gnu: bootloaders: Add uki-efi-bootloader.

* gnu/bootloader.scm (<bootloader-configuration>): New keypair field. * gnu/bootloader/uki.scm: New file. * gnu/local.mk (GNU_SYSTEM_MODULES): Add bootloader/uki.scm. * doc/guix.texi (Bootloader Configuration): Document UKI bootloader. Change-Id: I2097da9f3dd35137b3419f6d0545de26d53cb6da
gnu: system: Fix bootloader crypto device recognition.
2024-11-07 07:26:13 -05:00 · 2024-10-08 10:36:42 -04:00 · 2024-10-08 10:36:42 -04:00 · 2024-10-08 10:36:41 -04:00 · 2024-10-08 10:36:41 -04:00 · 2024-10-08 10:36:41 -04:00
159 changed files with 71256 additions and 67357 deletions
--- a/doc/guix.texi
+++ b/doc/guix.texi
@ -49,7 +49,7 @@ Copyright @copyright{} 2017 humanitiesNerd@*
 Copyright @copyright{} 2017, 2021 Christine Lemmer-Webber@*
 Copyright @copyright{} 2017, 2018, 2019, 2020, 2021, 2022 Marius Bakke@*
 Copyright @copyright{} 2017, 2019, 2020, 2022 Hartmut Goebel@*
-Copyright @copyright{} 2017, 2019, 2020, 2021, 2022, 2023 Maxim Cournoyer@*
+Copyright @copyright{} 2017, 2019, 2020, 2021, 2022, 2023, 2024 Maxim Cournoyer@*
 Copyright @copyright{} 2017–2022 Tobias Geerinckx-Rice@*
 Copyright @copyright{} 2017 George Clemmer@*
 Copyright @copyright{} 2017 Andy Wingo@*
@ -130,6 +130,7 @@ Copyright @copyright{} 2024 Richard Sent@*
 Copyright @copyright{} 2024 Dariqq@*
 Copyright @copyright{} 2024 Denis 'GNUtoo' Carikli@*
 Copyright @copyright{} 2024 Fabio Natali@*
+Copyright @copyright{} 2024 Lilah Tascheter@*

 Permission is granted to copy, distribute and/or modify this document
 under the terms of the GNU Free Documentation License, Version 1.3 or
@ -2528,12 +2529,9 @@ in particular:
 Make sure the @code{bootloader-configuration} form refers to the targets
 you want to install GRUB on.  It should mention @code{grub-bootloader}
 if you are installing GRUB in the legacy way, or
-@code{grub-efi-bootloader} for newer UEFI systems.  For legacy systems,
-the @code{targets} field contain the names of the devices, like
-@code{(list "/dev/sda")}; for UEFI systems it names the paths to mounted
-EFI partitions, like @code{(list "/boot/efi")}; do make sure the paths
-are currently mounted and a @code{file-system} entry is specified in
-your configuration.
+@code{grub-efi-bootloader} for newer UEFI systems.
+@xref{Bootloader Configuration} for information on how to format the
+@code{targets} field.

@item
 Be sure that your file system labels match the value of their respective
@ -2665,11 +2663,13 @@ If you build a disk image and the bootloader is not available otherwise
 includes the bootloader, specifically:

@example
-guix system image --system=armhf-linux -e '((@@ (gnu system install) os-with-u-boot) (@@ (gnu system install) installation-os) "A20-OLinuXino-Lime2")'
+guix system image --system=armhf-linux -e '(@ (gnu system install) beaglebone-black-installation-os)'
@end example

-@code{A20-OLinuXino-Lime2} is the name of the board.  If you specify an invalid
-board, a list of possible boards will be printed.
+@code{beaglebone-black} is the name of the board.  Similar
+@code{installation-os} variables exist for most other supported boards.
+Otherwise, you can use @code{embedded-installation-os}, passing it a u-boot
+bootloader and the desired console tty.


@c *********************************************************************
@ -4762,6 +4762,11 @@ Note that @command{guix time-machine} can trigger builds of channels and
 their dependencies, and these are controlled by the standard build
 options (@pxref{Common Build Options}).

+If @command{guix time-machine} is executed without any command, it
+prints the file name of the profile that would be used to execute the
+command.  This is sometimes useful if you need to get store file name of
+the profile---e.g., when you want to @command{guix copy} it.
+
@node Inferiors
@section Inferiors

@ -17268,7 +17273,9 @@ the @code{bootloader} field should contain something along these lines:
@lisp
 (bootloader-configuration
  (bootloader grub-efi-bootloader)
-  (targets '("/boot/efi")))
+  (targets (list (bootloader-target
+                   (type 'esp)
+                   (path "/boot/efi")))))
@end lisp

@xref{Bootloader Configuration}, for more information on the available
@ -17574,8 +17581,10 @@ from--e.g. @code{(list ddcci-driver-linux)}.
 List of strings or gexps representing additional arguments to pass on
 the command-line of the kernel---e.g., @code{("console=ttyS0")}.

-@item @code{bootloader}
-The system bootloader configuration object.  @xref{Bootloader Configuration}.
+@item @code{bootloader} (default: '())
+The system bootloader configuration object.  Can either be a single
+@code{bootloader-configuration} or a list of them, to install multiple or no
+bootloaders.  @xref{Bootloader Configuration}.

@item @code{label}
 This is the label (a string) as it appears in the bootloader's menu entry.
@ -18770,7 +18779,9 @@ configuration would look like:
  (keyboard-layout (keyboard-layout "tr"))  ;for the console
  (bootloader (bootloader-configuration
                (bootloader grub-efi-bootloader)
-                (targets '("/boot/efi"))
+                (targets (list (bootloader-target
+                                 (type 'esp)
+                                 (path "/boot/efi"))))
                (keyboard-layout keyboard-layout))) ;for GRUB
  (services (cons (set-xorg-configuration
                    (xorg-configuration             ;for Xorg
@ -21085,6 +21096,11 @@ ISC DHCP client listens only on the specified interfaces.
@item @code{config-file} (default: @code{#f})
 The configuration file for the ISC DHCP client.

+@item @code{version} (default: @code{"4"})
+The DHCP protocol version to use, as a string.  Accepted values are
+@code{"4"} or @code{"6"} for DHCPv4 or DHCPv6, respectively, as well as
+@code{"4o6"}, for DHCPv4 over DHCPv6 (as specified by RFC 7341).
+
@item @code{shepherd-requirement} (default: @code{'()})
@itemx @code{shepherd-provision} (default: @code{'(networking)})
 This option can be used to provide a list of symbols naming Shepherd services
@ -23159,9 +23175,9 @@ definition (@pxref{operating-system Reference, system-wide packages}).

@anchor{wayland-gdm}
 GDM also supports Wayland: it can itself use Wayland instead of X11 for
-its user interface, and it can also start Wayland sessions.  The former is
-required for the latter, to enable, set @code{wayland?} to @code{#t} in
-@code{gdm-configuration}.
+its user interface, and it can also start Wayland sessions.  Wayland
+support is enabled by default.  To disable it, set @code{wayland?} to
+@code{#f} in @code{gdm-configuration}.

@defvar gdm-service-type
 This is the type for the @uref{https://wiki.gnome.org/Projects/GDM/, GNOME
@ -23222,7 +23238,7 @@ File name of the @code{dbus-daemon} executable.
@item @code{gdm} (default: @code{gdm})
 The GDM package to use.

-@item @code{wayland?} (default: @code{#f})
+@item @code{wayland?} (default: @code{#t})
 When true, enables Wayland in GDM, necessary to use Wayland sessions.

@item @code{wayland-session} (default: @code{gdm-wayland-session-wrapper})
@ -39353,6 +39369,7 @@ like to serve.

@subsubheading Joycond service
@cindex joycond
+@cindex nintendo controllers
 The joycond service allows the pairing of Nintendo joycon game
 controllers over Bluetooth. (@pxref{Desktop Services} for setting up
 Bluetooth.)
@ -39367,7 +39384,10 @@ The joycond package to use.
@end deftp

@defvar joycond-service-type
-Service type for the joycond service.
+Service type for the joycond service.  It also extends the
+@code{udev-service-type} with the @code{joycond} package (provided via
+the @code{joycond-configuration} configuration), so that joycond
+controllers can be detected and used by an unprivileged user.
@end defvar

@subsubheading The Battle for Wesnoth Service
@ -42223,131 +42243,176 @@ The type of a bootloader configuration declaration.
@cindex EFI, bootloader
@cindex UEFI, bootloader
@cindex BIOS, bootloader
-The bootloader to use, as a @code{bootloader} object.  For now
-@code{grub-bootloader}, @code{grub-efi-bootloader},
-@code{grub-efi-removable-bootloader}, @code{grub-efi-netboot-bootloader},
-@code{grub-efi-netboot-removable-bootloader}, @code{extlinux-bootloader}
-and @code{u-boot-bootloader} are supported.
+The bootloader to use.  Available bootloaders, in addition to what
+target types they require, are as follows:
+
+@itemize
+@vindex depthcharge-veyron-speedy-bootloader
+@item @code{depthcharge-veyron-speedy-bootloader}
+For the Asus C201.  Requires a @code{'part} target, denoting the partition to
+install the kernel blob as a @code{device}, @code{label}, or @code{uuid}.
+
+@vindex grub-bootloader
+@item @code{grub-bootloader}
+GRUB2 for BIOS systems.  Requires a @code{'disk} target providing either a
+@code{device}, @code{label}, or @code{uuid}.  If root is mounted over NFS, it
+will load its files and the Guix System over
+@acronym{PXE, Preboot eXecution Environment}.
+
+@vindex grub-minimal-bootloader
+@item @code{grub-minimal-bootloader}
+As above, but using a minimal build of GRUB.
+
+@vindex grub-efi-bootloader
+@item @code{grub-efi-bootloader}
+GRUB2 for "modern" systems using the
+@acronym{UEFI, Unified Extensible Firmware Interface}.  It requires an
+@code{'esp} target providing a mount point @code{path} for the EFI
+System Partition.  If root is mounted over NFS, a PXE client will load
+the boot files and Guix System from a
+@acronym{TFTP, Trivial File Transfer Protocol} server, discovered via
+@acronym{DHCP, Dynamic Host Configuration Protocol}.
+
+@code{override} expects a procedure with @code{grub-configuration}
+argument and return value, when a GRUB bootloader is specified:
+
+@deftp {Data Type} grub-menu-entry
+Available @code{grub-menu-entry} fields are:
+@table @asis
+@item @code{label} (type: string)
+Entry label with e.g.  rank, kernel, and date.
+@item @code{device} (type: grub-device)
+Device UUID or label, NFS path, or block device path, with payload.
+@item @code{device-mount-point} (type: maybe-string)
+Remove prefix from relevant paths.
+@item @code{device-subvol} (type: maybe-string)
+Access files from this Btrfs subvolume.
+@item @code{directive} (type: directive-or-file-like)
+Configuration for a Linux or Multiboot directive, or a file for the
+chainloader directive.
+@deftp {Data Type} linux-directive
+Available @code{linux-directive} fields are:
+@table @asis
+@item @code{extra-initrd} (type: maybe-string)
+Path to out-of-store initrd with secrets.
+@item @code{initrd} (type: file-like)
+The initial RAM disk to use.
+@item @code{kernel} (type: file-like)
+The Linux kernel image to boot.
+@item @code{arguments} (type: string-list)
+The list of extra Linux kernel command-line arguments.
+@end table
+@end deftp
+@deftp {Data Type} multiboot-directive
+Available @code{multiboot-directive} fields are:
+@table @asis
+@item @code{kernel} (type: file-like)
+The Multiboot kernel image to boot.
+@item @code{arguments} (default: @code{()}) (type: string-list)
+The list of Multiboot kernel command-line arguments.
+@item @code{modules} (default: @code{()}) (type: file-like-list)
+The list of commands for loading Multiboot modules.
+@end table
+@end deftp
+@end table
+@end deftp
+
+@vindex extlinux-bootloader
+@item @code{extlinux-bootloader}
+Extlinux for "legacy" BIOS systems which use an MBR partition table.
+It requires a @code{'disk} target providing either a @code{device},
+@code{label}, or @code{uuid}.
+
+@vindex extlinux-gpt-bootloader
+@item @code{extlinux-gpt-bootloader}
+This is the same as above, but for systems with a GPT partition table.
+
+@cindex Secure Boot, UEFI
+@vindex uki-efi-bootloader
+@item @code{uki-efi-bootloader}
+Makes and installs UKI images for UEFI systems.  Requires an @code{'esp}
+target providing a @code{path} to the mount point of the EFI System
+Partition.  Not all system generations may be available with this
+option, as UKI images contain the entire kernel and initramfs, and ESPs
+tend to be small.
+
+Full disk encryption with @code{uki-efi-bootloader} only requires a
+single password entry with fast decryption, in contrast to GRUB2
+requiring a second password entry with slow, LUKS1-only decryption.
+
+This is the only bootloader to currently support UEFI Secure Boot, when
+configured as below.
+
+[THE CONFIGURATION BELOW]

@cindex ARM, bootloaders
@cindex AArch64, bootloaders
-Available bootloaders are described in @code{(gnu bootloader @dots{})}
-modules.  In particular, @code{(gnu bootloader u-boot)} contains definitions
-of bootloaders for a wide range of ARM and AArch64 systems, using the
-@uref{https://www.denx.de/wiki/U-Boot/, U-Boot bootloader}.
+@vindex u-boot-a20-olinuxino-lime-bootloader
+@vindex u-boot-a20-olinuxino-lime2-bootloader
+@vindex u-boot-a20-olinuxino-micro-bootloader
+@vindex u-boot-bananapi-m2-ultra-bootloader
+@vindex u-boot-beaglebone-black-bootloader
+@vindex u-boot-cubietruck-bootloader
+@vindex u-boot-firefly-rk3399-bootloader
+@vindex u-boot-mx6cuboxi-bootloader
+@vindex u-boot-nanopi-r4s-bootloader
+@vindex u-boot-nintendo-nes-classic-edition-bootloader
+@vindex u-boot-novena-bootloader
+@vindex u-boot-orangepi-r1-plus-lts-rk3328-bootloader
+@vindex u-boot-orangepi-zero-2w-bootloader
+@vindex u-boot-pine64-plus-bootloader
+@vindex u-boot-pine64-lts-bootloader
+@vindex u-boot-pinebook-bootloader
+@vindex u-boot-pinebook-pro-rk3399-bootloader
+@vindex u-boot-puma-rk3399-bootloader
+@vindex u-boot-qemu-riscv64-bootloader
+@vindex u-boot-rock64-rk3328-bootloader
+@vindex u-boot-rockpro64-rk3399-bootloader
+@vindex u-boot-rpi-2-bootloader
+@vindex u-boot-rpi-3-bootloader
+@vindex u-boot-rpi-4-bootloader
+@vindex u-boot-rpi-bootloader
+@vindex u-boot-sifive-unmatched-bootloader
+@vindex u-boot-starfive-visionfive2-bootloader
+@vindex u-boot-ts7970-q-2g-1000mhz-c-bootloader
+@vindex u-boot-wandboard-bootloader
+@item U-Boot
+U-Boot has individual bootloaders @code{u-boot-board-bootloader} for
+each of the following @code{board}s: @code{a20-olinuxino-lime},
+@code{a20-olinuxino-lime2}, @code{a20-olinuxino-micro},
+@code{bananapi-m2-ultra}, @code{beaglebone-black}, @code{cubietruck},
+@code{firefly-rk3399}, @code{mx6cuboxi}, @code{nanopi-r4s},
+@code{nintendo-nes-classic-edition}, @code{novena},
+@code{orangepi-r1-plus-lts-rk3328}, @code{orangepi-zero-2w},
+@code{pine64-plus}, @code{pine64-lts}, @code{pinebook},
+@code{pinebook-pro-rk3399}, @code{puma-rk3399}, @code{qemu-riscv64},
+@code{rock64-rk3328}, @code{rockpro64-rk3399}, @code{rpi-2},
+@code{rpi-3}, @code{rpi-4}, @code{rpi}, @code{sifive-unmatched},
+@code{ts7970-q-2g-1000mhz-c}, and @code{wandboard}.

-@vindex grub-bootloader
-@code{grub-bootloader} allows you to boot in particular Intel-based machines
-in ``legacy'' BIOS mode.
+Each of these require a @code{'disk} target providing either a @code{device},
+@code{label}, or @code{uuid}, except the @code{ts7970-q-2g-1000mhz-c}
+and @code{qemu-riscv64} boards.  Here the bootloader just copies U-Boot
+to @file{/boot/u-boot.imx} or @file{/boot/u-boot.bin}, respectively.
+You should then manually flash it to the SPI flash at the U-Boot prompt.

