diff --git a/build-aux/hydra/gnu-system.scm b/build-aux/hydra/gnu-system.scm
index b537aa7b1dce50ce4cfd3f0c518555214229323f..d586d90ae24ea757b4dee01f149b4f95dca89f99 100644
--- a/build-aux/hydra/gnu-system.scm
+++ b/build-aux/hydra/gnu-system.scm
@@ -221,10 +221,11 @@ (define subset
 
   (define (cross-jobs system)
     (define (from-32-to-64? target)
-      ;; Return true if SYSTEM is 32-bit and TARGET is 64-bit.
-      ;; This hacks prevents known-to-fail cross-builds from i686-linux to
+      ;; Return true if SYSTEM is 32-bit and TARGET is 64-bit.  This hack
+      ;; prevents known-to-fail cross-builds from i686-linux or armhf-linux to
       ;; mips64el-linux-gnuabi64.
-      (and (string-prefix? "i686-" system)
+      (and (or (string-prefix? "i686-" system)
+               (string-prefix? "armhf-" system))
            (string-suffix? "64" target)))
 
     (define (same? target)
diff --git a/configure.ac b/configure.ac
index cbe5dfb67e099e2648d75a03743d6f7967dea13f..1cfe876232dcb7672a135a8eebe4bbbeecfd121c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ(2.68)
-AC_INIT([GNU Guix], [0.8.3], [bug-guix@gnu.org], [guix],
+AC_INIT([GNU Guix], [0.9.0], [bug-guix@gnu.org], [guix],
   [http://www.gnu.org/software/guix/])
 AC_CONFIG_AUX_DIR([build-aux])
 
diff --git a/doc/guix.texi b/doc/guix.texi
index eec28218bb88cb85ff13553bbebf2fcd4f5f4f4d..8608e7a49f8b3b4363c810c683045b90aa2eece2 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -934,7 +934,9 @@ some of them.
 
 @subsection Locales
 
+@anchor{locales-and-locpath}
 @cindex locales, when not on GuixSD
+@vindex LOCPATH
 Packages installed @i{via} Guix will not use the host system's locale
 data.  Instead, you must first install one of the locale packages
 available with Guix and then define the @code{LOCPATH} environment
@@ -5569,6 +5571,13 @@ list only the locales that are actually used, as in:
         (charset "EUC-JP")))
 @end example
 
+@vindex LOCPATH
+The compiled locale definitions are available at
+@file{/run/current-system/locale}, which is the default location where
+the GNU@tie{}libc looks for locale data.  This can be overridden using
+the @code{LOCPATH} environment variable (@pxref{locales-and-locpath,
+@code{LOCPATH} and locale packages}).
+
 The @code{locale-definition} form is provided by the @code{(gnu system
 locale)} module.  Details are given below.
 
diff --git a/gnu-system.am b/gnu-system.am
index 2d261315efb7b395a5e9b92c03c8c465e533ebaa..f359a9b8342ab7cdfbdc617f2efaf6ffb0b49360 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -101,6 +101,7 @@ GNU_SYSTEM_MODULES =				\
   gnu/packages/feh.scm                          \
   gnu/packages/figlet.scm			\
   gnu/packages/file.scm				\
+  gnu/packages/finance.scm			\
   gnu/packages/firmware.scm			\
   gnu/packages/fish.scm				\
   gnu/packages/flashing-tools.scm		\
@@ -385,6 +386,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/abiword-pass-no-undefined-to-linker.patch	\
   gnu/packages/patches/abiword-use-proper-png-api.patch		\
   gnu/packages/patches/abiword-wmf-version-lookup-fix.patch	\
+  gnu/packages/patches/acl-hurd-path-max.patch			\
   gnu/packages/patches/aegis-constness-error.patch         	\
   gnu/packages/patches/aegis-perl-tempdir1.patch           	\
   gnu/packages/patches/aegis-perl-tempdir2.patch           	\
@@ -416,6 +418,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/clang-libc-search-path.patch		\
   gnu/packages/patches/clucene-pkgconfig.patch			\
   gnu/packages/patches/cmake-fix-tests.patch			\
+  gnu/packages/patches/coreutils-racy-tail-test.patch		\
   gnu/packages/patches/cpio-gets-undeclared.patch		\
   gnu/packages/patches/cpufrequtils-fix-aclocal.patch		\
   gnu/packages/patches/crda-optional-gcrypt.patch		\
@@ -468,6 +471,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/glibc-bootstrap-system.patch		\
   gnu/packages/patches/glibc-ldd-x86_64.patch			\
   gnu/packages/patches/glibc-locales.patch			\
+  gnu/packages/patches/glibc-o-largefile.patch			\
   gnu/packages/patches/gmp-arm-asm-nothumb.patch		\
   gnu/packages/patches/gnucash-price-quotes-perl.patch		\
   gnu/packages/patches/gnutls-doc-fix.patch			\
@@ -502,7 +506,10 @@ dist_patch_DATA =						\
   gnu/packages/patches/icecat-enable-acceleration-and-webgl.patch \
   gnu/packages/patches/icecat-freetype-2.6.patch		\
   gnu/packages/patches/icecat-libvpx-1.4.patch			\
+  gnu/packages/patches/icu4c-CVE-2014-6585.patch		\
+  gnu/packages/patches/icu4c-CVE-2015-1270.patch		\
   gnu/packages/patches/icu4c-CVE-2015-4760.patch		\
+  gnu/packages/patches/imagemagick-test-segv.patch		\
   gnu/packages/patches/irrlicht-mesa-10.patch			\
   gnu/packages/patches/jbig2dec-ignore-testtest.patch		\
   gnu/packages/patches/julia-0.3.10-fix-empty-array.patch	\
@@ -526,31 +533,13 @@ dist_patch_DATA =						\
   gnu/packages/patches/libmad-frame-length.patch		\
   gnu/packages/patches/libmad-mips-newgcc.patch			\
   gnu/packages/patches/libtheora-config-guess.patch		\
-  gnu/packages/patches/libtiff-CVE-2012-4564.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-1960.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-1961.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-4231.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-4232.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-4243.patch		\
-  gnu/packages/patches/libtiff-CVE-2013-4244.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-8129.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-9330.patch		\
-  gnu/packages/patches/libtiff-CVE-2014-9655.patch		\
   gnu/packages/patches/libtool-skip-tests2.patch		\
   gnu/packages/patches/libssh-CVE-2014-0017.patch		\
   gnu/packages/patches/libwmf-CVE-2006-3376.patch		\
   gnu/packages/patches/libwmf-CVE-2009-1364.patch		\
   gnu/packages/patches/libwmf-CVE-2015-0848+4588+4695+4696.patch \
   gnu/packages/patches/lirc-localstatedir.patch			\
+  gnu/packages/patches/libpthread-glibc-preparation.patch	\
   gnu/packages/patches/lm-sensors-hwmon-attrs.patch		\
   gnu/packages/patches/lua-pkgconfig.patch                      \
   gnu/packages/patches/lua51-liblua-so.patch                    \
@@ -583,12 +572,14 @@ dist_patch_DATA =						\
   gnu/packages/patches/nvi-db4.patch				\
   gnu/packages/patches/openexr-missing-samples.patch		\
   gnu/packages/patches/openssl-runpath.patch			\
+  gnu/packages/patches/openssl-c-rehash.patch			\
   gnu/packages/patches/orpheus-cast-errors-and-includes.patch	\
   gnu/packages/patches/ots-no-include-missing-file.patch	\
   gnu/packages/patches/patchelf-page-size.patch			\
   gnu/packages/patches/patchelf-rework-for-arm.patch		\
   gnu/packages/patches/patchutils-xfail-gendiff-tests.patch	\
   gnu/packages/patches/patch-hurd-path-max.patch		\
+  gnu/packages/patches/perl-autosplit-default-time.patch	\
   gnu/packages/patches/perl-finance-quote-unuse-mozilla-ca.patch \
   gnu/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \
   gnu/packages/patches/perl-module-pluggable-search.patch	\
@@ -598,6 +589,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/perl-tk-x11-discover.patch		\
   gnu/packages/patches/pidgin-add-search-path.patch		\
   gnu/packages/patches/pingus-sdl-libs-config.patch		\
+  gnu/packages/patches/pixman-pointer-arithmetic.patch		\
   gnu/packages/patches/plotutils-libpng-jmpbuf.patch		\
   gnu/packages/patches/polkit-drop-test.patch			\
   gnu/packages/patches/portaudio-audacity-compat.patch		\
@@ -666,7 +658,8 @@ dist_patch_DATA =						\
   gnu/packages/patches/unzip-remove-build-date.patch		\
   gnu/packages/patches/util-linux-tests.patch			\
   gnu/packages/patches/upower-builddir.patch			\
-  gnu/packages/patches/valgrind-glibc-2.21.patch		\
+  gnu/packages/patches/valgrind-glibc-2.22.patch		\
+  gnu/packages/patches/valgrind-linux-libre-4.x.patch		\
   gnu/packages/patches/vpnc-script.patch			\
   gnu/packages/patches/vtk-mesa-10.patch			\
   gnu/packages/patches/w3m-fix-compile.patch			\
diff --git a/gnu/packages/acl.scm b/gnu/packages/acl.scm
index af2fb62b8aa0dd9a1937f8e5769c96078e3723fa..784186b670bde4a362724772f47b7b45d00850ec 100644
--- a/gnu/packages/acl.scm
+++ b/gnu/packages/acl.scm
@@ -26,6 +26,7 @@ (define-module (gnu packages acl)
   #:use-module (gnu packages perl)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (gnu packages)
   #:use-module (guix build-system gnu))
 
 (define-public acl
@@ -39,7 +40,8 @@ (define-public acl
                           version ".src.tar.gz"))
       (sha256
        (base32
-        "08qd9s3wfhv0ajswsylnfwr5h0d7j9d4rgip855nrh400nxp940p"))))
+        "08qd9s3wfhv0ajswsylnfwr5h0d7j9d4rgip855nrh400nxp940p"))
+      (patches (list (search-patch "acl-hurd-path-max.patch")))))
     (build-system gnu-build-system)
     (arguments
      `(#:tests? #f   ; FIXME: Investigate test suite failures
@@ -58,11 +60,8 @@ (define-public acl
     (inputs `(("attr" ,attr)))
     (native-inputs
      `(("gettext" ,gnu-gettext)
-       ("perl" ,perl)
-       ("sed" ,sed)))
-
-    (home-page
-     "http://savannah.nongnu.org/projects/acl")
+       ("perl" ,perl)))
+    (home-page "http://savannah.nongnu.org/projects/acl")
     (synopsis
      "Library and tools for manipulating access control lists")
     (description
diff --git a/gnu/packages/admin.scm b/gnu/packages/admin.scm
index 70b2bb2c8fc0cbd26c17d611c395f8d767f526fa..027fe5b5735f6224de92fe1c248045dadb4131ad 100644
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@@ -428,6 +428,7 @@ (define-public isc-dhcp
                      (zero? (system* "tar" "cf" "bind.tar.gz"
                                      "bind-9.9.5-P1"
                                      ;; avoid non-determinism in the archive
+                                     "--sort=name"
                                      "--mtime=@0"
                                      "--owner=root:0"
                                      "--group=root:0"))))
diff --git a/gnu/packages/audio.scm b/gnu/packages/audio.scm
index 2511f121c2598a6ad292513c7c44bf249404230e..a35ef278ee570dbb05194d6a593c32de35e8a5a8 100644
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@@ -340,7 +340,7 @@ (define-public calf
 (define-public csound
   (package
     (name "csound")
-    (version "6.04")
+    (version "6.05")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -348,7 +348,7 @@ (define-public csound
                     version "/Csound" version ".tar.gz"))
               (sha256
                (base32
-                "1030w38lxdwjz1irr32m9cl0paqmgr02lab2m7f7j1yihwxj1w0g"))))
+                "0a1sni6lr7qpwywpggbkp0ia3h9bwwgf9i87gsag8ra2h30v82hd"))))
     (build-system cmake-build-system)
     (inputs
      `(("alsa-lib" ,alsa-lib)
diff --git a/gnu/packages/avahi.scm b/gnu/packages/avahi.scm
index 517df3238205791b1ce4bb9d5c5c2d2c71d24472..b6eef1a6ad1dfe2d6d854e0ac0325fc914fb8893 100644
--- a/gnu/packages/avahi.scm
+++ b/gnu/packages/avahi.scm
@@ -52,7 +52,8 @@ (define-public avahi
                            "--disable-xmltoman"
                            "--enable-tests"
                            "--disable-qt3" "--disable-qt4"
-                           "--disable-gtk" "--disable-gtk3")))
+                           "--disable-gtk" "--disable-gtk3"
+                           "--enable-compat-libdns_sd")))
     (inputs
      `(("expat" ,expat)
        ("glib" ,glib)
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index c5f447736a6ed66c9f7f0f9641fb22897ea45eb0..a3e3e36608f86fee746dffbdec4cb87cd18ef5fa 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -4,6 +4,7 @@
 ;;; Copyright © 2012 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2014 Alex Kost <alezost@gmail.com>
+;;; Copyright © 2014, 2015 Manolis Fragkiskos Ragkousis <manolis837@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,11 +34,13 @@ (define-module (gnu packages base)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages linux)
   #:use-module (gnu packages texinfo)
+  #:use-module (gnu packages hurd)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages gettext)
   #:use-module (guix utils)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix git-download)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system trivial))
 
@@ -246,10 +249,18 @@ (define-public coreutils
                                 version ".tar.xz"))
             (sha256
              (base32
-              "0w11jw3fb5sslf0f72kxy7llxgk1ia3a6bcw0c9kmvxrlj355mx2"))))
+              "0w11jw3fb5sslf0f72kxy7llxgk1ia3a6bcw0c9kmvxrlj355mx2"))
+            (patches
+             (list (search-patch "coreutils-racy-tail-test.patch")))))
    (build-system gnu-build-system)
    (inputs `(("acl"  ,acl)                        ; TODO: add SELinux
-             ("gmp"  ,gmp)))
+             ("gmp"  ,gmp)                        ;bignums in 'expr', yay!
+
+             ;; Drop the dependency on libcap when cross-compiling since it's
+             ;; not quite cross-compilable.
+             ,@(if (%current-target-system)
+                   '()
+                   `(("libcap" ,libcap)))))  ;capability support is 'ls', etc.
    (native-inputs
     ;; Perl is needed to run tests in native builds, and to run the bundled
     ;; copy of help2man.  However, don't pass it when cross-compiling since
@@ -285,6 +296,14 @@ (define-public coreutils
    (license gpl3+)
    (home-page "http://www.gnu.org/software/coreutils/")))
 
+(define-public coreutils-minimal
+  ;; Coreutils without its optional dependencies.
+  (package
+    (inherit coreutils)
+    (name "coreutils-minimal")
+    (outputs '("out"))
+    (inputs '())))
+
 (define-public gnu-make
   (package
    (name "make")
@@ -326,14 +345,14 @@ (define-public gnu-make
 (define-public binutils
   (package
    (name "binutils")
-   (version "2.25")
+   (version "2.25.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/binutils/binutils-"
                                 version ".tar.bz2"))
             (sha256
              (base32
-              "08r9i26b05zcwb9zxb6zllpfdiiicdfsgbpsjlrjmvx3rxjzrpi2"))
+              "08lzmhidzc16af1zbx34f8cy4z7mzrswpdbhrb8shy3xxpflmcdm"))
             (patches (list (search-patch "binutils-ld-new-dtags.patch")
                            (search-patch "binutils-loongson-workaround.patch")))))
    (build-system gnu-build-system)
@@ -439,14 +458,14 @@ (define* (make-ld-wrapper name #:key binutils
 (define-public glibc
   (package
    (name "glibc")
-   (version "2.21")
+   (version "2.22")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/glibc/glibc-"
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1f135546j34s9bfkydmx2nhh9vwxlx60jldi80zmsnln6wj3dsxf"))
+              "0j49682pm2nh4qbdw35bas82p1pgfnz4d2l7iwfyzvrvj0318wzb"))
             (snippet
              ;; Disable 'ldconfig' and /etc/ld.so.cache.  The latter is
              ;; required on LFS distros to avoid loading the distro's libc.so
@@ -455,7 +474,9 @@ (define-public glibc
                 (("use_ldconfig=yes")
                  "use_ldconfig=no")))
             (modules '((guix build utils)))
-            (patches (list (search-patch "glibc-ldd-x86_64.patch")))))
+            (patches (map search-patch
+                          '("glibc-ldd-x86_64.patch"
+                            "glibc-o-largefile.patch")))))
    (build-system gnu-build-system)
 
    ;; Glibc's <limits.h> refers to <linux/limit.h>, for instance, so glibc
@@ -472,7 +493,7 @@ (define-public glibc
       #:parallel-build? #f
 
       ;; The libraries have an empty RUNPATH, but some, such as the versioned
-      ;; libraries (libdl-2.21.so, etc.) have ld.so marked as NEEDED.  Since
+      ;; libraries (libdl-2.22.so, etc.) have ld.so marked as NEEDED.  Since
       ;; these libraries are always going to be found anyway, just skip
       ;; RUNPATH checks.
       #:validate-runpath? #f
@@ -513,72 +534,65 @@ (define-public glibc
             "libc_cv_ssp=no")
 
       #:tests? #f                                 ; XXX
-      #:phases (alist-cons-before
-                'configure 'pre-configure
-                (lambda* (#:key inputs native-inputs outputs
-                          #:allow-other-keys)
-                  (let* ((out  (assoc-ref outputs "out"))
-                         (bin  (string-append out "/bin")))
-                    ;; Use `pwd', not `/bin/pwd'.
-                    (substitute* "configure"
-                      (("/bin/pwd") "pwd"))
-
-                    ;; Install the rpc data base file under `$out/etc/rpc'.
-                    ;; FIXME: Use installFlags = [ "sysconfdir=$(out)/etc" ];
-                    (substitute* "sunrpc/Makefile"
-                      (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
-                       (string-append out "/etc/rpc" suffix "\n"))
-                      (("^install-others =.*$")
-                       (string-append "install-others = " out "/etc/rpc\n")))
-
-                    (substitute* "Makeconfig"
-                      ;; According to
-                      ;; <http://www.linuxfromscratch.org/lfs/view/stable/chapter05/glibc.html>,
-                      ;; linking against libgcc_s is not needed with GCC
-                      ;; 4.7.1.
-                      ((" -lgcc_s") ""))
-
-                    ;; Copy a statically-linked Bash in the output, with
-                    ;; no references to other store paths.
-                    ;; FIXME: Normally we would look it up only in INPUTS but
-                    ;; cross-base uses it as a native input.
-                    (mkdir-p bin)
-                    (copy-file (string-append (or (assoc-ref inputs
-                                                             "static-bash")
-                                                  (assoc-ref native-inputs
-                                                             "static-bash"))
-                                              "/bin/bash")
-                               (string-append bin "/bash"))
-                    (remove-store-references (string-append bin "/bash"))
-                    (chmod (string-append bin "/bash") #o555)
-
-                    ;; Keep a symlink, for `patch-shebang' resolution.
-                    (with-directory-excursion bin
-                      (symlink "bash" "sh"))
-
-                    ;; Have `system' use that Bash.
-                    (substitute* "sysdeps/posix/system.c"
-                      (("#define[[:blank:]]+SHELL_PATH.*$")
-                       (format #f "#define SHELL_PATH \"~a/bin/bash\"\n"
-                               out)))
-
-                    ;; Same for `popen'.
-                    (substitute* "libio/iopopen.c"
-                      (("/bin/sh")
-                       (string-append out "/bin/bash")))
-
-                    ;; Make sure we don't retain a reference to the
-                    ;; bootstrap Perl.
-                    (substitute* "malloc/mtrace.pl"
-                      (("^#!.*")
-                       ;; The shebang can be omitted, because there's the
-                       ;; "bilingual" eval/exec magic at the top of the file.
-                       "")
-                      (("exec @PERL@")
-                       "exec perl"))))
-                %standard-phases)))
-
-   (inputs `(("static-bash" ,(static-package bash-light))))
+      #:phases (modify-phases %standard-phases
+                 (add-before
+                  'configure 'pre-configure
+                  (lambda* (#:key inputs native-inputs outputs
+                                  #:allow-other-keys)
+                    (let* ((out  (assoc-ref outputs "out"))
+                           (bin  (string-append out "/bin"))
+                           ;; FIXME: Normally we would look it up only in INPUTS
+                           ;; but cross-base uses it as a native input.
+                           (bash (or (assoc-ref inputs "static-bash")
+                                     (assoc-ref native-inputs "static-bash"))))
+                      ;; Use `pwd', not `/bin/pwd'.
+                      (substitute* "configure"
+                        (("/bin/pwd") "pwd"))
+
+                      ;; Install the rpc data base file under `$out/etc/rpc'.
+                      ;; FIXME: Use installFlags = [ "sysconfdir=$(out)/etc" ];
+                      (substitute* "sunrpc/Makefile"
+                        (("^\\$\\(inst_sysconfdir\\)/rpc(.*)$" _ suffix)
+                         (string-append out "/etc/rpc" suffix "\n"))
+                        (("^install-others =.*$")
+                         (string-append "install-others = " out "/etc/rpc\n")))
+
+                      (substitute* "Makeconfig"
+                        ;; According to
+                        ;; <http://www.linuxfromscratch.org/lfs/view/stable/chapter05/glibc.html>,
+                        ;; linking against libgcc_s is not needed with GCC
+                        ;; 4.7.1.
+                        ((" -lgcc_s") ""))
+
+                      ;; Have `system' use that Bash.
+                      (substitute* "sysdeps/posix/system.c"
+                        (("#define[[:blank:]]+SHELL_PATH.*$")
+                         (format #f "#define SHELL_PATH \"~a/bin/bash\"\n"
+                                 bash)))
+
+                      ;; Same for `popen'.
+                      (substitute* "libio/iopopen.c"
+                        (("/bin/sh")
+                         (string-append bash "/bin/bash")))
+
+                      ;; Same for the shell used by the 'exec' functions for
+                      ;; scripts that lack a shebang.
+                      (substitute* (find-files "." "^paths\\.h$")
+                        (("#define[[:blank:]]+_PATH_BSHELL[[:blank:]].*$")
+                         (string-append "#define _PATH_BSHELL \""
+                                        bash "/bin/bash\"\n")))
+
+                      ;; Make sure we don't retain a reference to the
+                      ;; bootstrap Perl.
+                      (substitute* "malloc/mtrace.pl"
+                        (("^#!.*")
+                         ;; The shebang can be omitted, because there's the
+                         ;; "bilingual" eval/exec magic at the top of the file.
+                         "")
+                        (("exec @PERL@")
+                         "exec perl"))))))))
+
+   (inputs `(("static-bash" ,static-bash)))
 
    ;; To build the manual, we need Texinfo and Perl.  Gettext is needed to
    ;; install the message catalogs, with 'msgfmt'.
@@ -626,10 +640,6 @@ (define-public glibc-locales
           `(alist-replace
             'build
             (lambda* (#:key outputs #:allow-other-keys)
-              (let ((out (assoc-ref outputs "out")))
-                ;; Delete $out/bin, which contains 'bash'.
-                (delete-file-recursively (string-append out "/bin")))
-
               (zero? (system* "make" "localedata/install-locales"
                               "-j" (number->string (parallel-job-count)))))
             (alist-delete 'install ,phases)))
@@ -700,6 +710,113 @@ (define-public which
 command.")
     (license gpl3+))) ; some files are under GPLv2+
 
+(define-public glibc/hurd
+  ;; The Hurd's libc variant.
+  (package (inherit glibc)
+    (name "glibc-hurd")
+    (version "2.18")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "git://git.sv.gnu.org/hurd/glibc")
+                    (commit "cc94b3cfe65523f980359e5f0e93a26196bda1d3")))
+              (sha256
+               (base32
+                "17gsh0kaz0zyvghjmx861mi2p65m9901lngi179x61zm6v2v3xc4"))
+              (file-name (string-append name "-" version))
+              (patches (map search-patch
+                            '("glibc-hurd-extern-inline.patch")))))
+
+    ;; Libc provides <hurd.h>, which includes a bunch of Hurd and Mach headers,
+    ;; so both should be propagated.
+    (propagated-inputs `(("gnumach-headers" ,gnumach-headers)
+                         ("hurd-headers" ,hurd-headers)
+                         ("hurd-minimal" ,hurd-minimal)))
+    (native-inputs
+     `(,@(package-native-inputs glibc)
+       ("patch/libpthread-patch" ,(search-patch "libpthread-glibc-preparation.patch"))
+       ("mig" ,mig)
+       ("perl" ,perl)
+       ("libpthread" ,(origin
+                        (method git-fetch)
+                        (uri (git-reference
+                              (url "git://git.sv.gnu.org/hurd/libpthread")
+                              (commit "0ef7b75c4ba91b6660f0d3d8b51d14d25e3d5bfb")))
+                        (sha256
+                         (base32
+                          "031py18fls15z0wprni33mf762kg6fx8xqijppimhp83yp6ky3l3"))
+                        (file-name "libpthread")))))
+
+    (arguments
+     (substitute-keyword-arguments (package-arguments glibc)
+       ((#:configure-flags original-configure-flags)
+        `(append (list "--host=i686-pc-gnu"
+
+                       ;; nscd fails to build for GNU/Hurd:
+                       ;; <https://lists.gnu.org/archive/html/bug-hurd/2014-07/msg00006.html>.
+                       ;; Disable it.
+                       "--disable-nscd")
+                 (filter (lambda (flag)
+                           (not (or (string-prefix? "--with-headers=" flag)
+                                    (string-prefix? "--enable-kernel=" flag))))
+                         ;; Evaluate 'original-configure-flags' in a
+                         ;; lexical environment that has a dummy
+                         ;; "linux-headers" input, to prevent errors.
+                         (let ((%build-inputs `(("linux-headers" . "@DUMMY@")
+                                                ,@%build-inputs)))
+                           ,original-configure-flags))))
+       ((#:phases phases)
+        `(alist-cons-after
+          'unpack 'prepare-libpthread
+          (lambda* (#:key inputs #:allow-other-keys)
+            (copy-recursively (assoc-ref inputs "libpthread") "libpthread")
+
+            (system* "patch" "--force" "-p1" "-i"
+                     (assoc-ref inputs "patch/libpthread-patch"))
+            #t)
+          ,phases))))
+    (synopsis "The GNU C Library (GNU Hurd variant)")
+    (supported-systems %hurd-systems)))
+
+(define-public glibc/hurd-headers
+  (package (inherit glibc/hurd)
+    (name "glibc-hurd-headers")
+    (outputs '("out"))
+    (propagated-inputs `(("gnumach-headers" ,gnumach-headers)
+                         ("hurd-headers" ,hurd-headers)))
+    (arguments
+     (substitute-keyword-arguments (package-arguments glibc/hurd)
+       ;; We just pass the flags really needed to build the headers.
+       ((#:configure-flags _)
+        `(list "--enable-add-ons"
+               "--host=i686-pc-gnu"
+               "--enable-obsolete-rpc"))
+       ((#:phases _)
+        '(alist-replace
+          'install
+          (lambda* (#:key outputs #:allow-other-keys)
+            (and (zero? (system* "make" "install-headers"))
+
+                 ;; Make an empty stubs.h to work around not being able to
+                 ;; produce a valid stubs.h and causing the build to fail. See
+                 ;; <http://lists.gnu.org/archive/html/guix-devel/2014-04/msg00233.html>.
+                 (let ((out (assoc-ref outputs "out")))
+                   (close-port
+                    (open-output-file
+                     (string-append out "/include/gnu/stubs.h"))))))
+
+          ;; Nothing to build.
+          (alist-delete
+           'build
+
+           (alist-cons-before
+            'configure 'pre-configure
+            (lambda _
+              ;; Use the right 'pwd'.
+              (substitute* "configure"
+                (("/bin/pwd") "pwd")))
+            %standard-phases))))))))
+
 (define-public tzdata
   (package
     (name "tzdata")
diff --git a/gnu/packages/bash.scm b/gnu/packages/bash.scm
index 6b2d0b855d8c0e007b384dad9dfb01697e60352f..180c64e87289bea650572a079980d25479f63b1b 100644
--- a/gnu/packages/bash.scm
+++ b/gnu/packages/bash.scm
@@ -214,10 +214,10 @@ (define-public bash
      (license gpl3+)
      (home-page "http://www.gnu.org/software/bash/"))))
 
-(define-public bash-light
+(define-public bash-minimal
   ;; A stripped-down Bash for non-interactive use.
   (package (inherit bash)
-    (name "bash-light")
+    (name "bash-minimal")
     (inputs '())                                ; no readline, no curses
     (arguments
      (let ((args `(#:modules ((guix build gnu-build-system)
@@ -239,6 +239,28 @@ (define-public bash-light
                        '("bash_cv_job_control_missing=no")
                        '()))))))))
 
