.  Seuls
+les serveurs de substituts démarrés avec l'option @option{--advertise} seront
+découverts.  La découverte réseau utilise les protocoles mDNS et DNS-SD, pour
+l'instant grâce à la librairie Guile-Avahi.")))
+
+ (entry (commit "a9a2fdaabcc78e7a54d9a6bcfa4ee3de308e9a90")
+        (title (en "Logical Volume Manager (LVM) now supported on Guix System")
+               (de "Logical Volume Manager (LVM) wird jetzt auf Guix System unterstützt")
+               (es "El sistema Guix ahora implementa también volúmenes lógicos LVM"))
+        (body
+         (en "On Guix System, the new @code{lvm-device-mapping} variable
+allows you to declare ``mapped devices'' for LVM, the Linux Logical Volume
+Manager.  For example, LVM logical volumes ``alpha'' and ``beta'' from volume
+group ``vg0'' can be declared as follows:
+
+@lisp
+(mapped-device
+  (source \"vg0\")
+  (target (list \"vg0-alpha\" \"vg0-beta\"))
+  (type lvm-device-mapping))
+@end lisp
+
+See @command{info \"(guix) Mapped Devices\"} for more information.")
+         (de "Auf Guix System erlaubt Ihnen die neue Variable
+@code{lvm-device-mapping}, „zugeordnete Geräte“ (Mapped Devices) für LVM, den
+Linux Logical Volume Manager, zu deklarieren. Zum Beispiel können logische
+Datenträger von LVM namens „alpha“ und „beta“ aus der
+Datenträgergruppe (Volume Group) „vg0“ wie folgt deklariert werden:
+
+@lisp
+(mapped-device
+  (source \"vg0\")
+  (target (list \"vg0-alpha\" \"vg0-beta\"))
+  (type lvm-device-mapping))
+@end lisp
+
+Siehe @command{info \"(guix.de) Zugeordnete Geräte\"} für nähere Informationen.")
+         (es "En el sistema Guix, la nueva variable @code{lvm-device-mapping}
+le permite declarar «dispositivos traducidos» para LVM, el gestor de volúmenes
+lógicos de Linux. A continuación se muestra un ejemplo con la declaración de
+los volúmenes lógicos «alfa» y «beta» del grupo de volúmenes «vg0»:
+
+@lisp
+(mapped-device
+  (source \"vg0\")
+  (target (list \"vg0-alfa\" \"vg0-beta\"))
+  (type lvm-device-mapping))
+@end lisp
+
+Véase @command{info \"(guix.es) Dispositivos traducidos\"} para obtener más
+información.")))
+
+ (entry (commit "3b6e4e5fd05e72b8a32ff1a2d5e21464260e21e6")
+        (title (en "List of substitute keys is now declarative on Guix System")
+               (de "Liste der Substitutschlüssel auf Guix System ist jetzt deklarativ")
+               (es "Claves para sustituciones del sistema Guix en formato declarativo")
+               (fr "Liste des clefs de substituts désormais déclarative sur Guix System"))
+        (body
+         (en "The list of authorized substitute keys, available in
+@file{/etc/guix/acl}, is now built by default in a purely declarative fashion
+on Guix System based on the @code{authorized-keys} field of the configuration
+of @code{guix-service-type}.  This means that manual changes to
+@file{/etc/guix/acl} are now @emph{discarded} upon reconfiguration or
+reboot (a backup is made as @file{/etc/guix/acl.bak} in that case).
+
+We recommend updating your operating system configuration to explicitly list
+all the authorized substitute keys.  See @command{info \"(guix) Base
+Services\"}, for more info about @code{guix-configuration} and
+@code{authorized-keys}.
+
+Alternatively, you can set the @code{authorize-key?} field of
+@code{guix-configuration} to @code{#f} to restore previous behavior.")
+         (de "Die Liste von autorisierten Substitutschlüsseln, die in
+@file{/etc/guix/acl} steht, wird auf Guix System nach Vorgabe jetzt auf rein
+deklarative Weise erstellt, je nach Inhalt des @code{authorized-keys}-Feldes
+der Konfiguration des @code{guix-service-type}. Das hat zur Folge, dass
+manuelle Änderungen an @file{/etc/guix/acl} von jetzt an nach jedem
+Rekonfigurieren oder Neustarten @emph{verworfen} werden (in diesem Fall wird
+eine Sicherheitskopie namens @file{/etc/guix/acl.bak} angelegt).
+
+Wir empfehlen, dass Sie Ihre Betriebssystemkonfiguration aktualisieren, damit
+dort alle autorisierten Substitutschlüssel ausdrücklich aufgeführt
+werden. Siehe @command{info \"(guix.de) Basisdienste\"} für mehr Informationen
+zur @code{guix-configuration} und @code{authorized-keys}.
+
+Alternativ können Sie das @code{authorize-key?}-Feld der
+@code{guix-configuration} auf @code{#f} setzen, um zum alten Verhalten
+zurückzugehen.")
+         (es "El listado de claves autorizadas para la obtención de
+sustituciones, disponible en @file{/etc/guix/acl}, ahora se genera de manera
+predeterminada en el sistema Guix de forma completamente declarativa en base
+al campo @code{authorized-keys} del la configuración para el servicio
+@code{guix-service-type}. Esto significa que los cambios que se hayan
+realizado de manera manual en @file{/etc/guix/acl} @emph{se descartan} tras
+una reconfiguración del sistema o tras un reinicio (se realiza una copia de
+seguridad en la ruta @file{/etc/guix/acl.bak} en este caso).
+
+Le recomendamos que actualice su configuración del sistema operativo para que
+enumere explícitamente todas las claves que desea autorizar para la obtención
+de sustituciones.  Véase @command{info \"(guix.es) Servicios base\"}, para
+obtener más información sobre @code{guix-configuration} y
+@code{authorized-keys}.
+
+También puede proporcionar el valor @code{#f} en el campo
+@code{authorize-key?} de @code{guix-configuration} para volver al
+comportamiento que se obtenía con versiones previas.")
+         (fr "La liste des clefs de substituts autorisées, stockée dans
+@file{/guix/guix/acl}, est dorénavant construite par défaut de manière
+déclarative sur Guix System, en se basant sur le champs @code{authorized-keys}
+de la configuration de @code{guix-service-type}.  Cela signifie que les
+modifications apportées manuellement à @file{/etc/guix/acl} seront désormais
+@emph{perdues} lors d'une reconfiguration ou d'un redémarrage (dans ce cas une
+sauvegarde est faite dans @file{/etc/guix/acl.bak}).
+
+Nous recommandons de mettre à jour sa configuration de système d'exploitation
+pour y lister explicitement les clefs autorisées.  Lancez @command{info
+\"(guix.fr) Services de base\"} pour plus d'informations sur
+@code{guix-configuration} et @code{authorized-keys}.
+
+Il est également possible de mettre le champs @code{authorize-key?} de
+@code{guix-configuration} à @code{#f} pour restaurer le comportement qui
+prévalait jusqu'à maintenant.")))
+
+ (entry (commit "6aeda81602555fbeac0c0a209e74f5262093b513")
+        (title (en "New @option{--with-debug-info} package transformation option")
+               (de "Neue Paketumwandlungsoption @option{--with-debug-info}")
+               (es "Nueva opción de transformación @option{--with-debug-info}")
+               (fr "Nouvelle option de transformation @option{--with-debug-info}"))
+        (body
+         (en "The new @option{--with-debug-info} option builds a variant of a
+package that includes debug info and grafts it onto the application you want
+to debug.  Thus, only the package for which you want debug info needs to be
+recompiled.  This is useful for packages that do not already have a
+@code{debug} output.
+
+For example, here is how you would obtain debug info for the @code{glib}
+library so you can inspect it while debugging Inkscape:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (de "Die neue Paketumwandlungsoption @option{--with-debug-info} lässt
+eine Variante eines Pakets erstellen, die auch Informationen zur Fehlersuche
+enthält. Damit wird die Anwendung veredelt, wo Sie Fehler nachvollziehen
+möchten. Somit muss nur das Paket, für das Sie die Informationen brauchen, neu
+kompiliert werden. Das ist hilfreich bei Paketen, die noch nicht über eine
+@code{debug}-Ausgabe verfügen.
+
+Zum Beispiel würden Sie so Informationen zur Fehlersuche für die
+@code{glib}-Bibliothek bekommen, um sie inspizieren zu können, wenn Sie Fehler
+in Inkscape nachvollziehen möchten:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (es "La nueva opción @option{--with-debug-info} construye una
+variante del paquete que incluye la información de depuración y la injerta
+en la aplicación que desee depurar.  Por tanto, únicamente el paquete del
+que desee información de depuración debe construirse de nuevo.  Es útil
+para paquetes que no tienen ya una salida @code{debug}.
+
+El siguiente ejemplo muestra como obtener información de depuración
+para la biblioteca @code{glib} de modo que pueda inspeccionarla mientras
+depura Inkscape:
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--with-debug-info} compile une variante d'un paquet avec les
+informations de déboguage et la greffe sur l'application que l'on veut
+déboguer.  Ainsi seul le paquet pour lequel on demande des informations de
+déboguage a besoin d'être recompilé.  C'est utile pour les paquets n'ayant pas
+déjà un résultat @code{debug}.
+
+Voici par exemple comment obtenir des informations de déboguage pour la
+bibliothèque @code{glib} de manière à pouvoir l'inspecter quand on débuggue
+Inkscape :
+
+@example
+guix build --with-debug-info=glib inkscape
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "abd7a474615353149a44f4504f0b4b248dcc0716")
+        (title (en "New @option{--with-c-toolchain} package transformation option")
+               (de "Neue Paketumwandlungsoption @option{--with-c-toolchain}")
+               (es "Nueva opción de transformación @option{--with-c-toolchain}")
+               (fr "Nouvelle option de transformation @option{--with-c-toolchain}"))
+        (body
+         (en "The new @option{--with-c-toolchain} package transformation
+options provides an easy way for developers to rebuild their favorite packages
+with the C/C++ tool chain of their choice instead of the default one.
+
+For example, the following command rebuilds the @code{fftw} and @code{fftwf}
+packages as well as every package that depends on them, up to and including
+@code{octave-cli}, using GCC version 10 (currently GCC 7.5 is used by
+default):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (de "Die neue Paketumwandlungsoption @option{--with-c-toolchain}
+bietet Entwicklern die Möglichkeit, leicht ihre Lieblingspakete mit der
+selbstgewählten Toolchain für C/C++ anstelle der vorgegebenen neu zu
+erstellen.
+
+Zum Beispiel werden mit folgendem Befehl die Pakete @code{fftw} und
+@code{fftwf} sowie alle davon abhängigen Pakete bis einschließlich
+@code{octave-cli} mit Version 10 der GCC erstellt (vorgegeben wäre zurzeit,
+GCC 7.5 zu benutzen):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (es "La nueva opción de transformación de paquetes
+@option{--with-c-toolchain} proporciona a las desarrolladoras una manera
+fácil de reconstruir sus paquetes favoritos con la cadena de herramientas
+de compilación de C/C++ que elijan en vez de la predeterminada.
+
+Por ejemplo, la siguiente orden reconstruye los paquetes @code{fftw} y
+@code{fftwf} así como todos los paquetes que dependen de ellos hasta
+@code{octave-cli}, usando la versión 10 de GCC (el compilador
+predeterminado en estos momentos es GCC 7.5):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--with-c-toolchain} permet aux développeur·euses de recompiler leurs
+paquets préférés avec la chaîne d'outils C/C++ de leur choix à la place de
+celle par défaut.
+
+Par exemple, la commande ci-dessous recompile @code{fftw}, @code{fftwf} et
+tous les paquets qui en dépendent, jusqu'à @code{octave-cli} inclus, avec GCC
+10 (actuellement c'est GCC 7.5 qui est utilisé par défaut):
+
+@example
+guix build octave-cli \\
+  --with-c-toolchain=fftw=gcc-toolchain@@10 \\
+  --with-c-toolchain=fftwf=gcc-toolchain@@10
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "8e1907a72430aa989125b053573ef0897c480697")
+        (title (en "Package transformation options now recorded in profiles")
+               (es "Las opciones de transformación de paquetes ahora se
+quedan registradas en el perfil")
+               (de "Paketumwandlungsoptionen werden nun in Profilen gesichert")
+               (fr "Options de transformation sauvegardées dans les profils"))
+        (body
+         (en "When installing packages in a profile, package transformation
+options such as @option{--with-input} are now recorded in the profile.  When
+you eventually run @command{guix upgrade}, those transformations will be
+automatically applied to the upgraded packages.
+
+Run @command{info \"(guix) Package Transformation Options\"} for more info.")
+         (es "Si durante la instalación de paquetes en un perfil se utilizaron
+opciones de transformación de paquetes, como por ejemplo
+@option{--with-input}, éstas se registran en el perfil. Cuando vuelva a
+ejecutar @command{guix upgrade}, dichas transformaciones se aplicarán
+automáticamente a los paquetes actualizados.
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Wenn Sie ein Paket in ein Profil installieren, werden nun
+Paketumwandlungsoptionen wie @option{--with-input} im Profil gespeichert.
+Sobald Sie später @command{guix upgrade} ausführen, werden dieselben
+Umwandlungen automatisch auf die aktualisierten Pakete angewandt.
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (fr "Lorsqu'on installe des paquets dans un profil, les options de
+transformation telles que @option{--with-input} sont désormais enregistrées
+dans le profil.  Quand on le met plus tard à jour avec @command{guix upgrade},
+ces transformations sont automatiquement appliquées aux nouveaux paquets.
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "313f492657f1d0863c641fa5ee7f5b7028e27c94")
+        (title (en "New @option{--image-type} option for @command{guix system disk-image}.")
+               (es "Nueva opción @option{--image-type} para @command{guix system disk-image}.")
+               (de "Neue Option @option{--image-type} für @command{guix system disk-image}.")
+               (fr "Nouvelle option @option{--image-type} pour @command{guix system disk-image}."))
+        (body
+         (en "The @option{--file-system-type} option for @command{guix system
+disk-image} command has been replaced by the new @option{--image-type} option.
+By default, @code{raw} disk images are produced, but @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} and @code{iso9660} image types
+are also available.
+
+The @option{--list-image-types} option lists all the available image types.")
+         (es "La opción @option{--file-system-type} de @command{guix system
+disk-image} se ha sustituido por la nueva opción @option{--image-type}.  De
+manera predeterminada se producen imágenes en formato crudo (@code{raw}) pero
+también están disponibles los tipos de imagen @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} y @code{iso9660}.
+
+La opción @option{--list-image-types} muestra una lista con todos los tipos
+de imagen disponibles.")
+         (de "Anstelle der Befehlszeilenoption @option{--file-system-type} für
+@command{guix system disk-image} gibt es nun die neue Option
+@option{--image-type}.  In der Vorgabeeinstellung @code{raw} werden rohe
+Disk-Images erzeugt, aber es können auch die Abbildtypen @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} und @code{iso9660} ausgewählt
+werden.
+
+Mit der Option @option{--list-image-types} werden alle verfügbaren Abbildtypen
+aufgelistet.")
+         (fr "L'option @option{--file-system-type} pour la commande
+@command{guix system disk-image} a été remplacée par la nouvelle option
+@option{--image-type}. Par défaut, l'option @code{raw}, produisant des images
+disque brutes est sélectionnée. Les options @code{hurd-qcow2},
+@code{hurd-raw}, @code{uncompressed-iso9660} et @code{iso9660} sont également
+disponibles.
+
+La nouvelle option @option{--list-image-types} énumère les types d'image
+disponibles.")))
+
+ (entry (commit "8819551c8d2a12cd4e84e09b51e434d05a012c9d")
+        (title (en "Package transformations now apply to implicit inputs")
+               (es "Las transformaciones de paquetes ahora afectan también
+a las dependencias implícitas")
+               (de "Paketumwandlungen betreffen jetzt auch implizite Eingaben")
+               (fr "Les transformations de paquets s'appliquent aux
+dépendances implicites"))
+        (body
+         (en "Package transformation options such as @option{--with-branch},
+@option{--with-input}, and so on now apply to implicit inputs---previously
+only a package's explicit inputs would be affected.  This allows for things
+such as replacing the Python dependency of a package that uses
+@code{python-build-system}:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Another example is grafting a different version of the GNU C
+Library (@code{glibc} is an implicit input of almost all the packages and is
+``deep down'' in the dependency graph):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Run @command{info \"(guix) Package Transformation Options\"} for more
+info.")
+         (es "Las opciones de transformación de paquetes como
+@option{--with-branch}, @option{--with-input}, etcétera, ahora también
+influyen en las entradas implícitas---antes únicamente las entradas explícitas
+del paquete se veían afectadas. Esto permite, por ejemplo, sustituir la
+dependencia en python de un paquete que use @code{python-build-system}:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Otro ejemplo podría ser el injerto de una versión diferente de la biblioteca
+de C de GNU (@code{glibc} es una entrada implícita de casi todos los paquetes
+y ``muy abajo'' en el grafo de dependencias):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Paketumwandlungsoptionen wie @option{--with-branch},
+@option{--with-input} und so weiter betreffen nun auch implizite Eingaben —
+zuvor haben sie sich nur auf die expliziten Eingaben eines Pakets
+ausgewirkt. Dadurch kann jetzt zum Beispiel die Python-Abhängigkeit eines
+Pakets, welches @code{python-build-system} benutzt, ersetzt werden:
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Ein weiteres Beispiel ist, mit einer anderen Version der GNU-C-Bibliothek zu
+veredeln (@code{glibc} ist eine implizite Eingabe fast aller Pakete und steckt
+„ganz tief“ im Abhängigkeitsgraphen):
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Führen Sie für mehr Informationen @command{info \"(guix.de)
+Paketumwandlungsoptionen\"} aus.")
+         (fr "Les options de transformation de paquets telles que
+@option{--with-branch} et @option{--with-input} s'appliquent désormais aux
+dépendances implicites — jusque là seules les dépendances explicites des
+paquets étaient prises en compte.  Cela permet certaines choses telles que
+remplacer la dépendance sur Python d'un paquet utilisant
+@code{python-build-system} :
+
+@example
+guix install --with-input=python=python2 python-itsdangerous
+@end example
+
+Un autre exemple est la possibilité de greffer une version différente de la
+bibliothèque C GNU (la @code{glibc} est une dépendance implicite de tous les
+paquets et se trouve « tout en bas » du graphe de dépendance) :
+
+@example
+guix build --with-graft=glibc=glibc@@2.31 hello
+@end example
+
+Voir @command{info \"(guix.fr) Options de transformation de paquets\"} pour
+plus de détails.")))
+
+ (entry (commit "f458cfbcc54ed87b1a87dd9e150ea276f17eab74")
+        (title (en "New @option{--without-tests} transformation option")
+               (es "Nueva opción de transformación @option{--without-tests}")
+               (de "Neue Paketumwandlungsoption @option{--without-tests}")
+               (fr "Nouvelle option de transformation @option{--without-tests}"))
+        (body
+         (en "The new @option{--without-tests} package transformation option
+instructs Guix to skip the test suite of a given package.  In the example
+below, @code{guile-gcrypt} is built using a variant of @code{automake} itself
+built without running its (lengthy) test suite:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+This is primarily useful as a way to speed up development cycles, or to work
+around flaky test suites---skipping tests can hide real issues, so use with
+care.  Run @command{info \"(guix) Package Transformation Options\"} for more
+info.")
+         (es "La nueva opción de transformación de paquetes
+@option{--without-tests} indica a Guix que omita la batería de pruebas del
+paquete proporcionado. En el siguiente ejemplo @code{guile-gcrypt} se
+construye usando una variación de @code{automake}, la cual se ha construido
+sin ejecutar su (larga) batería de pruebas:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Esto es principalmente útil como una forma de acelerar ciclos de desarrollo o
+de omitir temporalmente baterías de pruebas problemáticas---omitir las pruebas
+puede ocultar problemas reales, por lo que debe usarse con precaución.
+Ejecute @command{info \"(guix.es) Opciones de transformación de paquetes\"}
+para obtener más información.")
+         (de "Mit der neuen Paketumwandlungsoption @option{--without-tests}
+wird Guix angewiesen, den Testkatalog des angegebenen Pakets zu
+überspringen. Im folgenden Beispiel wird @code{guile-gcrypt} mit einer
+Variante von @code{automake} erstellt, die wiederum ohne Durchlauf ihres (viel
+Zeit in Anspruch nehmenden) Testkatalogs erstellt wird:
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Der hauptsächliche Nutzen liegt in der Beschleunigung von Entwicklungszyklen
+oder im Umgehen unzuverlässiger Testkataloge. Allerdings kann das Überspringen
+dazu führen, dass echte Probleme verborgen bleiben. Setzen Sie es mit Bedacht
+ein. Führen Sie @command{info \"(guix.de) Paketumwandlungsoptionen\"} aus, um
+mehr Informationen zu erhalten.")
+         (fr "La nouvelle option de transformation de paquets
+@option{--without-tests} demande à Guix de sauter la suite de tests d'un
+paquet.  Dans l'exemple ci-dessous, @code{guile-gcrypt} est construit en
+utilisant une variante de @code{automake} construite sans lancer sa suite de
+tests :
+
+@example
+guix build guile-gcrypt --without-tests=automake
+@end example
+
+Cette option est surtout intéressante pour raccourcir le cycle de
+développement ou pour contourner une suite de tests qui n'est pas
+fiable — sauter les tests peut cacher des vrais problèmes, à utiliser avec
+précaution donc.  Voir @command{info \"(guix.fr) Options de transformation de
+paquets\"} pour plus de détails.")))
+
 (entry (commit "a98712785e0b042a290420fd74e5a4a5da4fc68f")
        (title (en "New @command{guix git authenticate} command")
+               (es "Nueva orden @command{guix git authenticate}")
               (de "Neuer Befehl @command{guix git authenticate}")
               (fr "Nouvelle commande @command{guix git authenticate}"))
        (body
@@ -30,6 +599,20 @@ to allow people to authenticate code fetched from your repository.
 Run @command{info \"(guix) Invoking guix git authenticate\"} for more info,
 and see @uref{https://guix.gnu.org/blog/2020/securing-updates/} for details on
 these mechanisms.")
+         (es "La nueva orden @command{guix git authenticate} comprueba la
+validez de un repositorio git verificando las firmas de las revisiones y
+comprobando que todas las firmas están autorizadas, exactamente igual que
+@command{guix pull}.
+
+Esta orden es principalmente útil para desarrolladoras de canales. Permite
+asegurar, antes de subir nada al repositorio remoto, que el canal contiene
+únicamente revisiones firmadas por claves autorizadas. No obstante esta orden
+es útil siempre que use git y quiera que otras personas puedan verificar el
+código obtenido de su repositorio.
+
+Ejecute @command{info \"(guix.es) Invocación de guix git authenticate\"}
+para obtener más información y vea detalles sobre estos mecanismos en
+ @uref{https://guix.gnu.org/blog/2020/securing-updates/}.")
         (de "Mit dem neuen Befehl @command{guix git authenticate} können Sie
 ein Git-Repository authentifizieren. Dazu werden alle Commit-Signaturen
 verifiziert und geprüft, dass jede von einer autorisierten Quelle kommt, genau
@@ -62,6 +645,7 @@ pour en savoir plus sur ces mécanismes.")))

 (entry (commit "43badf261f4688c8a7a7a9004a4bff8acb205835")
        (title (en "@command{guix pull} authenticates channels")
+               (es "@command{guix pull} verifica los canales")
               (de "@command{guix pull} authentifiziert Kanäle")
               (fr "@command{guix pull} authentifie les canaux"))
        (body
@@ -74,6 +658,16 @@ repository and from attempts to ship malicious code to users.

 This feature is currently limited to the @code{guix} channel but will soon be
 available to third-party channel authors.")
+         (es "Las ordenes @command{guix pull} y @command{guix time-machine}
+ahora verifican el código fuente que obtienen, a menos que se proporcione la
+opción @option{--disable-authentication}. Lo que esto significa es que Guix se
+asegura de que cada revisión que recibe está firmada criptográficamente por
+una desarrolladora autorizada. Esto le protege de intentos de modificación del
+repositorio de Guix y de entregas de código con malas intenciones sobre las
+usuarias.
+
+Esta característica está limitada actualmente al canal @code{guix} pero pronto
+estará disponible para autoras de canales independientes.")
         (de "Die Befehle @command{guix pull} und @command{guix time-machine}
 prüfen nun die Authentizität des heruntergeladenen Quellcodes, außer wenn die
 neue Befehlszeilenoption @option{--disable-authentication} angegeben
@@ -97,6 +691,7 @@ Cette fonctionnalité n'est actuellement disponible que pour le canal

 (entry (commit "c924e541390f9595d819edc33c19d979917c15ec")
        (title (en "@command{guix repl} adds support for running Guile scripts")
+               (es "@command{guix repl} puede ejecutar guiones de Guile")
               (de "@command{guix repl} kann Guile-Skripte ausführen")
               (fr "@command{guix repl} permet d'exécuter des scripts en langage Guile"))
        (body
@@ -110,6 +705,18 @@ guix repl -- my-script,scm --option1 --option2=option-arg arg1 arg2
@end example

 Run @command{info \"(guix) Invoking guix repl\"} for more information.")
+         (es "La orden @command{guix repl} ahora se puede usar para
+ejecutar guiones de Guile. En comparación con únicamente la ejecución
+de la orden @command{guile}, @command{guix repl} garantiza que todos
+los módulos de Guix y sus dependencias están disponibles en la ruta
+ de búsqueda. Los guiones se ejecutan de este modo:
+
+@example
+guix repl -- mi-guion.scm --opcion1 --opcion2=param-op2 param1 param2
+@end example
+
+Ejecute @command{info \"(guix.es) Invocación de guix repl\"} para obtener
+más información.")
         (de "Der Befehl @command{guix repl} kann jetzt zur Ausführung von
 Guile-Skripten verwendet werden.  Im Vergleich zum Befehl
@command{guile} garantiert @command{guix repl}, dass alle Guix-Module und
@@ -136,6 +743,7 @@ Exécutez @command{info \"(guix.fr) Invoquer guix repl\"} pour plus d'informatio

 (entry (commit "b460ba7992a0b4af2ddb5927dcf062784539ef7b")
        (title (en "Add support to boot from a Btrfs subvolume")
+               (es "Implementado el arranque desde un subvolumen de Btrfs")
               (de "Unterstützung für Systemstart von einem
 Btrfs-Unterlaufwerk hinzugefügt")
               (fr "Ajout du support pour démarrer depuis un sous-volume Btrfs")
@@ -146,6 +754,11 @@ operating system declaration now takes into account the use of a Btrfs
 subvolume for the partition holding @file{/gnu/store}.  Run the command
@command{info \"(guix) Btrfs file system\"} for more information and
 examples.")
+         (es "El fichero de configuración de GRUB producido por la
+declaración de sistema operativo ahora tiene en cuenta el uso de
+subvolúmenes de Btrfs en la partición que contiene @file{/gnu/store}.
+Ejecute la orden @command{info \"(guix.es) Sistema de ficheros Btrfs\"}
+ para obtener más información y ejemplos.")
         (de "Für die Erzeugung einer GRUB-Konfigurationsdatei aus einer
 Betriebssystemdeklaration kann jetzt ein Btrfs-Unterlaufwerk („Subvolume“) für
 die Partition mit @file{/gnu/store} angegeben werden.  Führen Sie
@@ -165,6 +778,8 @@ voorbeelden.")))
 (entry (commit "6456232164890dbf5aa20394ee24637feb4b7b9e")
        (title (en "@command{guix pack -RR} introduces a new execution
 engine")
+               (es "@command{guix pack -RR} introduce un nuevo motor
+de ejecución")
               (de "@command{guix pack -RR} führt neuen Ausführungstreiber
 ein"))
        (body
@@ -185,6 +800,26 @@ export GUIX_EXECUTION_ENGINE
@end example

 Run @command{info \"(guix) Invoking guix pack\"} for more information.")
+         (es "La orden @command{guix pack -RR} le permite crear un
+archivador tar que contiene @dfn{binarios reposicionables}. Hasta ahora
+dichos binarios dependían o bien de los ``espacios de nombres de usuarias
+sin privilegios'' de Linux o en PRoot, cuando estos no estaban
+implementados. No obstante, PRoot introduce una sobrecarga significativa
+en algunos escenarios de trabajo.
+
+Para estos casos @command{guix pack -RR} introduce una tercera opción
+basada en una extensión al enlazador de tiempo de ejecución de GNU (ld.so)
+y en Fakechroot, lo que conlleva muy poca sobrecarga. Puede seleccionar
+la opción más rápida cuando ejecute un binario reposicionable de esta
+manera:
+
+@example
+GUIX_EXECUTION_ENGINE=performance
+export GUIX_EXECUTION_ENGINE
+@end example
+
+Ejecute @command{info \"(guix.es) Invocación de guix pack\"} para
+obtener más información.")
         (de "Mit dem Befehl @command{guix pack -RR} können Sie einen Tarball
 mit @dfn{verschieblichen Binärdateien} erzeugen (englisch „Relocatable
 Binaries“).  Bisher wurden diese entweder in „unprivilegierten
@@ -209,6 +844,7 @@ mehr wissen wollen.")))

 (entry (commit "88a96c568c47c97d05d883ada5afbc4e1200b10f")
        (title (en "New @option{--path} option for @command{guix graph}")
+               (es "Nueva opción @option{--path} para @command{guix graph}")
               (de "Neue Option @option{--path} für @command{guix graph}"))
        (body
         (en "The @command{guix graph} command has a new @option{--path}
@@ -221,6 +857,18 @@ guix graph --path libreoffice libunistring
@end example

 Run @code{info \"(guix) Invoking guix graph\"} for more information.")
+         (es "La orden @command{guix graph} tiene una nueva opción
+@option{--path} que le indica que debe mostrar la ruta más corta entre dos
+paquetes, derivaciones o elementos del almacén. Por ejemplo, la siguiente
+orden muestra la ruta más corta desde el paquete @code{libreoffice} hasta
+@code{libunistring}:
+
+@example
+guix graph --path libreoffice libunistring
+@end example
+
+Ejecute @code{info \"(guix.es) Invocación de guix graph\"} para obtener más
+información.")
         (de "Der Befehl @command{guix graph} verfügt über eine neue
 Befehlszeilenoption @option{--path}, die ihn den kürzesten Pfad zwischen zwei
 Paketen, Ableitungen oder Store-Objekten ausgeben lässt.  Zum Beispiel zeigt
@@ -0,0 +1,28 @@
+#!/sbin/openrc-run
+# GNU Guix --- Functional package management for GNU
+# Copyright © 2020 Morgan Smith <Morgan.J.Smith@outlook.com>
+#
+# This file is part of GNU Guix.
+#
+# GNU Guix is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# GNU Guix is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+export GUIX_LOCPATH=@localstatedir@/guix/profiles/per-user/root/guix-profile/lib/locale
+export LC_ALL=en_US.utf8
+command="@localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daemon"
+command_args="--build-users-group=guixbuild"
+command_background="yes"
+pidfile="/var/run/guix-daemon.pid"
+
+output_log="/var/log/guix-daemon-stdout.log"
+error_log="/var/log/guix-daemon-stderr.log"
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -48,11 +49,18 @@ TARGET."
       '("bootstrap-tarballs" "gcc-toolchain" "nss-certs"
         "openssh" "emacs" "vim" "python" "guile" "guix")))

+(define %base-packages/hurd
+  ;; XXX: For now we are less demanding of "i586-gnu".
+  (map specification->package
+       '("coreutils" "grep" "findutils" "gawk" "make"
+         "gcc-toolchain" "tar" "xz")))
+
 (define %system-packages
  ;; Key packages proposed by the Guix System installer.
  (append (map specification->package
               '("xorg-server" "xfce" "gnome" "mate" "enlightenment"
                 "openbox" "awesome" "i3-wm" "ratpoison"
+                 "emacs" "emacs-exwm" "emacs-desktop-environment"
                 "xlockmore" "slock" "libreoffice"
                 "connman" "network-manager" "network-manager-applet"
                 "openssh" "ntp" "tor"
@@ -92,7 +100,9 @@ TARGET."
  (manifest
   (append-map (lambda (system)
                 (map (cut package->manifest-entry* <> system)
-                      %base-packages))
+                      (if (string=? system "i586-gnu")
+                          %base-packages/hurd
+                          %base-packages)))
               %hydra-supported-systems)))

 (define %system-manifest
@@ -11,20 +11,30 @@
                                          "ant-build-system"
                                          "asdf-build-system"
                                          "cargo-build-system"
+                                          "clojure-build-system"
                                          "cmake-build-system"
+                                          "copy-build-system"
                                          "dub-build-system"
+                                          "dune-build-system"
                                          "emacs-build-system"
                                          "font-build-system"
                                          "glib-or-gtk-build-system"
                                          "gnu-build-system"
                                          "go-build-system"
+                                          "guile-build-system"
                                          "haskell-build-system"
+                                          "julia-build-system"
+                                          "linux-module-build-system"
+                                          "maven-build-system"
                                          "meson-build-system"
                                          "minify-build-system"
+                                          "node-build-system"
                                          "ocaml-build-system"
                                          "perl-build-system"
                                          "python-build-system"
+                                          "qt-build-system"
                                          "r-build-system"
+                                          "rakudo-build-system"
                                          "ruby-build-system"
                                          "scons-build-system"
                                          "texlive-build-system"
@@ -0,0 +1,15 @@
+# -*- mode: snippet -*-
+# name: guix-commit-message-add-cl-package
+# key: addcl
+# condition: git-commit-mode
+# --
+gnu: Add ${1:`(with-temp-buffer
+                (magit-git-wash #'magit-diff-wash-diffs
+                  "diff" "--staged")
+                (beginning-of-buffer)
+                (when (search-forward "+(define-public " nil 'noerror)
+                  (replace-regexp-in-string
+		   "^sbcl-" ""
+		   (thing-at-point 'sexp 'no-properties))))`}.
+
+* `(car (magit-staged-files))` (cl-${1:$(replace-regexp-in-string "^cl-" "" yas-text)}, ecl-$1, sbcl-$1): New variables.
@@ -6,8 +6,8 @@
 gnu: Add ${1:`(with-temp-buffer
                (magit-git-wash #'magit-diff-wash-diffs
                  "diff" "--staged")
-                (beginning-of-buffer)
-                (when (search-forward "(define-public " nil 'noerror)
-                  (thing-at-point 'sexp 'no-properties)))`}.
+                (goto-char (point-min))
+                (when (re-search-forward "\\+(define-public \\(\\S-+\\)" nil 'noerror)
+                  (match-string-no-properties 1)))`}.