-@vindex grub-efi-bootloader
-@code{grub-efi-bootloader} allows to boot on modern systems using the
-@dfn{Unified Extensible Firmware Interface} (UEFI).  This is what you should
-use if the installation image contains a @file{/sys/firmware/efi} directory
-when you boot it on your system.
-
-@vindex grub-efi-removable-bootloader
-@code{grub-efi-removable-bootloader} allows you to boot your system from
-removable media by writing the GRUB file to the UEFI-specification location of
-@file{/EFI/BOOT/BOOTX64.efi} of the boot directory, usually @file{/boot/efi}.
-This is also useful for some UEFI firmwares that ``forget'' their configuration
-from their non-volatile storage. Like @code{grub-efi-bootloader}, this can only
-be used if the @file{/sys/firmware/efi} directory is available.
-
-@quotation Note
-This @emph{will} overwrite the GRUB file from any other operating systems that
-also place their GRUB file in the UEFI-specification location; making them
-unbootable.
-@end quotation
-
-@vindex grub-efi-netboot-bootloader
-@code{grub-efi-netboot-bootloader} allows you to boot your system over network
-through TFTP@.  In combination with an NFS root file system this allows you to
-build a diskless Guix system.
-
-The installation of the @code{grub-efi-netboot-bootloader} generates the
-content of the TFTP root directory at @code{targets} (@pxref{Bootloader
-Configuration, @code{targets}}) below the sub-directory @file{efi/Guix}, to be
-served by a TFTP server.  You may want to mount your TFTP server directories
-onto the @code{targets} to move the required files to the TFTP server
-automatically during installation.
-
-If you plan to use an NFS root file system as well (actually if you mount the
-store from an NFS share), then the TFTP server needs to serve the file
-@file{/boot/grub/grub.cfg} and other files from the store (like GRUBs background
-image, the kernel (@pxref{operating-system Reference, @code{kernel}}) and the
-initrd (@pxref{operating-system Reference, @code{initrd}})), too.  All these
-files from the store will be accessed by GRUB through TFTP with their normal
-store path, for example as
-@file{tftp://tftp-server/gnu/store/…-initrd/initrd.cpio.gz}.
-
-Two symlinks are created to make this possible.  For each target in the
-@code{targets} field, the first symlink is
-@samp{target}@file{/efi/Guix/boot/grub/grub.cfg} pointing to
-@file{../../../boot/grub/grub.cfg}, where @samp{target} may be
-@file{/boot}.  In this case the link is not leaving the served TFTP root
-directory, but otherwise it does.  The second link is
-@samp{target}@file{/gnu/store} and points to @file{../gnu/store}.  This
-link is leaving the served TFTP root directory.
-
-The assumption behind all this is that you have an NFS server exporting
-the root file system for your Guix system, and additionally a TFTP
-server exporting your @code{targets} directories—usually a single
-@file{/boot}—from that same root file system for your Guix system.  In
-this constellation the symlinks will work.
-
-For other constellations you will have to program your own bootloader
-installer, which then takes care to make necessary files from the store
-accessible through TFTP, for example by copying them into the TFTP root
-directory for your @code{targets}.
-
-It is important to note that symlinks pointing outside the TFTP root directory
-may need to be allowed in the configuration of your TFTP server.  Further the
-store link exposes the whole store through TFTP@.  Both points need to be
-considered carefully for security aspects.  It is advised to disable any TFTP
-write access!
-
-Please note, that this bootloader will not modify the ‘UEFI Boot Manager’ of
-the system.
-
-Beside the @code{grub-efi-netboot-bootloader}, the already mentioned TFTP and
-NFS servers, you also need a properly configured DHCP server to make the booting
-over netboot possible.  For all this we can currently only recommend you to look
-for instructions about @acronym{PXE, Preboot eXecution Environment}.
-
-If a local EFI System Partition (ESP) or a similar partition with a FAT
-file system is mounted in @code{targets}, then symlinks cannot be
-created.  In this case everything will be prepared for booting from
-local storage, matching the behavior of @code{grub-efi-bootloader}, with
-the difference that all GRUB binaries are copied to @code{targets},
-necessary for booting over the network.
-
-@vindex grub-efi-netboot-removable-bootloader
-@code{grub-efi-netboot-removable-bootloader} is identical to
-@code{grub-efi-netboot-bootloader} with the exception that the
-sub-directory @file{efi/boot} will be used instead of @file{efi/Guix} to
-comply with the UEFI specification for removable media.
-
-@quotation Note
-This @emph{will} overwrite the GRUB file from any other operating systems that
-also place their GRUB file in the UEFI-specification location; making them
-unbootable.
-@end quotation
+By default Guix configures U-Boot to use a generated extlinux config.
+However U-Boot can be configured to run a UEFI application, if you want
+to chain load another bootloader.
+@end itemize

@item @code{targets}
-This is a list of strings denoting the targets onto which to install the
-bootloader.
+This is a list of @code{bootloader-target} (see below) structures denoting
+where the bootloader should install itself.  Interpretation of specific target
+types and target requirements depend on the specific @code{bootloader} used.

-The interpretation of targets depends on the bootloader in question.
-For @code{grub-bootloader}, for example, they should be device names
-understood by the bootloader @command{installer} command, such as
-@code{/dev/sda} or @code{(hd0)} (@pxref{Invoking grub-install,,, grub,
-GNU GRUB Manual}).  For @code{grub-efi-bootloader} and
-@code{grub-efi-removable-bootloader} they should be mount
-points of the EFI file system, usually @file{/boot/efi}.  For
-@code{grub-efi-netboot-bootloader}, @code{targets} should be the mount
-points corresponding to TFTP root directories served by your TFTP
-server.
+@quotation Note
+Bootloaders have a set of default targets, that can interact with user-specified
+targets.  For UEFI bootloaders using the @code{'esp} target, this typically
+includes a @code{'vendir} target.  If you configure multiple UEFI bootloaders,
+you should set different @code{'vendir} target @code{path}s for each, each
+@code{offset} from @code{'esp}.
+@end quotation

@item @code{menu-entries} (default: @code{'()})
 A possibly empty list of @code{menu-entry} objects (see below), denoting
@ -42358,6 +42423,29 @@ system entry and the entry pointing to previous system generations.
 The index of the default boot menu entry.  Index 0 is for the entry of the
 current system.

+@item @code{efi-removable?} (default: @var{#f})
+Used by all UEFI bootloaders to determine whether they should be installed to
+the UEFI standard fallback bootloader path (on x86_64,
+@file{/EFI/BOOT/BOOTX64.EFI}).  This allows it to be booted from removable media
+or otherwise in cases where the system has not been booted from UEFI already.
+
+@quotation Warning
+This will override any other bootloaders installed to the same path!
+@end quotation
+
+@item @code{32bit?} (default: @var{#f})
+Some 64-bit systems require their bootloaders to be 32-bit, including some early
+UEFI systems and some Raspberry Pis.  If that is the case, and the bootloader
+supports it, setting this option will force the bootloader to install as if it
+were on a 32-bit system.
+
+@item @code{keypair} (default: @var{#f})
+Designates a keypair to be used by bootloaders that support some kind of
+cryptographic signature, such as UEFI Secure Boot.  This must be a pair
+@code{'(cert . priv)} of paths to the public key (@code{cert}) and private key
+(@code{priv}).  The keys these paths point to should be owned by root with 600
+permissions for security purposes.
+
@item @code{timeout} (default: @code{5})
 The number of seconds to wait for keyboard input before booting.  Set to
 0 to boot immediately, and to -1 to wait indefinitely.
@ -42380,19 +42468,20 @@ The bootloader theme object describing the theme to use.  If no theme
 is provided, some bootloaders might use a default theme, that's true
 for GRUB.

-@item @code{terminal-outputs} (default: @code{'(gfxterm)})
+@item @code{terminal-outputs} (default: @var{#f})
 The output terminals used for the bootloader boot menu, as a list of
-symbols.  GRUB accepts the values: @code{console}, @code{serial},
-@code{serial_@{0-3@}}, @code{gfxterm}, @code{vga_text},
-@code{mda_text}, @code{morse}, and @code{pkmodem}.  This field
-corresponds to the GRUB variable @code{GRUB_TERMINAL_OUTPUT} (@pxref{Simple
-configuration,,, grub,GNU GRUB manual}).
+symbols.  When @var{#f}, the default is used.  For GRUB this is @code{gfxterm}.
+GRUB accepts the values: @code{console}, @code{serial}, @code{serial_@{0-3@}},
+@code{gfxterm}, @code{vga_text}, @code{mda_text}, @code{morse}, and
+@code{pkmodem}.  This field corresponds to the GRUB variable
+@code{GRUB_TERMINAL_OUTPUT}
+(@pxref{Simple configuration,,, grub,GNU GRUB manual}).

-@item @code{terminal-inputs} (default: @code{'()})
+@item @code{terminal-inputs} (default: @code{#f})
 The input terminals used for the bootloader boot menu, as a list of
-symbols.  For GRUB, the default is the native platform terminal as
-determined at run-time.  GRUB accepts the values: @code{console},
-@code{serial}, @code{serial_@{0-3@}}, @code{at_keyboard}, and
+symbols, or @code{#f} to use the default.  For GRUB, this is the native
+platform terminal as determined at run-time.  GRUB accepts the values:
+@code{console}, @code{serial}, @code{serial_@{0-3@}}, @code{at_keyboard}, and
@code{usb_keyboard}.  This field corresponds to the GRUB variable
@code{GRUB_TERMINAL_INPUT} (@pxref{Simple configuration,,, grub,GNU GRUB
 manual}).
@ -42468,6 +42557,51 @@ Currently only supported by GRUB.

@end deftp

+@vindex bootloader-target
+Configuring bootloader targets uses a specialized record designed for clarity
+and to abstract over the varying user-supplied paths bootloaders.  Only the
+@code{type} field is required; Guix will attempt to extrapolate as needed from
+what information you provide, though at least one of @code{path}, @code{device},
+@code{label}, or @code{uuid} is required to do so.
+
+@deftp {Data Type} bootloader-target
+The type of a target as used in @code{bootloader-configuration}.
+
+@table @asis
+
+@item @code{type}
+What target this record is describing.  Must be a symbol, for example
+@code{'esp} or @code{'disk}.
+
+@item @code{path} (default: @var{#f})
+@code{path} denotes a string path, usually interpreted by the bootloader to
+signify a mount point (such as in the case of @code{'esp}).  This value is
+automatically offset from the target denoted by @code{offset}, even if the path
+given is absolute.  This allows for bootloaders to know what device or partition
+a @code{path} is actually stored on, and how to locate it.
+
+@item @code{offset} (default: @code{'root} when @code{path}, otherwise @var{#f})
+All @code{path} values, even if absolute, are automatically offset from another.
+@code{offset} is a symbol denoting which target type the path should be offset
+from.  This allows for bootloaders to know what device or partition a
+@code{path} is actually stored on, and how to locate it.
+
+@item @code{device} (default: @var{#f})
+@itemx @code{label} (default: @var{#f})
+@itemx @code{uuid} (default: @var{#f})
+These all work as a way of defining some kind of physical device or partition.
+Using @code{uuid} and @code{label} to refer to a filesystem's UUID or
+label is vastly preferred over using @code{device} to refer to block
+devices, as they can vary per boot and may not exist at boot-time.
+
+@item @code{file-system} (default: @var{#f})
+A string denoting a file system type, as used in @ref{File Systems}.  Unless
+your filesystem isn't being detected properly, or is unmounted at bootloader
+install-time, you shouldn't need to specify this.
+
+@end table
+@end deftp
+
@cindex dual boot
@cindex boot menu
 Should you want to list additional boot menu entries @i{via} the
@ -42479,6 +42613,8 @@ along these lines:
@lisp
 (menu-entry
  (label "The Other Distro")
+  (device (file-system-label "boot"))
+  (device-mount-point "/boot")
  (linux "/boot/old/vmlinux-2.6.32")
  (linux-arguments '("root=/dev/sda2"))
  (initrd "/boot/old/initrd"))
@ -42494,6 +42630,29 @@ The type of an entry in the bootloader menu.
@item @code{label}
 The label to show in the menu---e.g., @code{"GNU"}.

+@item @code{device} (default: @var{#f})
+The device where any files specified below are to be found.  For GRUB,
+this is what @dfn{root} (@pxref{root,,, grub, GNU GRUB manual}) is set
+to for this menu entry.
+
+This may be a file system label (a string), a file system UUID (a
+bytevector, @pxref{File Systems}), or @code{#f}, in which case
+the bootloader will search the device containing the file specified by
+the @code{linux} field (@pxref{search,,, grub, GNU GRUB manual}).  It
+must @emph{not} be an OS device name such as @file{/dev/sda1}.
+
+@item @code{device-mount-point} (default: @var{#f})
+This is where @code{device} is mounted onto your file system.  If provided, it
+allows for you to specify full paths for provided files, which will be
+automatically realized into paths local to their device.
+
+This is not necessary if specified files are already referring to files local to
+@code{device}, including if they're on your root filesystem.
+
+@item @code{device-subvol} (default: @var{#f})
+This is a btrfs subvolume name, useful in case you wish to access files from a
+btrfs subvolume on a device.  @xref{Btrfs file system}.
+
@item @code{linux} (default: @code{#f})
 The Linux kernel image to boot, for example:

@ -42501,17 +42660,6 @@ The Linux kernel image to boot, for example:
 (file-append linux-libre "/bzImage")
@end lisp

-For GRUB, it is also possible to specify a device explicitly in the
-file path using GRUB's device naming convention (@pxref{Naming
-convention,,, grub, GNU GRUB manual}), for example:
-
-@example
-"(hd0,msdos1)/boot/vmlinuz"
-@end example
-
-If the device is specified explicitly as above, then the @code{device}
-field is ignored entirely.
-
@item @code{linux-arguments} (default: @code{'()})
 The list of extra Linux kernel command-line arguments---e.g.,
@code{'("console=ttyS0")}.
@ -42520,16 +42668,6 @@ The list of extra Linux kernel command-line arguments---e.g.,
 A G-Expression or string denoting the file name of the initial RAM disk
 to use (@pxref{G-Expressions}).

-@item @code{device} (default: @code{#f})
-The device where the kernel and initrd are to be found---i.e., for GRUB,
-@dfn{root} for this menu entry (@pxref{root,,, grub, GNU GRUB manual}).
-
-This may be a file system label (a string), a file system UUID (a
-bytevector, @pxref{File Systems}), or @code{#f}, in which case
-the bootloader will search the device containing the file specified by
-the @code{linux} field (@pxref{search,,, grub, GNU GRUB manual}).  It
-must @emph{not} be an OS device name such as @file{/dev/sda1}.
-
@item @code{multiboot-kernel} (default: @code{#f})
 The kernel to boot in Multiboot-mode (@pxref{multiboot,,, grub, GNU GRUB
 manual}).  When this field is set, a Multiboot menu-entry is generated.
@ -42552,7 +42690,7 @@ console (use options @option{--nographic} @option{--serial mon:stdio}):
 To use the new and still experimental
@uref{https://darnassus.sceen.net/~hurd-web/rump_kernel/, rumpdisk
 user-level disk driver} instead of GNU@tie{}Mach's in-kernel IDE driver,
-set @code{kernel-arguments} to:
+set @code{multiboot-arguments} to:

@lisp
 '("noide")
@ -42575,10 +42713,11 @@ The list of commands for loading Multiboot modules.  For example:
@end lisp

@item @code{chain-loader} (default: @code{#f})
-A string that can be accepted by @code{grub}'s @code{chainloader}
-directive. This has no effect if either @code{linux} or
-@code{multiboot-kernel} fields are specified. The following is an
-example of chainloading a different GNU/Linux system.
+Varies slightly depending on bootloader.  For @code{grub}, this is
+anything that the @code{chainloader} directive can accept
+(@pxref{Chain-loading,,, grub, GNU GRUB manual}).  For @code{uki-efi},
+this is any efi binary to be installed alongside the system.  The
+following is an example of chainloading a different GNU/Linux system.

@lisp
 (bootloader
@ -42786,10 +42925,6 @@ and it moves the entries for the other generations to a submenu, if
 supported by the bootloader being used.  The next time the system
 boots, it will use the specified system generation.

-The bootloader itself is not being reinstalled when using this
-command.  Thus, the installed bootloader is used with an updated
-configuration file.
-
 The target generation can be specified explicitly by its generation
 number.  For example, the following invocation would switch to system
 generation 7:
@ -42810,11 +42945,10 @@ guix system switch-generation -- -1
@end example

 Currently, the effect of invoking this action is @emph{only} to switch
-the system profile to an existing generation and rearrange the
-bootloader menu entries.  To actually start using the target system
-generation, you must reboot after running this action.  In the future,
-it will be updated to do the same things as @command{reconfigure},
-like activating and deactivating services.
+the system profile to an existing generation and reinstall the bootloader.  To
+actually start using the target system generation, you must reboot after
+running this action.  In the future, it will be updated to do the same things
+as @command{reconfigure}, like activating and deactivating services.

 This action will fail if the specified generation does not exist.

@ -42990,11 +43124,9 @@ types.
 When using the @code{qcow2} image type, the returned image is in qcow2
 format, which the QEMU emulator can efficiently use. @xref{Running Guix
 in a VM}, for more information on how to run the image in a virtual
-machine.  The @code{grub-bootloader} bootloader is always used
-independently of what is declared in the @code{operating-system} file
-passed as argument.  This is to make it easier to work with QEMU, which
-uses the SeaBIOS BIOS by default, expecting a bootloader to be installed
-in the Master Boot Record (MBR).
+machine.  Currently, QEMU as packaged in Guix does not have UEFI support,
+so you should select a bootloader for BIOS systems in your
+@code{operating-system} configuration.

@cindex docker-image, creating docker images
 When using the @code{docker} image type, a Docker image is produced.
@ -43312,7 +43444,6 @@ evaluates to.  As an example, @var{file} might contain a definition like this:
 ;; forwarded to the host's loopback interface.

 (use-service-modules networking ssh)
-(use-package-modules bootloaders)

 (define %system
  (operating-system
@ -43320,7 +43451,9 @@ evaluates to.  As an example, @var{file} might contain a definition like this:
   (timezone "Etc/UTC")
   (bootloader (bootloader-configuration
                (bootloader grub-bootloader)
-                (targets '("/dev/vda"))
+                (targets (list (bootloader-target
+                                 (type 'disk)
+                                 (device "/dev/sda"))))
                (terminal-outputs '(console))))
   (file-systems (cons (file-system
                        (mount-point "/")
@ -47939,6 +48072,12 @@ you want to boot from this partition.  Exactly one partition should have
 this flag set, usually the root one. The @code{'esp} flag identifies a
 UEFI System Partition.