+(define-public static-bash
+  ;; Statically-linked Bash that contains nothing but the 'bash' binary and
+  ;; 'sh' symlink, without any reference.
+  (let ((bash (static-package bash-minimal)))
+    (package
+      (inherit bash)
+      (name "bash-static")
+      (arguments
+       (substitute-keyword-arguments
+           `(#:allowed-references ("out") ,@(package-arguments bash))
+         ((#:phases phases)
+          `(alist-cons-after
+            'strip 'remove-everything-but-the-binary
+            (lambda* (#:key outputs #:allow-other-keys)
+              (let* ((out (assoc-ref outputs "out"))
+                     (bin (string-append out "/bin")))
+                (remove-store-references (string-append bin "/bash"))
+                (delete-file (string-append bin "/bashbug"))
+                (delete-file-recursively (string-append out "/share"))
+                #t))
+            ,phases)))))))
+
 (define-public bash-completion
   (package
     (name "bash-completion")
diff --git a/gnu/packages/bioinformatics.scm b/gnu/packages/bioinformatics.scm
index e647186ab3ffcc0e232edfc8fc97f6d3b7e84c3c..8fc6142f19a4c924b10608cd4e0631f16294d287 100644
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@@ -233,9 +233,8 @@ (define-public bedtools
           'install
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))
-              (mkdir-p bin)
               (for-each (lambda (file)
-                          (copy-file file (string-append bin (basename file))))
+                          (install-file file bin))
                         (find-files "bin" ".*"))))
           %standard-phases)))))
     (home-page "https://github.com/arq5x/bedtools2")
@@ -559,9 +558,8 @@ (define-public bowtie
          'install
          (lambda* (#:key outputs #:allow-other-keys)
            (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))
-             (mkdir-p bin)
              (for-each (lambda (file)
-                         (copy-file file (string-append bin file)))
+                         (install-file file bin))
                        (find-files "." "bowtie2.*"))))
          (alist-replace
           'check
@@ -611,9 +609,9 @@ (define-public bwa
             (mkdir-p bin)
             (mkdir-p doc)
             (mkdir-p man)
-            (copy-file "bwa" (string-append bin "/bwa"))
-            (copy-file "README.md" (string-append doc "/README.md"))
-            (copy-file "bwa.1" (string-append man "/bwa.1"))))
+            (install-file "bwa" bin)
+            (install-file "README.md" doc)
+            (install-file "bwa.1" man)))
         ;; no "configure" script
         (alist-delete 'configure %standard-phases))))
     (inputs `(("zlib" ,zlib)))
@@ -1308,14 +1306,12 @@ (define-public hisat
         (alist-replace
          'install
          (lambda* (#:key outputs #:allow-other-keys)
-           (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))
-             (mkdir-p bin)
-             (for-each
-              (lambda (file)
-                (copy-file file (string-append bin file)))
-              (find-files
-               "."
-               "hisat(-(build|align|inspect)(-(s|l)(-debug)*)*)*$"))))
+           (let ((bin (string-append (assoc-ref outputs "out") "/bi/")))
+             (for-each (lambda (file)
+                         (install-file file bin))
+                       (find-files
+                        "."
+                        "hisat(-(build|align|inspect)(-(s|l)(-debug)*)*)*$"))))
          (alist-delete 'configure %standard-phases)))))
     (native-inputs
      `(("unzip" ,unzip)))
@@ -2091,17 +2087,14 @@ (define-public samtools
          'install 'install-library
          (lambda* (#:key outputs #:allow-other-keys)
            (let ((lib (string-append (assoc-ref outputs "out") "/lib")))
-             (mkdir-p lib)
-             (copy-file "libbam.a" (string-append lib "/libbam.a"))))
+             (install-file "libbam.a" lib)))
          (alist-cons-after
           'install 'install-headers
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((include (string-append (assoc-ref outputs "out")
                                           "/include/samtools/")))
-              (mkdir-p include)
               (for-each (lambda (file)
-                          (copy-file file (string-append include
-                                                         (basename file))))
+                          (install-file file include))
                         (scandir "." (lambda (name) (string-match "\\.h$" name))))
               #t))
           (alist-delete 'configure %standard-phases))))))
@@ -2356,8 +2349,7 @@ (define-public plink
                   (lambda* (#:key outputs #:allow-other-keys)
                     (let ((bin (string-append (assoc-ref outputs "out")
                                               "/bin/")))
-                      (mkdir-p bin)
-                      (copy-file "plink" (string-append bin "plink"))
+                      (install-file "plink" bin)
                       #t))))))
     (inputs
      `(("zlib" ,zlib)
@@ -2617,8 +2609,7 @@ (define-public star
          'install
          (lambda* (#:key outputs #:allow-other-keys)
            (let ((bin (string-append (assoc-ref outputs "out") "/bin/")))
-             (mkdir-p bin)
-             (copy-file "STAR" (string-append bin "STAR"))))
+             (install-file "STAR" bin)))
          (alist-delete
           'configure %standard-phases)))))
     (native-inputs
diff --git a/gnu/packages/bootstrap.scm b/gnu/packages/bootstrap.scm
index bd9bce8a269d525d25171288896affd8b6bef0ba..f5bf069c207fd5bf3437420c9b6f0faf05b93ed6 100644
--- a/gnu/packages/bootstrap.scm
+++ b/gnu/packages/bootstrap.scm
@@ -164,6 +164,8 @@ (define* (glibc-dynamic-linker
         ((string=? system "i686-linux") "/lib/ld-linux.so.2")
         ((string=? system "armhf-linux") "/lib/ld-linux-armhf.so.3")
         ((string=? system "mips64el-linux") "/lib/ld.so.1")
+        ((string=? system "i586-gnu") "/lib/ld.so.1")
+        ((string=? system "i686-gnu") "/lib/ld.so.1")
 
         ;; XXX: This one is used bare-bones, without a libc, so add a case
         ;; here just so we can keep going.
diff --git a/gnu/packages/certs.scm b/gnu/packages/certs.scm
index 0f5a105755e05318096358db85fa62507dcdfa9d..dd7d3397941c68c5a695ff5d99ae656bb9053fe1 100644
--- a/gnu/packages/certs.scm
+++ b/gnu/packages/certs.scm
@@ -26,6 +26,7 @@ (define-module (gnu packages certs)
   #:use-module (gnu packages)
   #:use-module (gnu packages gnuzilla)
   #:use-module (gnu packages python)
+  #:use-module (gnu packages perl)
   #:use-module (gnu packages tls))
 
 (define certdata2pem
@@ -76,7 +77,8 @@ (define-public nss-certs
     (outputs '("out"))
     (native-inputs
      `(("certdata2pem" ,certdata2pem)
-       ("openssl" ,openssl)))
+       ("openssl" ,openssl)
+       ("perl" ,perl)))                           ;for OpenSSL's 'c_rehash'
     (inputs '())
     (propagated-inputs '())
     (arguments
diff --git a/gnu/packages/check.scm b/gnu/packages/check.scm
index e0ee7c4d4f5e4cac691519d356609219869d2414..3b7a243ba7f45eaa2766e9d7c2fbd54f28965d90 100644
--- a/gnu/packages/check.scm
+++ b/gnu/packages/check.scm
@@ -136,10 +136,9 @@ (define-public catch-framework
                                                  ,version)))
                      (begin
                        (for-each mkdir-p (list incdir docdir))
-                       (copy-file (string-append source
+                       (install-file (string-append source
                                                  "/single_include/catch.hpp")
-                                  (string-append incdir
-                                                 "/catch.hpp"))
+                                     incdir)
                        (copy-recursively (string-append source "/docs")
                                          docdir))))))
     (home-page "http://catch-lib.net/")
diff --git a/gnu/packages/cmake.scm b/gnu/packages/cmake.scm
index 6f8b9f67e37b597a9a8e8b6730ab5851ed1c6c8f..128f0370dd9965255ee69ed4668067c735fbdac4 100644
--- a/gnu/packages/cmake.scm
+++ b/gnu/packages/cmake.scm
@@ -36,7 +36,7 @@ (define-module (gnu packages cmake)
 (define-public cmake
   (package
     (name "cmake")
-    (version "3.2.2")
+    (version "3.3.1")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -44,12 +44,11 @@ (define-public cmake
                    (version-major+minor version)
                    "/cmake-" version ".tar.gz"))
              (sha256
-              (base32 "0y3w83al0vh9ll7fnqm3nx7l8hsl85k8iv9abxb791q36rp4xsdd"))
+              (base32 "1mp32dqywk4dfw7zmpgp31axszv7h74yk69g273z21q7d8n04rfd"))
              (patches (list (search-patch "cmake-fix-tests.patch")))))
     (build-system gnu-build-system)
     (arguments
      `(#:test-target "test"
-       #:parallel-tests? #f ; 3 test from RunCMake fails
        #:phases (alist-cons-before
                  'configure 'patch-bin-sh
                  (lambda _
diff --git a/gnu/packages/code.scm b/gnu/packages/code.scm
index e346f7e0c5d0ea35c2c48290dc9513195ed1689b..ece86a9ed581ebe09645658b31c7055a920c35d1 100644
--- a/gnu/packages/code.scm
+++ b/gnu/packages/code.scm
@@ -117,9 +117,8 @@ (define-public global                             ; a global variable
                    (let* ((out  (assoc-ref outputs "out"))
                           (data (string-append out "/share/gtags"))
                           (lisp (string-append out "/share/emacs/site-lisp")))
-                     (mkdir-p lisp)
-                     (copy-file (string-append data "/gtags.el")
-                                (string-append lisp "/gtags.el"))
+                     (install-file (string-append data "/gtags.el")
+                                   lisp)
                      (delete-file (string-append data "/gtags.el"))
                      #t))
                  %standard-phases)))
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 74c3f304af388d31861ec8cbf9f4d7c823b00308..56c4cefaf9a2d954fe257225891b6d60231e8908 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -419,18 +419,17 @@ (define bison-boot1
                                   #:guile %bootstrap-guile))))
 
 (define static-bash-for-glibc
-  ;; A statically-linked Bash to be embedded in GLIBC-FINAL, for use by
-  ;; system(3) & co.
+  ;; A statically-linked Bash to be used by GLIBC-FINAL in system(3) & co.
   (let* ((gcc  (cross-gcc-wrapper gcc-boot0 binutils-boot0
                                   glibc-final-with-bootstrap-bash
                                   (car (assoc-ref %boot1-inputs "bash"))))
-         (bash (package (inherit bash-light)
+         (bash (package (inherit static-bash)
                  (native-inputs `(("bison" ,bison-boot1)))
                  (arguments
                   `(#:guile ,%bootstrap-guile
-                    ,@(package-arguments bash-light))))))
+                    ,@(package-arguments static-bash))))))
     (package-with-bootstrap-guile
-     (package-with-explicit-inputs (static-package bash)
+     (package-with-explicit-inputs bash
                                    `(("gcc" ,gcc)
                                      ("libc" ,glibc-final-with-bootstrap-bash)
                                      ,@(fold alist-delete %boot1-inputs
@@ -490,6 +489,7 @@ (define glibc-final
     (arguments
      `(#:allowed-references
        ,(cons* `(,gcc-boot0 "lib") (linux-libre-headers-boot0)
+               static-bash-for-glibc
                (package-outputs glibc-final-with-bootstrap-bash))
 
        ,@(package-arguments glibc-final-with-bootstrap-bash)))))
@@ -562,7 +562,8 @@ (define gcc-final
      `(#:guile ,%bootstrap-guile
        #:implicit-inputs? #f
 
-       #:allowed-references ("out" "lib" ,glibc-final)
+       #:allowed-references ("out" "lib"
+                             ,glibc-final ,static-bash-for-glibc)
 
        ;; Things like libasan.so and libstdc++.so NEED ld.so for some
        ;; reason, but it is not in their RUNPATH.  This is a false
@@ -596,8 +597,12 @@ (define gcc-final
            ((#:phases phases)
             `(alist-delete 'symlink-libgcc_eh ,phases)))))
 
-    ;; This time we want Texinfo, so we get the manual.
+    ;; This time we want Texinfo, so we get the manual.  Add
+    ;; STATIC-BASH-FOR-GLIBC so that it's used in the final shebangs of
+    ;; scripts such as 'mkheaders' and 'fixinc.sh' (XXX: who cares about these
+    ;; scripts?).
     (native-inputs `(("texinfo" ,texinfo-boot0)
+                     ("static-bash" ,static-bash-for-glibc)
                      ,@(package-native-inputs gcc-boot0)))
 
     (inputs `(("gmp-source" ,(bootstrap-origin (package-source gmp)))
@@ -655,10 +660,90 @@ (define glibc-utf8-locales-final
                                               (current-source-location)
                                               #:guile %bootstrap-guile))))))
 
+(define (locale-proof-package p)
+  "Return a new package based on P that ignores 'LOCPATH'.  The result is a
+\"locale-proof\" package in the sense that it cannot end up loading locale
+data that is not in the format its libc expects.  This is useful because the
+locale binary format may change incompatibly between libc versions."
+  (package
+    (inherit p)
+    (name (string-append (package-name p) "-lp"))
+    (build-system trivial-build-system)
+    (inputs `(("original" ,p)
+              ("bash" ,bash-final)))
+    (outputs '("out"))
+    (arguments
+     '(#:modules ((guix build utils))
+       #:builder
+       (begin
+         (use-modules (guix build utils))
+
+         (let* ((out      (assoc-ref %outputs "out"))
+                (bin      (string-append out "/bin"))
+                (bash     (assoc-ref %build-inputs "bash"))
+                (binaries (assoc-ref %build-inputs "original"))
+                (programs (find-files (string-append binaries "/bin"))))
+           (define (wrap-program program)
+             (let ((base (basename program)))
+               (call-with-output-file base
+                 (lambda (port)
+                   (format port "#!~a/bin/sh
+# Unset 'LOCPATH' so that the program does not end up loading incompatible
+# locale data.
+unset LOCPATH
+exec \"~a\" \"$@\"\n"
+                           bash program)))
+               (chmod base #o755)))
+
+           (mkdir-p bin)
+           (with-directory-excursion bin
+             (for-each wrap-program programs)
+             #t)))))))
+
+(define-public ld-wrapper
+  ;; The final 'ld' wrapper, which uses the final Guile and Binutils.
+  (package (inherit ld-wrapper-boot3)
+    (name "ld-wrapper")
+    (inputs `(("guile" ,guile-final)
+              ("bash"  ,bash-final)
+              ,@(fold alist-delete (package-inputs ld-wrapper-boot3)
+                      '("guile" "bash"))))))
+
 (define %boot5-inputs
-  ;; Now with UTF-8 locale.
-  `(("locales" ,glibc-utf8-locales-final)
-    ,@%boot4-inputs))
+  ;; Now with UTF-8 locales.  Since the locale binary format differs between
+  ;; libc versions, we have to rebuild some of the packages so that they use
+  ;; the new libc, which allows them to load locale data from
+  ;; GLIBC-UTF8-LOCALES-FINAL (remember that the bootstrap binaries were built
+  ;; with an older libc, which cannot load the new locale format.)  See
+  ;; <https://lists.gnu.org/archive/html/guix-devel/2015-08/msg00737.html>.
+  (let ((new-libc-package (compose package-with-bootstrap-guile
+                                   (cut package-with-explicit-inputs <>
+                                        %boot4-inputs
+                                        (current-source-location)
+                                        #:guile %bootstrap-guile))))
+    `(("locales" ,glibc-utf8-locales-final)
+      ("ld-wrapper" ,ld-wrapper)
+      ("binutils" ,binutils-final)
+      ("bash" ,bash-final)
+      ("make" ,(new-libc-package gnu-make))
+
+      ;; Some test suites (grep, Gnulib) use 'diff' to compare files in locale
+      ;; encoding, so we need support this.
+      ("diffutils" ,(new-libc-package diffutils))
+      ("findutils" ,(new-libc-package findutils))
+
+      ;; Grep's test suite uses 'timeout' from Coreutils to execute command,
+      ;; and yet these commands need to see the valid 'LOCPATH'.
+      ("coreutils" ,(new-libc-package coreutils-minimal))
+
+      ;; We just wrap the remaining binaries (tar, gzip, xz, etc.)  so that
+      ;; they ignore 'LOCPATH' (if they did not, they would be hit by an
+      ;; assertion failure in loadlocale.c.)
+      ("coreutils&co" ,(locale-proof-package %bootstrap-coreutils&co))
+
+      ,@(fold alist-delete %boot4-inputs
+              '("coreutils&co" "findutils" "diffutils" "make"
+                "bash" "binutils-cross" "ld-wrapper")))))
 
 (define gnu-make-final
   ;; The final GNU Make, which uses the final Guile.
@@ -668,15 +753,6 @@ (define gnu-make-final
                                    ,@%boot5-inputs)
                                  (current-source-location))))
 
-(define-public ld-wrapper
-  ;; The final `ld' wrapper, which uses the final Guile.
-  (package (inherit ld-wrapper-boot3)
-    (name "ld-wrapper")
-    (inputs `(("guile" ,guile-final)
-              ("bash"  ,bash-final)
-              ,@(fold alist-delete (package-inputs ld-wrapper-boot3)
-                      '("guile" "bash"))))))
-
 (define coreutils-final
   ;; The final Coreutils.  Treat them specially because some packages, such as
   ;; Findutils, keep a reference to the Coreutils they were built with.
@@ -791,14 +867,6 @@ (define (gcc-toolchain gcc)
                        (((names . directories) ...)
                         (union-build out directories)))
 
-                     ;; Remove the 'sh' and 'bash' binaries that come with
-                     ;; libc to avoid polluting the user's profile (these are
-                     ;; statically-linked binaries with no locale support and
-                     ;; so on.)
-                     (for-each (lambda (file)
-                                 (delete-file (string-append out "/bin/" file)))
-                               '("sh" "bash"))
-
                      (union-build (assoc-ref %outputs "debug")
                                   (list (assoc-ref %build-inputs
                                                    "libc-debug")))))))
diff --git a/gnu/packages/compression.scm b/gnu/packages/compression.scm
index 9a5c4e9a8d22d5d82acf2abbdaa0ea9674e31a56..fbe5ba484ea085365bdff7eb9272d503658edb24 100644
--- a/gnu/packages/compression.scm
+++ b/gnu/packages/compression.scm
@@ -253,7 +253,7 @@ (define-public xz
 (define-public lzo
   (package
     (name "lzo")
-    (version "2.06")
+    (version "2.09")
     (source
      (origin
       (method url-fetch)
@@ -261,7 +261,7 @@ (define-public lzo
                           version ".tar.gz"))
       (sha256
        (base32
-        "0wryshs446s7cclrbjykyj766znhcpnr7s3cxy33ybfn6vwfcygz"))))
+        "0k5kpj3jnsjfxqqkblpfpx0mqcy86zs5fhjhgh2kq1hksg7ag57j"))))
     (build-system gnu-build-system)
     (arguments '(#:configure-flags '("--enable-shared")))
     (home-page "http://www.oberhumer.com/opensource/lzo")
diff --git a/gnu/packages/cups.scm b/gnu/packages/cups.scm
index da085ee89785133ffb98a1ee1b716e51806ad1f8..9dcb75ad91094eabf141b6dfad450de4e02d7177 100644
--- a/gnu/packages/cups.scm
+++ b/gnu/packages/cups.scm
@@ -37,7 +37,7 @@ (define-module (gnu packages cups)
 (define-public cups-filters
   (package
     (name "cups-filters")
-    (version "1.0.71")
+    (version "1.0.75")
     (source (origin
               (method url-fetch)
               (uri
@@ -45,7 +45,7 @@ (define-public cups-filters
                               "cups-filters-" version ".tar.xz"))
               (sha256
                (base32
-                "07wwlqcykfjfqcwj1bxk60ggahyaw7wcx32n5s104d1qkhham01i"))
+                "0wrh9jmd2rm4z8c8nb50llb10shj1hik9vwqnr0djcvf63mfqsbw"))
               (modules '((guix build utils)))
               (snippet
                ;; install backends, banners and filters to cups-filters output
@@ -71,7 +71,8 @@ (define-public cups-filters
          ,(string-append "--with-rcdir="
                          (assoc-ref %outputs "out") "/etc/rc.d"))))
     (native-inputs
-     `(("pkg-config" ,pkg-config)))
+     `(("glib" ,glib "bin") ; for gdbus-codegen
+       ("pkg-config" ,pkg-config)))
     (inputs
      `(("fontconfig"   ,fontconfig)
        ("freetype"     ,freetype)
@@ -109,14 +110,14 @@ (define-public cups-filters
 (define-public cups-minimal
   (package
     (name "cups-minimal")
-    (version "2.0.3")
+    (version "2.1.0")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://www.cups.org/software/"
-                                  version "/cups-" version "-source.tar.gz"))
+                                  version "/cups-" version "-source.tar.bz2"))
               (sha256
                (base32
-                "1kq1kpny0hghqgbjvashlv6qw1xn0c1p3d4r3cx8qxdzd2ifk4lf"))))
+                "1jfjqsw9l7jbn5kb9i96k0wj12kjdbgx0rd8157dif22hi0kh0ms"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
diff --git a/gnu/packages/curl.scm b/gnu/packages/curl.scm
index 4523d529e7bfa3e25195f2107a99b28f21df419c..f7c9f083b7d3f4fec1aaf7692d121db15c137333 100644
--- a/gnu/packages/curl.scm
+++ b/gnu/packages/curl.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2013, 2014 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Tomáš Čech <sleep_walker@suse.cz>
+;;; Copyright © 2015 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -47,6 +48,8 @@ (define-public curl
              (base32
               "0gjnaav9vmwwwza451na1643br7i0kxgd4002pwqh3xk5ywvdap7"))))
    (build-system gnu-build-system)
+   (outputs '("out"
+              "doc"))                             ;1.2 MiB of man3 pages
    (inputs `(("gnutls" ,gnutls)
              ("gss" ,gss)
              ("libidn" ,libidn)
@@ -63,40 +66,50 @@ (define-public curl
     `(#:configure-flags '("--with-gnutls" "--with-gssapi")
       ;; Add a phase to patch '/bin/sh' occurances in tests/runtests.pl
       #:phases
-      (alist-replace
-       'check
-       (lambda _
-         (substitute* "tests/runtests.pl"
-           (("/bin/sh") (which "sh")))
-         ;; Test #1135 requires extern-scan.pl, which is not part of the
-         ;; tarball due to a mistake.  It has been fixed upstream.  We can
-         ;; simply disable the test as it is specific to VMS and OS/400.
-         (delete-file "tests/data/test1135")
+      (modify-phases %standard-phases
+        (add-after
+         'install 'move-man3-pages
+         (lambda* (#:key outputs #:allow-other-keys)
+           ;; Move section 3 man pages to "doc".
+           (let ((out (assoc-ref outputs "out"))
+                 (doc (assoc-ref outputs "doc")))
+             (mkdir-p (string-append doc "/share/man"))
+             (rename-file (string-append out "/share/man/man3")
+                          (string-append doc "/share/man/man3"))
+             #t)))
+        (replace
+         'check
+         (lambda _
+           (substitute* "tests/runtests.pl"
+             (("/bin/sh") (which "sh")))
+           ;; Test #1135 requires extern-scan.pl, which is not part of the
+           ;; tarball due to a mistake.  It has been fixed upstream.  We can
+           ;; simply disable the test as it is specific to VMS and OS/400.
+           (delete-file "tests/data/test1135")
 
-         ;; XXX FIXME: Test #1510 seems to work on some machines and not
-         ;; others, possibly based on the kernel version.  It works on GuixSD
-         ;; on x86_64 with linux-libre-4.1, but fails on Hydra for both i686
-         ;; and x86_64 with the following error:
-         ;;
-         ;; test 1510...[HTTP GET connection cache limit (CURLOPT_MAXCONNECTS)]
-         ;;
-         ;;  1510: output (log/stderr1510) FAILED:
-         ;; --- log/check-expected	2015-06-27 07:45:53.166720834 +0000
-         ;; +++ log/check-generated	2015-06-27 07:45:53.166720834 +0000
-         ;; @@ -1,5 +1,5 @@
-         ;;  * Connection #0 to host server1.example.com left intact[LF]
-         ;;  * Connection #1 to host server2.example.com left intact[LF]
-         ;;  * Connection #2 to host server3.example.com left intact[LF]
-         ;; -* Closing connection 0[LF]
-         ;; +* Closing connection 1[LF]
-         ;;  * Connection #3 to host server4.example.com left intact[LF]
-         (delete-file "tests/data/test1510")
+           ;; XXX FIXME: Test #1510 seems to work on some machines and not
+           ;; others, possibly based on the kernel version.  It works on GuixSD
+           ;; on x86_64 with linux-libre-4.1, but fails on Hydra for both i686
+           ;; and x86_64 with the following error:
+           ;;
+           ;; test 1510...[HTTP GET connection cache limit (CURLOPT_MAXCONNECTS)]
+           ;;
+           ;;  1510: output (log/stderr1510) FAILED:
+           ;; --- log/check-expected	2015-06-27 07:45:53.166720834 +0000
+           ;; +++ log/check-generated	2015-06-27 07:45:53.166720834 +0000
+           ;; @@ -1,5 +1,5 @@
+           ;;  * Connection #0 to host server1.example.com left intact[LF]
+           ;;  * Connection #1 to host server2.example.com left intact[LF]
+           ;;  * Connection #2 to host server3.example.com left intact[LF]
+           ;; -* Closing connection 0[LF]
+           ;; +* Closing connection 1[LF]
+           ;;  * Connection #3 to host server4.example.com left intact[LF]
+           (delete-file "tests/data/test1510")
 
-         ;; The top-level "make check" does "make -C tests quiet-test", which
-         ;; is too quiet.  Use the "test" target instead, which is more
-         ;; verbose.
-         (zero? (system* "make" "-C" "tests" "test")))
-       %standard-phases)))
+           ;; The top-level "make check" does "make -C tests quiet-test", which
+           ;; is too quiet.  Use the "test" target instead, which is more
+           ;; verbose.
+           (zero? (system* "make" "-C" "tests" "test")))))))
    (synopsis "Command line tool for transferring data with URL syntax")
    (description
     "curl is a command line tool for transferring data with URL syntax,
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 9036d0445b60489aad199985b69f9fb593f59381..a17424196a403e9b1e61f70bf7b600c3c8a66b52 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
-;;; Copyright © 2012, 2014 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2012, 2014, 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2014 David Thompson <davet@gnu.org>
 ;;; Copyright © 2014, 2015 Mark H Weaver <mhw@netris.org>
@@ -68,26 +68,31 @@ (define-public bdb
                "doc"))                           ; 94 MiB of HTML docs
     (arguments
      '(#:tests? #f                            ; no check target available
-                #:phases
-                (alist-replace
-                 'configure
-                 (lambda* (#:key outputs #:allow-other-keys)
-                   (let ((out (assoc-ref outputs "out"))
-                         (doc (assoc-ref outputs "doc")))
-                     ;; '--docdir' is not honored, so we need to patch.
-                     (substitute* "dist/Makefile.in"
-                       (("docdir[[:blank:]]*=.*")
-                        (string-append "docdir = " doc "/share/doc/bdb")))
+       #:phases
+       (alist-replace
+        'configure
+        (lambda* (#:key outputs #:allow-other-keys)
+          (let ((out (assoc-ref outputs "out"))
+                (doc (assoc-ref outputs "doc")))
+            ;; '--docdir' is not honored, so we need to patch.
+            (substitute* "dist/Makefile.in"
+              (("docdir[[:blank:]]*=.*")
+               (string-append "docdir = " doc "/share/doc/bdb")))
+
+            (zero?
+             (system* "./dist/configure"
+                      (string-append "--prefix=" out)
+                      (string-append "CONFIG_SHELL=" (which "bash"))
+                      (string-append "SHELL=" (which "bash"))
 
-                     (zero?
-                      (system* "./dist/configure"
-                               (string-append "--prefix=" out)
-                               (string-append "CONFIG_SHELL=" (which "bash"))
-                               (string-append "SHELL=" (which "bash"))
+                      ;; The compatibility mode is needed by some packages,
+                      ;; notably iproute2.
+                      "--enable-compat185"
 
-                               ;; The compatibility mode is needed by some packages,
-                               ;; notably iproute2.
-                               "--enable-compat185"))))
+                      ;; The following flag is needed so that the inclusion
+                      ;; of db_cxx.h into C++ files works; it leads to
+                      ;; HAVE_CXX_STDHEADERS being defined in db_cxx.h.
+                      "--enable-cxx"))))
                  %standard-phases)))
     (synopsis "Berkeley database")
     (description
@@ -307,7 +312,7 @@ (define-public recutils
 (define-public sqlite
   (package
    (name "sqlite")
-   (version "3.8.10.2")
+   (version "3.8.11.1")
    (source (origin
             (method url-fetch)
             ;; TODO: Download from sqlite.org once this bug :
@@ -322,9 +327,13 @@ (define-public sqlite
                                             (map (cut string-pad <> 2 #\0)
                                                  other-digits))
                                            6 #\0))))))
-                   (string-append
-                    "https://fossies.org/linux/misc/sqlite-autoconf-"
-                    numeric-version ".tar.gz")
+                   (list
+                    (string-append
+                     "https://fossies.org/linux/misc/sqlite-autoconf-"
+                     numeric-version ".tar.gz")
+                    (string-append
+                     "http://distfiles.gentoo.org/distfiles/"
+                     "/sqlite-autoconf-" numeric-version ".tar.gz"))
 
                    ;; XXX: As of 2015-09-08, SourceForge is squatting the URL
                    ;; below, returning 200 and showing an advertising page.
@@ -334,7 +343,7 @@ (define-public sqlite
                    ))
             (sha256
              (base32
-              "09nnaqx50gl1vmfvdipirizr61q3s0ywlql50f9kr1bx9rdfb0l3"))))
+              "1dnkl4qr1dgaprbyf3jddfiynkhxnin86qabni47wjlc0fnb16gv"))))
    (build-system gnu-build-system)
    (inputs `(("readline" ,readline)))
    (arguments
diff --git a/gnu/packages/emacs.scm b/gnu/packages/emacs.scm
index a342f4861b07512a05f45a8922e44e786627d9cd..dcbe5e5bd5677dff82e3037c57dce4ea33d4bc08 100644
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@@ -406,9 +406,9 @@ (define-public magit-svn
                 (lisp-dir (string-append %output "/share/emacs/site-lisp")))
            (setenv "PATH" PATH)
            (system* tar "xvf" source)
-           (mkdir-p lisp-dir)
-           (copy-file (string-append ,name "-" ,version "/magit-svn.el")
-                      (string-append lisp-dir "/magit-svn.el"))
+
+           (install-file (string-append ,name "-" ,version "/magit-svn.el")
+                         lisp-dir)
 
            (with-directory-excursion lisp-dir
              (parameterize ((%emacs emacs))
@@ -462,18 +462,14 @@ (define-public haskell-mode
                          out "/share/doc/haskell-mode-" ,version))
                    (info (string-append out "/share/info")))
               (define (copy-to-dir dir files)
-                (mkdir-p dir)
-                (for-each
-                 (lambda (f)
-                   (copy-file f (string-append dir "/" (basename f))))
-                 files))
+                (for-each (lambda (f)
+                            (install-file f dir))
+                          files))
 