 * `(car (magit-staged-files))` ($1): New variable.
@@ -7,12 +7,12 @@
 gnu: ${1:`(with-temp-buffer
           (magit-git-wash #'magit-diff-wash-diffs
             "diff" "--staged")
-           (beginning-of-buffer)
-           (when (search-forward "(define-public " nil 'noerror)
-             (thing-at-point 'sexp 'no-properties)))`}: Update to ${2:`(with-temp-buffer
+           (goto-char (point-min))
+           (when (re-search-forward "(define-public \\(\\S-+\\)" nil 'noerror)
+             (match-string-no-properties 1)))`}: Update to ${2:`(with-temp-buffer
    (magit-git-wash #'magit-diff-wash-diffs
      "diff" "--staged")
-    (beginning-of-buffer)
+    (goto-char (point-min))
    (search-forward "name" nil 'noerror)
    (search-forward "+" nil 'noerror)   ; first change
    (when (and (search-forward "version " nil 'noerror)
@@ -22,6 +22,8 @@

 (define-module (gnu bootloader)
  #:use-module (guix discovery)
+  #:use-module (guix gexp)
+  #:use-module (guix profiles)
  #:use-module (guix records)
  #:use-module (guix ui)
  #:use-module (srfi srfi-1)
@@ -66,7 +68,9 @@
            bootloader-configuration-additional-configuration

            %bootloaders
-            lookup-bootloader-by-name))
+            lookup-bootloader-by-name
+
+            efi-bootloader-chain))


 ;;;
@@ -227,3 +231,122 @@ record."
              (eq? name (bootloader-name bootloader)))
            (force %bootloaders))
      (leave (G_ "~a: no such bootloader~%") name)))
+
+(define (efi-bootloader-profile files bootloader-package hooks)
+  "Creates a profile with BOOTLOADER-PACKAGE and a directory collection/ with
+links to additional FILES from the store.  This collection is meant to be used
+by the bootloader installer.
+
+FILES is a list of file or directory names from the store, which will be
+symlinked into the collection/ directory.  If a directory name ends with '/',
+then the directory content instead of the directory itself will be symlinked
+into the collection/ directory.
+
+FILES may contain file like objects produced by functions like plain-file,
+local-file, etc., or package contents produced with file-append.
+
+HOOKS lists additional hook functions to modify the profile."
+  (define (bootloader-collection manifest)
+    (define build
+        (with-imported-modules '((guix build utils)
+                                 (ice-9 ftw)
+                                 (srfi srfi-1)
+                                 (srfi srfi-26))
+          #~(begin
+            (use-modules ((guix build utils)
+                          #:select (mkdir-p strip-store-file-name))
+                         ((ice-9 ftw)
+                          #:select (scandir))
+                         ((srfi srfi-1)
+                          #:select (append-map every remove))
+                         ((srfi srfi-26)
+                          #:select (cut)))
+            (define (symlink-to file directory transform)
+              "Creates a symlink to FILE named (TRANSFORM FILE) in DIRECTORY."
+              (symlink file (string-append directory "/" (transform file))))
+            (define (directory-content directory)
+              "Creates a list of absolute path names inside DIRECTORY."
+              (map (lambda (name)
+                     (string-append directory name))
+                   (or (scandir directory (lambda (name)
+                                            (not (member name '("." "..")))))
+                       '())))
+            (define name-ends-with-/? (cut string-suffix? "/" <>))
+            (define (name-is-store-entry? name)
+              "Return #t if NAME is a direct store entry and nothing inside."
+              (not (string-index (strip-store-file-name name) #\/)))
+            (let* ((collection (string-append #$output "/collection"))
+                   (files '#$files)
+                   (directories (filter name-ends-with-/? files))
+                   (names-from-directories
+                    (append-map (lambda (directory)
+                                  (directory-content directory))
+                                directories))
+                   (names (append names-from-directories
+                                  (remove name-ends-with-/? files))))
+              (mkdir-p collection)
+              (if (every file-exists? names)
+                  (begin
+                    (for-each (lambda (name)
+                               (symlink-to name collection
+                                            (if (name-is-store-entry? name)
+                                                strip-store-file-name
+                                                basename)))
+                              names)
+                    #t)
+                  #f)))))
+
+    (gexp->derivation "bootloader-collection"
+                      build
+                      #:local-build? #t
+                      #:substitutable? #f
+                      #:properties
+                      `((type . profile-hook)
+                        (hook . bootloader-collection))))
+
+  (profile (content (packages->manifest (list bootloader-package)))
+           (name "bootloader-profile")
+           (hooks (append (list bootloader-collection) hooks))
+           (locales? #f)
+           (allow-collisions? #f)
+           (relative-symlinks? #f)))
+
+(define* (efi-bootloader-chain files
+                               final-bootloader
+                               #:key
+                               (hooks '())
+                               installer)
+  "Define a bootloader chain with FINAL-BOOTLOADER as the final bootloader and
+certain directories and files from the store given in the list of FILES.
+
+FILES may contain file like objects produced by functions like plain-file,
+local-file, etc., or package contents produced with file-append.  They will be
+collected inside a directory collection/ inside a generated bootloader profile,
+which will be passed to the INSTALLER.
+
+If a directory name in FILES ends with '/', then the directory content instead
+of the directory itself will be symlinked into the collection/ directory.
+
+The procedures in the HOOKS list can be used to further modify the bootloader
+profile.  It is possible to pass a single function instead of a list.
+
+If the INSTALLER argument is used, then this function will be called to install
+the bootloader.  Otherwise the installer of the FINAL-BOOTLOADER will be called."
+  (let* ((final-installer (or installer
+                              (bootloader-installer final-bootloader)))
+         (profile (efi-bootloader-profile files
+                                          (bootloader-package final-bootloader)
+                                          (if (list? hooks)
+                                              hooks
+                                              (list hooks)))))
+    (bootloader
+     (inherit final-bootloader)
+     (package profile)
+     (installer
+      #~(lambda (bootloader target mount-point)
+          (#$final-installer bootloader target mount-point)
+          (copy-recursively
+           (string-append bootloader "/collection")
+           (string-append mount-point target)
+           #:follow-symlinks? #t
+           #:log (%make-void-port "w")))))))
@@ -4,6 +4,7 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019, 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2019, 2020 Miguel Ángel Arruga Vivas <rosen644835@gmail.com>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2020 Stefan <stefan-guix@vodafonemail.de>
 ;;;
@@ -23,14 +24,17 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu bootloader grub)
+  #:use-module (guix build union)
  #:use-module (guix records)
-  #:use-module ((guix utils) #:select (%current-system))
+  #:use-module (guix store)
+  #:use-module (guix utils)
  #:use-module (guix gexp)
  #:use-module (gnu artwork)
  #:use-module (gnu bootloader)
  #:use-module (gnu system uuid)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system keyboard)
+  #:use-module (gnu system locale)
  #:use-module (gnu packages bootloaders)
  #:autoload   (gnu packages gtk) (guile-cairo guile-rsvg)
  #:autoload   (gnu packages xorg) (xkeyboard-config)
@@ -46,8 +50,11 @@
            grub-theme-color-highlight
            grub-theme-gfxmode

+            install-grub-efi-netboot
+
            grub-bootloader
            grub-efi-bootloader
+            grub-efi-netboot-bootloader
            grub-mkrescue-bootloader
            grub-minimal-bootloader

@@ -135,6 +142,24 @@ file with the resolution provided in CONFIG."
            (image->png image #:width width #:height height))
           (_ #f)))))

+(define (grub-locale-directory grub)
+  "Generate a directory with the locales from GRUB."
+  (define builder
+    #~(begin
+        (use-modules (ice-9 ftw))
+        (let ((locale (string-append #$grub "/share/locale"))
+              (out    #$output))
+          (mkdir out)
+          (chdir out)
+          (for-each (lambda (lang)
+                      (let ((file (string-append locale "/" lang
+                                                 "/LC_MESSAGES/grub.mo"))
+                            (dest (string-append lang ".mo")))
+                        (when (file-exists? file)
+                          (copy-file file dest))))
+                    (scandir locale)))))
+  (computed-file "grub-locales" builder))
+
 (define* (eye-candy config store-device store-mount-point
                    #:key store-directory-prefix port)
  "Return a gexp that writes to PORT (a port-valued gexp) the 'grub.cfg' part
@@ -164,9 +189,11 @@ fi~%"
                     (symbol->string (assoc-ref colors 'bg)))))

  (define font-file
-    (normalize-file (file-append grub "/share/grub/unicode.pf2")
-                    store-mount-point
-                    store-directory-prefix))
+    (let* ((bootloader (bootloader-configuration-bootloader config))
+           (grub (bootloader-package bootloader)))
+      (normalize-file (file-append grub "/share/grub/unicode.pf2")
+                      store-mount-point
+                      store-directory-prefix)))

  (define image
    (normalize-file (grub-background-image config)
@@ -295,18 +322,51 @@ code."
        ((? file-system-label? label)
         (format #f "search --label --set ~a"
                 (file-system-label->string label)))
+        ((? (lambda (device)
+              (and (string? device) (string-contains device ":/"))) nfs-uri)
+         ;; If the device is an NFS share, then we assume that the expected
+         ;; file on that device (e.g. the GRUB background image or the kernel)
+         ;; has to be loaded over the network.  Otherwise we would need an
+         ;; additional device information for some local disk to look for that
+         ;; file, which we do not have.
+         ;;
+         ;; We explicitly set "root=(tftp)" here even though if grub.cfg
+         ;; had been loaded via TFTP, Grub would have set "root=(tftp)"
+         ;; automatically anyway.  The reason is if you have a system that
+         ;; used to be on NFS but now is local, root would be set to local
+         ;; disk.  If you then selected an older system generation that is
+         ;; supposed to boot from network in the Grub boot menu, Grub still
+         ;; wouldn't load those files from network otherwise.
+         ;;
+         ;; TFTP is preferred to HTTP because it is used more widely and
+         ;; specified in standards more widely--especially BOOTP/DHCPv4
+         ;; defines a TFTP server for DHCP option 66, but not HTTP.
+         ;;
+         ;; Note: DHCPv6 specifies option 59 to contain a boot-file-url,
+         ;; which can contain a HTTP or TFTP URL.
+         ;;
+         ;; Note: It is assumed that the file paths are of a similar
+         ;; setup on both the TFTP server and the NFS server (it is
+         ;; not possible to search for files on TFTP).
+         ;;
+         ;; TODO: Allow HTTP.
+         "set root=(tftp)")
        ((or #f (? string?))
         #~(format #f "search --file --set ~a" #$file)))))

 (define* (grub-configuration-file config entries
                                  #:key
+                                  (locale #f)
                                  (system (%current-system))
                                  (old-entries '())
+                                  (store-crypto-devices '())
                                  store-directory-prefix)
  "Return the GRUB configuration file corresponding to CONFIG, a
 <bootloader-configuration> object, and where the store is available at
 STORE-FS, a <file-system> object.  OLD-ENTRIES is taken to be a list of menu
 entries corresponding to old generations of the system.
+STORE-CRYPTO-DEVICES contain the UUIDs of the encrypted units that must
+be unlocked to access the store contents.
 STORE-DIRECTORY-PREFIX may be used to specify a store prefix, as is required
 when booting a root file system on a Btrfs subvolume."
  (define all-entries
@@ -354,6 +414,21 @@ menuentry ~s {
                  (string-join (map string-join '#$modules)
                               "\n  module " 'prefix))))))

+  (define (crypto-devices)
+    (define (crypto-device->cryptomount dev)
+      (if (uuid? dev)
+          #~(format port "cryptomount -u ~a~%"
+                    ;; cryptomount only accepts UUID without the hypen.
+                    #$(string-delete #\- (uuid->string dev)))
+          ;; Other type of devices aren't implemented.
+          #~()))
+    (let ((devices (map crypto-device->cryptomount store-crypto-devices))
+          ;; XXX: Add luks2 when grub 2.06 is packaged.
+          (modules #~(format port "insmod luks~%")))
+      (if (null? devices)
+          devices
+          (cons modules devices))))
+
  (define (sugar)
    (let* ((entry (first all-entries))
           (device (menu-entry-device entry))
@@ -364,17 +439,47 @@ menuentry ~s {
                 #:store-directory-prefix store-directory-prefix
                 #:port #~port)))

+  (define locale-config
+    (let* ((entry (first all-entries))
+           (device (menu-entry-device entry))
+           (mount-point (menu-entry-device-mount-point entry))
+           (bootloader (bootloader-configuration-bootloader config))
+           (grub (bootloader-package bootloader)))
+      #~(let ((locale #$(and locale
+                             (locale-definition-source
+                              (locale-name->definition locale))))
+              (locales #$(and locale
+                              (normalize-file (grub-locale-directory grub)
+                                              mount-point
+                                              store-directory-prefix))))
+          (when locale
+            (format port "\
+# Localization configuration.
+~asearch --file --set ~a/en@quot.mo
+set locale_dir=~a
+set lang=~a~%"
+                    ;; Skip the search if there is an image, as it has already
+                    ;; been performed by eye-candy and traversing the store is
+                    ;; an expensive operation.
+                    #$(if (grub-theme-image (bootloader-theme config))
+                          "# "
+                          "")
+                    locales
+                    locales
+                    locale)))))
+
  (define keyboard-layout-config
    (let* ((layout (bootloader-configuration-keyboard-layout config))
           (grub   (bootloader-package
                    (bootloader-configuration-bootloader config)))
           (keymap* (and layout
                         (keyboard-layout-file layout #:grub grub)))
+           (entry (first all-entries))
+           (device (menu-entry-device entry))
+           (mount-point (menu-entry-device-mount-point entry))
           (keymap (and keymap*
-                        (if store-directory-prefix
-                            #~(string-append #$store-directory-prefix
-                                             #$keymap*)
-                            keymap*))))
+                        (normalize-file keymap* mount-point
+                                        store-directory-prefix))))
      #~(when #$keymap
          (format port "\
 insmod keylayouts
@@ -387,7 +492,9 @@ keymap ~a~%" #$keymap))))
                  "# This file was generated from your Guix configuration.  Any changes
 # will be lost upon reconfiguration.
 ")
+          #$@(crypto-devices)
          #$(sugar)
+          #$locale-config
          #$keyboard-layout-config
          (format port "
 set default=~a
@@ -485,27 +592,127 @@ fi~%"))))

 (define install-grub-efi
  #~(lambda (bootloader efi-dir mount-point)
-      ;; Install GRUB onto the EFI partition mounted at EFI-DIR, for the
-      ;; system whose root is mounted at MOUNT-POINT.
-      (let ((grub-install (string-append bootloader "/sbin/grub-install"))
-            (install-dir (string-append mount-point "/boot"))
-            ;; When installing Guix, it's common to mount EFI-DIR below
-            ;; MOUNT-POINT rather than /boot/efi on the live image.
-            (target-esp (if (file-exists? (string-append mount-point efi-dir))
-                            (string-append mount-point efi-dir)
-                            efi-dir)))
-        ;; Tell 'grub-install' that there might be a LUKS-encrypted /boot or
-        ;; root partition.
-        (setenv "GRUB_ENABLE_CRYPTODISK" "y")
-        (invoke/quiet grub-install "--boot-directory" install-dir
-                      "--bootloader-id=Guix"
-                      "--efi-directory" target-esp))))
+      ;; There is nothing useful to do when called in the context of a disk
+      ;; image generation.
+      (when efi-dir
+        ;; Install GRUB onto the EFI partition mounted at EFI-DIR, for the
+        ;; system whose root is mounted at MOUNT-POINT.
+        (let ((grub-install (string-append bootloader "/sbin/grub-install"))
+              (install-dir (string-append mount-point "/boot"))
+              ;; When installing Guix, it's common to mount EFI-DIR below
+              ;; MOUNT-POINT rather than /boot/efi on the live image.
+              (target-esp (if (file-exists? (string-append mount-point efi-dir))
+                              (string-append mount-point efi-dir)
+                              efi-dir)))
+          ;; Tell 'grub-install' that there might be a LUKS-encrypted /boot or
+          ;; root partition.
+          (setenv "GRUB_ENABLE_CRYPTODISK" "y")
+          (invoke/quiet grub-install "--boot-directory" install-dir
+                        "--bootloader-id=Guix"
+                        "--efi-directory" target-esp)))))
+
+(define (install-grub-efi-netboot subdir)
+  "Define a grub-efi-netboot bootloader installer for installation in SUBDIR,
+which is usually efi/Guix or efi/boot."
+  (let* ((system (string-split (nix-system->gnu-triplet
+                                (or (%current-target-system)
+                                    (%current-system)))
+                               #\-))
+         (arch (first system))
+         (boot-efi-link (match system
+                          ;; These are the supportend systems and the names
+                          ;; defined by the UEFI standard for removable media.
+                          (("i686" _ ...)        "/bootia32.efi")
+                          (("x86_64" _ ...)      "/bootx64.efi")
+                          (("arm" _ ...)         "/bootarm.efi")
+                          (("aarch64" _ ...)     "/bootaa64.efi")
+                          (("riscv" _ ...)       "/bootriscv32.efi")
+                          (("riscv64" _ ...)     "/bootriscv64.efi")
+                          ;; Other systems are not supported, although defined.
+                          ;; (("riscv128" _ ...) "/bootriscv128.efi")
+                          ;; (("ia64" _ ...)     "/bootia64.efi")
+                          ((_ ...)               #f)))
+         (core-efi (string-append
+                    ;; This is the arch dependent file name of GRUB, e.g.
+                    ;; i368-efi/core.efi or arm64-efi/core.efi.
+                    (match arch
+                      ("i686"    "i386")
+                      ("aarch64" "arm64")
+                      ("riscv"   "riscv32")
+                      (_         arch))
+                    "-efi/core.efi")))
+    (with-imported-modules
+     '((guix build union))
+     #~(lambda (bootloader target mount-point)
+         "Install the BOOTLOADER, which must be the package grub, as e.g.
+bootx64.efi or bootaa64.efi into SUBDIR, which is usually efi/Guix or efi/boot,
+below the directory TARGET for the system whose root is mounted at MOUNT-POINT.
+
+MOUNT-POINT is the last argument in 'guix system init /etc/config.scm mnt/point'
+or '/' for other 'guix system' commands.
+
+TARGET is the target argument given to the bootloader-configuration in
+
+(operating-system
+ (bootloader (bootloader-configuration
+              (target \"/boot\")
+              …))
+ …)
+
+TARGET is required to be an absolute directory name, usually mounted via NFS,
+and finally needs to be provided by a TFTP server as the TFTP root directory.
+
+GRUB will load tftp://server/SUBDIR/grub.cfg and this file will instruct it to
+load more files from the store like tftp://server/gnu/store/…-linux…/Image.
+
+To make this possible two symlinks will be created. The first symlink points
+relatively form MOUNT-POINT/TARGET/SUBDIR/grub.cfg to
+MOUNT-POINT/boot/grub/grub.cfg, and the second symlink points relatively from
+MOUNT-POINT/TARGET/%store-prefix to MOUNT-POINT/%store-prefix.
+
+It is important to note that these symlinks need to be relativ, as the absolute
+paths on the TFTP server side are unknown.
+
+It is also important to note that both symlinks will point outside the TFTP root
+directory and that the TARGET/%store-prefix symlink makes the whole store
+accessible via TFTP. Possibly the TFTP server must be configured
+to allow accesses outside its TFTP root directory. This may need to be
+considered for security aspects."
+         (use-modules ((guix build union) #:select (symlink-relative)))
+         (let* ((net-dir (string-append mount-point target "/"))
+                (sub-dir (string-append net-dir #$subdir "/"))
+                (store (string-append mount-point (%store-prefix)))
+                (store-link (string-append net-dir (%store-prefix)))
+                (grub-cfg (string-append mount-point "/boot/grub/grub.cfg"))
+                (grub-cfg-link (string-append sub-dir (basename grub-cfg)))
+                (boot-efi-link (string-append sub-dir #$boot-efi-link)))
+           ;; Prepare the symlink to the store.
+           (mkdir-p (dirname store-link))
+           (false-if-exception (delete-file store-link))
+           (symlink-relative store store-link)
+           ;; Prepare the symlink to the grub.cfg, which points into the store.
+           (mkdir-p (dirname grub-cfg-link))
+           (false-if-exception (delete-file grub-cfg-link))
+           (symlink-relative grub-cfg grub-cfg-link)
+           ;; Install GRUB, which refers to the grub.cfg, with support for
+           ;; encrypted partitions,
+           (setenv "GRUB_ENABLE_CRYPTODISK" "y")
+           (invoke/quiet (string-append bootloader "/bin/grub-mknetdir")
+                         (string-append "--net-directory=" net-dir)
+                         (string-append "--subdir=" #$subdir))
+           ;; Prepare the bootloader symlink, which points to core.efi of GRUB.
+           (false-if-exception (delete-file boot-efi-link))
+           (symlink #$core-efi boot-efi-link))))))



 ;;;
 ;;; Bootloader definitions.
 ;;;
+;;; For all these grub-bootloader variables the path to /boot/grub/grub.cfg
+;;; is fixed.  Inheriting and overwriting the field 'configuration-file' will
+;;; break 'guix system delete-generations', 'guix system switch-generation',
+;;; and 'guix system roll-back'.

 (define grub-bootloader
  (bootloader
@@ -516,12 +723,12 @@ fi~%"))))
   (configuration-file "/boot/grub/grub.cfg")
   (configuration-file-generator grub-configuration-file)))

-(define* grub-minimal-bootloader
+(define grub-minimal-bootloader
  (bootloader
   (inherit grub-bootloader)
   (package grub-minimal)))

-(define* grub-efi-bootloader
+(define grub-efi-bootloader
  (bootloader
   (inherit grub-bootloader)
   (installer install-grub-efi)
@@ -529,7 +736,13 @@ fi~%"))))
   (name 'grub-efi)
   (package grub-efi)))

-(define* grub-mkrescue-bootloader
+(define grub-efi-netboot-bootloader
+  (bootloader
+   (inherit grub-efi-bootloader)
+   (name 'grub-efi-netboot-bootloader)
+   (installer (install-grub-efi-netboot "efi/Guix"))))
+
+(define grub-mkrescue-bootloader
  (bootloader
   (inherit grub-efi-bootloader)
   (package grub-hybrid)))
@@ -45,7 +45,7 @@
            u-boot-wandboard-bootloader))

 (define install-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (if bootloader
        (error "Failed to install U-Boot"))))

@@ -56,74 +56,74 @@
  ;; the MLO and is expected at 0x60000.  Write both first stage ("MLO") and
  ;; second stage ("u-boot.img") images, read in BOOTLOADER directory, to the
  ;; specified DEVICE.
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((mlo (string-append bootloader "/libexec/MLO"))
            (u-boot (string-append bootloader "/libexec/u-boot.img")))
        (write-file-on-device mlo (* 256 512)
-                              device (* 256 512))
+                              image (* 256 512))
        (write-file-on-device u-boot (* 1024 512)
-                              device (* 768 512)))))
+                              image (* 768 512)))))

 (define install-allwinner-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((u-boot (string-append bootloader
                                   "/libexec/u-boot-sunxi-with-spl.bin")))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 8 1024)))))
+                              image (* 8 1024)))))

 (define install-allwinner64-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/spl/sunxi-spl.bin"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 8 1024))
+                              image (* 8 1024))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 40 1024)))))
+                              image (* 40 1024)))))

 (define install-imx-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/SPL"))
            (u-boot (string-append bootloader "/libexec/u-boot.img")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 1 1024))
+                              image (* 1 1024))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 69 1024)))))
+                              image (* 69 1024)))))

 (define install-puma-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((spl (string-append bootloader "/libexec/u-boot-spl.rksd"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device spl (stat:size (stat spl))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 512 512)))))
+                              image (* 512 512)))))

 (define install-firefly-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-rock64-rk3328-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-rockpro64-rk3399-u-boot
-  #~(lambda (bootloader device mount-point)
+  #~(lambda (bootloader root-index image)
      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
        (write-file-on-device idb (stat:size (stat idb))
-                              device (* 64 512))
+                              image (* 64 512))
        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              device (* 16384 512)))))
+                              image (* 16384 512)))))

 (define install-pinebook-pro-rk3399-u-boot install-rockpro64-rk3399-u-boot)

@@ -138,28 +138,29 @@
   (inherit extlinux-bootloader)
   (name 'u-boot)
   (package #f)
-   (installer install-u-boot)))
+   (installer #f)
+   (disk-image-installer install-u-boot)))

 (define u-boot-beaglebone-black-bootloader
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-am335x-boneblack)
-   (installer install-beaglebone-black-u-boot)))
+   (disk-image-installer install-beaglebone-black-u-boot)))

 (define u-boot-allwinner-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-allwinner-u-boot)))
+   (disk-image-installer install-allwinner-u-boot)))

 (define u-boot-allwinner64-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-allwinner64-u-boot)))
+   (disk-image-installer install-allwinner64-u-boot)))

 (define u-boot-imx-bootloader
  (bootloader
   (inherit u-boot-bootloader)
-   (installer install-imx-u-boot)))
+   (disk-image-installer install-imx-u-boot)))

 (define u-boot-nintendo-nes-classic-edition-bootloader
  (bootloader
@@ -196,7 +197,7 @@
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-firefly-rk3399)
-   (installer install-firefly-rk3399-u-boot)))
+   (disk-image-installer install-firefly-rk3399-u-boot)))

 (define u-boot-mx6cuboxi-bootloader
  (bootloader
@@ -232,25 +233,25 @@
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-puma-rk3399)
-   (installer install-puma-rk3399-u-boot)))
+   (disk-image-installer install-puma-rk3399-u-boot)))

 (define u-boot-rock64-rk3328-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-rock64-rk3328)
-   (installer install-rock64-rk3328-u-boot)))
+   (disk-image-installer install-rock64-rk3328-u-boot)))

 (define u-boot-rockpro64-rk3399-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-rockpro64-rk3399)
-   (installer install-rockpro64-rk3399-u-boot)))
+   (disk-image-installer install-rockpro64-rk3399-u-boot)))

 (define u-boot-pinebook-pro-rk3399-bootloader
  ;; SD and eMMC use the same format
  (bootloader
   (inherit u-boot-bootloader)
   (package u-boot-pinebook-pro-rk3399)
-   (installer install-pinebook-pro-rk3399-u-boot)))
+   (disk-image-installer install-pinebook-pro-rk3399-u-boot)))
@@ -22,6 +22,8 @@
  #:use-module (guix utils)
  #:use-module (ice-9 binary-ports)
  #:use-module (ice-9 format)
+  #:use-module (rnrs io ports)
+  #:use-module (rnrs io simple)
  #:export (write-file-on-device
            install-efi-loader))

@@ -35,11 +37,17 @@
  (call-with-input-file file
    (lambda (input)
      (let ((bv (get-bytevector-n input size)))
-        (call-with-output-file device
-          (lambda (output)
-            (seek output offset SEEK_SET)
-            (put-bytevector output bv))
-          #:binary #t)))))
+        (call-with-port
+         ;; Do not use "call-with-output-file" that would truncate the file.
+         (open-file-output-port device
+                                (file-options no-truncate no-fail)
+                                (buffer-mode block)
+                                ;; Use the binary-friendly ISO-8859-1
+                                ;; encoding.
+                                (make-transcoder (latin-1-codec)))
+         (lambda (output)
+           (seek output offset SEEK_SET)
+           (put-bytevector output bv)))))))


 ;;;
@@ -0,0 +1,192 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Marius Bakke <marius@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build chromium-extension)
+  #:use-module (gcrypt base16)
+  #:use-module ((gcrypt hash) #:prefix hash:)
+  #:use-module (ice-9 iconv)
+  #:use-module (guix gexp)
+  #:use-module (guix packages)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages check)
+  #:use-module (gnu packages chromium)
+  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages tls)
+  #:use-module (gnu packages xorg)
+  #:use-module (guix build-system trivial)
+  #:export (make-chromium-extension))
+
+;;; Commentary:
+;;;
+;;; Tools to deal with Chromium extensions.
+;;;
+;;; Code:
+
+(define (make-signing-key seed)
+  "Return a derivation for a deterministic PKCS #8 private key using SEED."
+
+  (define sha256sum
+    (bytevector->base16-string (hash:sha256 (string->bytevector seed "UTF-8"))))
+
+  ;; certtool.c wants a 56 byte seed for a 2048 bit key.
+  (define size 2048)
+  (define normalized-seed (string-take sha256sum 56))
+
+  (computed-file (string-append seed "-signing-key.pem")
+                 #~(system* #$(file-append gnutls "/bin/certtool")
+                            "--generate-privkey"
+                            "--key-type=rsa"
+                            "--pkcs8"
+                            ;; Use the provable FIPS-PUB186-4 algorithm for
+                            ;; deterministic results.
+                            "--provable"
+                            "--password="
+                            "--no-text"
+                            (string-append "--bits=" #$(number->string size))
+                            (string-append "--seed=" #$normalized-seed)
+                            "--outfile" #$output)
+                 #:local-build? #t))
+
+(define* (make-crx signing-key package #:optional (package-output "out"))
+  "Create a signed \".crx\" file from the unpacked Chromium extension residing
+in PACKAGE-OUTPUT of PACKAGE.  The extension will be signed with SIGNING-KEY."
+  (define name (package-name package))
+  (define version (package-version package))
+
+  (with-imported-modules '((guix build utils))
+    (computed-file
+     (string-append name "-" version ".crx")
+     #~(begin
+         ;; This is not great.  We pull Xorg and Chromium just to Zip and
+         ;; sign an extension.  This should be implemented with something
+         ;; lighter.  (TODO: where is the CRXv3 documentation..?)
+         (use-modules (guix build utils))
+         (let ((chromium #$(file-append ungoogled-chromium "/bin/chromium"))
+               (xvfb #$(file-append xorg-server "/bin/Xvfb"))
+               (packdir "/tmp/extension"))
+           (mkdir-p (dirname packdir))
+           (copy-recursively (ungexp package package-output) packdir)
+           (system (string-append xvfb " :1 &"))
+           (setenv "DISPLAY" ":1")
+           (sleep 2)                    ;give Xorg some time to initialize...
+           ;; Chromium stores the current time in the .crx Zip archive.
+           ;; Use a fixed timestamp for deterministic behavior.
+           ;; FIXME (core-updates): faketime is missing an absolute reference
+           ;; to 'date', hence the need to set PATH.
+           (setenv "PATH" #$(file-append coreutils "/bin"))
+           (invoke #$(file-append libfaketime "/bin/faketime")
+                   "2000-01-01 00:00:00"
+                   chromium
+                   "--user-data-dir=/tmp/signing-profile"
+                   (string-append "--pack-extension=" packdir)
+                   (string-append "--pack-extension-key=" #$signing-key))
+           (copy-file (string-append packdir ".crx") #$output)))
+     #:local-build? #t)))
+
+(define* (crx->chromium-json crx version)
+  "Return a derivation that creates a Chromium JSON settings file for the
+extension given as CRX.  VERSION is used to signify the CRX version, and
+must match the version listed in the extension manifest.json."
+  ;; See chrome/browser/extensions/external_provider_impl.cc and
+  ;; extensions/common/extension.h for documentation on the JSON format.
+  (computed-file "extension.json"
+                 #~(call-with-output-file #$output
+                     (lambda (port)
+                       (format port "{
+  \"external_crx\": \"~a\",
+  \"external_version\": \"~a\"
+}
+"
+                               #$crx #$version)))
+                 #:local-build? #t))
+
+
+(define (signing-key->public-der key)
+  "Return a derivation for a file containing the public key of KEY in DER
+format."
+  (computed-file "der"
+                 #~(system* #$(file-append gnutls "/bin/certtool")
+                            "--load-privkey" #$key
+                            "--pubkey-info"
+                            "--outfile" #$output
+                            "--outder")
+                 #:local-build? #t))
+
+(define (chromium-json->profile-object json signing-key)
+  "Return a derivation that installs JSON to the directory searched by
+Chromium, using a file name (aka extension ID) derived from SIGNING-KEY."
+  (define der (signing-key->public-der signing-key))
+
+  (with-extensions (list guile-gcrypt)
+    (with-imported-modules '((guix build utils))
+      (computed-file
+       "chromium-extension"
+       #~(begin
+           (use-modules (guix build utils)
+                        (gcrypt base16)
+                        (gcrypt hash))
+           (define (base16-string->chromium-base16 str)
+             ;; Translate STR, a hexadecimal string, to a Chromium-style
+             ;; representation using the letters a-p (where a=0, p=15).
+             (define s1 "0123456789abcdef")
+             (define s2 "abcdefghijklmnop")
+             (let loop ((chars (string->list str))
+                        (converted '()))
+               (if (null? chars)
+                   (list->string (reverse converted))
+                   (loop (cdr chars)
+                         (cons (string-ref s2 (string-index s1 (car chars)))
+                               converted)))))
+
+           (let* ((checksum (bytevector->base16-string (file-sha256 #$der)))
+                  (file-name (base16-string->chromium-base16
+                              (string-take checksum 32)))
+                  (extension-directory (string-append #$output
+                                                      "/share/chromium/extensions")))
+             (mkdir-p extension-directory)
+             (symlink #$json (string-append extension-directory "/"
+                                            file-name ".json"))))
+       #:local-build? #t))))
+
+(define* (make-chromium-extension p #:optional (output "out"))
+  "Create a Chromium extension from package P and return a package that,
+when installed, will make the extension contained in P available as a
+Chromium browser extension.  OUTPUT specifies which output of P to use."
+  (let* ((pname (package-name p))
+         (version (package-version p))
+         (signing-key (make-signing-key pname)))
+    (package
+      (inherit p)
+      (name (string-append pname "-chromium"))
+      (source #f)
+      (build-system trivial-build-system)
+      (native-inputs '())
+      (inputs
+       `(("extension" ,(chromium-json->profile-object
+                        (crx->chromium-json (make-crx signing-key p output)
+                                            version)
+                        signing-key))))
+      (propagated-inputs '())
+      (outputs '("out"))
+      (arguments
+       '(#:modules ((guix build utils))
+         #:builder
+         (begin
+           (use-modules (guix build utils))
+           (copy-recursively (assoc-ref %build-inputs "extension")
+                             (assoc-ref %outputs "out"))))))))
@@ -1,9 +1,9 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2014, 2015, 2016, 2017, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014, 2015, 2016, 2017, 2018, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2016, 2017 David Craven <david@craven.ch>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
-;;; Copyright © 2019 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 David C. Trudgian <dave@trudgian.net>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;;
@@ -179,6 +179,100 @@ if DEVICE does not contain an ext2 file system."
    (2 'reboot-required)
    (_ 'fatal-error)))

+
+;;;
+;;; Linux swap.
+;;;
+
+;; Linux "swap space" is not a file system but it has a UUID and volume name,
+;; like actual file systems, and we want to be able to look up swap partitions
+;; by UUID and by label.
+
+(define %linux-swap-magic
+  (string->utf8 "SWAPSPACE2"))
+
+;; Like 'PAGE_SIZE' in Linux, arch/x86/include/asm/page.h.
+;; XXX: This is always 4K on x86_64, i386, and ARMv7.  However, on AArch64,
+;; this is determined by 'CONFIG_ARM64_PAGE_SHIFT' in the kernel, which is 12
+;; by default (4K) but can be 14 or 16.
+(define %page-size 4096)
+
+(define (linux-swap-superblock? sblock)
+  "Return #t when SBLOCK is an linux-swap superblock."
+  (and (= (bytevector-length sblock) %page-size)
+       (bytevector=? (sub-bytevector sblock (- %page-size 10) 10)
+                     %linux-swap-magic)))
+
+(define (read-linux-swap-superblock device)
+  "Return the raw contents of DEVICE's linux-swap superblock as a bytevector, or #f
+if DEVICE does not contain an linux-swap file system."
+  (read-superblock device 0 %page-size linux-swap-superblock?))
+
+;; See 'union swap_header' in 'include/linux/swap.h'.
+
+(define (linux-swap-superblock-uuid sblock)
+  "Return the UUID of Linux-swap superblock SBLOCK as a 16-byte bytevector."
+  (sub-bytevector sblock (+ 1024 4 4 4) 16))
+
+(define (linux-swap-superblock-volume-name sblock)
+  "Return the label of Linux-swap superblock SBLOCK as a string."
+  (null-terminated-latin1->string
+   (sub-bytevector sblock (+ 1024 4 4 4 16) 16)))
+
+
+;;;
+;;; Bcachefs file systems.
+;;;
+
+;; <https://evilpiepirate.org/git/bcachefs-tools.git/tree/libbcachefs/bcachefs_format.h>
+
+(define-syntax %bcachefs-endianness
+  ;; Endianness of bcachefs file systems.
+  (identifier-syntax (endianness little)))
+
+(define (bcachefs-superblock? sblock)
+  "Return #t when SBLOCK is an bcachefs superblock."
+  (bytevector=? (sub-bytevector sblock 24 16)
+                #vu8(#xc6 #x85 #x73 #xf6 #x4e #x1a #x45 #xca
+                     #x82 #x65 #xf5 #x7f #x48 #xba #x6d #x81)))
+
+(define (read-bcachefs-superblock device)
+  "Return the raw contents of DEVICE's bcachefs superblock as a bytevector, or #f
+if DEVICE does not contain a bcachefs file system."
+  ;; We completely ignore the back-up superblock & any checksum errors.
+  ;; Superblock field names, with offset & length respectively, in bytes:
+  ;;  0 16 bch_csum
+  ;; 16  8 version
+  ;; 24 16 magic
+  ;; 40 16 uuid ← ‘internal UUID’, you probably don't want this
+  ;; 56 16 user_uuid ← ‘external UUID’, the one by which to mount
+  ;; 72 32 label
+  ;; … there are more & the superblock is extensible, but we don't care yet.
+  (read-superblock device 4096 104 bcachefs-superblock?))
+
+(define (bcachefs-superblock-external-uuid sblock)
+  "Return the external UUID of bcachefs superblock SBLOCK as a 16-byte
+bytevector."
+  (sub-bytevector sblock 56 16))
+
+(define (bcachefs-superblock-volume-name sblock)
+  "Return the volume name of SBLOCK as a string of at most 32 characters, or
+#f if SBLOCK has no volume name."
+  (null-terminated-latin1->string (sub-bytevector sblock 72 32)))
+
+(define (check-bcachefs-file-system device)
+  "Return the health of a bcachefs file system on DEVICE."
+  (let ((ignored-bits (logior 2))       ; DEVICE was mounted read-only
+        (status
+         (status:exit-val
+          (apply system* "bcachefs" "fsck" "-p" "-v"
+                 ;; Make each multi-device member a separate argument.
+                 (string-split device #\:)))))
+    (match (logand (lognot ignored-bits) status)
+      (0 'pass)
+      (1 'errors-corrected)
+      (_ 'fatal-error))))
+

 ;;;
 ;;; Btrfs file systems.
@@ -596,6 +690,10 @@ partition field reader that returned a value."
                                iso9660-superblock-volume-name)
        (partition-field-reader read-ext2-superblock
                                ext2-superblock-volume-name)
+        (partition-field-reader read-linux-swap-superblock
+                                linux-swap-superblock-volume-name)
+        (partition-field-reader read-bcachefs-superblock
+                                bcachefs-superblock-volume-name)
        (partition-field-reader read-btrfs-superblock
                                btrfs-superblock-volume-name)
        (partition-field-reader read-fat32-superblock
@@ -612,6 +710,10 @@ partition field reader that returned a value."
                                iso9660-superblock-uuid)
        (partition-field-reader read-ext2-superblock
                                ext2-superblock-uuid)
+        (partition-field-reader read-linux-swap-superblock
+                                linux-swap-superblock-uuid)
+        (partition-field-reader read-bcachefs-superblock
+                                bcachefs-superblock-external-uuid)
        (partition-field-reader read-btrfs-superblock
                                btrfs-superblock-uuid)
        (partition-field-reader read-fat32-superblock
@@ -675,7 +777,8 @@ were found."

 (define (canonicalize-device-spec spec)
  "Return the device name corresponding to SPEC, which can be a <uuid>, a
-<file-system-label>, or a string (typically a /dev file name)."
+<file-system-label>, or a string (typically a /dev file name or an nfs-root
+containing ':/')."
  (define max-trials
    ;; Number of times we retry partition label resolution, 1 second per
    ;; trial.  Note: somebody reported a delay of 16 seconds (!) before their
@@ -718,6 +821,7 @@ were found."
  (define check-procedure
    (cond
     ((string-prefix? "ext" type) check-ext2-file-system)
+     ((string-prefix? "bcachefs" type) check-bcachefs-file-system)
     ((string-prefix? "btrfs" type) check-btrfs-file-system)
     ((string-suffix? "fat" type) check-fat-file-system)
     ((string-prefix? "jfs" type) check-jfs-file-system)
@@ -211,6 +211,9 @@ set."
      ("dev/vcs"     ("/hurd/console"))
      ("dev/tty"     ("/hurd/magic"    "tty")               #o666)

+      ;; 'fd_to_filename' in libc expects it.
+      ("dev/fd"      ("/hurd/magic"    "--directory" "fd")  #o555)
+
      ("dev/tty1"    ("/hurd/term"     "/dev/tty1" "hurdio" "/dev/vcs/1/console")
                                                            #o666)
      ("dev/tty2"    ("/hurd/term"     "/dev/tty2" "hurdio" "/dev/vcs/2/console")
@@ -240,10 +243,10 @@ set."
  (for-each scope-set-translator devices)

  (false-if-EEXIST (symlink "/dev/random" (scope "dev/urandom")))
-  (mkdir* "dev/fd")
  (false-if-EEXIST (symlink "/dev/fd/0" (scope "dev/stdin")))
  (false-if-EEXIST (symlink "/dev/fd/1" (scope "dev/stdout")))
  (false-if-EEXIST (symlink "/dev/fd/2" (scope "dev/stderr")))
+  (false-if-EEXIST (symlink "crash-dump-core" (scope "servers/crash")))

  ;; Make sure /etc/mtab is a symlink to /proc/mounts.
  (false-if-exception (delete-file (scope "etc/mtab")))
@@ -37,6 +37,7 @@
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:export (make-partition-image
+            convert-disk-image
            genimage
            initialize-efi-partition
            initialize-root-partition
@@ -117,36 +118,39 @@ ROOT directory to populate the image."
     ((string=? type "vfat")
      (make-vfat-image partition target root))
     (else
-      (format (current-error-port)
-              "Unsupported partition type~%.")))))
+      (raise (condition
+              (&message
+               (message "unsupported partition type"))))))))

-(define* (genimage config target)
+(define (convert-disk-image image format output)
+  "Convert IMAGE to OUTPUT according to the given FORMAT."
+  (case format
+    ((compressed-qcow2)
+     (invoke "qemu-img" "convert" "-c" "-f" "raw"
+             "-O" "qcow2" image output))
+    (else
+     (copy-file image output))))
+
+(define* (genimage config)
  "Use genimage to generate in TARGET directory, the image described in the
 given CONFIG file."
  ;; genimage needs a 'root' directory.
  (mkdir "root")
-  (invoke "genimage" "--config" config
-          "--outputpath" target))
+  (invoke "genimage" "--config" config))

 (define* (register-closure prefix closure
                           #:key
-                           (deduplicate? #t) (reset-timestamps? #t)
                           (schema (sql-schema))
                           (wal-mode? #t))
  "Register CLOSURE in PREFIX, where PREFIX is the directory name of the
 target store and CLOSURE is the name of a file containing a reference graph as
-produced by #:references-graphs..  As a side effect, if RESET-TIMESTAMPS? is
-true, reset timestamps on store files and, if DEDUPLICATE? is true,
-deduplicates files common to CLOSURE and the rest of PREFIX.  Pass WAL-MODE?
-to call-with-database."
+produced by #:references-graphs.  Pass WAL-MODE? to call-with-database."
  (let ((items (call-with-input-file closure read-reference-graph)))
    (parameterize ((sql-schema schema))
      (with-database (store-database-file #:prefix prefix) db
       #:wal-mode? wal-mode?
       (register-items db items
                       #:prefix prefix
-                       #:deduplicate? deduplicate?
-                       #:reset-timestamps? reset-timestamps?
                       #:registration-time %epoch)))))

 (define* (initialize-efi-partition root
@@ -178,7 +182,8 @@ rest of the store when registering the closures.  SYSTEM-DIRECTORY is the name
 of the directory of the 'system' derivation.  Pass WAL-MODE? to
 register-closure."
  (populate-root-file-system system-directory root)
-  (populate-store references-graphs root)
+  (populate-store references-graphs root
+                  #:deduplicate? deduplicate?)