+@item @code{target} (default: @var{#f})
+If provided, this partition provides itself as a bootloader target
+(@pxref{Bootloader Configuration}).  Most commonly, this is used to provide the
+@code{'root} and @code{'esp} targets, with the root partition and EFI System
+Partition, respectively, though this can provide any target necessary.
+
@item @code{initializer} (default: @code{#false})
 The partition initializer procedure as a gexp.  This procedure is called
 to populate a partition.  If no initializer is passed, the
@ -47987,6 +48126,7 @@ You would then write the following image definition in a
    (label "GNU-ESP")
    (file-system "vfat")
    (flags '(esp))
+    (target 'esp)
    (initializer (gexp initialize-efi-partition)))
   (partition
    (size (* 50 MiB))
@ -48003,15 +48143,17 @@ You would then write the following image definition in a
    (label root-label)
    (file-system "ext4")
    (flags '(boot))
+    (target 'root)
    (initializer (gexp initialize-root-partition))))))
@end lisp

-Note that the first and third partitions use generic initializers
-procedures, initialize-efi-partition and initialize-root-partition
-respectively.  The initialize-efi-partition installs a GRUB EFI loader
-that is loading the GRUB bootloader located in the root partition.  The
-initialize-root-partition instantiates a complete system as defined by
-the @code{%simple-os} operating-system.
+Note that the first and third partitions use generic initializer
+procedures, @code{initialize-efi-partition} and
+@code{initialize-root-partition} respectively.
+@code{initialize-efi-partition} simply creates the directory structure
+for an EFI bootloader to install itself to.
+@code{initialize-root-partition} instantiates a complete system as
+defined by the @code{%simple-os} operating-system.

 You can now run:

@ -48068,10 +48210,6 @@ a ROOT boot partition.  This image can be used on most @code{x86_64} and
@code{i686} machines, supporting BIOS or UEFI booting.
@end defvar

-@defvar efi32-disk-image
-Same as @code{efi-disk-image} but with a 32 bits EFI partition.
-@end defvar
-
@defvar iso9660-image
 An ISO-9660 image composed of a single bootable partition.  This image
 can also be used on most @code{x86_64} and @code{i686} machines.
@ -48162,10 +48300,6 @@ Build an image based on the @code{mbr-hybrid-disk-image} image.
 Build an image based on the @code{efi-disk-image} image.
@end defvar

-@defvar efi32-raw-image-type
-Build an image based on the @code{efi32-disk-image} image.
-@end defvar
-
@defvar qcow2-image-type
 Build an image based on the @code{mbr-disk-image} image but with the
@code{compressed-qcow2} image format.
@ -48193,14 +48327,14 @@ the post-MBR gap.
@defvar pinebook-pro-image-type
 Build an image that is targeting the Pinebook Pro machine.  The MBR
 image contains a single partition starting at a @code{9MiB} offset.  The
-@code{u-boot-pinebook-pro-rk3399-bootloader} bootloader will be
+@code{u-boot-pinebook-pro-rk3399-bootloader} bootloader can be
 installed in this gap.
@end defvar

@defvar rock64-image-type
 Build an image that is targeting the Rock64 machine.  The MBR image
 contains a single partition starting at a @code{16MiB} offset.  The
-@code{u-boot-rock64-rk3328-bootloader} bootloader will be installed in
+@code{u-boot-rock64-rk3328-bootloader} bootloader can be installed in
 this gap.
@end defvar

--- a/etc/teams.scm
+++ b/etc/teams.scm
@ -328,6 +328,12 @@ (define-team embedded
        #:scope (list "gnu/packages/bootloaders.scm"
                      "gnu/packages/firmware.scm")))

+(define-team bootloaders
+  (team 'bootloaders
+        #:name "Bootloaders"
+        #:scope (list "gnu/bootloader.scm"
+                      (make-regexp* "^gnu/bootloader/"))))
+
 (define-team rust
  (team 'rust
        #:name "Rust"
@ -465,7 +471,8 @@ (define-team games
  (team 'games
        #:name "Games and Toys"
        #:description "Packaging programs for amusement."
-        #:scope (list "gnu/packages/games.scm"
+        #:scope (list "gnu/packages/emulators.scm"
+                      "gnu/packages/games.scm"
                      "gnu/packages/game-development.scm"
                      "gnu/packages/minetest.scm"
                      "gnu/packages/esolangs.scm" ; granted, rather niche
@ -749,6 +756,10 @@ (define-member (person "André Batista"
                       "nandre@riseup.net")
  mozilla)

+(define-member (person "Lilah Tascheter"
+                       "lilah@lunabee.space")
+  bootloaders)
+

 (define (find-team name)
  (or (hash-ref %teams (string->symbol name))
--- a/gnu/bootloader.scm
+++ b/gnu/bootloader.scm
@ -7,6 +7,8 @@
 ;;; Copyright © 2022 Josselin Poiret <dev@jpoiret.xyz>
 ;;; Copyright © 2022 Reza Alizadeh Majd <r.majd@pantherx.org>
 ;;; Copyright © 2024 Tomas Volf <~@wolfsden.cz>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
+;;; Copyright © 2024 Herman Rimm <herman@rimm.ee>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -24,52 +26,86 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu bootloader)
+  #:autoload   (gnu build file-systems)
+               (read-partition-label read-partition-uuid
+                find-partition-by-label find-partition-by-uuid)
+  #:use-module (gnu services configuration)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system uuid)
-  #:use-module (guix discovery)
+  #:autoload   (guix build syscalls)
+               (mounts mount-source mount-point mount-type)
+  #:use-module (guix deprecation)
+  #:use-module (guix diagnostics)
  #:use-module (guix gexp)
+  #:use-module (guix i18n)
+  #:use-module (guix modules)
  #:use-module (guix profiles)
  #:use-module (guix records)
-  #:use-module (guix deprecation)
-  #:use-module ((guix ui) #:select (warn-about-load-error))
-  #:use-module (guix diagnostics)
-  #:use-module (guix i18n)
+  #:use-module (guix utils)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 receive)
+  #:use-module (ice-9 regex)
+  #:use-module (rnrs bytevectors)
  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
  #:use-module (srfi srfi-34)
  #:use-module (srfi srfi-35)
-  #:use-module (ice-9 match)
  #:export (menu-entry
            menu-entry?
            menu-entry-label
            menu-entry-device
+            menu-entry-device-mount-point
+            menu-entry-device-subvol
            menu-entry-linux
            menu-entry-linux-arguments
            menu-entry-initrd
-            menu-entry-device-mount-point
            menu-entry-multiboot-kernel
            menu-entry-multiboot-arguments
            menu-entry-multiboot-modules
            menu-entry-chain-loader

+            normalize-file
            menu-entry->sexp
            sexp->menu-entry

            bootloader
            bootloader?
            bootloader-name
-            bootloader-package
+            bootloader-default-targets
            bootloader-installer
-            bootloader-disk-image-installer
-            bootloader-configuration-file
-            bootloader-configuration-file-generator
+
+            bootloader-target
+            bootloader-target?
+            bootloader-target-type
+            bootloader-target-expected?
+            bootloader-target-path
+            bootloader-target-offset
+            bootloader-target-device
+            bootloader-target-file-system
+
+            target-error?
+            target-error-type
+            target-error-targets
+
+            find-mount
+            find-file-system
+            label->uuid
+            uuid->file-system
+            mount-point->block-device
+
+            gbegin
+            :path :devpath :device :fs :label :uuid
+            with-targets

            bootloader-configuration
            bootloader-configuration?
            bootloader-configuration-bootloader
-            bootloader-configuration-target ;deprecated
            bootloader-configuration-targets
            bootloader-configuration-menu-entries
            bootloader-configuration-default-entry
+            bootloader-configuration-efi-removable?
+            bootloader-configuration-32bit?
+            bootloader-configuration-keypair
            bootloader-configuration-timeout
            bootloader-configuration-keyboard-layout
            bootloader-configuration-theme
@ -80,10 +116,15 @@ (define-module (gnu bootloader)
            bootloader-configuration-device-tree-support?
            bootloader-configuration-extra-initrd

-            %bootloaders
-            lookup-bootloader-by-name
+            bootloader-configuration->gexp
+            bootloader-configurations->gexp

-            efi-bootloader-chain))
+            match-bootloader-configuration
+            match-menu-entry
+
+            %efi-supported-systems
+            efi-arch
+            install-efi))


 ;;;
@ -98,6 +139,8 @@ (define-record-type* <menu-entry>
                   (default #f))
  (device-mount-point menu-entry-device-mount-point
                   (default #f))
+  (device-subvol menu-entry-device-subvol
+                   (default #f))
  (linux           menu-entry-linux
                   (default #f))
  (linux-arguments menu-entry-linux-arguments
@ -114,6 +157,18 @@ (define-record-type* <menu-entry>
  (chain-loader     menu-entry-chain-loader
                    (default #f)))         ; string, path of efi file

+(define (normalize-file entry file)
+  "Normalize a file FILE stored in a menu entry into one suitable for a
+bootloader.  Realizes device-mount-point and device-subvol."
+  (match-menu-entry entry (device-mount-point device-subvol)
+    ;; Avoid using cut procedure from SRFI-26 inside G-exp.
+    (let ((mount (and=> device-mount-point (cut string-trim <> #\/))))
+      #~(let* ((file (string-trim #$file #\/))
+               (file (if (and #$mount (string-prefix? #$mount file))
+                         (substring file (string-length #$mount))
+                         file)))
+          (string-append (or #$device-subvol "") "/" file)))))
+
 (define (report-menu-entry-error menu-entry)
  (raise
   (condition
@ -136,12 +191,12 @@ (define (menu-entry->sexp entry)
  (define (device->sexp device)
    (match device
      ((? uuid? uuid)
-       `(uuid ,(uuid-type uuid) ,(uuid->string uuid)))
+       `(uuid ,(uuid->string uuid) ,(uuid-type uuid)))
      ((? file-system-label? label)
       `(label ,(file-system-label->string label)))
      (_ device)))
  (match entry
-    (($ <menu-entry> label device mount-point
+    (($ <menu-entry> label device mount-point subvol
                     (? identity linux) linux-arguments (? identity initrd)
                     #f () () #f)
     `(menu-entry (version 0)
@ -150,8 +205,9 @@ (define (device->sexp device)
                  (device-mount-point ,mount-point)
                  (linux ,linux)
                  (linux-arguments ,linux-arguments)
-                  (initrd ,initrd)))
-    (($ <menu-entry> label device mount-point #f () #f
+                  (initrd ,initrd)
+                  (device-subvol ,subvol)))
+    (($ <menu-entry> label device mount-point subvol #f () #f
                     (? identity multiboot-kernel) multiboot-arguments
                     multiboot-modules #f)
     `(menu-entry (version 0)
@ -160,22 +216,26 @@ (define (device->sexp device)
                  (device-mount-point ,mount-point)
                  (multiboot-kernel ,multiboot-kernel)
                  (multiboot-arguments ,multiboot-arguments)
-                  (multiboot-modules ,multiboot-modules)))
-    (($ <menu-entry> label device mount-point #f () #f #f () ()
+                  (multiboot-modules ,multiboot-modules)
+                  (device-subvol ,subvol)))
+    (($ <menu-entry> label device mount-point subvol #f () #f #f () ()
                     (? identity chain-loader))
     `(menu-entry (version 0)
                  (label ,label)
                  (device ,(device->sexp device))
                  (device-mount-point ,mount-point)
-                  (chain-loader ,chain-loader)))
+                  (chain-loader ,chain-loader)
+                  (device-subvol ,subvol)))
    (_ (report-menu-entry-error entry))))

 (define (sexp->menu-entry sexp)
  "Turn SEXP, an sexp as returned by 'menu-entry->sexp', into a <menu-entry>
 record."
+  ;; XXX: The match ORs shadow subvol.
+  (define subvol #f)
  (define (sexp->device device-sexp)
    (match device-sexp
-      (('uuid type uuid-string)
+      (('uuid uuid-string type)
       (uuid uuid-string type))
      (('label label)
       (file-system-label label))
@ -185,35 +245,41 @@ (define (sexp->device device-sexp)
                  ('label label) ('device device)
                  ('device-mount-point mount-point)
                  ('linux linux) ('linux-arguments linux-arguments)
-                  ('initrd initrd) _ ...)
+                  ('initrd initrd)
+                  (or ('device-subvol subvol _ ...) (_ ...)))
     (menu-entry
      (label label)
      (device (sexp->device device))
      (device-mount-point mount-point)
+      (device-subvol subvol)
      (linux linux)
      (linux-arguments linux-arguments)
      (initrd initrd)))
    (('menu-entry ('version 0)
                  ('label label) ('device device)
-                  ('device-mount-point mount-point)
+                  ('device-mount-point mount-point) ('device-subvol subvol)
                  ('multiboot-kernel multiboot-kernel)
                  ('multiboot-arguments multiboot-arguments)
-                  ('multiboot-modules multiboot-modules) _ ...)
+                  ('multiboot-modules multiboot-modules)
+                  (or ('device-subvol subvol _ ...) (_ ...)))
     (menu-entry
      (label label)
      (device (sexp->device device))
      (device-mount-point mount-point)
+      (device-subvol subvol)
      (multiboot-kernel multiboot-kernel)
      (multiboot-arguments multiboot-arguments)
      (multiboot-modules multiboot-modules)))
    (('menu-entry ('version 0)
                  ('label label) ('device device)
-                  ('device-mount-point mount-point)
-                  ('chain-loader chain-loader) _ ...)
+                  ('device-mount-point mount-point) ('device-subvol subvol)
+                  ('chain-loader chain-loader)
+                  (or ('device-subvol subvol _ ...) (_ ...)))
     (menu-entry
      (label label)
      (device (sexp->device device))
      (device-mount-point mount-point)
+      (device-subvol subvol)
      (chain-loader chain-loader)))))


@ -226,46 +292,330 @@ (define (sexp->device device-sexp)
 ;; has to be described by this record.