               (with-directory-excursion "doc"
                 (unless (zero? (system* "makeinfo" "haskell-mode.texi"))
                   (error "makeinfo failed"))
-                (mkdir-p info)
-                (copy-file "haskell-mode.info"
-                           (string-append info "/haskell-mode.info")))
+                (install-file "haskell-mode.info" info))
                (copy-to-dir doc '("CONTRIBUTING.md" "NEWS" "README.md"))
                (copy-to-dir el-dir (find-files "." "\\.elc?"))
                ;; these are now distributed with emacs
@@ -952,11 +948,9 @@ (define-public emacs-pdf-tools
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((target (string-append (assoc-ref outputs "out")
                                          "/share/emacs/site-lisp/")))
-              (mkdir-p target)
-              (for-each
-               (lambda (file)
-                 (copy-file file (string-append target (basename file))))
-               (find-files "../lisp" "^(pdf|tab).*\\.elc?"))
+              (for-each (lambda (file)
+                          (install-file file target))
+                        (find-files "../lisp" "^(pdf|tab).*\\.elc?"))
               (emacs-byte-compile-directory target)
               (emacs-generate-autoloads "pdf-tools" target)))))))
     (native-inputs `(("autoconf" ,autoconf)
diff --git a/gnu/packages/engineering.scm b/gnu/packages/engineering.scm
index 1e245a8b5e33a4567c46e3d3e52f6ab7331a3ba4..54e43ef0f8123ecbf574531833edc88fc8bd82e2 100644
--- a/gnu/packages/engineering.scm
+++ b/gnu/packages/engineering.scm
@@ -302,11 +302,9 @@ (define-public fastcap
                            (doc (string-append data "/doc/" ,name "-" ,version))
                            (examples (string-append doc "/examples")))
                       (with-directory-excursion "bin"
-                        (mkdir-p bin)
-                        (for-each
-                         (lambda (f)
-                           (copy-file f (string-append bin "/" (basename f))))
-                         (find-files "." ".*")))
+                        (for-each (lambda (f)
+                                    (install-file f bin))
+                                  (find-files "." ".*")))
                       (copy-recursively "doc" doc)
                       (copy-recursively "examples" examples)
                       #t))))))
@@ -352,11 +350,9 @@ (define-public fasthenry
                            (doc (string-append data "/doc/" ,name "-" ,version))
                            (examples (string-append doc "/examples")))
                       (with-directory-excursion "bin"
-                        (mkdir-p bin)
-                        (for-each
-                         (lambda (f)
-                           (copy-file f (string-append bin "/" (basename f))))
-                         (find-files "." ".*")))
+                        (for-each (lambda (f)
+                                    (install-file f bin))
+                                  (find-files "." ".*")))
                       (copy-recursively "doc" doc)
                       (copy-recursively "examples" examples)
                       #t))))))
diff --git a/gnu/packages/finance.scm b/gnu/packages/finance.scm
new file mode 100644
index 0000000000000000000000000000000000000000..264cfbf7f31c2ee3d46de1d29de676d7d5f104bf
--- /dev/null
+++ b/gnu/packages/finance.scm
@@ -0,0 +1,82 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages finance)
+ #:use-module ((guix licenses) #:prefix license:)
+ #:use-module (guix packages)
+ #:use-module (guix download)
+ #:use-module (guix build utils)
+ #:use-module (guix build-system gnu)
+ #:use-module (gnu packages boost)
+ #:use-module (gnu packages databases)
+ #:use-module (gnu packages linux)
+ #:use-module (gnu packages pkg-config)
+ #:use-module (gnu packages protobuf)
+ #:use-module (gnu packages python)
+ #:use-module (gnu packages qt)
+ #:use-module (gnu packages tls)
+ #:use-module (gnu packages upnp))
+
+(define-public bitcoin-core
+  (package
+    (name "bitcoin-core")
+    (version "0.11.0")
+    (source (origin
+             (method url-fetch)
+             (uri
+              (string-append "https://bitcoin.org/bin/bitcoin-core-"
+                             version "/bitcoin-"
+                             version ".tar.gz"))
+             (sha256
+              (base32
+               "17yh6lq13xzzi5v2i48qaxiqm40x3hrj4gwyamkib9yzmmb1gfji"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("pkg-config" ,pkg-config)
+       ("python" ,python-wrapper) ; for the tests
+       ("util-linux" ,util-linux))) ; provides the hexdump command for tests
+    (inputs
+     `(("bdb" ,bdb)
+       ("boost" ,boost)
+       ("miniupnpc" ,miniupnpc)
+       ("openssl" ,openssl)
+       ("protobuf" ,protobuf)
+       ("qt" ,qt)))
+    (arguments
+     `(#:configure-flags
+        (list
+          ;; We use a bdb version newer than 4.8.
+          "--with-incompatible-bdb"
+          ;; Boost is not found unless specified manually.
+          (string-append "--with-boost="
+                         (assoc-ref %build-inputs "boost")))
+       #:phases
+        (modify-phases %standard-phases
+          (add-before 'check 'set-home
+           (lambda _
+            (setenv "HOME" (getenv "TMPDIR"))))))) ; Tests write to $HOME.
+    (home-page "https://bitcoin.org/en/")
+    (synopsis "Bitcoin peer-to-peer client")
+    (description
+     "Bitcoin is a digital currency that enables instant payments to anyone
+anywhere in the world.  It uses peer-to-peer technology to operate without
+central authority: managing transactions and issuing money are carried out
+collectively by the network.  Bitcoin Core is the reference implementation
+of the bitcoin protocol.  This package provides the Bitcoin Core command
+line client and a client based on Qt.")
+    (license license:expat)))
diff --git a/gnu/packages/fontutils.scm b/gnu/packages/fontutils.scm
index 8b5346a17f0e33e71cfcde4619f1eb981af2b7e3..3db8f9f11d59f7a8c90a24bb644c6c6fcf0366f2 100644
--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@@ -71,14 +71,14 @@ (define-public freetype
 (define-public fontconfig
   (package
    (name "fontconfig")
-   (version "2.11.92")
+   (version "2.11.94")
    (source (origin
             (method url-fetch)
             (uri (string-append
                    "http://www.freedesktop.org/software/fontconfig/release/fontconfig-"
                    version ".tar.bz2"))
             (sha256 (base32
-                     "18r45dcnaj93izwfr082qiwg8ka7ll6j0c9yf1slblm542d5pmd9"))))
+                     "1psrl4b4gi4wmbvwwh43lk491wsl8lgvqj146prlcha3vwjc0qyp"))))
    (build-system gnu-build-system)
    (propagated-inputs `(("expat" ,expat)
                         ("freetype" ,freetype)))
@@ -86,13 +86,24 @@ (define-public fontconfig
    (native-inputs
       `(("pkg-config" ,pkg-config)))
    (arguments
-     `(#:configure-flags
-               ;; point to user profile instead of /usr/share/fonts in /etc/fonts.conf
-        (list "--with-default-fonts=~/.guix-profile/share/fonts"
-              ;; register gs-fonts
-              (string-append "--with-add-fonts="
-                             (assoc-ref %build-inputs "gs-fonts")
-                             "/share/fonts"))))
+    `(#:configure-flags
+      (list "--with-cache-dir=/var/cache/fontconfig"
+            ;; register gs-fonts as default fonts
+            (string-append "--with-default-fonts="
+                           (assoc-ref %build-inputs "gs-fonts")
+                           "/share/fonts")
+            ;; register fonts from user profile
+            "--with-add-fonts=~/.guix-profile/share/fonts"
+            ;; python is not actually needed
+            "PYTHON=false")
+      #:phases
+      (modify-phases %standard-phases
+        (replace 'install
+                 (lambda _
+                   ;; Don't try to create /var/cache/fontconfig.
+                   (zero? (system* "make" "install"
+                                   "fc_cachedir=$(TMPDIR)"
+                                   "RUN_FC_CACHE_TEST=false")))))))
    (synopsis "Library for configuring and customizing font access")
    (description
     "Fontconfig can discover new fonts when installed automatically;
@@ -192,7 +203,7 @@ (define-public teckit
 (define-public graphite2
   (package
    (name "graphite2")
-   (version "1.2.4")
+   (version "1.3.1")
    (source
      (origin
        (method url-fetch)
@@ -201,12 +212,13 @@ (define-public graphite2
               version ".tgz"))
        (sha256
          (base32
-           "00xhv1mp640fr3wmdzwn4yz0g56jd4r9fb7b02mc1g19h0bdbhsb"))))
+           "0xvhmlyyxg2qmbwyl8k2f9w7mrbjyl59823pnjd8xmxpyl6976d5"))))
    (build-system cmake-build-system)
+   (native-inputs
+    `(("python" ,python-2) ; because of "import imap" in tests
+      ("python-fonttools" ,python2-fonttools)))
    (inputs
-    `(("freetype" ,freetype)
-      ("perl" ,perl)
-      ("python" ,python-2))) ; because of "import imap" in tests
+    `(("freetype" ,freetype)))
    (synopsis "Reimplementation of the SIL Graphite text processing engine")
    (description
     "Graphite2 is a reimplementation of the SIL Graphite text processing
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index 761d3a6998f954b92c6c9661a4b7f9a4ca03b287..d2652aef3f3056d75e9e4683c4091472f0671ac8 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -206,7 +206,7 @@ (define-public gcc-4.7
 
                 ;; Fix the dynamic linker's file name.
                 (substitute* (find-files "gcc/config"
-                                         "^linux(64|-elf|-eabi)?\\.h$")
+                                         "^(linux|gnu)(64|-elf|-eabi)?\\.h$")
                   (("#define GLIBC_DYNAMIC_LINKER([^ ]*).*$" _ suffix)
                    (format #f "#define GLIBC_DYNAMIC_LINKER~a \"~a\"~%"
                            suffix
@@ -578,11 +578,7 @@ (define (make-libstdc++-doc gcc)
                                     (("@XSL_STYLE_DIR@")
                                      (string-append
                                       docbook "/xml/xsl/"
-                                      (string-drop
-                                       docbook
-                                       (+ 34
-                                          (string-length
-                                           (%store-directory))))))))))
+                                      (strip-store-file-name docbook)))))))
                   (replace 'build
                            (lambda _
                              ;; XXX: There's also a 'doc-info' target, but it
diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index cdec3706ddbbef9be31155ebf03028259ae6195c..2e8797560bb208295c7856a33007c6777977261d 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -119,7 +119,7 @@ (define dbus
 (define glib
   (package
    (name "glib")
-   (version "2.44.0")
+   (version "2.44.1")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/"
@@ -127,7 +127,7 @@ (define glib
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "1fgmjv3yzxgbks31h42201x2izpw0sd84h8dfw0si3x00sqn5lzj"))
+              "01yabrfp64i11mrks3p1gcks99lw0zm7f5vhkc53sl4amyndw4c8"))
             (patches (list (search-patch "glib-tests-homedir.patch")
                            (search-patch "glib-tests-desktop.patch")
                            (search-patch "glib-tests-prlimit.patch")
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index f9cb579e85da57ab3ab656a4c8e59fd0866403ce..b4b5c237c915e2b088983616360a6c11f1777509 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -787,7 +787,7 @@ (define-public libcroco
 (define-public libgsf
   (package
     (name "libgsf")
-    (version "1.14.30")
+    (version "1.14.34")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -795,7 +795,7 @@ (define-public libgsf
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0w2v1a9sxsymd1mcy4mwsz4r6za9iwq69rj86nb939p41d4c6j6b"))))
+                "0a5m1i5gp4m2z0cn2x1rrdm8wgrr04bzv65l8pgp6jipw13s9zph"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("intltool" ,intltool)
@@ -820,7 +820,7 @@ (define-public libgsf
 (define-public librsvg
   (package
     (name "librsvg")
-    (version "2.40.9")
+    (version "2.40.10")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnome/sources/" name "/"
@@ -828,7 +828,7 @@ (define-public librsvg
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "0fplymmqqr28y24vcnb01szn62pfbqhk8p1ngns54x9m6mflr5hk"))))
+                "0y9lvnb9ij9mjg8cyp7xysi0c5ms5v4q1zrhx42b546f71s80p4n"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
diff --git a/gnu/packages/gnuzilla.scm b/gnu/packages/gnuzilla.scm
index bfd1f5dc7b417a93ba82c7db73cb8c0e8a87594e..53e6ea7787b3efbf6449583fc7e2feda033d6c2f 100644
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@@ -190,14 +190,12 @@ (define-public nss
                    (obj (match (scandir "dist" (cut string-suffix? "OBJ" <>))
                           ((obj) (string-append "dist/" obj)))))
               ;; Install nss-config to $out/bin.
-              (mkdir-p (string-append out "/bin"))
-              (copy-file (string-append obj "/bin/nss-config")
-                         (string-append out "/bin/nss-config"))
+              (install-file (string-append obj "/bin/nss-config")
+                            (string-append out "/bin"))
               (delete-file (string-append obj "/bin/nss-config"))
               ;; Install nss.pc to $out/lib/pkgconfig.
-              (mkdir-p (string-append out "/lib/pkgconfig"))
-              (copy-file (string-append obj "/lib/pkgconfig/nss.pc")
-                         (string-append out "/lib/pkgconfig/nss.pc"))
+              (install-file (string-append obj "/lib/pkgconfig/nss.pc")
+                            (string-append out "/lib/pkgconfig"))
               (delete-file (string-append obj "/lib/pkgconfig/nss.pc"))
               (rmdir (string-append obj "/lib/pkgconfig"))
               ;; Install other files.
diff --git a/gnu/packages/graphics.scm b/gnu/packages/graphics.scm
index b2f921e9dd42987e7cd8d1ffdafe367da5efc36f..02e65d32765fe2abc488af3b4912ef1af72e4497 100644
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@@ -43,15 +43,15 @@ (define-module (gnu packages graphics)
 (define-public cgal
   (package
     (name "cgal")
-    (version "4.5.1")
+    (version "4.6.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
-                    "http://gforge.inria.fr/frs/download.php/file/34402/CGAL-"
-                    version ".tar.xz"))
+                    "http://gforge.inria.fr/frs/download.php/file/"
+                    "35139/CGAL-4.6.3.tar.xz"))
               (sha256
                (base32
-                "1565ycbds92bxmhi09avc1jl6ks141ig00j110l49gqxp9swy6zv"))))
+                "08gwjjh0qz3fakj1y2nsl2qvb0qv5lc7k1pxwjkagh37hxxh4f73"))))
     (build-system cmake-build-system)
     (arguments
      '(;; "RelWithDebInfo" is not supported.
diff --git a/gnu/packages/gtk.scm b/gnu/packages/gtk.scm
index 45cd1e30f6acc39de8f15c99f127e9d66d0437ec..a44c2dd3feb2e0075ee08aa91bb737cf9ae350c4 100644
--- a/gnu/packages/gtk.scm
+++ b/gnu/packages/gtk.scm
@@ -144,28 +144,34 @@ (define-public cairo
 (define-public harfbuzz
   (package
    (name "harfbuzz")
-   (version "0.9.40")
+   (version "1.0.3")
    (source (origin
-            (method url-fetch)
-            (uri (string-append "http://www.freedesktop.org/software/harfbuzz/release/harfbuzz-"
-                                version ".tar.bz2"))
-            (sha256
-             (base32
-              "07rjp05axas96fp23lpf8l2yyfdj9yib4m0qjv592vdyhcsxaw8p"))))
+             (method url-fetch)
+             (uri (string-append "http://www.freedesktop.org/software/"
+                                 "harfbuzz/release/harfbuzz-"
+                                 version ".tar.bz2"))
+             (sha256
+              (base32
+               "1xrxlrvgyr6mm9qjxmkif2kvcah082y94gf1vqi0f0bdl1g8gp7b"))))
    (build-system gnu-build-system)
+   (outputs '("out"
+              "bin")) ; 160K, only hb-view depend on cairo
    (inputs
-    `(("cairo" ,cairo)
+    `(("cairo" ,cairo)))
+   (propagated-inputs
+    ;; There are all in the Requires or Requires.private field of '.pc'.
+    `(("glib" ,glib)
       ("graphite2" ,graphite2)
       ("icu4c" ,icu4c)))
-   (propagated-inputs
-    `(("glib" ,glib))) ; required by harfbuzz-gobject.pc
    (native-inputs
     `(("gobject-introspection" ,gobject-introspection)
       ("pkg-config" ,pkg-config)
       ("python" ,python-2))) ; incompatible with Python 3 (print syntax)
    (arguments
     `(#:configure-flags `("--with-graphite2"
-                          "--with-gobject")))
+                          "--with-gobject"
+                          ,(string-append
+                            "--bindir=" (assoc-ref %outputs "bin") "/bin"))))
    (synopsis "OpenType text shaping engine")
    (description
     "HarfBuzz is an OpenType text shaping engine.")
@@ -508,7 +514,7 @@ (define-public gtk+-2
 (define-public gtk+
   (package (inherit gtk+-2)
    (name "gtk+")
-   (version "3.16.3")
+   (version "3.16.6")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnome/sources/" name "/"
@@ -516,7 +522,7 @@ (define-public gtk+
                                 name "-" version ".tar.xz"))
             (sha256
              (base32
-              "195ykv53sl2gsc847wcnd79zilm1yzcc2cfjxnrakhh2dd5gshr9"))))
+              "1gpzlnfrifc17yfk0zki6b2vmsfpf5cmrbh232s6iaan11np44jd"))))
    (propagated-inputs
     `(("at-spi2-atk" ,at-spi2-atk)
       ("atk" ,atk)
@@ -556,9 +562,6 @@ (define-public gtk+
          (substitute* "testsuite/Makefile.in"
            (("SUBDIRS = gdk gtk a11y css reftests")
             "SUBDIRS = gdk"))
-         (substitute* '("demos/widget-factory/Makefile.in"
-                        "demos/gtk-demo/Makefile.in")
-           (("gtk-update-icon-cache") "$(bindir)/gtk-update-icon-cache"))
          #t)
        (alist-cons-after
         'install 'wrap-gtk-encode-symbolic-svg
diff --git a/gnu/packages/guile.scm b/gnu/packages/guile.scm
index 60af92dcebf4a82bf7a13da9bb8fecfe85f551cf..d5a95a0444314b83868c8574d5e3e6b3604bc9ed 100644
--- a/gnu/packages/guile.scm
+++ b/gnu/packages/guile.scm
@@ -467,7 +467,7 @@ (define-public guile-minikanren
                      scm-files)
 
            ;; Also copy over the README.
-           (copy-file "README.org" (string-append doc "/README.org"))
+           (install-file "README.org" doc)
            #t))))
     (inputs
      `(("guile" ,guile-2.0)))
diff --git a/gnu/packages/hurd.scm b/gnu/packages/hurd.scm
index 62dc04385f32932317a8fc88f7bc914f9e051e37..3867b4d7ec142de36466219a1fe62b832e9f6b3e 100644
--- a/gnu/packages/hurd.scm
+++ b/gnu/packages/hurd.scm
@@ -20,11 +20,14 @@ (define-module (gnu packages hurd)
   #:use-module (guix licenses)
   #:use-module (guix download)
   #:use-module (guix packages)
+  #:use-module (gnu packages)
   #:use-module (guix build-system gnu)
   #:use-module (gnu packages flex)
   #:use-module (gnu packages bison)
   #:use-module (gnu packages perl)
-  #:use-module (gnu packages autotools))
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
+  #:use-module (guix git-download))
 
 (define-public gnumach-headers
   (package
@@ -73,7 +76,9 @@ (define-public mig
        (base32
         "13r1pg8icyc0pl082z7k36i440pr1f3nr7ahig3rrc0r7qndqmk9"))))
     (build-system gnu-build-system)
-    (inputs `(("gnumach-headers" ,gnumach-headers)))
+    ;; Flex is needed both at build and run time.
+    (inputs `(("gnumach-headers" ,gnumach-headers)
+              ("flex" ,flex)))
     (native-inputs
      `(("flex" ,flex)
        ("bison" ,bison)))
@@ -128,3 +133,55 @@ (define-public hurd-headers
      "This package provides C headers of the GNU Hurd, used to build the GNU C
 Library and other user programs.")
     (license gpl2+)))
+
+(define-public hurd-minimal
+  (package (inherit hurd-headers)
+    (name "hurd-minimal")
+    (inputs `(("glibc-hurd-headers" ,glibc/hurd-headers)))
+    (native-inputs
+     `(("autoconf" ,(autoconf-wrapper))
+       ("mig" ,mig)))
+
+    (arguments
+     `(#:phases (alist-replace
+                 'install
+                 (lambda* (#:key outputs #:allow-other-keys)
+                   (let ((out (assoc-ref outputs "out")))
+                     ;; We need to copy libihash.a to the output directory manually,
+                     ;; since there is no target for that in the makefile.
+                     (mkdir-p (string-append out "/include"))
+                     (copy-file "libihash/ihash.h"
+                                (string-append out "/include/ihash.h"))
+                     (mkdir-p (string-append out "/lib"))
+                     (copy-file "libihash/libihash.a"
+                                (string-append out "/lib/libihash.a"))
+                     #t))
+                 (alist-replace
+                  'build
+                  (lambda _
+                    (zero? (system* "make" "-Clibihash" "libihash.a")))
+                  (alist-cons-before
+                   'configure 'bootstrap
+                   (lambda _
+                     (zero? (system* "autoreconf" "-vfi")))
+                   %standard-phases)))
+       #:configure-flags '(;; Pretend we're on GNU/Hurd; 'configure' wants
+                           ;; that.
+                           "--host=i686-pc-gnu"
+
+                           ;; Reduce set of dependencies.
+                           "--disable-ncursesw"
+                           "--disable-test"
+                           "--without-libbz2"
+                           "--without-libz"
+                           "--without-parted"
+                           ;; Skip the clnt_create check because it expects
+                           ;; a working glibc causing a circular dependency.
+                           "ac_cv_search_clnt_create=no")
+       #:tests? #f))
+    (home-page "http://www.gnu.org/software/hurd/hurd.html")
+    (synopsis "GNU Hurd libraries")
+    (description
+     "This package provides libihash, needed to build the GNU C 
+Library for GNU/Hurd.")
+    (license gpl2+)))
diff --git a/gnu/packages/ibus.scm b/gnu/packages/ibus.scm
index 38db959d9482c4f2207dc78382d7246d502dff6a..97b65698bb4307779c20316dcad418a3747be461 100644
--- a/gnu/packages/ibus.scm
+++ b/gnu/packages/ibus.scm
@@ -82,6 +82,7 @@ (define-public ibus
       ("dconf" ,dconf)
       ("gconf" ,gconf)
       ("gtk2" ,gtk+-2)
+      ("gtk+" ,gtk+)
       ("intltool" ,intltool)
       ("libnotify" ,libnotify)
       ("iso-codes" ,iso-codes)
diff --git a/gnu/packages/icu4c.scm b/gnu/packages/icu4c.scm
index 46e5d1204927f80f5c881fec99d46bfc905c669e..d442b5e69a381cd3bab9adebd7644e58489495e7 100644
--- a/gnu/packages/icu4c.scm
+++ b/gnu/packages/icu4c.scm
@@ -38,7 +38,9 @@ (define-public icu4c
                    "-src.tgz"))
             (sha256
              (base32 "0ys5f5spizg45qlaa31j2lhgry0jka2gfha527n4ndfxxz5j4sz1"))
-            (patches (list (search-patch "icu4c-CVE-2015-4760.patch")))))
+            (patches (map search-patch '("icu4c-CVE-2014-6585.patch"
+                                         "icu4c-CVE-2015-1270.patch"
+                                         "icu4c-CVE-2015-4760.patch")))))
    (build-system gnu-build-system)
    (inputs
     `(("perl" ,perl)))
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 1ba281205cacb70f532f5b32802a277979bc1582..cee7f146facac360137d6b272dd8f890e6237691 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -107,41 +107,24 @@ (define-public libjpeg-8
 (define-public libtiff
   (package
    (name "libtiff")
-   (version "4.0.3")
+   (version "4.0.5")
    (source (origin
             (method url-fetch)
             (uri (string-append "ftp://ftp.remotesensing.org/pub/libtiff/tiff-"
                    version ".tar.gz"))
             (sha256 (base32
-                     "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa"))
-            (patches (map search-patch '("libtiff-CVE-2012-4564.patch"
-                                         "libtiff-CVE-2013-1960.patch"
-                                         "libtiff-CVE-2013-1961.patch"
-                                         "libtiff-CVE-2013-4231.patch"
-                                         "libtiff-CVE-2013-4232.patch"
-                                         "libtiff-CVE-2013-4244.patch"
-                                         "libtiff-CVE-2013-4243.patch"
-                                         "libtiff-CVE-2014-9330.patch"
-                                         "libtiff-CVE-2014-8127-pt1.patch"
-                                         "libtiff-CVE-2014-8127-pt2.patch"
-                                         "libtiff-CVE-2014-8127-pt3.patch"
-                                         "libtiff-CVE-2014-8127-pt4.patch"
-                                         "libtiff-CVE-2014-8128-pt1.patch"
-                                         "libtiff-CVE-2014-8128-pt2.patch"
-                                         "libtiff-CVE-2014-8128-pt3.patch"
-                                         "libtiff-CVE-2014-8129.patch"
-                                         "libtiff-CVE-2014-9655.patch"
-                                         "libtiff-CVE-2014-8128-pt4.patch"
-                                         "libtiff-CVE-2014-8128-pt5.patch")))))
+                     "171hgy4mylwmvdm7gp6ffjva81m4j56v3fbqsbfl7avzxn1slpp2"))))
    (build-system gnu-build-system)
-   (inputs `(("zlib" ,zlib)
-             ("libjpeg-8" ,libjpeg-8)))
-             ;; currently does not compile with libjpeg version 9
+   (outputs '("out"
+              "doc"))                           ;1.3 MiB of HTML documentation
    (arguments
-    `(#:configure-flags
-      (list (string-append "--with-jpeg-include-dir="
-                           (assoc-ref %build-inputs "libjpeg-8")
-                           "/include"))))
+    ;; Instead of using --docdir, this package has its own --with-docdir.
+    `(#:configure-flags (list (string-append "--with-docdir="
+                                             (assoc-ref %outputs "doc")
+                                             "/share/doc/"
+                                             ,name "-" ,version))))
+   (inputs `(("zlib" ,zlib)
+             ("libjpeg" ,libjpeg)))
    (synopsis "Library for handling TIFF files")
    (description
     "Libtiff provides support for the Tag Image File Format (TIFF), a format
diff --git a/gnu/packages/imagemagick.scm b/gnu/packages/imagemagick.scm
index 4e49c60993cb9d04493abbecae64eb3149e37586..8e176845e166b06c2dd7b4453b1f81a1da9eb58f 100644
--- a/gnu/packages/imagemagick.scm
+++ b/gnu/packages/imagemagick.scm
@@ -23,6 +23,7 @@ (define-module (gnu packages imagemagick)
   #:use-module (guix build-system perl)
   #:use-module (guix download)
   #:use-module ((guix licenses) #:select (fsf-free))
+  #:use-module (gnu packages)
   #:use-module (gnu packages algebra)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages fontutils)
@@ -37,14 +38,15 @@ (define-module (gnu packages imagemagick)
 (define-public imagemagick
   (package
     (name "imagemagick")
-    (version "6.9.1-3")
+    (version "6.9.2-1")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://imagemagick/ImageMagick-"
                                  version ".tar.xz"))
              (sha256
               (base32
-               "18wbsjfccxlgsdsd6h9wvhcjrsglyi086jk4bk029ik07rh81laz"))))
+               "159afhqrj22jlz745ccbgnkdiwvn8pjcc96jic0iv9ms7gqxwln5"))
+             (patches (list (search-patch "imagemagick-test-segv.patch")))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
@@ -84,7 +86,7 @@ (define-public imagemagick
               ("libxml2" ,libxml2)
               ("libtiff" ,libtiff)
               ("libpng" ,libpng)
-              ("libjpeg" ,libjpeg-8)
+              ("libjpeg" ,libjpeg)
               ("pango" ,pango)
               ("freetype" ,freetype)
               ("bzip2" ,bzip2)
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index 0ff70c82b2c6ca43ed94b4080dbc7b5a8cda3b29..9304a92eb9177883531a08dfe4339313509d368e 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -102,8 +102,8 @@ (define-public swt
           (lambda* (#:key outputs #:allow-other-keys)
             (let ((java (string-append (assoc-ref outputs "out")
                                        "/share/java")))
-              (mkdir-p java)
-              (copy-file "swt.jar" (string-append java "/swt.jar"))) #t)
+              (install-file "swt.jar" java)
+              #t))
           (alist-delete 'configure %standard-phases))))))
     (inputs
      `(("xulrunner" ,icecat)
diff --git a/gnu/packages/libidn.scm b/gnu/packages/libidn.scm
index 4a7840c78c0ac7a911c33afa83843910299964dc..382e14f0cc3c91bcd359f5f936fb2327fba59541 100644
--- a/gnu/packages/libidn.scm
+++ b/gnu/packages/libidn.scm
@@ -26,13 +26,13 @@ (define-module (gnu packages libidn)
 (define-public libidn
   (package
    (name "libidn")
-   (version "1.31")
+   (version "1.32")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/libidn/libidn-" version
                                 ".tar.gz"))
             (sha256 (base32
-                     "026z12mczlag443ms9n954h36pi3m7iva9jfw8y4ispsj772zpxg"))))
+                     "1xf4hphhahcjm2xwx147lfpsavjwv9l4c2gf6hx71zxywbz5lpds"))))
    (build-system gnu-build-system)
 ;; FIXME: No Java and C# libraries are currently built.
    (synopsis "Internationalized string processing library")
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index 97e8bdcaec0be380fe57b5648e62114c3d6b6c11..d2619335a308bfff46324e9146b430bf05993f61 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -321,7 +321,7 @@ (define-public linux-libre
 (define-public linux-pam
   (package
     (name "linux-pam")
-    (version "1.1.6")
+    (version "1.2.1")
     (source
      (origin
       (method url-fetch)
@@ -331,7 +331,7 @@ (define-public linux-pam
                                 version ".tar.bz2")))
       (sha256
        (base32
-        "1hlz2kqvbjisvwyicdincq7nz897b9rrafyzccwzqiqg53b8gf5s"))))
+        "1n9lnf9gjs72kbj1g354v1xhi2j27aqaah15vykh7cnkq08i4arl"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("flex" ,flex)
@@ -390,7 +390,7 @@ (define-public psmisc
 (define-public util-linux
   (package
     (name "util-linux")
-    (version "2.25.2")
+    (version "2.27")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://kernel.org/linux/utils/"
@@ -398,19 +398,20 @@ (define-public util-linux
                                   name "-" version ".tar.xz"))
               (sha256
                (base32
-                "1miwwdq1zwvhf0smrxx3fjddq3mz22s8rc5cw54s7x3kbdqpyig0"))
+                "1ivdx1bhjbakf77agm9dn3wyxia1wgz9lzxgd61zqxw3xzih9gzw"))
               (patches (list (search-patch "util-linux-tests.patch")))
               (modules '((guix build utils)))
               (snippet
                ;; We take the 'logger' program from GNU Inetutils and 'kill'
                ;; from GNU Coreutils.
-               '(substitute* "configure"
-                  (("build_logger=yes") "build_logger=no")
-                  (("build_kill=yes") "build_kill=no")))))
+               '(begin
+                  (substitute* "configure"
+                    (("build_logger=yes") "build_logger=no")
+                    (("build_kill=yes") "build_kill=no"))
+                  #t))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags (list "--disable-use-tty-group"
-                               "--enable-ddate"
 
                                ;; Install completions where our
                                ;; bash-completion package expects them.
@@ -1021,19 +1022,15 @@ (define (apply-patch file)
 (define-public libcap
   (package
     (name "libcap")
-    (version "2.22")
+    (version "2.24")
     (source (origin
              (method url-fetch)
-
-             ;; Tarballs used to be available from
-             ;; <https://www.kernel.org/pub/linux/libs/security/linux-privs/>
-             ;; but they never came back after kernel.org was compromised.
              (uri (string-append
-                   "mirror://debian/pool/main/libc/libcap2/libcap2_"
-                   version ".orig.tar.gz"))
+                   "mirror://kernel.org/linux/libs/security/linux-privs/"
+                   "libcap2/libcap-" version ".tar.xz"))
              (sha256
               (base32
-               "07vjhkznm82p8dm4w6j8mmg7h5c70lp5s9bwwfdmgwpbixfydjp1"))))
+               "0rbc9qbqs5bp9am9s9g83wxj5k4ixps2agy9dxr1v1fwg27mdr6f"))))
     (build-system gnu-build-system)
     (arguments '(#:phases
                  (modify-phases %standard-phases
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index 1b70d54c483a4f6180da28b52991a69b12415e00..b3c86dbebf1db8d5faa84f93fbe4e674fb64f57c 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -115,7 +115,7 @@ (define (native-inputs)
                                 #:native-inputs native-inputs))
 
 (define %bash-static
-  (static-package bash-light))
+  (static-package bash-minimal))
 
 (define %static-inputs
   ;; Packages that are to be used as %BOOTSTRAP-INPUTS.
@@ -253,10 +253,8 @@ (define (copy-directory source destination)
 
             ;; But of course, there are exceptions to this rule.
             (let ((grep (assoc-ref %build-inputs "grep")))
-              (copy-file (string-append grep "/bin/fgrep")
-                         (string-append bin "/fgrep"))
-              (copy-file (string-append grep "/bin/egrep")
-                         (string-append bin "/egrep")))
+              (install-file (string-append grep "/bin/fgrep") bin)
+              (install-file (string-append grep "/bin/egrep") bin))
 