  ;; Populate /dev.
  (when make-device-nodes
@@ -186,10 +191,7 @@ register-closure."

  (when register-closures?
    (for-each (lambda (closure)
-                (register-closure root
-                                  closure
-                                  #:reset-timestamps? #t
-                                  #:deduplicate? deduplicate?
+                (register-closure root closure
                                  #:wal-mode? wal-mode?))
              references-graphs))

@@ -18,6 +18,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu build install)
+  #:use-module (guix build syscalls)
  #:use-module (guix build utils)
  #:use-module (guix build store-copy)
  #:use-module (srfi srfi-26)
@@ -26,7 +27,9 @@
            evaluate-populate-directive
            populate-root-file-system
            install-database-and-gc-roots
-            populate-single-profile-directory))
+            populate-single-profile-directory
+            mount-cow-store
+            unmount-cow-store))

 ;;; Commentary:
 ;;;
@@ -211,7 +214,8 @@ This is used to create the self-contained tarballs with 'guix pack'."
    (symlink old (scope new)))

  ;; Populate the store.
-  (populate-store (list closure) directory)
+  (populate-store (list closure) directory
+                  #:deduplicate? #f)

  (when database
    (install-database-and-gc-roots directory database profile
@@ -229,4 +233,43 @@ This is used to create the self-contained tarballs with 'guix pack'."
    (_
     #t)))

+(define (mount-cow-store target backing-directory)
+  "Make the store copy-on-write, using TARGET as the backing store.  This is
+useful when TARGET is on a hard disk, whereas the current store is on a RAM
+disk."
+  (define (set-store-permissions directory)
+    "Set the right perms on DIRECTORY to use it as the store."
+    (chown directory 0 30000)      ;use the fixed 'guixbuild' GID
+    (chmod directory #o1775))
+
+  (let ((tmpdir (string-append target "/tmp")))
+    (mkdir-p tmpdir)
+    (mount tmpdir "/tmp" "none" MS_BIND))
+
+  (let* ((rw-dir (string-append target backing-directory))
+         (work-dir (string-append rw-dir "/../.overlayfs-workdir")))
+    (mkdir-p rw-dir)
+    (mkdir-p work-dir)
+    (mkdir-p "/.rw-store")
+    (set-store-permissions rw-dir)
+    (set-store-permissions "/.rw-store")
+
+    ;; Mount the overlay, then atomically make it the store.
+    (mount "none" "/.rw-store" "overlay" 0
+           (string-append "lowerdir=" (%store-directory) ","
+                          "upperdir=" rw-dir ","
+                          "workdir=" work-dir))
+    (mount "/.rw-store" (%store-directory) "" MS_MOVE)
+    (rmdir "/.rw-store")))
+
+(define (unmount-cow-store target backing-directory)
+  "Unmount copy-on-write store."
+  (let ((tmp-dir "/remove"))
+    (mkdir-p tmp-dir)
+    (mount (%store-directory) tmp-dir "" MS_MOVE)
+    (umount tmp-dir)
+    (rmdir tmp-dir)
+    (delete-file-recursively
+     (string-append target backing-directory))))
+
 ;;; install.scm ends here
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2016, 2017, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
 ;;;
@@ -110,6 +111,58 @@ OPTION doesn't appear in ARGUMENTS."
                       (substring arg (+ 1 (string-index arg #\=)))))
                arguments)))

+(define (resume-if-hibernated device)
+  "Resume from hibernation if possible.  This is safe ONLY if no on-disk file
+systems have been mounted; calling it later risks severe file system corruption!
+See <Documentation/swsusp.txt> in the kernel source directory.  This is the
+caller's responsibility, as is catching exceptions if resumption was supposed to
+happen but didn't.
+
+Resume only from DEVICE if it's a string.  If it's #f, use the kernel's default
+hibernation device (CONFIG_PM_STD_PARTITION).  Never return if resumption
+succeeds.  Return nothing otherwise.  The kernel logs any details to dmesg."
+
+  (define (string->major:minor string)
+    "Return a string with MAJOR:MINOR numbers of the device specified by STRING"
+
+    ;; The "resume=" kernel command-line option always provides a string, which
+    ;; can represent a device, a UUID, or a label.  Check for all three.
+    (let* ((spec (cond ((string-prefix? "/" string) string)
+                       ((uuid string) => identity)
+                       (else (file-system-label string))))
+           ;; XXX The kernel's swsusp_resume_can_resume() waits if ‘resumewait’
+           ;; is found on the command line; our canonicalize-device-spec gives
+           ;; up after 20 seconds.  We could emulate the former by looping…
+           (device (canonicalize-device-spec spec))
+           (rdev (stat:rdev (stat device)))
+           ;; For backwards compatibility, device numbering is a baroque affair.
+           ;; This is the full 64-bit scheme used by glibc's <sys/sysmacros.h>.
+           (major (logior (ash (logand #x00000000000fff00 rdev) -8)
+                          (ash (logand #xfffff00000000000 rdev) -32)))
+           (minor (logior      (logand #x00000000000000ff rdev)
+                          (ash (logand #x00000ffffff00000 rdev) -12))))
+      (format #f "~a:~a" major minor)))
+
+  ;; Write the resume DEVICE to this magic file, using the MAJOR:MINOR device
+  ;; numbers if possible.  The kernel will immediately try to resume from it.
+  (let ((resume "/sys/power/resume"))
+    (when (file-exists? resume)         ; this kernel supports hibernation
+      ;; Honour the kernel's default device (only) if none other was given.
+      (let ((major:minor (if device
+                             (or (false-if-exception (string->major:minor
+                                                      device))
+                                 ;; We can't parse it.  Maybe the kernel can.
+                                 device)
+                             (let ((default (call-with-input-file resume
+                                              read-line)))
+                               ;; Don't waste time echoing 0:0 to /sys.
+                               (if (string=? "0:0" default)
+                                   #f
+                                   default)))))
+        (when major:minor
+          (call-with-output-file resume ; may throw an ‘Invalid argument’
+            (cut display major:minor <>))))))) ; may never return
+
 (define* (make-disk-device-nodes base major #:optional (minor 0))
  "Make the block device nodes around BASE (something like \"/root/dev/sda\")
 with the given MAJOR number, starting with MINOR."
@@ -469,9 +522,10 @@ upon error."

  (define (device-string->file-system-device device-string)
    ;; The "--root=SPEC" kernel command-line option always provides a
-    ;; string, but the string can represent a device, a UUID, or a
-    ;; label.  So check for all three.
+    ;; string, but the string can represent a device, an nfs-root, a UUID, or a
+    ;; label.  So check for all four.
    (cond ((string-prefix? "/" device-string) device-string)
+          ((string-contains device-string ":/") device-string) ; nfs-root
          ((uuid device-string) => identity)
          (else (file-system-label device-string))))

@@ -506,6 +560,15 @@ upon error."
        (load-linux-modules-from-directory linux-modules
                                           linux-module-directory)

+        (unless (or (member "hibernate=noresume" args)
+                    ;; Also handle the equivalent old-style argument.
+                    ;; See Documentation/admin-guide/kernel-parameters.txt.
+                    (member "noresume" args))
+          ;; Try to resume immediately after loading (storage) modules
+          ;; but before any on-disk file systems have been mounted.
+          (false-if-exception           ; failure is not fatal
+           (resume-if-hibernated (find-long-option "resume" args))))
+
        (when keymap-file
          (let ((status (system* "loadkeys" keymap-file)))
            (unless (zero? status)
@@ -170,7 +170,8 @@ for the process."
    (pivot-root root put-old)
    (chdir "/")
    (umount "real-root" MNT_DETACH)
-    (rmdir "real-root")))
+    (rmdir "real-root")
+    (chmod "/" #o755)))

 (define* (initialize-user-namespace pid host-uids
                                    #:key (guest-uid 0) (guest-gid 0))
@@ -243,7 +244,8 @@ that host UIDs (respectively GIDs) map to in the namespace."
             (match (read child)
               ('ready
                (purify-environment)
-                (when (memq 'mnt namespaces)
+                (when (and (memq 'mnt namespaces)
+                           (not (string=? root "/")))
                  (catch #t
                    (lambda ()
                      (mount-file-systems root mounts
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013, 2014, 2015, 2018 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2014, 2015, 2018, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -39,8 +39,9 @@
                             #:key
                             (compress? #t)
                             (gzip "gzip"))
-  "Write a cpio archive containing DIRECTORY to file OUTPUT.  When
-COMPRESS? is true, compress it using GZIP.  On success, return OUTPUT."
+  "Write a cpio archive containing DIRECTORY to file OUTPUT, with reset
+timestamps in the archive.  When COMPRESS? is true, compress it using GZIP.
+On success, return OUTPUT."

  ;; Note: as per `ramfs-rootfs-initramfs.txt', always add directory entries
  ;; before the files that are inside of it: "The Linux kernel cpio
@@ -126,7 +127,8 @@ REFERENCES-GRAPHS."
  (mkdir "contents")

  ;; Copy the closures of all the items referenced in REFERENCES-GRAPHS.
-  (populate-store references-graphs "contents")
+  (populate-store references-graphs "contents"
+                  #:deduplicate? #f)

  (with-directory-excursion "contents"
    ;; Make '/init'.
@@ -141,12 +143,6 @@ REFERENCES-GRAPHS."
    (symlink (string-append guile "/bin/guile") "proc/self/exe")
    (readlink "proc/self/exe")

-    ;; Reset the timestamps of all the files that will make it in the initrd.
-    (for-each (lambda (file)
-                (unless (eq? 'symlink (stat:type (lstat file)))
-                  (utime file 0 0 0 0)))
-              (find-files "." ".*"))
-
    (write-cpio-archive output "." #:gzip gzip))

  ;; Make sure directories are writable so we can delete files.
@@ -0,0 +1,190 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu build secret-service)
+  #:use-module (guix build utils)
+
+  #:use-module (srfi srfi-26)
+  #:use-module (rnrs bytevectors)
+  #:use-module (ice-9 binary-ports)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 rdelim)
+
+  #:export (secret-service-receive-secrets
+            secret-service-send-secrets))
+
+;;; Commentary:
+;;;
+;;; Utility procedures for copying secrets into a VM.
+;;;
+;;; Code:
+
+(define-syntax log
+  (lambda (s)
+    "Log the given message."
+    (syntax-case s ()
+      ((_ fmt args ...)
+       (with-syntax ((fmt (string-append "secret service: "
+                                         (syntax->datum #'fmt))))
+         ;; Log to the current output port.  That way, when
+         ;; 'secret-service-send-secrets' is called from shepherd, output goes
+         ;; to syslog.
+         #'(format (current-output-port) fmt args ...))))))
+
+(define* (secret-service-send-secrets port secret-root
+                                      #:key (retry 60)
+                                      (handshake-timeout 120))
+  "Copy all files under SECRET-ROOT using TCP to secret-service listening at
+local PORT.  If connect fails, sleep 1s and retry RETRY times; once connected,
+wait for at most HANDSHAKE-TIMEOUT seconds for handshake to complete.  Return
+#f on failure."
+  (define (file->file+size+mode file-name)
+    (let ((stat (stat file-name))
+          (target (substring file-name (string-length secret-root))))
+      (list target (stat:size stat) (stat:mode stat))))
+
+  (define (send-files sock)
+    (let* ((files (if secret-root (find-files secret-root) '()))
+           (files-sizes-modes (map file->file+size+mode files))
+           (secrets `(secrets
+                      (version 0)
+                      (files ,files-sizes-modes))))
+      (write secrets sock)
+      (for-each (lambda (file)
+                  (call-with-input-file file
+                    (lambda (input)
+                      (dump-port input sock))))
+                files)))
+
+  (log "sending secrets to ~a~%" port)
+  (let ((sock (socket AF_INET SOCK_STREAM 0))
+        (addr (make-socket-address AF_INET INADDR_LOOPBACK port)))
+    ;; Connect to QEMU on the forwarded port.  The 'connect' call succeeds as
+    ;; soon as QEMU is ready, even if there's no server listening on the
+    ;; forward port inside the guest.
+    (let loop ((retry retry))
+      (catch 'system-error
+        (cute connect sock addr)
+        (lambda (key . args)
+          (when (zero? retry)
+            (apply throw key args))
+          (log "retrying connection [~a attempts left]~%"
+               (- retry 1))
+          (sleep 1)
+          (loop (1- retry)))))
+
+    (log "connected; waiting for handshake...~%")
+
+    ;; Wait for "hello" message from the server.  This is the only way to know
+    ;; that we're really connected to the server inside the guest.
+    (match (select (list sock) '() '() handshake-timeout)
+      (((_) () ())
+       (match (read sock)
+         (('secret-service-server ('version version ...))
+          (log "sending files from ~s...~%" secret-root)
+          (send-files sock)
+          (log "done sending files to port ~a~%" port)
+          (close-port sock)
+          secret-root)
+         (x
+          (log "invalid handshake ~s~%" x)
+          (close-port sock)
+          #f)))
+      ((() () ())                                 ;timeout
+       (log "timeout while sending files to ~a~%" port)
+       (close-port sock)
+       #f))))
+
+(define (secret-service-receive-secrets port)
+  "Listen to local PORT and wait for a secret service client to send secrets.
+Write them to the file system.  Return the list of files installed on success,
+and #f otherwise."
+
+  (define (wait-for-client port)
+    ;; Wait for a TCP connection on PORT.  Note: We cannot use the
+    ;; virtio-serial ports, which would be safer, because they are
+    ;; (presumably) unsupported on GNU/Hurd.
+    (let ((sock (socket AF_INET SOCK_STREAM 0)))
+      (bind sock AF_INET INADDR_ANY port)
+      (listen sock 1)
+      (log "waiting for secrets on port ~a...~%" port)
+      (match (select (list sock) '() '() 60)
+        (((_) () ())
+         (match (accept sock)
+           ((client . address)
+            (log "client connection from ~a~%"
+                 (inet-ntop (sockaddr:fam address)
+                            (sockaddr:addr address)))
+
+            ;; Send a "hello" message.  This allows the client running on the
+            ;; host to know that it's now actually connected to server running
+            ;; in the guest.
+            (write '(secret-service-server (version 0)) client)
+            (force-output client)
+            (close-port sock)
+            client)))
+        ((() () ())
+         (log "did not receive any secrets; time out~%")
+         (close-port sock)
+         #f))))
+
+  ;; TODO: Remove when (@ (guix build utils) dump-port) has a 'size'
+  ;; parameter.
+  (define (dump in out size)
+    ;; Copy SIZE bytes from IN to OUT.
+    (define buf-size 65536)
+    (define buf (make-bytevector buf-size))
+
+    (let loop ((left size))
+      (if (<= left 0)
+          0
+          (let ((read (get-bytevector-n! in buf 0 (min left buf-size))))
+            (if (eof-object? read)
+                left
+                (begin
+                  (put-bytevector out buf 0 read)
+                  (loop (- left read))))))))
+
+  (define (read-secrets port)
+    ;; Read secret files from PORT and install them.
+    (match (false-if-exception (read port))
+      (('secrets ('version 0)
+                 ('files ((files sizes modes) ...)))
+       (for-each (lambda (file size mode)
+                   (log "installing file '~a' (~a bytes)...~%"
+                        file size)
+                   (mkdir-p (dirname file))
+                   (call-with-output-file file
+                     (lambda (output)
+                       (dump port output size)
+                       (chmod file mode))))
+                 files sizes modes)
+       (log "received ~a secret files~%" (length files))
+       files)
+      (_
+       (log "invalid secrets received~%")
+       #f)))
+
+  (let* ((port   (wait-for-client port))
+         (result (and=> port read-secrets)))
+    (when port
+      (close-port port))
+    result))
+
+;;; secret-service.scm ends here
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Mathieu Othacehe <othacehe@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -23,7 +24,8 @@
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
  #:use-module (ice-9 match)
-  #:export (make-forkexec-constructor/container))
+  #:export (make-forkexec-constructor/container
+            fork+exec-command/container))

 ;;; Commentary:
 ;;;
@@ -93,7 +95,8 @@
 ;; XXX: Lazy-bind the Shepherd to avoid a compile-time dependency.
 (module-autoload! (current-module)
                  '(shepherd service)
-                  '(read-pid-file exec-command %precious-signals))
+                  '(fork+exec-command read-pid-file exec-command
+                    %precious-signals))
 (module-autoload! (current-module)
                  '(shepherd system) '(unblock-signals))

@@ -188,6 +191,35 @@ namespace, in addition to essential bind-mounts such /proc."
              (read-pid-file pid-file #:max-delay pid-file-timeout))
          pid))))

+(define* (fork+exec-command/container command
+                                      #:key pid
+                                      #:allow-other-keys
+                                      #:rest args)
+  "This is a variant of 'fork+exec-command' procedure, that joins the
+namespaces of process PID beforehand.  If there is no support for containers,
+on Hurd systems for instance, fallback to direct forking."
+  (define (strip-pid args)
+    ;; TODO: Replace with 'strip-keyword-arguments' when that no longer pulls
+    ;; in (guix config).
+    (let loop ((args args)
+               (result '()))
+      (match args
+        (()
+         (reverse result))
+        ((#:pid _ . rest)
+         (loop rest result))
+        ((head . rest)
+         (loop rest (cons head result))))))
+
+  (let ((container-support?
+         (file-exists? "/proc/self/ns"))
+        (fork-proc (lambda ()
+                     (apply fork+exec-command command
+                            (strip-pid args)))))
+    (if container-support?
+        (container-excursion* pid fork-proc)
+        (fork-proc))))
+
 ;; Local Variables:
 ;; eval: (put 'container-excursion* 'scheme-indent-function 1)
 ;; End:
@@ -215,20 +215,15 @@ the #:references-graphs parameter of 'derivation'."

 (define* (register-closure prefix closure
                           #:key
-                           (deduplicate? #t) (reset-timestamps? #t)
                           (schema (sql-schema)))
  "Register CLOSURE in PREFIX, where PREFIX is the directory name of the
 target store and CLOSURE is the name of a file containing a reference graph as
-produced by #:references-graphs..  As a side effect, if RESET-TIMESTAMPS? is
-true, reset timestamps on store files and, if DEDUPLICATE? is true,
-deduplicates files common to CLOSURE and the rest of PREFIX."
+produced by #:references-graphs."
  (let ((items (call-with-input-file closure read-reference-graph)))
    (parameterize ((sql-schema schema))
      (with-database (store-database-file #:prefix prefix) db
        (register-items db items
                        #:prefix prefix
-                        #:deduplicate? deduplicate?
-                        #:reset-timestamps? reset-timestamps?
                        #:registration-time %epoch)))))


@@ -397,7 +392,8 @@ system that is passed to 'populate-root-file-system'."
    (when copy-closures?
      ;; Populate the store.
      (populate-store (map (cut string-append "/xchg/" <>) closures)
-                      target))
+                      target
+                      #:deduplicate? deduplicate?))

    ;; Populate /dev.
    (make-device-nodes target)
@@ -413,9 +409,7 @@ system that is passed to 'populate-root-file-system'."
      (display "registering closures...\n")
      (for-each (lambda (closure)
                  (register-closure target
-                                    (string-append "/xchg/" closure)
-                                    #:reset-timestamps? copy-closures?
-                                    #:deduplicate? deduplicate?))
+                                    (string-append "/xchg/" closure)))
                closures)
      (unless copy-closures?
        (umount target-store)))
@@ -1,7 +1,9 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2017 Jan Nieuwenhuizen <janneke@gnu.org>
+;;; Copyright © 2017, 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2018, 2019 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2020 Julien Lepiller <julien@lepiller.eu>
+;;; Copyright © 2020 Mathieu Othacehe <othacehe@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,6 +27,7 @@
  #:use-module (guix profiles)
  #:use-module (guix packages)
  #:use-module (guix channels)
+  #:use-module (guix config)
  #:use-module (guix derivations)
  #:use-module (guix build-system)
  #:use-module (guix monads)
@@ -54,6 +57,9 @@
  #:use-module (gnu system vm)
  #:use-module (gnu system install)
  #:use-module (gnu system images hurd)
+  #:use-module (gnu system images novena)
+  #:use-module (gnu system images pine64)
+  #:use-module (gnu system images pinebook-pro)
  #:use-module (gnu tests)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
@@ -73,28 +79,36 @@
                         #:optional (package-derivation package-derivation))
  "Convert PACKAGE to an alist suitable for Hydra."
  (parameterize ((%graft? #f))
-    `((derivation . ,(derivation-file-name
-                      (package-derivation store package system
-                                          #:graft? #f)))
-      (description . ,(package-synopsis package))
-      (long-description . ,(package-description package))
+    (let ((drv (package-derivation store package system
+                                   #:graft? #f)))
+      `((derivation . ,(derivation-file-name drv))
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
+        (description . ,(package-synopsis package))
+        (long-description . ,(package-description package))

-      ;; XXX: Hydra ignores licenses that are not a <license> structure or a
-      ;; list thereof.
-      (license . ,(let loop ((license (package-license package)))
-                    (match license
-                      ((? license?)
-                       (license-name license))
-                      ((lst ...)
-                       (map loop license)))))
+        ;; XXX: Hydra ignores licenses that are not a <license> structure or a
+        ;; list thereof.
+        (license . ,(let loop ((license (package-license package)))
+                      (match license
+                        ((? license?)
+                         (license-name license))
+                        ((lst ...)
+                         (map loop license)))))

-      (home-page . ,(package-home-page package))
-      (maintainers . ("bug-guix@gnu.org"))
-      (max-silent-time . ,(or (assoc-ref (package-properties package)
-                                         'max-silent-time)
-                              3600))              ;1 hour by default
-      (timeout . ,(or (assoc-ref (package-properties package) 'timeout)
-                      72000)))))                  ;20 hours by default
+        (home-page . ,(package-home-page package))
+        (maintainers . ("bug-guix@gnu.org"))
+        (max-silent-time . ,(or (assoc-ref (package-properties package)
+                                           'max-silent-time)
+                                3600))              ;1 hour by default
+        (timeout . ,(or (assoc-ref (package-properties package) 'timeout)
+                        72000))))))                  ;20 hours by default

 (define (package-job store job-name package system)
  "Return a job called JOB-NAME that builds PACKAGE on SYSTEM."
@@ -116,7 +130,7 @@ SYSTEM."
  ;; Note: Don't put the '-final' package variants because (1) that's
  ;; implicit, and (2) they cannot be cross-built (due to the explicit input
  ;; chain.)
-  (list gcc-4.8 gcc-4.9 gcc-5 glibc binutils
+  (list gcc-7 gcc-8 gcc-9 gcc-10 glibc binutils
        gmp mpfr mpc coreutils findutils diffutils patch sed grep
        gawk gnu-gettext hello guile-2.0 guile-2.2 zlib gzip xz
        %bootstrap-binaries-tarball
@@ -193,16 +207,33 @@ SYSTEM."
  '("x86_64-linux" "i686-linux"))

 (define %guix-system-images
-  (list hurd-barebones-disk-image))
+  (list hurd-barebones-qcow2-image
+        pine64-barebones-raw-image
+        pinebook-pro-barebones-raw-image
+        novena-barebones-raw-image))
+
+(define (hours hours)
+  (* 3600 hours))

 (define (image-jobs store system)
-  "Return a list of jobs that build images for SYSTEM."
+  "Return a list of jobs that build images for SYSTEM.  Those jobs are
+expensive in storage and I/O operations, hence their periodicity is limited by
+passing the PERIOD argument."
  (define (->alist drv)
    `((derivation . ,(derivation-file-name drv))
+      (log . ,(log-file store (derivation-file-name drv)))
+      (outputs . ,(filter-map (lambda (res)
+                                (match res
+                                  ((name . path)
+                                   `(,name . ,path))))
+                              (derivation->output-paths drv)))
+      (nix-name . ,(derivation-name drv))
+      (system . ,(derivation-system drv))
      (description . "Stand-alone image of the GNU system")
      (long-description . "This is a demo stand-alone image of the GNU
 system.")
      (license . ,(license-name gpl3+))
+      (period . ,(hours 48))
      (max-silent-time . 600)
      (timeout . 3600)
      (home-page . ,%guix-home-page-url)
@@ -233,7 +264,12 @@ system.")
        ,(->job 'iso9660-image
                (build-image
                 (image
-                  (inherit iso9660-image)
+                  (inherit (image-with-label
+                             iso9660-image
+                             (string-append "GUIX_" system "_"
+                                            (if (> (string-length %guix-version) 7)
+                                                (substring %guix-version 0 7)
+                                                %guix-version))))
                  (operating-system installation-os))))
        ;; Only cross-compile Guix System images from x86_64-linux for now.
        ,@(if (string=? system "x86_64-linux")
@@ -296,11 +332,23 @@ system.")
            (set-guile-for-build (default-guile))
            (system-test-value test))))

+      ;; Those tests are extremely expensive in I/O operations and storage
+      ;; size, use the "period" attribute to run them with a period of at
+      ;; least 48 hours.
      `((derivation . ,(derivation-file-name drv))
+        (log . ,(log-file store (derivation-file-name drv)))
+        (outputs . ,(filter-map (lambda (res)
+                                  (match res
+                                    ((name . path)
+                                     `(,name . ,path))))
+                                (derivation->output-paths drv)))
+        (nix-name . ,(derivation-name drv))
+        (system . ,(derivation-system drv))
        (description . ,(format #f "Guix '~a' system test"
                                (system-test-name test)))
        (long-description . ,(system-test-description test))
        (license . ,(license-name gpl3+))
+        (period . ,(hours 48))
        (max-silent-time . 600)
        (timeout . 3600)
        (home-page . ,%guix-home-page-url)
@@ -326,12 +374,21 @@ system.")
  "Return Hydra jobs to build the self-contained Guix binary tarball."
  (define (->alist drv)
    `((derivation . ,(derivation-file-name drv))
+      (log . ,(log-file store (derivation-file-name drv)))
+      (outputs . ,(filter-map (lambda (res)
+                                (match res
+                                  ((name . path)
+                                   `(,name . ,path))))
+                              (derivation->output-paths drv)))
+      (nix-name . ,(derivation-name drv))
+      (system . ,(derivation-system drv))
      (description . "Stand-alone binary Guix tarball")
      (long-description . "This is a tarball containing binaries of Guix and
 all its dependencies, and ready to be installed on \"foreign\" distributions.")
      (license . ,(license-name gpl3+))
      (home-page . ,%guix-home-page-url)
-      (maintainers . ("bug-guix@gnu.org"))))
+      (maintainers . ("bug-guix@gnu.org"))
+      (period . ,(hours 24))))

  (define (->job name drv)
    (let ((name (symbol-append name (string->symbol ".")
@@ -504,20 +561,16 @@ Return #f if no such checkout is found."
                             (cross-jobs store system)))
                    ((hello)
                     ;; Build hello package only.
-                     (if (string=? system (%current-system))
-                         (let ((hello (specification->package "hello")))
-                           (list (package-job store (job-name hello) hello system)))
-                         '()))
+                     (let ((hello (specification->package "hello")))
+                       (list (package-job store (job-name hello) hello system))))
                    ((list)
                     ;; Build selected list of packages only.
-                     (if (string=? system (%current-system))
-                         (let* ((names (assoc-ref arguments 'subset))
-                                (packages (map specification->package names)))
-                           (map (lambda (package)
-                                    (package-job store (job-name package)
-                                                 package system))
-                                  packages))
-                         '()))
+                     (let* ((names (assoc-ref arguments 'subset))
+                            (packages (map specification->package names)))
+                       (map (lambda (package)
+                              (package-job store (job-name package)
+                                           package system))
+                            packages)))
                    ((manifests)
                     ;; Build packages in the list of manifests.
                     (let* ((manifests (arguments->manifests arguments))
@@ -39,7 +39,14 @@
            image-partitions
            image-compression?
            image-volatile-root?
-            image-substitutable?))
+            image-substitutable?
+
+            image-type
+            image-type?
+            image-type-name
+            image-type-constructor
+
+            os->image))


 ;;;
@@ -84,3 +91,23 @@
                      (default #t))
  (substitutable?     image-substitutable? ;boolean
                      (default #t)))
+
+
+;;;
+;;; Image type.
+;;;
+
+(define-record-type* <image-type>
+  image-type make-image-type
+  image-type?
+  (name           image-type-name) ;symbol
+  (constructor    image-type-constructor)) ;<operating-system> -> <image>
+
+
+;;;
+;;; Image creation.
+;;;
+
+(define* (os->image os #:key type)
+  (let ((constructor (image-type-constructor type)))
+    (constructor os)))
@@ -71,7 +71,7 @@
    (_ #f)))

 (define* (build-compiled-file name locale-builder)
-  "Return a file-like object that evalutes the gexp LOCALE-BUILDER and store
+  "Return a file-like object that evaluates the gexp LOCALE-BUILDER and store
 its result in the scheme file NAME. The derivation will also build a compiled
 version of this file."
  (define set-utf8-locale
@@ -266,6 +266,13 @@ selected keymap."
          (compute (lambda _
                     ((installer-network-page current-installer)))))

+         ;; Ask whether to enable substitute server discovery.
+         (installer-step
+          (id 'substitutes)
+          (description (G_ "Substitute server discovery"))
+          (compute (lambda _
+                     ((installer-substitutes-page current-installer)))))
+
         ;; Prompt for users (name, group and home directory).
         (installer-step
          (id 'user)
@@ -308,7 +315,8 @@ selected keymap."
    ;; translated.
    #~(begin
        (bindtextdomain "guix" (string-append #$guix "/share/locale"))
-        (textdomain "guix")))
+        (textdomain "guix")
+        (setlocale LC_ALL "")))

  (define set-installer-path
    ;; Add the specified binary to PATH for later use by the installer.
@@ -180,7 +180,7 @@ Return the corresponding association list of '((KEY . VALUE) (KEY2 . VALUE2)
 (define (connman-state)
  "Return the state of connman. The nominal states are 'offline, 'idle,
 'ready, 'oneline.  If an unexpected state is read, 'unknown is
-returned. Finally, an error is raised if the comman output could not be
+returned. Finally, an error is raised if the connman output could not be
 parsed, usually because the connman daemon is not responding."
  (let* ((output (connman "state"))
         (state-keys (parse-keys output)))
@@ -26,6 +26,8 @@
  #:use-module (guix build syscalls)
  #:use-module (guix build utils)
  #:use-module (gnu build accounts)
+  #:use-module (gnu build install)
+  #:use-module (gnu build linux-container)
  #:use-module ((gnu system shadow) #:prefix sys:)
  #:use-module (rnrs io ports)
  #:use-module (srfi srfi-1)
@@ -133,49 +135,32 @@ USERS."
                       (_ #f))))))
              pids)))

-(define (umount-cow-store)
-  "Remove the store overlay and the bind-mount on /tmp created by the
-cow-store service.  This procedure is very fragile and a better approach would
-be much appreciated."
-  (catch #t
-    (lambda ()
-      (let ((tmp-dir "/remove"))
-        (syslog "Unmounting cow-store.~%")
+(define (call-with-mnt-container thunk)
+  "This is a variant of call-with-container. Run THUNK in a new container
+process, within a separate MNT namespace. The container is not jailed so that
+it can interact with the rest of the system."
+  (let ((pid (run-container "/" '() '(mnt) 1 thunk)))
+    ;; Catch SIGINT and kill the container process.
+    (sigaction SIGINT
+      (lambda (signum)
+        (false-if-exception
+         (kill pid SIGKILL))))

-        (mkdir-p tmp-dir)
-        (mount (%store-directory) tmp-dir "" MS_MOVE)
-
-        ;; The guix-daemon has possibly opened files from the cow-store,
-        ;; restart it.
-        (restart-service 'guix-daemon)
-
-        (syslog "Killing cow users.")
-
-        ;; Kill all processes started while the cow-store was active (logins
-        ;; on other TTYs for instance).
-        (kill-cow-users tmp-dir)
-
-        ;; Try to umount the store overlay. Some process such as udevd
-        ;; workers might still be active, so do some retries.
-        (let loop ((try 5))
-          (syslog "Umount try ~a~%" (- 5 try))
-          (sleep 1)
-          (let ((umounted? (false-if-exception (umount tmp-dir))))
-            (if (and (not umounted?) (> try 0))
-                (loop (- try 1))
-                (if umounted?
-                    (syslog "Umounted ~a successfully.~%" tmp-dir)
-                    (syslog "Failed to umount ~a.~%" tmp-dir)))))
-
-        (umount "/tmp")))
-    (lambda args
-      (syslog "~a~%" args))))
+    (match (waitpid pid)
+      ((_ . status) status))))

 (define* (install-system locale #:key (users '()))
  "Create /etc/shadow and /etc/passwd on the installation target for USERS.
 Start COW-STORE service on target directory and launch guix install command in
 a subshell.  LOCALE must be the locale name under which that command will run,
 or #f.  Return #t on success and #f on failure."
+  (define backing-directory
+    ;; Sub-directory used as the backing store for copy-on-write.
+    "/tmp/guix-inst")
+
+  (define (assert-exit x)
+    (primitive-exit (if x 0 1)))
+
  (let* ((options         (catch 'system-error
                            (lambda ()
                              ;; If this file exists, it can provide
@@ -188,7 +173,11 @@ or #f.  Return #t on success and #f on failure."
                                        "--fallback")
                                  options
                                  (list (%installer-configuration-file)
-                                        (%installer-target-dir)))))
+                                        (%installer-target-dir))))
+         (database-dir    "/var/guix/db")
+         (database-file   (string-append database-dir "/db.sqlite"))
+         (saved-database  (string-append database-dir "/db.save"))
+         (ret             #f))
    (mkdir-p (%installer-target-dir))

    ;; We want to initialize user passwords but we don't want to store them in
@@ -198,27 +187,49 @@ or #f.  Return #t on success and #f on failure."
    ;; passwords that we've put in there.
    (create-user-database users (%installer-target-dir))

-    (dynamic-wind
-      (lambda ()
-        (start-service 'cow-store (list (%installer-target-dir))))
-      (lambda ()
-        ;; If there are any connected clients, assume that we are running
-        ;; installation tests. In that case, dump the standard and error
-        ;; outputs to syslog.
-        (if (not (null? (current-clients)))
-            (with-output-to-file "/dev/console"
-              (lambda ()
-                (with-error-to-file "/dev/console"
-                  (lambda ()
-                    (setvbuf (current-output-port) 'none)
-                    (setvbuf (current-error-port) 'none)
-                    (run-command install-command #:locale locale)))))
-            (run-command install-command #:locale locale)))
-      (lambda ()
-        (stop-service 'cow-store)
-        ;; Remove the store overlay created at cow-store service start.
-        ;; Failing to do that will result in further umount calls to fail
-        ;; because the target device is seen as busy. See:
-        ;; https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00161.html.
-        (umount-cow-store)
-        #f))))
+    ;; When the store overlay is mounted, other processes such as kmscon, udev
+    ;; and guix-daemon may open files from the store, preventing the
+    ;; underlying install support from being umounted. See:
+    ;; https://lists.gnu.org/archive/html/guix-devel/2018-12/msg00161.html.
+    ;;
+    ;; To avoid this situation, mount the store overlay inside a container,
+    ;; and run the installation from within that container.
+    (zero?
+     (call-with-mnt-container
+       (lambda ()
+         (dynamic-wind
+           (lambda ()
+             ;; Save the database, so that it can be restored once the
+             ;; cow-store is umounted.
+             (copy-file database-file saved-database)
+             (mount-cow-store (%installer-target-dir) backing-directory))
+           (lambda ()
+             ;; We need to drag the guix-daemon to the container MNT
+             ;; namespace, so that it can operate on the cow-store.
+             (stop-service 'guix-daemon)
+             (start-service 'guix-daemon (list (number->string (getpid))))
+
+             (setvbuf (current-output-port) 'none)
+             (setvbuf (current-error-port) 'none)
+
+             ;; If there are any connected clients, assume that we are running
+             ;; installation tests. In that case, dump the standard and error
+             ;; outputs to syslog.
+             (set! ret
+                   (if (not (null? (current-clients)))
+                       (with-output-to-file "/dev/console"
+                         (lambda ()
+                           (with-error-to-file "/dev/console"
+                             (lambda ()
+                               (run-command install-command
+                                            #:locale locale)))))
+                       (run-command install-command #:locale locale))))
+           (lambda ()
+             ;; Restart guix-daemon so that it does no keep the MNT namespace
+             ;; alive.
+             (restart-service 'guix-daemon)
+             (copy-file saved-database database-file)
+
+             ;; Finally umount the cow-store and exit the container.
+             (unmount-cow-store (%installer-target-dir) backing-directory)
+             (assert-exit ret))))))))
@@ -30,6 +30,7 @@
  #:use-module (gnu installer newt page)
  #:use-module (gnu installer newt partition)
  #:use-module (gnu installer newt services)
+  #:use-module (gnu installer newt substitutes)
  #:use-module (gnu installer newt timezone)
  #:use-module (gnu installer newt user)
  #:use-module (gnu installer newt utils)
@@ -46,6 +47,7 @@
  (newt-init)
  (clear-screen)
  (set-screen-size!)
+  (syslog "Display is ~ax~a.~%" (screen-columns) (screen-rows))
  (push-help-line
   (format #f (G_ "Press <F1> for installation parameters."))))