 (define-record-type* <bootloader>
-  bootloader make-bootloader
-  bootloader?
+  bootloader make-bootloader bootloader?
  (name            bootloader-name)
-  (package                         bootloader-package)
-  (installer                       bootloader-installer)
-  (disk-image-installer            bootloader-disk-image-installer
-                                   (default #f))
-  (configuration-file              bootloader-configuration-file)
-  (configuration-file-generator    bootloader-configuration-file-generator))
+  (default-targets bootloader-default-targets (default '()))
+  (installer       bootloader-installer))
+
+
+;;;
+;;; Bootloader target record.
+;;;
+
+;; <bootloader-target> represents different kinds of targets in a
+;; normalized form.
+
+(define (string-or-boolean? x)
+  (or (string? x) (boolean? x)))
+
+(define (symbol-or-boolean? x)
+  (or (symbol? x) (boolean? x)))
+
+;; XXX: Are file-system-labels all that good?
+;; Could a block-device record be better, instead?
+(define (file-system-label-or-boolean? x)
+  (or (file-system-label? x) (boolean? x)))
+
+;; TODO: Create wrapper record for block-device.
+(define (uuid-or-string-or-boolean? x)
+  (or (uuid? x) (string? x) (boolean? x)))
+
+(define-configuration/no-serialization bootloader-target
+  (type symbol "What target this record describes, e.g. 'esp or 'disk.")
+  (expected? (boolean #f) "TODO")
+  (path (string-or-boolean #f) "TODO")
+  (offset (symbol-or-boolean #f) "TODO")
+  (device
+   (uuid-or-string-or-boolean #f)
+   "Refers to a physical device or partition.  A string is interpreted
+as a block device.  Note that block devices can vary per boot and may
+not exist at boot-time.  The find-partition-uuid procedure returns a
+block device's UUID.")
+  (file-system
+   (string-or-boolean #f)
+   "Set the type of the file system, in case it isn't being detected
+properly, or it is unmounted during bootloader installation.  See also
+the find-file-system and uuid->file-system procedures."))
+
+(define-condition-type &target-error &error target-error?
+  (type target-error-type)
+  (targets target-error-targets))
+
+;; XXX: Use a more appropriate name than FS?
+(define (find-mount block-device-or-fs)
+  "Return the <mount> record with source BLOCK-DEVICE-OR-FS, or #f
+otherwise.  An FS could be efivarsfs, cgroup etc.."
+  (define (block-device-or-fs? mount)
+    (and (string=? block-device-or-fs (mount-source mount)) mount))
+  ;; A mount source is either a block device or an FS.
+  (when (and (not (string-prefix? "/dev/" block-device-or-fs))
+             (or (string-contains "/" block-device-or-fs)
+                 (string=? "none" block-device-or-fs)))
+    (error (G_ "not a block device with mount~%") block-device-or-fs))
+  (any block-device-or-fs? (mounts)))
+
+(define (find-file-system block-device)
+  "Detects the type of a given block device.  Return #f if not found."
+  (and=> (find-mount block-device) mount-type))
+
+(define (label->uuid label)
+  (and=> (find-partition-by-label (file-system-label->string label))
+         read-partition-uuid))
+
+(define (uuid->file-system uuid)
+  "Returns the UUID's type as a string.  Does not depend on current
+mounts, unlike find-file-system.  Use together with the find-uuid, or
+label->uuid procedure."
+  (symbol->string (uuid-type uuid)))
+
+;; TODO: Test together with find-mount.
+(define (mount-point->block-device point)
+  "Return the block device mounted on POINT, or #f otherwise."
+  (define (point? mount)
+    (and (string=? point (mount-point mount)) (mount-source mount)))
+  ;; A mount point is an absolute path.
+  (unless (string-prefix? "/" point)
+    (error (G_ "mount point is not an absolute path~%") point))
+  (any point? (mounts)))
+
+(define (pathcat p1 p2)
+  (string-append (string-trim-right p1 #\/) "/" (string-trim p2 #\/)))
+
+(define* (get-target-of-type type targets #:optional require?)
+  "Finds a target in TARGETS of type TYPE, returns #f if REQUIRE? is #f,
+and provides an error otherwise."
+  (define (type? target)
+    (eq? type (bootloader-target-type target)))
+  (match (filter type? targets)
+    ((target _ ...) target)
+    (_ (and require?
+            (raise
+              (condition
+                (&message (message (G_ "required, but not provided")))
+                (&target-error (type type) (targets targets))))))))
+
+(define (parent-of target targets)
+  "Resolve the parent of TARGET in TARGETS, return #f if orphan."
+  (and=> (bootloader-target-offset target)
+         (cut get-target-of-type <> targets #t)))
+
+(define (unfold-pathcat target targets)
+  "Find the full VFS path of TARGET."
+  (let ((quit (lambda (t) (not (and=> t bootloader-target-path))))
+        (parent-of (cut parent-of <> targets)))
+    (reduce pathcat #f
+      (unfold quit bootloader-target-path parent-of target))))
+
+(define (target-base? t)
+  (or (not t) (match-record t <bootloader-target>
+                (expected? offset device)
+                (or device (not offset) expected?))))
+
+(define (type-major? target) (memq target '(root esp disk)))
+
+(define (ensure types targets end)
+  (let* ((used-in (cute unfold end identity (cut parent-of <> targets) <>))
+         (cons-in (lambda (t) (cons t (used-in t))))
+         (ensure (map (cut get-target-of-type <> targets #t) types)))
+    (filter identity (apply append (map cons-in ensure)))))
+
+(define* (ensure-target-types types targets #:optional (base? #f))
+  "Ensures all TYPES are provided in TARGETS.  Returns #t iff every ensured
+target and its requirements are fully provided.  Errors out when a required TYPE
+isn't provided.  When BASE?, only ensure path requirements up to a device."
+  (let ((base (if base? target-base? not)))
+    (not (any bootloader-target-expected? (ensure types targets base)))))
+
+(define (ensure-majors types targets)
+  "Errors out when a required TYPE isn't provided, or when use of multiple major
+targets is detected."
+  (let* ((all (map bootloader-target-type
+                   (ensure types targets target-base?)))
+         (majors (delete-duplicates (filter type-major? all) eq?)))
+    (if (< (length majors) 2) #t
+      (raise (condition (&message (message (G_ "multiple major targets used")))
+                        (&target-error (type majors) (targets targets)))))))
+
+
+
+(define (gbegin . gex)
+  "Sequence provided g-expressions."
+  (case (length gex) ((0) #f) ((1) (car gex)) (else #~(begin #$@gex))))
+
+;; syntax matching on free literals breaks easily, so bind them
+(define-syntax-rule (define-literal id) (define-syntax id (syntax-rules ())))
+(define-literal :path)
+(define-literal :devpath)
+(define-literal :device)
+(define-literal :fs)
+(define-literal :label)
+(define-literal :uuid)
+
+(define-syntax with-targets
+  (cut syntax-case <> ()
+    ((_ targets-expr block ...)
+     (let* ((genvars (compose generate-temporaries make-list))
+            (targets (car (genvars 1))))
+       (define (resolve in target base)
+         (with-syntax ((target target) (base base) (targets targets))
+           (syntax-case in
+             (:path :devpath :device :fs :label :uuid)
+             ((name _) (not (identifier? #'name))
+              #`(_ (syntax-error "binds must be to identifiers" #,in)))
+             ((name :device)
+              #'(name (and (string? (bootloader-target-device base))
+                           (bootloader-target-device base))))
+             ((name :label)
+              #'(name (and (string? (bootloader-target-device base))
+                           (bootloader-target-device base))))
+             ((name :uuid)
+              #'(name (and (uuid? (bootloader-target-device base))
+                           (bootloader-target-device base))))
+             ((name :fs) #'(name (bootloader-target-file-system base)))
+             ((name :path) #'(name (unfold-pathcat target targets)))
+             ((name :devpath)
+              #'(name (if (target-base? target)
+                          "/"
+                          (pathcat "/" (bootloader-target-path target)))))
+             (_ #`(_ (syntax-error "invalid binding spec" #,in))))))
+
+       (define (binds spec)
+         (syntax-case spec (=>)
+           ((type => binds ...)
+            (with-syntax (((target base) (genvars 2)) (targets targets))
+              (append
+                #`((get (lambda (t) (get-target-of-type t targets #t)))
+                   (target (get type))
+                   (base (if (target-base? target)
+                             target
+                             (get (bootloader-target-offset target)))))
+                (map (cut resolve <> #'target #'base) #'(binds ...)))))
+           (_ #f)))
+
+       (define blocks
+         (cut syntax-case <> ()
+           ((spec ... expr)
+            (let* ((path? (cut syntax-case <> (:path) ((_ :path) #t) (_ #f)))
+                   (qualified? (cut syntax-case <> (=>)
+                                 ((_ => spec ...)
+                                  (any path? #'(spec ...)))
+                                 (_ #f)))
+                   (specs #'(spec ...))
+                   (lets (apply append (filter-map binds specs)))
+                   (type (cut syntax-case <> (=>)
+                           ((t => _ ...) #'t) (t #'t))))
+              (receive (full part) (partition qualified? specs)
+                #`(and (ensure-majors (list #,@(map type specs)) #,targets)
+                       (ensure-target-types (list #,@(map type part))
+                                            #,targets #t)
+                       (ensure-target-types (list #,@(map type full))
+                                            #,targets #f)
+                       (let* #,lets expr)))))
+           (bad #'(syntax-error "malformed block" bad))))
+       "Using the list TARGETS, evaluate and sequence each BLOCK to produce a
+gexp.  BLOCK is a set of SPECs followed by an EXPR (evaluating to a gexp).
+Each SPEC denotes a type of target to guard EXPR on their existance and
+full-qualification.  This procedure is linear in regard to BLOCKs.
+
+SPEC may be of the following forms:
+@itemize
+@item 'TYPE Requires TYPE to be fully present or promised. Errors otherwise.
+@item ('TYPE => (VAR COMPONENT) ...): As type, but also binds variables. TYPE's
+      COMPONENT is bound to the variable VAR as described below.
+@end itemize
+
+Available COMPONENTs are:
+@itemize
+@item :path (fully-qualified)
+@item :devpath (relative from device)
+@item :device (auto-detected from uuid and label if not user-provided)
+@item :fs
+@item :label
+@item :uuid
+@end itemize
+
+Note that installers may be called multiple times with different targets being
+fully-qualified.  To ensure that targets aren't installed multiple times, make sure
+that each BLOCK ensures at least one major target, either directly or indirectly.
+Likewise, at most one major target should be ensured per BLOCK, under the same
+conditions.  Major targets originate from disk image handling, and are currently:
+@itemize
+@item disk
+@item root
+@item esp
+@end itemize"
+       #`(let ((#,targets targets-expr))
+           (apply gbegin (filter identity
+                                 (list #,@(map blocks #'(block ...))))))))
+    (bad #'(syntax-error "must provide targets" bad))))


 ;;;
 ;;; Bootloader configuration record.
 ;;;

-;; The <bootloader-configuration> record contains bootloader independant
+;; The <bootloader-configuration> record contains bootloader independent
 ;; configuration used to fill bootloader configuration file.

-(define-with-syntax-properties (warn-target-field-deprecation
-                                (value properties))
-  (when value
-    (warning (source-properties->location properties)
-             (G_ "the 'target' field is deprecated, please use 'targets' \
-instead~%")))
-  value)
+;; Based on report-duplicate-field-specifier from (guix records).
+(define (report-duplicate-type-field targets)
+  "Report the first target with duplicate type among TARGETS."
+  (let loop ((targets targets)
+             (seen    '()))
+    (match targets
+      ((target rest ...)
+       (let ((type (bootloader-target-type target)))
+         (when (memq type seen)
+           (error loc (G_ "target with duplicate type~%") duplicate))
+         (loop rest (cons type seen))))
+      (() #t))))
+
+(define-with-syntax-properties (warn-update-targets (value properties))
+  (let ((targets (wrap-element value))
+        (loc (source-properties->location properties)))
+    (define string->target
+      (match-lambda
+        ((? bootloader-target? target) target)
+        ((? string? s) (if (string-prefix? "/dev" s)
+                           (if (string-match ".+p[0-9]+$" s)
+                               (bootloader-target
+                                 (type 'part)
+                                 (device s))
+                               (bootloader-target
+                                 (type 'disk)
+                                 (device s)))
+                           (bootloader-target
+                             (type 'esp)
+                             (offset 'root)
+                             (path s))))
+        (x (error loc (G_ "invalid target '~a'~%") x))))
+
+    ;; XXX: Should this be an error?
+    (when (any string? targets)
+      (warning loc (G_ "the 'targets' field should now contain \
+<bootloader-target> records, inferring a best guess, this might break!~%")))
+    (let* ((targets (map string->target targets)))
+      (report-duplicate-type-field targets)
+      targets)))

 (define-record-type* <bootloader-configuration>
  bootloader-configuration make-bootloader-configuration
  bootloader-configuration?
  (bootloader
   bootloader-configuration-bootloader)   ;<bootloader>
-  (targets               %bootloader-configuration-targets
-                         (default #f))     ;list of strings
-  (target                %bootloader-configuration-target ;deprecated
-                         (default #f)
-                         (sanitize warn-target-field-deprecation))
+  (targets               bootloader-configuration-targets
+                         (default '())    ;list of strings
+                         (sanitize warn-update-targets))
  (menu-entries          bootloader-configuration-menu-entries
                         (default '()))   ;list of <menu-entry>
  (default-entry         bootloader-configuration-default-entry
                         (default 0))     ;integer
+  (efi-removable?        bootloader-configuration-efi-removable?
+                         (default #f))    ;bool
+  (32bit?                bootloader-configuration-32bit?
+                         (default #f))    ;bool
+  (keypair               bootloader-configuration-keypair
+                         (default #f))    ;(cert . priv) pair
  (timeout               bootloader-configuration-timeout
                         (default 5))     ;seconds as integer
  (keyboard-layout       bootloader-configuration-keyboard-layout
@ -273,9 +623,9 @@ (define-record-type* <bootloader-configuration>
  (theme                 bootloader-configuration-theme
                         (default #f))    ;bootloader-specific theme
  (terminal-outputs      bootloader-configuration-terminal-outputs
-                         (default '(gfxterm)))   ;list of symbols
+                         (default #f))    ;list of symbols | #f (default outs)
  (terminal-inputs       bootloader-configuration-terminal-inputs
-                         (default '()))   ;list of symbols
+                         (default #f))    ;list of symbols | #f (default ins)
  (serial-unit           bootloader-configuration-serial-unit
                         (default #f))    ;integer | #f
  (serial-speed          bootloader-configuration-serial-speed
@ -285,164 +635,153 @@ (define-record-type* <bootloader-configuration>
  (extra-initrd          bootloader-configuration-extra-initrd
                         (default #f)))   ;string | #f

-(define-deprecated (bootloader-configuration-target config)
-  bootloader-configuration-targets
-  (%bootloader-configuration-target config))
+
+;;;
+;;; Bootloader installation paths.
+;;;

-(define (bootloader-configuration-targets config)
-  (or (%bootloader-configuration-targets config)
-      ;; TODO: Remove after the deprecated 'target' field is removed.
-      (list (%bootloader-configuration-target config))
-      ;; XXX: At least the GRUB installer (see (gnu bootloader grub)) has this
-      ;; peculiar behavior of installing fonts and GRUB modules when DEVICE is #f,
-      ;; hence the default value of '(#f) rather than '().
-      (list #f)))
+(define (target-overrides . layers)
+  (let* ((types (flat-map (cute map bootloader-target-type <>) layers))
+         ;; TODO: use loop instead of fold for early termination.
+         (pred (lambda (type layer found)
+                 (or found (get-target-of-type type layer))))
+         (find (lambda (type) (fold (cute pred type <> <>) #f layers))))
+    (filter identity (map find (delete-duplicates types)))))
+
+(define (normalize targets)
+  "Augments TARGETS with filesystem information at runtime, allowing
+users to specify a lot less information.  Puts TARGETS into a normal
+form, where each path is fully specified up to a device offset."
+  (define (mass m)
+    `((,(mount-source m) . ,m)
+      (,(mount-point m) . ,m)))
+
+  (define (arborify target targets)
+    (let* ((up (lambda (t) (and t (parent-of t targets))))
+           (proto (unfold target-base? identity up (up target) list))
+           (chain (reverse (cons target proto))))
+      (bootloader-target
+        (inherit target)
+        (offset (and=> (car chain) bootloader-target-type))
+        (path (reduce pathcat #f (map bootloader-target-path (cdr chain)))))))
+
+  (let ((amounts (delay (apply append (map mass (mounts))))))
+    (define (assoc-mnt f)
+      (lambda (v) (and=> (assoc-ref (force amounts) v) f)))
+
+    (define (scrape target)
+      (match-record target <bootloader-target>
+        (expected? path offset device file-system)
+        (if expected? target
+          (bootloader-target
+            (inherit target)
+            (device (or device
+                        (and path ((assoc-mnt mount-source)
+                                   (unfold-pathcat target targets)))))
+            (file-system (or file-system
+                             (match device
+                               ((? string?) ((assoc-mnt mount-type) device))
+                               ((? uuid?) (uuid->file-system device))
+                               (_ #f))))
+            (offset (and path offset))
+            (path (or path (and=> device (assoc-mnt mount-point))))))))
+
+    (let ((mid (map scrape targets)))
+      (map (cut arborify <> mid) mid))))
+
+(define* (bootloader-configuration->gexp bootloader-config args #:key
+                                          (root-offset "/") (overrides '()))
+  "Returns a gexp to install BOOTLOADER-CONFIG to its targets, passing ARGS
+to each installer alongside the additional #:bootloader-config keyword
+arguments.  Target OVERRIDES are applied and all path targets have ROOT-OFFSET
+applied.  The following keyword arguments are expected in ARGS:
+@enumerate
+@item current-boot-alternative
+@item old-boot-alternatives
+@item locale (from bootmeta)
+@item store-directory-prefix (from bootmeta)
+@item store-crypto-devices (from bootmeta)
+@end enumerate"
+  (let* ((bootloader (bootloader-configuration-bootloader bootloader-config))
+         (installer (bootloader-installer bootloader))
+         (auto-targets (list (bootloader-target
+                               (type 'root)
+                               (path root-offset)
+                               (offset #f))))
+         (targets (target-overrides
+                    overrides
+                    (bootloader-configuration-targets bootloader-config)
+                    auto-targets
+                    (bootloader-default-targets bootloader)))
+         (conf (bootloader-configuration
+                 (inherit bootloader-config)
+                 (targets (normalize targets)))))
+    (apply installer #:bootloader-config conf args)))
+
+(define (bootloader-configurations->gexp bootloader-configs . rest)
+  (apply gbegin (filter-map (cut apply bootloader-configuration->gexp <> rest)
+                            bootloader-configs)))
+
+;; In lieu of exporting bootloader-configuration and menu-entry RTDs.
+(define-syntax match-bootloader-configuration
+  (syntax-rules ()
+    "Bind each BOOTLOADER-CONFIGURATION field in FIELDS."
+    ((_ bootloader-configuration (fields ...) body ...)
+     (match-record bootloader-configuration <bootloader-configuration>
+                   (fields ...) body ...))))
+
+(define-syntax match-menu-entry
+  (syntax-rules ()
+    "Bind each MENU-ENTRY field in FIELDS."
+    ((_ menu-entry (fields ...) body ...)
+     (match-record menu-entry <menu-entry> (fields ...) body ...))))


 ;;;
-;;; Bootloaders.
+;;; Bootloader installation to ESP.
 ;;;

-(define (bootloader-modules)
-  "Return the list of bootloader modules."
-  (all-modules (map (lambda (entry)
-                      `(,entry . "gnu/bootloader"))
-                    %load-path)
-               #:warn warn-about-load-error))
+;; systems currently supported by efi-arch. should be used for packages relying
+;; on it.
+(define %efi-supported-systems
+  '("i686-linux" "x86_64-linux" "armhf-linux" "aarch64-linux" "riscv64-linux"))

-(define %bootloaders
-  ;; The list of publically-known bootloaders.
-  (delay (fold-module-public-variables (lambda (obj result)
-                                         (if (bootloader? obj)
-                                             (cons obj result)
-                                             result))
-                                       '()
-                                       (bootloader-modules))))
+(define* (efi-arch #:key (target (or (%current-target-system) (%current-system)))
+                         (32? #f))
+  "Returns the UEFI architecture name for the current target, in lowercase."
+  (cond ((target-x86-32? target)  "ia32")
+        ((target-x86-64? target)  (if 32? "ia32" "x64"))
+        ((target-arm32? target)   "arm")
+        ((target-aarch64? target) (if 32? "arm" "aa64"))
+        ((target-riscv64? target) (if 32? "riscv32" "riscv64"))
+        (else (raise (formatted-message (G_ "no UEFI standard arch for ~a!")
+                                        target)))))

-(define (lookup-bootloader-by-name name)
-  "Return the bootloader called NAME."
-  (or (find (lambda (bootloader)
-              (eq? name (bootloader-name bootloader)))
-            (force %bootloaders))
-      (leave (G_ "~a: no such bootloader~%") name)))
+(define (lazy-efibootmgr)
+  "Lazy-loaded efibootmgr package, in order to prevent circular refs."
+  (module-ref (resolve-interface '(gnu packages linux)) 'efibootmgr))