             ;; Clear references to the store path.
             (for-each remove-store-references
@@ -425,8 +423,7 @@ (define %gcc-static
                        "--disable-libcilkrts"
                        "--disable-libvtv"
                        "--disable-libssp"
-                       "--disable-libquadmath"
-                       "--disable-decimal-float")
+                       "--disable-libquadmath")
                       (remove (cut string-match "--(.*plugin|enable-languages)" <>)
                               ,flags)))
             ((#:phases phases)
@@ -631,7 +628,8 @@ (define (tarball-package pkg)
                                               ".tar.xz")
                                "."
                                ;; avoid non-determinism in the archive
-                               "--mtime=@0" "--owner=root:0" "--group=root:0"))))))))))
+                               "--sort=name" "--mtime=@0"
+                               "--owner=root:0" "--group=root:0"))))))))))
 
 (define %bootstrap-binaries-tarball
   ;; A tarball with the statically-linked bootstrap binaries.
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index b56ca4057d38afc6e3460d6b3e739a0b3f95e3f1..45fda144be74e625f74984df4e48ff2145cda4fe 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -1828,21 +1828,17 @@ (define-public lpsolve
                           (string-append lib "/liblpsolve55.a"))
                (copy-file "lpsolve55/bin/ux64/liblpsolve55.so"
                           (string-append lib "/liblpsolve55.so"))
-               (mkdir-p bin)
-               (copy-file "lp_solve/bin/ux64/lp_solve"
-                          (string-append bin "/lp_solve"))
-               (mkdir-p include)
+               (install-file "lp_solve/bin/ux64/lp_solve" bin)
+
                ;; Install a subset of the header files as on Debian
                ;; (plus lp_bit.h, which matches the regular expression).
-               (for-each
-                 (lambda (name)
-                   (copy-file name (string-append include "/" name)))
-                 (find-files "." "lp_[HMSa-z].*\\.h$"))
+               (for-each (lambda (name)
+                           (install-file name include))
+                         (find-files "." "lp_[HMSa-z].*\\.h$"))
                (with-directory-excursion "shared"
-                 (for-each
-                   (lambda (name)
-                     (copy-file name (string-append include "/" name)))
-                   (find-files "." "\\.h$")))
+                 (for-each (lambda (name)
+                             (install-file name include))
+                           (find-files "." "\\.h$")))
                #t))))))
     (home-page "http://lpsolve.sourceforge.net/")
     (synopsis "Mixed integer linear programming (MILP) solver")
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index ddd90fb72aff727bf3d6d1166200cf8e872ab67a..d5ca1555dbe07eb832516921b6d219ee79feb11f 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -435,7 +435,7 @@ (define-public mpc123
                     (let* ((out (assoc-ref outputs "out"))
                            (bin (string-append out "/bin")))
                       (mkdir-p bin)
-                      (copy-file "mpc123" (string-append bin "/mpc123"))))
+                      (install-file "mpc123" bin)))
                   %standard-phases))
        #:tests? #f))
 
diff --git a/gnu/packages/ncurses.scm b/gnu/packages/ncurses.scm
index 180cdde19f5def1854f9dcc6f5865b11c53dbf97..2b0d4426642d32f46874429f9d446b32afbc14e7 100644
--- a/gnu/packages/ncurses.scm
+++ b/gnu/packages/ncurses.scm
@@ -28,21 +28,17 @@ (define-public ncurses
          '(lambda _
             (for-each patch-makefile-SHELL
                       (find-files "." "Makefile.in"))))
-        (configure-phase
-         '(lambda* (#:key inputs outputs configure-flags
-                    #:allow-other-keys)
-            ;; The `ncursesw5-config' has a #!/bin/sh.  We want to patch
-            ;; it to point to libc's embedded Bash, to avoid retaining a
-            ;; reference to the bootstrap Bash.
-            (let* ((libc (assoc-ref inputs "libc"))
-                   (bash (string-append libc "/bin/bash"))
-                   (out  (assoc-ref outputs "out")))
-              (format #t "configure flags: ~s~%" configure-flags)
-              (zero? (apply system* bash "./configure"
-                            (string-append "SHELL=" bash)
-                            (string-append "CONFIG_SHELL=" bash)
-                            (string-append "--prefix=" out)
-                            configure-flags)))))
+        (remove-shebang-phase
+         '(lambda _
+            ;; To avoid retaining a reference to the bootstrap Bash via the
+            ;; shebang of the 'ncursesw5-config' script, simply remove that
+            ;; shebang: it'll work just as well without it.
+            (substitute* "misc/ncurses-config.in"
+              (("#!@SHELL@")
+               "# No shebang here, use /bin/sh!\n")
+              (("@SHELL@ \\$0")
+               "$0"))
+            #t))
         (post-install-phase
          '(lambda* (#:key outputs #:allow-other-keys)
             (let ((out (assoc-ref outputs "out")))
@@ -56,9 +52,9 @@ (define libw.a
                             (define lib.a
                               (string-append "lib" lib ".a"))
                             (define libw.so.x
-                              (string-append "lib" lib "w.so.5"))
+                              (string-append "lib" lib "w.so.6"))
                             (define lib.so.x
-                              (string-append "lib" lib ".so.5"))
+                              (string-append "lib" lib ".so.6"))
                             (define lib.so
                               (string-append "lib" lib ".so"))
 
@@ -73,14 +69,14 @@ (define lib.so
                           '("curses" "ncurses" "form" "panel" "menu")))))))
     (package
      (name "ncurses")
-     (version "5.9")
+     (version "6.0")
      (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/ncurses/ncurses-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0fsn7xis81za62afan0vvm38bvgzg5wfmv1m86flqcj0nj7jjilh"))))
+                "0q3jck7lna77z5r42f13c4xglc7azd19pxfrjrpgp2yf615w4lgm"))))
      (build-system gnu-build-system)
      (arguments
       `(#:configure-flags
@@ -90,37 +86,20 @@ (define lib.so
           ;; what users expect.
           ,(string-append "--includedir=" (assoc-ref %outputs "out")
                           "/include")
+          "--enable-overwrite"                    ;really honor --includedir
 
           ;; Make sure programs like 'tic', 'reset', and 'clear' have a
           ;; correct RUNPATH.
           ,(string-append "LDFLAGS=-Wl,-rpath=" (assoc-ref %outputs "out")
-                          "/lib")
-
-          ;; C++ bindings fail to build on
-          ;; `i386-pc-solaris2.11' with GCC 3.4.3:
-          ;; <http://bugs.opensolaris.org/bugdatabase/view_bug.do?bug_id=6395191>.
-          ,,@(if (string=? (%current-system) "i686-solaris")
-                 '("--without-cxx-binding")
-                 '()))
+                          "/lib"))
         #:tests? #f                               ; no "check" target
-        #:phases ,(if (%current-target-system)
-
-                      `(alist-cons-before         ; cross build
-                        'configure 'patch-makefile-SHELL
-                        ,patch-makefile-phase
-                        (alist-cons-after
-                         'install 'post-install ,post-install-phase
-                         %standard-phases))
-
-                      `(alist-cons-after          ; native build
-                        'install 'post-install ,post-install-phase
-                        (alist-cons-before
-                         'configure 'patch-makefile-SHELL
-                         ,patch-makefile-phase
-                         (alist-replace
-                          'configure
-                          ,configure-phase
-                          %standard-phases))))))
+        #:phases (modify-phases %standard-phases
+                   (add-after 'install 'post-install
+                              ,post-install-phase)
+                   (add-before 'configure 'patch-makefile-SHELL
+                               ,patch-makefile-phase)
+                   (add-after 'unpack 'remove-unneeded-shebang
+                              ,remove-shebang-phase))))
      (self-native-input? #t)                      ; for `tic'
      (synopsis "Terminal emulation (termcap, terminfo) library")
      (description
diff --git a/gnu/packages/ninja.scm b/gnu/packages/ninja.scm
index a0eb109bbb9971ebfce68e865acaacfb1e083140..ea5488afc9d44f1762a84138878196429dfcdfa4 100644
--- a/gnu/packages/ninja.scm
+++ b/gnu/packages/ninja.scm
@@ -66,11 +66,8 @@ (define-public ninja
             (let* ((out (assoc-ref outputs "out"))
                    (bin (string-append out "/bin"))
                    (doc (string-append out "/share/doc/ninja")))
-              (mkdir-p bin)
-              (copy-file "ninja" (string-append bin "/ninja"))
-              (mkdir-p doc)
-              (copy-file "doc/manual.asciidoc"
-                         (string-append doc "/manual.asciidoc"))
+              (install-file "ninja" bin)
+              (install-file "doc/manual.asciidoc" doc)
               #t))))))
     (home-page "http://martine.github.io/ninja/")
     (synopsis "Small build system")
diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index bbc3ebdd8f1bc7ab01a6132a58e583d76f7d2e58..d416a43857e2a2a8cf5da901e2c819c7eecb6b7c 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -34,7 +34,7 @@ (define-module (gnu packages openldap)
 (define-public openldap
   (package
    (name "openldap")
-   (version "2.4.40")
+   (version "2.4.42")
    (source (origin
             (method url-fetch)
 
@@ -51,7 +51,7 @@ (define-public openldap
                         "openldap-release/openldap-" version ".tgz")))
             (sha256
              (base32
-              "1nyslrgwxwilgv5sixc37svls5rbvhsv9drb7hlrjr2vqaji29ni"))))
+              "0qwfpb5ipp2l76v11arghq5mr0sjc6xhjfg8a0kgsaw5qpib1dzf"))))
    (build-system gnu-build-system)
    (inputs `(("bdb" ,bdb)
              ("openssl" ,openssl)
diff --git a/gnu/packages/package-management.scm b/gnu/packages/package-management.scm
index f7af1a30dad613f9b372a42a15457d7779a8dbaa..8fbe5b3064fb2151b7c9fa77c0a334b8b674571f 100644
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@@ -176,7 +176,7 @@ (define guix-devel
   ;;
   ;; Note: use a short commit id; when using the long one, the limit on socket
   ;; file names is exceeded while running the tests.
-  (let ((commit "5d09263"))
+  (let ((commit "abbe2c6"))
     (package (inherit guix-0.8.3)
       (version (string-append "0.8.3." commit))
       (source (origin
@@ -186,7 +186,7 @@ (define guix-devel
                       (commit commit)))
                 (sha256
                  (base32
-                  "0v5g90di91j218x620shib7xjrjd5dkk4h1zrlg98hdmbgxq5s3j"))
+                  "1zgjj5knpz3qbbqdjm4yh436bzfgasc6p0k3xnx58hfjd88mdsga"))
                 (file-name (string-append "guix-" version "-checkout"))))
       (arguments
        (substitute-keyword-arguments (package-arguments guix-0.8.3)
diff --git a/gnu/packages/patches/acl-hurd-path-max.patch b/gnu/packages/patches/acl-hurd-path-max.patch
new file mode 100644
index 0000000000000000000000000000000000000000..89cb3a38d766fdf60b01366044463b90f7607f66
--- /dev/null
+++ b/gnu/packages/patches/acl-hurd-path-max.patch
@@ -0,0 +1,80 @@
+http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=636512
+
+From: Svante Signell <srs@kth.se>
+Subject: acl: Fix FTBFS on hurd-i386
+Date: Wed, 03 Aug 2011 19:36:27 +0200
+
+Currently acl does not compile on hurd-i386. The problem is a PATH_MAX
+definition which is not supported on GNU/Hurd.
+
+Index: acl-2.2.52/setfacl/parse.c
+===================================================================
+--- acl-2.2.52/setfacl/parse.c
++++ acl-2.2.52/setfacl/parse.c
+@@ -419,7 +419,13 @@ read_acl_comments(
+ 	  bytes for "# file: ". Not a good solution but for now it is the
+ 	  best I can do without too much impact on the code. [tw]
+ 	*/
++
++#ifdef __GNU__
++	char *linebuf;
++	size_t dummy = 0;
++#else
+ 	char linebuf[(4*PATH_MAX)+9];
++#endif
+ 	char *cp;
+ 	char *p;
+ 	int comments_read = 0;
+@@ -449,9 +455,13 @@ read_acl_comments(
+ 		if (line)
+ 			(*line)++;
+ 
++#ifdef __GNU__
++		if (getline(&linebuf, &dummy, file) == -1)
++			break;
++#else
+ 		if (fgets(linebuf, sizeof(linebuf), file) == NULL)
+ 			break;
+-		
++#endif		
+ 		comments_read = 1;
+ 
+ 		p = strrchr(linebuf, '\0');
+@@ -473,7 +483,12 @@ read_acl_comments(
+ 					goto fail;
+ 				*path_p = (char*)malloc(strlen(cp)+1);
+ 				if (!*path_p)
++				  {
++#ifdef __GNU__
++				    free (linebuf);
++#endif
+ 					return -1;
++				  }
+ 				strcpy(*path_p, cp);
+ 			}
+ 		} else if (strncmp(cp, "owner:", 6) == 0) {
+@@ -522,13 +537,24 @@ read_acl_comments(
+ 		}
+ 	}
+ 	if (ferror(file))
++	  {
++#ifdef __GNU__
++	    free (linebuf);
++#endif
+ 		return -1;
++	  }
++#ifdef __GNU__
++	free (linebuf);
++#endif
+ 	return comments_read;
+ fail:
+ 	if (path_p && *path_p) {
+ 		free(*path_p);
+ 		*path_p = NULL;
+ 	}
++#ifdef __GNU__
++	free (linebuf);
++#endif
+ 	return -EINVAL;
+ }
+ 
diff --git a/gnu/packages/patches/coreutils-racy-tail-test.patch b/gnu/packages/patches/coreutils-racy-tail-test.patch
new file mode 100644
index 0000000000000000000000000000000000000000..91640513e4d33b3498fc4344e6fe5327cb46fd4a
--- /dev/null
+++ b/gnu/packages/patches/coreutils-racy-tail-test.patch
@@ -0,0 +1,13 @@
+Skip this test, which uncovers a race condition in how 'tail' handles
+file deletion.  See <http://bugs.gnu.org/21460>.
+
+--- a/tests/tail-2/assert.sh
++++ b/tests/tail-2/assert.sh
+@@ -16,6 +16,7 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
++exit 77				# see <http://bugs.gnu.org/21460>
+ 
+ # This test fails with tail from textutils-2.0.
+ # It would get something like this:
diff --git a/gnu/packages/patches/glibc-hurd-extern-inline.patch b/gnu/packages/patches/glibc-hurd-extern-inline.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a609b1f54a7ecbf70a8e66e13ee364ff2244360b
--- /dev/null
+++ b/gnu/packages/patches/glibc-hurd-extern-inline.patch
@@ -0,0 +1,35 @@
+This changes the way _EXTERN_INLINE is defined so we can
+avoid external definition errors.
+https://lists.gnu.org/archive/html/bug-hurd/2014-04/msg00002.html
+
+diff --git a/signal/sigsetops.c b/signal/sigsetops.c
+index 0317662..b92c296 100644
+--- a/signal/sigsetops.c
++++ b/signal/sigsetops.c
+@@ -3,7 +3,9 @@
+ 
+ #include <features.h>
+ 
+-#define _EXTERN_INLINE
++#ifndef _EXTERN_INLINE
++#define _EXTERN_INLINE __extern_inline
++#endif
+ #ifndef __USE_EXTERN_INLINES
+ # define __USE_EXTERN_INLINES  1
+ #endif
+
+Link libmachuser and libhurduser automatically with libc, since they are
+considered a standard part of the API in GNU-land.
+
+--- a/Makerules
++++ b/Makerules
+@@ -978,6 +978,9 @@
+ 	      '$(libdir)/$(patsubst %,$(libtype.oS),$(libprefix)$(libc-name))'\
+	      ' AS_NEEDED (' $(rtlddir)/$(rtld-installed-name) ') )' \
+ 	) > $@.new
++ifeq ($(patsubst gnu%,,$(config-os)),)
++	echo 'INPUT ( AS_NEEDED ( -lmachuser -lhurduser ) )' >> $@.new
++endif
+ 	mv -f $@.new $@
+ 
+ endif
\ No newline at end of file
diff --git a/gnu/packages/patches/glibc-locales.patch b/gnu/packages/patches/glibc-locales.patch
index 1d254e1c1dfa6e5dde23614ff71e27d8df06ade1..1bcf12bf6f0dd00b7136d4c5e4e97565cfa9e116 100644
--- a/gnu/packages/patches/glibc-locales.patch
+++ b/gnu/packages/patches/glibc-locales.patch
@@ -9,9 +9,9 @@ in a package separate from glibc.
      because otherwise, 'localedef' fails with:
      "cannot write output files to `(null)'".
 
---- glibc-2.20/localedata/Makefile	2014-09-07 10:09:09.000000000 +0200
-+++ glibc-2.20/localedata/Makefile	2015-02-11 10:23:55.560545568 +0100
-@@ -217,7 +217,7 @@ INSTALL-SUPPORTED-LOCALES=$(addprefix in
+--- glibc-2.22/localedata/Makefile	1970-01-01 01:00:00.000000000 +0100
++++ glibc-2.22/localedata/Makefile	2015-09-25 14:18:34.698941752 +0200
+@@ -195,7 +195,7 @@ INSTALL-SUPPORTED-LOCALES=$(addprefix in
  
  # Sometimes the whole collection of locale files should be installed.
  LOCALEDEF=I18NPATH=. GCONV_PATH=$(common-objpfx)iconvdata LC_ALL=C \
@@ -20,12 +20,12 @@ in a package separate from glibc.
  install-locales: $(INSTALL-SUPPORTED-LOCALES)
  
  install-locales-dir:
-@@ -234,7 +234,7 @@ $(INSTALL-SUPPORTED-LOCALES): install-lo
+@@ -212,7 +212,7 @@ $(INSTALL-SUPPORTED-LOCALES): install-lo
  	input=`echo $$locale | sed 's/\([^.]*\)[^@]*\(.*\)/\1\2/'`; \
  	$(LOCALEDEF) --alias-file=../intl/locale.alias \
  		     -i locales/$$input -c -f charmaps/$$charset \
--		     $(addprefix --prefix=,$(install_root)) $$locale; \
-+		     $(addprefix --prefix=,$(install_root)) $(localedir)/$$locale; \
- 	echo ' done'; \
+-		     $(addprefix --prefix=,$(install_root)) $$locale \
++		     $(addprefix --prefix=,$(install_root)) $(localedir)/$$locale \
+ 	&& echo ' done'; \
  