@@ -100,6 +102,9 @@ problem. The backtrace is displayed below. Please report it by email to \
 (define (network-page)
  (run-network-page))

+(define (substitutes-page)
+  (run-substitutes-page))
+
 (define (hostname-page)
  (run-hostname-page))

@@ -107,7 +112,7 @@ problem. The backtrace is displayed below. Please report it by email to \
  (run-user-page))

 (define (partition-page)
-  (run-partioning-page))
+  (run-partitioning-page))

 (define (services-page)
  (run-services-page))
@@ -129,6 +134,7 @@ problem. The backtrace is displayed below. Please report it by email to \
   (locale-page locale-page)
   (menu-page menu-page)
   (network-page network-page)
+   (substitutes-page substitutes-page)
   (timezone-page timezone-page)
   (hostname-page hostname-page)
   (user-page user-page)
@@ -77,7 +77,7 @@ connection is pending."
      #:title (G_ "Ethernet connection")
      #:listbox-items services
      #:listbox-item->text ethernet-service->text
-      #:listbox-height (min (+ (length services) 2) 10)
+      #:listbox-height (min (+ (length services) 2) 5)
      #:button-text (G_ "Exit")
      #:button-callback-procedure
      (lambda _
@@ -29,6 +29,7 @@
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:use-module (ice-9 match)
+  #:use-module ((ice-9 rdelim) #:select (read-line))
  #:use-module (newt)
  #:export (run-final-page))

@@ -39,9 +40,8 @@
      file))

 (define* (run-config-display-page #:key locale)
-  (let ((width (%configuration-file-width))
-        (height (nearest-exact-integer
-                 (/ (screen-rows) 2))))
+  (let ((width (max 70 (- (screen-columns) 20)))
+        (height (default-listbox-height)))
    (run-file-textbox-page
     #:info-text (format #f (G_ "\
 We're now ready to proceed with the installation! \
@@ -102,18 +102,24 @@ a specific step, or restart the installer."))
                            #:key (users '()))
  (clear-screen)
  (newt-suspend)
-  ;; XXX: Force loading 'bold' font files before mouting the
-  ;; cow-store. Otherwise, if the file is loaded by kmscon after the cow-store
-  ;; in mounted, it will be necessary to kill kmscon to umount to cow-store.
-  (display
-   (colorize-string
-    (format #f (G_ "Installing Guix System ...~%"))
-    (color BOLD)))
  (let ((install-ok? (install-system locale #:users users)))
    (newt-resume)
    install-ok?))

 (define (run-final-page result prev-steps)
+  (define (wait-for-clients)
+    (unless (null? (current-clients))
+      (syslog "waiting with clients before starting final step~%")
+      (send-to-clients '(starting-final-step))
+      (match (select (current-clients) '() '())
+        (((port _ ...) _ _)
+         (read-line port)))))
+
+  ;; Before generating the configuration file, give clients a chance to do
+  ;; things such as changing the swap partition label.
+  (wait-for-clients)
+
+  (syslog "proceeding with final step~%")
  (let* ((configuration   (format-configuration prev-steps result))
         (user-partitions (result-step result 'partition))
         (locale          (result-step result 'locale))
@@ -106,7 +106,7 @@ symbol.")
 territory, codeset and modifier. Use SUPPORTED-LOCALES as the list of glibc
 available locales. ISO639-LANGUAGES is an association list associating a
 locale code to a locale name. ISO3166-TERRITORIES is an association list
-associating a territory code with a territory name. The formated locale, under
+associating a territory code with a territory name. The formatted locale, under
 glibc format is returned."

  (define (break-on-locale-found locales)
@@ -80,7 +80,7 @@ network devices were found. Do you want to continue anyway?"))
      #:title (G_ "Internet access")
      #:listbox-items items
      #:listbox-item->text technology->text
-      #:listbox-height (min (+ (length items) 2) 10)
+      #:listbox-height (min (+ (length items) 2) 5)
      #:button-text (G_ "Exit")
      #:button-callback-procedure
      (lambda _
@@ -32,7 +32,9 @@
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
  #:use-module (newt)
-  #:export (draw-info-page
+  #:export (default-listbox-height
+
+            draw-info-page
            draw-connecting-page
            run-input-page
            run-error-page
@@ -168,6 +170,10 @@ Like 'run-form', return two values: the exit reason, and an \"argument\"."
        (_
         (values reason argument))))))

+(define (default-listbox-height)
+  "Return the default listbox height."
+  (max 5 (- (screen-rows) 20)))
+
 (define (draw-info-page text title)
  "Draw an informative page with the given TEXT as content.  Set the title of
 this page to TITLE."
@@ -339,7 +345,8 @@ of the page is set to TITLE."
                                     (info-textbox-width 50)
                                     listbox-items
                                     listbox-item->text
-                                     (listbox-height 20)
+                                     (listbox-height
+                                      (default-listbox-height))
                                     (listbox-default-item #f)
                                     (listbox-allow-multiple? #f)
                                     (sort-listbox-items? #t)
@@ -20,6 +20,7 @@
  #:use-module (gnu installer proxy)
  #:use-module (gnu installer steps)
  #:use-module (gnu installer newt page)
+  #:use-module (guix build syscalls)
  #:use-module (guix i18n)
  #:use-module (ice-9 match)
  #:use-module (newt)
@@ -40,7 +41,8 @@ empty string, proxy usage will be disabled.")
  (let* ((items
          (list
           (cons (G_ "Change keyboard layout") keyboard-layout-selection)
-           (cons (G_ "Configure HTTP proxy") run-proxy-page)))
+           (cons (G_ "Configure HTTP proxy") run-proxy-page)
+           (cons (G_ "Reboot") reboot)))
         (result
          (run-listbox-selection-page
           #:info-text (G_ "Please choose one of the following parameters or \
@@ -25,6 +25,7 @@
  #:use-module (gnu installer newt page)
  #:use-module (gnu installer newt utils)
  #:use-module (guix i18n)
+  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
@@ -32,7 +33,7 @@
  #:use-module (srfi srfi-35)
  #:use-module (newt)
  #:use-module (parted)
-  #:export (run-partioning-page))
+  #:export (run-partitioning-page))

 (define (button-exit-action)
  "Raise the &installer-step-abort condition."
@@ -56,11 +57,17 @@
                  #:button-callback-procedure button-exit-action)))
    (car result)))

-(define (draw-formatting-page)
+(define (draw-formatting-page partitions)
  "Draw a page asking for confirmation, and then indicating that partitions
 are being formatted."
-  (run-confirmation-page (G_ "We are about to format your hard disk.  All \
-its data will be lost.  Do you wish to continue?")
+  ;; TRANSLATORS: The ~{ and ~} format specifiers are used to iterate the list
+  ;; of device names of the user partitions that will be formatted.
+  (run-confirmation-page (format #f (G_ "We are about to write the configured \
+partition table to the disk and format the partitions listed below.  Their \
+data will be lost.  Do you wish to continue?~%~%~{ - ~a~%~}")
+                                 (map user-partition-file-name
+                                      (filter user-partition-need-formatting?
+                                              partitions)))
                         (G_ "Format disk?")
                         #:exit-button-procedure button-exit-action)
  (draw-info-page
@@ -674,7 +681,7 @@ by pressing the Exit button.~%~%")))
                      (G_ "Guided partitioning")
                      (G_ "Manual partitioning"))
          #:info-textbox-width 76         ;we need a lot of room for INFO-TEXT
-          #:listbox-height 12
+          #:listbox-height (max 5 (- (screen-rows) 30))
          #:listbox-items (disk-items)
          #:listbox-item->text cdr
          #:sort-listbox-items? #f
@@ -725,7 +732,7 @@ by pressing the Exit button.~%~%")))
          (run-disk-page result-disks new-user-partitions
                         #:guided? guided?)))))

-(define (run-partioning-page)
+(define (run-partitioning-page)
  "Run a page asking the user for a partitioning method."
  (define (run-page devices)
    (let* ((items
@@ -773,9 +780,12 @@ by pressing the Exit button.~%~%")))
         (user-partitions (run-page non-install-devices))
         (user-partitions-with-pass (prompt-luks-passwords
                                     user-partitions))
-         (form (draw-formatting-page)))
+         (form (draw-formatting-page user-partitions)))
    ;; Make sure the disks are not in use before proceeding to formatting.
    (free-parted non-install-devices)
    (format-user-partitions user-partitions-with-pass)
+    (syslog "formatted ~a user partitions~%"
+            (length user-partitions-with-pass))
+
    (destroy-form-and-pop form)
    user-partitions))
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
-;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2019, 2020 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -40,7 +41,7 @@ choose the one to use on the log-in screen.")
     #:items items
     #:selection (map system-service-recommended? items)
     #:item->text system-service-name             ;no i18n for DE names
-     #:checkbox-tree-height 8
+     #:checkbox-tree-height 9
     #:exit-button-callback-procedure
     (lambda ()
       (raise
@@ -76,6 +77,7 @@ system.")
 We recommend NetworkManager or Connman for a WiFi-capable laptop; the DHCP \
 client may be enough for a server.")
     #:info-textbox-width 70
+     #:listbox-height 7
     #:listbox-items (filter (lambda (service)
                               (eq? 'network-management
                                    (system-service-type service)))
@@ -0,0 +1,43 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Mathieu Othacehe <othacehe@gnu.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu installer newt substitutes)
+  #:use-module (gnu installer substitutes)
+  #:use-module (gnu installer utils)
+  #:use-module (guix i18n)
+  #:use-module (newt)
+  #:use-module (ice-9 match)
+  #:export (run-substitutes-page))
+
+(define* (run-substitutes-page)
+  (match (current-clients)
+    (()
+     (case (choice-window
+            (G_ "Substitute server discovery.")
+            (G_ "Enable") (G_ "Disable")
+            (G_ " By turning this option on, you allow Guix to fetch \
+substitutes (pre-built binaries) during installation from servers \
+discovered on your local area network (LAN) in addition to the official \
+server.  This can increase download throughput.
+
+ There are no security risks: only genuine substitutes may be retrieved from \
+those servers.  However, eavesdroppers on your LAN may be able to see what \
+software you are installing."))
+       ((1) (enable-discovery))
+       ((2) (disable-discovery))))
+    (_ #f)))
@@ -38,6 +38,9 @@
 (define info-textbox-width (make-parameter 70))
 (define options-listbox-height (make-parameter 5))

+(define (display-logo?)
+  (> (screen-rows) 35))
+
 (define* (run-menu-page title info-text logo
                        #:key
                        listbox-items
@@ -55,7 +58,10 @@ we want this page to occupy all the screen space available."
         items))

  (let* ((logo-textbox
-          (make-textbox -1 -1 (logo-width) (logo-height) 0))
+          (make-textbox -1 -1
+                        (if (display-logo?) (logo-width) 0)
+                        (if (display-logo?) (logo-height) 0)
+                        0))
         (info-textbox
          (make-reflowed-textbox -1 -1
                                 info-text
@@ -165,7 +165,8 @@ of <service-item> records present in LISTBOX."
 (define service-name-max-length (make-parameter 20))

 ;; Height of the listbox displaying wifi services.
-(define wifi-listbox-height (make-parameter 20))
+(define wifi-listbox-height (make-parameter
+                             (default-listbox-height)))

 ;; Information textbox width.
 (define info-textbox-width (make-parameter 40))
@@ -36,10 +36,12 @@
  #:use-module (guix utils)
  #:use-module (guix i18n)
  #:use-module (parted)
+  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
  #:use-module (ice-9 regex)
  #:use-module (rnrs io ports)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-19)
  #:use-module (srfi srfi-26)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
@@ -317,7 +319,7 @@ PARTED-OBJECT field equals PARTITION, return #f if not found."
 fail. See rereadpt function in wipefs.c of util-linux for an explanation."
  ;; Kernel always return EINVAL for BLKRRPART on loopdevices.
  (and (not (string-match "/dev/loop*" file-name))
-       (let loop ((try 4))
+       (let loop ((try 16))
         (usleep 250000)
         (let ((in-use? (device-in-use? file-name)))
           (if (and in-use? (> try 0))
@@ -338,15 +340,12 @@ fail. See rereadpt function in wipefs.c of util-linux for an explanation."
 (define (non-install-devices)
  "Return all the available devices, except the busy one, allegedly the
 install device. DEVICE-IS-BUSY? is a parted call, checking if the device is
-mounted. The install image uses an overlayfs so the install device does not
-appear as mounted and won't be considered as busy. So use also DEVICE-IN-USE?
-from (guix build syscalls) module, who will try to re-read the device's
-partition table to determine whether or not it is already used (like sfdisk
-from util-linux)."
+mounted."
+  ;; FIXME: The install image uses an overlayfs so the install device does not
+  ;; appear as mounted and won't be considered as busy.
  (remove (lambda (device)
            (let ((file-name (device-path device)))
-              (or (device-is-busy? device)
-                  (with-delay-device-in-use? file-name))))
+              (device-is-busy? device)))
          (devices)))


@@ -526,56 +525,54 @@ determined by MAX-LENGTH-COLUMN procedure."
         (size (user-partition-size user-partition))
         (mount-point (user-partition-mount-point user-partition)))
    `(,@(if has-name?
-            `((name . ,(string-append "Name: " (or name "None"))))
+            `((name . ,(format #f (G_ "Name: ~a")
+                               (or name (G_ "None")))))
            '())
      ,@(if (and has-extended?
                 (freespace-partition? partition)
                 (not (eq? type 'logical)))
-            `((type . ,(string-append "Type: " type-name)))
+            `((type . ,(format #f (G_ "Type: ~a") type-name)))
            '())
      ,@(if (eq? type 'extended)
            '()
-            `((fs-type . ,(string-append "Filesystem type: " fs-type-name))))
+            `((fs-type . ,(format #f (G_ "File system type: ~a")
+                                  fs-type-name))))
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap)
                (not has-extended?))
            '()
-            `((bootable . ,(string-append "Bootable flag: "
-                                          (if bootable? "On" "Off")))))
+            `((bootable . ,(format #f (G_ "Bootable flag: ~:[off~;on~]")
+                                   bootable?))))
      ,@(if (and (not has-extended?)
                 (not (eq? fs-type 'swap)))
-            `((esp? . ,(string-append "ESP flag: "
-                                      (if esp? "On" "Off"))))
+            `((esp? . ,(format #f (G_ "ESP flag: ~:[off~;on~]") esp?)))
            '())
      ,@(if (freespace-partition? partition)
            (let ((size-formatted
-                   (or size (unit-format device
+                   (or size (unit-format device   ;XXX: i18n
                                         (partition-length partition)))))
-              `((size . ,(string-append "Size : " size-formatted))))
+              `((size . ,(format #f (G_ "Size: ~a") size-formatted))))
            '())
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap))
            '()
            `((crypt-label
-               . ,(string-append
-                   "Encryption: "
-                   (if crypt-label
-                       (format #f "Yes (label ~a)" crypt-label)
-                       "No")))))
+               . ,(format #f (G_ "Encryption: ~:[No~a~;Yes (label '~a')~]")
+                          crypt-label (or crypt-label "")))))
      ,@(if (or (freespace-partition? partition)
                (eq? fs-type 'swap))
            '()
            `((need-formatting?
-               . ,(string-append "Format the partition? : "
-                                 (if need-formatting? "Yes" "No")))))
+               . ,(format #f (G_ "Format the partition? ~:[No~;Yes~]")
+                          need-formatting?))))
      ,@(if (or (eq? type 'extended)
                (eq? fs-type 'swap))
            '()
            `((mount-point
-               . ,(string-append "Mount point : "
-                                 (or mount-point
-                                     (and esp? (default-esp-mount-point))
-                                     "None"))))))))
+               . ,(format #f (G_ "Mount point: ~a")
+                          (or mount-point
+                              (and esp? (default-esp-mount-point))
+                              (G_ "None")))))))))


 ;;
@@ -759,11 +756,33 @@ cause them to cross."
                                                      dev-constraint))
              (no-constraint (constraint-any device))
              ;; Try to create a partition with an optimal alignment
-              ;; constraint. If it fails, fallback to creating a partition with
-              ;; no specific constraint.
+              ;; constraint. If it fails, fallback to creating a partition
+              ;; with no specific constraint.
+              (partition-constraint-ok?
+               (disk-add-partition disk partition final-constraint))
+              (partition-no-contraint-ok?
+               (or partition-constraint-ok?
+                   (disk-add-partition disk partition no-constraint)))
              (partition-ok?
-               (or (disk-add-partition disk partition final-constraint)
-                   (disk-add-partition disk partition no-constraint))))
+               (or partition-constraint-ok? partition-no-contraint-ok?)))
+         (syslog "Creating partition:
+~/type: ~a
+~/filesystem-type: ~a
+~/start: ~a
+~/end: ~a
+~/start-range: [~a, ~a]
+~/end-range: [~a, ~a]
+~/constraint: ~a
+~/no-constraint: ~a
+"
+                 partition-type
+                 (filesystem-type-name filesystem-type)
+                 start-sector*
+                 end-sector
+                 (geometry-start start-range) (geometry-end start-range)
+                 (geometry-start end-range) (geometry-end end-range)
+                 partition-constraint-ok?
+                 partition-no-contraint-ok?)
         ;; Set the partition name if supported.
         (when (and partition-ok? has-name? name)
           (partition-set-name partition name))
@@ -911,13 +930,13 @@ exists."

    (let* ((start-partition
            (and (not has-extended?)
-                 (not esp-partition)
                 (if (efi-installation?)
-                     (user-partition
-                      (fs-type 'fat32)
-                      (esp? #t)
-                      (size new-esp-size)
-                      (mount-point (default-esp-mount-point)))
+                     (and (not esp-partition)
+                          (user-partition
+                           (fs-type 'fat32)
+                           (esp? #t)
+                           (size new-esp-size)
+                           (mount-point (default-esp-mount-point))))
                     (user-partition
                      (fs-type 'ext4)
                      (bootable? #t)
@@ -1201,13 +1220,13 @@ the FS-TYPE field set to 'swap, return the empty list if none found."
          user-partitions))

 (define (start-swapping user-partitions)
-  "Start swaping on <user-partition> records with FS-TYPE equal to 'swap."
+  "Start swapping on <user-partition> records with FS-TYPE equal to 'swap."
  (let* ((swap-user-partitions (find-swap-user-partitions user-partitions))
         (swap-devices (map user-partition-file-name swap-user-partitions)))
    (for-each swapon swap-devices)))

 (define (stop-swapping user-partitions)
-  "Stop swaping on <user-partition> records with FS-TYPE equal to 'swap."
+  "Stop swapping on <user-partition> records with FS-TYPE equal to 'swap."
  (let* ((swap-user-partitions (find-swap-user-partitions user-partitions))
         (swap-devices (map user-partition-file-name swap-user-partitions)))
    (for-each swapoff swap-devices)))
@@ -1327,7 +1346,12 @@ USER-PARTITIONS, or return nothing."
      ,@(initrd-configuration user-partitions)
      ,@(if (null? swap-devices)
            '()
-            `((swap-devices (list ,@swap-devices))))
+            (let* ((uuids (map (lambda (file)
+                                 (uuid->string (read-partition-uuid file)))
+                               swap-devices)))
+              `((swap-devices (list ,@(map (lambda (uuid)
+                                             `(uuid ,uuid))
+                                           uuids))))))
      ,@(if (null? encrypted-partitions)
            '()
            `((mapped-devices
@@ -1364,9 +1388,12 @@ the devices not to be used before returning."
  (let ((device-file-names (map device-path devices)))
    (for-each force-device-sync devices)
    (for-each (lambda (file-name)
-                (let ((in-use? (with-delay-device-in-use? file-name)))
-                  (and in-use?
-                       (error
-                        (format #f (G_ "Device ~a is still in use.")
-                                file-name)))))
+                (let/time ((time in-use?
+                                 (with-delay-device-in-use? file-name)))
+                  (if in-use?
+                      (error
+                       (format #f (G_ "Device ~a is still in use.")
+                               file-name))
+                      (syslog "Syncing ~a took ~a seconds.~%"
+                              file-name (time-second time)))))
              device-file-names)))
@@ -17,15 +17,11 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu installer proxy)
+  #:use-module (gnu installer utils)
  #:use-module (gnu services herd)
  #:export (set-http-proxy
            clear-http-proxy))

-(define-syntax-rule (with-silent-shepherd exp ...)
-  (parameterize ((shepherd-message-port
-                  (%make-void-port "w")))
-    exp ...))
-
 (define (set-http-proxy proxy)
  (with-silent-shepherd
    (with-shepherd-action 'guix-daemon
@@ -33,6 +33,7 @@
            installer-locale-page
            installer-menu-page
            installer-network-page
+            installer-substitutes-page
            installer-timezone-page
            installer-hostname-page
            installer-user-page
@@ -73,6 +74,8 @@
  (menu-page installer-menu-page)
  ;; procedure void -> void
  (network-page installer-network-page)
+  ;; procedure void -> void
+  (substitutes-page installer-substitutes-page)
  ;; procedure (zonetab) -> posix-timezone
  (timezone-page installer-timezone-page)
  ;; procedure void -> void
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -82,6 +83,11 @@
      (name "ratpoison")
      (packages '((specification->package "ratpoison")
                  (specification->package "xterm"))))
+     (desktop-environment
+      (name "Emacs EXWM")
+      (packages '((specification->package "emacs")
+                  (specification->package "emacs-exwm")
+                  (specification->package "emacs-desktop-environment"))))

     ;; Networking.
     (system-service
@@ -50,7 +50,6 @@

            %installer-configuration-file
            %installer-target-dir
-            %configuration-file-width
            format-configuration
            configuration->file))

@@ -88,7 +87,7 @@
                              (rewind-strategy 'previous)
                              (menu-proc (const #f)))
  "Run the COMPUTE procedure of all <installer-step> records in STEPS
-sequencially. If the &installer-step-abort condition is raised, fallback to a
+sequentially.  If the &installer-step-abort condition is raised, fallback to a
 previous install-step, accordingly to the specified REWIND-STRATEGY.

 REWIND-STRATEGY possible values are 'previous, 'menu and 'start.  If 'previous
@@ -218,7 +217,6 @@ stored in RESULTS. Return #f otherwise."

 (define %installer-configuration-file (make-parameter "/mnt/etc/config.scm"))
 (define %installer-target-dir (make-parameter "/mnt"))
-(define %configuration-file-width (make-parameter 79))

 (define (format-configuration steps results)
  "Return the list resulting from the application of the procedure defined in
@@ -0,0 +1,41 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2020 Mathieu Othacehe <m.othacehe@gmail.com>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu installer substitutes)
+  #:use-module (gnu installer utils)
+  #:use-module (gnu services herd)
+  #:export (enable-discovery
+            disable-discovery))
+
+(define (enable-discovery)
+  (with-silent-shepherd
+    (with-shepherd-action 'guix-daemon
+        ('discover "on")
+        result
+      result)))
+
+(define (disable-discovery)
+  (with-silent-shepherd
+    (with-shepherd-action 'guix-daemon
+        ('discover "off")
+        result
+      result)))
+
+;; Local Variables:
+;; eval: (put 'with-silent-shepherd 'scheme-indent-function 0)
+;; End:
@@ -286,8 +286,9 @@ instrumented for further testing."
                               edit-configuration-file))
  "Converse over PORT to choose the partitioning method.  When ENCRYPTED? is
 true, choose full-disk encryption with PASSPHRASE as the LUKS passphrase.
-This conversation goes past the final dialog box that shows the configuration
-file, actually starting the installation process."
+This conversation stops when the user partitions have been formatted, right
+before the installer generates the configuration file and shows it in a dialog
+box."
  (converse port
    ((list-selection (title "Partitioning method")
                     (multiple-choices? #f)
@@ -330,15 +331,29 @@ file, actually starting the installation process."
     #t)
    ((info (title "Preparing partitions") _ ...)
     (values))                                    ;nothing to return
+    ((starting-final-step)
+     ;; Do not return anything.  The reply will be sent by
+     ;; 'conclude-installation' and in the meantime the installer just waits
+     ;; for us, giving us a chance to do things such as changing partition
+     ;; UUIDs before it generates the configuration file.
+     (values))))
+
+(define (conclude-installation port)
+  "Conclude the installation by checking over PORT that we get the generated
+configuration file, accepting it and starting the installation, and then
+receiving the final messages once the 'guix system init' process has
+completed."
+  ;; Assume the previous message received was 'starting-final-step'; here we
+  ;; send the reply to that message, which lets the installer continue.
+  (write #t port)
+  (newline port)
+  (force-output port)
+
+  (converse port
    ((file-dialog (title "Configuration file")
                  (text _)
                  (file ,configuration-file))
-     (edit-configuration-file configuration-file))))
-
-(define (conclude-installation port)
-  "Conclude the installation by checking over PORT that we get the final
-messages once the 'guix system init' process has completed."
-  (converse port
+     (edit-configuration-file configuration-file))
    ((pause)                                      ;"Press Enter to continue."
     #t)
    ((installation-complete)                      ;congratulations!
@@ -18,10 +18,12 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu installer utils)
+  #:use-module (gnu services herd)
  #:use-module (guix utils)
  #:use-module (guix build utils)
  #:use-module (guix i18n)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-19)
  #:use-module (srfi srfi-34)
  #:use-module (ice-9 match)
  #:use-module (ice-9 rdelim)
@@ -36,11 +38,15 @@

            syslog-port
            syslog
+            call-with-time
+            let/time

            with-server-socket
            current-server-socket
            current-clients
-            send-to-clients))
+            send-to-clients
+
+            with-silent-shepherd))

 (define* (read-lines #:optional (port (current-input-port)))
  "Read lines from PORT and return them as a list."
@@ -117,6 +123,17 @@ COMMAND exited successfully, #f otherwise."
 ;;; Logging.
 ;;;

+(define (call-with-time thunk kont)
+  "Call THUNK and pass KONT the elapsed time followed by THUNK's return
+values."
+  (let* ((start  (current-time time-monotonic))
+         (result (call-with-values thunk list))
+         (end    (current-time time-monotonic)))
+    (apply kont (time-difference end start) result)))
+
+(define-syntax-rule (let/time ((time result exp)) body ...)
+  (call-with-time (lambda () exp) (lambda (time result) body ...)))
+
 (define (open-syslog-port)
  "Return an open port (a socket) to /dev/log or #f if that wasn't possible."
  (let ((sock (socket AF_UNIX SOCK_DGRAM 0)))
@@ -219,3 +236,9 @@ accepting socket."