-(define (efi-bootloader-profile packages files hooks)
-  "Creates a profile from the lists of PACKAGES and FILES from the store.
-This profile is meant to be used by the bootloader-installer.
-
-FILES is a list of file or directory names from the store, which will be
-symlinked into the profile.  If a directory name ends with '/', then the
-directory content instead of the directory itself will be symlinked into the
-profile.
-
-FILES may contain file like objects produced by procedures like plain-file,
-local-file, etc., or package contents produced with file-append.
-
-HOOKS lists additional hook functions to modify the profile."
-  (define* (efi-bootloader-profile-hook manifest #:optional system)
-    (define build
-        (with-imported-modules '((guix build utils))
-          #~(begin
-            (use-modules ((guix build utils)
-                          #:select (mkdir-p strip-store-file-name))
-                         ((ice-9 ftw)
-                          #:select (scandir))
-                         ((srfi srfi-1)
-                          #:select (append-map every remove))
-                         ((srfi srfi-26)
-                          #:select (cut)))
-            (define (symlink-to file directory transform)
-              "Creates a symlink to FILE named (TRANSFORM FILE) in DIRECTORY."
-              (symlink file (string-append directory "/" (transform file))))
-            (define (directory-content directory)
-              "Creates a list of absolute path names inside DIRECTORY."
-              (map (lambda (name)
-                     (string-append directory name))
-                   (or (scandir directory (lambda (name)
-                                            (not (member name '("." "..")))))
-                       '())))
-            (define name-ends-with-/? (cut string-suffix? "/" <>))
-            (define (name-is-store-entry? name)
-              "Return #t if NAME is a direct store entry and nothing inside."
-              (not (string-index (strip-store-file-name name) #\/)))
-            (let* ((files '#$files)
-                   (directories (filter name-ends-with-/? files))
-                   (names-from-directories
-                    (append-map (lambda (directory)
-                                  (directory-content directory))
-                                directories))
-                   (names (append names-from-directories
-                                  (remove name-ends-with-/? files))))
-              (mkdir-p #$output)
-              (if (every file-exists? names)
-                  (begin
-                    (for-each (lambda (name)
-                               (symlink-to name #$output
-                                            (if (name-is-store-entry? name)
-                                                strip-store-file-name
-                                                basename)))
-                              names)
-                    #t)
-                  #f)))))
-
-    (gexp->derivation "efi-bootloader-profile"
-                      build
-                      #:system system
-                      #:local-build? #t
-                      #:substitutable? #f
-                      #:properties
-                      `((type . profile-hook)
-                        (hook . efi-bootloader-profile-hook))))
-
-  (profile (content (packages->manifest packages))
-           (name "efi-bootloader-profile")
-           (hooks (cons efi-bootloader-profile-hook hooks))
-           (locales? #f)
-           (allow-collisions? #f)
-           (relative-symlinks? #f)))
-
-(define* (efi-bootloader-chain final-bootloader
-                               #:key
-                               (packages '())
-                               (files '())
-                               (hooks '())
-                               installer
-                               disk-image-installer)
-  "Define a chain of bootloaders with the FINAL-BOOTLOADER, optional PACKAGES,
-and optional directories and files from the store given in the list of FILES.
-
-The package of the FINAL-BOOTLOADER and all PACKAGES and FILES will be placed
-in an efi-bootloader-profile, which will be passed to the INSTALLER.
-
-FILES may contain file-like objects produced by procedures like plain-file,
-local-file, etc., or package contents produced with file-append.
-
-If a directory name in FILES ends with '/', then the directory content instead
-of the directory itself will be symlinked into the efi-bootloader-profile.
-
-The procedures in the HOOKS list can be used to further modify the bootloader
-profile.  It is possible to pass a single function instead of a list.
-
-If the INSTALLER argument is used, then this gexp procedure will be called to
-install the efi-bootloader-profile.  Otherwise the installer of the
-FINAL-BOOTLOADER will be called.
-
-If the DISK-IMAGE-INSTALLER is used, then this gexp procedure will be called
-to install the efi-bootloader-profile into a disk image.  Otherwise the
-disk-image-installer of the FINAL-BOOTLOADER will be called."
-  (bootloader
-    (inherit final-bootloader)
-    (name "efi-bootloader-chain")
-    (package
-     (efi-bootloader-profile (cons (bootloader-package final-bootloader)
-                                   packages)
-                             files
-                             (if (list? hooks)
-                                 hooks
-                                 (list hooks))))
-    (installer
-     (or installer
-         (bootloader-installer final-bootloader)))
-    (disk-image-installer
-     (or disk-image-installer
-         (bootloader-disk-image-installer final-bootloader)))))
+(define (install-efi bootloader-config plan)
+  "Returns a gexp installing PLAN to the ESP, as denoted by the 'vendir target.
+PLAN is a gexp of a list of '(BUILDER DEST-BASENAME . LABEL) triples, that
+should be in boot order.  If the user selects a removable bootloader, only the
+first entry in PLAN is used."
+  (match-record bootloader-config <bootloader-configuration>
+    (targets efi-removable? 32bit?)
+    (if efi-removable?
+      ;; Hard code the output location to a well-known path recognized by
+      ;; compliant firmware.  See "3.5.1.1 Removable Media Boot Behaviour":
+      ;; http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf
+      (with-targets targets
+        (('esp => (path :path))
+         #~(let ((boot #$(string-append path "/EFI/BOOT"))
+                 (arch #$(string-upcase (efi-arch #:32? 32bit?)))
+                 (builder (car (car #$plan))))
+             (mkdir-p boot)
+             ;; Only realize the first planspec.
+             (builder (string-append boot "/BOOT" arch ".EFI")))))
+      ;; Install normally if not configured as removable.
+      (with-targets targets
+        (('vendir => (vendir :path) (loader :devpath) (disk :device))
+         #~(install-efi #+(file-append (lazy-efibootmgr) "/sbin/efibootmgr")
+                        #$vendir #$loader #$disk #$plan))))))
--- a/gnu/bootloader/depthcharge.scm
+++ b/gnu/bootloader/depthcharge.scm
@ -1,5 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2019 Timothy Sample <samplet@ngyro.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -17,92 +18,87 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu bootloader depthcharge)
-  #:use-module (gnu bootloader extlinux)
  #:use-module (gnu bootloader)
  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu system boot)
  #:use-module (guix gexp)
+  #:use-module (guix deprecation)
+  #:use-module (guix diagnostics)
+  #:use-module (guix i18n)
+  #:use-module (guix records)
  #:use-module (guix utils)
-  #:use-module (ice-9 match)
-  #:export (depthcharge-bootloader))
+  #:use-module (srfi srfi-26)
+  #:use-module (srfi srfi-35)
+  #:export (depthcharge-veyron-speedy-bootloader
+            depthcharge-bootloader))

-(define (signed-kernel kernel kernel-arguments initrd)
-  (define builder
-    (with-imported-modules '((guix build utils))
+(define* (install-depthcharge arch dtb
+                              #:key bootloader-config current-boot-alternative
+                              #:allow-other-keys)
+  (when (not (null? (bootloader-configuration-menu-entries bootloader-config)))
+    (raise (formatted-message
+             (G_ "extra menu-entries are not supported for depthcharge!"))))
+  (with-targets (bootloader-configuration-targets bootloader-config)
+    ;; use 'part instead of 'disk, cause we write an image directly into a
+    ;; partition instead of the extra-partition disk space
+    (('part => (disk :device))
+     (match-menu-entry
+       (boot-alternative->menu-entry current-boot-alternative)
+       (linux linux-arguments initrd)
       #~(begin
-          (use-modules (guix build utils)
-                       (ice-9 binary-ports)
-                       (rnrs bytevectors))
+           (use-modules (ice-9 binary-ports) (rnrs bytevectors))
           (set-path-environment-variable "PATH" '("bin") (list #$dtc))

           ;; TODO: These files have to be writable, so we copy them.
           ;; This can probably be fixed by using a ".its" file, just
           ;; be careful not to break initrd loading.
-          (copy-file #$kernel "zImage")
+           (copy-file #$linux "zImage")
           (chmod "zImage" #o755)
-          (copy-file (string-append (dirname #$kernel) "/lib/dtbs/"
-                                    "rk3288-veyron-speedy.dtb")
-                     "rk3288-veyron-speedy.dtb")
-          (chmod "rk3288-veyron-speedy.dtb" #o644)
+           (copy-file (string-append (dirname #$linux) "/lib/dtbs/" #$dtb)
+                      "dtb")
+           (chmod "dtb" #o644)
           (copy-file #$initrd "initrd")
           (chmod "initrd" #o644)

-          (invoke (string-append #$u-boot-tools "/bin/mkimage")
+           (invoke #+(file-append u-boot-tools "/bin/mkimage")
                     "-D" "-I dts -O dtb -p 2048"
-		  "-f" "auto"
-                  "-A" "arm"
-                  "-O" "linux"
-                  "-T" "kernel"
-                  "-C" "None"
-                  "-d" "zImage"
-                  "-a" "0"
-                  "-b" "rk3288-veyron-speedy.dtb"
-                  "-i" "initrd"
+                     "-f" "auto" ; format
+                     "-A" #$arch ; architecture
+                     "-O" "linux" ; os
+                     "-T" "kernel" ; image type
+                     "-C" "None" ; compression
+                     "-d" "zImage" ; image data
+                     "-a" "0" ; load address (hex)
+                     "-b" "dtb" ; dtb for device
+                     "-i" "initrd" ; initrd
                     "image.itb")
           (call-with-output-file "bootloader.bin"
             (lambda (port)
               (put-bytevector port (make-bytevector 512 0))))
-          (with-output-to-file "kernel-arguments"
-	    (lambda ()
-	      (display (string-join (list #$@kernel-arguments)))))
-          (invoke (string-append #$vboot-utils "/bin/vbutil_kernel")
-                  "--pack" #$output
+           (call-with-output-file "kernel-arguments"
+             (lambda (port)
+               (display (string-join (list #$@linux-arguments)) port)))
+           (invoke #+(file-append vboot-utils "/bin/vbutil_kernel")
                   "--version" "1"
                   "--vmlinuz" "image.itb"
-		  "--arch" "arm"
-		  "--keyblock" (string-append #$vboot-utils
-                                              "/share/vboot-utils/devkeys/"
-                                              "kernel.keyblock")
-		  "--signprivate" (string-append #$vboot-utils
-                                                 "/share/vboot-utils/devkeys/"
-                                                 "kernel_data_key.vbprivk")
+                   "--arch" #$arch
+                   "--keyblock"
+                   #$(file-append vboot-utils
+                       "/share/vboot-utils/devkeys/kernel.keyblock")
+                   "--signprivate"
+                   #$(file-append vboot-utils
+                       "/share/vboot-utils/devkeys/kernel_data_key.vbprivk")
                   "--config" "kernel-arguments"
-                  "--bootloader" "bootloader.bin"))))
-  (computed-file "vmlinux.kpart" builder))
+                   "--pack" "vmlinux.kpart")
+           (write-file-on-device "vmlinux.kpart"
+                                 (stat:size (stat "vmlinux.kpart"))
+                                 #$disk 0))))))

-(define* (depthcharge-configuration-file config entries
-                                         #:key
-                                         (system (%current-system))
-                                         (old-entries '())
-                                         #:allow-other-keys)
-  (match entries
-    ((entry)
-     (let ((kernel (menu-entry-linux entry))
-           (kernel-arguments (menu-entry-linux-arguments entry))
-           (initrd (menu-entry-initrd entry)))
-       ;; XXX: Make this a symlink.
-       (signed-kernel kernel kernel-arguments initrd)))
-    (_ (error "Too many bootloader menu entries!"))))
-
-(define install-depthcharge
-  #~(lambda (bootloader device mount-point)
-      (let ((kpart (string-append mount-point
-                                  "/boot/depthcharge/vmlinux.kpart")))
-        (write-file-on-device kpart (stat:size (stat kpart)) device 0))))
-
-(define depthcharge-bootloader
+(define depthcharge-veyron-speedy-bootloader
  (bootloader
   (name 'depthcharge)
-   (package #f)
-   (installer install-depthcharge)
-   (configuration-file "/boot/depthcharge/vmlinux.kpart")
-   (configuration-file-generator depthcharge-configuration-file)))
+   (installer (cute install-depthcharge "arm" "rk3288-veyron-speedy.dtb"
+                    <...>))))
+
+(define-deprecated/alias depthcharge-bootloader
+  depthcharge-veyron-speedy-bootloader)
--- a/gnu/bootloader/extlinux.scm
+++ b/gnu/bootloader/extlinux.scm
@ -2,6 +2,7 @@
 ;;; Copyright © 2017 David Craven <david@craven.ch>
 ;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2022 Reza Alizadeh Majd <r.majd@pantherx.org>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -21,32 +22,34 @@
 (define-module (gnu bootloader extlinux)
  #:use-module (gnu bootloader)
  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu system boot)
  #:use-module (guix gexp)
+  #:use-module (guix deprecation)
+  #:use-module (guix records)
  #:use-module (guix utils)
-  #:export (extlinux-bootloader
+  #:export (install-extlinux-config ; for u-boot
+            extlinux-bootloader
+            extlinux-gpt-bootloader
            extlinux-bootloader-gpt))

-(define* (extlinux-configuration-file config entries
-                                      #:key
-                                      (system (%current-system))
-                                      (old-entries '())
+
+;;;
+;;; Config procedures.
+;;;
+
+(define* (install-extlinux-config #:key bootloader-config
+                                        current-boot-alternative
+                                        old-boot-alternatives
                                  #:allow-other-keys)
-  "Return the U-Boot configuration file corresponding to CONFIG, a
-<u-boot-configuration> object, and where the store is available at STORE-FS, a
-<file-system> object.  OLD-ENTRIES is taken to be a list of menu entries
-corresponding to old generations of the system."
-
-  (define all-entries
-    (append entries (bootloader-configuration-menu-entries config)))
-
-  (define with-fdtdir?
-    (bootloader-configuration-device-tree-support? config))
-
+  "Installer for the extlinux configuration file, meant to be shared by
+all bootloaders that use the format to specify boot options."
+  (match-bootloader-configuration
+    bootloader-config
+    (targets menu-entries device-tree-support? timeout)
    (define (menu-entry->gexp entry)
-    (let ((label (menu-entry-label entry))
-          (kernel (menu-entry-linux entry))
-          (kernel-arguments (menu-entry-linux-arguments entry))
-          (initrd (menu-entry-initrd entry)))
+      (match-menu-entry entry (label linux linux-arguments initrd)
+        (let* ((linux (normalize-file entry linux))
+               (fdt #~(string-append "FDTDIR " (dirname #$linux) "/lib/dtbs")))
          #~(format port "LABEL ~a
  MENU LABEL ~a
  KERNEL ~a
@ -54,66 +57,53 @@ (define (menu-entry->gexp entry)
  INITRD ~a
  APPEND ~a
 ~%"
-                #$label #$label
-                #$kernel
-                (if #$with-fdtdir?
-                    (string-append "FDTDIR " (dirname #$kernel) "/lib/dtbs")
-                    "")
-                #$initrd
-                (string-join (list #$@kernel-arguments)))))
+                    #$label #$label #$linux
+                    #$(if device-tree-support? fdt "")
+                    #$(normalize-file entry initrd)
+                    (string-join (list #$@linux-arguments))))))

-  (define builder
-    #~(call-with-output-file #$output
+    (let ((entries (cons (boot-alternative->menu-entry
+                           current-boot-alternative)
+                         (append menu-entries
+                                 (map boot-alternative->menu-entry
+                                      old-boot-alternatives)))))
+      (with-targets targets
+        (('extlinux => (path :path))
+         #~(begin
+             (mkdir-p #$path)
+             (call-with-output-file #$(string-append path
+                                                     "/extlinux.conf")
               (lambda (port)
-          (let ((timeout #$(bootloader-configuration-timeout config)))
-            (format port "# This file was generated from your Guix configuration.  Any changes
+                 (format port "\
+# This file was generated from your Guix configuration.  Any changes
 # will be lost upon reconfiguration.
 UI menu.c32
 MENU TITLE GNU Guix Boot Options
 PROMPT ~a
-TIMEOUT ~a~%"
-                    (if (> timeout 0) 1 0)
-                    ;; timeout is expressed in 1/10s of seconds.
-                    (* 10 timeout))
-            #$@(map menu-entry->gexp all-entries)
-
-            #$@(if (pair? old-entries)
-                   #~((format port "~%")
-                      #$@(map menu-entry->gexp old-entries)
-                      (format port "~%"))
-                   #~())))))
-
-  (computed-file "extlinux.conf" builder
-                 #:options '(#:local-build? #t
-                             #:substitutable? #f)))
-
+TIMEOUT ~a~%" ; Timeout is expressed in tenths of a second.
+                         #$(if (> timeout 0) 1 0) #$(* 10 timeout))
+                 #$@(map menu-entry->gexp entries)))))))))


-
 ;;;
-;;; Install procedures.
+;;; Install procedure.
 ;;;

 (define (install-extlinux mbr)
-  #~(lambda (bootloader device mount-point)
-      (let ((extlinux (string-append bootloader "/sbin/extlinux"))
-            (install-dir (string-append mount-point "/boot/extlinux"))
-            (syslinux-dir (string-append bootloader "/share/syslinux")))
-        (for-each (lambda (file)
-                    (install-file file install-dir))
-                  (find-files syslinux-dir "\\.c32$"))
-        (invoke/quiet extlinux "--install" install-dir)
-        (write-file-on-device (string-append syslinux-dir "/" #$mbr)
-                              440 device 0))))
+  (lambda* (#:key bootloader-config #:allow-other-keys . args)
+    (with-targets (bootloader-configuration-targets bootloader-config)
+      (('extlinux => (path :path))
+       #~(begin
+           #$(apply install-extlinux-config args)
+           (copy-recursively #$(file-append syslinux "/share/syslinux") #$path)
+           (invoke/quiet #+(file-append syslinux "/sbin/extlinux")
+                         "--install" #$path)))
+      (('disk => (disk :device))
+       #~(write-file-on-device #$(file-append syslinux "/share/syslinux/" mbr)
+                               440 #$disk 0)))))

-(define install-extlinux-mbr
-  (install-extlinux "mbr.bin"))
-
-(define install-extlinux-gpt
-  (install-extlinux "gptmbr.bin"))


-
 ;;;
 ;;; Bootloader definitions.
 ;;;
@ -121,12 +111,19 @@ (define install-extlinux-gpt
 (define extlinux-bootloader
  (bootloader
    (name 'extlinux)
-   (package syslinux)
-   (installer install-extlinux-mbr)
-   (configuration-file "/boot/extlinux/extlinux.conf")
-   (configuration-file-generator extlinux-configuration-file)))
+    (default-targets (list (bootloader-target
+                             (type 'install)
+                             (offset 'root)
+                             (path "boot"))
+                           (bootloader-target
+                             (type 'extlinux)
+                             (offset 'install)
+                             (path "extlinux"))))
+    (installer (install-extlinux "mbr.bin"))))