  tst-setlocale-ENV = LC_ALL=ja_JP.EUC-JP
diff --git a/gnu/packages/patches/glibc-o-largefile.patch b/gnu/packages/patches/glibc-o-largefile.patch
new file mode 100644
index 0000000000000000000000000000000000000000..2b0ae8c8bb0390465f748dfdfc2e7797e0f3c4b9
--- /dev/null
+++ b/gnu/packages/patches/glibc-o-largefile.patch
@@ -0,0 +1,25 @@
+This fixes <https://sourceware.org/bugzilla/show_bug.cgi?id=18781>
+whereby, on 32-bit platforms, libc 2.22 would fail to pass O_LARGEFILE
+to 'openat'.  This was caught by 'tests/sparse03.at' in the tar
+test suite.
+
+commit eb32b0d40308166c4d8f6330cc2958cb1e545075
+Author: Andreas Schwab <schwab@suse.de>
+Date:   Mon Aug 10 14:12:47 2015 +0200
+
+    Readd O_LARGEFILE flag for openat64 (bug 18781)
+
+--- a/sysdeps/unix/sysv/linux/openat.c
++++ b/sysdeps/unix/sysv/linux/openat.c
+@@ -68,6 +68,11 @@ __OPENAT (int fd, const char *file, int oflag, ...)
+       va_end (arg);
+     }
+ 
++  /* We have to add the O_LARGEFILE flag for openat64.  */
++#ifdef MORE_OFLAGS
++  oflag |= MORE_OFLAGS;
++#endif
++
+   return SYSCALL_CANCEL (openat, fd, file, oflag, mode);
+ }
+ libc_hidden_def (__OPENAT)
diff --git a/gnu/packages/patches/icu4c-CVE-2014-6585.patch b/gnu/packages/patches/icu4c-CVE-2014-6585.patch
new file mode 100644
index 0000000000000000000000000000000000000000..d21a0d0ba180567bbe487e7f548a3d1e00ff5c86
--- /dev/null
+++ b/gnu/packages/patches/icu4c-CVE-2014-6585.patch
@@ -0,0 +1,21 @@
+Copied from Debian.
+
+description: out-of-bounds read
+origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6585
+
+--- a/source/layout/LETableReference.h
++++ b/source/layout/LETableReference.h
+@@ -322,7 +322,12 @@ LE_TRACE_TR("INFO: new RTAO")
+   }
+   
+   const T& operator()(le_uint32 i, LEErrorCode &success) const {
+-    return *getAlias(i,success);
++    const T *ret = getAlias(i,success);
++    if (LE_FAILURE(success) || ret==NULL) {
++      return *(new T());
++    } else {
++      return *ret;
++    }
+   }
+ 
+   size_t getOffsetFor(le_uint32 i, LEErrorCode &success) const {
diff --git a/gnu/packages/patches/icu4c-CVE-2015-1270.patch b/gnu/packages/patches/icu4c-CVE-2015-1270.patch
new file mode 100644
index 0000000000000000000000000000000000000000..2a7658d36efa144ce4e499cd57acf45169e6f1cb
--- /dev/null
+++ b/gnu/packages/patches/icu4c-CVE-2015-1270.patch
@@ -0,0 +1,15 @@
+Copied from Debian.
+
+diff --git a/source/common/ucnv_io.cpp b/source/common/ucnv_io.cpp
+index 5dd35d8..4424664 100644
+--- a/source/common/ucnv_io.cpp
++++ b/source/common/ucnv_io.cpp
+@@ -744,7 +744,7 @@ ucnv_io_getConverterName(const char *alias, UBool *containsOption, UErrorCode *p
+              * the name begins with 'x-'. If it does, strip it off and try
+              * again.  This behaviour is similar to how ICU4J does it.
+              */
+-            if (aliasTmp[0] == 'x' || aliasTmp[1] == '-') {
++            if (aliasTmp[0] == 'x' && aliasTmp[1] == '-') {
+                 aliasTmp = aliasTmp+2;
+             } else {
+                 break;
diff --git a/gnu/packages/patches/imagemagick-test-segv.patch b/gnu/packages/patches/imagemagick-test-segv.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6626e54828c4c40fa1db12e18a15b259b27a8157
--- /dev/null
+++ b/gnu/packages/patches/imagemagick-test-segv.patch
@@ -0,0 +1,20 @@
+This patch works around a segmentation fault in 'Magick++/tests/color' when
+running 'Magick++/tests/tests.tap'.  Here we get an exception early on, which
+is supposedly harmless:
+
+  Caught exception: color: UnableToOpenConfigureFile `colors.xml' @ warning/configure.c/GetConfigureOptions/706
+
+However, when the stack unwinders run, 'UnregisterDOTImage' gets called even
+though 'RegisterDOTImage' hadn't been called yet; thus, 'graphic_context' in
+coders/dot.c is NULL, leading to the segfault.
+
+--- ImageMagick-6.9.2-1/coders/dot.c	2015-09-16 17:32:42.900323334 +0200
++++ ImageMagick-6.9.2-1/coders/dot.c	2015-09-16 17:32:48.312367636 +0200
+@@ -240,6 +240,7 @@ ModuleExport void UnregisterDOTImage(voi
+   (void) UnregisterMagickInfo("GV");
+   (void) UnregisterMagickInfo("DOT");
+ #if defined(MAGICKCORE_GVC_DELEGATE)
++  if (graphic_context != NULL)
+   gvFreeContext(graphic_context);
+ #endif
+ }
diff --git a/gnu/packages/patches/libpthread-glibc-preparation.patch b/gnu/packages/patches/libpthread-glibc-preparation.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a43245436c21085cc66f84ca9f2f320dbcea9d43
--- /dev/null
+++ b/gnu/packages/patches/libpthread-glibc-preparation.patch
@@ -0,0 +1,146 @@
+This patch helps to integrate the Hurd's libpthread as a libc add-on.
+
+It writes the configure file, removes an rpc call not yet 
+implemented on the version of gnumach we use and defines
+a missing macro.
+
+diff --git a/libpthread/configure b/libpthread/configure
+new file mode 100644
+index 0000000..2cdbc71
+--- /dev/null
++++ b/libpthread/configure
+@@ -0,0 +1,2 @@
++libc_add_on_canonical=libpthread
++libc_add_on_subdirs=.
+-- 
+1.9.0
+
+We are using a version of GNU Mach that lacks 'thread_terminate_release'
+(not introduced yet).  The 'thread_terminate' RPC call will be enough for
+our needs.
+See <http://lists.gnu.org/archive/html/bug-hurd/2014-05/msg00127.html>.
+
+diff --git a/libpthread/sysdeps/mach/pt-thread-terminate.c b/libpthread/sysdeps/mach/pt-thread-terminate.c
+index 6672065..129a611 100644
+--- a/libpthread/sysdeps/mach/pt-thread-terminate.c
++++ b/libpthread/sysdeps/mach/pt-thread-terminate.c
+@@ -70,9 +70,9 @@ __pthread_thread_terminate (struct __pthread *thread)
+   __mach_port_destroy (__mach_task_self (), wakeup_port);
+ 
+   /* Terminate and release all that's left.  */
+-  err = __thread_terminate_release (kernel_thread, mach_task_self (),
+-				    kernel_thread, reply_port,
+-				    stackaddr, stacksize);
++  /* err = __thread_terminate_release (kernel_thread, mach_task_self (), */
++  /* 				    kernel_thread, reply_port, */
++  /* 				    stackaddr, stacksize); */
+ 
+   /* The kernel does not support it yet.  Leak but at least terminate
+      correctly.  */
+-- 
+1.9.2
+
+The __PTHREAD_SPIN_LOCK_INITIALIZER definition is missing, so we 
+define it to __SPIN_LOCK_INITIALIZER which already exists.
+See <http://lists.gnu.org/archive/html/commit-hurd/2009-04/msg00006.html>.
+  
+diff --git a/libpthread/sysdeps/mach/bits/spin-lock.h b/libpthread/sysdeps/mach/bits/spin-lock.h
+index 537dac9..fca0e5a 100644
+--- a/libpthread/sysdeps/mach/bits/spin-lock.h
++++ b/libpthread/sysdeps/mach/bits/spin-lock.h
+@@ -30,7 +30,7 @@ typedef __spin_lock_t __pthread_spinlock_t;
+ 
+ /* Initializer for a spin lock object.  */
+ #ifndef __PTHREAD_SPIN_LOCK_INITIALIZER
+-#error __PTHREAD_SPIN_LOCK_INITIALIZER undefined: should be defined by <lock-intern.h>.
++#define __PTHREAD_SPIN_LOCK_INITIALIZER __SPIN_LOCK_INITIALIZER
+ #endif
+ 
+ __END_DECLS
+
+The version of the glibc we use doesn't include the shm-directory.c file and does
+not yet support IS_IN.
+See <https://lists.gnu.org/archive/html/bug-hurd/2015-03/msg00078.html>
+
+diff --git a/libpthread/Makefile b/libpthread/Makefile
+index 2906788..b8dee58 100644
+--- a/libpthread/Makefile
++++ b/libpthread/Makefile
+@@ -149,8 +149,6 @@ libpthread-routines := pt-attr pt-attr-destroy pt-attr-getdetachstate	    \
+ 	sem-post sem-timedwait sem-trywait sem-unlink			    \
+ 	sem-wait							    \
+ 									    \
+-	shm-directory							    \
+-									    \
+ 	cthreads-compat							    \
+ 	$(SYSDEPS)
+ 
+-- 
+2.3.6
+
+diff --git a/libpthread/pthread/pt-create.c b/libpthread/pthread/pt-create.c
+index d88afae..84044dc 100644
+--- a/libpthread/pthread/pt-create.c
++++ b/libpthread/pthread/pt-create.c
+@@ -28,7 +28,7 @@
+ 
+ #include <pt-internal.h>
+ 
+-#if IS_IN (libpthread)
++#ifdef IS_IN_libpthread
+ # include <ctype.h>
+ #endif
+ #ifdef HAVE_USELOCALE
+@@ -50,7 +50,7 @@ entry_point (struct __pthread *self, void *(*start_routine)(void *), void *arg)
+   __resp = &self->res_state;
+ #endif
+ 
+-#if IS_IN (libpthread)
++#ifdef IS_IN_libpthread
+   /* Initialize pointers to locale data.  */
+   __ctype_init ();
+ #endif
+diff --git a/libpthread/pthread/pt-initialize.c b/libpthread/pthread/pt-initialize.c
+index 9e5404b..b9cacbd 100644
+--- a/libpthread/pthread/pt-initialize.c
++++ b/libpthread/pthread/pt-initialize.c
+@@ -28,7 +28,7 @@
+ 
+ DEFINE_HOOK (__pthread_init, (void));
+ 
+-#if IS_IN (libpthread)
++#ifdef IS_IN_libpthread
+ static const struct pthread_functions pthread_functions =
+   {
+     .ptr_pthread_attr_destroy = __pthread_attr_destroy,
+@@ -81,7 +81,7 @@ static const struct pthread_functions pthread_functions =
+ void
+ ___pthread_init (void)
+ {
+-#if IS_IN (libpthread)
++#ifdef IS_IN_libpthread
+   __libc_pthread_init(&pthread_functions);
+ #endif
+   RUN_HOOK (__pthread_init, ());
+diff --git a/libpthread/pthread/pt-internal.h b/libpthread/pthread/pt-internal.h
+index 18b5b4c..8cdcfce 100644
+--- a/libpthread/pthread/pt-internal.h
++++ b/libpthread/pthread/pt-internal.h
+@@ -35,7 +35,7 @@
+ #include <pt-sysdep.h>
+ #include <pt-machdep.h>
+ 
+-#if IS_IN (libpthread)
++#ifdef IS_IN_libpthread
+ # include <ldsodefs.h>
+ #endif
+ 
+@@ -60,7 +60,7 @@ enum pthread_state
+ # define PTHREAD_SYSDEP_MEMBERS
+ #endif
+ 
+-#if !(IS_IN (libpthread))
++#ifndef IS_IN_libpthread
+ #ifdef ENABLE_TLS
+ /* Type of the TCB.  */
+ typedef struct
diff --git a/gnu/packages/patches/libtiff-CVE-2012-4564.patch b/gnu/packages/patches/libtiff-CVE-2012-4564.patch
deleted file mode 100644
index 472f9ca35f1640fbc1f1c2f3ead019e3225b8642..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2012-4564.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-Copied from Debian
-
-Index: tiff-4.0.3/tools/ppm2tiff.c
-===================================================================
---- tiff-4.0.3.orig/tools/ppm2tiff.c	2013-06-23 10:36:50.779629492 -0400
-+++ tiff-4.0.3/tools/ppm2tiff.c	2013-06-23 10:36:50.775629494 -0400
-@@ -89,6 +89,7 @@
- 	int c;
- 	extern int optind;
- 	extern char* optarg;
-+	tmsize_t scanline_size;
- 
- 	if (argc < 2) {
- 	    fprintf(stderr, "%s: Too few arguments\n", argv[0]);
-@@ -237,8 +238,16 @@
- 	}
- 	if (TIFFScanlineSize(out) > linebytes)
- 		buf = (unsigned char *)_TIFFmalloc(linebytes);
--	else
--		buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
-+	else {
-+		scanline_size = TIFFScanlineSize(out);
-+		if (scanline_size != 0)
-+			buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
-+		else {
-+			fprintf(stderr, "%s: scanline size overflow\n",infile);
-+			(void) TIFFClose(out);
-+			exit(-2);
-+			}
-+		}
- 	if (resolution > 0) {
- 		TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
- 		TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
diff --git a/gnu/packages/patches/libtiff-CVE-2013-1960.patch b/gnu/packages/patches/libtiff-CVE-2013-1960.patch
deleted file mode 100644
index 341063f25d5bd6a28a36188acd19e5c3fb9cae55..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-1960.patch
+++ /dev/null
@@ -1,148 +0,0 @@
-Copied from Debian
-
-Index: tiff-4.0.3/tools/tiff2pdf.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-06-23 10:36:50.979629486 -0400
-+++ tiff-4.0.3/tools/tiff2pdf.c	2013-06-23 10:36:50.975629486 -0400
-@@ -3341,33 +3341,56 @@
- 	uint32 height){
- 
- 	tsize_t i=0;
--	uint16 ri =0;
--	uint16 v_samp=1;
--	uint16 h_samp=1;
--	int j=0;
--	
--	i++;
--	
--	while(i<(*striplength)){
-+
-+	while (i < *striplength) {
-+		tsize_t datalen;
-+		uint16 ri;
-+		uint16 v_samp;
-+		uint16 h_samp;
-+		int j;
-+		int ncomp;
-+
-+		/* marker header: one or more FFs */
-+		if (strip[i] != 0xff)
-+			return(0);
-+		i++;
-+		while (i < *striplength && strip[i] == 0xff)
-+			i++;
-+		if (i >= *striplength)
-+			return(0);
-+		/* SOI is the only pre-SOS marker without a length word */
-+		if (strip[i] == 0xd8)
-+			datalen = 0;
-+		else {
-+			if ((*striplength - i) <= 2)
-+				return(0);
-+			datalen = (strip[i+1] << 8) | strip[i+2];
-+			if (datalen < 2 || datalen >= (*striplength - i))
-+				return(0);
-+		}
- 		switch( strip[i] ){
--			case 0xd8:
--				/* SOI - start of image */
-+			case 0xd8:	/* SOI - start of image */
- 				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);
- 				*bufferoffset+=2;
--				i+=2;
- 				break;
--			case 0xc0:
--			case 0xc1:
--			case 0xc3:
--			case 0xc9:
--			case 0xca:
-+			case 0xc0:	/* SOF0 */
-+			case 0xc1:	/* SOF1 */
-+			case 0xc3:	/* SOF3 */
-+			case 0xc9:	/* SOF9 */
-+			case 0xca:	/* SOF10 */
- 				if(no==0){
--					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
--					for(j=0;j<buffer[*bufferoffset+9];j++){
--						if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp) 
--							h_samp = (buffer[*bufferoffset+11+(2*j)]>>4);
--						if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp) 
--							v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f);
-+					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
-+					ncomp = buffer[*bufferoffset+9];
-+					if (ncomp < 1 || ncomp > 4)
-+						return(0);
-+					v_samp=1;
-+					h_samp=1;
-+					for(j=0;j<ncomp;j++){
-+						uint16 samp = buffer[*bufferoffset+11+(3*j)];
-+						if( (samp>>4) > h_samp) 
-+							h_samp = (samp>>4);
-+						if( (samp & 0x0f) > v_samp) 
-+							v_samp = (samp & 0x0f);
- 					}
- 					v_samp*=8;
- 					h_samp*=8;
-@@ -3381,45 +3404,43 @@
-                                           (unsigned char) ((height>>8) & 0xff);
- 					buffer[*bufferoffset+6]=
-                                             (unsigned char) (height & 0xff);
--					*bufferoffset+=strip[i+2]+2;
--					i+=strip[i+2]+2;
--
-+					*bufferoffset+=datalen+2;
-+					/* insert a DRI marker */
- 					buffer[(*bufferoffset)++]=0xff;
- 					buffer[(*bufferoffset)++]=0xdd;
- 					buffer[(*bufferoffset)++]=0x00;
- 					buffer[(*bufferoffset)++]=0x04;
- 					buffer[(*bufferoffset)++]=(ri >> 8) & 0xff;
- 					buffer[(*bufferoffset)++]= ri & 0xff;
--				} else {
--					i+=strip[i+2]+2;
- 				}
- 				break;
--			case 0xc4:
--			case 0xdb:
--				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
--				*bufferoffset+=strip[i+2]+2;
--				i+=strip[i+2]+2;
-+			case 0xc4: /* DHT */
-+			case 0xdb: /* DQT */
-+				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
-+				*bufferoffset+=datalen+2;
- 				break;
--			case 0xda:
-+			case 0xda: /* SOS */
- 				if(no==0){
--					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
--					*bufferoffset+=strip[i+2]+2;
--					i+=strip[i+2]+2;
-+					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
-+					*bufferoffset+=datalen+2;
- 				} else {
- 					buffer[(*bufferoffset)++]=0xff;
- 					buffer[(*bufferoffset)++]=
-                                             (unsigned char)(0xd0 | ((no-1)%8));
--					i+=strip[i+2]+2;
- 				}
--				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1);
--				*bufferoffset+=(*striplength)-i-1;
-+				i += datalen + 1;
-+				/* copy remainder of strip */
-+				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);
-+				*bufferoffset+= *striplength - i;
- 				return(1);
- 			default:
--				i+=strip[i+2]+2;
-+				/* ignore any other marker */
-+				break;
- 		}
-+		i += datalen + 1;
- 	}
--	
- 
-+	/* failed to find SOS marker */
- 	return(0);
- }
- #endif
diff --git a/gnu/packages/patches/libtiff-CVE-2013-1961.patch b/gnu/packages/patches/libtiff-CVE-2013-1961.patch
deleted file mode 100644
index 9c2481ce836918846cb6387d40fd954eb449d956..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-1961.patch
+++ /dev/null
@@ -1,770 +0,0 @@
-Copied from Debian
-
-Index: tiff-4.0.3/contrib/dbs/xtiff/xtiff.c
-===================================================================
---- tiff-4.0.3.orig/contrib/dbs/xtiff/xtiff.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/contrib/dbs/xtiff/xtiff.c	2013-06-23 10:36:51.147629484 -0400
-@@ -512,9 +512,9 @@
-     Arg args[1];
- 
-     if (tfMultiPage)
--        sprintf(buffer, "%s - page %d", fileName, tfDirectory);
-+        snprintf(buffer, sizeof(buffer), "%s - page %d", fileName, tfDirectory);
-     else
--        strcpy(buffer, fileName);
-+        snprintf(buffer, sizeof(buffer), "%s", fileName);
-     XtSetArg(args[0], XtNlabel, buffer);
-     XtSetValues(labelWidget, args, 1);
- }
-Index: tiff-4.0.3/libtiff/tif_dirinfo.c
-===================================================================
---- tiff-4.0.3.orig/libtiff/tif_dirinfo.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/libtiff/tif_dirinfo.c	2013-06-23 10:36:51.147629484 -0400
-@@ -711,7 +711,7 @@
- 	 * note that this name is a special sign to TIFFClose() and
- 	 * _TIFFSetupFields() to free the field
- 	 */
--	sprintf(fld->field_name, "Tag %d", (int) tag);
-+	snprintf(fld->field_name, 32, "Tag %d", (int) tag);
- 
- 	return fld;    
- }
-Index: tiff-4.0.3/libtiff/tif_codec.c
-===================================================================
---- tiff-4.0.3.orig/libtiff/tif_codec.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/libtiff/tif_codec.c	2013-06-23 10:36:51.151629482 -0400
-@@ -108,7 +108,8 @@
- 	const TIFFCodec* c = TIFFFindCODEC(tif->tif_dir.td_compression);
-         char compression_code[20];
-         
--        sprintf( compression_code, "%d", tif->tif_dir.td_compression );
-+        snprintf(compression_code, sizeof(compression_code), "%d",
-+		 tif->tif_dir.td_compression );
- 	TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
-                      "%s compression support is not configured", 
-                      c ? c->name : compression_code );
-Index: tiff-4.0.3/tools/tiffdither.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiffdither.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/tiffdither.c	2013-06-23 10:36:51.151629482 -0400
-@@ -260,7 +260,7 @@
- 		TIFFSetField(out, TIFFTAG_FILLORDER, fillorder);
- 	else
- 		CopyField(TIFFTAG_FILLORDER, shortv);
--	sprintf(thing, "Dithered B&W version of %s", argv[optind]);
-+	snprintf(thing, sizeof(thing), "Dithered B&W version of %s", argv[optind]);
- 	TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
- 	CopyField(TIFFTAG_PHOTOMETRIC, shortv);
- 	CopyField(TIFFTAG_ORIENTATION, shortv);
-Index: tiff-4.0.3/tools/rgb2ycbcr.c
-===================================================================
---- tiff-4.0.3.orig/tools/rgb2ycbcr.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/rgb2ycbcr.c	2013-06-23 10:36:51.151629482 -0400
-@@ -332,7 +332,8 @@
- 	TIFFSetField(out, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
- 	{ char buf[2048];
- 	  char *cp = strrchr(TIFFFileName(in), '/');
--	  sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
-+	  snprintf(buf, sizeof(buf), "YCbCr conversion of %s",
-+		   cp ? cp+1 : TIFFFileName(in));
- 	  TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
- 	}
- 	TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
-Index: tiff-4.0.3/tools/tiff2pdf.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/tiff2pdf.c	2013-06-23 10:36:51.151629482 -0400
-@@ -3630,7 +3630,9 @@
- 	char buffer[16];
- 	int buflen=0;
- 	
--	buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff);
-+	buflen = snprintf(buffer, sizeof(buffer), "%%PDF-%u.%u ",
-+			  t2p->pdf_majorversion&0xff,
-+			  t2p->pdf_minorversion&0xff);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7);
- 
-@@ -3644,10 +3646,10 @@
- tsize_t t2p_write_pdf_obj_start(uint32 number, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
--	buflen=sprintf(buffer, "%lu", (unsigned long)number);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen );
- 	written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7);
- 
-@@ -3686,13 +3688,13 @@
- 	written += t2pWriteFile(output, (tdata_t) "/", 1);
- 	for (i=0;i<namelen;i++){
- 		if ( ((unsigned char)name[i]) < 0x21){
--			sprintf(buffer, "#%.2X", name[i]);
-+			snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 			buffer[sizeof(buffer) - 1] = '\0';
- 			written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 			nextchar=1;
- 		}
- 		if ( ((unsigned char)name[i]) > 0x7E){
--			sprintf(buffer, "#%.2X", name[i]);
-+			snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 			buffer[sizeof(buffer) - 1] = '\0';
- 			written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 			nextchar=1;
-@@ -3700,57 +3702,57 @@
- 		if (nextchar==0){
- 			switch (name[i]){
- 				case 0x23:
--					sprintf(buffer, "#%.2X", name[i]);
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x25:
--					sprintf(buffer, "#%.2X", name[i]);
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x28:
--					sprintf(buffer, "#%.2X", name[i]);
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x29:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x2F:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x3C:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x3E:
--					sprintf(buffer, "#%.2X", name[i]);
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x5B:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x5D:
--					sprintf(buffer, "#%.2X", name[i]);
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x7B:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
- 				case 0x7D:
--					sprintf(buffer, "#%.2X", name[i]); 
-+					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
- 					buffer[sizeof(buffer) - 1] = '\0';
- 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
- 					break;
-@@ -3865,14 +3867,14 @@
- tsize_t t2p_write_pdf_stream_dict(tsize_t len, uint32 number, TIFF* output){
- 	
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 	
- 	written += t2pWriteFile(output, (tdata_t) "/Length ", 8);
- 	if(len!=0){
- 		written += t2p_write_pdf_stream_length(len, output);
- 	} else {
--		buflen=sprintf(buffer, "%lu", (unsigned long)number);
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
- 	}
-@@ -3913,10 +3915,10 @@
- tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
--	buflen=sprintf(buffer, "%lu", (unsigned long)len);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)len);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "\n", 1);
- 
-@@ -3930,7 +3932,7 @@
- tsize_t t2p_write_pdf_catalog(T2P* t2p, TIFF* output)
- {
- 	tsize_t written = 0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen = 0;
- 
- 	written += t2pWriteFile(output, 
-@@ -3969,7 +3971,6 @@
- 		written += t2p_write_pdf_string(t2p->pdf_datetime, output);
- 	}
- 	written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11);
--	_TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer));
- 	snprintf(buffer, sizeof(buffer), "libtiff / tiff2pdf - %d", TIFFLIB_VERSION);
- 	written += t2p_write_pdf_string(buffer, output);
- 	written += t2pWriteFile(output, (tdata_t) "\n", 1);
-@@ -4110,7 +4111,7 @@
- {
- 	tsize_t written=0;
- 	tdir_t i=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
- 	int page=0;
-@@ -4118,7 +4119,7 @@
- 		(tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26);
- 	page = t2p->pdf_pages+1;
- 	for (i=0;i<t2p->tiff_pagecount;i++){
--		buflen=sprintf(buffer, "%d", page);
-+		buflen=snprintf(buffer, sizeof(buffer), "%d", page);
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
- 		if ( ((i+1)%8)==0 ) {
-@@ -4133,8 +4134,7 @@
- 		}
- 	}
- 	written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10);
--	_TIFFmemset(buffer, 0x00, 16);
--	buflen=sprintf(buffer, "%d", t2p->tiff_pagecount);
-+	buflen=snprintf(buffer, sizeof(buffer), "%d", t2p->tiff_pagecount);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6);
- 
-@@ -4149,28 +4149,28 @@
- 
- 	unsigned int i=0;
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[256];
- 	int buflen=0;
- 
- 	written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24);
--	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_pages);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
- 	written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11); 
--	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1);
-+	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x1);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
--	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1);
-+	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y1);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
--	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2);
-+	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x2);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
--	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2);
-+	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y2);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "] \n", 3); 
- 	written += t2pWriteFile(output, (tdata_t) "/Contents ", 10);
--	buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1));
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(object + 1));
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
- 	written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15);
-@@ -4178,15 +4178,13 @@
- 		written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
- 		for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount;i++){
- 			written += t2pWriteFile(output, (tdata_t) "/Im", 3);
--			buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
-+			buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) "_", 1);
--			buflen = sprintf(buffer, "%u", i+1);
-+			buflen = snprintf(buffer, sizeof(buffer), "%u", i+1);
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) " ", 1);
--			buflen = sprintf(
--				buffer, 
--				"%lu", 
-+			buflen = snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); 
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
-@@ -4198,12 +4196,10 @@
- 	} else {
- 			written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
- 			written += t2pWriteFile(output, (tdata_t) "/Im", 3);
--			buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
-+			buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) " ", 1);
--			buflen = sprintf(
--				buffer, 
--				"%lu", 
-+			buflen = snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); 
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
-@@ -4212,9 +4208,7 @@
- 	if(t2p->tiff_transferfunctioncount != 0) {
- 		written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13);
- 		t2pWriteFile(output, (tdata_t) "/GS1 ", 5);
--		buflen = sprintf(
--			buffer, 
--			"%lu", 
-+		buflen = snprintf(buffer, sizeof(buffer), "%lu",
- 			(unsigned long)(object + 3)); 
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
-@@ -4587,7 +4581,7 @@
- 	if(t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount>0){ 
- 		for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount; i++){
- 			box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box;
--			buflen=sprintf(buffer, 
-+			buflen=snprintf(buffer, sizeof(buffer), 
- 				"q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n", 
- 				t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
- 				box.mat[0],
-@@ -4602,7 +4596,7 @@
- 		}
- 	} else {
- 		box=t2p->pdf_imagebox;
--		buflen=sprintf(buffer, 
-+		buflen=snprintf(buffer, sizeof(buffer), 
- 			"q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n", 
- 			t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
- 			box.mat[0],
-@@ -4627,59 +4621,48 @@
- 												TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
- 	written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output); 
- 	written += t2pWriteFile(output, 
- 		(tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im", 
- 		42);
--	buflen=sprintf(buffer, "%u", t2p->pdf_page+1);
-+	buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	if(tile != 0){
- 		written += t2pWriteFile(output, (tdata_t) "_", 1);
--		buflen=sprintf(buffer, "%lu", (unsigned long)tile);
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)tile);
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	}
- 	written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8);
--	_TIFFmemset((tdata_t)buffer, 0x00, 16);
- 	if(tile==0){
--		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width);
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_width);
- 	} else {
- 		if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
--			buflen=sprintf(
--				buffer, 
--				"%lu", 
-+			buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
- 		} else {
--			buflen=sprintf(
--				buffer, 
--				"%lu", 
-+			buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
- 		}
- 	}
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9);
--	_TIFFmemset((tdata_t)buffer, 0x00, 16);
- 	if(tile==0){
--		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length);
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_length);
- 	} else {
- 		if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
--			buflen=sprintf(
--				buffer, 
--				"%lu", 
-+			buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
- 		} else {
--			buflen=sprintf(
--				buffer, 
--				"%lu", 
-+			buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
- 		}
- 	}
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19);
--	_TIFFmemset((tdata_t)buffer, 0x00, 16);
--	buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
-+	buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13);
- 	written += t2p_write_pdf_xobject_cs(t2p, output);
-@@ -4723,11 +4706,10 @@
- 		t2p->pdf_colorspace ^= T2P_CS_PALETTE;
- 		written += t2p_write_pdf_xobject_cs(t2p, output);
- 		t2p->pdf_colorspace |= T2P_CS_PALETTE;
--		buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
-+		buflen=snprintf(buffer, sizeof(buffer), "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " ", 1);
--		_TIFFmemset(buffer, 0x00, 16);
--		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs ); 
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_palettecs ); 
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7);
- 		return(written);
-@@ -4761,10 +4743,10 @@
- 			X_W /= Y_W;
- 			Z_W /= Y_W;
- 			Y_W = 1.0F;
--			buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
-+			buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
- 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			written += t2pWriteFile(output, (tdata_t) "/Range ", 7);
--			buflen=sprintf(buffer, "[%d %d %d %d] \n", 
-+			buflen=snprintf(buffer, sizeof(buffer), "[%d %d %d %d] \n", 
- 				t2p->pdf_labrange[0], 
- 				t2p->pdf_labrange[1], 
- 				t2p->pdf_labrange[2], 
-@@ -4780,26 +4762,26 @@
- tsize_t t2p_write_pdf_transfer(T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
- 	written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25);
- 	if(t2p->tiff_transferfunctioncount == 1){
--		buflen=sprintf(buffer, "%lu",
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 			       (unsigned long)(t2p->pdf_xrefcount + 1));
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
- 	} else {
- 		written += t2pWriteFile(output, (tdata_t) "[ ", 2);
--		buflen=sprintf(buffer, "%lu",
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 			       (unsigned long)(t2p->pdf_xrefcount + 1));
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
--		buflen=sprintf(buffer, "%lu",
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 			       (unsigned long)(t2p->pdf_xrefcount + 2));
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
--		buflen=sprintf(buffer, "%lu",
-+		buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 			       (unsigned long)(t2p->pdf_xrefcount + 3));
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
-@@ -4821,7 +4803,7 @@
- 	written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17);
- 	written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19);
- 	written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18);
--	buflen=sprintf(buffer, "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
-+	buflen=snprintf(buffer, sizeof(buffer), "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19);
- 	written += t2p_write_pdf_stream_dict(((tsize_t)1)<<(t2p->tiff_bitspersample+1), 0, output);
-@@ -4848,7 +4830,7 @@
- tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[128];
-+	char buffer[256];
- 	int buflen=0;
- 	
- 	float X_W=0.0;
-@@ -4916,16 +4898,16 @@
- 	written += t2pWriteFile(output, (tdata_t) "<< \n", 4);
- 	if(t2p->pdf_colorspace & T2P_CS_CALGRAY){
- 		written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
--		buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
-+		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12);
- 	}
- 	if(t2p->pdf_colorspace & T2P_CS_CALRGB){
- 		written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
--		buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
-+		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
- 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 		written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8);
--		buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", 
-+		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", 
- 			X_R, Y_R, Z_R, 
- 			X_G, Y_G, Z_G, 
- 			X_B, Y_B, Z_B); 
-@@ -4944,11 +4926,11 @@
- tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 	
- 	written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11);
--	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_icccs);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7);
- 
-@@ -4958,11 +4940,11 @@
- tsize_t t2p_write_pdf_xobject_icccs_dict(T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 	
- 	written += t2pWriteFile(output, (tdata_t) "/N ", 3);
--	buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel);
-+	buflen=snprintf(buffer, sizeof(buffer), "%u \n", t2p->tiff_samplesperpixel);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11);
- 	t2p->pdf_colorspace ^= T2P_CS_ICCBASED;
-@@ -5027,7 +5009,7 @@
- tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[16];
-+	char buffer[32];
- 	int buflen=0;
- 
- 	if(t2p->pdf_compression==T2P_COMPRESS_NONE){
-@@ -5042,41 +5024,33 @@
- 			written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9);
- 			if(tile==0){
- 				written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
--				buflen=sprintf(buffer, "%lu",
-+				buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 					       (unsigned long)t2p->tiff_width);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
--				buflen=sprintf(buffer, "%lu",
-+				buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 					       (unsigned long)t2p->tiff_length);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 			} else {
- 				if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
- 					written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
--					buflen=sprintf(
--						buffer, 
--						"%lu", 
-+					buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
- 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				} else {
- 					written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
--					buflen=sprintf(
--						buffer, 
--						"%lu", 
-+					buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
- 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				}
- 				if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
- 					written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
--					buflen=sprintf(
--						buffer, 
--						"%lu", 
-+					buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
- 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				} else {
- 					written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
--					buflen=sprintf(
--						buffer, 
--						"%lu", 
-+					buflen=snprintf(buffer, sizeof(buffer), "%lu",
- 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
- 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				}
-@@ -5103,21 +5077,17 @@
- 			if(t2p->pdf_compressionquality%100){
- 				written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13);
- 				written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14);
--				_TIFFmemset(buffer, 0x00, 16);
--				buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100);
-+				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_compressionquality%100);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				written += t2pWriteFile(output, (tdata_t) " /Columns ", 10);
--				_TIFFmemset(buffer, 0x00, 16);
--				buflen = sprintf(buffer, "%lu",
-+				buflen = snprintf(buffer, sizeof(buffer), "%lu",
- 						 (unsigned long)t2p->tiff_width);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				written += t2pWriteFile(output, (tdata_t) " /Colors ", 9);
--				_TIFFmemset(buffer, 0x00, 16);
--				buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel);
-+				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_samplesperpixel);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19);
--				_TIFFmemset(buffer, 0x00, 16);
--				buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
-+				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
- 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 				written += t2pWriteFile(output, (tdata_t) ">>\n", 3);
- 			}
-@@ -5137,16 +5107,16 @@
- tsize_t t2p_write_pdf_xreftable(T2P* t2p, TIFF* output){
- 
- 	tsize_t written=0;
--	char buffer[21];
-+	char buffer[64];
- 	int buflen=0;
- 	uint32 i=0;
- 
- 	written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7);
--	buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
- 	written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22);
- 	for (i=0;i<t2p->pdf_xrefcount;i++){
--		sprintf(buffer, "%.10lu 00000 n \n",
-+		snprintf(buffer, sizeof(buffer), "%.10lu 00000 n \n",
- 			(unsigned long)t2p->pdf_xrefoffsets[i]);
- 		written += t2pWriteFile(output, (tdata_t) buffer, 20);
- 	}
-@@ -5170,17 +5140,14 @@
- 		snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand());
- 
- 	written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17);
--	buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
-+	buflen = snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
--	_TIFFmemset(buffer, 0x00, 32);	
- 	written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7);
--	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_catalog);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
--	_TIFFmemset(buffer, 0x00, 32);	
- 	written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12);
--	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_info);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
--	_TIFFmemset(buffer, 0x00, 32);	
- 	written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11);
- 	written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
- 				sizeof(t2p->pdf_fileid) - 1);
-@@ -5188,9 +5155,8 @@
- 	written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
- 				sizeof(t2p->pdf_fileid) - 1);
- 	written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16);
--	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref);
-+	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_startxref);
- 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
--	_TIFFmemset(buffer, 0x00, 32);	
- 	written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7);
- 
- 	return(written);
-Index: tiff-4.0.3/tools/tiff2ps.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2ps.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/tiff2ps.c	2013-06-23 10:36:51.155629481 -0400
-@@ -1781,8 +1781,8 @@
- 		imageOp = "imagemask";
- 
- 	(void)strcpy(im_x, "0");
--	(void)sprintf(im_y, "%lu", (long) h);
--	(void)sprintf(im_h, "%lu", (long) h);
-+	(void)snprintf(im_y, sizeof(im_y), "%lu", (long) h);
-+	(void)snprintf(im_h, sizeof(im_h), "%lu", (long) h);
- 	tile_width = w;
- 	tile_height = h;
- 	if (TIFFIsTiled(tif)) {
-@@ -1803,7 +1803,7 @@
- 		}
- 		if (tile_height < h) {
- 			fputs("/im_y 0 def\n", fd);
--			(void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
-+			(void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
- 		}
- 	} else {
- 		repeat_count = tf_numberstrips;
-@@ -1815,7 +1815,7 @@
- 			fprintf(fd, "/im_h %lu def\n",
- 			    (unsigned long) tile_height);
- 			(void)strcpy(im_h, "im_h");
--			(void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
-+			(void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
- 		}
- 	}
- 
-Index: tiff-4.0.3/tools/tiffcrop.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiffcrop.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/tiffcrop.c	2013-06-23 10:36:51.159629481 -0400
-@@ -2077,7 +2077,7 @@
-         return 1;
-         }
- 
--      sprintf (filenum, "-%03d%s", findex, export_ext);
-+      snprintf(filenum, sizeof(filenum), "-%03d%s", findex, export_ext);
-       filenum[14] = '\0';
-       strncat (exportname, filenum, 15);
-       }
-@@ -2230,8 +2230,8 @@
- 
-           /* dump.infilename is guaranteed to be NUL termimated and have 20 bytes 
-              fewer than PATH_MAX */ 
--          memset (temp_filename, '\0', PATH_MAX + 1);              
--          sprintf (temp_filename, "%s-read-%03d.%s", dump.infilename, dump_images,
-+          snprintf(temp_filename, sizeof(temp_filename), "%s-read-%03d.%s",
-+		   dump.infilename, dump_images,
-                   (dump.format == DUMP_TEXT) ? "txt" : "raw");
-           if ((dump.infile = fopen(temp_filename, dump.mode)) == NULL)
-             {
-@@ -2249,8 +2249,8 @@
- 
-           /* dump.outfilename is guaranteed to be NUL termimated and have 20 bytes 
-              fewer than PATH_MAX */ 
--          memset (temp_filename, '\0', PATH_MAX + 1);              
--          sprintf (temp_filename, "%s-write-%03d.%s", dump.outfilename, dump_images,
-+          snprintf(temp_filename, sizeof(temp_filename), "%s-write-%03d.%s",
-+		   dump.outfilename, dump_images,
-                   (dump.format == DUMP_TEXT) ? "txt" : "raw");
-           if ((dump.outfile = fopen(temp_filename, dump.mode)) == NULL)
-             {
-Index: tiff-4.0.3/tools/tiff2bw.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2bw.c	2013-06-23 10:36:51.163629483 -0400
-+++ tiff-4.0.3/tools/tiff2bw.c	2013-06-23 10:36:51.159629481 -0400
-@@ -205,7 +205,7 @@
- 		}
- 	}
- 	TIFFSetField(out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_MINISBLACK);
--	sprintf(thing, "B&W version of %s", argv[optind]);
-+	snprintf(thing, sizeof(thing), "B&W version of %s", argv[optind]);
- 	TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
- 	TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw");
- 	outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4231.patch b/gnu/packages/patches/libtiff-CVE-2013-4231.patch
deleted file mode 100644
index c71f7dac2ee94c165c11b31fcdd5c7d13c2a3d8f..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-4231.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Copied from Debian
-
-Description: Buffer overflow in gif2tiff
-Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2450
-Bug-Debian: http://bugs.debian.org/719303
-
-Index: tiff-4.0.3/tools/gif2tiff.c
-===================================================================
---- tiff-4.0.3.orig/tools/gif2tiff.c	2013-08-22 11:46:11.960846910 -0400
-+++ tiff-4.0.3/tools/gif2tiff.c	2013-08-22 11:46:11.956846910 -0400
-@@ -333,6 +333,8 @@
-     int status = 1;
- 
-     datasize = getc(infile);
-+    if (datasize > 12)
-+	return 0;
-     clear = 1 << datasize;
-     eoi = clear + 1;
-     avail = clear + 2;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4232.patch b/gnu/packages/patches/libtiff-CVE-2013-4232.patch
deleted file mode 100644
index 3a92f61fef17e6661c307a24c535e492f8357c2f..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-4232.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Copied from Debian
-
-Description: use after free in tiff2pdf
-Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2449
-Bug-Debian: http://bugs.debian.org/719303
-
-Index: tiff-4.0.3/tools/tiff2pdf.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-08-22 11:46:37.292847242 -0400
-+++ tiff-4.0.3/tools/tiff2pdf.c	2013-08-22 11:46:37.292847242 -0400
-@@ -2461,7 +2461,8 @@
- 					(unsigned long) t2p->tiff_datasize, 
- 					TIFFFileName(input));
- 				t2p->t2p_error = T2P_ERR_ERROR;
--			  _TIFFfree(buffer);
-+				_TIFFfree(buffer);
-+				return(0);
- 			} else {
- 				buffer=samplebuffer;
- 				t2p->tiff_datasize *= t2p->tiff_samplesperpixel;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4243.patch b/gnu/packages/patches/libtiff-CVE-2013-4243.patch
deleted file mode 100644
index a10884cd899cbbf4b2ad2f7bef042b094d1df29e..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-4243.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Copied from Debian
-
-Index: tiff/tools/gif2tiff.c
-===================================================================
---- tiff.orig/tools/gif2tiff.c
-+++ tiff/tools/gif2tiff.c
-@@ -280,6 +280,10 @@ readgifimage(char* mode)
-         fprintf(stderr, "no colormap present for image\n");
-         return (0);
-     }
-+    if (width == 0 || height == 0) {
-+        fprintf(stderr, "Invalid value of width or height\n");
-+        return(0);
-+    }
-     if ((raster = (unsigned char*) _TIFFmalloc(width*height+EXTRAFUDGE)) == NULL) {
-         fprintf(stderr, "not enough memory for image\n");
-         return (0);
-@@ -404,6 +408,10 @@ process(register int code, unsigned char
-             fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
-             return 0;
-         }
-+        if (*fill >= raster + width*height) {