  (current-clients (reverse remainder))
  exp)
+
+(define-syntax-rule (with-silent-shepherd exp ...)
+  "Evaluate EXP while discarding shepherd messages."
+  (parameterize ((shepherd-message-port
+                  (%make-void-port "w")))
+    exp ...))
@@ -20,7 +20,7 @@
 # Copyright © 2018, 2019, 2020 Oleg Pykhalov <go.wigust@gmail.com>
 # Copyright © 2018 Stefan Stefanović <stefanx2ovic@gmail.com>
 # Copyright © 2018, 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
-# Copyright © 2019 Guillaume Le Vaillant <glv@posteo.net>
+# Copyright © 2019, 2020 Guillaume Le Vaillant <glv@posteo.net>
 # Copyright © 2019, 2020 John Soo <jsoo1@asu.edu>
 # Copyright © 2019 Jonathan Brielmaier <jonathan.brielmaier@web.de>
 # Copyright © 2019 Evan Straw <evan.straw99@gmail.com>
@@ -36,6 +36,9 @@
 # Copyright © 2020 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
 # Copyright © 2020 Brice Waegeneire <brice@waegenei.re>
 # Copyright © 2020 Tanguy Le Carrour <tanguy@bioneland.org>
+# Copyright © 2020 Martin Becze <mjbecze@riseup.net>
+# Copyright © 2020 Malte Frank Gerdes <mate.f.gerdes@gmail.com>
+# Copyright © 2020 Vinicius Monego <monego@posteo.net>
 #
 # This file is part of GNU Guix.
 #
@@ -109,6 +112,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/boost.scm			\
  %D%/packages/bootloaders.scm			\
  %D%/packages/bootstrap.scm			\
+  %D%/packages/browser-extensions.scm		\
  %D%/packages/build-tools.scm			\
  %D%/packages/busybox.scm			\
  %D%/packages/c.scm				\
@@ -143,6 +147,8 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/cppi.scm				\
  %D%/packages/cran.scm				\
  %D%/packages/crates-io.scm			\
+  %D%/packages/crates-graphics.scm		\
+  %D%/packages/crates-gtk.scm			\
  %D%/packages/cross-base.scm			\
  %D%/packages/crypto.scm			\
  %D%/packages/cryptsetup.scm			\
@@ -197,8 +203,10 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/enlightenment.scm		\
  %D%/packages/entr.scm				\
  %D%/packages/erlang.scm			\
+  %D%/packages/esolangs.scm			\
  %D%/packages/fabric-management.scm		\
  %D%/packages/fcitx.scm			\
+  %D%/packages/fcitx5.scm			\
  %D%/packages/figlet.scm			\
  %D%/packages/file.scm				\
  %D%/packages/file-systems.scm			\
@@ -269,6 +277,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/heads.scm			\
  %D%/packages/hexedit.scm			\
  %D%/packages/hugs.scm				\
+  %D%/packages/hunspell.scm				\
  %D%/packages/hurd.scm				\
  %D%/packages/hyperledger.scm			\
  %D%/packages/i2p.scm				\
@@ -342,6 +351,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/lout.scm				\
  %D%/packages/logging.scm			\
  %D%/packages/logo.scm				\
+  %D%/packages/loko.scm				\
  %D%/packages/lolcode.scm                      \
  %D%/packages/lsof.scm				\
  %D%/packages/lua.scm				\
@@ -430,6 +440,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/photo.scm			\
  %D%/packages/phabricator.scm 			\
  %D%/packages/php.scm				\
+  %D%/packages/piet.scm			\
  %D%/packages/pkg-config.scm			\
  %D%/packages/plotutils.scm			\
  %D%/packages/poedit.scm				\
@@ -460,6 +471,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/radio.scm			\
  %D%/packages/ragel.scm			\
  %D%/packages/rails.scm			\
+  %D%/packages/raspberry-pi.scm			\
  %D%/packages/ratpoison.scm			\
  %D%/packages/rcm.scm				\
  %D%/packages/rdesktop.scm			\
@@ -484,7 +496,6 @@ GNU_SYSTEM_MODULES =				\
  %D%/packages/screen.scm			\
  %D%/packages/scribus.scm			\
  %D%/packages/scsi.scm				\
-  %D%/packages/sdcc.scm				\
  %D%/packages/sdl.scm				\
  %D%/packages/search.scm			\
  %D%/packages/security-token.scm		\
@@ -643,12 +654,16 @@ GNU_SYSTEM_MODULES =				\
  %D%/system/vm.scm				\
 						\
  %D%/system/images/hurd.scm			\
+  %D%/system/images/novena.scm			\
+  %D%/system/images/pine64.scm			\
+  %D%/system/images/pinebook-pro.scm		\
 						\
  %D%/machine.scm				\
 						\
  %D%/build/accounts.scm			\
  %D%/build/activation.scm			\
  %D%/build/bootloader.scm			\
+  %D%/build/chromium-extension.scm		\
  %D%/build/cross-toolchain.scm			\
  %D%/build/image.scm				\
  %D%/build/file-systems.scm			\
@@ -659,6 +674,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/build/linux-initrd.scm			\
  %D%/build/linux-modules.scm			\
  %D%/build/marionette.scm			\
+  %D%/build/secret-service.scm			\
  %D%/build/vm.scm				\
 						\
  %D%/tests.scm					\
@@ -702,6 +718,7 @@ INSTALLER_MODULES =                             \
  %D%/installer/record.scm		        \
  %D%/installer/services.scm			\
  %D%/installer/steps.scm			\
+  %D%/installer/substitutes.scm			\
  %D%/installer/tests.scm			\
  %D%/installer/timezone.scm			\
  %D%/installer/user.scm			\
@@ -718,6 +735,7 @@ INSTALLER_MODULES =                             \
  %D%/installer/newt/page.scm			\
  %D%/installer/newt/partition.scm		\
  %D%/installer/newt/services.scm		\
+  %D%/installer/newt/substitutes.scm		\
  %D%/installer/newt/timezone.scm		\
  %D%/installer/newt/user.scm			\
  %D%/installer/newt/utils.scm			\
@@ -774,7 +792,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/akonadi-not-relocatable.patch		\
  %D%/packages/patches/akonadi-timestamps.patch		\
  %D%/packages/patches/allegro-mesa-18.2.5-and-later.patch	\
-  %D%/packages/patches/alsa-modular-synth-fix-vocoder.patch	\
  %D%/packages/patches/amule-crypto-6.patch			\
  %D%/packages/patches/anki-mpv-args.patch			\
  %D%/packages/patches/antiword-CVE-2014-8123.patch			\
@@ -786,19 +803,20 @@ dist_patch_DATA =						\
  %D%/packages/patches/ath9k-htc-firmware-gcc.patch		\
  %D%/packages/patches/ath9k-htc-firmware-objcopy.patch		\
  %D%/packages/patches/audacity-build-with-system-portaudio.patch \
+  %D%/packages/patches/audacity-add-include.patch 		\
  %D%/packages/patches/audiofile-fix-datatypes-in-tests.patch	\
  %D%/packages/patches/audiofile-fix-sign-conversion.patch	\
  %D%/packages/patches/audiofile-CVE-2015-7747.patch		\
  %D%/packages/patches/audiofile-CVE-2018-13440.patch		\
  %D%/packages/patches/audiofile-CVE-2018-17095.patch		\
-  %D%/packages/patches/audiofile-Check-the-number-of-coefficients.patch \
+  %D%/packages/patches/audiofile-check-number-of-coefficients.patch \
  %D%/packages/patches/audiofile-Fail-on-error-in-parseFormat.patch \
  %D%/packages/patches/audiofile-Fix-index-overflow-in-IMA.cpp.patch \
-  %D%/packages/patches/audiofile-Fix-multiply-overflow-sfconvert.patch \
-  %D%/packages/patches/audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch \
-  %D%/packages/patches/audiofile-division-by-zero-BlockCodec-runPull.patch \
-  %D%/packages/patches/audiofile-hurd.patch \
-  %D%/packages/patches/audiofile-signature-of-multiplyCheckOverflow.patch \
+  %D%/packages/patches/audiofile-multiply-overflow.patch	\
+  %D%/packages/patches/audiofile-overflow-in-MSADPCM.patch	\
+  %D%/packages/patches/audiofile-division-by-zero.patch 	\
+  %D%/packages/patches/audiofile-hurd.patch 			\
+  %D%/packages/patches/audiofile-function-signature.patch	\
  %D%/packages/patches/automake-skip-amhello-tests.patch	\
  %D%/packages/patches/avahi-localstatedir.patch		\
  %D%/packages/patches/avogadro-boost148.patch			\
@@ -806,6 +824,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/avogadro-python-eigen-lib.patch		\
  %D%/packages/patches/avidemux-install-to-lib.patch		\
  %D%/packages/patches/awesome-reproducible-png.patch		\
+  %D%/packages/patches/aws-c-event-stream-cmake-prefix.patch  \
+  %D%/packages/patches/aws-checksums-cmake-prefix.patch		\
  %D%/packages/patches/azr3.patch				\
  %D%/packages/patches/bash-reproducible-linux-pgrp-pipe.patch	\
  %D%/packages/patches/bash-completion-directories.patch	\
@@ -813,11 +833,22 @@ dist_patch_DATA =						\
  %D%/packages/patches/bastet-change-source-of-unordered_set.patch	\
  %D%/packages/patches/bazaar-CVE-2017-14176.patch		\
  %D%/packages/patches/bc-fix-cross-compilation.patch		\
+  %D%/packages/patches/bear-disable-preinstall-tests.patch	\
+  %D%/packages/patches/bsd-games-2.17-64bit.patch		\
+  %D%/packages/patches/bsd-games-add-configure-config.patch	\
+  %D%/packages/patches/bsd-games-add-wrapper.patch		\
+  %D%/packages/patches/bsd-games-bad-ntohl-cast.patch		\
+  %D%/packages/patches/bsd-games-dont-install-empty-files.patch	\
+  %D%/packages/patches/bsd-games-gamescreen.h.patch		\
+  %D%/packages/patches/bsd-games-getline.patch			\
+  %D%/packages/patches/bsd-games-null-check.patch		\
+  %D%/packages/patches/bsd-games-number.c-and-test.patch	\
+  %D%/packages/patches/bsd-games-prevent-name-collisions.patch	\
+  %D%/packages/patches/bsd-games-stdio.h.patch			\
  %D%/packages/patches/beancount-disable-googleapis-fonts.patch	\
  %D%/packages/patches/beets-werkzeug-compat.patch		\
  %D%/packages/patches/behave-skip-a-couple-of-tests.patch	\
  %D%/packages/patches/beignet-correct-file-names.patch		\
-  %D%/packages/patches/benchmark-unbundle-googletest.patch	\
  %D%/packages/patches/biber-fix-encoding-write.patch		\
  %D%/packages/patches/biber-sortinithash.patch			\
  %D%/packages/patches/bidiv-update-fribidi.patch		\
@@ -825,7 +856,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/binutils-loongson-workaround.patch	\
  %D%/packages/patches/binutils-mingw-w64-timestamp.patch	\
  %D%/packages/patches/binutils-mingw-w64-deterministic.patch	\
-  %D%/packages/patches/bitcoin-core-python-compat.patch		\
  %D%/packages/patches/blender-2.79-gcc8.patch			\
  %D%/packages/patches/blender-2.79-gcc9.patch			\
  %D%/packages/patches/blender-2.79-newer-ffmpeg.patch		\
@@ -833,7 +863,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/blender-2.79-python-3.7-fix.patch	\
  %D%/packages/patches/blender-2.79-python-3.8-fix.patch	\
  %D%/packages/patches/bpftrace-disable-bfd-disasm.patch	\
-  %D%/packages/patches/busybox-1.31.1-fix-build-with-glibc-2.31.patch \
  %D%/packages/patches/byobu-writable-status.patch		\
  %D%/packages/patches/calibre-no-updates-dialog.patch		\
  %D%/packages/patches/calibre-remove-test-sqlite.patch		\
@@ -845,6 +874,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/cdrtools-3.01-mkisofs-isoinfo.patch 	\
  %D%/packages/patches/ceph-disable-cpu-optimizations.patch	\
  %D%/packages/patches/chmlib-inttypes.patch			\
+  %D%/packages/patches/cl-asdf-config-directories.patch		\
  %D%/packages/patches/clamav-config-llvm-libs.patch		\
  %D%/packages/patches/clamav-system-tomsfastmath.patch		\
  %D%/packages/patches/clang-3.5-libc-search-path.patch		\
@@ -854,6 +884,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/clang-7.0-libc-search-path.patch		\
  %D%/packages/patches/clang-9.0-libc-search-path.patch		\
  %D%/packages/patches/clang-10.0-libc-search-path.patch	\
+  %D%/packages/patches/clang-11.0-libc-search-path.patch	\
  %D%/packages/patches/clang-runtime-asan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-esan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-9-libsanitizer-mode-field.patch	\
@@ -864,7 +895,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/clementine-fix-sqlite.patch		\
  %D%/packages/patches/clementine-remove-crypto++-dependency.patch	\
  %D%/packages/patches/clementine-use-openssl.patch		\
-  %D%/packages/patches/clisp-remove-failing-test.patch		\
  %D%/packages/patches/clucene-pkgconfig.patch			\
  %D%/packages/patches/cmake-curl-certificates.patch		\
  %D%/packages/patches/coda-use-system-libs.patch		\
@@ -890,7 +920,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/dbus-c++-gcc-compat.patch		\
  %D%/packages/patches/dbus-c++-threading-mutex.patch		\
  %D%/packages/patches/dbxfs-remove-sentry-sdk.patch		\
-  %D%/packages/patches/dconf-meson-0.52.patch			\
  %D%/packages/patches/debops-constants-for-external-program-names.patch \
  %D%/packages/patches/debops-debops-defaults-fall-back-to-less.patch \
  %D%/packages/patches/dee-vapi.patch			\
@@ -913,6 +942,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/ecl-16-format-directive-limit.patch	\
  %D%/packages/patches/ecl-16-ignore-stderr-write-error.patch	\
  %D%/packages/patches/ecl-16-libffi.patch			\
+  %D%/packages/patches/eigen-remove-openmp-error-counting.patch	\
  %D%/packages/patches/eigen-stabilise-sparseqr-test.patch	\
  %D%/packages/patches/einstein-build.patch			\
  %D%/packages/patches/elfutils-tests-ptrace.patch		\
@@ -945,6 +975,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/exiv2-CVE-2017-14859-14862-14864.patch	\
  %D%/packages/patches/extempore-unbundle-external-dependencies.patch	\
  %D%/packages/patches/extundelete-e2fsprogs-1.44.patch		\
+  %D%/packages/patches/farstream-make.patch                          \
  %D%/packages/patches/fastcap-mulGlobal.patch			\
  %D%/packages/patches/fastcap-mulSetup.patch			\
  %D%/packages/patches/fasthenry-spAllocate.patch		\
@@ -964,9 +995,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/foomatic-filters-CVE-2015-8560.patch	\
  %D%/packages/patches/fontconfig-hurd-path-max.patch		\
  %D%/packages/patches/fpc-reproducibility.patch		\
+  %D%/packages/patches/fplll-std-fenv.patch     		\
  %D%/packages/patches/freedink-engine-fix-sdl-hints.patch	\
  %D%/packages/patches/freeimage-unbundle.patch		\
  %D%/packages/patches/fuse-overlapping-headers.patch				\
+  %D%/packages/patches/gajim-honour-GAJIM_PLUGIN_PATH.patch	\
  %D%/packages/patches/ganeti-deterministic-manual.patch	\
  %D%/packages/patches/ganeti-disable-version-symlinks.patch	\
  %D%/packages/patches/ganeti-drbd-compat.patch			\
@@ -989,6 +1022,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/gcc-4.9-libsanitizer-ustat.patch		\
  %D%/packages/patches/gcc-libsanitizer-ustat.patch		\
  %D%/packages/patches/gcc-4.9-libsanitizer-mode-size.patch	\
+  %D%/packages/patches/gcc-6-fix-isl-includes.patch	\
+  %D%/packages/patches/gcc-6-fix-buffer-size.patch	\
  %D%/packages/patches/gcc-6-libsanitizer-mode-size.patch	\
  %D%/packages/patches/gcc-7-libsanitizer-mode-size.patch	\
  %D%/packages/patches/gcc-libvtv-runpath.patch			\
@@ -1011,10 +1046,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/gcc-8-strmov-store-file-names.patch	\
  %D%/packages/patches/gcc-9-asan-fix-limits-include.patch	\
  %D%/packages/patches/gcc-9-strmov-store-file-names.patch	\
+  %D%/packages/patches/gdb-hurd.patch				\
  %D%/packages/patches/gd-fix-tests-on-i686.patch		\
  %D%/packages/patches/gd-brect-bounds.patch			\
-  %D%/packages/patches/gdb-hurd.patch				\
  %D%/packages/patches/gdm-default-session.patch		\
+  %D%/packages/patches/genimage-signedness.patch		\
  %D%/packages/patches/geoclue-config.patch			\
  %D%/packages/patches/ghc-8.0-fall-back-to-madv_dontneed.patch	\
  %D%/packages/patches/ghc-testsuite-dlopen-pie.patch		\
@@ -1028,6 +1064,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/ghostscript-no-header-id.patch		\
  %D%/packages/patches/ghostscript-no-header-uuid.patch		\
  %D%/packages/patches/ghostscript-no-header-creationdate.patch \
+  %D%/packages/patches/glib-appinfo-watch.patch			\
  %D%/packages/patches/glib-tests-timer.patch			\
  %D%/packages/patches/glibc-CVE-2018-11236.patch		\
  %D%/packages/patches/glibc-CVE-2018-11237.patch		\
@@ -1061,8 +1098,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/glibc-supported-locales.patch     	\
  %D%/packages/patches/gmp-arm-asm-nothumb.patch		\
  %D%/packages/patches/gmp-faulty-test.patch			\
+  %D%/packages/patches/gnash-fix-giflib-version.patch	        \
  %D%/packages/patches/gnome-shell-theme.patch			\
  %D%/packages/patches/gnome-shell-disable-test.patch		\
+  %D%/packages/patches/gnome-settings-daemon-gc.patch		\
  %D%/packages/patches/gnome-todo-delete-esource-duplicate.patch \
  %D%/packages/patches/gnome-tweaks-search-paths.patch		\
  %D%/packages/patches/gnupg-default-pinentry.patch		\
@@ -1073,6 +1112,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/gobject-introspection-girepository.patch	\
  %D%/packages/patches/go-skip-gc-test.patch			\
  %D%/packages/patches/gpm-glibc-2.26.patch			\
+  %D%/packages/patches/gpodder-disable-updater.patch		\
  %D%/packages/patches/gpsbabel-minizip.patch     		\
  %D%/packages/patches/gpsbabel-qstring.patch     		\
  %D%/packages/patches/grantlee-merge-theme-dirs.patch		\
@@ -1132,8 +1172,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/icecat-use-older-reveal-hidden-html.patch	\
  %D%/packages/patches/icecat-use-system-graphite2+harfbuzz.patch	\
  %D%/packages/patches/icecat-use-system-media-libs.patch	\
-  %D%/packages/patches/icedtea-6-hotspot-gcc-segfault-workaround.patch  \
-  %D%/packages/patches/icedtea-7-hotspot-gcc-segfault-workaround.patch  \
+  %D%/packages/patches/icedtea-6-extend-hotspot-aarch64-support.patch	\
+  %D%/packages/patches/icedtea-7-hotspot-aarch64-use-c++98.patch	\
  %D%/packages/patches/icu4c-CVE-2020-10531.patch  		\
  %D%/packages/patches/id3lib-CVE-2007-4460.patch			\
  %D%/packages/patches/id3lib-UTF16-writing-bug.patch			\
@@ -1149,8 +1189,14 @@ dist_patch_DATA =						\
  %D%/packages/patches/json-c-0.13-CVE-2020-12762.patch	\
  %D%/packages/patches/json-c-0.12-CVE-2020-12762.patch	\
  %D%/packages/patches/jacal-fix-texinfo.patch			\
+  %D%/packages/patches/jamvm-1.5.1-aarch64-support.patch	\
+  %D%/packages/patches/jamvm-1.5.1-armv7-support.patch	\
+  %D%/packages/patches/jamvm-2.0.0-aarch64-support.patch	\
  %D%/packages/patches/jamvm-2.0.0-disable-branch-patching.patch	\
-  %D%/packages/patches/jamvm-arm.patch				\
+  %D%/packages/patches/jamvm-2.0.0-opcode-guard.patch		\
+  %D%/packages/patches/java-antlr4-Add-standalone-generator.patch	\
+  %D%/packages/patches/java-antlr4-fix-code-too-large.java	\
+  %D%/packages/patches/java-tunnelvisionlabs-antlr-code-too-large.patch	\
  %D%/packages/patches/java-apache-ivy-port-to-latest-bouncycastle.patch	\
  %D%/packages/patches/java-commons-collections-fix-java8.patch \
  %D%/packages/patches/java-jeromq-fix-tests.patch		\
@@ -1166,6 +1212,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/jsoncpp-fix-inverted-case.patch		\
  %D%/packages/patches/julia-SOURCE_DATE_EPOCH-mtime.patch	\
  %D%/packages/patches/kdbusaddons-kinit-file-name.patch	\
+  %D%/packages/patches/libffi-3.3-powerpc-fixes.patch		\
+  %D%/packages/patches/libffi-float128-powerpc64le.patch	\
  %D%/packages/patches/libvirt-create-machine-cgroup.patch	\
  %D%/packages/patches/libziparchive-add-includes.patch		\
  %D%/packages/patches/localed-xorg-keyboard.patch		\
@@ -1181,6 +1229,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/kmod-module-directory.patch		\
  %D%/packages/patches/kmscon-runtime-keymap-switch.patch	\
  %D%/packages/patches/kpackage-allow-external-paths.patch	\
+  %D%/packages/patches/kpackage-fix-KF5PackageMacros.cmake.patch \
  %D%/packages/patches/kmplayer-aarch64.patch			\
  %D%/packages/patches/kmplayer-upstream_Fix-build-with-Qt-5.9.patch	\
  %D%/packages/patches/kobodeluxe-paths.patch			\
@@ -1192,7 +1241,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/kodi-increase-test-timeout.patch		\
  %D%/packages/patches/kodi-set-libcurl-ssl-parameters.patch		\
  %D%/packages/patches/kodi-skip-test-449.patch		\
-  %D%/packages/patches/konversation-Fix-build-with-Qt-5.11.patch	\
  %D%/packages/patches/laby-make-install.patch			\
  %D%/packages/patches/lcalc-default-parameters-1.patch		\
  %D%/packages/patches/lcalc-default-parameters-2.patch		\
@@ -1213,14 +1261,15 @@ dist_patch_DATA =						\
  %D%/packages/patches/libbase-use-own-logging.patch		\
  %D%/packages/patches/libbonobo-activation-test-race.patch	\
  %D%/packages/patches/libcanberra-sound-theme-freedesktop.patch \
-  %D%/packages/patches/libdrm-realpath-virtio.patch		\
+  %D%/packages/patches/libcanberra-wayland-crash.patch \
+  %D%/packages/patches/libcyaml-libyaml-compat.patch		\
+  %D%/packages/patches/libexpected-nofetch.patch                \
  %D%/packages/patches/libgeotiff-adapt-test-script-for-proj-6.2.patch		\
  %D%/packages/patches/libgit2-mtime-0.patch			\
  %D%/packages/patches/libgnome-encoding.patch			\
  %D%/packages/patches/libgnomeui-utf8.patch			\
  %D%/packages/patches/libjxr-fix-function-signature.patch	\
  %D%/packages/patches/libjxr-fix-typos.patch			\
-  %D%/packages/patches/liblouisutdml-fix-tests.patch		\
  %D%/packages/patches/libofa-ftbfs-1.diff		\
  %D%/packages/patches/libofa-curl.diff		\
  %D%/packages/patches/libofa-ftbfs-2.diff		\
@@ -1238,10 +1287,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/libmygpo-qt-missing-qt5-modules.patch	\
  %D%/packages/patches/libqalculate-3.8.0-libcurl-ssl-fix.patch	\
  %D%/packages/patches/libquicktime-ffmpeg.patch 		\
-  %D%/packages/patches/libsndfile-armhf-type-checks.patch	\
-  %D%/packages/patches/libsndfile-CVE-2017-8361-8363-8365.patch	\
-  %D%/packages/patches/libsndfile-CVE-2017-8362.patch		\
-  %D%/packages/patches/libsndfile-CVE-2017-12562.patch		\
  %D%/packages/patches/libtar-CVE-2013-4420.patch 		\
  %D%/packages/patches/libtgvoip-disable-sse2.patch 		\
  %D%/packages/patches/libtgvoip-disable-webrtc.patch 		\
@@ -1277,6 +1322,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/lm-sensors-hwmon-attrs.patch		\
  %D%/packages/patches/lrcalc-includes.patch    		\
  %D%/packages/patches/lrzip-CVE-2017-8842.patch		\
+  %D%/packages/patches/lsh-fix-x11-forwarding.patch		\
+  %D%/packages/patches/lsof-fatal-test-failures.patch		\
  %D%/packages/patches/lua-CVE-2014-5461.patch                      \
  %D%/packages/patches/lua-pkgconfig.patch                      \
  %D%/packages/patches/lua51-liblua-so.patch                    \
@@ -1285,8 +1332,8 @@ dist_patch_DATA =						\
  %D%/packages/patches/luajit-no_ldconfig.patch			\
  %D%/packages/patches/luit-posix.patch				\
  %D%/packages/patches/lvm2-static-link.patch			\
+  %D%/packages/patches/mailutils-fix-uninitialized-variable.patch	\
  %D%/packages/patches/make-impure-dirs.patch			\
-  %D%/packages/patches/mariadb-client-test-32bit.patch		\
  %D%/packages/patches/mars-install.patch			\
  %D%/packages/patches/mars-sfml-2.3.patch			\
  %D%/packages/patches/maxima-defsystem-mkdir.patch		\
@@ -1307,6 +1354,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/mingw-w64-6.0.0-gcc.patch		\
  %D%/packages/patches/mingw-w64-dlltool-temp-prefix.patch	\
  %D%/packages/patches/mingw-w64-reproducible-gendef.patch	\
+  %D%/packages/patches/minimap2-aarch64-support.patch		\
  %D%/packages/patches/minisat-friend-declaration.patch		\
  %D%/packages/patches/minisat-install.patch			\
  %D%/packages/patches/mit-krb5-hurd.patch			\
@@ -1324,11 +1372,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/mozjs38-version-detection.patch		\
  %D%/packages/patches/mrrescue-support-love-11.patch		\
  %D%/packages/patches/mtools-mformat-uninitialized.patch	\
-  %D%/packages/patches/multipath-tools-sans-systemd.patch	\
  %D%/packages/patches/mumps-build-parallelism.patch		\
  %D%/packages/patches/mumps-shared-libseq.patch		\
  %D%/packages/patches/mumps-shared-mumps.patch			\
  %D%/packages/patches/mumps-shared-pord.patch			\
+  %D%/packages/patches/mupdf-fix-linkage.patch			\
  %D%/packages/patches/mupen64plus-ui-console-notice.patch	\
  %D%/packages/patches/mupen64plus-video-z64-glew-correct-path.patch    \
  %D%/packages/patches/musl-cross-locale.patch			\
@@ -1336,7 +1384,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/m4-gnulib-libio.patch			\
  %D%/packages/patches/ncompress-fix-softlinks.patch		\
  %D%/packages/patches/netcdf-date-time.patch			\
-  %D%/packages/patches/netcdf-tst_h_par.patch			\
  %D%/packages/patches/netpbm-CVE-2017-2586.patch		\
  %D%/packages/patches/netpbm-CVE-2017-2587.patch		\
  %D%/packages/patches/netsurf-message-timestamp.patch		\
@@ -1346,17 +1393,17 @@ dist_patch_DATA =						\
  %D%/packages/patches/nfs4-acl-tools-0.3.7-fixpaths.patch	\
  %D%/packages/patches/ngircd-handle-zombies.patch		\
  %D%/packages/patches/network-manager-plugin-path.patch	\
+  %D%/packages/patches/nginx-socket-cloexec.patch		\
  %D%/packages/patches/nsis-env-passthru.patch			\
  %D%/packages/patches/nss-increase-test-timeout.patch		\
-  %D%/packages/patches/nss-pkgconfig.patch			\
+  %D%/packages/patches/nss-3.56-pkgconfig.patch			\
  %D%/packages/patches/ntfs-3g-CVE-2019-9755.patch		\
  %D%/packages/patches/nvi-assume-preserve-path.patch		\
  %D%/packages/patches/nvi-dbpagesize-binpower.patch		\
  %D%/packages/patches/nvi-db4.patch				\
  %D%/packages/patches/nyacc-binary-literals.patch		\
-  %D%/packages/patches/oath-toolkit-glibc-compat.patch		\
-  %D%/packages/patches/ocaml-bisect-fix-camlp4-in-another-directory.patch	\
  %D%/packages/patches/ocaml-bitstring-fix-configure.patch \
+  %D%/packages/patches/ocaml-cairo2-caml_ba_array-fix.patch     \
  %D%/packages/patches/ocaml-CVE-2015-8869.patch		\
  %D%/packages/patches/ocaml-Add-a-.file-directive.patch	\
  %D%/packages/patches/ocaml-enable-ocamldoc-reproducibility.patch	\
@@ -1373,7 +1420,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/openfoam-4.1-cleanup.patch			\
  %D%/packages/patches/openjdk-10-idlj-reproducibility.patch	\
  %D%/packages/patches/openmpi-mtl-priorities.patch		\
-  %D%/packages/patches/openocd-nrf52.patch			\
+  %D%/packages/patches/openssh-fix-ssh-copy-id.patch		\
  %D%/packages/patches/openssh-hurd.patch			\
  %D%/packages/patches/openresolv-restartcmd-guix.patch	\
  %D%/packages/patches/openscad-parser-boost-1.72.patch	\
@@ -1391,10 +1438,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/p7zip-CVE-2017-17969.patch		\
  %D%/packages/patches/p7zip-remove-unused-code.patch		\
  %D%/packages/patches/pam-krb5-CVE-2020-10595.patch		\
-  %D%/packages/patches/pam-mount-luks2-support.patch		\
  %D%/packages/patches/pango-skip-libthai-test.patch		\
  %D%/packages/patches/pciutils-hurd-configure.patch		\
+  %D%/packages/patches/pciutils-hurd-fix.patch			\
+  %D%/packages/patches/plasma-framework-fix-KF5PlasmaMacros.cmake.patch \
  %D%/packages/patches/ppsspp-disable-upgrade-and-gold.patch		\
+  %D%/packages/patches/samba-fix-fcntl-hint-detection.patch		\
+  %D%/packages/patches/sdcc-disable-non-free-code.patch		\
  %D%/packages/patches/sdl-pango-api_additions.patch		\
  %D%/packages/patches/sdl-pango-blit_overflow.patch		\
  %D%/packages/patches/sdl-pango-fillrect_crash.patch		\
@@ -1402,6 +1452,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/sdl-pango-matrix_declarations.patch	\
  %D%/packages/patches/sdl-pango-sans-serif.patch		\
  %D%/packages/patches/sqlite-hurd.patch			\
+  %D%/packages/patches/sunxi-tools-remove-sys-io.patch	\
  %D%/packages/patches/patchutils-test-perms.patch		\
  %D%/packages/patches/patch-hurd-path-max.patch		\
  %D%/packages/patches/perl-autosplit-default-time.patch	\
@@ -1415,7 +1466,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/perl-text-markdown-discount-unbundle.patch	\
  %D%/packages/patches/perl-module-pluggable-search.patch	\
  %D%/packages/patches/perl-reproducible-build-date.patch	\
+  %D%/packages/patches/perl-www-curl-fix-struct-void.patch	\
  %D%/packages/patches/perl-www-curl-remove-symbol.patch	\
+  %D%/packages/patches/picard-fix-id3-rename-test.patch		\
  %D%/packages/patches/picprog-non-intel-support.patch		\
  %D%/packages/patches/pidgin-add-search-path.patch		\
  %D%/packages/patches/pidgin-libnm.patch			\
@@ -1465,17 +1518,15 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-3-search-paths.patch		\
  %D%/packages/patches/python-3-fix-tests.patch			\
  %D%/packages/patches/python-3.8-fix-tests.patch		\
+  %D%/packages/patches/python-3.9-fix-tests.patch		\
  %D%/packages/patches/python-CVE-2018-14647.patch		\
-  %D%/packages/patches/python-aiohttp-3.6.2-no-warning-fail.patch	\
  %D%/packages/patches/python-aionotify-0.2.0-py3.8.patch	\
  %D%/packages/patches/python-argcomplete-1.11.1-fish31.patch	\
  %D%/packages/patches/python-axolotl-AES-fix.patch		\
-  %D%/packages/patches/python-cairocffi-dlopen-path.patch	\
  %D%/packages/patches/python-cross-compile.patch		\
  %D%/packages/patches/python2-larch-coverage-4.0a6-compatibility.patch \
  %D%/packages/patches/python-configobj-setuptools.patch	\
  %D%/packages/patches/python-flask-restful-werkzeug-compat.patch	\
-  %D%/packages/patches/python-gst-fix-build-with-python-3.8.patch	\
  %D%/packages/patches/python-keras-integration-test.patch	\
  %D%/packages/patches/python-pep8-stdlib-tokenize-compat.patch \
  %D%/packages/patches/python-pyfakefs-remove-bad-test.patch	\
@@ -1490,16 +1541,17 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-paste-remove-timing-test.patch	\
  %D%/packages/patches/python-pycrypto-CVE-2013-7459.patch	\
  %D%/packages/patches/python-pycrypto-time-clock.patch		\
-  %D%/packages/patches/python2-pygobject-2-gi-info-type-error-domain.patch \
+  %D%/packages/patches/python-pydot-regression-test.patch	\
+  %D%/packages/patches/python2-pygobject-2-deprecation.patch	\
  %D%/packages/patches/python-pygpgme-fix-pinentry-tests.patch	\
-  %D%/packages/patches/python-robotframework-honor-source-date-epoch.patch \
+  %D%/packages/patches/python-robotframework-source-date-epoch.patch \
  %D%/packages/patches/python-shouldbe-0.1.2-cpy3.8.patch	\
  %D%/packages/patches/python2-subprocess32-disable-input-test.patch	\
-  %D%/packages/patches/python-tinycss2-flake8-compat.patch	\
  %D%/packages/patches/python-unittest2-python3-compat.patch	\
  %D%/packages/patches/python-unittest2-remove-argparse.patch	\
  %D%/packages/patches/python-waitress-fix-tests.patch		\
  %D%/packages/patches/pypy3-7.3.1-fix-tests.patch		\
+  %D%/packages/patches/qemu-build-info-manual.patch		\
  %D%/packages/patches/qemu-glibc-2.27.patch 			\
  %D%/packages/patches/qrcodegen-cpp-make-install.patch		\
  %D%/packages/patches/qt4-ldflags.patch			\
@@ -1518,11 +1570,13 @@ dist_patch_DATA =						\
  %D%/packages/patches/raptor2-heap-overflow.patch		\
  %D%/packages/patches/ratpoints-sturm_and_rp_private.patch	\
  %D%/packages/patches/ratpoison-shell.patch			\
-  %D%/packages/patches/rcs-5.9.4-noreturn.patch			\
+  %D%/packages/patches/rcs-5.10.0-no-stdin.patch		\
  %D%/packages/patches/rct-add-missing-headers.patch		\
  %D%/packages/patches/readline-link-ncurses.patch		\
  %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
+  %D%/packages/patches/renpy-use-system-fribidi.patch		\
  %D%/packages/patches/reposurgeon-add-missing-docbook-files.patch	\
+  %D%/packages/patches/r-httpuv-1.5.4-unvendor-libuv.patch	\
  %D%/packages/patches/ri-li-modernize_cpp.patch		\
  %D%/packages/patches/ripperx-missing-file.patch		\
  %D%/packages/patches/rpcbind-CVE-2017-8779.patch		\
@@ -1543,21 +1597,22 @@ dist_patch_DATA =						\
  %D%/packages/patches/rust-1.45-linker-locale.patch		\
  %D%/packages/patches/rust-bootstrap-stage0-test.patch		\
  %D%/packages/patches/rust-coresimd-doctest.patch		\
+  %D%/packages/patches/rust-ndarray-remove-blas-src-dep.patch	\
  %D%/packages/patches/rust-nettle-disable-vendor.patch		 \
  %D%/packages/patches/rust-nettle-sys-disable-vendor.patch	 \
  %D%/packages/patches/rust-reproducible-builds.patch		 \
  %D%/packages/patches/rust-openssl-sys-no-vendor.patch	\
  %D%/packages/patches/rxvt-unicode-escape-sequences.patch	\
-  %D%/packages/patches/sbcl-graph-asdf-definitions.patch	\
+  %D%/packages/patches/sbcl-clml-fix-types.patch		\
  %D%/packages/patches/scalapack-blacs-mpi-deprecations.patch	\
  %D%/packages/patches/scheme48-tests.patch			\
  %D%/packages/patches/scotch-build-parallelism.patch		\
  %D%/packages/patches/scotch-integer-declarations.patch	\
  %D%/packages/patches/screen-hurd-path-max.patch		\
-  %D%/packages/patches/scribus-1.5.5-poppler-0.86-build-fix.patch	\
  %D%/packages/patches/sdl-libx11-1.6.patch			\
  %D%/packages/patches/seed-webkit.patch			\
  %D%/packages/patches/seq24-rename-mutex.patch			\
+  %D%/packages/patches/serf-python3.patch			\
  %D%/packages/patches/sharutils-CVE-2018-1000097.patch		\
  %D%/packages/patches/shadow-hurd-pctrl.patch			\
  %D%/packages/patches/shishi-fix-libgcrypt-detection.patch	\
@@ -1568,7 +1623,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/slim-login.patch				\
  %D%/packages/patches/slim-display.patch			\
  %D%/packages/patches/snappy-add-O2-flag-in-CmakeLists.txt.patch	\
-  %D%/packages/patches/sooperlooper-build-with-wx-30.patch 	\
  %D%/packages/patches/sphinxbase-fix-doxygen.patch		\
  %D%/packages/patches/sssd-fix-samba.patch			\
  %D%/packages/patches/sssd-system-directories.patch		\
@@ -1610,16 +1664,17 @@ dist_patch_DATA =						\
  %D%/packages/patches/tipp10-remove-license-code.patch		\
  %D%/packages/patches/tk-find-library.patch			\
  %D%/packages/patches/transcode-ffmpeg.patch	\
+  %D%/packages/patches/transmission-honor-localedir.patch	\
  %D%/packages/patches/ttf2eot-cstddef.patch			\
-  %D%/packages/patches/ttfautohint-source-date-epoch.patch	\
-  %D%/packages/patches/tomb-fix-errors-on-open.patch		\
  %D%/packages/patches/tup-unbundle-dependencies.patch		\
  %D%/packages/patches/tuxpaint-stamps-path.patch		\
  %D%/packages/patches/twinkle-bcg729.patch			\
  %D%/packages/patches/u-boot-riscv64-fix-extlinux.patch	\
  %D%/packages/patches/ucx-tcp-iface-ioctl.patch		\
  %D%/packages/patches/udiskie-no-appindicator.patch		\
+  %D%/packages/patches/ungoogled-chromium-extension-search-path.patch	\
  %D%/packages/patches/ungoogled-chromium-system-nspr.patch	\
+  %D%/packages/patches/unison-fix-ocaml-4.08.patch		\
  %D%/packages/patches/unknown-horizons-python-3.8-distro.patch	\
  %D%/packages/patches/unzip-CVE-2014-8139.patch		\
  %D%/packages/patches/unzip-CVE-2014-8140.patch		\
@@ -1653,10 +1708,10 @@ dist_patch_DATA =						\
  %D%/packages/patches/vte-CVE-2012-2738-pt1.patch			\
  %D%/packages/patches/vte-CVE-2012-2738-pt2.patch			\
  %D%/packages/patches/warsow-qfusion-fix-bool-return-type.patch	\
-  %D%/packages/patches/weasyprint-library-paths.patch		\
  %D%/packages/patches/webkitgtk-share-store.patch		\
  %D%/packages/patches/webkitgtk-bind-all-fonts.patch		\
  %D%/packages/patches/websocketpp-fix-for-cmake-3.15.patch	\
+  %D%/packages/patches/wgetpaste-update-bpaste.patch		\
  %D%/packages/patches/wicd-bitrate-none-fix.patch		\
  %D%/packages/patches/wicd-get-selected-profile-fix.patch	\
  %D%/packages/patches/wicd-urwid-1.3.patch			\
@@ -1672,11 +1727,11 @@ dist_patch_DATA =						\
  %D%/packages/patches/xf86-video-mach64-glibc-2.20.patch	\
  %D%/packages/patches/xf86-video-savage-xorg-compat.patch 	\
  %D%/packages/patches/xf86-video-siliconmotion-fix-ftbfs.patch \
-  %D%/packages/patches/xf86-video-sis-xorg-compat.patch 	\
  %D%/packages/patches/xf86-video-tga-remove-mibstore.patch	\
  %D%/packages/patches/xf86-video-voodoo-pcitag.patch		\
  %D%/packages/patches/xfce4-panel-plugins.patch		\
  %D%/packages/patches/xfce4-settings-defaults.patch		\
+  %D%/packages/patches/xmonad-dynamic-linking.patch		\
  %D%/packages/patches/xplanet-1.3.1-cxx11-eof.patch		\
  %D%/packages/patches/xplanet-1.3.1-libdisplay_DisplayOutput.cpp.patch	\
  %D%/packages/patches/xplanet-1.3.1-libimage_gif.c.patch	\
@@ -1687,6 +1742,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/xsane-fix-snprintf-buffer-length.patch	\
  %D%/packages/patches/xsane-support-ipv6.patch			\
  %D%/packages/patches/xsane-tighten-default-umask.patch	\
+  %D%/packages/patches/yggdrasil-extra-config.patch	\
  %D%/packages/patches/zziplib-CVE-2018-16548.patch

 MISC_DISTRO_FILES =				\
@@ -37,6 +37,7 @@
  #:use-module (guix ssh)
  #:use-module (guix store)
  #:use-module (guix utils)
+  #:use-module ((guix self) #:select (make-config.scm))
  #:use-module (gcrypt pk-crypto)
  #:use-module (ice-9 format)
  #:use-module (ice-9 match)
@@ -172,6 +173,8 @@ exist on the machine."
              (and (file-system-mount? fs)
                   (not (member (file-system-type fs)
                                %pseudo-file-system-types))
+                   ;; Don't try to validate network file systems.
+                   (not (string-prefix? "nfs" (file-system-type fs)))
                   (not (memq 'bind-mount (file-system-flags fs)))))
            (operating-system-file-systems (machine-operating-system machine))))

@@ -351,8 +354,9 @@ of MACHINE's system profile, ordered from most recent to oldest."

  (define remote-exp
    (with-extensions (list guile-gcrypt)
-      (with-imported-modules (source-module-closure '((guix config)
-                                                      (guix profiles)))
+      (with-imported-modules (source-module-closure
+                              `(((guix config) => ,(make-config.scm))
+                                (guix profiles)))
        #~(begin
            (use-modules (guix config)
                         (guix profiles)
@@ -478,6 +482,12 @@ an environment type of 'managed-host."
                                 (raise roll-back-failure)))
                       (entries -> (map boot-parameters->menu-entry
                                        (list (second boot-parameters))))
+                       (locale -> (boot-parameters-locale
+                                   (second boot-parameters)))
+                       (crypto-dev -> (boot-parameters-store-crypto-devices
+                                       (second boot-parameters)))
+                       (store-dir -> (boot-parameters-store-directory-prefix
+                                      (second boot-parameters)))
                       (old-entries -> (map boot-parameters->menu-entry
                                            (drop boot-parameters 2)))
                       (bootloader -> (operating-system-bootloader
@@ -487,6 +497,9 @@ an environment type of 'managed-host."
                                   (bootloader-configuration-bootloader
                                    bootloader))
                                  bootloader entries
+                                  #:locale locale
+                                  #:store-crypto-devices crypto-dev
+                                  #:store-directory-prefix store-dir
                                  #:old-entries old-entries)))
                       (remote-result (machine-remote-eval machine remote-exp)))
    (when (eqv? 'error remote-result)
@@ -19,6 +19,7 @@

 (define-module (gnu packages abduco)
  #:use-module (guix build-system gnu)
+  #:use-module (guix utils)
  #:use-module (guix download)
  #:use-module (guix licenses)
  #:use-module (guix packages))
@@ -37,7 +38,7 @@
              "1x1m58ckwsprljgmdy93mvgjyg9x3cqrzdf3mysp0mx97zhhj2f9"))))
   (build-system gnu-build-system)
   (arguments
-    `(#:make-flags (list "CC=gcc"
+    `(#:make-flags (list (string-append "CC=" ,(cc-for-target))
                         (string-append "PREFIX=" (assoc-ref %outputs "out")))
      #:phases (modify-phases %standard-phases
                 (delete 'configure)
@@ -3,6 +3,7 @@
 ;;; Copyright © 2017 Stefan Reichör <stefan@xsteve.at>
 ;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Andrew Miloradovsky <andrew@interpretmath.pw>
+;;; Copyright © 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -272,7 +273,7 @@ available to help to click.")
       `(("hidapi" ,hidapi)))
      (arguments
       `(#:tests? #f ; no tests
-         #:make-flags (list "CC=gcc")
+         #:make-flags (list (string-append "CC=" ,(cc-for-target)))
         #:phases (modify-phases %standard-phases
                    (delete 'configure)
                    ;; Install target in the Makefile does not work for Guix
@@ -308,7 +309,7 @@ devices have vendorId:productId = 0c45:7403 or 0c45:7404.")
    (arguments
     `(#:tests? #f ; none included
       #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
             (string-append "prefix=" (assoc-ref %outputs "out")))
       #:phases
       (modify-phases %standard-phases
@@ -5,6 +5,7 @@
 ;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2019 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,6 +26,7 @@
  #:use-module (guix licenses)
  #:use-module (gnu packages attr)
  #:use-module (gnu packages base)
+  #:use-module (gnu packages hurd)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages perl)
  #:use-module (guix packages)
@@ -49,6 +51,8 @@
     `(#:modules ((ice-9 ftw)
                  ,@%gnu-build-system-modules)
       #:configure-flags '("--disable-static")
+       #:tests? ,(not (or (%current-target-system)
+                          (hurd-target?)))
       #:phases
       (modify-phases %standard-phases
         ;; XXX After repacking the sources the timestamps are reset to the
@@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
+;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -24,10 +25,126 @@
  #:use-module (guix download)
  #:use-module (guix git-download)
  #:use-module (gnu packages)
+  #:use-module (gnu packages base)
  #:use-module (gnu packages check)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages python)
-  #:use-module (gnu packages python-xyz))
+  #:use-module (gnu packages python-xyz)
+  #:use-module (ice-9 match))
+
+(define-public ada/ed
+  (package
+    (name "ada-ed")
+    (version "1.11.2")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             ;; The HOME-PAGE sources, mirrored by one of the original authors.
+             (url "https://github.com/daveshields/AdaEd")
+             (commit "57daecfb7ccadfd9aaf13b4d54f51065affbe599")))
+       (sha256
+        (base32 "1k97a8nqsvbsadizrmhhypcx758sxqkai8wq3ckk853qxvzaasd8"))
+       (file-name (git-file-name name version))))
+    (build-system gnu-build-system)
+    (supported-systems (list "i686-linux" "x86_64-linux"
+                             "armhf-linux" "aarch64-linux"))
+    (outputs (list "out" "debug"))
+    (arguments
+     `(#:system
+       ,@(match (%current-system)
+           ;; This package predates 64-bit PCs: a ‘64-bit’ adaexec segfaults.
+           ;; Force a 32-bit build targeting a similar architecture.
+           ((or "armhf-linux" "aarch64-linux")
+            `("armhf-linux"))
+           (_
+            `("i686-linux")))
+       #:make-flags
+       (let ((out (assoc-ref %outputs "out")))
+         (list (string-append
+                "CFLAGS=-g"             ; compile with :debug symbols
+                " -DOP_SYS='\"GNU\"'"   ; sic; quoting gets mangled somewhere
+                " -DSYSTEM_V"           ; closest to modern GNU
+                " -DWORDSIZE32"
+                " -DALIGN4")            ; suffices on both x86 and ARM
+               "LFLAGS="                ; don't link against -lg
+               (string-append "BINDIR=" out "/bin")
+               (string-append "LIBDIR=" out "/lib")
+               (string-append "MANDIR=" out "/share/man")))
+       #:modules ((guix build gnu-build-system)
+                  (guix build utils)
+                  (srfi srfi-26))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-sources
+           (lambda _
+             ;; Rename the custom (and incompatible) getline() implementation.
+             (substitute* "adalex.c"
+               (("getline") "adaed_getline"))
+             ;; Work around ‘error: initializer element is not constant’ by not
+             ;; initialising MSGFILE.
+             (substitute* "vars.ch"
+               (("INIT\\(stdout\\)") ""))
+             #t))
+         (delete 'configure)            ; no configure script
+         (add-before 'build 'find-build-scripts
+           (lambda _
+             (setenv "PATH" (string-append ".:" (getenv "PATH")))
+             #t))
+         (add-after 'build 'build-predef
+           (lambda* (#:key make-flags #:allow-other-keys)
+             ;; These aren't otherwise compiled until the ‘install’ phase.
+             (apply invoke "make" "predef" make-flags)
+             #t))
+         (delete 'check)                ; no test suite; run our own below
+         (add-before 'install 'create-output-directories
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (mkdir-p (string-append out "/share/man/manl"))
+               #t)))
+         (add-after 'install 'check
+           ;; Run most of the included demos as our own ‘test suite’.
+           (lambda* (#:key outputs tests? #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (when tests?
+                 (setenv "ADAED" (string-append out "/lib"))
+                 (setenv "PATH" (string-append out "/bin:" (getenv "PATH")))
+                 (with-directory-excursion "demos" ; won't run outside of it
+                   (for-each
+                    delete-file
+                    '("runc"   ; ‘invalid data. Please make it a positive no.’
+                      "rund"   ; deadlocks by design
+                      "rune"   ; ‘dining2.ada: No such file or directory’
+                      "rung")) ; ‘mathlib cannot be used as a library’ (!)
+                   (for-each (lambda (script)
+                               (format #t "\n=== Invoking ~a ===\n" script)
+                               (invoke script))
+                             (find-files "." "^run")))))))
+         (add-after 'install 'clean-up-output
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (with-directory-excursion out
+                 ;; These needn't be executable.
+                 (for-each (cut chmod <> #o644)
+                           (append (find-files "lib" "\\....$")
+                                   (find-files "share" ".")))
+                 #t)))))))
+    (native-inputs
+     `(("sed" ,sed)))
+    (home-page (string-append "https://web.archive.org/web/20140902150609/"
+                              "http://www2.informatik.uni-stuttgart.de/iste/ps/"
+                              "ada-software/html/dos_ada.html"))
+    (synopsis "Ada 83 interpreter")
+    (description "Ada/Ed is a translator-interpreter for Ada 83.  It's intended
+primarily as a teaching tool and lacks the capacity, performance, and robustness
+of other contemporary or modern-day Ada compilers.
+
+Ada/Ed was the first Ada compiler to pass the @acronym{ACVC, Ada Compiler
+Validation Suite} version 1.7 but fails many newer tests and is not a validated
+Ada system.  Being an interpreter, it does not implement most representation
+clauses, and thus does not support systems programming close to the machine
+level.")
+    (license license:gpl2+)))

 (define-public python2-langkit
  (let ((commit "fe0bc8bf60dbd2937759810df76ac420d99fc15f")
@@ -6,10 +6,10 @@
 ;;; Copyright © 2015, 2016 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
 ;;; Copyright © 2015 Alex Sassmannshausen <alex.sassmannshausen@gmail.com>
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
-;;; Copyright © 2016, 2017 Leo Famulari <leo@famulari.name>
+;;; Copyright © 2016, 2017, 2020 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2016 Pjotr Prins <pjotr.guix@thebird.nl>
 ;;; Copyright © 2016, 2017 Ricardo Wurmus <rekado@elephly.net>
-;;; Copyright © 2016, 2017, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Peter Feigl <peter.feigl@nexoid.at>
 ;;; Copyright © 2016 John J. Foerch <jjfoerch@earthlink.net>
 ;;; Copyright © 2016, 2017 Nikita <nikita@n0.is>
@@ -56,6 +56,7 @@
  #:use-module (guix build-system emacs)
  #:use-module (guix build-system glib-or-gtk)
  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
  #:use-module (guix build-system meson)
  #:use-module (guix build-system perl)
  #:use-module (guix build-system python)
@@ -106,6 +107,7 @@
  #:use-module (gnu packages libusb)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages lua)
+  #:use-module (gnu packages mail)
  #:use-module (gnu packages man)
  #:use-module (gnu packages mcrypt)
  #:use-module (gnu packages mpi)
@@ -313,7 +315,7 @@ interface and is based on GNU Guile.")
 (define-public cloud-utils
  (package
    (name "cloud-utils")
-    (version "0.31")
+    (version "0.32")
    (source
     (origin
       (method url-fetch)
@@ -322,7 +324,7 @@ interface and is based on GNU Guile.")
             version "/+download/cloud-utils-" version ".tar.gz"))
       (sha256
        (base32
-         "07fl3dlqwdzw4xx7mcxhpkks6dnmaxha80zgs9f6wmibgzni8z0r"))))
+         "0xxdi55lzw7j91zfajw7jhd2ilsqj2dy04i9brlk8j3pvb5ma8hk"))))
    (build-system gnu-build-system)
    (arguments
     '(#:make-flags
@@ -443,7 +445,7 @@ graphs and can export its output to different formats.")
 (define-public facter
  (package
    (name "facter")
-    (version "4.0.34")
+    (version "4.0.47")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -452,7 +454,7 @@ graphs and can export its output to different formats.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "19lcmmcnxkbirvh5bn5xa9a99z48zmb1b8845cp5r598y019gxqp"))))
+                "1zz5kk3ad1jj8y939369dfvjh7zqwpkcqzzad7yb6wp01rc5sf88"))))
    (build-system ruby-build-system)
    (arguments
     `(#:phases
@@ -514,7 +516,7 @@ or via the @code{facter} Ruby library.")
 (define-public htop
  (package
    (name "htop")
-    (version "3.0.0")
+    (version "3.0.4")
    (source
     (origin
       (method git-fetch)
@@ -522,15 +524,14 @@ or via the @code{facter} Ruby library.")
             (url "https://github.com/htop-dev/htop")
             (commit version)))
       (sha256
-        (base32 "096gdnpaszs5rfp7qj8npi2jkvdqpp8mznn89f97ykrg6pgagwq4"))
+        (base32 "1fckfv96vzqjs3lzy0cgwsqv5vh1sxca3fhvgskmnkvr5bq6cia9"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (inputs
     `(("ncurses" ,ncurses)))
    (native-inputs
     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("python" ,python-wrapper)))     ; for scripts/MakeHeader.py
+       ("automake" ,automake)))
    (home-page "https://htop.dev")
    (synopsis "Interactive process viewer")
    (description
@@ -565,7 +566,7 @@ memory, disks, network and processes.")
 (define-public pies
  (package
    (name "pies")
-    (version "1.4")
+    (version "1.5")
    (source
     (origin
       (method url-fetch)
@@ -573,7 +574,7 @@ memory, disks, network and processes.")
                           version ".tar.bz2"))
       (sha256
        (base32
-         "14jb4pa4zs26d5j2skxbaypnwhsx2lw8jgj1irrgs03c2dnf7gp6"))))
+         "11j168qljsinaj5dwmg7nkm2z1aghi6gc3d0wf0pikflnh2q2wqf"))))
    (build-system gnu-build-system)
    (arguments
     '(#:phases (modify-phases %standard-phases
@@ -828,7 +829,7 @@ would need and has several interesting built-in capabilities.")
 (define-public netcat-openbsd
  (package
    (name "netcat-openbsd")
-    (version "1.217-1")
+    (version "1.217-2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -837,12 +838,12 @@ would need and has several interesting built-in capabilities.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0kcvi3pav2fdx5c22psjv5dggk4cmrqiaq2cklhqngsk4a7vrjan"))))
+                "19sr52ix14w344pv13ppb0c1wyg5dxhic1fw2q0s3qfmx57b9hhp"))))
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f                      ; no test suite
       #:make-flags
-       (list "CC=gcc")
+       (list (string-append "CC=" ,(cc-for-target)))
       #:phases
       (modify-phases %standard-phases
         (delete 'configure)
@@ -1343,9 +1344,11 @@ at once based on a Perl regular expression.")