-(define extlinux-bootloader-gpt
+(define extlinux-gpt-bootloader
  (bootloader
    (inherit extlinux-bootloader)
-   (installer install-extlinux-gpt)))
+    (installer (install-extlinux "gptmbr.bin"))))
+
+(define-deprecated/alias extlinux-bootloader-gpt extlinux-gpt-bootloader)
--- a/gnu/bootloader/grub.scm
+++ b/gnu/bootloader/grub.scm
--- a/gnu/bootloader/u-boot.scm
+++ b/gnu/bootloader/u-boot.scm
@ -5,8 +5,9 @@
 ;;; Copyright © 2020 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2022 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2023 Efraim Flashner <efraim@flashner.co.il>
-;;; Copyright © 2023 Herman Rimm <herman_rimm@protonmail.com>
+;;; Copyright © 2023-2024 Herman Rimm <herman@rimm.ee>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -24,12 +25,14 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu bootloader u-boot)
-  #:use-module (gnu bootloader extlinux)
  #:use-module (gnu bootloader)
+  #:use-module (gnu bootloader extlinux)
  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages raspberry-pi)
+  #:use-module (gnu system boot)
  #:use-module (guix gexp)
-  #:export (u-boot-bootloader
-            u-boot-a20-olinuxino-lime-bootloader
+  #:use-module (guix utils)
+  #:export (u-boot-a20-olinuxino-lime-bootloader
            u-boot-a20-olinuxino-lime2-bootloader
            u-boot-a20-olinuxino-micro-bootloader
            u-boot-bananapi-m2-ultra-bootloader
@ -37,9 +40,11 @@ (define-module (gnu bootloader u-boot)
            u-boot-cubietruck-bootloader
            u-boot-firefly-rk3399-bootloader
            u-boot-mx6cuboxi-bootloader
+            u-boot-nanopi-r4s-rk3399-bootloader
            u-boot-nintendo-nes-classic-edition-bootloader
            u-boot-novena-bootloader
            u-boot-orangepi-r1-plus-lts-rk3328-bootloader
+            u-boot-orangepi-zero2w-bootloader
            u-boot-pine64-plus-bootloader
            u-boot-pine64-lts-bootloader
            u-boot-pinebook-bootloader
@ -47,307 +52,252 @@ (define-module (gnu bootloader u-boot)
            u-boot-puma-rk3399-bootloader
            u-boot-rock64-rk3328-bootloader
            u-boot-rockpro64-rk3399-bootloader
+            u-boot-rpi-2-bootloader
+            u-boot-rpi-3-bootloader
+            u-boot-rpi-4-bootloader
+            u-boot-rpi-bootloader
            u-boot-sifive-unmatched-bootloader
            u-boot-qemu-riscv64-bootloader
            u-boot-starfive-visionfive2-bootloader
            u-boot-ts7970-q-2g-1000mhz-c-bootloader
            u-boot-wandboard-bootloader))

-(define install-u-boot
-  #~(lambda (bootloader root-index image)
-      (if bootloader
-        (error "Failed to install U-Boot"))))
+(define (make-install-u-boot firmware installers)
+  (lambda* (#:key bootloader-config #:allow-other-keys . args)
+    (with-targets (bootloader-configuration-targets bootloader-config)
+      ('extlinux (apply install-extlinux-config args))
+      (('install => (path :path)) #~(let ((path #$path)) #$firmware))
+      (('disk => (disk :device)) #~(let ((disk #$disk)) #f #$@installers)))))

-(define install-beaglebone-black-u-boot
+(define-syntax-rule (define-u-bootloader def-name package firmware
+                                         (file size doffset) ...)
+  "Defines a U-Boot installer DEF-NAME, using u-boot PACKAGE.  Installs
+each given FILE of SIZE (or #f to autodetect) to the targeted disk at
+OFFSET.  FIRMWARE is ran on the U-Boot firmware directory to install
+supporting files, with the directory path as the local variable 'path'."
+  (define def-name
+    (bootloader
+      (name 'u-boot)
+      (default-targets (list (bootloader-target
+                               (type 'install)
+                               (offset 'root)
+                               (path "boot"))
+                             (bootloader-target
+                               (type 'extlinux)
+                               (offset 'install)
+                               (path "extlinux"))))
+      (installer
+        (make-install-u-boot
+          firmware
+          (list #~(let ((fw #$(file-append package "/libexec/" file)))
+                    (write-file-on-device fw
+                      #$(or size #~(stat:size (stat fw)))
+                      disk #$doffset)) ...))))))
+
+
+;;;
+;;; Bootloader definitions.
+;;;
+
+(define-u-bootloader u-boot-beaglebone-black-bootloader
+  u-boot-am335x-boneblack #f
  ;; http://wiki.beyondlogic.org/index.php?title=BeagleBoneBlack_Upgrading_uBoot
  ;; This first stage bootloader called MLO (U-Boot SPL) is expected at
  ;; 0x20000 by BBB ROM code. The second stage bootloader will be loaded by
  ;; the MLO and is expected at 0x60000.  Write both first stage ("MLO") and
-  ;; second stage ("u-boot.img") images, read in BOOTLOADER directory, to the
-  ;; specified DEVICE.
-  #~(lambda (bootloader root-index image)
-      (let ((mlo (string-append bootloader "/libexec/MLO"))
-            (u-boot (string-append bootloader "/libexec/u-boot.img")))
-        (write-file-on-device mlo (* 256 512)
-                              image (* 256 512))
-        (write-file-on-device u-boot (* 1024 512)
-                              image (* 768 512)))))
+  ;; second stage ("u-boot.img") images to the target.
+  ("MLO"        (* 256 512)  (* 256 512))
+  ("u-boot.img" (* 1024 512) (* 768 512)))

-(define install-allwinner-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((u-boot (string-append bootloader
-                                   "/libexec/u-boot-sunxi-with-spl.bin")))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 8 1024)))))
+(define-u-bootloader u-boot-sifive-unmatched-bootloader
+  u-boot-sifive-unmatched #f
+  ("spl/u-boot-spl.bin" #f (* 34 512))
+  ("u-boot.itb"         #f (* 2082 512)))

-(define install-allwinner64-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((spl (string-append bootloader "/libexec/u-boot-sunxi-with-spl.bin"))
-            (u-boot (string-append bootloader "/libexec/u-boot-sunxi-with-spl.fit.itb")))
-        (write-file-on-device spl (stat:size (stat spl))
-                              image (* 8 1024))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 40 1024)))))
-
-(define install-imx-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((spl (string-append bootloader "/libexec/SPL"))
-            (u-boot (string-append bootloader "/libexec/u-boot.img")))
-        (write-file-on-device spl (stat:size (stat spl))
-                              image (* 1 1024))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 69 1024)))))
-
-(define install-orangepi-r1-plus-lts-rk3328-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device idb (stat:size (stat idb))
-                              image (* 64 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 16384 512)))))
-
-(define install-puma-rk3399-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((spl (string-append bootloader "/libexec/idbloader.img"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device spl (stat:size (stat spl))
-                              image (* 64 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 512 512)))))
-
-(define install-firefly-rk3399-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device idb (stat:size (stat idb))
-                              image (* 64 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 16384 512)))))
-
-(define install-rock64-rk3328-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device idb (stat:size (stat idb))
-                              image (* 64 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 16384 512)))))
-
-(define install-rockpro64-rk3399-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((idb (string-append bootloader "/libexec/idbloader.img"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device idb (stat:size (stat idb))
-                              image (* 64 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 16384 512)))))
-
-(define install-pinebook-pro-rk3399-u-boot install-rockpro64-rk3399-u-boot)
-
-(define install-u-boot-ts7970-q-2g-1000mhz-c-u-boot
-  #~(lambda (bootloader device mount-point)
-      (let ((u-boot.imx (string-append bootloader "/libexec/u-boot.imx"))
-            (install-dir (string-append mount-point "/boot")))
-        (install-file u-boot.imx install-dir))))
-
-(define install-sifive-unmatched-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((spl (string-append bootloader "/libexec/spl/u-boot-spl.bin"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device spl (stat:size (stat spl))
-                              image (* 34 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 2082 512)))))
-
-(define install-starfive-visionfive2-u-boot
-  #~(lambda (bootloader root-index image)
-      (let ((spl (string-append
-                  bootloader "/libexec/spl/u-boot-spl.bin.normal.out"))
-            (u-boot (string-append bootloader "/libexec/u-boot.itb")))
-        (write-file-on-device spl (stat:size (stat spl))
-                              image (* 34 512))
-        (write-file-on-device u-boot (stat:size (stat u-boot))
-                              image (* 2082 512)))))
-
-(define install-starfive-visionfive2-uEnv.txt
-  #~(lambda (bootloader device mount-point)
-      (mkdir-p (string-append mount-point "/boot"))
-      (call-with-output-file (string-append mount-point "/boot/uEnv.txt")
+(define-u-bootloader u-boot-starfive-visionfive2-bootloader
+  u-boot-starfive-visionfive2
+  #~(begin (mkdir-p path)
+      (call-with-output-file (string-append path "/uEnv.txt")
        (lambda (port)
          (format port
            ;; if board SPI use vender's u-boot, will find
            ;; ""starfive/starfive_visionfive2.dtb"", We cannot guarantee
            ;; that users will update this u-boot, so set it.
-                  "fdtfile=starfive/jh7110-starfive-visionfive-2-v1.3b.dtb~%")))))
-
-(define install-qemu-riscv64-u-boot
-  #~(lambda (bootloader device mount-point)
-      (let ((u-boot.bin (string-append bootloader "/libexec/u-boot.bin"))
-            (install-dir (string-append mount-point "/boot")))
-        (install-file u-boot.bin install-dir))))
+            "fdtfile=starfive/jh7110-starfive-visionfive-2-v1.3b.dtb~%"))))
+  ("spl/u-boot-spl.bin.normal.out" #f (* 34 512))
+  ("u-boot.itb"                    #f (* 2082 512)))


-
 ;;;
-;;; Bootloader definitions.
+;;; Allwinner bootloader definitions.
+;;;
+(define-syntax-rule (define-u-bootloader-allwinner def-name package)
+  (define-u-bootloader def-name package #f
+    ("u-boot-sunxi-with-spl.bin" #f (* 8 1024))))
+
+
+(define-u-bootloader-allwinner u-boot-nintendo-nes-classic-edition-bootloader
+  u-boot-nintendo-nes-classic-edition)
+
+(define-u-bootloader-allwinner u-boot-a20-olinuxino-lime-bootloader
+  u-boot-a20-olinuxino-lime)
+
+(define-u-bootloader-allwinner u-boot-a20-olinuxino-lime2-bootloader
+  u-boot-a20-olinuxino-lime2)
+
+(define-u-bootloader-allwinner u-boot-a20-olinuxino-micro-bootloader
+  u-boot-a20-olinuxino-micro)
+
+(define-u-bootloader-allwinner u-boot-bananapi-m2-ultra-bootloader
+  u-boot-bananapi-m2-ultra)
+
+(define-u-bootloader-allwinner u-boot-cubietruck-bootloader u-boot-cubietruck)
+
+(define-u-bootloader-allwinner u-boot-pine64-lts-bootloader u-boot-pine64-lts)
+
+(define-u-bootloader-allwinner u-boot-orangepi-zero2w-bootloader
+  u-boot-orangepi-zero2w)
+
+
+;;;
+;;; Allwinner64 bootloader definitions.
+;;;
+(define-syntax-rule (define-u-bootloader-allwinner64 def-name package)
+  (define-u-bootloader def-name package #f
+    ("u-boot-sunxi-with-spl.bin"     #f (* 8 1024))
+    ("u-boot-sunxi-with-spl.fit.itb" #f (* 40 1024))))
+
+(define-u-bootloader-allwinner64 u-boot-pine64-plus-bootloader
+  u-boot-pine64-plus)
+
+(define-u-bootloader-allwinner64 u-boot-pinebook-bootloader u-boot-pinebook)
+
+
+;;;
+;;; IMX bootloader definitions.
+;;;
+(define-syntax-rule (define-u-bootloader-imx def-name package)
+  (define-u-bootloader def-name package #f
+    ("SPL"        #f (* 8 1024))
+    ("u-boot.img" #f (* 40 1024))))
+
+
+(define-u-bootloader-imx u-boot-mx6cuboxi-bootloader u-boot-mx6cuboxi)
+
+(define-u-bootloader-imx u-boot-wandboard-bootloader u-boot-wandboard)
+
+(define-u-bootloader-imx u-boot-novena-bootloader u-boot-novena)
+
+
+;;;
+;;; Rockchip bootloader definitions.
+;;;
+(define-syntax-rule (define-u-bootloader-rockchip def-name package)
+  ;; SD and eMMC use the same format
+  (define-u-bootloader def-name package #f
+    ("idbloader.img" #f (* 64 512))
+    ("u-boot.itb"    #f (* 16384 512))))
+
+(define-u-bootloader-rockchip u-boot-firefly-rk3399-bootloader
+  u-boot-firefly-rk3399)
+
+(define-u-bootloader-rockchip u-boot-nanopi-r4s-rk3399-bootloader
+  u-boot-nanopi-r4s-rk3399)
+
+(define-u-bootloader-rockchip u-boot-orangepi-r1-plus-lts-rk3328-bootloader
+  u-boot-orangepi-r1-plus-lts-rk3328)
+
+(define-u-bootloader-rockchip u-boot-rock64-rk3328-bootloader
+  u-boot-rock64-rk3328)
+
+(define-u-bootloader-rockchip u-boot-rockpro64-rk3399-bootloader
+  u-boot-rockpro64-rk3399)
+
+(define-u-bootloader-rockchip u-boot-pinebook-pro-rk3399-bootloader
+  u-boot-pinebook-pro-rk3399)
+
+(define-u-bootloader u-boot-puma-rk3399-bootloader u-boot-puma-rk3399 #f
+  ("idbloader.img" #f (* 64 512))
+  ("u-boot.itb"    #f (* 512 512)))
+
+
+;;;
+;;; Copy-only bootloader definitions.
 ;;;

-(define u-boot-bootloader
-  (bootloader
-   (inherit extlinux-bootloader)
-   (name 'u-boot)
-   (package #f)
-   (installer #f)
-   (disk-image-installer install-u-boot)))
+;; These bootloaders don't really need to be installed, as they are read from
+;; an SPI memory chip  or directly from the FS, not the disk.
+(define-syntax-rule (define-u-bootloader-copy def-name package file)
+  (define-u-bootloader def-name package
+    #~(install-file #$(file-append package "/libexec/" file) path)))

-(define u-boot-beaglebone-black-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-am335x-boneblack)
-   (disk-image-installer install-beaglebone-black-u-boot)))
+;; user should manually install this to SPI flash
+;; TODO: write directly to SPI flash? unless wear issues are a problem.
+(define-u-bootloader-copy u-boot-ts7970-q-2g-1000mhz-c-bootloader
+  u-boot-ts7970-q-2g-1000mhz-c "u-boot.imx")

-(define u-boot-allwinner-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (disk-image-installer install-allwinner-u-boot)))
+(define-u-bootloader-copy u-boot-qemu-riscv64-bootloader
+  u-boot-qemu-riscv64 "u-boot.bin")

-(define u-boot-allwinner64-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (disk-image-installer install-allwinner64-u-boot)))
+
+;;;
+;;; Raspberry Pi bootloader definitions.
+;;;

-(define u-boot-imx-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (disk-image-installer install-imx-u-boot)))
+(define (rpi-config 64bit?)
+  "Raspberry Pi config.txt which includes a user-specified custom.txt."
+  (plain-file "config.txt"
+    (string-join
+      (list (string-append "arm_64bit=" (if 64bit? "1" "0"))
+            "enable_uart=1"
+            "kernel=u-boot.bin"
+            "include custom.txt")
+      #\newline
+      'suffix)))

-(define u-boot-nintendo-nes-classic-edition-bootloader
-  (bootloader
-    (inherit u-boot-allwinner-bootloader)
-    (package u-boot-nintendo-nes-classic-edition)))
+(define (install-rpi u-boot-32 u-boot-64)
+  "Install the U-Boot from U-BOOT-64 for a 64-bit target, if available.
+Otherwise install using U-BOOT-32."
+  (lambda* (#:key bootloader-config #:allow-other-keys . args)
+    (with-targets (bootloader-configuration-targets bootloader-config)
+      ('install (apply install-extlinux-config args))
+      (('firmware => (firmware :path))
+       (let* ((32? (bootloader-configuration-32bit? bootloader-config))
+              (64bit? (and (not 32?) (target-64bit?) u-boot-64)))
+         #~(with-directory-excursion #$firmware
+             (atomic-copy #$(file-append (if 64bit? u-boot-64 u-boot-32)
+                                         "/libexec/u-boot.bin")
+                          "u-boot.bin")
+             (atomic-copy #$(rpi-config 64bit?) "config.txt")))))))

-(define u-boot-a20-olinuxino-lime-bootloader
-  (bootloader
-   (inherit u-boot-allwinner-bootloader)
-   (package u-boot-a20-olinuxino-lime)))
+(define* (make-u-boot-rpi-bootloader #:key u-boot-32 u-boot-64)
+  "Make a Raspberry Pi bootloader using either U-BOOT-32 or U-BOOT-64."
+  (bootloader (name 'u-boot)
+              (default-targets
+                (list (bootloader-target (type 'install)
+                                         (offset 'firmware)
+                                         (path "extlinux"))
+                      (bootloader-target (type 'firmware)
+                                         (offset 'root)
+                                         (path "boot"))))
+              (installer (install-rpi u-boot-32 u-boot-64))))

-(define u-boot-a20-olinuxino-lime2-bootloader
-  (bootloader
-   (inherit u-boot-allwinner-bootloader)
-   (package u-boot-a20-olinuxino-lime2)))
+;; These neither install firmware nor device-tree files for the Raspberry Pi.
+;; They just assume them to be existing in 'install in the same way that some
+;; UEFI firmware with ACPI data is usually assumed to be existing on PCs.
+;; They can be used with either extlinux or as UEFI firmware, alongside
+;; e.g. GRUB.
+(define u-boot-rpi-2-bootloader
+  (make-u-boot-rpi-bootloader #:u-boot-32 u-boot-rpi-2))

-(define u-boot-a20-olinuxino-micro-bootloader
-  (bootloader
-   (inherit u-boot-allwinner-bootloader)
-   (package u-boot-a20-olinuxino-micro)))
+(define u-boot-rpi-3-bootloader
+  (make-u-boot-rpi-bootloader #:u-boot-32 u-boot-rpi-3-32b
+                              #:u-boot-64 u-boot-rpi-arm64))

-(define u-boot-bananapi-m2-ultra-bootloader
-  (bootloader
-   (inherit u-boot-allwinner-bootloader)
-   (package u-boot-bananapi-m2-ultra)))
+(define u-boot-rpi-4-bootloader
+  (make-u-boot-rpi-bootloader #:u-boot-32 u-boot-rpi-4-32b
+                              #:u-boot-64 u-boot-rpi-arm64))