-+            fprintf(stderr, "raster full before eoi code\n");
-+            return 0;
-+        }
- 	*(*fill)++ = suffix[code];
- 	firstchar = oldcode = code;
- 	return 1;
-@@ -434,6 +442,10 @@ process(register int code, unsigned char
-     }
-     oldcode = incode;
-     do {
-+        if (*fill >= raster + width*height) {
-+            fprintf(stderr, "raster full before eoi code\n");
-+            return 0;
-+        }
- 	*(*fill)++ = *--stackp;
-     } while (stackp > stack);
-     return 1;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4244.patch b/gnu/packages/patches/libtiff-CVE-2013-4244.patch
deleted file mode 100644
index be9c65c3119c56a9ae1bba754a2d6c72dccd74df..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2013-4244.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-Copied from Debian
-
-Description: OOB write in gif2tiff
-Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=996468
-
-Index: tiff-4.0.3/tools/gif2tiff.c
-===================================================================
---- tiff-4.0.3.orig/tools/gif2tiff.c	2013-08-24 11:17:13.546447901 -0400
-+++ tiff-4.0.3/tools/gif2tiff.c	2013-08-24 11:17:13.546447901 -0400
-@@ -400,6 +400,10 @@
-     }
- 
-     if (oldcode == -1) {
-+        if (code >= clear) {
-+            fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
-+            return 0;
-+        }
- 	*(*fill)++ = suffix[code];
- 	firstchar = oldcode = code;
- 	return 1;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch
deleted file mode 100644
index 7f70edb86fbe5a33cd16114629f9241f667c63f5..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-Copied from Debian
-
-From 0782c759084daaf9e4de7ee6be7543081823455e Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 20:58:29 +0000
-Subject: [PATCH] * tools/tiff2bw.c: when Photometric=RGB, the utility only
- works if SamplesPerPixel = 3. Enforce that
- http://bugzilla.maptools.org/show_bug.cgi?id=2485 (CVE-2014-8127)
-
----
- ChangeLog       | 6 ++++++
- tools/tiff2bw.c | 5 +++++
- 2 files changed, 11 insertions(+)
-
-diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
-index 22467cd..94b8e31 100644
---- a/tools/tiff2bw.c
-+++ b/tools/tiff2bw.c
-@@ -171,6 +171,11 @@ main(int argc, char* argv[])
- 		    argv[optind], samplesperpixel);
- 		return (-1);
- 	}
-+	if( photometric == PHOTOMETRIC_RGB && samplesperpixel != 3) {
-+		fprintf(stderr, "%s: Bad samples/pixel %u for PHOTOMETRIC_RGB.\n",
-+		    argv[optind], samplesperpixel);
-+		return (-1);
-+	}
- 	TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bitspersample);
- 	if (bitspersample != 8) {
- 		fprintf(stderr,
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch
deleted file mode 100644
index a177ebfa2118a3cf402528dfe9eb3d2ca25dddf1..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Copied from Debian
-
-From 3996fa0f84f4a8b7e65fe4b8f0681711022034ea Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 20:04:31 +0000
-Subject: [PATCH] * tools/pal2rgb.c, tools/thumbnail.c: fix crash by disabling
- TIFFTAG_INKNAMES copying. The right fix would be to properly copy it, but not
- worth the burden for those esoteric utilities.
- http://bugzilla.maptools.org/show_bug.cgi?id=2484 (CVE-2014-8127)
-
----
- ChangeLog         | 7 +++++++
- tools/pal2rgb.c   | 2 +-
- tools/thumbnail.c | 2 +-
- 3 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
-index bfe7899..3fc3de3 100644
---- a/tools/pal2rgb.c
-+++ b/tools/pal2rgb.c
-@@ -372,7 +372,7 @@ static struct cpTag {
-     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
-     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
-     { TIFFTAG_INKSET,			1, TIFF_SHORT },
--    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
-+    /*{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },*/ /* Needs much more complicated logic. See tiffcp */
-     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
-     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
-     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
-diff --git a/tools/thumbnail.c b/tools/thumbnail.c
-index c50bbff..73f9c34 100644
---- a/tools/thumbnail.c
-+++ b/tools/thumbnail.c
-@@ -257,7 +257,7 @@ static struct cpTag {
-     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
-     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
-     { TIFFTAG_INKSET,			1, TIFF_SHORT },
--    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
-+    /*{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },*/ /* Needs much more complicated logic. See tiffcp */
-     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
-     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
-     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch
deleted file mode 100644
index b8a3703c4c66f846dd40d1a4deae7cdab9c04116..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Copied from Debian
-
-From 1f7359b00663804d96c3a102bcb6ead9812c1509 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Tue, 23 Dec 2014 10:15:35 +0000
-Subject: [PATCH] * libtiff/tif_read.c: fix several invalid comparisons of a
- uint64 value with <= 0 by casting it to int64 first. This solves crashing bug
- on corrupted images generated by afl.
-
----
- ChangeLog          | 6 ++++++
- libtiff/tif_read.c | 6 +++---
- 2 files changed, 9 insertions(+), 3 deletions(-)
-
-diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
-index 2ba822a..dfc5b07 100644
---- a/libtiff/tif_read.c
-+++ b/libtiff/tif_read.c
-@@ -458,7 +458,7 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
- 		return ((tmsize_t)(-1));
- 	}
- 	bytecount = td->td_stripbytecount[strip];
--	if (bytecount <= 0) {
-+	if ((int64)bytecount <= 0) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 		TIFFErrorExt(tif->tif_clientdata, module,
- 			     "%I64u: Invalid strip byte count, strip %lu",
-@@ -498,7 +498,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[strip];
--		if (bytecount <= 0) {
-+		if ((int64)bytecount <= 0) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"Invalid strip byte count %I64u, strip %lu",
-@@ -801,7 +801,7 @@ TIFFFillTile(TIFF* tif, uint32 tile)
- 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
- 	{
- 		uint64 bytecount = td->td_stripbytecount[tile];
--		if (bytecount <= 0) {
-+		if ((int64)bytecount <= 0) {
- #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
- 			TIFFErrorExt(tif->tif_clientdata, module,
- 				"%I64u: Invalid tile byte count, tile %lu",
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch
deleted file mode 100644
index 62d903c6503cbe0b4e43484bbc2c915787595153..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch
+++ /dev/null
@@ -1,295 +0,0 @@
-Copied from Debian
-
-From 662f74445b2fea2eeb759c6524661118aef567ca Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 15:15:31 +0000
-Subject: [PATCH] Fix various crasher bugs on fuzzed images. *
- libtiff/tif_dir.c: TIFFSetField(): refuse to set negative values for
- TIFFTAG_XRESOLUTION and TIFFTAG_YRESOLUTION that cause asserts when writing
- the directory * libtiff/tif_dirread.c: TIFFReadDirectory(): refuse to read
- ColorMap or TransferFunction if BitsPerSample has not yet been read,
- otherwise reading it later will cause user code to crash if BitsPerSample > 1
- * libtiff/tif_getimage.c: TIFFRGBAImageOK(): return FALSE if LOGLUV with
- SamplesPerPixel != 3, or if CIELAB with SamplesPerPixel != 3 or BitsPerSample
- != 8 * libtiff/tif_next.c: in the "run mode", use tilewidth for tiled images
- instead of imagewidth to avoid crash * tools/bmp2tiff.c: fix crash due to int
- overflow related to input BMP dimensions * tools/tiff2pdf.c: fix crash due to
- invalid tile count (should likely be checked by libtiff too). Detect invalid
- settings of BitsPerSample/SamplesPerPixel for CIELAB / ITULAB *
- tools/tiffcrop.c: fix crash due to invalid TileWidth/TileHeight *
- tools/tiffdump.c: fix crash due to overflow of entry count.
-
----
- ChangeLog              | 19 +++++++++++++++++++
- libtiff/tif_dir.c      | 21 +++++++++++++++++++--
- libtiff/tif_dirread.c  | 17 +++++++++++++++++
- libtiff/tif_getimage.c | 15 +++++++++++++++
- libtiff/tif_next.c     |  2 ++
- tools/bmp2tiff.c       | 15 +++++++++++++++
- tools/tiff2pdf.c       | 41 +++++++++++++++++++++++++++++++++++++++++
- tools/tiffcrop.c       |  7 ++++---
- tools/tiffdump.c       |  9 ++++++---
- 9 files changed, 138 insertions(+), 8 deletions(-)
-
-diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
-index 98cf66d..ab43a28 100644
---- a/libtiff/tif_dir.c
-+++ b/libtiff/tif_dir.c
-@@ -160,6 +160,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
- 	TIFFDirectory* td = &tif->tif_dir;
- 	int status = 1;
- 	uint32 v32, i, v;
-+    double dblval;
- 	char* s;
- 	const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
- 	uint32 standard_tag = tag;
-@@ -284,10 +285,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
- 			setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
- 		break;
- 	case TIFFTAG_XRESOLUTION:
--		td->td_xresolution = (float) va_arg(ap, double);
-+        dblval = va_arg(ap, double);
-+        if( dblval < 0 )
-+            goto badvaluedouble;
-+		td->td_xresolution = (float) dblval;
- 		break;
- 	case TIFFTAG_YRESOLUTION:
--		td->td_yresolution = (float) va_arg(ap, double);
-+        dblval = va_arg(ap, double);
-+        if( dblval < 0 )
-+            goto badvaluedouble;
-+		td->td_yresolution = (float) dblval;
- 		break;
- 	case TIFFTAG_PLANARCONFIG:
- 		v = (uint16) va_arg(ap, uint16_vap);
-@@ -694,6 +701,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
- 		va_end(ap);
-         }
- 	return (0);
-+badvaluedouble:
-+        {
-+        const TIFFField* fip=TIFFFieldWithTag(tif,tag);
-+        TIFFErrorExt(tif->tif_clientdata, module,
-+             "%s: Bad value %f for \"%s\" tag",
-+             tif->tif_name, dblval,
-+             fip ? fip->field_name : "Unknown");
-+        va_end(ap);
-+        }
-+    return (0);
- }
- 
- /*
-diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
-index 391c823..f66c9a7 100644
---- a/libtiff/tif_dirread.c
-+++ b/libtiff/tif_dirread.c
-@@ -3430,6 +3430,8 @@ TIFFReadDirectory(TIFF* tif)
- 	const TIFFField* fip;
- 	uint32 fii=FAILED_FII;
-         toff_t nextdiroff;
-+    int bitspersample_read = FALSE;
-+
- 	tif->tif_diroff=tif->tif_nextdiroff;
- 	if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
- 		return 0;           /* last offset or bad offset (IFD looping) */
-@@ -3706,6 +3708,8 @@ TIFFReadDirectory(TIFF* tif)
- 					}
- 					if (!TIFFSetField(tif,dp->tdir_tag,value))
- 						goto bad;
-+                    if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
-+                        bitspersample_read = TRUE;
- 				}
- 				break;
- 			case TIFFTAG_SMINSAMPLEVALUE:
-@@ -3763,6 +3767,19 @@ TIFFReadDirectory(TIFF* tif)
- 					uint32 countrequired;
- 					uint32 incrementpersample;
- 					uint16* value=NULL;
-+                    /* It would be dangerous to instanciate those tag values */
-+                    /* since if td_bitspersample has not yet been read (due to */
-+                    /* unordered tags), it could be read afterwards with a */
-+                    /* values greater than the default one (1), which may cause */
-+                    /* crashes in user code */
-+                    if( !bitspersample_read )
-+                    {
-+                        fip = TIFFFieldWithTag(tif,dp->tdir_tag);
-+                        TIFFWarningExt(tif->tif_clientdata,module,
-+                                       "Ignoring %s since BitsPerSample tag not found",
-+                                       fip ? fip->field_name : "unknown tagname");
-+                        continue;
-+                    }
- 					countpersample=(1L<<tif->tif_dir.td_bitspersample);
- 					if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
- 					{
-diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
-index 074d32a..396ad08 100644
---- a/libtiff/tif_getimage.c
-+++ b/libtiff/tif_getimage.c
-@@ -182,8 +182,23 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
- 				    "Planarconfiguration", td->td_planarconfig);
- 				return (0);
- 			}
-+			if( td->td_samplesperpixel != 3 )
-+            {
-+                sprintf(emsg,
-+                        "Sorry, can not handle image with %s=%d",
-+                        "Samples/pixel", td->td_samplesperpixel);
-+                return 0;
-+            }
- 			break;
- 		case PHOTOMETRIC_CIELAB:
-+            if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
-+            {
-+                sprintf(emsg,
-+                        "Sorry, can not handle image with %s=%d and %s=%d",
-+                        "Samples/pixel", td->td_samplesperpixel,
-+                        "Bits/sample", td->td_bitspersample);
-+                return 0;
-+            }
- 			break;
- 		default:
- 			sprintf(emsg, "Sorry, can not handle image with %s=%d",
-diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
-index 55e2537..a53c716 100644
---- a/libtiff/tif_next.c
-+++ b/libtiff/tif_next.c
-@@ -102,6 +102,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
- 		default: {
- 			uint32 npixels = 0, grey;
- 			uint32 imagewidth = tif->tif_dir.td_imagewidth;
-+            if( isTiled(tif) )
-+                imagewidth = tif->tif_dir.td_tilewidth;
- 
- 			/*
- 			 * The scanline is composed of a sequence of constant
-diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
-index dfda963..f202b41 100644
---- a/tools/tiff2pdf.c
-+++ b/tools/tiff2pdf.c
-@@ -1167,6 +1167,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
- 		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
- 			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
- 				TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);
-+                if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )
-+                {
-+                    TIFFError(
-+                        TIFF2PDF_MODULE, 
-+                        "Invalid tile count, %s", 
-+                        TIFFFileName(input));
-+                    t2p->t2p_error = T2P_ERR_ERROR;
-+                    return;
-+                }
- 				t2p->tiff_tiles[i].tiles_tilecount/= xuint16;
- 		}
- 		if( t2p->tiff_tiles[i].tiles_tilecount > 0){
-@@ -1552,6 +1561,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
- #endif
- 			break;
- 		case PHOTOMETRIC_CIELAB:
-+            if( t2p->tiff_samplesperpixel != 3){
-+                TIFFError(
-+                    TIFF2PDF_MODULE, 
-+                    "Unsupported samplesperpixel = %d for CIELAB", 
-+                    t2p->tiff_samplesperpixel);
-+                t2p->t2p_error = T2P_ERR_ERROR;
-+                return;
-+            }
-+            if( t2p->tiff_bitspersample != 8){
-+                TIFFError(
-+                    TIFF2PDF_MODULE, 
-+                    "Invalid bitspersample = %d for CIELAB", 
-+                    t2p->tiff_bitspersample);
-+                t2p->t2p_error = T2P_ERR_ERROR;
-+                return;
-+            }
- 			t2p->pdf_labrange[0]= -127;
- 			t2p->pdf_labrange[1]= 127;
- 			t2p->pdf_labrange[2]= -127;
-@@ -1567,6 +1592,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
- 			t2p->pdf_colorspace=T2P_CS_LAB;
- 			break;
- 		case PHOTOMETRIC_ITULAB:
-+            if( t2p->tiff_samplesperpixel != 3){
-+                TIFFError(
-+                    TIFF2PDF_MODULE, 
-+                    "Unsupported samplesperpixel = %d for ITULAB", 
-+                    t2p->tiff_samplesperpixel);
-+                t2p->t2p_error = T2P_ERR_ERROR;
-+                return;
-+            }
-+            if( t2p->tiff_bitspersample != 8){
-+                TIFFError(
-+                    TIFF2PDF_MODULE, 
-+                    "Invalid bitspersample = %d for ITULAB", 
-+                    t2p->tiff_bitspersample);
-+                t2p->t2p_error = T2P_ERR_ERROR;
-+                return;
-+            }
- 			t2p->pdf_labrange[0]=-85;
- 			t2p->pdf_labrange[1]=85;
- 			t2p->pdf_labrange[2]=-75;
-diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
-index f5530bb..4088463 100644
---- a/tools/tiffcrop.c
-+++ b/tools/tiffcrop.c
-@@ -1205,9 +1205,10 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
-   tsize_t tilesize = TIFFTileSize(out);
-   unsigned char *tilebuf = NULL;
- 
--  TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
--  TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
--  TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
-+  if( !TIFFGetField(out, TIFFTAG_TILELENGTH, &tl) ||
-+      !TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw) ||
-+      !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
-+      return 1;
- 
-   tile_buffsize = tilesize;
-   if (tilesize < (tsize_t)(tl * tile_rowsize))
-diff --git a/tools/tiffdump.c b/tools/tiffdump.c
-index cf5d62f..8247765 100644
---- a/tools/tiffdump.c
-+++ b/tools/tiffdump.c
-@@ -374,6 +374,8 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
- 		void* datamem;
- 		uint64 dataoffset;
- 		int datatruncated;
-+        int datasizeoverflow;
-+
- 		tag = *(uint16*)dp;
- 		if (swabflag)
- 			TIFFSwabShort(&tag);
-@@ -412,13 +414,14 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
- 		else
- 			typewidth = datawidth[type];
- 		datasize = count*typewidth;
-+        datasizeoverflow = (typewidth > 0 && datasize / typewidth != count);
- 		datafits = 1;
- 		datamem = dp;
- 		dataoffset = 0;
- 		datatruncated = 0;
- 		if (!bigtiff)
- 		{
--			if (datasize>4)
-+			if (datasizeoverflow || datasize>4)
- 			{
- 				uint32 dataoffset32;
- 				datafits = 0;
-@@ -432,7 +435,7 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
- 		}
- 		else
- 		{
--			if (datasize>8)
-+			if (datasizeoverflow || datasize>8)
- 			{
- 				datafits = 0;
- 				datamem = NULL;
-@@ -442,7 +445,7 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
- 			}
- 			dp += sizeof(uint64);
- 		}
--		if (datasize>0x10000)
-+		if (datasizeoverflow || datasize>0x10000)
- 		{
- 			datatruncated = 1;
- 			count = 0x10000/typewidth;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch
deleted file mode 100644
index fda018b7bb864ee5c15d0fa697633c084a709234..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-Copied from Debian
-
-From 3206e0c752a62da1ae606867113ed3bf9bf73306 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 19:53:59 +0000
-Subject: [PATCH] * tools/thumbnail.c: fix out-of-buffer write
- http://bugzilla.maptools.org/show_bug.cgi?id=2489 (CVE-2014-8128)
-
----
- ChangeLog         | 5 +++++
- tools/thumbnail.c | 8 +++++++-
- 2 files changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/tools/thumbnail.c b/tools/thumbnail.c
-index fab63f6..c50bbff 100644
---- a/tools/thumbnail.c
-+++ b/tools/thumbnail.c
-@@ -568,7 +568,13 @@ setImage1(const uint8* br, uint32 rw, uint32 rh)
- 	    err -= limit;
- 	    sy++;
- 	    if (err >= limit)
--		rows[nrows++] = br + bpr*sy;
-+		{
-+			/* We should perhaps error loudly, but I can't make sense of that */
-+			/* code... */
-+			if( nrows == 256 )
-+				break;
-+			rows[nrows++] = br + bpr*sy;
-+		}
- 	}
- 	setrow(row, nrows, rows);
- 	row += tnw;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch
deleted file mode 100644
index 6f9ef85d14b0d71431b85c965ce8bb33702ac344..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch
+++ /dev/null
@@ -1,83 +0,0 @@
-Copied from Debian
-
-From 8b6e80fca434525497e5a31c3309a3bab5b3c1c8 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 18:52:42 +0000
-Subject: [PATCH] * tools/thumbnail.c, tools/tiffcmp.c: only read/write
- TIFFTAG_GROUP3OPTIONS or TIFFTAG_GROUP4OPTIONS if compression is
- COMPRESSION_CCITTFAX3 or COMPRESSION_CCITTFAX4
- http://bugzilla.maptools.org/show_bug.cgi?id=2493 (CVE-2014-8128)
-
----
- ChangeLog         |  7 +++++++
- tools/thumbnail.c | 21 ++++++++++++++++++++-
- tools/tiffcmp.c   | 17 +++++++++++++++--
- 3 files changed, 42 insertions(+), 3 deletions(-)
-
-diff --git a/tools/thumbnail.c b/tools/thumbnail.c
-index a98a881..fab63f6 100644
---- a/tools/thumbnail.c
-+++ b/tools/thumbnail.c
-@@ -274,7 +274,26 @@ cpTags(TIFF* in, TIFF* out)
- {
-     struct cpTag *p;
-     for (p = tags; p < &tags[NTAGS]; p++)
--	cpTag(in, out, p->tag, p->count, p->type);
-+	{
-+		/* Horrible: but TIFFGetField() expects 2 arguments to be passed */
-+		/* if we request a tag that is defined in a codec, but that codec */
-+		/* isn't used */
-+		if( p->tag == TIFFTAG_GROUP3OPTIONS )
-+		{
-+			uint16 compression;
-+			if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
-+				compression != COMPRESSION_CCITTFAX3 )
-+				continue;
-+		}
-+		if( p->tag == TIFFTAG_GROUP4OPTIONS )
-+		{
-+			uint16 compression;
-+			if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
-+				compression != COMPRESSION_CCITTFAX4 )
-+				continue;
-+		}
-+		cpTag(in, out, p->tag, p->count, p->type);
-+	}
- }
- #undef NTAGS
- 
-diff --git a/tools/tiffcmp.c b/tools/tiffcmp.c
-index 508a461..d6392af 100644
---- a/tools/tiffcmp.c
-+++ b/tools/tiffcmp.c
-@@ -260,6 +260,7 @@ tiffcmp(TIFF* tif1, TIFF* tif2)
- static int
- cmptags(TIFF* tif1, TIFF* tif2)
- {
-+	uint16 compression1, compression2;
- 	CmpLongField(TIFFTAG_SUBFILETYPE,	"SubFileType");
- 	CmpLongField(TIFFTAG_IMAGEWIDTH,	"ImageWidth");
- 	CmpLongField(TIFFTAG_IMAGELENGTH,	"ImageLength");
-@@ -276,8 +277,20 @@ cmptags(TIFF* tif1, TIFF* tif2)
- 	CmpShortField(TIFFTAG_SAMPLEFORMAT,	"SampleFormat");
- 	CmpFloatField(TIFFTAG_XRESOLUTION,	"XResolution");
- 	CmpFloatField(TIFFTAG_YRESOLUTION,	"YResolution");
--	CmpLongField(TIFFTAG_GROUP3OPTIONS,	"Group3Options");
--	CmpLongField(TIFFTAG_GROUP4OPTIONS,	"Group4Options");
-+	if( TIFFGetField(tif1, TIFFTAG_COMPRESSION, &compression1) &&
-+		compression1 == COMPRESSION_CCITTFAX3 &&
-+		TIFFGetField(tif2, TIFFTAG_COMPRESSION, &compression2) &&
-+		compression2 == COMPRESSION_CCITTFAX3 )
-+	{
-+		CmpLongField(TIFFTAG_GROUP3OPTIONS,	"Group3Options");
-+	}
-+	if( TIFFGetField(tif1, TIFFTAG_COMPRESSION, &compression1) &&
-+		compression1 == COMPRESSION_CCITTFAX4 &&
-+		TIFFGetField(tif2, TIFFTAG_COMPRESSION, &compression2) &&
-+		compression2 == COMPRESSION_CCITTFAX4 )
-+	{
-+		CmpLongField(TIFFTAG_GROUP4OPTIONS,	"Group4Options");
-+	}
- 	CmpShortField(TIFFTAG_RESOLUTIONUNIT,	"ResolutionUnit");
- 	CmpShortField(TIFFTAG_PLANARCONFIG,	"PlanarConfiguration");
- 	CmpLongField(TIFFTAG_ROWSPERSTRIP,	"RowsPerStrip");
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch
deleted file mode 100644
index 200af0ef8b1bdb137e62093b47b249aaa3ff8ec6..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-Copied from Debian
-
-From 266bc48054b018a2f1d74562aa48eb2f509436d5 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 17:36:36 +0000
-Subject: [PATCH] * tools/tiff2pdf.c: check return code of TIFFGetField() when
- reading TIFFTAG_SAMPLESPERPIXEL
-
----
- ChangeLog        |  5 +++++
- tools/tiff2pdf.c | 10 +++++++++-
- 2 files changed, 14 insertions(+), 1 deletion(-)
-
-Index: tiff-4.0.3/tools/tiff2pdf.c
-===================================================================
---- tiff-4.0.3.orig/tools/tiff2pdf.c
-+++ tiff-4.0.3/tools/tiff2pdf.c
-@@ -1164,7 +1164,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF*
- 			t2p->tiff_pages[i].page_tilecount;
- 		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
- 			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
--				TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);
-+				if( !TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16) )
-+				{
-+					TIFFError(
-+                        TIFF2PDF_MODULE, 
-+                        "Missing SamplesPerPixel, %s", 
-+                        TIFFFileName(input));
-+                    t2p->t2p_error = T2P_ERR_ERROR;
-+                    return;
-+				}
-                 if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )
-                 {
-                     TIFFError(
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch
deleted file mode 100644
index fda4045504fa740eacccd3cdbc01e9d49439c6cf..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch
+++ /dev/null
@@ -1,77 +0,0 @@
-Copied from Debian
-
-Picked from CVE: diff -u -r1.14 -r1.15
-http://bugzilla.maptools.org/show_bug.cgi?id=2501
-
-Author: Even Rouault <even.rouault@spatialys.com>
-
---- tiff-4.0.3.orig/tools/tiffdither.c
-+++ tiff-4.0.3/tools/tiffdither.c
-@@ -39,6 +39,7 @@
- #endif
- 
- #include "tiffio.h"
-+#include "tiffiop.h"
- 
- #define	streq(a,b)	(strcmp(a,b) == 0)
- #define	strneq(a,b,n)	(strncmp(a,b,n) == 0)
-@@ -56,7 +57,7 @@ static	void usage(void);
-  * Floyd-Steinberg error propragation with threshold.
-  * This code is stolen from tiffmedian.
-  */
--static void
-+static int
- fsdither(TIFF* in, TIFF* out)
- {
- 	unsigned char *outline, *inputline, *inptr;
-@@ -68,14 +69,19 @@ fsdither(TIFF* in, TIFF* out)
- 	int lastline, lastpixel;
- 	int bit;
- 	tsize_t outlinesize;
-+	int errcode = 0;
- 
- 	imax = imagelength - 1;
- 	jmax = imagewidth - 1;
- 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
--	thisline = (short *)_TIFFmalloc(imagewidth * sizeof (short));
--	nextline = (short *)_TIFFmalloc(imagewidth * sizeof (short));
-+	thisline = (short *)_TIFFmalloc(TIFFSafeMultiply(tmsize_t, imagewidth, sizeof (short)));
-+	nextline = (short *)_TIFFmalloc(TIFFSafeMultiply(tmsize_t, imagewidth, sizeof (short)));
- 	outlinesize = TIFFScanlineSize(out);
- 	outline = (unsigned char *) _TIFFmalloc(outlinesize);
-+	if (! (inputline && thisline && nextline && outline)) {
-+	    fprintf(stderr, "Out of memory.\n");
-+	    goto skip_on_error;
-+	}
- 
- 	/*
- 	 * Get first line
-@@ -93,7 +99,7 @@ fsdither(TIFF* in, TIFF* out)
- 		nextline = tmpptr;
- 		lastline = (i == imax);
- 		if (TIFFReadScanline(in, inputline, i, 0) <= 0)
--			break;
-+			goto skip_on_error;
- 		inptr = inputline;
- 		nextptr = nextline;
- 		for (j = 0; j < imagewidth; ++j)
-@@ -131,13 +137,18 @@ fsdither(TIFF* in, TIFF* out)
- 			}
- 		}
- 		if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
--			break;
-+			goto skip_on_error;
- 	}
-+	goto exit_label;
-+
-   skip_on_error:
-+	errcode = 1;
-+  exit_label:
- 	_TIFFfree(inputline);
- 	_TIFFfree(thisline);
- 	_TIFFfree(nextline);
- 	_TIFFfree(outline);
-+	return errcode;
- }
- 
- static	uint16 compression = COMPRESSION_PACKBITS;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch
deleted file mode 100644
index a555a187479382e42aedc8daecedd504a2a823b4..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Copied from Debian
-
-Patches by Petr Gajdos (pgajdos@suse.cz) from
-http://bugzilla.maptools.org/show_bug.cgi?id=2499
-
---- tiff-4.0.3.orig/libtiff/tif_dirinfo.c
-+++ tiff-4.0.3/libtiff/tif_dirinfo.c
-@@ -141,6 +141,8 @@ tiffFields[] = {
- 	{ TIFFTAG_FAXDCS, -1, -1, TIFF_ASCII, 0, TIFF_SETGET_ASCII, TIFF_SETGET_ASCII, FIELD_CUSTOM, TRUE, FALSE, "FaxDcs", NULL },
- 	{ TIFFTAG_STONITS, 1, 1, TIFF_DOUBLE, 0, TIFF_SETGET_DOUBLE, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "StoNits", NULL },
- 	{ TIFFTAG_INTEROPERABILITYIFD, 1, 1, TIFF_IFD8, 0, TIFF_SETGET_UNDEFINED, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "InteroperabilityIFDOffset", NULL },
-+	{ TIFFTAG_CONSECUTIVEBADFAXLINES, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32, TIFF_SETGET_UINT32, FIELD_CUSTOM, TRUE, FALSE, "ConsecutiveBadFaxLines", NULL },
-+        { TIFFTAG_PREDICTOR, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UINT16, FIELD_CUSTOM, FALSE, FALSE, "Predictor", NULL },
- 	/* begin DNG tags */
- 	{ TIFFTAG_DNGVERSION, 4, 4, TIFF_BYTE, 0, TIFF_SETGET_C0_UINT8, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "DNGVersion", NULL },
- 	{ TIFFTAG_DNGBACKWARDVERSION, 4, 4, TIFF_BYTE, 0, TIFF_SETGET_C0_UINT8, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "DNGBackwardVersion", NULL },
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8129.patch b/gnu/packages/patches/libtiff-CVE-2014-8129.patch
deleted file mode 100644
index 091ec8f5739344edb1b75fb21aa22ac69ab59081..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-8129.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Copied from Debian
-
-From cd82b5267ad4c10eb91e4ee8a716a81362cf851c Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Sun, 21 Dec 2014 18:07:48 +0000
-Subject: [PATCH] * libtiff/tif_next.c: check that BitsPerSample = 2. Fixes
- http://bugzilla.maptools.org/show_bug.cgi?id=2487 (CVE-2014-8129)
-
----
- ChangeLog          |  5 +++++
- libtiff/tif_next.c | 17 +++++++++++++++++
- 2 files changed, 22 insertions(+)
-
-diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
-index a53c716..d834196 100644
---- a/libtiff/tif_next.c
-+++ b/libtiff/tif_next.c
-@@ -141,10 +141,27 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
- 	return (0);
- }
- 
-+static int
-+NeXTPreDecode(TIFF* tif, uint16 s)
-+{
-+	static const char module[] = "NeXTPreDecode";
-+	TIFFDirectory *td = &tif->tif_dir;
-+	(void)s;
-+
-+	if( td->td_bitspersample != 2 )
-+	{
-+		TIFFErrorExt(tif->tif_clientdata, module, "Unsupported BitsPerSample = %d",
-+					 td->td_bitspersample);
-+		return (0);
-+	}
-+	return (1);
-+}
-+	
- int
- TIFFInitNeXT(TIFF* tif, int scheme)
- {
- 	(void) scheme;
-+	tif->tif_predecode = NeXTPreDecode;  
- 	tif->tif_decoderow = NeXTDecode;  
- 	tif->tif_decodestrip = NeXTDecode;  
- 	tif->tif_decodetile = NeXTDecode;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-9330.patch b/gnu/packages/patches/libtiff-CVE-2014-9330.patch
deleted file mode 100644
index c3c5fc03676391e19a725d53f253e638b7696d22..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-9330.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-Copied from Debian
-
-Description: CVE-2014-9330
- Integer overflow in bmp2tiff
-Origin: upstream, http://bugzilla.maptools.org/show_bug.cgi?id=2494
-Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2494
-Bug-Debian: http://bugs.debian.org/773987
-
-Index: tiff/tools/bmp2tiff.c
-===================================================================
---- tiff.orig/tools/bmp2tiff.c
-+++ tiff/tools/bmp2tiff.c
-@@ -1,4 +1,4 @@
--/* $Id: bmp2tiff.c,v 1.23 2010-03-10 18:56:49 bfriesen Exp $
-+/* $Id: bmp2tiff.c,v 1.24 2014-12-21 15:15:32 erouault Exp $
-  *
-  * Project:  libtiff tools
-  * Purpose:  Convert Windows BMP files in TIFF.
-@@ -403,6 +403,13 @@ main(int argc, char* argv[])
- 
- 		width = info_hdr.iWidth;
- 		length = (info_hdr.iHeight > 0) ? info_hdr.iHeight : -info_hdr.iHeight;
-+        if( width <= 0 || length <= 0 )
-+        {
-+            TIFFError(infilename,
-+                  "Invalid dimensions of BMP file" );
-+            close(fd);
-+            return -1;
-+        }
- 
- 		switch (info_hdr.iBitCount)
- 		{
-@@ -593,6 +600,14 @@ main(int argc, char* argv[])
- 
- 			compr_size = file_hdr.iSize - file_hdr.iOffBits;
- 			uncompr_size = width * length;
-+            /* Detect int overflow */
-+            if( uncompr_size / width != length )
-+            {
-+                TIFFError(infilename,
-+                    "Invalid dimensions of BMP file" );
-+                close(fd);
-+                return -1;
-+            }
- 			comprbuf = (unsigned char *) _TIFFmalloc( compr_size );
- 			if (!comprbuf) {
- 				TIFFError(infilename,
diff --git a/gnu/packages/patches/libtiff-CVE-2014-9655.patch b/gnu/packages/patches/libtiff-CVE-2014-9655.patch
deleted file mode 100644
index 065804d03a7a515c60ffa73f73fdb51b70de90c0..0000000000000000000000000000000000000000
--- a/gnu/packages/patches/libtiff-CVE-2014-9655.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-Copied from Debian
-
-From 40a5955cbf0df62b1f9e9bd7d9657b0070725d19 Mon Sep 17 00:00:00 2001
-From: erouault <erouault>
-Date: Mon, 29 Dec 2014 12:09:11 +0000
-Subject: [PATCH] * libtiff/tif_next.c: add new tests to check that we don't
- read outside of the compressed input stream buffer.
-
-* libtiff/tif_getimage.c: in OJPEG case, fix checks on strile width/height
----
- ChangeLog              |  9 +++++++++
- libtiff/tif_getimage.c | 12 +++++++-----
- libtiff/tif_next.c     |  4 +++-
- 3 files changed, 19 insertions(+), 6 deletions(-)
-
-diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
-index a4f46d9..3ad8ee7 100644
---- a/libtiff/tif_getimage.c
-+++ b/libtiff/tif_getimage.c
-@@ -1871,7 +1871,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
- 
-     (void) y;
-     fromskew = (fromskew * 10) / 4;
--    if ((h & 3) == 0 && (w & 1) == 0) {
-+    if ((w & 3) == 0 && (h & 1) == 0) {
-         for (; h >= 2; h -= 2) {
-             x = w>>2;
-             do {
-@@ -1948,7 +1948,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
-     /* XXX adjust fromskew */
-     do {
- 	x = w>>2;
--	do {
-+	while(x>0) {
- 	    int32 Cb = pp[4];
- 	    int32 Cr = pp[5];
- 
-@@ -1959,7 +1959,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
- 
- 	    cp += 4;
- 	    pp += 6;
--	} while (--x);
-+		x--;
-+	}
- 
-         if( (w&3) != 0 )
-         {
-@@ -2050,7 +2051,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
- 	fromskew = (fromskew * 4) / 2;
- 	do {
- 		x = w>>1;
--		do {
-+		while(x>0) {
- 			int32 Cb = pp[2];
- 			int32 Cr = pp[3];
- 
-@@ -2059,7 +2060,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
- 
- 			cp += 2;
- 			pp += 4;
--		} while (--x);
-+			x --;
-+		}
- 
- 		if( (w&1) != 0 )
- 		{
-diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
-index d834196..dd669cc 100644
---- a/libtiff/tif_next.c
-+++ b/libtiff/tif_next.c
-@@ -71,7 +71,7 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
- 		TIFFErrorExt(tif->tif_clientdata, module, "Fractional scanlines cannot be read");
- 		return (0);
- 	}
--	for (row = buf; occ > 0; occ -= scanline, row += scanline) {
-+	for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) {
- 		n = *bp++, cc--;
- 		switch (n) {
- 		case LITERALROW:
-@@ -90,6 +90,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
- 			 * The scanline has a literal span that begins at some
- 			 * offset.
- 			 */
-+			if( cc < 4 )
-+				goto bad;
- 			off = (bp[0] * 256) + bp[1];
- 			n = (bp[2] * 256) + bp[3];
- 			if (cc < 4+n || off+n > scanline)
diff --git a/gnu/packages/patches/openssl-c-rehash.patch b/gnu/packages/patches/openssl-c-rehash.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f873a9af2351b9061d14df0e0e83ab6342029989
--- /dev/null
+++ b/gnu/packages/patches/openssl-c-rehash.patch
@@ -0,0 +1,17 @@
+This patch removes the explicit reference to the 'perl' binary,
+such that OpenSSL does not retain a reference to Perl.
+
+The 'c_rehash' program is seldom used, but it is used nonetheless
+to create symbolic links to certificates, for instance in the 'nss-certs'
+package.
+
+--- openssl-1.0.2d/tools/c_rehash	2015-09-09 18:36:07.313316482 +0200
++++ openssl-1.0.2d/tools/c_rehash	2015-09-09 18:36:28.965458458 +0200
+@@ -1,4 +1,6 @@
+-#!/usr/bin/perl
++eval '(exit $?0)' && eval 'exec perl -wS "$0" ${1+"$@"}'
++  & eval 'exec perl -wS "$0" $argv:q'
++    if 0;
+ 
+ # Perl c_rehash script, scan all files in a directory
+ # and add symbolic links to their hash values.
diff --git a/gnu/packages/patches/perl-autosplit-default-time.patch b/gnu/packages/patches/perl-autosplit-default-time.patch
new file mode 100644
index 0000000000000000000000000000000000000000..e801ac9bfe04550c1ec2db56cb8456a4962c2d36
--- /dev/null
+++ b/gnu/packages/patches/perl-autosplit-default-time.patch
@@ -0,0 +1,15 @@
+AutoSplit will fail to create an index for files whose modification time is 0
+because its default time for a non-existent index is 1.  Set this default time
+to -1 instead.
+
+--- perl-5.16.1/cpan/AutoLoader/lib/AutoSplit.pm.orig	2012-02-14 22:44:36.000000000 -0600
++++ perl-5.16.1/cpan/AutoLoader/lib/AutoSplit.pm	2015-09-09 19:59:22.208708921 -0500
+@@ -361,7 +361,7 @@
+     my($al_idx_file) = catfile($autodir, $modpname, $IndexFile);
+ 
+     if ($check_mod_time){
+-	my($al_ts_time) = (stat("$al_idx_file"))[9] || 1;
++	my($al_ts_time) = (stat("$al_idx_file"))[9] || -1;
+ 	if ($al_ts_time >= $pm_mod_time and
+ 	    $al_ts_time >= $self_mod_time){
+ 	    print "AutoSplit skipped ($al_idx_file newer than $filename)\n"
diff --git a/gnu/packages/patches/pixman-pointer-arithmetic.patch b/gnu/packages/patches/pixman-pointer-arithmetic.patch
new file mode 100644
index 0000000000000000000000000000000000000000..d34e6632a01e7ba946558ef6ca466631cec88cf2
--- /dev/null
+++ b/gnu/packages/patches/pixman-pointer-arithmetic.patch
@@ -0,0 +1,15 @@
+Fix <https://bugs.freedesktop.org/show_bug.cgi?id=92027> whereby
+an arithemitic overflow could occur while doing pointer arithmetic,
+leading pixman to use an invalid address as the destination buffer.
+
+--- pixman-0.32.6/pixman/pixman-general.c	2015-09-21 15:14:34.695981325 +0200
++++ pixman-0.32.6/pixman/pixman-general.c	2015-09-21 15:19:48.898355548 +0200
+@@ -144,8 +144,7 @@ general_composite_rect  (pixman_implemen
+     mask_buffer = ALIGN (src_buffer + width * Bpp);
+     dest_buffer = ALIGN (mask_buffer + width * Bpp);
+ 
+-    if (ALIGN (dest_buffer + width * Bpp) >
+-	    scanline_buffer + sizeof (stack_scanline_buffer))
++    if ((width + 1) * Bpp * 3 > sizeof (stack_scanline_buffer))
+     {
+ 	scanline_buffer = pixman_malloc_ab_plus_c (width, Bpp * 3, 32 * 3);
diff --git a/gnu/packages/patches/util-linux-tests.patch b/gnu/packages/patches/util-linux-tests.patch
index 2ad025f66accd750ffadcabbe17cc79ff2a209f2..f436299b7f8b7601340d8f782d6ba84e14edec07 100644
--- a/gnu/packages/patches/util-linux-tests.patch
+++ b/gnu/packages/patches/util-linux-tests.patch
@@ -16,15 +16,3 @@ using 'getpwnam' in libmount.  This doesn't work in the chroot because
  ts_init_subtest "deduplicate"
  ts_valgrind $TESTPROG --dedup bbb,ccc,AAA,xxx,AAA=a,AAA=bbb,ddd,AAA=ccc,fff=eee AAA &> $TS_OUTPUT
  ts_finalize_subtest
-
-
-The expected output for this test seems to lack a carriage return.
-
---- util-linux-2.25.2/tests/expected/more/regexp	2015-01-23 14:02:21.098557632 +0100
-+++ util-linux-2.25.2/tests/expected/more/regexp	2015-01-23 14:02:23.598573648 +0100
-@@ -1,4 +1,4 @@
- 
- ...skipping
--foo
-+
foo
- xyzzy
diff --git a/gnu/packages/patches/valgrind-glibc-2.21.patch b/gnu/packages/patches/valgrind-glibc-2.22.patch
similarity index 70%
rename from gnu/packages/patches/valgrind-glibc-2.21.patch
rename to gnu/packages/patches/valgrind-glibc-2.22.patch
index 70f809c43fd37687df18c6be7d938035802ed6e7..36c4916cc6883dc7f67e2b89bfbf2b7d003768f6 100644
--- a/gnu/packages/patches/valgrind-glibc-2.21.patch
+++ b/gnu/packages/patches/valgrind-glibc-2.22.patch
@@ -4,10 +4,13 @@ Initial Package Version: 3.10.1
 Upstream Status: Unknown
 Origin: Self
 Description: Allows Valgrind to build with glibc-2.21
+
+Later modified to support glibc-2.22 as well.
+
 diff -Naur valgrind-3.10.1.old/configure valgrind-3.10.1.new/configure
 --- valgrind-3.10.1.old/configure	2014-11-25 20:42:25.000000000 +0100
 +++ valgrind-3.10.1.new/configure	2015-02-22 10:46:06.607826488 +0100
-@@ -6842,6 +6842,16 @@
+@@ -6842,6 +6842,26 @@
  	DEFAULT_SUPP="glibc-2.34567-NPTL-helgrind.supp ${DEFAULT_SUPP}"
  	DEFAULT_SUPP="glibc-2.X-drd.supp ${DEFAULT_SUPP}"
  	;;
@@ -20,6 +23,16 @@ diff -Naur valgrind-3.10.1.old/configure valgrind-3.10.1.new/configure
 +	DEFAULT_SUPP="glibc-2.X.supp ${DEFAULT_SUPP}"
 +	DEFAULT_SUPP="glibc-2.34567-NPTL-helgrind.supp ${DEFAULT_SUPP}"
 +	DEFAULT_SUPP="glibc-2.X-drd.supp ${DEFAULT_SUPP}"
++	;;
++     2.22)
++	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: 2.22 family" >&5
++$as_echo "2.22 family" >&6; }
++
++$as_echo "#define GLIBC_2_22 1" >>confdefs.h
++
++	DEFAULT_SUPP="glibc-2.X.supp ${DEFAULT_SUPP}"
++	DEFAULT_SUPP="glibc-2.34567-NPTL-helgrind.supp ${DEFAULT_SUPP}"
++	DEFAULT_SUPP="glibc-2.X-drd.supp ${DEFAULT_SUPP}"
 +	;;
       darwin)
  	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: Darwin" >&5
diff --git a/gnu/packages/patches/valgrind-linux-libre-4.x.patch b/gnu/packages/patches/valgrind-linux-libre-4.x.patch
new file mode 100644
index 0000000000000000000000000000000000000000..79166619c72c2397ba34dacdab26e52c8e7aae7b
--- /dev/null
+++ b/gnu/packages/patches/valgrind-linux-libre-4.x.patch
@@ -0,0 +1,18 @@
+Modify valgrind's configure script to accept linux-libre-4.x as being in the
+same family as 3.x.
+
+--- valgrind-3.10.1/configure	2015-09-15 18:02:20.710262686 -0400
++++ valgrind-3.10.1/configure	2015-09-15 18:02:59.831829731 -0400
+@@ -5553,9 +5553,9 @@
+         kernel=`uname -r`
+ 
+         case "${kernel}" in
+-             2.6.*|3.*)
+-        	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: 2.6.x/3.x family (${kernel})" >&5
+-$as_echo "2.6.x/3.x family (${kernel})" >&6; }
++             2.6.*|3.*|4.*)
++        	    { $as_echo "$as_me:${as_lineno-$LINENO}: result: 2.6.x/3.x/4.x family (${kernel})" >&5
++$as_echo "2.6.x/3.x/4.x family (${kernel})" >&6; }
+ 
+ $as_echo "#define KERNEL_2_6 1" >>confdefs.h
+ 
diff --git a/gnu/packages/pciutils.scm b/gnu/packages/pciutils.scm
index 7135af44e506aabc7b36088632890f2f24cdb779..e022b6a81df1e11f89d80817f325775b3ff95388 100644
--- a/gnu/packages/pciutils.scm
+++ b/gnu/packages/pciutils.scm
@@ -28,16 +28,16 @@ (define-module (gnu packages pciutils)
 (define-public pciutils
   (package
     (name "pciutils")
-    (version "3.2.0")
+    (version "3.3.1")
     (source (origin
               (method url-fetch)
               (uri (string-append
                     "mirror://kernel.org/software/utils/pciutils/pciutils-"
                     version
-                    ".tar.bz2"))
+                    ".tar.xz"))
               (sha256
                (base32
-                "0d9as9jzjjg5c1nwf58z1y1i7rf9fqxmww1civckhcvcn0xr85mq"))))
+                "1ag3skny1bamqil46dlppw8j1fp08spqa60fjygbxkg4fzdknjji"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (alist-replace
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index 5897974e781cc7777755e4eef84fb00d3c7bba31..03ed5113b131d95ce1521222d76dc6ffb239f8b2 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -52,13 +52,13 @@ (define-module (gnu packages pdf)
 (define-public poppler
   (package
    (name "poppler")
-   (version "0.32.0")
+   (version "0.36.0")
    (source (origin
             (method url-fetch)
             (uri (string-append "http://poppler.freedesktop.org/poppler-"
                                 version ".tar.xz"))
             (sha256 (base32
-                     "162vfbvbz0frvqyk00ldsbl49h4bj8i8wn0ngfl30xg1lldy6qs9"))))
+                     "13i440kv873wgmw50rs4d1v05cj0r7bqnghd70hp9vy44dxhdk4k"))))
    (build-system gnu-build-system)
    ;; FIXME: more dependencies could  be added
    ;;  cairo output:       no (requires cairo >= 1.10.0)
@@ -477,13 +477,13 @@ (define-public mupdf
 (define-public qpdf
   (package
    (name "qpdf")
-   (version "5.1.2")
+   (version "5.1.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://sourceforge/qpdf/qpdf-"
                                 version ".tar.gz"))
             (sha256 (base32
-                     "1zbvhrp0zjzbi6q2bnbxbg6399r47pq5gw3kspzph81j19fqvpg9"))))
+                     "1lq1v7xghvl6p4hgrwbps3a13ad6lh4ib3myimb83hxgsgd4n5nm"))))
    (build-system gnu-build-system)
    (arguments
       '(#:phases (alist-cons-before
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index 5bae3f31c801d54eb9c229c2b5cda42bb904ba0a..95aa596cf5103622b8b92ac69e5a0ffa4176cc38 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -47,6 +47,7 @@ (define-public perl
                "15qxzba3a50c9nik5ydgyfp62x7h9vxxn12yd1jgl93hb1wj96km"))
              (patches (map search-patch
                            '("perl-no-sys-dirs.patch"
+                             "perl-autosplit-default-time.patch"
                              "perl-module-pluggable-search.patch")))))
     (build-system gnu-build-system)
     (arguments
diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
index 7bb5e95c353601e46166f779972f90d9c4a38309..708ba29d24042ed555f2b5c27debd6adf7d4249f 100644
--- a/gnu/packages/python.scm
+++ b/gnu/packages/python.scm
@@ -674,7 +674,7 @@ (define-public python2-mock
 (define-public python-setuptools
   (package
     (name "python-setuptools")
-    (version "12.1")
+    (version "18.3.1")
     (source
      (origin
       (method url-fetch)
@@ -682,7 +682,7 @@ (define-public python-setuptools
                           version ".tar.gz"))
       (sha256
        (base32
-        "04bfk7si1pwj3b5k2b1x9b1zkiclybmzpw6alrs5bciri56lg9zs"))))
+        "0kc7rbav00ks6iaw14p38y81q12fx0lpkhgf5m97xc04f5r318ig"))))
     (build-system python-build-system)
     ;; FIXME: Tests require pytest, which itself relies on setuptools.
     ;; One could bootstrap with an internal untested setuptools.
@@ -2791,7 +2791,7 @@ (define-public python-numpy
                                          (tgt-dir (string-append html "/" dir)))
                                     (unless (equal? "." dir)
                                       (mkdir-p tgt-dir))
-                                    (copy-file file (string-append html "/" file))))
+                                    (install-file file html)))
                                 (find-files "." ".*"))))))
               ,phases)))))))
 