       #:phases (modify-phases %standard-phases
                  (add-after 'unpack 'patch-paths
-                    (lambda _
+                    (lambda* (#:key inputs #:allow-other-keys)
                      (substitute* "rc/rc"
-                        (("/usr/sbin/sendmail") "sendmail"))
+                        (("/usr/sbin/sendmail")
+                         (string-append (assoc-ref inputs "mailutils")
+                                        "/bin/mail")))
                      #t))
                  (add-after 'unpack 'fix-configure
                    (lambda* (#:key inputs native-inputs #:allow-other-keys)
@@ -1384,7 +1387,8 @@ at once based on a Perl regular expression.")
    (native-inputs `(("texinfo" ,texinfo)
                     ("automake" ,automake)
                     ("util-linux" ,util-linux))) ; for 'cal'
-    (inputs `(("coreutils*" ,coreutils)))
+    (inputs `(("coreutils*" ,coreutils)
+              ("mailutils" ,mailutils)))
    (home-page "https://www.gnu.org/software/rottlog/")
    (synopsis "Log rotation and management")
    (description
@@ -1398,7 +1402,7 @@ system administrator.")
 (define-public sudo
  (package
    (name "sudo")
-    (version "1.9.2")
+    (version "1.9.4p2")
    (source (origin
              (method url-fetch)
              (uri
@@ -1408,25 +1412,19 @@ system administrator.")
                                    version ".tar.gz")))
              (sha256
               (base32
-                "05432672iilb7s52j9l9xzrlambb1wg3k7qvf5973i41y40x563w"))
+                "0r0g8z289ipw0zpkhmm33cpfm42j01jds2q1wilhh3flg7xg2jn3"))
              (modules '((guix build utils)))
              (snippet
               '(begin
                  (delete-file-recursively "lib/zlib")
                  #t))))
    (build-system gnu-build-system)
-    (outputs (list "out" "python"))
+    (outputs (list "out"))
    (arguments
     `(#:configure-flags
       (list (string-append "--docdir=" (assoc-ref %outputs "out")
                            "/share/doc/" ,name "-" ,version)

-             ;; XXX: Disable Python support when cross-compiling because
-             ;; 'configure' tries to run 'python', which fails.
-             ,(if (%current-target-system)
-                  "--disable-python"
-                  "--enable-python")              ; for plug-ins written in ~
-
             "--with-logpath=/var/log/sudo.log"
             "--with-rundir=/var/run/sudo" ; must be cleaned up at boot time
             "--with-vardir=/var/db/sudo"
@@ -1473,34 +1471,19 @@ system administrator.")
             (substitute* "plugins/sudoers/Makefile.in"
               (("^pre-install:" match)
                (string-append match "\ndisabled-" match)))
-             #t))
-         (add-after 'install 'separate-python-output
-           (lambda* (#:key target outputs #:allow-other-keys)
-             (let ((out        (assoc-ref outputs "out"))
-                   (out:python (assoc-ref outputs "python")))
-               (if target
-                   (mkdir-p (string-append out:python "/empty"))
-                   (for-each
-                    (lambda (file)
-                      (let ((old (string-append out "/" file))
-                            (new (string-append out:python "/" file)))
-                        (mkdir-p (dirname new))
-                        (rename-file old new)))
-                    (list "libexec/sudo/python_plugin.so"
-                          "libexec/sudo/python_plugin.la")))
-               #t))))
+             #t)))

       ;; XXX: The 'testsudoers' test series expects user 'root' to exist, but
       ;; the chroot's /etc/passwd doesn't have it.  Turn off the tests.
       #:tests? #f))
    (native-inputs
-     `(("groff" ,groff)))
+     ;; XXX TODO: Remove on next rebuild cycle.
+     (if (hurd-target?)
+         '()
+         `(("groff" ,groff))))
    (inputs
     `(("coreutils" ,coreutils)
       ("linux-pam" ,linux-pam)
-       ,@(if (%current-target-system)
-             '()
-             `(("python" ,python)))
       ("zlib" ,zlib)))
    (home-page "https://www.sudo.ws/")
    (synopsis "Run commands as root")
@@ -1516,7 +1499,7 @@ commands and their arguments.")
 (define-public opendoas
  (package
    (name "opendoas")
-    (version "6.6.1")
+    (version "6.8")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1525,7 +1508,7 @@ commands and their arguments.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "07kkc5729p654jrgfsc8zyhiwicgmq38yacmwfvay2b3gmy728zn"))))
+                "1dlwnvy8r6slxcy260gfkximp1ms510wdslpfq9y6xvd2qi5izcb"))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases
@@ -1533,19 +1516,17 @@ commands and their arguments.")
         (replace 'configure
           ;; The configure script doesn't accept most of the default flags.
           (lambda* (#:key configure-flags #:allow-other-keys)
-             ;; The configure script can only be told which compiler to use
+             ;; The configure script can be told which compiler to use only
             ;; through environment variables.
             (setenv "CC" ,(cc-for-target))
             (apply invoke "./configure" configure-flags)))
         (add-before 'install 'fix-makefile
           (lambda* (#:key outputs #:allow-other-keys)
-             (substitute* "bsd.prog.mk"
+             (substitute* "GNUmakefile"
               (("^\tchown.*$") ""))
             #t)))
       #:configure-flags
       (list (string-append "--prefix=" (assoc-ref %outputs "out"))
-             ;; Nothing is done with this value (yet?) but it's supported.
-             ;; (string-append "--target=" (or ,(%current-target-system) ""))
             "--with-timestamp")
       ;; Compiler choice is not carried over from the configure script.
       #:make-flags
@@ -1583,10 +1564,10 @@ features of sudo with a fraction of the codebase.")
                    #t))))
    (build-system gnu-build-system)
    (arguments
-     '(#:phases
+     `(#:phases
       (modify-phases %standard-phases
         (replace 'configure
-           (lambda* (#:key outputs #:allow-other-keys)
+           (lambda _
             (chdir "wpa_supplicant")
             (copy-file "defconfig" ".config")
             (let ((port (open-file ".config" "al")))
@@ -1600,6 +1581,15 @@ features of sudo with a fraction of the codebase.")
      CONFIG_LIBNL32=y
      CONFIG_READLINE=y\n" port)
               (close-port port))
+             ;; Make sure we have a pkg-config when cross compiling
+             (substitute* '(".config"
+                            "Android.mk"
+                            "Makefile"
+                            "dbus/Makefile")
+               (("pkg-config")
+                (or (which "pkg-config")
+                    (which (string-append ,(%current-target-system)
+                                          "-pkg-config")))))
             #t))
         (add-after 'install 'install-documentation
           (lambda* (#:key outputs #:allow-other-keys)
@@ -1628,7 +1618,7 @@ features of sudo with a fraction of the codebase.")
                           "wpa_supplicant.conf"))
               #t))))

-      #:make-flags (list "CC=gcc"
+      #:make-flags (list (string-append "CC=" ,(cc-for-target))
                         (string-append "BINDIR=" (assoc-ref %outputs "out")
                                        "/sbin")
                         (string-append "LIBDIR=" (assoc-ref %outputs "out")
@@ -1738,10 +1728,10 @@ command.")
                "1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8"))))
    (build-system gnu-build-system)
    (arguments
-     '(#:phases
+     `(#:phases
       (modify-phases %standard-phases
         (replace 'configure
-           (lambda* (#:key outputs #:allow-other-keys)
+           (lambda _
             ;; This is mostly copied from 'wpa-supplicant' above.
             (chdir "hostapd")
             (copy-file "defconfig" ".config")
@@ -1753,6 +1743,14 @@ command.")
      CONFIG_IEEE80211AC=y\n" port)
               (close-port port))
             #t))
+         (add-after 'unpack 'patch-pkg-config
+           (lambda _
+             (substitute* "src/drivers/drivers.mak"
+               (("pkg-config")
+                (or (which "pkg-config")
+                    (string-append ,(%current-target-system)
+                                   "-pkg-config"))))
+             #t))
         (add-after 'install 'install-man-pages
           (lambda* (#:key outputs #:allow-other-keys)
             (let* ((out  (assoc-ref outputs "out"))
@@ -1769,7 +1767,7 @@ command.")
                         (find-files "." "\\.8"))
               #t))))

-      #:make-flags (list "CC=gcc"
+      #:make-flags (list (string-append "CC=" ,(cc-for-target))
                         (string-append "BINDIR=" (assoc-ref %outputs "out")
                                        "/sbin")
                         (string-append "LIBDIR=" (assoc-ref %outputs "out")
@@ -1831,21 +1829,24 @@ network, which causes enabled computers to power on.")
 (define-public dmidecode
  (package
    (name "dmidecode")
-    (version "3.2")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "mirror://savannah/dmidecode/dmidecode-"
-                    version ".tar.xz"))
-              (sha256
-               (base32
-                "1pcfhcgs2ifdjwp7amnsr3lq95pgxpr150bjhdinvl505px0cw07"))))
+    (version "3.3")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://savannah/dmidecode/dmidecode-"
+                           version ".tar.xz"))
+       (sha256
+        (base32 "0m8lzg9rf1qssasiix672bxk5qwms90561g8hfkkhk31h2kkgiw2"))))
    (build-system gnu-build-system)
    (arguments
-     '(#:phases (modify-phases %standard-phases (delete 'configure))
-       #:tests? #f                                ; no 'check' target
-       #:make-flags (list (string-append "prefix="
-                                         (assoc-ref %outputs "out")))))
+     `(#:tests? #f                                ; no 'check' target
+       #:make-flags
+       (list (string-append "CC=" ,(cc-for-target))
+             (string-append "prefix="
+                            (assoc-ref %outputs "out")))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure))))                   ; no configure script
    (home-page "https://www.nongnu.org/dmidecode/")
    (synopsis "Read hardware information from the BIOS")
    (description
@@ -1861,7 +1862,7 @@ module slots, and the list of I/O ports (e.g. serial, parallel, USB).")
 (define-public acpica
  (package
    (name "acpica")
-    (version "20200717")
+    (version "20201217")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -1869,13 +1870,13 @@ module slots, and the list of I/O ports (e.g. serial, parallel, USB).")
                    version ".tar.gz"))
              (sha256
               (base32
-                "0jyy71szjr40c8v40qqw6yh3gfk8d6sl3nay69zrn5d88i3r0jca"))))
+                "06rdpfjmij5nni1x2wi1gnalhsza5yxq1viskjm9r11wmsjnxm2a"))))
    (build-system gnu-build-system)
    (native-inputs `(("flex" ,flex)
                     ("bison" ,bison)))
    (arguments
-     '(#:make-flags (list (string-append "PREFIX=" %output)
-                          "CC=gcc"
+     `(#:make-flags (list (string-append "PREFIX=" %output)
+                          (string-append "CC=" ,(cc-for-target))
                          "HOST=_LINUX"
                          "OPT_CFLAGS=-Wall -fno-strict-aliasing")
       #:tests? #f                      ; no 'check' target
@@ -2081,7 +2082,7 @@ track changes in important system configuration files.")
 (define-public libcap-ng
  (package
    (name "libcap-ng")
-    (version "0.7.11")
+    (version "0.8")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -2089,7 +2090,7 @@ track changes in important system configuration files.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "1s8akhnnazk0b5c6z5i3x54rjb26p8pz2wdl1m21ml3231qmr0c5"))))
+                "08cy59iassiwbmfxa5v0kb374r80290vv32f5q1mnip11av26kgi"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
@@ -2192,13 +2193,13 @@ of supported upstream metrics systems simultaneously.")
 (define-public ansible
  (package
    (name "ansible")
-    (version "2.9.11")
+    (version "2.9.16")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "ansible" version))
       (sha256
-        (base32 "1c9ayh61qwasgncmlw7rjx5r4g5n2cpg1d5blgn53zg7xhrx1yc8"))))
+        (base32 "0j1icfqff25zm9sq6j41ipl6gcj3i67mb5bqbjf2f2q1yx6rm8sk"))))
    (build-system python-build-system)
    (native-inputs
     `(("python-bcrypt" ,python-bcrypt)
@@ -2395,17 +2396,20 @@ lookup to YAML Mode.  You could enable the mode with @code{(add-hook
     `(#:phases (modify-phases %standard-phases
                  (delete 'configure)
                  (replace 'build
-                    (lambda _
-                      (invoke "make" "CC=gcc" "-Csrc")))
+                    (lambda* (#:key make-flags #:allow-other-keys)
+                      (apply invoke "make" "-Csrc" make-flags)))
                  (replace 'check
-                    (lambda _
-                      (invoke "make" "CC=gcc" "-Ctests")))
+                    (lambda* (#:key tests? make-flags #:allow-other-keys)
+                      (when tests?
+                        (apply invoke "make" "-Ctests" make-flags))
+                      #t))
                  (replace 'install
                    (lambda* (#:key outputs #:allow-other-keys)
                      (let* ((out (assoc-ref outputs "out"))
                             (bin (string-append out "/bin")))
                        (install-file "src/cpulimit" bin))
-                      #t)))))
+                      #t)))
+       #:make-flags (list (string-append "CC=" ,(cc-for-target)))))
    (home-page "https://github.com/opsengine/cpulimit")
    (synopsis "Limit CPU usage")
    (description
@@ -2607,14 +2611,14 @@ done with the @code{auditctl} utility.")
 (define-public nmap
  (package
    (name "nmap")
-    (version "7.80")
+    (version "7.91")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://nmap.org/dist/nmap-" version
                                  ".tar.bz2"))
              (sha256
               (base32
-                "1aizfys6l9f9grm82bk878w56mg0zpkfns3spzj157h98875mypw"))
+                "001kb5xadqswyw966k2lqi6jr6zz605jpp9w4kmm272if184pk0q"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -2692,7 +2696,7 @@ advanced netcat implementation (ncat), a utility for comparing scan
 results (ndiff), and a packet generation and response analysis tool (nping).")
    ;; This package uses nmap's bundled versions of libdnet and liblinear, which
    ;; both use a 3-clause BSD license.
-    (license (list license:nmap license:bsd-3))))
+    (license (list license:npsl license:bsd-3))))

 (define-public dstat
  (package
@@ -2702,7 +2706,7 @@ results (ndiff), and a packet generation and response analysis tool (nping).")
     (origin
       (method git-fetch)
       (uri (git-reference
-             (url "https://github.com/dagwieers/dstat")
+             (url "https://github.com/dstat-real/dstat")
             (commit (string-append "v" version))))
       (file-name (git-file-name "dstat" version))
       (sha256
@@ -2712,9 +2716,8 @@ results (ndiff), and a packet generation and response analysis tool (nping).")
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f                      ; no make check
-       #:make-flags (let ((out (assoc-ref %outputs "out")))
-                      (list (string-append "DESTDIR=" out)
-                            "prefix=/"))
+       #:make-flags
+       (list (string-append "prefix=" (assoc-ref %outputs "out")))
       #:phases
       (modify-phases %standard-phases
         (add-after 'unpack 'fix-python3-DeprecationWarning
@@ -2895,9 +2898,13 @@ shortcut syntax and completion options.")
    (version "4.8")
    (source (origin
              (method url-fetch)
-              (uri (string-append
-                    "https://archives.eyrie.org/software/kerberos/"
-                    "pam-krb5-" version ".tar.xz"))
+              (uri
+                (list (string-append
+                        "https://archives.eyrie.org/software/kerberos/"
+                        "pam-krb5-" version ".tar.xz")
+                      (string-append
+                        "https://archives.eyrie.org/software/ARCHIVE/"
+                        "pam-krb5/pam-krb5-" version ".tar.xz")))
              (patches (search-patches "pam-krb5-CVE-2020-10595.patch"))
              (sha256
               (base32
@@ -2931,7 +2938,7 @@ with @code{ChallengeResponseAuthentication} and @code{PrivilegeSeparation}
 enabled, and supports extensive configuration either by PAM options or in
 krb5.conf or both.  PKINIT is supported with recent versions of both MIT
 Kerberos and Heimdal and FAST is supported with recent MIT Kerberos.")
-    (home-page "https://www.eyrie.org/~eagle/software/pam-krb5")
+    (home-page "https://www.eyrie.org/~eagle/software/pam-krb5/")
    ;; Dual licenced under  a homebrew non-copyleft OR GPL (any version)
    ;; However, the tarball does not contain a copy of the GPL,  so unless
    ;; we put one in, we cannot distribute it under GPL without violating
@@ -2946,6 +2953,8 @@ Kerberos and Heimdal and FAST is supported with recent MIT Kerberos.")
             (commit (string-append "v" version))))
       (sha256
        (base32 "04f3jqg8ww4jxsf9c6ddcdgy2xbhkyp0b3l5f1hvvbv94p81rjxd"))
+       (patches
+        (search-patches "sunxi-tools-remove-sys-io.patch"))
       (modules '((guix build utils)))
       (snippet
        ;; Remove binaries contained in the tarball which are only for the
@@ -3104,7 +3113,7 @@ buffers.")
 (define-public igt-gpu-tools
  (package
    (name "igt-gpu-tools")
-    (version "1.24")
+    (version "1.25")
    (source
     (origin
       (method git-fetch)
@@ -3113,27 +3122,22 @@ buffers.")
             (commit (string-append "igt-gpu-tools-" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1gpdjs5aj6vsnzwcjvw5bb120lgffvvshi4202phr0bzw3b92ky8"))))
-    (build-system gnu-build-system)
+        (base32 "1lvhkdhilw0fn4nzkpfwvrhiv8d92h811qs2v6ac3p5w7v86a9zm"))))
+    (build-system meson-build-system)
    (arguments
     `(#:tests? #f))            ; many of the tests try to load kernel modules
    (inputs
     `(("cairo" ,cairo)
       ("elfutils" ,elfutils)           ; libdw
       ("eudev" ,eudev)
-       ("glib" ,glib)
       ("kmod" ,kmod)
       ("libdrm" ,libdrm)
       ("libpciaccess" ,libpciaccess)
       ("libunwind" ,libunwind)
-       ("libxrandr" ,libxrandr)
-       ("openssl" ,openssl)
-       ("procps" ,procps)
-       ("util-macros" ,util-macros)))
+       ("procps" ,procps)))
    (native-inputs
-     `(("autoconf" ,autoconf)
-       ("automake" ,automake)
-       ("libtool" ,libtool)
+     `(("bison" ,bison)
+       ("flex" ,flex)
       ("pkg-config" ,pkg-config)))
    (home-page "https://gitlab.freedesktop.org/drm/igt-gpu-tools")
    (synopsis "Tools for development and testing of the Intel DRM driver")
@@ -3371,14 +3375,14 @@ information tool.")
 (define-public nnn
  (package
    (name "nnn")
-    (version "3.4")
+    (version "3.5")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://github.com/jarun/nnn/releases/download/v"
                           version "/nnn-v" version ".tar.gz"))
       (sha256
-        (base32 "189h950m1jjrnhvgcvzk6nj89l58rkxim7bxa0441ssajxpaw0vq"))))
+        (base32 "1ww18vvfjkvi36rcamw8kpix4bhk71w5bw9kmnh158crah1x8dp6"))))
    (build-system gnu-build-system)
    (inputs
     `(("ncurses" ,ncurses)
@@ -3386,15 +3390,23 @@ information tool.")
    (native-inputs
     `(("pkg-config" ,pkg-config)))
    (arguments
-     '(#:tests? #f                      ; no tests
+     `(#:tests? #f                      ; no tests
       #:phases
       (modify-phases %standard-phases
-         (delete 'configure))           ; no configure script
+         (delete 'configure)            ; no configure script
+         (add-after 'unpack 'patch-pkg-config
+           (lambda _
+             (substitute* "Makefile"
+               (("pkg-config")
+                (or (which "pkg-config")
+                    (string-append ,(%current-target-system)
+                                   "-pkg-config"))))
+             #t)))
       #:make-flags
       (list
        (string-append "PREFIX="
                       (assoc-ref %outputs "out"))
-        "CC=gcc")))
+        (string-append "CC=" ,(cc-for-target)))))
    (home-page "https://github.com/jarun/nnn")
    (synopsis "Terminal file browser")
    (description "@command{nnn} is a fork of @command{noice}, a blazing-fast
@@ -3407,40 +3419,56 @@ make it a perfect utility on modern distros.")
 (define-public thermald
  (package
    (name "thermald")
-    (version "1.9.1")
+    (version "2.4.1")
    (source
     (origin
      (method git-fetch)
      (uri (git-reference
-             (url "https://github.com/01org/thermal_daemon")
+             (url "https://github.com/intel/thermal_daemon")
             (commit (string-append "v" version))))
      (file-name (git-file-name name version))
      (sha256
-       (base32 "0iagc3jqpnh6q2fa1gx4wx6r8qg0556j60xr159zqg95djr4dv99"))))
+       (base32 "0rlac7v1b59m7gh767hkd8a0r4p001nd24786fnmryygbxynd2s6"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
-       (let ((out      (assoc-ref %outputs "out")))
-         (list (string-append "--sysconfdir="
-                              out "/etc")
-               (string-append "--with-dbus-sys-dir="
+       (let ((out (assoc-ref %outputs "out")))
+         (list (string-append "--with-dbus-sys-dir="
                              out "/etc/dbus-1/system.d")
-               "--localstatedir=/var"))))
+               "--localstatedir=/var"))
+       #:make-flags
+       (list "V=1")                     ; log build commands
+       #:phases
+       (modify-phases %standard-phases
+         (add-before 'bootstrap 'no-early-./configure
+           (lambda _
+             (setenv "NO_CONFIGURE" "yet")
+             ;; XXX thd_trip_point.h redefines "__STDC_LIMIT_MACROS" after
+             ;; <xz>/include/lzma.h.  ./configure forcibly appends -Werror
+             ;; to CXXFLAGS, overriding any -Wno-error we'd add.
+             (substitute* "configure.ac"
+               (("-Werror") ""))
+             #t)))))
    (native-inputs
     `(("autoconf" ,autoconf)
+       ("autoconf-archive" ,autoconf-archive)
       ("automake" ,automake)
       ("glib" ,glib "bin")             ; for glib-genmarshal, etc.
+       ("gtk-doc" ,gtk-doc)
       ("pkg-config" ,pkg-config)))
    (inputs
     `(("dbus-glib" ,dbus-glib)
-       ("libxml2" ,libxml2)))
+       ("libevdev" ,libevdev)
+       ("libxml2" ,libxml2)
+       ("upower" ,upower)
+       ("xz" ,xz)))
    (home-page "https://01.org/linux-thermal-daemon/")
    (synopsis "CPU scaling for thermal management")
    (description "The Linux Thermal Daemon helps monitor and control temperature
 on systems running the Linux kernel.")
    ;; arm and aarch64 don't have cpuid.h.
    (supported-systems '("i686-linux" "x86_64-linux"))
-    (license license:gpl2+)))
+    (license license:gpl2)))

 (define-public masscan
  (package
@@ -3459,9 +3487,9 @@ on systems running the Linux kernel.")
    (inputs
     `(("libpcap" ,libpcap)))
    (arguments
-     '(#:test-target "regress"
+     `(#:test-target "regress"
       #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
             (string-append "PREFIX=" (assoc-ref %outputs "out")))
       #:phases
       (modify-phases %standard-phases
@@ -3589,7 +3617,7 @@ Python loading in HPC environments.")
  (let ((real-name "inxi"))
    (package
      (name "inxi-minimal")
-      (version "3.1.05-2")
+      (version "3.2.01-1")
      (source
       (origin
         (method git-fetch)
@@ -3598,7 +3626,7 @@ Python loading in HPC environments.")
               (commit version)))
         (file-name (git-file-name real-name version))
         (sha256
-          (base32 "1a7nl2wk49yz5hcrph692xh5phv1mdg1m5cbvgv3ya12c6r32pa2"))))
+          (base32 "15bakrv3jzj5h88c3bd0cfhh6hb8b4hm79924k1ygn29sqzgyw65"))))
      (build-system trivial-build-system)
      (inputs
       `(("bash" ,bash-minimal)
@@ -3691,6 +3719,8 @@ support forum.  It runs with the @code{/exec} command in most IRC clients.")
       ("perl-io-socket-ssl" ,perl-io-socket-ssl)
       ("perl-json-xs" ,perl-json-xs)
       ("perl-time-hires" ,perl-time-hires)
+       ("lvm2" ,lvm2)                   ; lvs
+       ("mdadm" ,mdadm)
       ;; TODO: Add more inputs:
       ;; ipmi-sensors
       ;; hddtemp
@@ -3768,26 +3798,20 @@ support forum.  It runs with the @code{/exec} command in most IRC clients.")
 (define-public solaar
  (package
    (name "solaar")
-    (version "0.9.2")
+    (version "1.0.4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/pwr/Solaar")
+                    (url "https://github.com/pwr-Solaar/Solaar")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "085mfa13dap3wqik1dqlad0d7kff4rv7j4ljh99c7l8nhczkqgwm"))))
+                "15wzxxr2m5349kkvcs3k5clg1rsmvh6by2066qm4hlgvjwmigggy"))))
    (build-system python-build-system)
    (arguments
     `(#:phases
       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-prefix-detection
-           (lambda _
-             (substitute* "setup.py"
-              (("'--prefix' in sys\\.argv")
-               "len([x.startswith('--prefix=') for x in sys.argv]) > 0"))
-             #t))
         (add-before 'build 'setenv-PATH
           (lambda _
             (setenv "PYTHONPATH" (string-append "lib:" (getenv "PYTHONPATH")))
@@ -3915,19 +3939,14 @@ tcpdump and snoop.")
 (define-public pam-mount
  (package
    (name "pam-mount")
-    (version "2.16")
+    (version "2.17")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "mirror://sourceforge/pam-mount/pam_mount/"
-                           version "/pam_mount-" version ".tar.xz"))
+                           "pam_mount-" version ".tar.xz"))
       (sha256
-        (base32
-         "1rvi4irb7ylsbhvx1cr6islm2xxw1a4b19q6z4a9864ndkm0f0mf"))
-       (patches
-        ;; Patch adding support for encrypted volumes in LUKS2 format.
-        ;; It comes from the Gentoo package definition for sys-auth/pam_mount.
-        (search-patches "pam-mount-luks2-support.patch"))))
+        (base32 "1q2n6a2ah6nghdn8i6ad2wj247njwb5nx48cggxknaa6lqxylidy"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("perl" ,perl)
@@ -4099,3 +4118,191 @@ the system configuration; hosts only works when using the Guix package manager
 on a foreign distro.  @command{hosts} works with existing hosts files and
 entries, providing commands to add, remove, comment, and search.")
    (license license:expat)))
+
+(define-public nmrpflash
+  (package
+    (name "nmrpflash")
+    (version "0.9.14")
+    (source
+     (origin
+       (method git-fetch)
+       (uri
+        (git-reference
+         (url "https://github.com/jclehner/nmrpflash")
+         (commit (string-append "v" version))))
+       (sha256
+        (base32 "1fdjrxhjs96rdclbkld57xarf592slhkp79h46z833npxpn12ck1"))
+       (file-name (git-file-name name version))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("libnl" ,libnl)
+       ("libpcap" ,libpcap)))
+    (arguments
+     `(#:tests? #f ; None exist
+       #:make-flags
+       (list (string-append "CC=" ,(cc-for-target))
+             (string-append "PREFIX=" (assoc-ref %outputs "out")))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (add-before 'install 'prepare-install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (mkdir-p (string-append (assoc-ref outputs "out") "/bin"))
+             #t)))))
+    (home-page "https://github.com/jclehner/nmrpflash")
+    (synopsis "Netgear unbrick utility")
+    (description "This package provides a utility to flash a new firmware
+image to a Netgear device.  It has been tested on Netgear EX2700, EX6120,
+EX6150v2, DNG3700v2, R6100, R6220, R7000, D7000, WNR3500, R6400, R6800,
+R8000, R8500, WNDR3800, but is likely to be compatible with many other
+Netgear devices.")
+    (license license:gpl3+)))
+
+(define-public atop
+  (package
+    (name "atop")
+    (version "2.5.0")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://www.atoptool.nl/download/atop-"
+                                  version ".tar.gz"))
+              (sha256
+               (base32
+                "0crzz4i2nabyh7d6xg7fvl65qls87nbca5ihidp3nijhrrbi14ab"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ; no test suite
+       #:make-flags
+       (list (string-append "CC=" ,(cc-for-target))
+             ;; The installer requires a choice between systemd or SysV.
+             "systemdinstall"
+             (string-append "DESTDIR=" (assoc-ref %outputs "out"))
+             (string-append "BINPATH=/bin")
+             (string-append "SBINPATH=/sbin")
+             (string-append "SYSDPATH=/etc/systemd/system")
+             (string-append "PMPATHD=/etc/systemd/system-sleep")
+             (string-append "MAN1PATH=/share/man/man1")
+             (string-append "MAN5PATH=/share/man/man5")
+             (string-append "MAN8PATH=/share/man/man8")
+             ;; Or else it tries to create /var/log/atop...
+             (string-append "LOGPATH="))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure) ; No ./configure script
+         (add-before 'build 'patch-build
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* "Makefile"
+               ;; We don't need to chown things in the build environment.
+               (("chown.*$") "")
+               ;; We can't toggle the setuid bit in the build environment.
+               (("chmod 04711") "chmod 0711")
+               ;; Otherwise, it creates a blank configuration file as a "default".
+               (("touch.*DEFPATH)/atop") "")
+               (("chmod.*DEFPATH)/atop") ""))
+             #t)))))
+    (inputs
+     `(("ncurses" ,ncurses)
+       ("python" ,python-wrapper) ; for `atopgpud`
+       ("zlib" ,zlib)))
+    (home-page "https://www.atoptool.nl/")
+    (synopsis "Linux performance monitoring console")
+    (description "Atop is an ASCII full-screen performance monitor for Linux
+that is capable of reporting the activity of all processes (even processes have
+finished during the monitoring interval), daily logging of system and process
+activity for long-term analysis, highlighting overloaded system resources by
+using colors, etc.  At regular intervals, it shows system-level activity related
+to the CPU, memory, swap, disks (including LVM) and network layers, and for
+every process (and thread) it shows e.g. the CPU utilization, memory growth,
+disk utilization, priority, username, state, and exit code.")
+    (license license:gpl2+)))
+
+;; TODO: Unvendor u-root (pkg: forth, golang, testutil).
+(define fiano
+  (package
+    (name "fiano")
+    (version "5.0.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/linuxboot/fiano.git")
+                    (commit (string-append "v" version))))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "03ihdwwhb7g6bihx141cn0924sjs5ps6q3ps58pk1cg0g0srrr9h"))
+              (modules '((guix build utils)))
+              (snippet
+               '(begin
+                  (delete-file-recursively "vendor/golang.org")
+                  (delete-file-recursively "vendor/github.com")
+                  #t))))
+    (build-system go-build-system)
+    (arguments
+     `(#:import-path "github.com/linuxboot/fiano"
+       #:unpack-path "github.com/linuxboot/fiano"))
+    (native-inputs
+     `())
+    (inputs
+     `(("go-golang-org-x-text" ,go-golang-org-x-text)
+       ("go-github.com-ulikunitz-xz" ,go-github.com-ulikunitz-xz)))
+    (synopsis "UEFI image editor")
+    (description "This package provides a command-line UEFI image editor.")
+    (home-page "https://github.com/linuxboot/fiano")
+    (license license:bsd-3)))
+
+(define-public fiano-utk
+  (package
+    (inherit fiano)
+    (name "fiano-utk")
+    (arguments
+     `(#:import-path "github.com/linuxboot/fiano/cmds/utk"
+       #:unpack-path "github.com/linuxboot/fiano"))))
+
+(define-public fiano-fmap
+  (package
+    (inherit fiano)
+    (name "fiano-fmap")
+    (arguments
+     `(#:import-path "github.com/linuxboot/fiano/cmds/fmap"
+       #:unpack-path "github.com/linuxboot/fiano"))))
+
+(define-public novena-eeprom
+  (package
+    (name "novena-eeprom")
+    (version "2.3")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/xobs/novena-eeprom.git")
+                    (commit (string-append "v" version))))
+              (file-name (string-append name "-" version "-checkout"))
+              (sha256
+               (base32
+                "00pd71mg0g20v0820ggp3ghf9nyj5s4wavaz9mkmrmsr91hcnf7i"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f   ; No tests exist
+       #:make-flags
+       (list (string-append "CC=" ,(cc-for-target)))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (out-bin (string-append out "/bin"))
+                    (out-share-man (string-append out "/share/man/man8")))
+               (install-file "novena-eeprom" out-bin)
+               (install-file "novena-eeprom.8" out-share-man)))))))
+    (inputs
+     `(("i2c-tools" ,i2c-tools)))
+    (synopsis "Novena EEPROM editor")
+    (description "This package provides an editor for the Novena EEPROM.
+Novena boards contain a device-dependent descriptive EEPROM that defines
+various parameters such as serial number, MAC address, and featureset.
+This program allows you to view and manipulate this EEPROM list.")
+    (home-page "https://github.com/xobs/novena-eeprom/")
+    (supported-systems '("armhf-linux"))
+    (license license:bsd-3)))
@@ -50,7 +50,7 @@
       (method git-fetch)
       (uri
        (git-reference
-         (url "https://github.com/nu-book/zxing-cpp.git")
+         (url "https://github.com/nu-book/zxing-cpp")
         (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
@@ -48,6 +48,7 @@
  #:use-module (gnu packages maths)
  #:use-module (gnu packages mpi)
  #:use-module (gnu packages multiprecision)
+  #:use-module (gnu packages ocaml)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages pulseaudio)
@@ -123,15 +124,15 @@ greatest common divisor operations.")
 (define-public cm
  (package
   (name "cm")
-   (version "0.3")
+   (version "0.3.1")
   (source (origin
            (method url-fetch)
            (uri (string-append
-                  "http://www.multiprecision.org/cm/download/cm-"
+                  "http://www.multiprecision.org/downloads/cm-"
                  version ".tar.gz"))
            (sha256
             (base32
-              "1nf5kr0nqmhbzrsrinky18z0ighjpsmb5cr8zyg8jf04bfbyrfmc"))))
+              "0qq6b1kwb1byj8ws33ya5awq0ilkpm32037pi1l4cf2737fg9m42"))))
   (build-system gnu-build-system)
   (propagated-inputs
     `(("mpfrcx" ,mpfrcx)
@@ -151,12 +152,7 @@ line applications.")
 (define-public fplll
  (package
    (name "fplll")
-    ;; The most recent version 5.3.3 fails in the configure phase:
-    ;; ./configure: line 12956: syntax error near unexpected token `LIBQD,'
-    ;; ./configure: line 12956: `  PKG_CHECK_MODULES(LIBQD, qd, have_libqd="yes",'
-    ;; The error disappears when adding qd as an input; but this is
-    ;; supposed to be an optional input.
-    (version "5.3.2")
+    (version "5.3.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -165,13 +161,15 @@ line applications.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "00iyz218ywspizjiimrjdcqvdqmrsb2367zyy3vkmypnf9i9l680"))))
+                "06nyfidagp8pc2kfcw88ldgb2b1xm0a8z31n0sln7j72ihlmd8zj"))
+              (patches (search-patches "fplll-std-fenv.patch"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("autoconf" ,autoconf)
       ("automake" ,automake)
-       ("libtool" ,libtool)))
-    (inputs
+       ("libtool" ,libtool)
+       ("pkg-config" ,pkg-config)))
+    (propagated-inputs ; header files pulled in by fplll/defs.h
     `(("gmp" ,gmp)
       ("mpfr" ,mpfr)))
    (home-page "https://github.com/fplll/fplll")
@@ -236,7 +234,7 @@ the real span of the lattice.")
 (define-public pari-gp
  (package
    (name "pari-gp")
-    (version "2.11.4")
+    (version "2.13.0")
    (source (origin
              (method url-fetch)
              (uri (string-append
@@ -244,7 +242,7 @@ the real span of the lattice.")
                    version ".tar.gz"))
              (sha256
               (base32
-                "070bjw4kg7r6lqs1hfs08n5fmjv90cpwflp3wr04hbrmyz28zj5z"))))
+                "14xs90wrw8mbdx08hxlbhiahp6kgjq6yh27zjw7fvhfjx5nr84f8"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("texlive" ,(texlive-union
@@ -278,7 +276,7 @@ PARI is also available as a C library to allow for faster computations.")
 (define-public gp2c
  (package
   (name "gp2c")
-   (version "0.0.11pl4")
+   (version "0.0.12")
   (source (origin
            (method url-fetch)
            (uri (string-append
@@ -286,7 +284,7 @@ PARI is also available as a C library to allow for faster computations.")
                  version ".tar.gz"))
            (sha256
              (base32
-                "1cnnh7diqc97q76q5pyhpbljbhc0sz8mlrbqgiwi0sjkgh8iqsj0"))))
+                "039ip7qkwwv46wrcdrz7y12m30kazzkjr44kqbc0h137g4wzd7zf"))))
   (build-system gnu-build-system)
   (native-inputs `(("perl" ,perl)))
   (inputs `(("pari-gp" ,pari-gp)))
@@ -357,7 +355,7 @@ precision.")
 (define-public giac
  (package
    (name "giac")
-    (version "1.6.0-7")
+    (version "1.6.0-31")
    (source
     (origin
       (method url-fetch)
@@ -369,7 +367,7 @@ precision.")
                           "~parisse/debian/dists/stable/main/source/"
                           "giac_" version ".tar.gz"))
       (sha256
-        (base32 "1pvgp137zcl0rbhdn1j41xxfml7fp771a7x4ph8qrhhlx0hxzn3p"))))
+        (base32 "1dr1y88sx2gzldn0zl6p8b1ngjjcmh89iv4kzyhi2cf74j3yw85m"))))
    (build-system gnu-build-system)
    (arguments
     `(#:modules ((ice-9 ftw)
@@ -380,7 +378,8 @@ precision.")
         (add-after 'unpack 'patch-bin-cp
           ;; Some Makefiles contain hard-coded "/bin/cp".
           (lambda _
-             (substitute* (find-files "doc" "^Makefile")
+             (substitute* (cons "micropython-1.12/xcas/Makefile"
+                                (find-files "doc" "^Makefile"))
               (("/bin/cp") (which "cp")))
             #t))
         (add-after 'unpack 'disable-failing-test
@@ -409,9 +408,9 @@ precision.")
               (delete-file (string-append out "/bin/xcasnew"))
               #t))))))
    (inputs
-;;; TODO: Add libnauty.
+     ;; TODO: Add libnauty, unbundle "libmicropython.a".
     `(("fltk" ,fltk)
-       ("glpk" ,glpk)
+       ("glpk" ,glpk-4)
       ("gmp" ,gmp)
       ("gsl" ,gsl)
       ("lapack" ,lapack)
@@ -433,6 +432,8 @@ precision.")
    (native-inputs
     `(("bison" ,bison)
       ("flex" ,flex)
+       ("hevea" ,hevea)
+       ("python" ,python-wrapper)
       ("readline" ,readline)
       ("texlive" ,texlive-tiny)))
    (home-page "https://www-fourier.ujf-grenoble.fr/~parisse/giac.html")
@@ -532,14 +533,14 @@ fast arithmetic.")
                       (string-append "--with-flint=" flint)
                       (string-append "--with-gmp=" gmp)
                       (string-append "--with-mpfr=" mpfr))))))))
+    (home-page "https://arblib.org")
    (synopsis "Arbitrary precision floating-point ball arithmetic")
    (description
     "Arb is a C library for arbitrary-precision floating-point ball
 arithmetic.  It supports efficient high-precision computation with
 polynomials, power series, matrices and special functions over the
 real and complex numbers, with automatic, rigorous error control.")
-    (license license:lgpl2.1+)
-    (home-page "http://arblib.org")))
+    (license license:lgpl2.1+)))