-(define u-boot-cubietruck-bootloader
-  (bootloader
-    (inherit u-boot-allwinner-bootloader)
-    (package u-boot-cubietruck)))
-
-(define u-boot-firefly-rk3399-bootloader
-  ;; SD and eMMC use the same format
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-firefly-rk3399)
-   (disk-image-installer install-firefly-rk3399-u-boot)))
-
-(define u-boot-mx6cuboxi-bootloader
-  (bootloader
-   (inherit u-boot-imx-bootloader)
-   (package u-boot-mx6cuboxi)))
-
-(define u-boot-wandboard-bootloader
-  (bootloader
-   (inherit u-boot-imx-bootloader)
-   (package u-boot-wandboard)))
-
-(define u-boot-novena-bootloader
-  (bootloader
-   (inherit u-boot-imx-bootloader)
-   (package u-boot-novena)))
-
-(define u-boot-orangepi-r1-plus-lts-rk3328-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-orangepi-r1-plus-lts-rk3328)
-   (disk-image-installer install-orangepi-r1-plus-lts-rk3328-u-boot)))
-
-(define u-boot-pine64-plus-bootloader
-  (bootloader
-   (inherit u-boot-allwinner64-bootloader)
-   (package u-boot-pine64-plus)))
-
-(define u-boot-pine64-lts-bootloader
-  (bootloader
-   (inherit u-boot-allwinner-bootloader)
-   (package u-boot-pine64-lts)))
-
-(define u-boot-pinebook-bootloader
-  (bootloader
-   (inherit u-boot-allwinner64-bootloader)
-   (package u-boot-pinebook)))
-
-(define u-boot-puma-rk3399-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-puma-rk3399)
-   (disk-image-installer install-puma-rk3399-u-boot)))
-
-(define u-boot-rock64-rk3328-bootloader
-  ;; SD and eMMC use the same format
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-rock64-rk3328)
-   (disk-image-installer install-rock64-rk3328-u-boot)))
-
-(define u-boot-rockpro64-rk3399-bootloader
-  ;; SD and eMMC use the same format
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-rockpro64-rk3399)
-   (disk-image-installer install-rockpro64-rk3399-u-boot)))
-
-(define u-boot-pinebook-pro-rk3399-bootloader
-  ;; SD and eMMC use the same format
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-pinebook-pro-rk3399)
-   (disk-image-installer install-pinebook-pro-rk3399-u-boot)))
-
-(define u-boot-ts7970-q-2g-1000mhz-c-bootloader
-  ;; This bootloader doesn't really need to be installed, as it is read from
-  ;; an SPI memory chip, not the SD card.  It is copied to /boot/u-boot.imx
-  ;; for convenience and should be manually flashed at the U-Boot prompt.
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-ts7970-q-2g-1000mhz-c)
-   (installer install-u-boot-ts7970-q-2g-1000mhz-c-u-boot)
-   (disk-image-installer #f)))
-
-(define u-boot-sifive-unmatched-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-sifive-unmatched)
-   (disk-image-installer install-sifive-unmatched-u-boot)))
-
-(define u-boot-starfive-visionfive2-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-starfive-visionfive2)
-   (installer install-starfive-visionfive2-uEnv.txt)
-   (disk-image-installer install-starfive-visionfive2-u-boot)))
-
-(define u-boot-qemu-riscv64-bootloader
-  (bootloader
-   (inherit u-boot-bootloader)
-   (package u-boot-qemu-riscv64)
-   (installer install-qemu-riscv64-u-boot)
-   (disk-image-installer #f)))
+;; Usable for any 64-bit Raspberry Pi.
+(define u-boot-rpi-bootloader
+  (make-u-boot-rpi-bootloader #:u-boot-64 u-boot-rpi-arm64))
--- a/gnu/bootloader/uki.scm
+++ b/gnu/bootloader/uki.scm
@ -0,0 +1,106 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu bootloader uki)
+  #:use-module (gnu bootloader)
+  #:use-module (gnu packages bootloaders)
+  #:use-module (gnu packages efi)
+  #:use-module (gnu packages linux)
+  #:use-module (gnu system boot)
+  #:use-module (guix gexp)
+  #:use-module (guix diagnostics)
+  #:use-module (guix i18n)
+  #:use-module (guix records)
+  #:use-module (ice-9 match)
+  #:export (uki-efi-bootloader))
+
+;; TODO: Support 32bit/mixed-mode UEFI.  May be relevant:
+;; https://github.com/systemd/systemd/issues/17056
+(define (menu-entry+bootcfg->builder entry bootcfg)
+  (match-menu-entry entry
+    (label linux linux-arguments initrd chain-loader)
+    (match-bootloader-configuration bootcfg (32bit? theme keypair)
+      (cond
+        ;; Support chainloader in order to allow arbitrary signed EFI
+        ;; binaries.
+        (chain-loader
+          (match keypair
+            ((cert key)
+             #~(lambda (dest)
+                 (invoke/quiet #+(sbsigntools "/bin/sbsign")
+                               "--cert" #$cert "--key" #$key
+                               "--output" dest #$chain-loader)
+                 (invoke/quiet #+(sbsigntools "/bin/sbverify")
+                               "--cert" #$(car keypair) dest)))
+            (#f #~(lambda (dest) (copy-file #$chain-loader dest)))))
+        (linux
+          (let* ((arch (efi-arch #:32? 32bit?))
+                 (stub (file-append systemd-stub "/libexec/linux" arch
+                                    ".efi.stub")))
+            #~(lambda (dest)
+                (invoke/quiet
+                  #+(file-append ukify "/bin/ukify") "build"
+                  "--output" dest "--linux" #$linux "--initrd" #$initrd
+                  "--cmdline" (string-join (list #$@linux-arguments))
+                  "--os-release" #$label "--stub" #$stub
+                  "--efi-arch" #$arch
+                  #$@(if theme #~("--splash" #$theme) '())
+                  #$@(match keypair
+                       ((cert key)
+                        #~("--secureboot-certificate" #$cert
+                           "--secureboot-private-key" #$key))
+                       (#f '()))))))
+        (else
+          (leave
+            (G_ "uki-efi-bootloader doesn't support multiboot")))))))
+
+;; We cannot use Guix's build system to make UKI images for two reasons:
+;; 1. signing is necessarily non-reproducable, especially since keys
+;; should not be in the store, or else risk being publically accessible.
+;; 2. Menu-entries may reference files which do not exist in the store.
+(define* (install-uki #:key
+                      bootloader-config
+                      current-boot-alternative
+                      old-boot-alternatives
+                      #:allow-other-keys)
+  (define* (menu-entry->plan entry num #:optional (prefix "menu-entry"))
+    #~(cons* #$(menu-entry+bootcfg->builder entry bootloader-config)
+             #$(string-append prefix "-" (number->string num) ".efi")
+             #$(menu-entry-label entry)))
+
+  (define (boot-alternative->plan alt)
+    (menu-entry->plan (boot-alternative->menu-entry alt)
+                      (boot-alternative-generation alt)
+                      "generation"))
+
+  (install-efi
+    bootloader-config
+    (let ((entries
+            (bootloader-configuration-menu-entries bootloader-config)))
+      #~(list #$(boot-alternative->plan current-boot-alternative)
+              #$@(map menu-entry->plan entries (iota (length entries)))
+              #$@(map boot-alternative->plan old-boot-alternatives)))))
+
+(define uki-efi-bootloader
+  (bootloader
+    (name 'uki-efi)
+    (default-targets (list (bootloader-target
+                             (type 'vendir)
+                             (offset 'esp)
+                             (path "EFI/Guix"))))
+    (installer install-uki)))
--- a/gnu/build/bootloader.scm
+++ b/gnu/build/bootloader.scm
@ -3,6 +3,7 @@
 ;;; Copyright © 2019 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2022 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2022 Timothy Sample <samplet@ngyro.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -20,20 +21,45 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu build bootloader)
+  #:autoload   (guix build syscalls) (free-disk-space)
  #:use-module (guix build utils)
-  #:use-module (guix utils)
-  #:use-module (ice-9 binary-ports)
+  #:use-module (guix diagnostics)
+  #:use-module (guix i18n)
  #:use-module (ice-9 format)
+  #:use-module (ice-9 match)
+  #:use-module (ice-9 popen)
+  #:use-module (ice-9 receive)
+  #:use-module (ice-9 regex)
  #:use-module (rnrs io ports)
  #:use-module (rnrs io simple)
-  #:export (write-file-on-device
-            install-efi-loader))
+  #:use-module (srfi srfi-1)
+  #:use-module (srfi srfi-26)
+  #:use-module (srfi srfi-35)
+  #:export (atomic-copy
+            in-temporary-directory
+            write-file-on-device
+            install-efi))


 ;;;
 ;;; Writing utils.
 ;;;

+(define (atomic-copy from to)
+  (let ((pivot (string-append to ".new")))
+    (copy-file from pivot)
+    (rename-file pivot to)))
+
+(define-syntax-rule (in-temporary-directory blocks ...)
+  "Run BLOCKS while chdir'd into a temporary directory."
+  ;; Under POSIX.1-2008, mkdtemp must make the dir with 700 perms.
+  (let* ((tmp (or (getenv "TMPDIR") "/tmp"))
+         (dir (mkdtemp (string-append tmp "/guix-bootloader.XXXXXX")))
+         (cwd (getcwd)))
+    (dynamic-wind (lambda () (chdir dir))
+                  (lambda () blocks ...)
+                  (lambda () (chdir cwd) (delete-file-recursively dir)))))
+
 (define (write-file-on-device file size device offset)
  "Write SIZE bytes from FILE to DEVICE starting at OFFSET."
  (call-with-input-file file
@ -56,57 +82,80 @@ (define (write-file-on-device file size device offset)
 ;;; EFI bootloader.
 ;;;

-(define* (install-efi grub grub-config esp #:key targets)
-  "Write a self-contained GRUB EFI loader to the mounted ESP using
-GRUB-CONFIG.
+;; XXX: Parsing efibootmgr output may be kinda jank.  A better way may exist.
+(define (efi-bootnums efibootmgr)
+  "Returns '(path . bootnum) pairs for each EFI boot entry.  bootnum is
+a string, and path is backslash-deliminated and relative to the ESP."
+  (let* ((pipe (open-pipe* OPEN_READ efibootmgr))
+         (text (get-string-all pipe))
+         (status (status:exit-val (close-pipe pipe)))
+         (bootnum-pattern
+           "^Boot([0-9a-fA-F]+).*[^A-Za-z]File\\(([^)]+)\\)$"))
+    (unless (zero? status)
+      (raise-exception
+        (formatted-message (G_ "efibootmgr exited with error code ~a") status)))
+    (fold-matches (make-regexp bootnum-pattern regexp/newline) text '()
+                  (lambda (match acc)
+                    (let* ((path (match:substring match 2))
+                           (bootnum (match:substring match 1)))
+                      (cons (cons path bootnum) acc))))))

-If TARGETS is set, use its car as the GRUB image format and its cdr as
-the output filename.  Otherwise, use defaults for the host platform."
-  (let* ((system %host-type)
-         ;; Hard code the output location to a well-known path recognized by
-         ;; compliant firmware. See "3.5.1.1 Removable Media Boot Behaviour":
-         ;; http://www.uefi.org/sites/default/files/resources/UEFI%20Spec%202_6.pdf
-         (grub-mkstandalone (string-append grub "/bin/grub-mkstandalone"))
-         (efi-directory (string-append esp "/EFI/BOOT"))
-         ;; Map grub target names to boot file names.
-         (efi-targets (or targets
-                          (cond ((string-prefix? "x86_64" system)
-                                 '("x86_64-efi" . "BOOTX64.EFI"))
-                                ((string-prefix? "i686" system)
-                                 '("i386-efi" . "BOOTIA32.EFI"))
-                                ((string-prefix? "armhf" system)
-                                 '("arm-efi" . "BOOTARM.EFI"))
-                                ((string-prefix? "aarch64" system)
-                                 '("arm64-efi" . "BOOTAA64.EFI"))))))
-    ;; grub-mkstandalone requires a TMPDIR to prepare the firmware image.
-    (setenv "TMPDIR" esp)
-
-    (mkdir-p efi-directory)
-    (invoke grub-mkstandalone "-O" (car efi-targets)
-            "-o" (string-append efi-directory "/"
-                                (cdr efi-targets))
-            ;; Graft the configuration file onto the image.
-            (string-append "boot/grub/grub.cfg=" grub-config))))
-
-(define* (install-efi-loader grub-efi esp #:key targets)
-  "Install in ESP directory the given GRUB-EFI bootloader.  Configure it to
-load the Grub bootloader located in the 'Guix_image' root partition.
-
-If TARGETS is set, use its car as the GRUB image format and its cdr as
-the output filename.  Otherwise, use defaults for the host platform."
-  (let ((grub-config "grub.cfg"))
-    (call-with-output-file grub-config
-      (lambda (port)
-        ;; Create a tiny configuration file telling the embedded grub where to
-        ;; load the real thing.  XXX This is quite fragile, and can prevent
-        ;; the image from booting when there's more than one volume with this
-        ;; label present.  Reproducible almost-UUIDs could reduce the risk
-        ;; (not eliminate it).
-        (format port
-                "insmod part_msdos~@
-               insmod part_gpt~@
-               search --set=root --label Guix_image~@
-               configfile /boot/grub/grub.cfg~%")))
-    (install-efi grub-efi grub-config esp #:targets targets)
-    (delete-file grub-config)))
+(define (install-efi efibootmgr vendir loader* disk plan)
+  "See also install-efi in (gnu bootloader)."
+  (let* ((loader (string-map (match-lambda (#\/ #\\) (x x)) loader*))
+         (bootnums (filter (compose (cut string-prefix? loader <>) car)
+                     (efi-bootnums efibootmgr)))
+         (plan-files (map cadr plan)))
+    (define (size file) (if (file-exists? file) (stat:size (stat file)) 0))
+    (define (vendirof file) (string-append vendir "/" file))
+    (define (loaderof file) (string-append loader "\\" file))
+    (define (delete-boot num file)
+      (invoke efibootmgr "--quiet" "--bootnum" num "--delete-bootnum")
+      (when (file-exists? file) (delete-file file)))

+    (mkdir-p vendir)
+    ;; Delete old entries first, to clear up space.
+    (for-each (lambda (spec) ; '(path . bootnum)
+                (let* ((s (substring (car spec) (string-length loader)))
+                       (file (substring s (if (string-prefix? "\\" s) 1 0))))
+                  (unless (member file plan-files)
+                    (delete-boot (cdr spec) (vendirof file)))))
+      bootnums)
+    ;; New and updated entries.
+    (in-temporary-directory
+      (for-each
+        (lambda (spec)
+          (let* ((builder (car spec)) (name (cadr spec))
+                 (dest (vendirof name)) (loadest (loaderof name))
+                 (rest (reverse (cdr (member name plan-files)))))
+            ;; Build to a temporary file so we can check its size.
+            (builder name)
+            ;; Disk space is usually limited on ESPs.
+            ;; Try to clear space as we install new bootloaders.
+            (if (while (> (- (size name) (size dest)) (free-disk-space vendir))
+                  (let ((del (find (compose file-exists? vendirof) rest)))
+                    (if del (delete-file (vendirof del)) (break #t))))
+                (begin
+                  (and=> (assoc-ref bootnums loadest) (cut delete-boot <> dest))
+                  (warning (G_ "ESP too small for bootloader ~a!~%") name))
+                ;; The ESP is too small for atomic copy.
+                (begin
+                  (copy-file name dest)
+                  (unless (assoc loadest bootnums)
+                    (invoke
+                      efibootmgr "--quiet" "--create-only" "--label"
+                      (cddr spec) "--disk" disk "--loader" loadest))))
+            (delete-file name)))
+        plan))
+    ;; Verify that at least the first entry was installed.
+    (unless (file-exists? (vendirof (cadr (car plan))))
+      ;; Extremely fatal error so we use leave instead of raise.
+      (leave (G_ "not enough space in ESP to install bootloader!
+ SYSTEM WILL NOT BOOT UNLESS THIS IS FIXED!~%")))
+    ;; Some UEFI systems will refuse to acknowledge the existence of boot
+    ;; entries unless they're in bootorder, so just shove everything in there.
+    (invoke
+      efibootmgr "--quiet" "--bootorder"
+      ;; Recall efi-bootnums to get a fresh list with new installs.
+      (let ((num (cute assoc-ref (efi-bootnums efibootmgr) <>))) ; cute is eager
+        (string-join (filter-map (compose num loaderof) plan-files) ",")))))
--- a/gnu/build/file-systems.scm
+++ b/gnu/build/file-systems.scm
@ -9,6 +9,7 @@
 ;;; Copyright © 2022 Oleg Pykhalov <go.wigust@gmail.com>
 ;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;; Copyright © 2024 Richard Sent <richard@freakingpenguin.com>
+;;; Copyright © 2024 Herman Rimm <herman@rimm.ee>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -45,6 +46,7 @@ (define-module (gnu build file-systems)
  #:use-module (srfi srfi-1)
  #:use-module (srfi srfi-26)
  #:export (disk-partitions
+            block-devices
            partition-label-predicate
            partition-uuid-predicate
            partition-luks-uuid-predicate
@ -57,6 +59,9 @@ (define-module (gnu build file-systems)
            read-partition-uuid
            read-luks-partition-uuid

+            uuids
+            find-uuid
+
            cleanly-unmounted-ext2?

            bind-mount
@ -230,8 +235,8 @@ (define EXT3_FEATURE_INCOMPAT_RECOVER #x0004)   ;journal needs recovery
          (else (error "invalid ext2 superblock state" state)))))

 (define (ext2-superblock-uuid sblock)
-  "Return the UUID of ext2 superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock 104 16))
+  "Return the <uuid> for ext2 superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock 104 16) 'ext2))

 (define (ext2-superblock-volume-name sblock)
  "Return the volume name of ext2 superblock SBLOCK as a string of at most 16
@ -293,8 +298,8 @@ (define (read-linux-swap-superblock device)
 ;; See 'union swap_header' in 'include/linux/swap.h'.