@@ -2835,7 +2835,7 @@ (define-public python-pyparsing
             (for-each
              (lambda (dir tgt)
                (map (lambda (file)
-                      (copy-file file (string-append tgt "/" (basename file))))
+                      (install-file file tgt))
                     (find-files dir ".*")))
              (list "docs" "htmldoc" "examples")
              (list doc html-doc examples))))
@@ -3147,9 +3147,7 @@ (define-public python-scipy
                  (for-each (lambda (file)
                              (let* ((dir (dirname file))
                                     (tgt-dir (string-append html "/" dir)))
-                               (unless (equal? "." dir)
-                                 (mkdir-p tgt-dir))
-                               (copy-file file (string-append html "/" file))))
+                               (install-file file html)))
                            (find-files "." ".*"))))))
          ;; Tests can only be run after the library has been installed and not
          ;; within the source directory.
@@ -4642,6 +4640,37 @@ (define-public python2-terminado
                 ,@(alist-delete "python-tornado"
                                 (package-propagated-inputs terminado)))))))
 
+(define-public python-fonttools
+  (package
+    (name "python-fonttools")
+    (version "2.5")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://pypi.python.org/packages/source/F/FontTools/"
+                    "fonttools-" version ".tar.gz"))
+              (sha256
+               (base32
+                "08ay3x4ijarwhl60gqx2i9jzq6pxs20p4snc2d1q5jagh4rn39lb"))))
+    (build-system python-build-system)
+    (arguments '(#:test-target "check"))
+    (propagated-inputs
+     ;; XXX: module not found if setuptools is not available.
+     `(("python-setuptools" ,python-setuptools)))
+    (home-page "http://github.com/behdad/fonttools")
+    (synopsis "Tools to manipulate font files")
+    (description
+     "FontTools/TTX is a library to manipulate font files from Python.  It
+supports reading and writinfg of TrueType/OpenType fonts, reading and writing
+of AFM files, reading (and partially writing) of PS Type 1 fonts.  The package
+also contains a tool called “TTX” which converts TrueType/OpenType fonts to and
+from an XML-based format.")
+    (license (non-copyleft "file://LICENSE.txt"
+                           "See LICENSE.txt in the distribution."))))
+
+(define-public python2-fonttools
+  (package-with-python2 python-fonttools))
+
 (define-public python-ly
   (package
     (name "python-ly")
diff --git a/gnu/packages/screen.scm b/gnu/packages/screen.scm
index 3a39c36478a026857d7de6540c768bde25f6c17e..84cc8c9dc5f582ad4f409c2f31207c2eaf27d977 100644
--- a/gnu/packages/screen.scm
+++ b/gnu/packages/screen.scm
@@ -79,8 +79,7 @@ (define-public dtach
                  'install
                  (lambda* (#:key outputs #:allow-other-keys)
                    (let ((out (assoc-ref outputs "out")))
-                     (mkdir-p (string-append out "/bin"))
-                     (copy-file "dtach" (string-append out "/bin/dtach"))))
+                     (install-file "dtach" (string-append out "/bin"))))
                  %standard-phases)
        ;; No check target.
        #:tests? #f))
diff --git a/gnu/packages/synergy.scm b/gnu/packages/synergy.scm
index 9a038bb545db59e873d4945223f20155b7b82807..905ef82af404030cb9f238fa93b76dfd9d0c2af8 100644
--- a/gnu/packages/synergy.scm
+++ b/gnu/packages/synergy.scm
@@ -92,19 +92,15 @@ (define-public synergy
                      (ex  (string-append out "/share/doc/synergy-"
                                          ,version "/examples")))
                 (begin
-                  (mkdir-p bin)
                   (for-each
                    (lambda (f)
-                     (copy-file (string-append srcdir "/bin/" f)
-                                (string-append bin "/" f)))
+                     (install-file (string-append srcdir "/bin/" f) bin))
                    '("synergyc" "synergys" "synergyd"
                      "usynergy" "syntool"))
                   ;; Install example configuration files
-                  (mkdir-p ex)
                   (for-each
                    (lambda (e)
-                     (copy-file (string-append srcdir "/doc/" e)
-                                (string-append ex "/" e)))
+                     (install-file (string-append srcdir "/doc/" e) ex))
                    '("synergy.conf.example"
                      "synergy.conf.example-advanced"
                      "synergy.conf.example-basic")))))
diff --git a/gnu/packages/tcl.scm b/gnu/packages/tcl.scm
index afa715c4cb26ae9a5c7cd4b45c926090fab420d3..5b55cccbdead3774680ceb457a8cb5313d9049d9 100644
--- a/gnu/packages/tcl.scm
+++ b/gnu/packages/tcl.scm
@@ -25,6 +25,7 @@ (define-module (gnu packages tcl)
   #:use-module (guix build-system perl)
   #:use-module (gnu packages)
   #:use-module (gnu packages image)
+  #:use-module (gnu packages fontutils)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages xorg)
@@ -33,7 +34,7 @@ (define-module (gnu packages tcl)
 (define-public tcl
   (package
     (name "tcl")
-    (version "8.6.0")
+    (version "8.6.4")
     (source
      (origin
       (method url-fetch)
@@ -41,7 +42,7 @@ (define-public tcl
                           version "/tcl" version "-src.tar.gz"))
       (sha256
        (base32
-        "1pnabp3xsja4rc8c01l9q1avb65a3zhdzci3j54qa5krqjwj4i1m"))))
+        "13cwa4bc85ylf5gfj9vk182lvgy60qni3f7gbxghq78wk16djvly"))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (alist-cons-before
@@ -132,21 +133,34 @@ (define-public expect
 (define-public tk
   (package
     (name "tk")
-    (version "8.6.0")
+    (version "8.6.4")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://sourceforge/tcl/Tcl/"
                                  version "/tk" version "-src.tar.gz"))
              (sha256
               (base32
-               "1rld0l7p1h31z488w44j170jpsm11xsjf2qrb7gid2b5dwmqnw2w"))))
+               "1h96vp15zl5xz0d4qp6wjyrchqmrmdm3q5k22wkw9jaxbvw9vy88"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:phases (alist-cons-before
-                 'configure 'pre-configure
-                 (lambda _
-                   (chdir "unix"))
-                 %standard-phases)
+     '(#:phases (modify-phases %standard-phases
+                  (add-before
+                   'configure 'pre-configure
+                   (lambda _
+                     (chdir "unix")))
+                  (add-after
+                   'install 'add-fontconfig-flag
+                   (lambda* (#:key inputs outputs #:allow-other-keys)
+                     ;; Add the missing -L flag for Fontconfig in 'tk.pc' and
+                     ;; 'tkConfig.sh'.
+                     (let ((out        (assoc-ref outputs "out"))
+                           (fontconfig (assoc-ref inputs "fontconfig")))
+                       (substitute* (find-files out
+                                                "^(tkConfig\\.sh|tk\\.pc)$")
+                         (("-lfontconfig")
+                          (string-append "-L" fontconfig
+                                         "/lib -lfontconfig")))
+                       #t))))
 
        #:configure-flags (list (string-append "--with-tcl="
                                               (assoc-ref %build-inputs "tcl")
@@ -156,6 +170,7 @@ (define-public tk
        #:tests? #f))
     (native-inputs `(("pkg-config" ,pkg-config)))
     (inputs `(("libxft" ,libxft)
+              ("fontconfig" ,fontconfig)
               ("tcl" ,tcl)))
     ;; tk.h refers to X11 headers, hence the propagation.
     (propagated-inputs `(("libx11" ,libx11)
diff --git a/gnu/packages/textutils.scm b/gnu/packages/textutils.scm
index 08b1b64c573d9289b500a4ddf0cfdb0de9bb4871..95a8ad1da98c1f6c135bef23a2ff94f8d6fd3c2f 100644
--- a/gnu/packages/textutils.scm
+++ b/gnu/packages/textutils.scm
@@ -111,11 +111,9 @@ (define-public utf8proc
         (lambda* (#:key outputs #:allow-other-keys)
           (let ((lib (string-append (assoc-ref outputs "out") "/lib/"))
                 (include (string-append (assoc-ref outputs "out") "/include/")))
-            (mkdir-p lib)
-            (mkdir-p include)
-            (copy-file "utf8proc.h" (string-append include "utf8proc.h"))
+            (install-file "utf8proc.h" include)
             (for-each (lambda (file)
-                        (copy-file file (string-append lib (basename file))))
+                        (install-file file lib))
                       '("libutf8proc.a" "libutf8proc.so"))))
         ;; no configure script
         (alist-delete 'configure %standard-phases))))
diff --git a/gnu/packages/tls.scm b/gnu/packages/tls.scm
index c9c84dff2fd26463d99fcf795bd5084fdcbd1828..1a0eeb27089fbddc2c7b0cc9098f449521589a4a 100644
--- a/gnu/packages/tls.scm
+++ b/gnu/packages/tls.scm
@@ -105,7 +105,7 @@ (define-public p11-kit
 (define-public gnutls
   (package
     (name "gnutls")
-    (version "3.4.4.1")
+    (version "3.4.5")
     (source (origin
              (method url-fetch)
              (uri
@@ -116,7 +116,7 @@ (define-public gnutls
                              "/gnutls-" version ".tar.xz"))
              (sha256
               (base32
-               "1xf354xafavqhi207ll1m1isd4l5b31lic2sz9lw0j0r0fcxfnsj"))
+               "1bks1zpmhmnkz2v32dd9b44pz6x0a5w4yi9zzwsd0a078vhbi25g"))
              (patches (list (search-patch "gnutls-doc-fix.patch")))))
     (build-system gnu-build-system)
     (arguments
@@ -195,7 +195,9 @@ (define-public openssl
             (sha256
              (base32
               "1j58r7rdj9fz2lanir8ajbx4bspb5jnm5ikl6dq8lql5fx43c737"))
-            (patches (list (search-patch "openssl-runpath.patch")))))
+            (patches (map search-patch
+                          '("openssl-runpath.patch"
+                            "openssl-c-rehash.patch")))))
    (build-system gnu-build-system)
    (native-inputs `(("perl" ,perl)))
    (arguments
@@ -203,32 +205,68 @@ (define-public openssl
       #:parallel-tests? #f
       #:test-target "test"
       #:phases
-      (alist-replace
-       'configure
-       (lambda* (#:key outputs #:allow-other-keys)
-         (let ((out (assoc-ref outputs "out")))
-           (zero?
-            (system* "./config"
-                     "shared"                   ; build shared libraries
-                     "--libdir=lib"
-                     (string-append "--prefix=" out)
-                     ;; XXX FIXME: Work around a code generation bug in GCC
-                     ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
-                     ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
-                     ,@(if (and (not (%current-target-system))
-                                (string-prefix? "armhf" (%current-system)))
-                           '("-mfpu=vfpv3")
-                           '())))))
-       (alist-cons-before
-        'patch-source-shebangs 'patch-tests
-        (lambda* (#:key inputs native-inputs #:allow-other-keys)
-          (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
-            (substitute* (find-files "test" ".*")
-              (("/bin/sh")
-               (string-append bash "/bin/bash"))
-              (("/bin/rm")
-               "rm"))))
-        %standard-phases))))
+      (modify-phases %standard-phases
+        (add-before
+         'configure 'fix-man-dir
+         (lambda* (#:key outputs #:allow-other-keys)
+           ;; The default MANDIR is some unusual place.  Fix that.
+           (let ((out (assoc-ref outputs "out")))
+             (substitute* "Makefile.org"
+               (("^MANDIR[[:blank:]]*=.*$")
+                (string-append "MANDIR = " out "/share/man\n")))
+             #t)))
+        (replace
+         'configure
+         (lambda* (#:key outputs #:allow-other-keys)
+           (let ((out (assoc-ref outputs "out")))
+             (zero?
+              (system* "./config"
+                       "shared"                   ;build shared libraries
+                       "--libdir=lib"
+
+                       ;; The default for this catch-all directory is
+                       ;; PREFIX/ssl.  Change that to something more
+                       ;; conventional.
+                       (string-append "--openssldir=" out
+                                      "/share/openssl-" ,version)
+
+                       (string-append "--prefix=" out)
+
+                       ;; XXX FIXME: Work around a code generation bug in GCC
+                       ;; 4.9.3 on ARM when compiled with -mfpu=neon.  See:
+                       ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66917>
+                       ,@(if (and (not (%current-target-system))
+                                  (string-prefix? "armhf" (%current-system)))
+                             '("-mfpu=vfpv3")
+                             '()))))))
+        (add-after
+         'install 'make-libraries-writable
+         (lambda* (#:key outputs #:allow-other-keys)
+           ;; Make libraries writable so that 'strip' does its job.
+           (let ((out (assoc-ref outputs "out")))
+             (for-each (lambda (file)
+                         (chmod file #o644))
+                       (find-files (string-append out "/lib")
+                                   "\\.so"))
+             #t)))
+        (add-before
+         'patch-source-shebangs 'patch-tests
+         (lambda* (#:key inputs native-inputs #:allow-other-keys)
+           (let ((bash (assoc-ref (or native-inputs inputs) "bash")))
+             (substitute* (find-files "test" ".*")
+               (("/bin/sh")
+                (string-append bash "/bin/bash"))
+               (("/bin/rm")
+                "rm")))))
+        (add-after
+         'install 'remove-miscellany
+         (lambda* (#:key outputs #:allow-other-keys)
+           ;; The 'misc' directory contains random undocumented shell and Perl
+           ;; scripts.  Remove them to avoid retaining a reference on Perl.
+           (let ((out (assoc-ref outputs "out")))
+             (delete-file-recursively (string-append out "/share/openssl-"
+                                                     ,version "/misc"))
+             #t))))))
    (native-search-paths
     ;; FIXME: These two variables must designate a single file or directory
     ;; and are not actually "search paths."  In practice it works OK in user
diff --git a/gnu/packages/valgrind.scm b/gnu/packages/valgrind.scm
index 5e5a1d906937ccbfbab677ca2f47284098604a00..a4c75baed98b1442e983816345de348c352b639f 100644
--- a/gnu/packages/valgrind.scm
+++ b/gnu/packages/valgrind.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2015 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -37,7 +38,8 @@ (define-public valgrind
              (sha256
               (base32
                "15xrzhfnwwn7n1sfbkwvdbvs6zk0zx718n6zd5i1nrnvdp13s9gs"))
-             (patches (list (search-patch "valgrind-glibc-2.21.patch")))))
+             (patches (map search-patch '("valgrind-glibc-2.22.patch"
+                                          "valgrind-linux-libre-4.x.patch")))))
     (build-system gnu-build-system)
     (arguments
      '(#:phases (alist-cons-after
diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
index e0b3c538586906b06d82042a1df6a5f89dde5afd..b4c518acf789cf645d4d9864ee351bbe0e6ac6ce 100644
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@@ -419,11 +419,9 @@ (define-public git-test-sequence
                             (output (assoc-ref %outputs "out"))
                             (bindir (string-append output "/bin"))
                             (script "git-test-sequence"))
-                       (begin
-                         (mkdir-p bindir)
-                         (copy-file (string-append source "/" script)
-                                    (string-append bindir "/" script))
-                         #t)))))
+                       (install-file (string-append source "/" script)
+                                     bindir)
+                       #t))))
       (home-page "http://dustin.sallings.org/2010/03/28/git-test-sequence.html")
       (synopsis "Run a command over a sequence of commits")
       (description
diff --git a/gnu/packages/video.scm b/gnu/packages/video.scm
index a4e90ac4c1f92d73a4ff0a28be250c04b45e01b6..fbcfc12624835f2ddeb97e93a76333dbcfded45c 100644
--- a/gnu/packages/video.scm
+++ b/gnu/packages/video.scm
@@ -1014,7 +1014,8 @@ (define-public avidemux
                (("#! /bin/sh") (string-append "#!" (which "bash"))))
              (system* "tar" "cjf" "ffmpeg-2.6.1.tar.bz2" "ffmpeg-2.6.1"
                       ;; avoid non-determinism in the archive
-                      "--mtime=@0" "--owner=root:0" "--group=root:0")
+                      "--sort=name" "--mtime=@0"
+                      "--owner=root:0" "--group=root:0")
              (delete-file-recursively "ffmpeg-2.6.1")))
          (alist-replace 'configure
           (lambda _
diff --git a/gnu/packages/wicd.scm b/gnu/packages/wicd.scm
index 26b1c7d3f92a83a06ec2c84a25563f41d212b20f..33953eebf0f5021130f38f0272c0d09c86dad071 100644
--- a/gnu/packages/wicd.scm
+++ b/gnu/packages/wicd.scm
@@ -174,16 +174,13 @@ (define (which* cmd)
              ;; directory.
              (let ((dest-dir (string-append out "/etc/wicd"))
                    (name "dhclient.conf.template.default"))
-               (mkdir-p dest-dir)
-               (copy-file (string-append "other/" name)
-                          (string-append dest-dir "/" name)))
+               (install-file (string-append "other/" name) dest-dir))
 