 (define-public python-flint
  (package
@@ -1004,16 +1005,20 @@ Optional thin wrappers allow usage of the library from other languages.")
 (define-public eigen
  (package
    (name "eigen")
-    (version "3.3.7")
+    (version "3.3.8")
    (source (origin
              (method url-fetch)
-              (uri (string-append "https://bitbucket.org/eigen/eigen/get/"
-                                  version ".tar.bz2"))
+              (uri (list
+                     (string-append "https://bitbucket.org/eigen/eigen/get/"
+                                    version ".tar.bz2")
+                     (string-append "mirror://debian/pool/main/e/eigen3/eigen3_"
+                                    version ".orig.tar.bz2")))
              (sha256
               (base32
-                "1km3fyfzyqfdvmnl79drps3fjwnz3zbh0c7l34mfbqyvvs8cy4wz"))
+                "1vxrsncfnkyq6gwxpsannpryp12mk7lc8f42ybvz3saf7icwc582"))
              (file-name (string-append name "-" version ".tar.bz2"))
-              (patches (search-patches "eigen-stabilise-sparseqr-test.patch"))
+              (patches (search-patches "eigen-remove-openmp-error-counting.patch"
+                                       "eigen-stabilise-sparseqr-test.patch"))
              (modules '((guix build utils)))
              (snippet
               ;; There are 3 test failures in the "unsupported" directory,
@@ -1088,7 +1093,7 @@ features, and more.")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/QuantStack/xtensor")
+                    (url "https://github.com/xtensor-stack/xtensor")
                    (commit version)))
              (sha256
               (base32
@@ -1102,7 +1107,7 @@ features, and more.")
     `(#:configure-flags
       '("-DBUILD_TESTS=ON")
       #:test-target "xtest"))
-    (home-page "https://quantstack.net/xtensor")
+    (home-page "https://xtensor.readthedocs.io/en/latest/")
    (synopsis "C++ tensors with broadcasting and lazy computing")
    (description "xtensor is a C++ library meant for numerical analysis with
 multi-dimensional array expressions.
@@ -1118,17 +1123,17 @@ xtensor provides:
 (define-public gap
  (package
    (name "gap")
-    (version "4.10.2")
+    (version "4.11.0")
    (source
     (origin
       (method url-fetch)
-       (uri (string-append "https://www.gap-system.org/pub/gap/gap-"
+       (uri (string-append "https://files.gap-system.org/gap-"
                           (version-major+minor version)
                           "/tar.bz2/gap-"
                           version
                           ".tar.bz2"))
       (sha256
-        (base32 "0cp6ddk0469zzv1m1vair6gm27ic6c5m77ri8rn0znq3gaps6x94"))
+        (base32 "00l6hvy4iggnlrib4vp805sxdm3j7n3hzpv5zs9hbiiavh80l1xz"))
       (modules '((guix build utils) (ice-9 ftw) (srfi srfi-1)))
       (snippet
        '(begin
@@ -1140,41 +1145,46 @@ xtensor provides:
           ;; FIXME: This might be fixed in the next release, see
           ;; https://github.com/gap-system/gap/issues/3292
           (delete-file "tst/testinstall/dir.tst")
-           ;; Delete all packages except for a fixed list.
+           ;; Delete all packages except for a fixed list,
+           ;; given by their names up to version numbers.
           (with-directory-excursion "pkg"
             (for-each delete-file-recursively
-               (lset-difference string=? (scandir ".")
+               (lset-difference
+                 (lambda (all keep) (string-prefix? keep all))
+                 (scandir ".")
                 '("." ".."
                   ;; Necessary packages.
-                   "GAPDoc-1.6.2"
-                   "primgrp-3.3.2"
-                   "SmallGrp-1.3"    ; artistic2.0
-                   "transgrp"        ; artistic2.0 for data,
-                                     ; gpl2 or gpl3 for code
-                   ;; Recommanded package.
-                   "io-4.5.4"        ; gpl3+
+                   "GAPDoc-"
+                   "primgrp-"
+                   "SmallGrp-"   ; artistic2.0
+                   "transgrp"    ; artistic2.0 for data,
+                                 ; gpl2 or gpl3 for code
+                   ;; Recommended package.
+                   "io-"         ; gpl3+
                   ;; Optional packages, searched for at start,
                   ;; and their depedencies.
-                   "alnuth-3.1.0"
-                   "autpgrp-1.10"
-                   "crisp-1.4.4"     ; bsd-2
-                   "ctbllib"       ; gpl3+ according to doc/chap0.txt
-                   "FactInt-1.6.2"
+                   "alnuth-"
+                   "autpgrp-"
+                   "crisp-"      ; bsd-2
+                   "ctbllib"     ; gpl3+, clarified in the next release;
+                                 ; see
+                                 ; http://www.math.rwth-aachen.de/~Thomas.Breuer/ctbllib/README.md
+                   "FactInt-"
                   "fga"
-                   "irredsol-1.4"    ; bsd-2
-                   "laguna-3.9.2"
-                   "polenta-1.3.8"
-                   "polycyclic-2.14"
-                   "radiroot-2.8"
-                   "resclasses-4.7.1"
-                   "sophus-1.24"
-                   "tomlib-1.2.7"  ; gpl2+, clarified in the git repository
-                                   ; and the next release
-                   "utils-0.59"))))
+                   "irredsol-"   ; bsd-2
+                   "laguna-"
+                   "polenta-"
+                   "polycyclic-"
+                   "radiroot-"
+                   "resclasses-"
+                   "sophus-"
+                   "tomlib-"
+                   "utils-"))))
           #t))))
    (build-system gnu-build-system)
    (inputs
     `(("gmp" ,gmp)
+       ("readline" ,readline)
       ("zlib" ,zlib)))
    (arguments
     `(#:modules ((ice-9 ftw)
@@ -1201,15 +1211,14 @@ xtensor provides:
           (lambda* (#:key outputs #:allow-other-keys)
             (let* ((out (assoc-ref outputs "out"))
                    (bin (string-append out "/bin"))
-                    (lib (string-append out "/lib"))
                    (prog (string-append bin "/gap"))
                    (prog-real (string-append bin "/.gap-real"))
-                    (share (string-append out "/share/gap"))
-                    (include (string-append out "/include/gap"))
-                    (include-hpc (string-append include "/hpc")))
+                    (share (string-append out "/share/gap")))
               ;; Install only the gap binary; the gac compiler is left
               ;; for maybe later. "Wrap" it in a shell script that calls
               ;; the binary with the correct parameter.
+               ;; The make target install-bin is supposed to do that, but
+               ;; is not currently working.
               (mkdir-p bin)
               (copy-file "gap" prog-real)
               (call-with-output-file prog
@@ -1220,52 +1229,18 @@ xtensor provides:
                           prog-real
                           share)))
               (chmod prog #o755)
-               ;; Install the headers, which are needed by Sage. The
-               ;; Makefile target "install-headers" was available in
-               ;; gap-4.10.0, but has been commented out in gap-4.10.1.
-               (mkdir-p include-hpc)
-               (install-file "gen/config.h" include)
-               (let ((file-name-predicate-without-stat
-                       (lambda (regex)
-                         (cut (file-name-predicate regex) <> #f))))
-                 (with-directory-excursion "src"
-                   (for-each
-                     (cut install-file <> include)
-                     (scandir "."
-                              (file-name-predicate-without-stat ".*\\.h$"))))
-                 (with-directory-excursion "src/hpc"
-                   (for-each
-                     (cut install-file <> include-hpc)
-                     (scandir "."
-                              (file-name-predicate-without-stat ".*\\.h$")))))
-               ;; Install the library, which is needed by Sage. The
-               ;; Makefile target "install-libgap" was available in
-               ;; gap-4.10.0, but has been commented out in gap-4.10.1.
-               ;; Compared to the Makefile, which used libtool, the
-               ;; following approach of copying files and making symlinks
-               ;; is rather pedestrian. There is hope that some later
-               ;; version of gap reinstates and completes the install
-               ;; targets.
-               (invoke "make" "libgap.la")
-               (install-file "libgap.la" lib)
-               (install-file ".libs/libgap.so.0.0.0" lib)
-               (symlink "libgap.so.0.0.0" (string-append lib "/libgap.so")) 
-               (symlink "libgap.so.0.0.0" (string-append lib "/libgap.so.0"))
-               ;; Install a certain number of files and directories to
-               ;; SHARE, where the wrapped shell script expects them.
+               ;; Install the headers and library, which are needed by Sage.
+               (invoke "make" "install-headers")
+               (invoke "make" "install-libgap")
               ;; Remove information on the build directory from sysinfo.gap.
               (substitute* "sysinfo.gap"
                 (("GAP_BIN_DIR=\".*\"") "GAP_BIN_DIR=\"\"")
                 (("GAP_LIB_DIR=\".*\"") "GAP_LIB_DIR=\"\"")
                 (("GAP_CPPFLAGS=\".*\"") "GAP_CPPFLAGS=\"\""))
-               (install-file "sysinfo.gap" share)
-               (copy-recursively "grp" (string-append share "/grp"))
-               (copy-recursively "pkg" (string-append share "/pkg"))
-               ;; The following is not the C library libgap.so, but a
-               ;; library of GAP code.
-               (copy-recursively "lib" (string-append share "/lib"))
-               ;; The gap binary looks for documentation inside SHARE.
-               (copy-recursively "doc" (string-append share "/doc")))
+               (invoke "make" "install-gaproot")
+               ;; Copy the directory of compiled packages; the make target
+               ;; install-pkg is currently empty.
+               (copy-recursively "pkg" (string-append share "/pkg")))
             #t)))))
    (home-page "https://www.gap-system.org/")
    (synopsis
@@ -1584,7 +1559,7 @@ structure constants of Schubert polynomials.")
         "0akwhhz9b40bz6lrfxpamp7r7wkk48p455qbn04mfnl9a1l6db8x"))))
    (build-system gnu-build-system)
    (inputs
-     `(("gmp", gmp)
+     `(("gmp" ,gmp)
       ("cblas" ,openblas))) ; or any other BLAS library; the documentation
                             ; mentions ATLAS in particular
    (arguments
@@ -10,6 +10,7 @@
 ;;; Copyright © 2019, 2020 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2020 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2020 Sergey Trofimov <sarg@sarg.org.ru>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,8 +31,9 @@
  #:use-module (guix packages)
  #:use-module (guix download)
  #:use-module (guix git-download)
-  #:use-module (guix build-system gnu)
  #:use-module (guix build-system android-ndk)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix build-system go)
  #:use-module (guix build-system python)
  #:use-module (guix build-system trivial)
  #:use-module ((guix licenses) #:prefix license:)
@@ -41,6 +43,7 @@
  #:use-module (gnu packages docker)
  #:use-module (gnu packages gcc)
  #:use-module (gnu packages gnupg)
+  #:use-module (gnu packages golang)
  #:use-module (gnu packages java)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages pcre)
@@ -944,7 +947,7 @@ useful for reverse engineering, analysis of Android applications and more.")
       ("python-apache-libcloud" ,python-apache-libcloud)
       ("python-clint" ,python-clint)
       ("python-defusedxml" ,python-defusedxml)
-       ("python-docker-py" ,python-docker-py)
+       ("python-docker" ,python-docker)
       ("python-gitpython" ,python-gitpython)
       ("python-mwclient" ,python-mwclient)
       ("python-paramiko" ,python-paramiko)
@@ -972,6 +975,36 @@ publishing, or to assist in creating, testing and submitting metadata to the
 main repository.")
    (license license:agpl3+)))

+(define-public fdroidcl
+  (package
+    (name "fdroidcl")
+    (version "0.5.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/mvdan/fdroidcl")
+                     (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32 "1rxcdyy2j34z0ql9d62w7ivsch9xihjnpb1z9kgy9q46vl8zhhy0"))))
+    (build-system go-build-system)
+    (arguments
+     `(#:import-path "mvdan.cc/fdroidcl"
+       #:tests? #f  ; TODO: Inputs missing.
+       #:install-source? #f))
+    (inputs
+     `(("go-github-com-kr-pretty" ,go-github-com-kr-pretty)))
+    ;(native-inputs
+    ; `(("go-github-com-rogpeppe-go-internal-testscript"
+    ;    ,go-github-com-rogpeppe-go-internal-testscript)))
+    (synopsis "F-Droid desktop client")
+    (description
+     "While the Android client integrates with the system with regular update
+checks and notifications, this is a simple command line client that talks to
+connected devices via ADB.")
+    (home-page "https://github.com/mvdan/fdroidcl")
+    (license license:bsd-3)))
+
 (define-public enjarify
  (package
    (name "enjarify")
@@ -2,6 +2,7 @@
 ;;; Copyright © 2015, 2017 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Pkill -9 <pkill9@runbox.com>
+;;; Copyright © 2020 Vinicius Monego <monego@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -27,19 +28,30 @@
  #:use-module (guix build-system gnu)
  #:use-module (gnu packages)
  #:use-module (gnu packages algebra)
+  #:use-module (gnu packages autotools)
  #:use-module (gnu packages boost)
  #:use-module (gnu packages compression)
+  #:use-module (gnu packages curl)
+  #:use-module (gnu packages dejagnu)
  #:use-module (gnu packages fontutils)
+  #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gl)
  #:use-module (gnu packages glib)
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages graphics)
  #:use-module (gnu packages gtk)
  #:use-module (gnu packages image)
  #:use-module (gnu packages imagemagick)
+  #:use-module (gnu packages jemalloc)
+  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
  #:use-module (gnu packages pulseaudio)
+  #:use-module (gnu packages python)
  #:use-module (gnu packages qt)
-  #:use-module (gnu packages video))
+  #:use-module (gnu packages sdl)
+  #:use-module (gnu packages tls)
+  #:use-module (gnu packages video)
+  #:use-module (gnu packages xiph))

 ;; ETL, synfig, and Synfig Studio are updated in tandem.
 (define synfig-version "1.2.2")
@@ -192,6 +204,89 @@ need for tweening, preventing the need to hand-draw each frame.  This package
 contains the graphical user interface for synfig.")
    (license license:gpl3+)))

+;; This package provides a standalone (no browser plugin) version of Gnash.
+(define-public gnash
+  ;; The last tagged release of Gnash was in 2013.
+  (let ((commit "583ccbc1275c7701dc4843ec12142ff86bb305b4")
+        (revision "0"))
+    (package
+      (name "gnash")
+      (version (git-version "0.8.11" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://git.savannah.gnu.org/git/gnash.git/")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (patches (search-patches "gnash-fix-giflib-version.patch"))
+         (sha256
+          (base32 "0fh0bljn0i6ypyh6l99afi855p7ki7lm869nq1qj6k8hrrwhmfry"))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:configure-flags
+         (list "--disable-static"
+               ;; Plugins are based on XULRunner and NPAPI only.  Disable.
+               "--disable-plugins"
+               "--enable-gui=gtk"
+               "--enable-media=ffmpeg"
+               (string-append "--with-boost-incl="
+                              (assoc-ref %build-inputs "boost") "/include")
+               (string-append "--with-boost-lib="
+                              (assoc-ref %build-inputs "boost") "/lib")
+               (string-append "--with-ffmpeg-incl="
+                              (assoc-ref %build-inputs "ffmpeg")
+                              "/include/libavcodec")
+               (string-append "--with-speex-incl="
+                              (assoc-ref %build-inputs "speex") "/include")
+               (string-append "--with-jemalloc-incl="
+                              (assoc-ref %build-inputs "jemalloc")
+                              "/include/jemalloc")
+               (string-append "--with-speex-lib="
+                              (assoc-ref %build-inputs "speex") "/lib")
+               (string-append "--with-jpeg-incl="
+                              (assoc-ref %build-inputs "libjpeg") "/include")
+               (string-append "--with-zlib-incl="
+                              (assoc-ref %build-inputs "zlib") "/include")
+               (string-append "--with-png-incl="
+                              (assoc-ref %build-inputs "libpng")
+                              "/include"))))
+      (native-inputs
+       `(("autoconf" ,autoconf)
+         ("automake" ,automake)
+         ("dejagnu" ,dejagnu) ;for tests
+         ("gettext" ,gettext-minimal)
+         ("libtool" ,libtool)
+         ("perl" ,perl)
+         ("pkg-config" ,pkg-config)
+         ("python" ,python-wrapper)))
+      (inputs
+       `(("agg" ,agg)
+         ("atk" ,atk)
+         ("boost" ,boost)
+         ("curl" ,curl)
+         ("ffmpeg" ,ffmpeg-2.8)
+         ("freeglut" ,freeglut)
+         ("gconf" ,gconf)
+         ("giflib" ,giflib)
+         ("glib" ,glib)
+         ("gtk+" ,gtk+-2)
+         ("gtkglext" ,gtkglext)
+         ("jemalloc" ,jemalloc)
+         ("libjpeg" ,libjpeg-turbo)
+         ("libltdl" ,libltdl)
+         ("libpng" ,libpng)
+         ("pangox-compat" ,pangox-compat)
+         ("sdl" ,sdl)
+         ("speex" ,speex)))
+      (synopsis "Flash movie player")
+      (description
+       "Gnash is a Flash movie player.  It supports SWF version v7 and some
+of v8 and v9.  It is possible to configure Gnash to use several different
+audio or video backends, ensuring good performance.")
+      (home-page "https://www.gnu.org/software/gnash/")
+      (license license:gpl3+))))
+
 (define-public papagayo
  (let ((commit "e143684b30e59fe4a554f965cb655d23cbe93ee7")
        (revision "1"))
@@ -44,14 +44,14 @@
 (define-public clamav
  (package
    (name "clamav")
-    (version "0.102.4")
+    (version "0.103.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.clamav.net/downloads/production/"
                                  "clamav-" version ".tar.gz"))
              (sha256
               (base32
-                "06rrzyrhnr0rswryijpbbzywr6387rv8qjq8sb8cl3h2d1m45ggf"))
+                "0ih5x1rscg2m64y0z20njj7435q8k7ss575cfw7aipdzfx979a9j"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@@ -2,13 +2,16 @@
 ;;; Copyright © 2013, 2014, 2015, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015, 2016 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2016 John Darrington <jmd@gnu.org>
-;;; Copyright © 2016, 2017, 2019 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Christopher Andersson <christopher@8bits.nu>
 ;;; Copyright © 2016 Theodoros Foradis <theodoros@foradis.org>
 ;;; Copyright © 2016, 2017, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Jens Mølgaard <jens@zete.tk>
 ;;; Copyright © 2020 Timotej Lazar <timotej.lazar@araneo.si>
 ;;; Copyright © 2020 Marcin Karpezo <sirmacik@wioo.waw.pl>
+;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de>
+;;; Copyright © 2020 Jakub Kądziołka <kuba@kadziolka.net>
+;;; Copyright © 2020 Noah Landis <noahlandis@posteo.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,7 +36,9 @@
  #:use-module (guix utils)
  #:use-module (gnu packages)
  #:use-module (gnu packages base)
+  #:use-module (gnu packages bison)
  #:use-module (gnu packages compression)
+  #:use-module (gnu packages ncurses)
  #:use-module (gnu packages perl)
  #:use-module (ice-9 match))

@@ -166,6 +171,13 @@ dictionaries, including personal ones.")
         (hash (content-hash sha256))))
      (home-page "https://www.softcatala.org/pub/softcatala/aspell/"))))

+(define-public aspell-dict-cs
+  (aspell-dictionary "cs" "Czech"
+                     #:version "20040614-1"
+                     #:sha256
+                     (base32
+                      "0rihj4hsw96pd9casvmpvw3r8040pfa28p1h73x4vyn20zwr3h01")))
+
 (define-public aspell-dict-de
  (aspell-dictionary "de" "German"
                     #:version "20161207-7-0"
@@ -271,6 +283,7 @@ dictionaries, including personal ones.")
 (define-public aspell-dict-mi
  (aspell-dictionary "mi" "Maori"
                     #:version "0.50-0"
+                     #:prefix "aspell-"
                     #:sha256
                     (base32
                      "12bxplpd348yx8d2q8qvahi9dlp7qf28qmanzhziwc7np8rixvmy")))
@@ -286,6 +299,7 @@ dictionaries, including personal ones.")
 (define-public aspell-dict-nn
  (aspell-dictionary "nn" "Norwegian Nynorsk"
                     #:version "0.50.1-1"
+                     #:prefix "aspell-"
                     #:sha256
                     (base32
                      "0w2k5l5rbqpliripgqwiqixz5ghnjf7i9ggbrc4ly4vy1ia10rmc")))
@@ -293,6 +307,7 @@ dictionaries, including personal ones.")
 (define-public aspell-dict-pl
  (aspell-dictionary "pl" "Polish"
                     #:version "0.51-0"
+                     #:prefix "aspell-"
                     #:sha256
                     (base32
                      "1a3ccji6k5gys7l3ilr2lh5pzxgzb7ipc5vb737svl6nqgdy8757")))
@@ -359,8 +374,8 @@ dictionaries, including personal ones.")
    (source (origin
              (method url-fetch)
              (uri (string-append
-                    "http://downloads.sourceforge.net/wordlist/scowl-"
-                    version ".tar.gz"))
+                    "mirror://sourceforge/wordlist/SCOWL/"
+                    version "/scowl-" version ".tar.gz"))
              (sha256
               (base32
                "11lkrnhwrf5mvrrq45k4mads3n9aswgac8dc25ba61c75alxb5rs"))))
@@ -457,3 +472,50 @@ under permissive licensing terms.  See the 'Copyright' file."))))
 (define-word-list-dictionary hunspell-dict-en-us
  "en_US"
  (synopsis "Hunspell dictionary for United States English"))
+
+(define-public ispell
+  (package
+    (name "ispell")
+    (version "3.4.00")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.cs.hmc.edu/~geoff/tars/ispell-"
+                           version ".tar.gz"))
+       (sha256
+        (base32
+         "1hmfnz55qzfpz7lz0r3m4kkv31smir92ks9s5l1iiwimhr2jxi2x"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:parallel-build? #f
+       #:tests? #f ; no tests
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key inputs outputs #:allow-other-keys)
+             ;; Based on local.h.linux
+             (let* ((grep (assoc-ref inputs "grep"))
+                    (out (assoc-ref outputs "out")))
+               (call-with-output-file "local.h"
+                 (lambda (port)
+                   (format port "#define MINIMENU~%")
+                   (format port "#define USG~%")
+                   (format port "#define HAS_RENAME~%")
+                   (format port "#define CC \"gcc\"~%")
+                   (format port "#define POUNDBANG \"#!~a\"~%" (which "sh"))
+                   (format port "#define EGREPCMD \"~a/bin/grep -Ei\"~%" grep)
+                   (format port "#define BINDIR \"~a/bin\"~%" out)
+                   (format port "#define LIBDIR \"~a/lib/ispell\"~%" out)
+                   (format port "#define MAN1DIR \"~a/share/man/man1\"~%" out)
+                   (format port "#define MAN45DIR \"~a/share/man/man5\"~%" out))))
+             #t)))))
+    (inputs
+     `(("grep" ,grep)
+       ("ncurses" ,ncurses)))
+    (native-inputs
+     `(("bison" ,bison)))
+    (synopsis "Interactive spell-checking tool for Unix")
+    (description "Ispell is an interactive spell-checking tool supporting many
+European languages.")
+    (home-page "https://www.cs.hmc.edu/~geoff/ispell.html")
+    (license bsd-3)))
@@ -2,7 +2,7 @@
 ;;; Copyright © 2016 Jan Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2013, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Guy Fleury Iteriteka <hoonandon@gmail.com>
 ;;; Copyright © 2019 Andy Tai <atai@atai.org>
@@ -51,7 +51,7 @@
  #:use-module (gnu packages shells)
  #:use-module (gnu packages xml)
  #:use-module ((guix utils)
-                #:select (%current-system)))
+                #:select (%current-system cc-for-target)))

