WARNING: CVE-2015-4473 may not be fully addressed here, because I was unable
to backport some of the patches (for upstream bugs 1182711 and 1146213).  I
was also unable to backport CVE-2015-4484 (upstream bug 1171540) and
CVE-2015-4487 (upstream bug 1171603).  I was unable to find any commit in the
upstream repository that claims to address bug 1105914 (CVE-2015-4478).

* gnu/packages/patches/icecat-CVE-2015-4473-partial.patch,
  gnu/packages/patches/icecat-CVE-2015-4482.patch,
  gnu/packages/patches/icecat-CVE-2015-4488.patch,
  gnu/packages/patches/icecat-CVE-2015-4489.patch,
  gnu/packages/patches/icecat-CVE-2015-4491.patch,
  gnu/packages/patches/icecat-CVE-2015-4492.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patches.

* gnu/packages/linux.scm (linux-libre): Update to 4.1.5.

* gnu/packages/telephony.scm (sipwitch): Update to 1.9.9.

* gnu/packages/telephony.scm (ucommon): Update to 6.5.1.

* gnu/packages/ssh.scm (openssh): Update to 7.0p1.

* gnu/packages/ratpoison.scm (ratpoison): Update to 1.4.8.
* gnu/packages/patches/ratpoison-shell.patch: Adapt to it.

* gnu/packages/video.scm (avidemux): Update to 2.6.10. Disable the GTK+
  build, which fails, and remove the gtk+ input.

* gnu/packages/patches/wicd-bitrate-none-fix.patch,
  gnu/packages/patches/wicd-get-selected-profile-fix.patch: New files.
* gnu-system.am (dist_patch_DATA): Add them.
* gnu/packages/wicd.scm (wicd)[source]: Add patches.

* gnu/packages/gnupg.scm (gnupg): Update to 2.1.7.

* .mailmap: Add new lines for Andy Wingo and Eric Dvorsak.

* gnu/packages/ebook.scm (calibre): Update to 2.34.0.

* gnu/packages/qt.scm (python-sip, python2-sip, python-pyqt, python2-pyqt,
    python-pyqt-4, python2-pyqt-4)[arguments]: Fix computation of python
    library path for multi-digit python versions.

Fixes bug #21226.

Linux 3.19 introduced a fix for a security vulnerability in user namespaces.
This fix introduced a new proc file called 'setgroups' and was backported to
many older kernels.  However, some users run a kernel that is new enough to
support user namespaces yet old enough to not include the patch, so we must
skip the tests.

* tests/containers.scm: Skip all tests if /proc/self/setgroups does not exist.

* gnu/packages/gnome.scm (epiphany): New variable.

* gnu/packages/qt.scm (python-pyqt-4, python2-pyqt-4): Update to 4.11.4.

* gnu/packages/qt.scm (python-pyqt, python2-pyqt): Update to 5.5.

* gnu/packages/qt.scm (python-sip, python2-sip): Update to 4.16.9.

Reported by Eric Dvorsak <eric@dvorsak.fr> on #guix.

* guix/scripts/import/elpa.scm (%default-options): Remove redundant
  quote which led to an error if --archive option was not specified.

* gnu/packages/python.scm (python-six): Bump to 1.9.0.

* gnu/packages/databases.scm (redis): New variable.

* gnu/packages/gnome.scm (simple-scan): New variable.

* gnu/packages/gnome.scm (gusb): New variable.

* gnu/packages/gtk.scm (gtk-doc): New variable.

Modified-By: Mark H Weaver <mhw@netris.org>

* gnu/packages/scanner.scm (sane-backends): Build with libusb-compat as an
  input and install a udev rule to give users access to scanners.

Modified-By: Mark H Weaver <mhw@netris.org>

* gnu/packages/libusb.scm (libusb-compat): New variable.

Modified-By: Mark H Weaver <mhw@netris.org>

* gnu/packages/gv.scm (ghostscript/x): Move ...
* gnu/packages/ghostscript.scm (ghostscript/x): ... to here.

It's not always possible to map 65536 uids when creating a container as the
root user within another user namespace.  This is true when building Guix
within the build daemon's container.  By using a uid range of 1 by default,
even as the root user, the tests now pass.

* gnu/build/linux-container.scm (initialize-user-namespace, run-container):
  Add 'host-uids' argument.
  (call-with-container): Add #:host-uids keyword argument.
* tests/containers.scm ("container-excursion"): Update 'run-container' call.

* gnu/build/file-systems.scm (regular-file?): New procedure.
  (mount-file-system): Create a regular file instead of a directory when bind
  mounting a regular file.

* gnu/packages/video.scm (aalib)[arguments]: In configure phase, accept
  'build' keyword argument and pass it to 'configure'.

* gnu/packages/patches/icecat-CVE-2015-4495.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/gnuzilla.scm (icecat)[source]: Add patch.  Move the 'patches'
  field above the snippet.

* gnu/packages/patches/python2-sqlite-3.8.4-test-fix.patch,
  gnu/packages/patches/python-libffi-mips-n32-fix.patch: Remove files.
* gnu-system.am (dist_patch_DATA): Remove them.
* gnu/packages/python.scm (python-2): Update to 2.7.10.  Remove patches.
  Update comment showing test failures.

* guix/build/python-build-system.scm (get-python-version): Rewrite to handle
  multiple-digit version number components.

Upstream changed the tarball contents without changing the version number.

* gnu/packages/audio.scm (vamp)[source]: Update source URI and hash.

* gnu/packages/messaging.scm (pidgin-otr): New variable.

* gnu/packages/patches/pidgin-add-search-path.patch: New file.
* gnu-system.am (dist_patch_DATA): Add it.
* gnu/packages/messaging.scm (pidgin): New variable.

* gnu/packages/messaging.scm (libotr)[description]: Modify formatting.

* gnu/packages/linux.scm (linux-libre-4.0): Remove.

* gnu/system.scm (<operating-system>)[kernel]: Change default to
  LINUX-LIBRE.

* gnu/packages/linux.scm (linux-libre): Update to 4.1.4.

* gnu/packages/node.scm (node): Update to 0.12.7.