              ;; Copy index.theme from hicolor-icon-theme.  This is needed to
              ;; allow wicd-gtk to find its icons.
              (let ((hicolor (assoc-ref inputs "hicolor-icon-theme"))
                    (name "/share/icons/hicolor/index.theme"))
-               (copy-file (string-append hicolor name)
-                          (string-append out name)))
+               (install-file (string-append hicolor name) out))
              #t))
          %standard-phases))))
     (synopsis "Network connection manager")
diff --git a/gnu/packages/xdisorg.scm b/gnu/packages/xdisorg.scm
index 9fd9f4a321fae02fe329652e31ff803fbb340c55..7aa82fe31226311b4c6fa9675d125e83afc248bd 100644
--- a/gnu/packages/xdisorg.scm
+++ b/gnu/packages/xdisorg.scm
@@ -150,7 +150,8 @@ (define-public pixman
                ".tar.gz"))
         (sha256
           (base32
-           "0129g4zdrw5hif5783li7rzcr4vpbc2cfia91azxmsk0h0xx3zix"))))
+           "0129g4zdrw5hif5783li7rzcr4vpbc2cfia91azxmsk0h0xx3zix"))
+        (patches (list (search-patch "pixman-pointer-arithmetic.patch")))))
     (build-system gnu-build-system)
     (inputs
       `(("libpng" ,libpng)
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index ddb73143a19f5857985bdd7538e5e6e9105aae75..5d65648bfb90492a82eb57a53fa2889a03cacd65 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -145,7 +145,7 @@ (define-public libxslt
 (define-public perl-xml-parser
   (package
     (name "perl-xml-parser")
-    (version "2.41")
+    (version "2.44")
     (source (origin
              (method url-fetch)
              (uri (string-append
@@ -153,7 +153,7 @@ (define-public perl-xml-parser
                    version ".tar.gz"))
              (sha256
               (base32
-               "1sadi505g5qmxr36lgcbrcrqh3a5gcdg32b405gnr8k54b6rg0dl"))))
+               "05ij0g6bfn27iaggxf8nl5rhlwx6f6p6xmdav6rjcly3x5zd1s8s"))))
     (build-system perl-build-system)
     (arguments `(#:make-maker-flags
                  (let ((expat (assoc-ref %build-inputs "expat")))
@@ -171,7 +171,7 @@ (define-public perl-xml-parser
 then passed on to the Expat object on each parse call.  They can also be given
 as extra arguments to the parse methods, in which case they override options
 given at XML::Parser creation time.")
-    (home-page "http://search.cpan.org/~toddr/XML-Parser-2.41/Parser.pm")))
+    (home-page "http://search.cpan.org/dist/XML-Parser")))
 
 (define-public perl-libxml
   (package
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index a9859e695bf4303e59f5512b8fc1bdd3ba87a96b..d4ed4b82d01454bf0af75707f4a0f5cb2a68a85a 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -4951,6 +4951,12 @@ (define-public libx11
           (base32
             "05mx0s0vqzds3qjc1gmjr2s6x2ll37z4lfhgm7p2w7936zl2g81a"))))
     (build-system gnu-build-system)
+    (outputs '("out"
+               "doc"))                            ;8 MiB of man pages + XML
+    (arguments
+     '(#:configure-flags (list (string-append "--mandir="
+                                              (assoc-ref %outputs "doc")
+                                              "/share/man"))))
     (propagated-inputs
       `(("kbproto" ,kbproto)
         ("libxcb" ,libxcb)))
@@ -5011,6 +5017,12 @@ (define-public libxt
           (base32
             "0myxwbx9ylam5x3ia5b5f4x8azcqdm420h9ad1r4hrgmi2lrffl4"))))
     (build-system gnu-build-system)
+    (outputs '("out"
+               "doc"))                            ;2 MiB of man pages + XML
+    (arguments
+     '(#:configure-flags (list (string-append "--mandir="
+                                              (assoc-ref %outputs "doc")
+                                              "/share/man"))))
     (propagated-inputs
       `(("libx11" ,libx11)
         ("libice" ,libice)
diff --git a/gnu/system/install.scm b/gnu/system/install.scm
index 9314462f306d316111a7bc3294dffda8519411b3..c161526d772d7a19049fe03c10a1d8577fcd4887 100644
--- a/gnu/system/install.scm
+++ b/gnu/system/install.scm
@@ -74,8 +74,13 @@ (define %root "root")
           ;; length limitation.
           (with-directory-excursion %root
             (zero? (system* "tar" "--xz" "--format=gnu"
-                            "--owner=root:0" "--group=root:0"
+
+                            ;; avoid non-determinism in the archive
+                            "--sort=name"
                             "--mtime=@0"          ;for files in /var/guix
+                            "--owner=root:0"
+                            "--group=root:0"
+
                             "--check-links"
                             "-cvf" #$output
                             ;; Avoid adding / and /var to the tarball,
diff --git a/guix/build-system/glib-or-gtk.scm b/guix/build-system/glib-or-gtk.scm
index a1f0a9b8a4b3fa609afaca3319b8c08d97dcecc8..d585d84f2075eea9abb056f2bda53c99b9b827ed 100644
--- a/guix/build-system/glib-or-gtk.scm
+++ b/guix/build-system/glib-or-gtk.scm
@@ -36,7 +36,7 @@ (define-module (guix build-system glib-or-gtk)
 ;; This build system is an extension of the 'gnu-build-system'.  It
 ;; accomodates the needs of applications making use of glib or gtk+ (with "or"
 ;; to be interpreted in the mathematical sense).  This is achieved by adding
-;; three phases run after the 'install' phase:
+;; two phases run after the 'install' phase:
 ;;
 ;; 'glib-or-gtk-wrap' phase:
 ;;
@@ -57,11 +57,6 @@ (define-module (guix build-system glib-or-gtk)
 ;; exists and does not include a file named "gschemas.compiled", then
 ;; "glib-compile-schemas" is run in that directory.
 ;;
-;; 'glib-or-gtk-icon-cache' phase:
-;;
-;; Looks for the existence of icon themes and, if no cache exists, generate
-;; the "icon-theme.cache" file.
-;;
 ;; Code:
 
 (define %default-modules
@@ -81,22 +76,16 @@ (define (default-glib)
   (let ((module (resolve-interface '(gnu packages glib))))
     (module-ref module 'glib)))
 
-(define (default-gtk+)
-  "Return the default gtk+ package from which we use
-\"gtk-update-icon-cache\"."
-  (let ((module (resolve-interface '(gnu packages gtk))))
-    (module-ref module 'gtk+)))
-
 (define* (lower name
                 #:key source inputs native-inputs outputs system target
-                (glib (default-glib)) (gtk+ (default-gtk+))
+                (glib (default-glib))
                 (implicit-inputs? #t)
                 (strip-binaries? #t)
                 #:allow-other-keys
                 #:rest arguments)
   "Return a bag for NAME."
   (define private-keywords
-    '(#:source #:target #:glib #:gtk+ #:inputs #:native-inputs
+    '(#:source #:target #:glib #:inputs #:native-inputs
       #:outputs #:implicit-inputs?))
 
   (and (not target)                               ;XXX: no cross-compilation
@@ -108,7 +97,6 @@ (define private-keywords
                               '())
                         ,@inputs))
          (build-inputs `(("glib:bin" ,glib "bin") ; to compile schemas
-                         ("gtk+" ,gtk+)           ; to generate icon cache
                          ,@(if implicit-inputs?
                                (standard-packages)
                                '())
diff --git a/guix/build/emacs-build-system.scm b/guix/build/emacs-build-system.scm
index c01b24fe9aa43139a7b3d517ee0593e92668e3f5..f0a9a6e1256e0f62c89151f8d93275546b858100 100644
--- a/guix/build/emacs-build-system.scm
+++ b/guix/build/emacs-build-system.scm
@@ -83,7 +83,8 @@ (define* (move-doc #:key outputs #:allow-other-keys)
   (let* ((out (assoc-ref outputs "out"))
          (elpa-name-ver (store-directory->elpa-name-version out))
          (el-dir (string-append out %install-suffix "/" elpa-name-ver))
-         (info-dir (string-append out "/share/info"))
+         (name-ver (strip-store-file-name out))
+         (info-dir (string-append out "/share/info/"))
          (info-files (find-files el-dir "\\.info$")))
     (unless (null? info-files)
       (mkdir-p info-dir)
@@ -115,7 +116,7 @@ (define (emacs-inputs inputs)
   (filter (match-lambda
             ((label . directory)
              (emacs-package? ((compose package-name->name+version
-                                       store-directory->name-version)
+                                       strip-store-file-name)
                               directory)))
             (_ #f))
           inputs))
@@ -137,47 +138,17 @@ (define (emacs-inputs-el-directories dirs)
 (define (package-name-version->elpa-name-version name-ver)
   "Convert the Guix package NAME-VER to the corresponding ELPA name-version
 format.  Essnetially drop the prefix used in Guix."
-  (let ((name (store-directory->name-version name-ver)))
-    (if (emacs-package? name-ver)
-        (store-directory->name-version name-ver)
-        name-ver)))
+  (if (emacs-package? name-ver)  ; checks for "emacs-" prefix
+      (string-drop name-ver (string-length "emacs-"))
+      name-ver))
 
 (define (store-directory->elpa-name-version store-dir)
   "Given a store directory STORE-DIR return the part of the basename after the
 second hyphen.  This corresponds to 'name-version' as used in ELPA packages."
   ((compose package-name-version->elpa-name-version
-            store-directory->name-version)
+            strip-store-file-name)
    store-dir))
 
-(define (store-directory->name-version store-dir)
-  "Given a store directory STORE-DIR return the part of the basename
-after the first hyphen.  This corresponds to 'name-version' of the package."
-  (let* ((base (basename store-dir)))
-    (string-drop base
-                 (+ 1 (string-index base #\-)))))
-
-;; from (guix utils).  Should we put it in (guix build utils)?
-(define (package-name->name+version name)
-  "Given NAME, a package name like \"foo-0.9.1b\", return two values:
-\"foo\" and \"0.9.1b\".  When the version part is unavailable, NAME and
-#f are returned.  The first hyphen followed by a digit is considered to
-introduce the version part."
-  ;; See also `DrvName' in Nix.
-
-  (define number?
-    (cut char-set-contains? char-set:digit <>))
-
-  (let loop ((chars   (string->list name))
-             (prefix '()))
-    (match chars
-      (()
-       (values name #f))
-      ((#\- (? number? n) rest ...)
-       (values (list->string (reverse prefix))
-               (list->string (cons n rest))))
-      ((head tail ...)
-       (loop tail (cons head prefix))))))
-
 (define %standard-phases
   (modify-phases gnu:%standard-phases
     (delete 'configure)
diff --git a/guix/build/glib-or-gtk-build-system.scm b/guix/build/glib-or-gtk-build-system.scm
index 15d7de2236ad5e640e01c82bd5bcf47d9e0430cd..b6291e735b0da5e601c7b0189353ba8b7b4d4a88 100644
--- a/guix/build/glib-or-gtk-build-system.scm
+++ b/guix/build/glib-or-gtk-build-system.scm
@@ -213,37 +213,9 @@ (define* (compile-glib-schemas #:key outputs #:allow-other-keys)
                  #t))))
          outputs))
 
-(define* (generate-icon-cache #:key outputs #:allow-other-keys)
-  "Implement phase \"glib-or-gtk-icon-cache\": generate icon cache if
-needed."
-  (every (match-lambda
-          ((output . directory)
-           (let ((iconsdir (string-append directory
-                                            "/share/icons")))
-             (when (file-exists? iconsdir)
-               (with-directory-excursion iconsdir
-                 (for-each
-                  (lambda (dir)
-                    (unless (file-exists?
-                             (string-append iconsdir "/" dir "/"
-                                            "icon-theme.cache"))
-                      (system* "gtk-update-icon-cache"
-                               "--ignore-theme-index"
-                               (string-append iconsdir "/" dir))))
-                  (scandir "."
-                           (lambda (name)
-                             (and
-                              (not (equal? name "."))
-                              (not (equal? name ".."))
-                              (equal? 'directory
-                                      (stat:type (stat name)))))))))
-             #t)))
-         outputs))
-
 (define %standard-phases
   (modify-phases gnu:%standard-phases
     (add-after 'install 'glib-or-gtk-compile-schemas compile-glib-schemas)
-    (add-after 'install 'glib-or-gtk-icon-cache generate-icon-cache)
     (add-after 'install 'glib-or-gtk-wrap wrap-all-programs)))
 
 (define* (glib-or-gtk-build #:key inputs (phases %standard-phases)
diff --git a/guix/build/gnu-build-system.scm b/guix/build/gnu-build-system.scm
index 102207b0226d2bc2d00398eabb3d9ac93d2003ec..0a774e1e841a9ffb061b6b9a6c089d757fe6c423 100644
--- a/guix/build/gnu-build-system.scm
+++ b/guix/build/gnu-build-system.scm
@@ -25,6 +25,7 @@ (define-module (guix build gnu-build-system)
   #:use-module (ice-9 regex)
   #:use-module (ice-9 format)
   #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-19)
   #:use-module (srfi srfi-26)
   #:use-module (rnrs io ports)
   #:export (%standard-phases
@@ -576,6 +577,11 @@ (define* (gnu-build #:key (source #f) (outputs #f) (inputs #f)
                     #:rest args)
   "Build from SOURCE to OUTPUTS, using INPUTS, and by running all of PHASES
 in order.  Return #t if all the PHASES succeeded, #f otherwise."
+  (define (elapsed-time end start)
+    (let ((diff (time-difference end start)))
+      (+ (time-second diff)
+         (/ (time-nanosecond diff) 1e9))))
+
   (setvbuf (current-output-port) _IOLBF)
   (setvbuf (current-error-port) _IOLBF)
 
@@ -586,12 +592,13 @@ (define* (gnu-build #:key (source #f) (outputs #f) (inputs #f)
   ;; PHASES can pick the keyword arguments it's interested in.
   (every (match-lambda
           ((name . proc)
-           (let ((start (gettimeofday)))
+           (let ((start (current-time time-monotonic)))
              (format #t "starting phase `~a'~%" name)
              (let ((result (apply proc args))
-                   (end    (gettimeofday)))
-               (format #t "phase `~a' ~:[failed~;succeeded~] after ~a seconds~%"
-                       name result (- (car end) (car start)))
+                   (end    (current-time time-monotonic)))
+               (format #t "phase `~a' ~:[failed~;succeeded~] after ~,1f seconds~%"
+                       name result
+                       (elapsed-time end start))
 
                ;; Dump the environment variables as a shell script, for handy debugging.
                (system "export > $NIX_BUILD_TOP/environment-variables")
diff --git a/guix/build/utils.scm b/guix/build/utils.scm
index 676a0120e3415f48f9c4c0442c7e97a0080779c6..971929621a0d368e8312845817fd891622e5dc52 100644
--- a/guix/build/utils.scm
+++ b/guix/build/utils.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2012, 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org>
+;;; Copyright © 2015 Mark H Weaver <mhw@netris.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -21,6 +22,7 @@
 (define-module (guix build utils)
   #:use-module (srfi srfi-1)
   #:use-module (srfi srfi-11)
+  #:use-module (srfi srfi-26)
   #:use-module (srfi srfi-60)
   #:use-module (ice-9 ftw)
   #:use-module (ice-9 match)
@@ -33,6 +35,8 @@ (define-module (guix build utils)
                alist-delete)
   #:export (%store-directory
             store-file-name?
+            strip-store-file-name
+            package-name->name+version
             parallel-job-count
 
             directory-exists?
@@ -43,6 +47,7 @@ (define-module (guix build utils)
             ar-file?
             with-directory-excursion
             mkdir-p
+            install-file
             copy-recursively
             delete-file-recursively
             file-name-predicate
@@ -86,6 +91,33 @@ (define (store-file-name? file)
   "Return true if FILE is in the store."
   (string-prefix? (%store-directory) file))
 
+(define (strip-store-file-name file)
+  "Strip the '/gnu/store' and hash from FILE, a store file name.  The result
+is typically a \"PACKAGE-VERSION\" string."
+  (string-drop file
+               (+ 34 (string-length (%store-directory)))))
+
+(define (package-name->name+version name)
+  "Given NAME, a package name like \"foo-0.9.1b\", return two values:
+\"foo\" and \"0.9.1b\".  When the version part is unavailable, NAME and
+#f are returned.  The first hyphen followed by a digit is considered to
+introduce the version part."
+  ;; See also `DrvName' in Nix.
+
+  (define number?
+    (cut char-set-contains? char-set:digit <>))
+
+  (let loop ((chars   (string->list name))
+             (prefix '()))
+    (match chars
+      (()
+       (values name #f))
+      ((#\- (? number? n) rest ...)
+       (values (list->string (reverse prefix))
+               (list->string (cons n rest))))
+      ((head tail ...)
+       (loop tail (cons head prefix))))))
+
 (define parallel-job-count
   ;; Number of processes to be passed next to GNU Make's `-j' argument.
   (make-parameter
@@ -197,6 +229,12 @@ (define not-slash
                  (apply throw args))))))
       (() #t))))
 
+(define (install-file file directory)
+  "Create DIRECTORY if it does not exist and copy FILE in there under the same
+name."
+  (mkdir-p directory)
+  (copy-file file (string-append directory "/" (basename file))))
+
 (define* (copy-recursively source destination
                            #:key
                            (log (current-output-port))
@@ -279,13 +317,16 @@ (define (file-name-predicate regexp)
       (regexp-exec file-rx (basename file)))))
 
 (define* (find-files dir #:optional (pred (const #t))
-                     #:key (stat lstat))
+                     #:key (stat lstat)
+                     directories?
+                     fail-on-error?)
   "Return the lexicographically sorted list of files under DIR for which PRED
 returns true.  PRED is passed two arguments: the absolute file name, and its
 stat buffer; the default predicate always returns true.  PRED can also be a
 regular expression, in which case it is equivalent to (file-name-predicate
 PRED).  STAT is used to obtain file information; using 'lstat' means that
-symlinks are not followed."
+symlinks are not followed.  If DIRECTORIES? is true, then directories will
+also be included.  If FAIL-ON-ERROR? is true, raise an exception upon error."
   (let ((pred (if (procedure? pred)
                   pred
                   (file-name-predicate pred))))
@@ -296,7 +337,10 @@ (define* (find-files dir #:optional (pred (const #t))
                                   (cons file result)
                                   result))
                             (lambda (dir stat result) ; down
-                              result)
+                              (if (and directories?
+                                       (pred dir stat))
+                                  (cons dir result)
+                                  result))
                             (lambda (dir stat result) ; up
                               result)
                             (lambda (file stat result) ; skip
@@ -304,6 +348,8 @@ (define* (find-files dir #:optional (pred (const #t))
                             (lambda (file stat errno result)
                               (format (current-error-port) "find-files: ~a: ~a~%"
                                       file (strerror errno))
+                              (when fail-on-error?
+                                (error "find-files failed"))
                               result)
                             '()
                             dir
diff --git a/guix/gexp.scm b/guix/gexp.scm
index 63af40aed9d6f7f4555806956c8d6c3913638cff..de49fef0882c76c051bbf8c166d2c4284334b468 100644
--- a/guix/gexp.scm
+++ b/guix/gexp.scm
@@ -717,32 +717,11 @@ (define (substitute-references exp substs)
 ;;; Module handling.
 ;;;
 
-(define %mkdir-p-definition
-  ;; The code for 'mkdir-p' is copied from (guix build utils).  We use it in
-  ;; derivations that cannot use the #:modules argument of 'gexp->derivation'
-  ;; precisely because they implement that functionality.
-  (gexp
-   (define (mkdir-p dir)
-     (define absolute?
-       (string-prefix? "/" dir))
-
-     (define not-slash
-       (char-set-complement (char-set #\/)))
-
-     (let loop ((components (string-tokenize dir not-slash))
-                (root       (if absolute? "" ".")))
-       (match components
-         ((head tail ...)
-          (let ((path (string-append root "/" head)))
-            (catch 'system-error
-              (lambda ()
-                (mkdir path)
-                (loop tail path))
-              (lambda args
-                (if (= EEXIST (system-error-errno args))
-                    (loop tail path)
-                    (apply throw args))))))
-         (() #t))))))
+(define %utils-module
+  ;; This file provides 'mkdir-p', needed to implement 'imported-files' and
+  ;; other primitives below.
+  (local-file (search-path %load-path "guix/build/utils.scm")
+              "build-utils.scm"))
 
 (define* (imported-files files
                          #:key (name "file-import")
@@ -763,10 +742,9 @@ (define file-pair
     (define build
       (gexp
        (begin
+         (primitive-load (ungexp %utils-module))  ;for 'mkdir-p'
          (use-modules (ice-9 match))
 
-         (ungexp %mkdir-p-definition)
-
          (mkdir (ungexp output)) (chdir (ungexp output))
          (for-each (match-lambda
                     ((final-path store-path)
@@ -822,13 +800,12 @@ (define* (compiled-modules modules
     (define build
       (gexp
        (begin
+         (primitive-load (ungexp %utils-module))  ;for 'mkdir-p'
+
          (use-modules (ice-9 ftw)
-                      (ice-9 match)
                       (srfi srfi-26)
                       (system base compile))
 
-         (ungexp %mkdir-p-definition)
-
          (define (regular? file)
            (not (member file '("." ".."))))
 
diff --git a/guix/packages.scm b/guix/packages.scm
index edcb53ec93b4edb9c00d517c83a1cff29bea5433..72822b8c975e2a7d715d01562afae3a1bd308b87 100644
--- a/guix/packages.scm
+++ b/guix/packages.scm
@@ -99,6 +99,7 @@ (define-module (guix packages)
             transitive-input-references
 
             %supported-systems
+            %hurd-systems
             %hydra-supported-systems
             supported-package?
 
@@ -215,9 +216,13 @@ (define %supported-systems
   ;; expect all packages to build successfully here.
   '("x86_64-linux" "i686-linux" "armhf-linux" "mips64el-linux"))
 
+(define %hurd-systems
+  ;; The GNU/Hurd systems for which support is being developed.
+  '("i585-gnu" "i686-gnu"))
+
 (define %hydra-supported-systems
   ;; This is the list of system types for which build slaves are available.
-  (delete "armhf-linux" %supported-systems))
+  %supported-systems)
 
 
 ;; A package.
@@ -445,6 +450,13 @@ (define build
                        (srfi srfi-1)
                        (guix build utils))
 
+          ;; The --sort option was added to GNU tar in version 1.28, released
+          ;; 2014-07-28.  During bootstrap we must cope with older versions.
+          (define tar-supports-sort?
+            (zero? (system* (string-append #+tar "/bin/tar")
+                            "cf" "/dev/null" "--files-from=/dev/null"
+                            "--sort=name")))
+
           (define (apply-patch patch)
             (format (current-error-port) "applying '~a'...~%" patch)
 
@@ -504,12 +516,25 @@ (define (first-file directory)
                              #~())
 
                       (begin (chdir "..") #t)
-                      (zero? (system* (string-append #+tar "/bin/tar")
-                                      "cvfa" #$output directory
-                                      ;; avoid non-determinism in the archive
-                                      "--mtime=@0"
-                                      "--owner=root:0"
-                                      "--group=root:0")))))))
+
+                      (unless tar-supports-sort?
+                        (call-with-output-file ".file_list"
+                          (lambda (port)
+                            (for-each (lambda (name) (format port "~a~%" name))
+                                      (find-files directory
+                                                  #:directories? #t
+                                                  #:fail-on-error? #t)))))
+                      (zero? (apply system* (string-append #+tar "/bin/tar")
+                                    "cvfa" #$output
+                                    ;; avoid non-determinism in the archive
+                                    "--mtime=@0"
+                                    "--owner=root:0"
+                                    "--group=root:0"
+                                    (if tar-supports-sort?
+                                        `("--sort=name"
+                                          ,directory)
+                                        '("--no-recursion"
+                                          "--files-from=.file_list")))))))))
 
     (let ((name    (tarxz-name original-file-name))
           (modules (delete-duplicates (cons '(guix build utils) modules))))
diff --git a/guix/utils.scm b/guix/utils.scm
index 1fe11f52f516c350de2f9c97ce8ddcbbd69565dc..b6df5d9cc9d265e50d8b6f101910fd316beff55e 100644
--- a/guix/utils.scm
+++ b/guix/utils.scm
@@ -29,7 +29,8 @@ (define-module (guix utils)
   #:use-module (srfi srfi-60)
   #:use-module (rnrs bytevectors)
   #:use-module ((rnrs io ports) #:select (put-bytevector))
-  #:use-module ((guix build utils) #:select (dump-port))
+  #:use-module ((guix build utils)
+                #:select (dump-port package-name->name+version))
   #:use-module ((guix build syscalls) #:select (errno mkdtemp!))
   #:use-module (ice-9 vlist)
   #:use-module (ice-9 format)
@@ -39,6 +40,7 @@ (define-module (guix utils)
   #:use-module (ice-9 match)
   #:use-module (ice-9 format)
   #:use-module (system foreign)
+  #:re-export (package-name->name+version)
   #:export (bytevector->base16-string
             base16-string->bytevector
 
@@ -71,7 +73,6 @@ (define-module (guix utils)
             version-prefix
             version-major+minor
             guile-version>?
-            package-name->name+version
             string-replace-substring
             arguments-from-environment-variable
             file-extension
@@ -578,27 +579,6 @@ (define (guile-version>? str)
                             (micro-version))
              str))
 
-(define (package-name->name+version name)
-  "Given NAME, a package name like \"foo-0.9.1b\", return two values:
-\"foo\" and \"0.9.1b\".  When the version part is unavailable, NAME and
-#f are returned.  The first hyphen followed by a digit is considered to
-introduce the version part."
-  ;; See also `DrvName' in Nix.
-
-  (define number?
-    (cut char-set-contains? char-set:digit <>))
-
-  (let loop ((chars   (string->list name))
-             (prefix '()))
-    (match chars
-      (()
-       (values name #f))
-      ((#\- (? number? n) rest ...)
-       (values (list->string (reverse prefix))
-               (list->string (cons n rest))))
-      ((head tail ...)
-       (loop tail (cons head prefix))))))
-
 (define (file-extension file)
   "Return the extension of FILE or #f if there is none."
   (let ((dot (string-rindex file #\.)))
diff --git a/tests/build-utils.scm b/tests/build-utils.scm
index a5ea640c47915adf8eaee4e69e0c1e24fe3379c5..b0a4d1584a9a18bed5692adbe32afcd1626e05ef 100644
--- a/tests/build-utils.scm
+++ b/tests/build-utils.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -128,6 +128,11 @@ (define %store
               (inputs `(("bash" ,(search-bootstrap-binary "bash"
                                                           (%current-system)))))))
          (d (package-derivation %store p)))
+
+    ;; The bootstrap Bash is linked against an old libc and would abort with
+    ;; an assertion failure when trying to load incompatible locale data.
+    (unsetenv "LOCPATH")
+
     (and (build-derivations %store (pk 'drv d (list d)))
          (let* ((p    (derivation->output-path d))
                 (foo  (string-append p "/foo"))
diff --git a/tests/packages.scm b/tests/packages.scm
index ace2f36f196b5b745892298a5fa35778c7f4f9e4..b28ae0b6623cae2aeb906626ea0569d484d38a79 100644
--- a/tests/packages.scm
+++ b/tests/packages.scm
@@ -321,7 +321,10 @@ (define read-at
                                 (chmod "." #o777)
                                 (symlink "guile" "guile-rocks")
                                 (copy-recursively "../share/guile/2.0/scripts"
-                                                  "scripts"))))))
+                                                  "scripts")
+
+                                ;; Make sure '.file_list' can be created.
+                                (chmod ".." #o777))))))
          (package (package (inherit (dummy-package "with-snippet"))
                     (source source)
                     (build-system trivial-build-system)