 (define-public nasm
  (package
@@ -151,14 +151,14 @@ to the clients.")
 (define-public fasm
  (package
    (name "fasm")
-    (version "1.73.24")
+    (version "1.73.25")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://flatassembler.net/fasm-"
                           version ".tgz"))
       (sha256
-        (base32 "142vxhs8mh8isvlzq7ir0asmqda410phzxmk9gk9b43dldskkj7k"))))
+        (base32 "0k3h61mfwslyb34kf4dnapfwl8jxlmrp4dv666wc057hkj047knn"))))
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f                      ; no tests exist
@@ -261,28 +261,36 @@ runtime")
 (define-public rgbds
  (package
    (name "rgbds")
-    (version "0.4.1")
+    (version "0.4.2")
    (source (origin
              (method git-fetch)
              (uri (git-reference
-                    (url "https://github.com/rednex/rgbds")
+                    (url "https://github.com/gbdev/rgbds")
                    (commit (string-append "v" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "05djzl3h18zg2z5p2a881wjbmgikzkhf67cgk00frhw4v05sq0lf"))))
+                "0lygj7jzjlq4w0mkiir7ycysrd1p1akyvzrppjcchja05mi8wy9p"))))
    (build-system gnu-build-system)
    (arguments
     `(#:phases
       (modify-phases %standard-phases
         (delete 'configure)
+         (add-after 'unpack 'patch-pkg-config
+           (lambda _
+             (substitute* "Makefile"
+               (("pkg-config")
+                (or (which "pkg-config")
+                    (string-append ,(%current-target-system)
+                                   "-pkg-config"))))
+             #t))
         (replace 'check
           (lambda _
             (with-directory-excursion "test/asm"
               (invoke "./test.sh"))
             (with-directory-excursion "test/link"
               (invoke "./test.sh")))))
-       #:make-flags `("CC=gcc"
+       #:make-flags `(,(string-append "CC=" ,(cc-for-target))
                      ,(string-append "PREFIX="
                                      (assoc-ref %outputs "out")))))
    (native-inputs
@@ -292,7 +300,7 @@ runtime")
       ("util-linux" ,util-linux)))
    (inputs
     `(("libpng" ,libpng)))
-    (home-page "https://github.com/rednex/rgbds")
+    (home-page "https://github.com/gbdev/rgbds")
    (synopsis "Rednex Game Boy Development System")
    (description
     "RGBDS (Rednex Game Boy Development System) is an assembler/linker
@@ -436,7 +444,7 @@ sets, both THUMB and ARM mode.")
           (origin
             (method git-fetch)
             (uri (git-reference
-                   (url "https://github.com/intelxed/mbuild.git")
+                   (url "https://github.com/intelxed/mbuild")
                   (commit "5304b94361fccd830c0e2417535a866b79c1c297")))
             (sha256
              (base32
@@ -128,7 +128,7 @@ header.")
 (define-public gnuastro
  (package
    (name "gnuastro")
-    (version "0.12")
+    (version "0.13")
    (source
     (origin
       (method url-fetch)
@@ -136,7 +136,7 @@ header.")
                           version ".tar.lz"))
       (sha256
        (base32
-         "0ypk1c72q778cixfa52vjxzbd5m4qc6hfjgnipy16sfa7mnspmyf"))))
+         "07di6zx2irc5q0zyymx2951ydzxdfjmzd3az5qnk67ncf3hknvj5"))))
    (build-system gnu-build-system)
    (arguments
     '(#:configure-flags '("--disable-static")))
@@ -159,7 +159,7 @@ programs for the manipulation and analysis of astronomical data.")
 (define-public stellarium
  (package
    (name "stellarium")
-    (version "0.20.2")
+    (version "0.20.3")
    (source
     (origin
       (method url-fetch)
@@ -167,7 +167,7 @@ programs for the manipulation and analysis of astronomical data.")
                           "/releases/download/v" version
                           "/stellarium-" version ".tar.gz"))
       (sha256
-        (base32 "16symz212vjvhfabh39a68qf7d0rm574c6djlibj2qd1q9jgj3j0"))))
+        (base32 "0z5r7b1ac43l330xphxnw54xg7jm87ajix8yl4hkq82cs5ja7097"))))
    (build-system cmake-build-system)
    (inputs
     `(("qtbase" ,qtbase)
@@ -328,7 +328,7 @@ Mechanics, Astrometry and Astrodynamics library.")
       ("freetype" ,freetype)
       ("pango" ,pango)
       ("giflib" ,giflib)
-       ("libjpeg", libjpeg-turbo)
+       ("libjpeg" ,libjpeg-turbo)
       ("libpng" ,libpng)
       ("libtiff" ,libtiff)
       ("netpbm" ,netpbm)
@@ -4,7 +4,7 @@
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Alex Kost <alezost@gmail.com>
 ;;; Copyright © 2015, 2016 Mark H Weaver <mhw@netris.org>
-;;; Copyright © 2016, 2017, 2018, 2019 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016, 2017 Alex Griffin <a@ajgrf.com>
 ;;; Copyright © 2016 Nikita <nikita@n0.is>
 ;;; Copyright © 2016 Lukas Gradl <lgradl@openmailbox.org>
@@ -33,6 +33,7 @@
 ;;; Copyright © 2020 Jonathan Frederickson <jonathan@terracrypt.net>
 ;;; Copyright © 2020 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;; Copyright © 2020 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2020 Michael Rohleder <mike@rohleder.de>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -57,6 +58,7 @@
  #:use-module (gnu packages backup)
  #:use-module (gnu packages base)
  #:use-module (gnu packages bison)
+  #:use-module (gnu packages build-tools)
  #:use-module (gnu packages boost)
  #:use-module (gnu packages check)
  #:use-module (gnu packages compression)
@@ -108,6 +110,7 @@
  #:use-module (gnu packages valgrind)
  #:use-module (gnu packages video)
  #:use-module (gnu packages vim) ;xxd
+  #:use-module (gnu packages web)
  #:use-module (gnu packages webkit)
  #:use-module (gnu packages wxwidgets)
  #:use-module (gnu packages xiph)
@@ -138,7 +141,7 @@
       (method git-fetch)
       (uri
        (git-reference
-         (url "https://github.com/KhronosGroup/OpenSL-ES-Registry.git")
+         (url "https://github.com/KhronosGroup/OpenSL-ES-Registry")
         (commit "ea5104bf37bf525c25e6ae2386586048179d0fda")))
       (file-name (git-file-name name version))
       (sha256
@@ -200,7 +203,7 @@ promoting the market for advanced audio.")
       (method git-fetch)
       (uri
        (git-reference
-         (url "https://github.com/Mindwerks/wildmidi.git")
+         (url "https://github.com/Mindwerks/wildmidi")
         (commit (string-append name "-" version))))
       (file-name (git-file-name name version))
       (sha256
@@ -275,7 +278,7 @@ Coding (AAC) encoder.")
       (method git-fetch)
       (uri
        (git-reference
-         (url "https://github.com/tinyalsa/tinyalsa.git")
+         (url "https://github.com/tinyalsa/tinyalsa")
         (commit version)))
       (file-name (git-file-name name version))
       (sha256
@@ -298,7 +301,7 @@ Linux kernel.")
 (define-public libopenmpt
  (package
    (name "libopenmpt")
-    (version "0.5.1")
+    (version "0.5.4")
    (source
     (origin
       (method url-fetch)
@@ -306,8 +309,20 @@ Linux kernel.")
        (string-append "https://download.openmpt.org/archive/libopenmpt/src/"
                       "libopenmpt-" version "+release.autotools.tar.gz"))
       (sha256
-        (base32 "1vpalfsrkbx4vyrh1qy564lr91jwdxlbjivv5gzf8zcywxasf0xa"))))
+        (base32 "0h7gpjx1221jwsq3k91p8zhf1h77qaxyasakc88s3g57vawhckgk"))))
    (build-system gnu-build-system)
+    (arguments
+     `(#:configure-flags
+       (list (string-append "--docdir=" (assoc-ref %outputs "out")
+                            "/share/doc/" ,name "-" ,version))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'delete-static-libraries
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (lib (string-append out "/lib")))
+               (for-each delete-file (find-files lib "\\.a$"))
+               #t))))))
    (native-inputs
     `(("doxygen" ,doxygen)
       ("perl" ,perl)
@@ -461,41 +476,15 @@ implementation of Adaptive Multi Rate Narrowband and Wideband
 (define-public alsa-modular-synth
  (package
    (name "alsa-modular-synth")
-    (version "2.1.2")
+    (version "2.2.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/alsamodular/alsamodular"
                                  "/" version "/ams-" version ".tar.bz2"))
              (sha256
               (base32
-                "1azbrhpfk4nnybr7kgmc7w6al6xnzppg853vas8gmkh185kk11l0"))
-              (patches
-               (search-patches "alsa-modular-synth-fix-vocoder.patch"))))
+                "056dn6b9c5nsw2jdww7z1kxrjqqfvxjzxhsd5x9gi4wkwyiv21nz"))))
    (build-system gnu-build-system)
-    (arguments
-     `(#:configure-flags
-       '("--enable-qt5"
-         "CXXFLAGS=-std=gnu++11")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'set-paths 'hide-default-gcc
-           (lambda* (#:key inputs #:allow-other-keys)
-             (let ((gcc (assoc-ref inputs "gcc")))
-               ;; Remove the default GCC from CPLUS_INCLUDE_PATH to prevent
-               ;; conflicts with the GCC 5 input.
-               (setenv "CPLUS_INCLUDE_PATH"
-                       (string-join
-                        (delete (string-append gcc "/include/c++")
-                                (string-split (getenv "CPLUS_INCLUDE_PATH") #\:))
-                        ":"))
-               #t)))
-         ;; Insert an extra space between linker flags.
-         (add-before 'configure 'add-missing-space
-           (lambda _
-             (substitute* "configure"
-               (("LIBS\\+=\\$LIBSsave") "LIBS+=\" $LIBSsave\"")
-               (("CFLAGS\\+=\\$CFLAGSsave") "CFLAGS+=\" $CFLAGSsave\""))
-             #t)))))
    (inputs
     `(("alsa-lib" ,alsa-lib)
       ;; We cannot use zita-alsa-pcmi (the successor of clalsadrv) due to
@@ -508,8 +497,7 @@ implementation of Adaptive Multi Rate Narrowband and Wideband
       ("qtbase" ,qtbase)))
    (native-inputs
     `(("pkg-config" ,pkg-config)
-       ("qttools" ,qttools)
-       ("gcc@5" ,gcc-5)))
+       ("qttools" ,qttools)))
    (home-page "http://alsamodular.sourceforge.net/")
    (synopsis "Realtime modular synthesizer and effect processor")
    (description
@@ -688,7 +676,7 @@ engineers, musicians, soundtrack editors and composers.")
 (define-public audacity
  (package
    (name "audacity")
-    (version "2.4.1")
+    (version "2.4.2")
    (source
     (origin
       (method git-fetch)
@@ -698,8 +686,9 @@ engineers, musicians, soundtrack editors and composers.")
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "1xk0piv72d2xd3p7igr916fhcbrm76fhjr418k1rlqdzzg1hfljn"))
-       (patches (search-patches "audacity-build-with-system-portaudio.patch"))
+         "0lklcvqkxrr2gkb9gh3422iadzl2rv9v0a8s76rwq43lj2im7546"))
+       (patches (search-patches "audacity-build-with-system-portaudio.patch"
+                                "audacity-add-include.patch"))
       (modules '((guix build utils)))
       (snippet
        ;; Remove bundled libraries.
@@ -709,7 +698,7 @@ engineers, musicians, soundtrack editors and composers.")
              (delete-file-recursively (string-append "lib-src/" dir)))
            '("expat" "ffmpeg" "lame" "libflac" "libid3tag" "libmad" "libogg"
              "libsndfile" "libsoxr" "libvamp" "libvorbis" "lv2"
-              "portaudio-v19" "portmidi" "soundtouch" "twolame"
+              "portmidi" "soundtouch" "twolame"
              ;; FIXME: these libraries have not been packaged yet:
              ;; "libnyquist"
              ;; "libscorealign"
@@ -723,7 +712,7 @@ engineers, musicians, soundtrack editors and composers.")
              ;; "sbsms"
              ))
           #t))))
-    (build-system glib-or-gtk-build-system)
+    (build-system cmake-build-system)
    (inputs
     `(("wxwidgets" ,wxwidgets)
       ("gtk+" ,gtk+)
@@ -745,7 +734,6 @@ engineers, musicians, soundtrack editors and composers.")
       ("lv2" ,lv2)
       ("lilv" ,lilv)                   ;for lv2
       ("suil" ,suil)                   ;for lv2
-       ("portaudio" ,portaudio)
       ("portmidi" ,portmidi)))
    (native-inputs
     `(("autoconf" ,autoconf)
@@ -757,52 +745,18 @@ engineers, musicians, soundtrack editors and composers.")
       ("which" ,which)))
    (arguments
     `(#:configure-flags
-       (let ((libid3tag (assoc-ref %build-inputs "libid3tag"))
-             (libmad (assoc-ref %build-inputs "libmad"))
-             (portmidi (assoc-ref %build-inputs "portmidi")))
-         (list
-          ;; Loading FFmpeg dynamically is problematic.
-          "--disable-dynamic-loading"
-          ;; SSE instructions are available on Intel systems only.
-          ,@(if (any (cute string-prefix? <> (or (%current-target-system)
-                                                 (%current-system)))
-                    '("x86_64" "i686"))
-              '()
-              '("--enable-sse=no"))
-          ;; portmidi, libid3tag and libmad provide no .pc files, so
-          ;; pkg-config fails to find them.  Force their inclusion.
-          (string-append "ID3TAG_CFLAGS=-I" libid3tag "/include")
-          (string-append "ID3TAG_LIBS=-L" libid3tag "/lib -lid3tag -lz")
-          (string-append "LIBMAD_CFLAGS=-I" libmad "/include")
-          (string-append "LIBMAD_LIBS=-L" libmad "/lib -lmad")
-          (string-append "PORTMIDI_CFLAGS=-I" portmidi "/include")
-          (string-append "PORTMIDI_LIBS=-L" portmidi "/lib -lportmidi")
-          "EXPAT_USE_SYSTEM=yes"
-          "FFMPEG_USE_SYSTEM=yes"
-          "LAME_USE_SYSTEM=yes"
-          "LIBFLAC_USE_SYSTEM=yes"
-          "LIBID3TAG_USE_SYSTEM=yes"
-          "LIBMAD_USE_SYSTEM=yes"
-          "USE_LOCAL_LIBNYQUIST="      ;not packaged yet
-          ;;"LIBSBSMS_USE_SYSTEM=yes"  ;bundled version is patched
-          "LIBSNDFILE_USE_SYSTEM=yes"
-          "LIBSOUNDTOUCH_USE_SYSTEM=yes"
-          "LIBSOXR_USE_SYSTEM=yes"
-          "LIBTWOLAME_USE_SYSTEM=yes"
-          "LIBVAMP_USE_SYSTEM=yes"
-          "LIBVORBIS_USE_SYSTEM=yes"
-          "LV2_USE_SYSTEM=yes"
-          "PORTAUDIO_USE_SYSTEM=yes"))
+       (list
+        ;; Loading FFmpeg dynamically is problematic.
+        "-Daudacity_use_ffmpeg=linked"
+        "-Daudacity_use_lame=system"
+        "-Daudacity_use_portsmf=system")
       #:phases
       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-sbsms-check
+         (add-after 'unpack 'comment-out-revision-ident
           (lambda _
-             ;; This check is wrong: there is no 2.2.0 release; not even the
-             ;; bundled sources match this release string.
-             (substitute* '("m4/audacity_checklib_libsbsms.m4"
-                            "configure")
-               (("sbsms >= 2.2.0") "sbsms >= 2.0.0"))
-             #t))
+             (substitute* "src/AboutDialog.cpp"
+               (("(.*RevisionIdent\\.h.*)" include-line)
+                (string-append "// " include-line)))))
         (add-after 'unpack 'use-upstream-headers
           (lambda* (#:key inputs #:allow-other-keys)
             (substitute* '("src/NoteTrack.cpp"
@@ -812,12 +766,11 @@ engineers, musicians, soundtrack editors and composers.")
               (("../lib-src/portmidi/pm_common/portmidi.h") "portmidi.h")
               (("../lib-src/portmidi/porttime/porttime.h") "porttime.h"))
             (substitute* "src/prefs/MidiIOPrefs.cpp"
-               (("../../lib-src/portmidi/pm_common/portmidi.h") "portmidi.h"))
-             #t)))
-       ;; The test suite is not "well exercised" according to the developers,
-       ;; and fails with various errors.  See
-       ;; <http://sourceforge.net/p/audacity/mailman/message/33524292/>.
-       #:tests? #f))
+               (("../../lib-src/portmidi/pm_common/portmidi.h") "portmidi.h")))))
+         ;; The test suite is not "well exercised" according to the developers,
+         ;; and fails with various errors.  See
+         ;; <http://sourceforge.net/p/audacity/mailman/message/33524292/>.
+         #:tests? #f))
    (home-page "https://www.audacityteam.org/")
    (synopsis "Software for recording and editing sounds")
    (description
@@ -848,18 +801,30 @@ tools.")
         "audiofile-Fix-index-overflow-in-IMA.cpp.patch"
         ;; CVE-2017-6827, CVE-2017-6828, CVE-2017-6832, CVE-2017-6835,
         ;; CVE-2017-6837:
-         "audiofile-Check-the-number-of-coefficients.patch"
+         "audiofile-check-number-of-coefficients.patch"
         ;; CVE-2017-6839:
-         "audiofile-Fix-overflow-in-MSADPCM-decodeSam.patch"
+         "audiofile-overflow-in-MSADPCM.patch"
         ;; CVE-2017-6830, CVE-2017-6834, CVE-2017-6836, CVE-2017-6838:
-         "audiofile-Fix-multiply-overflow-sfconvert.patch"
-         "audiofile-signature-of-multiplyCheckOverflow.patch"
+         "audiofile-multiply-overflow.patch"
+         "audiofile-function-signature.patch"
         ;; CVE-2017-6831:
         "audiofile-Fail-on-error-in-parseFormat.patch"
         ;; CVE-2017-6833:
-         "audiofile-division-by-zero-BlockCodec-runPull.patch"
+         "audiofile-division-by-zero.patch"
         "audiofile-CVE-2018-13440.patch"
         "audiofile-CVE-2018-17095.patch"))))
+    (properties `((lint-hidden-cve . ("CVE-2017-6829"
+
+                                      "CVE-2017-6827" "CVE-2017-6828"
+                                      "CVE-2017-6832" "CVE-2017-6835"
+                                      "CVE-2017-6837"
+
+                                      "CVE-2017-6839"
+
+                                      "CVE-2017-6830" "CVE-2017-6834"
+                                      "CVE-2017-6836" "CVE-2017-6838"
+
+                                      "CVE-2017-6831" "CVE-2017-6833"))))
    (build-system gnu-build-system)
    (inputs
     `(("alsa-lib" ,alsa-lib)))
@@ -1033,7 +998,7 @@ tools (analyzer, mono/stereo tools, crossovers).")
     `(("lv2" ,lv2)))
    ;; home-page of the original LADSPA version: http://quitte.de/dsp/caps.html
    (home-page "https://github.com/moddevices/caps-lv2")
-    (synopsis "LV2 port of the CAPS audio plugin colection")
+    (synopsis "LV2 port of the CAPS audio plugin collection")
    (description
     "LV2 port of CAPS, a collection of audio plugins comprising basic virtual
 guitar amplification and a small range of classic effects, signal processors and
@@ -1618,7 +1583,7 @@ follower.")
 (define-public fluidsynth
  (package
    (name "fluidsynth")
-    (version "2.1.4")
+    (version "2.1.5")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -1627,7 +1592,7 @@ follower.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1r3khwyw57ybg5m4x0rvdzq7hgw2484sd52k6bm19akbw8yicfna"))))
+                "0ccpq4p1h1g53ng3961g3lh590qnwvpzwdzpl6ai4j6iazq0bh73"))))
    (build-system cmake-build-system)
    (arguments
     '(#:tests? #f                      ; no check target
@@ -1810,7 +1775,7 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
 (define-public guitarix
  (package
    (name "guitarix")
-    (version "0.38.1")
+    (version "0.41.0")
    (source (origin
             (method url-fetch)
             (uri (string-append
@@ -1818,28 +1783,14 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
                   version ".tar.xz"))
             (sha256
              (base32
-               "0bw7xnrx062nwb1bfj9x660h7069ncmz77szcs8icpqxrvhs7z80"))))
+               "0qsfbyrrpb3bbdyq68k28mjql7kglxh8nqcw9jvja28x6x9ik5a0"))))
    (build-system waf-build-system)
    (arguments
     `(#:tests? #f ; no "check" target
-       #:python ,python-2
       #:configure-flags
       (list
        ;; Add the output lib directory to the RUNPATH.
-        (string-append "--ldflags=-Wl,-rpath=" %output "/lib"))
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'unpack 'fix-boost-includes
-           (lambda _
-             (substitute* "src/headers/gx_internal_plugins.h"
-               (("namespace gx_jack" m)
-                (string-append "#include <boost/noncopyable.hpp>\n" m)))
-             (substitute* '("src/headers/gx_system.h"
-                            "src/headers/gx_parameter.h"
-                            "src/headers/gx_json.h")
-               (("namespace gx_system" m)
-                (string-append "#include <boost/noncopyable.hpp>\n" m)))
-             #t)))))
+        (string-append "--ldflags=-Wl,-rpath=" %output "/lib"))))
    (inputs
     `(("libsndfile" ,libsndfile)
       ("boost" ,boost)
@@ -1850,8 +1801,8 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
       ("lilv" ,lilv)
       ("ladspa" ,ladspa)
       ("jack" ,jack-1)
-       ("gtkmm" ,gtkmm-2)
-       ("gtk+" ,gtk+-2)
+       ("gtkmm" ,gtkmm)
+       ("gtk+" ,gtk+)
       ("fftwf" ,fftwf)
       ("lrdf" ,lrdf)
       ("zita-resampler" ,zita-resampler)
@@ -1861,7 +1812,8 @@ patches that can be used with softsynths such as Timidity and WildMidi.")
       ("faust" ,faust)
       ("intltool" ,intltool)
       ("gettext" ,gettext-minimal)
-       ("pkg-config" ,pkg-config)))
+       ("pkg-config" ,pkg-config)
+       ("sassc" ,sassc)))
    (native-search-paths
     (list (search-path-specification
            (variable "LV2_PATH")
@@ -1955,8 +1907,15 @@ well suited to all musical instruments and vocals.")
       (list (string-append "PREFIX=" (assoc-ref %outputs "out"))
             (string-append "INSTDIR="
                            (assoc-ref %outputs "out") "/lib/lv2"))
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure))))        ; no configure script
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)        ; no configure script
+         ;; See https://github.com/tomszilagyi/ir.lv2/pull/20
+         (add-after 'unpack 'fix-type 
+           (lambda _
+             (substitute* '("ir_gui.cc" "lv2_ui.h")
+               (("_LV2UI_Descriptor") "LV2UI_Descriptor"))
+             #t)))))
    (inputs
     `(("libsndfile" ,libsndfile)
       ("libsamplerate" ,libsamplerate)
@@ -2030,7 +1989,7 @@ synchronous execution of all clients, and low latency operation.")
 (define-public jack-2
  (package (inherit jack-1)
    (name "jack2")
-    (version "1.9.13")
+    (version "1.9.14")
    (source (origin
             (method url-fetch)
             (uri (string-append "https://github.com/jackaudio/jack2/releases/"
@@ -2039,7 +1998,7 @@ synchronous execution of all clients, and low latency operation.")
             (file-name (string-append name "-" version ".tar.gz"))
             (sha256
              (base32
-               "1d1d403jn4366mqig6g8ghr8057b3rn7gs26b5p3rkal34j20qw2"))))
+               "0z11hf55a6mi8h50hfz5wry9pshlwl4mzfwgslghdh40cwv342m2"))))
    (build-system waf-build-system)
    (arguments
     `(#:tests? #f  ; no check target
@@ -2049,6 +2008,10 @@ synchronous execution of all clients, and low latency operation.")
       (modify-phases %standard-phases
         (add-before 'configure 'set-linkflags
           (lambda _
+             ;; Ensure -lstdc++ is the tail of LDFLAGS or the simdtests.cpp
+             ;; will not link with undefined reference to symbol
+             ;; '__gxx_personality_v0@@CXXABI_1.3'
+             (setenv "LDFLAGS" "-lstdc++")
             ;; Add $libdir to the RUNPATH of all the binaries.
             (substitute* "wscript"
               ((".*CFLAGS.*-Wall.*" m)
@@ -2676,20 +2639,21 @@ different audio devices such as ALSA or PulseAudio.")
 (define-public qjackctl
  (package
    (name "qjackctl")
-    (version "0.5.9")
+    (version "0.9.0")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/qjackctl/qjackctl/"
                                  version "/qjackctl-" version ".tar.gz"))
              (sha256
               (base32
-                "1saywsda9m124rmjp7i3n0llryaliabjxhqhvqr6dm983qy7pypk"))))
+                "1gaabf2ncd5xd846fjm3k5d0kzphlyc33k9pralc2j3r3g0cb5ji"))))
    (build-system gnu-build-system)
    (arguments
     '(#:tests? #f))                    ; no check target
    (inputs
     `(("jack" ,jack-1)
       ("alsa-lib" ,alsa-lib)
+       ("portaudio" ,portaudio)
       ("qtbase" ,qtbase)
       ("qtx11extras" ,qtx11extras)))
    (native-inputs
@@ -2920,7 +2884,7 @@ aimed at audio/musical applications.")
    (description "This package contains the @command{resample} and
@command{windowfilter} command line utilities.  The @command{resample} command
 allows changing the sampling rate of a sound file, while the
-@command{windowfilter} command allows to design Finite Impulse Response (FIR)
+@command{windowfilter} command allows designing Finite Impulse Response (FIR)
 filters using the so-called @emph{window method}.")
    (home-page "https://ccrma.stanford.edu/~jos/resample/Free_Resampling_Software.html")
    (license license:lgpl2.1+)))
@@ -2996,14 +2960,14 @@ input/output.")
 (define-public sratom
  (package
    (name "sratom")
-    (version "0.6.4")
+    (version "0.6.6")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://download.drobilla.net/sratom-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-                "0vh0biy3ngpzzgdml309c2mqz8xq9q0hlblczb4c6alhp0a8yv0l"))))
+                "178v90qvsp6lw4sqdmdz0bzyjkgwhv9m75ph1d1z8say5bv0p4gv"))))
    (build-system waf-build-system)
    (arguments `(#:tests? #f))          ;no check target
    (propagated-inputs
@@ -3023,14 +2987,14 @@ the Turtle syntax.")
 (define-public suil
  (package
    (name "suil")
-    (version "0.10.6")
+    (version "0.10.8")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://download.drobilla.net/suil-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-                "0z4v01pjw4wh65x38w6icn28wdwxz13ayl8hvn4p1g9kmamp1z06"))))
+                "0h0ghk1s0lrj4gh12r7390b0ybaw7awnj0vhchyy9ll0gvhqgkci"))))
    (build-system waf-build-system)
    (arguments
     `(#:tests? #f))                    ;no check target
@@ -3054,6 +3018,32 @@ that toolkit will work in all hosts that use Suil automatically.
 Suil currently supports every combination of Gtk, Qt, and X11.")
    (license license:isc)))

+(define-public libebur128
+  (package
+    (name "libebur128")
+    (version "1.2.4")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/jiixyj/libebur128")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0n81rnm8dm1zmibkr2v3q79rsd609y0dbbsrbay18njcjva88p0g"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(;; Tests require proprietary .wav files. See
+       ;; https://github.com/jiixyj/libebur128/issues/82.
+       #:tests? #f
+       #:configure-flags '("-DBUILD_STATIC_LIBS=OFF")))
+    (home-page "https://github.com/jiixyj/libebur128")
+    (synopsis "Library implementing the EBU R 128 loudness standard")
+    (description
+     "@code{libebur128} is a C library that implements the EBU R 128 standard
+for loudness normalisation.")
+    (license license:expat)))
+
 (define-public timidity++
  (package
    (name "timidity++")
@@ -3298,7 +3288,7 @@ Tracker 3 S3M and Impulse Tracker IT files.")
 (define-public soundtouch
  (package
    (name "soundtouch")
-    (version "2.1.2")
+    (version "2.2")
    (source
     (origin
       (method git-fetch)
@@ -3307,7 +3297,7 @@ Tracker 3 S3M and Impulse Tracker IT files.")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "174wgm3s0inmbnkrlnspxjwm2014qhjhkbdqa5r8rbfi0nzqxzsz"))))
+        (base32 "12i6yg8vvqwyk412lxl2krbfby6hnxld8qxy0k4m5xp4g94jiq4p"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("autoconf" ,autoconf)
@@ -3478,8 +3468,11 @@ interface.")
    (source
     (origin
       (method url-fetch)
-       (uri (string-append "mirror://sourceforge/qsynth/qsynth/" version
-                           "/qsynth-" version ".tar.gz"))
+       (uri (list
+              (string-append "mirror://sourceforge/qsynth/qsynth/" version
+                             "/qsynth-" version ".tar.gz")
+              (string-append "mirror://sourceforge/qsynth/qsynth (attic)"
+                             "/qsynth-" version ".tar.gz")))
       (sha256
        (base32 "18im4w8agj60nkppwbkxqnhpp13z5li3w30kklv4lgs20rvgbvl6"))))
    (build-system gnu-build-system)
@@ -3758,8 +3751,11 @@ machine-readable ASCII format.")
    (version "3.0.10")
    (source (origin
             (method url-fetch)
-             (uri (string-append "http://etree.org/shnutils/shntool/dist/src/"
-                                 "shntool-" version ".tar.gz"))
+             (uri (list
+                    (string-append "http://etree.org/shnutils/shntool/dist/src/"
+                                   "shntool-" version ".tar.gz")
+                    (string-append "mirror://debian/pool/main/s/shntool/shntool_"
+                                   version ".orig.tar.gz")))
             (sha256
              (base32
               "00i1rbjaaws3drkhiczaign3lnbhr161b7rbnjr8z83w8yn2wc3l"))))
@@ -3790,9 +3786,9 @@ use them split WAVE data into multiple files.")
    (build-system gnu-build-system)
    (arguments
     ;; Test files are missing: https://github.com/foo86/dcadec/issues/53
-     '(#:tests? #f
+     `(#:tests? #f
       #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
             ;; Build shared library.
             "CONFIG_SHARED=1"
             (string-append "PREFIX=" (assoc-ref %outputs "out"))
@@ -3867,8 +3863,8 @@ loudness of audio and video files to the same level.")
           "0hbb290n3wb23f2k692a6bhc23nnqmxqi9sc9j15pnya8wifw64g"))))
      (build-system gnu-build-system)
      (arguments
-       '(#:make-flags (list (string-append "PREFIX=" %output)
-                            "CC=gcc")
+       `(#:make-flags (list (string-append "PREFIX=" %output)
+                            (string-append "CC=" ,(cc-for-target)))
         #:tests? #f ; No tests
         #:phases
         (modify-phases %standard-phases
@@ -3959,10 +3955,31 @@ mixers.")
 (define-public python2-pyalsaaudio
  (package-with-python2 python-pyalsaaudio))

+(define-public ldacbt
+  (package
+    (name "ldacbt")
+    (version "2.0.2.3")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://github.com/EHfive/ldacBT"
+                                  "/releases/download/v" version
+                                  "/ldacBT-" version ".tar.gz"))
+              (sha256
+               (base32
+                "1d65dms4klzql29abi15i90f41h523kl6mxrz9hi6p5vg37fxn2b"))))
+    (build-system cmake-build-system)
+    (arguments `(#:tests? #f)) ; no check target
+    (home-page "https://github.com/EHfive/ldacBT/")
+    (synopsis "LDAC Bluetooth encoder and ABR library")
+    (description "This package provides an encoder for the LDAC
+high-resolution Bluetooth audio streaming codec for streaming at up to 990
+kbps at 24 bit/96 kHz.")
+    (license license:asl2.0)))
+
 (define-public bluez-alsa
  (package
    (name "bluez-alsa")
-    (version "2.0.0")
+    (version "3.0.0")
    (source (origin
              ;; The tarballs are mere snapshots and don't contain a
              ;; bootstrapped build system.
@@ -3973,11 +3990,12 @@ mixers.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "08mppgnjf1j2733bk9yf0cny6rfxxwiys0s62lz2zd2lpdl6d9lz"))))
+                "1jlsgxyqfhncfhx1sy3ry0dp6p95kd4agh7g2b7g51h0c4cv74h8"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags
-       (list (string-append "--with-alsaplugindir="
+       (list "--enable-ldac"
+             (string-append "--with-alsaplugindir="
                            (assoc-ref %outputs "out")
                            "/lib/alsa-lib")
             (string-append "--with-dbusconfdir="
@@ -3993,6 +4011,7 @@ mixers.")
       ("bluez" ,bluez)
       ("dbus" ,dbus)
       ("glib" ,glib)
+       ("ldacbt" ,ldacbt)
       ("libbsd" ,libbsd)
       ("ncurses" ,ncurses)
       ("ortp" ,ortp)
@@ -4013,14 +4032,14 @@ on the ALSA software PCM plugin.")
 (define-public snd
  (package
    (name "snd")
-    (version "20.6")
+    (version "20.9")
    (source (origin
              (method url-fetch)
              (uri (string-append "ftp://ccrma-ftp.stanford.edu/pub/Lisp/"
                                  "snd-" version ".tar.gz"))
              (sha256
               (base32
-                "1h4dsq5xcvwjbnayhn719cln0lg199w3xm59sl9d2jz8bq78gqgj"))))
+                "0jxkycxn6jcbs4gklk9sk3gfr0y26dz1m71nxah9rnx80wnzj6hr"))))
    (build-system glib-or-gtk-build-system)
    (arguments
     `(#:tests? #f                      ; no tests
@@ -4163,7 +4182,7 @@ representations.")
 (define-public cava
  (package
    (name "cava")
-    (version "0.6.1")
+    (version "0.7.3")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@@ -4172,7 +4191,7 @@ representations.")
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1kvhqgijs29909w3sq9m0bslx2zxxn4b3i07kdz4hb0dqkppxpjy"))))
+                "04j5hb29hivcbk542sfsx9m57dbnj2s6qpvy9fs488zvgjbgxrai"))))
    (build-system gnu-build-system)
    (native-inputs
     `(("autoconf" ,autoconf)
@@ -4464,10 +4483,40 @@ supports both of ID3v1/v2 and APEv2 tags.")
    (home-page "http://tausoft.org/")
    (license license:gpl2+)))

+(define-public libsoundio
+  (package
+    (name "libsoundio")
+    (version "2.0.0")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/andrewrk/libsoundio")
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32
+         "12l4rvaypv87vigdrmjz48d4d6sq4gfxf5asvnc4adyabxb73i4x"))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:tests? #f)) ;no tests included
+    (inputs
+     `(("alsa-lib" ,alsa-lib)
+       ("jack" ,jack-1)
+       ("pulseaudio" ,pulseaudio)))
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (home-page "http://libsound.io")
+    (synopsis "C library for real-time audio input and output")
+    (description "@code{libsoundio} is a C library providing audio input and
+output.  The API is suitable for real-time software such as digital audio
+workstations as well as consumer software such as music players.")
+    (license license:expat)))
+
 (define-public redkite
  (package
    (name "redkite")
-    (version "0.8.1")
+    (version "1.0.3")
    (source
     (origin
       (method git-fetch)
@@ -4476,14 +4525,14 @@ supports both of ID3v1/v2 and APEv2 tags.")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "17kv2jc4jvn3sdicz3sf8dnf25wbvv7ijzkr0mm0sbrrjz6vrwz0"))))
+        (base32 "1m2db7c791fi33snkjwnvlxapmf879g5r8azlkx7sr6vp2s0jq2k"))))
    (build-system cmake-build-system)
    (arguments
     `(#:tests? #f))                    ;no tests included
    (inputs
     `(("cairo" ,cairo)))
    (native-inputs
-     `(("pkg-config", pkg-config)))
+     `(("pkg-config" ,pkg-config)))
    (synopsis "Small GUI toolkit")
    (description "Redkite is a small GUI toolkit developed in C++17 and
 inspired from other well known GUI toolkits such as Qt and GTK.  It is
@@ -4610,7 +4659,7 @@ in the package.")
 (define-public libaudec
  (package
    (name "libaudec")
-    (version "0.2.2")
+    (version "0.2.4")
    (source
      (origin
        (method git-fetch)
@@ -4620,16 +4669,18 @@ in the package.")
        (file-name (git-file-name name version))
        (sha256
          (base32
-            "04mpmfmqc43asw0m3zxhb6jj4qms7x4jw7mx4xb1d3lh16xllniz"))))
+            "1570m2dfia17dbkhd2qhx8jjihrpm7g8nnyg6n4wif4vv229s7dz"))))
   (build-system meson-build-system)
   (arguments
-    `(#:configure-flags `("-Denable_tests=true -Denable_ffmpeg=true")))
+    `(#:meson ,meson-0.55
+      #:configure-flags
+      ;; Build the tests.
+      `("-Dtests=true")))
   (inputs
    `(("libsamplerate" ,libsamplerate)
-      ("libsndfile" ,libsndfile)
-      ("ffmpeg" ,ffmpeg)))
+      ("libsndfile" ,libsndfile)))
   (native-inputs
-     `(("pkg-config", pkg-config)))
+     `(("pkg-config" ,pkg-config)))
   (synopsis "Library for reading and resampling audio files")
   (description "libaudec is a wrapper library over ffmpeg, sndfile and
 libsamplerate for reading and resampling audio files, based on Robin Gareus'
@@ -4640,7 +4691,7 @@ libsamplerate for reading and resampling audio files, based on Robin Gareus'
 (define-public lv2lint
  (package
    (name "lv2lint")
-    (version "0.4.0")
+    (version "0.8.0")
    (source
      (origin
        (method git-fetch)
@@ -4650,18 +4701,18 @@ libsamplerate for reading and resampling audio files, based on Robin Gareus'
        (file-name (git-file-name name version))
        (sha256
          (base32
-            "1pspwqpzl2dw1hd9ra9yr53arqbbqjn7d7j0f7p9g3iqa76vblpi"))))
+            "1jrka0hsn4n1clri7zfkcl3c2vi52144lkpjm81l51ff8rqy8ks1"))))
    (build-system meson-build-system)
    (arguments
     `(#:configure-flags
       `("-Delf-tests=true" ; for checking symbol visibility
         "-Donline-tests=true"))) ; for checking URI existence
    (inputs
-      `(("curl", curl)
-        ("libelf", libelf)
-        ("lilv", lilv)))
+      `(("curl" ,curl)
+        ("libelf" ,libelf)
+        ("lilv" ,lilv)))
    (native-inputs
-      `(("pkg-config", pkg-config)))
+      `(("pkg-config" ,pkg-config)))
    (synopsis "LV2 plugin lint tool")
    (description "lv2lint is an LV2 lint-like tool that checks whether a
 given plugin and its UI(s) match up with the provided metadata and adhere
@@ -4692,11 +4743,11 @@ to well-known best practices.")
      (modify-phases %standard-phases
        (delete 'configure))))
    (inputs
-      `(("jalv", jalv)
-        ("lilv", lilv)))
+      `(("jalv" ,jalv)
+        ("lilv" ,lilv)))
    (native-inputs
-      `(("help2man", help2man)
-        ("pkg-config", pkg-config)))
+      `(("help2man" ,help2man)
+        ("pkg-config" ,pkg-config)))
    (synopsis "Documentation generator for LV2 plugins")
    (description
      "lv2toweb allows the user to create an xhtml page with information
@@ -4778,6 +4829,37 @@ edited, converted, compressed and saved.")
       ,@(package-inputs ztoolkit)))
    (synopsis "ZToolkit with SVG support")))

+(define-public lsp-dsp-lib
+  (package
+    (name "lsp-dsp-lib")
+    (version "0.5.8")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (string-append "https://github.com/sadko4u/lsp-dsp-lib/"
+                            "releases/download/lsp-dsp-lib-" version
+                            "/lsp-dsp-lib-" version "-src.tar.gz"))
+        (sha256
+         (base32
+          "07w3d2i0z0xmvi1ngcgs7lc5a0da8jvf7rv4dnjk01md43b7fkh1"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f ; no tests
+       #:make-flags
+       (list (string-append "CC=" ,(cc-for-target)))
+       #:phases
+       (modify-phases %standard-phases
+         (replace 'configure
+           (lambda* (#:key outputs #:allow-other-keys)
+             (invoke "make" "config"
+                     (string-append "PREFIX=" (assoc-ref outputs "out"))))))))
+    (home-page "https://github.com/sadko4u/lsp-dsp-lib")
+    (synopsis "Digital signal processing library")
+    (description "The LSP DSP library provides a set of functions that perform
+SIMD-optimized computing on several hardware architectures.  All functions
+currently operate on IEEE-754 single-precision floating-point numbers.")
+    (license license:lgpl3+)))
+
 (define-public codec2
  (package
    (name "codec2")
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2018 Tobias Geerinckx-Rice <me@tobias.gr>
-;;; Copyright © 2019 Ricardo Wurmus <rekado@elephly.net>
+;;; Copyright © 2018, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2019, 2020 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,26 +33,14 @@
 (define-public oath-toolkit
  (package
    (name "oath-toolkit")
-    (version "2.6.2")
+    (version "2.6.4")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://download.savannah.nongnu.org/releases/"
                           name "/" name "-" version ".tar.gz"))
-       (patches
-        (append (search-patches "oath-toolkit-glibc-compat.patch")
-                (list (origin
-                        ;; This huge commit updates gnulib for GCC 7 compatibility.
-                        (method url-fetch)
-                        (uri (string-append
-                              "https://gitlab.com/oath-toolkit/oath-toolkit/commit/"
-                              "2fffce2a471f74a585939c84cce16ef3015e5d3d.diff"))
-                        (file-name "oath-toolkit-update-gnulib.patch")
-                        (sha256
-                         (base32
-                          "088c9s4ay1b54bjqc4mwfs5l3f6357zj5vpw771zlq5g4addd4s0"))))))
       (sha256
-        (base32 "182ah8vfbg0yhv6mh1b6ap944d0na6x7lpfkwkmzb6jl9gx4cd5h"))))
+        (base32 "116na9nncpwshl3ww8w3llzwk49igilplxcjy1k6jzl3mmg2bimz"))))
    (build-system gnu-build-system)
    (arguments
     ;; TODO ‘--enable-pskc’ causes xmlsec-related test suite failures.
@@ -127,3 +115,28 @@ and the time-based @dfn{TOTP} algorithm (RFC6238).")
      (description "The Yubico PAM module provides an easy way to integrate the
 YubiKey into your existing user authentication infrastructure.")
      (license license:bsd-2))))
+
+(define-public pamtester
+  (package
+    (name "pamtester")
+    (version "0.1.2")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "mirror://sourceforge/pamtester/pamtester/"
+             version "/pamtester-" version ".tar.gz"))
+       (sha256
+        (base32 "1mdj1wj0adcnx354fs17928yn2xfr1hj5mfraq282dagi873sqw3"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)))
+    (inputs
+     `(("linux-pam" ,linux-pam)))
+    (home-page "http://pamtester.sourceforge.net/")
+    (synopsis "Utility for testing pluggable authentication modules (PAM) facility")
+    (description
+     "Pamtester is a tiny utility program to test the pluggable authentication
+modules (PAM) facility, specifically designed to help PAM module authors to
+intensively test their own modules.")
+    (license license:bsd-3)))
@@ -43,7 +43,7 @@
  #:use-module (ice-9 match)
  #:export (autoconf-wrapper))

-(define-public autoconf
+(define-public autoconf-2.69
  (package
    (name "autoconf")
    (version "2.69")
@@ -103,6 +103,39 @@ scripts are self-contained and portable, freeing the user from needing to
 know anything about Autoconf or M4.")
    (license gpl3+))) ; some files are under GPLv2+

+(define-public autoconf-2.70
+  (package
+    (inherit autoconf-2.69)
+    (version "2.70")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://gnu/autoconf/autoconf-"
+                           version ".tar.xz"))
+       (sha256
+        (base32
+         "1ipckz0wr2mvhj9n3ys54fmf2aksin6bhqvzl304bn6rc1w257ps"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments autoconf-2.69)
+       ((#:tests? _ #f)
+        ;; FIXME: To run the test suite, fix all the instances where scripts
+        ;; generates "#! /bin/sh" shebangs.
+        #f)
+       ((#:phases phases '%standard-phases)
+        `(modify-phases ,phases
+           (add-before 'check 'prepare-tests
+             (lambda _
+               (for-each patch-shebang
+                         (append (find-files "tests"
+                                             (lambda (file stat)
+                                               (executable-file? file)))
+                                 (find-files "bin"
+                                             (lambda (file stat)
+                                               (executable-file? file)))))
+               #t))))))))
+
+(define-public autoconf autoconf-2.69)
+
 (define-public autoconf-2.68
  (package (inherit autoconf)
    (version "2.68")
@@ -0,0 +1,88 @@
+/* GNU Guix --- Functional package management for GNU
+   Copyright 1996-1997,2000-2001,2006,2008,2011,2013,2018,2020
+      Free Software Foundation, Inc.
+   Copyright (C) 2020 Ludovic Courtès <ludo@gnu.org>
+
+   This file is part of GNU Guix.
+
+   GNU Guix is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or (at
+   your option) any later version.
+
+   GNU Guix is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.  */
+
+/* This file implements a variant of the 'guile' executable that does not
+   complain about locale issues and arranges to reduce startup time by
+   ignoring GUILE_LOAD_PATH and GUILE_LOAD_COMPILED_PATH until it has
+   booted.  */
+
+#include <stdlib.h>
+#include <string.h>
+#include <locale.h>
+#include <libguile.h>
+
+/* Saved values of GUILE_LOAD_PATH and GUILE_LOAD_COMPILED_PATH.  */
+static const char *load_path, *load_compiled_path;
+
+static void
+inner_main (void *unused, int argc, char **argv)
+{
+  if (load_path != NULL)
+    {
+      setenv ("GUILE_LOAD_PATH", load_path, 1);
+      SCM load_path_var =
+	scm_c_public_lookup ("guile", "%load-path");
+      SCM addition =
+	scm_parse_path (scm_from_locale_string (load_path), SCM_EOL);
+      scm_variable_set_x (load_path_var,
+			  scm_append
+			  (scm_list_2 (scm_variable_ref (load_path_var),
+				       addition)));
+    }
+
+  if (load_compiled_path != NULL)
+    {
+      setenv ("GUILE_LOAD_COMPILED_PATH", load_compiled_path, 1);
+      SCM load_compiled_path_var =
+	scm_c_public_lookup ("guile", "%load-compiled-path");
+      SCM addition =
+	scm_parse_path (scm_from_locale_string (load_compiled_path), SCM_EOL);
+      scm_variable_set_x (load_compiled_path_var,
+			  scm_append
+			  (scm_list_2 (scm_variable_ref (load_compiled_path_var),
+				       addition)));
+    }
+
+  scm_shell (argc, argv);
+}
+
+int
+main (int argc, char **argv)
+{
+  /* Try to install the current locale; remain silent if it fails.  */
+  if (setlocale (LC_ALL, "") == NULL)
+    /* The 'guix pull'-provided 'guix' includes at least en_US.utf8 so use
+       that.  That gives us UTF-8 support for 'scm_to_locale_string', etc.,
+       which is always preferable over the C locale.  */
+    setlocale (LC_ALL, "en_US.utf8");
+
+  const char *str;
+  str = getenv ("GUILE_LOAD_PATH");
+  load_path = str != NULL ? strdup (str) : NULL;
+  str = getenv ("GUILE_LOAD_COMPILED_PATH");
+  load_compiled_path = str ? strdup (str) : NULL;
+
+  unsetenv ("GUILE_LOAD_PATH");
+  unsetenv ("GUILE_LOAD_COMPILED_PATH");
+
+  scm_install_gmp_memory_functions = 1;
+  scm_boot_guile (argc, argv, inner_main, 0);
+  return 0; /* never reached */
+}
@@ -0,0 +1,7 @@
+" This appends all of the vim plugins to the end of Vim's runtimepath.
+for directory in ["/run/current-system/profile", $HOME . "/.guix-profile", $GUIX_PROFILE, $GUIX_ENVIRONMENT]
+    let vimplugins = directory . "/share/vim/vimfiles"
+    if isdirectory(vimplugins)
+        let &rtp = join([&rtp,vimplugins], ',')
+    endif
+endfor
@@ -1023,7 +1023,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -966,7 +966,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -1053,7 +1053,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -1063,7 +1063,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -1034,7 +1034,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -1008,7 +1008,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 CONFIG_NET_KEY_MIGRATE=y
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
@@ -1027,7 +1027,8 @@ CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=m
 # CONFIG_NET_KEY_MIGRATE is not set
 # CONFIG_SMC is not set
-# CONFIG_XDP_SOCKETS is not set
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=m
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
--- a/Show More
+++ b/Show More