 (define (linux-swap-superblock-uuid sblock)
-  "Return the UUID of Linux-swap superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock (+ 1024 4 4 4) 16))
+  "Return the <uuid> for Linux-swap superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock (+ 1024 4 4 4) 16)))

 (define (linux-swap-superblock-volume-name sblock)
  "Return the label of Linux-swap superblock SBLOCK as a string."
@ -363,9 +368,8 @@ (define (read-bcachefs-superblock device)
  (read-superblock device 4096 104 bcachefs-superblock?))

 (define (bcachefs-superblock-external-uuid sblock)
-  "Return the external UUID of bcachefs superblock SBLOCK as a 16-byte
-bytevector."
-  (sub-bytevector sblock 56 16))
+  "Return the external UUID of bcachefs superblock SBLOCK as an <uuid>."
+  (bytevector->uuid (sub-bytevector sblock 56 16) 'bcachefs))

 (define (bcachefs-superblock-volume-name sblock)
  "Return the volume name of bcachefs superblock SBLOCK as a string of at most
@ -416,8 +420,8 @@ (define (read-btrfs-superblock device)
  (read-superblock device 65536 4096 btrfs-superblock?))

 (define (btrfs-superblock-uuid sblock)
-  "Return the UUID of a btrfs superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock 32 16))
+  "Return the <uuid> for a btrfs superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock 32 16) 'btrfs))

 (define (btrfs-superblock-volume-name sblock)
  "Return the volume name of btrfs superblock SBLOCK as a string of at most 256
@ -535,10 +539,11 @@ (define (exfat-superblock-volume-name sblock)
          #f))))

 (define (exfat-superblock-uuid sblock)
-  "Return the Volume Serial Number of exFAT superblock SBLOCK as a bytevector.
-This 4-byte identifier is guaranteed to exist, unlike the optional 16-byte
-Volume GUID from section 7.5 of the exFAT specification."
-  (sub-bytevector sblock 100 4))
+  "Return the Volume Serial Number of exFAT superblock SBLOCK as a
+<uuid> record.  This 4-byte identifier is guaranteed to exist, unlike
+the optional 16-byte Volume GUID from section 7.5 of the exFAT
+specification."
+  (bytevector->uuid (sub-bytevector sblock 100 4) 'exfat))

 (define (check-exfat-file-system device force? repair)
  "Return the health of an unmounted exFAT file system on DEVICE.  If FORCE?
@ -576,8 +581,8 @@ (define (read-fat32-superblock device)
  (read-superblock device 0 90 fat32-superblock?))

 (define (fat32-superblock-uuid sblock)
-  "Return the Volume ID of a fat superblock SBLOCK as a 4-byte bytevector."
-  (sub-bytevector sblock 67 4))
+  "Return the Volume ID of a fat superblock SBLOCK as a <uuid> record."
+  (bytevector->uuid (sub-bytevector sblock 67 4) 'fat32))

 (define (fat32-superblock-volume-name sblock)
  "Return the volume name of fat superblock SBLOCK as a string of at most 11
@ -616,8 +621,8 @@ (define (read-fat16-superblock device)
  (read-superblock device 0 62 fat16-superblock?))

 (define (fat16-superblock-uuid sblock)
-  "Return the Volume ID of a fat superblock SBLOCK as a 4-byte bytevector."
-  (sub-bytevector sblock 39 4))
+  "Return the Volume ID of a fat superblock SBLOCK as a <uuid> record."
+  (bytevector->uuid (sub-bytevector sblock 39 4) 'fat16))

 (define (fat16-superblock-volume-name sblock)
  "Return the volume name of fat superblock SBLOCK as a string of at most 11
@ -667,7 +672,7 @@ (define (read-iso9660-superblock device)

 (define (iso9660-superblock-uuid sblock)
  "Return the modification time of an iso9660 primary volume descriptor
-SBLOCK as a bytevector.  If that's not set, returns the creation time."
+SBLOCK as a <uuid>.  If that's not set, returns the creation time."
  ;; Drops GMT offset for compatibility with Grub, blkid and /dev/disk/by-uuid.
  ;; Compare Grub: "2014-12-02-19-30-23-00".
  ;; Compare blkid result: "2014-12-02-19-30-23-00".
@ -678,7 +683,7 @@ (define (iso9660-superblock-uuid sblock)
         (time (if (bytevector=? unset-time modification-time)
                   creation-time
                   modification-time)))
-    (sub-bytevector time 0 16))) ; strips GMT offset.
+    (bytevector->uuid (sub-bytevector time 0 16)) 'iso9660)) ; strips GMT offset.

 (define (iso9660-superblock-volume-name sblock)
  "Return the volume name of iso9660 superblock SBLOCK as a string.  The volume
@ -709,8 +714,8 @@ (define (read-jfs-superblock device)
  (read-superblock device 32768 184 jfs-superblock?))

 (define (jfs-superblock-uuid sblock)
-  "Return the UUID of JFS superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock 136 16))
+  "Return the <uuid> for JFS superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock 136 16) 'jfs))

 (define (jfs-superblock-volume-name sblock)
  "Return the volume name of JFS superblock SBLOCK as a string of at most 16
@ -775,12 +780,13 @@ (define (read-f2fs-superblock device)
                   f2fs-superblock?))

 (define (f2fs-superblock-uuid sblock)
-  "Return the UUID of F2FS superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock
+  "Return the <uuid> for F2FS superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock
                                    (- (+ #x460 12)
                                       ;; subtract superblock offset
                                       #x400)
-                  16))
+                                    16)
+                    'f2fs))

 (define (f2fs-superblock-volume-name sblock)
  "Return the volume name of F2FS superblock SBLOCK as a string of at most 512
@ -847,11 +853,10 @@ (define (read-luks-header file)
  (read-superblock file 0 592 luks-superblock?))

 (define (luks-header-uuid header)
-  "Return the LUKS UUID from HEADER, as a 16-byte bytevector."
-  ;; 40 bytes are reserved for the UUID, but in practice, it contains the 36
-  ;; bytes of its ASCII representation.
-  (let ((uuid (sub-bytevector header 168 36)))
-    (string->uuid (utf8->string uuid))))
+  "Return the LUKS UUID from HEADER, as a <uuid> record."
+  ;; 40 bytes are reserved for the UUID, but in practice, it contains
+  ;; the 36 bytes of its ASCII representation.
+  (bytevector->uuid (utf8->string (sub-bytevector header 168 36)) 'luks))


 ;;;
@ -875,8 +880,8 @@ (define (read-ntfs-superblock device)
  (read-superblock device 0 511 ntfs-superblock?))

 (define (ntfs-superblock-uuid sblock)
-  "Return the UUID of NTFS superblock SBLOCK as a 8-byte bytevector."
-  (sub-bytevector sblock 72 8))
+  "Return the <uuid> for the NTFS superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock 72 8) 'ntfs))

 ;; TODO: Add ntfs-superblock-volume-name.  The partition label is not stored
 ;; in the BOOT SECTOR like the UUID, but in the MASTER FILE TABLE, which seems
@ -917,8 +922,8 @@ (define (read-xfs-superblock device)
  (read-superblock device 0 120 xfs-superblock?))

 (define (xfs-superblock-uuid sblock)
-  "Return the UUID of XFS superblock SBLOCK as a 16-byte bytevector."
-  (sub-bytevector sblock 32 16))
+  "Return the <uuid> for XFS superblock SBLOCK."
+  (bytevector->uuid (sub-bytevector sblock 32 16) 'xfs))

 (define (xfs-superblock-volume-name sblock)
  "Return the volume name of XFS superblock SBLOCK as a string of at most 12
@ -994,6 +999,20 @@ (define (partition? name major minor)
                     (loop (cons name parts))
                     (loop parts))))))))))

+(define (block-devices)
+  "Return the block devices of valid disk partitions."
+  (map (cut string-append "/dev/" <>) (disk-partitions)))
+
+(define (uuids)
+  "Return the uuids in use by the system as a list of <uuid> records."
+  (filter-map read-partition-uuid (block-devices)))
+
+(define (find-uuid str)
+  "Return the current UUID which gets printed as STR, or #f otherwise."
+  (define (str? uuid)
+    (and (string=? str (uuid->string uuid)) uuid))
+  (any str? (uuids)))
+
 (define (ENOENT-safe proc)
  "Wrap the one-argument PROC such that ENOENT, EIO, and ENOMEDIUM errors are
 caught and lead to a warning and #f as the result."
@ -1123,9 +1142,7 @@ (define (find-partition predicate)
  "Return the first partition found that matches PREDICATE, or #f if none
 were found."
  (lambda (expected)
-    (find (predicate expected)
-          (map (cut string-append "/dev/" <>)
-               (disk-partitions)))))
+    (find (predicate expected) (block-devices))))

 (define find-partition-by-label
  (find-partition partition-label-predicate))
@ -1178,8 +1195,7 @@ (define (resolve find-partition spec fmt)
              identity))
    ((? uuid?)
     (resolve find-partition-by-uuid
-              (uuid-bytevector spec)
-              uuid->string))))
+              spec uuid->string))))

 (define (check-file-system device type force? repair)
  "Check an unmounted TYPE file system on DEVICE.  Do nothing but warn if it is
--- a/gnu/build/image.scm
+++ b/gnu/build/image.scm
@ -8,6 +8,7 @@
 ;;; Copyright © 2022 Pavel Shlyak <p.shlyak@pantherx.org>
 ;;; Copyright © 2022 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2023 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -28,6 +29,7 @@ (define-module (gnu build image)
  #:use-module (guix build store-copy)
  #:use-module (guix build syscalls)
  #:use-module (guix build utils)
+  #:use-module (guix deprecation)
  #:use-module (guix store database)
  #:use-module (guix utils)
  #:use-module (gnu build bootloader)
@ -181,30 +183,13 @@ (define* (register-closure prefix closure
                       #:prefix prefix
                       #:registration-time %epoch)))))

-(define* (initialize-efi-partition root
-                                   #:key
-                                   grub-efi
-                                   #:allow-other-keys)
-  "Install in ROOT directory, an EFI loader using GRUB-EFI."
-  (install-efi-loader grub-efi root))
+(define (initialize-efi-partition root . rest)
+  (mkdir-p (string-append root "/EFI")))

-(define* (initialize-efi32-partition root
-                                     #:key
-                                     grub-efi32
-                                     #:allow-other-keys)
-  "Install in ROOT directory, an EFI 32bit loader using GRUB-EFI32."
-  (install-efi-loader grub-efi32 root
-                      #:targets (cond ((target-x86?)
-                                       '("i386-efi" . "BOOTIA32.EFI"))
-                                      ((target-arm?)
-                                       '("arm-efi" . "BOOTARM.EFI")))))
+(define-deprecated/alias initialize-efi32-partition initialize-efi-partition)

 (define* (initialize-root-partition root
                                    #:key
-                                    bootcfg
-                                    bootcfg-location
-                                    bootloader-package
-                                    bootloader-installer
                                    (copy-closures? #t)
                                    (deduplicate? #t)
                                    references-graphs
@ -251,18 +236,10 @@ (define tmp-store ".tmp-store")

    (unless copy-closures?
      (delete-file root-store)
-      (rename-file tmp-store root-store)))
-
-  ;; There's no point installing a bootloader if we do not populate the store.
-  (when copy-closures?
-    (when bootloader-installer
-      (display "installing bootloader...\n")
-      (bootloader-installer bootloader-package #f root))
-    (when bootcfg
-      (install-boot-config bootcfg bootcfg-location root))))
+      (rename-file tmp-store root-store))))

 (define* (make-iso9660-image xorriso grub-mkrescue-environment
-                             grub bootcfg system-directory root target
+                             grub grub.dir system-directory root target
                             #:key (volume-id "Guix_image") (volume-uuid #f)
                             register-closures? (references-graphs '())
                             (compression? #t))
@ -304,7 +281,7 @@ (define grub-mkrescue-sed.sh

                              ;; On 32-bit systems the 2nd argument must be
                              ;; lower than 2^32.
-                              (string-hash (iso9660-uuid->string volume-uuid)
+                              (string-hash volume-uuid
                                           (- (expt 2 32) 1))

                              #x77777777)
@ -321,7 +298,7 @@ (define grub-mkrescue-sed.sh
  (apply invoke grub-mkrescue
         (string-append "--xorriso=" grub-mkrescue-sed.sh)
         "-o" target
-         (string-append "boot/grub/grub.cfg=" bootcfg)
+         (string-append "boot/grub=" grub.dir)
         root
         "--"
         ;; Set all timestamps to 1.
@ -352,6 +329,5 @@ (define grub-mkrescue-sed.sh
             `("-volume_date" "uuid"
               ,(string-filter (lambda (value)
                                 (not (char=? #\- value)))
-                               (iso9660-uuid->string
-                                volume-uuid)))
+                               volume-uuid))
             '()))))
--- a/gnu/build/install.scm
+++ b/gnu/build/install.scm
@ -25,8 +25,7 @@ (define-module (gnu build install)
  #:use-module (guix build store-copy)
  #:use-module (srfi srfi-26)
  #:use-module (ice-9 match)
-  #:export (install-boot-config
-            evaluate-populate-directive
+  #:export (evaluate-populate-directive
            populate-root-file-system
            install-database-and-gc-roots
            populate-single-profile-directory
@ -42,19 +41,6 @@ (define-module (gnu build install)
 ;;;
 ;;; Code:

-(define (install-boot-config bootcfg bootcfg-location mount-point)
-  "Atomically copy BOOTCFG into BOOTCFG-LOCATION on the MOUNT-POINT.  Note
-that the caller must make sure that BOOTCFG is registered as a GC root so
-that the fonts, background images, etc. referred to by BOOTCFG are not GC'd."
-  (let* ((target (string-append mount-point bootcfg-location))
-         (pivot  (string-append target ".new")))
-    (mkdir-p (dirname target))
-
-    ;; Copy BOOTCFG instead of just symlinking it, because symlinks won't
-    ;; work when /boot is on a separate partition.  Do that atomically.
-    (copy-file bootcfg pivot)
-    (rename-file pivot target)))
-
 (define* (evaluate-populate-directive directive target
                                      #:key
                                      (default-gid 0)
--- a/gnu/image.scm
+++ b/gnu/image.scm
@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2020, 2022 Mathieu Othacehe <othacehe@gnu.org>
 ;;; Copyright © 2023 Oleg Pykhalov <go.wigust@gmail.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -35,6 +36,7 @@ (define-module (gnu image)
            partition-label
            partition-uuid
            partition-flags
+            partition-target
            partition-initializer

            image
@ -131,6 +133,8 @@ (define-record-type* <partition> partition make-partition
  (flags                partition-flags
                        (default '())  ;list of symbols
                        (sanitize validate-partition-flags))
+  (target               partition-target ; bootloader target type: symbol | #f
+                        (default #f))
  (initializer          partition-initializer
                        (default #false))) ;gexp | #false

--- a/gnu/installer/parted.scm
+++ b/gnu/installer/parted.scm
@ -1418,7 +1418,7 @@ (define (user-partition->file-system user-partition)
         (upper-file-name (user-partition-upper-file-name user-partition))
         ;; Only compute uuid if partition is not encrypted.
         (uuid (or crypt-label
-                   (uuid->string (read-partition-uuid file-name) fs-type))))
+                   (uuid->string (read-partition-uuid file-name)))))
    `(file-system
       (mount-point ,mount-point)
       (device ,@(if crypt-label
@ -1460,15 +1460,19 @@ (define (root-user-partition? partition)

 (define (bootloader-configuration user-partitions)
  "Return the bootloader configuration field for USER-PARTITIONS."
-  (let* ((root-partition (find root-user-partition?
-                               user-partitions))
+  (let* ((root-partition (find root-user-partition? user-partitions))
         (root-partition-disk (user-partition-disk-file-name root-partition)))
    `((bootloader-configuration
       ,@(if (efi-installation?)
             `((bootloader grub-efi-bootloader)
-               (targets (list ,(default-esp-mount-point))))
+               (targets (list (bootloader-target
+                                (type 'esp)
+                                (path ,(default-esp-mount-point))))))
             `((bootloader grub-bootloader)
-               (targets (list ,root-partition-disk))))
+               (targets (list (bootloader-target
+                                (type 'disk)
+                                ;; TODO: Provide a uuid or label.
+                                (device ,root-partition-disk))))))

       ;; XXX: Assume we defined the 'keyboard-layout' field of
       ;; <operating-system> right above.
--- a/gnu/local.mk
+++ b/gnu/local.mk
@ -62,7 +62,7 @@
 # Copyright © 2023 B. Wilson <elaexuotee@wilsonb.com>
 # Copyright © 2023 Bruno Victal <mirai@makinata.eu>
 # Copyright © 2023, 2024 gemmaro <gemmaro.dev@gmail.com>
-# Copyright © 2023 Herman Rimm <herman@rimm.ee>
+# Copyright © 2023, 2024 Herman Rimm <herman@rimm.ee>
 # Copyright © 2023 Troy Figiel <troy@troyfigiel.com>
 # Copyright © 2024 David Elsing <david.elsing@posteo.net>
 # Copyright © 2024 Ashish SHUKLA <ashish.is@lostca.se>
@ -94,6 +94,7 @@ GNU_SYSTEM_MODULES =				\
  %D%/bootloader/extlinux.scm                   \
  %D%/bootloader/u-boot.scm                     \
  %D%/bootloader/depthcharge.scm                \
+  %D%/bootloader/uki.scm                        \
  %D%/ci.scm					\
  %D%/compression.scm				\
  %D%/home.scm					\
@ -763,6 +764,7 @@ GNU_SYSTEM_MODULES =				\
 						\
  %D%/system.scm				\
  %D%/system/accounts.scm			\
+  %D%/system/boot.scm				\
  %D%/system/file-systems.scm			\
  %D%/system/hurd.scm				\
  %D%/system/image.scm 				\
@ -1027,6 +1029,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/breezy-fix-gio.patch			\
  %D%/packages/patches/byobu-writable-status.patch		\
  %D%/packages/patches/bubblewrap-fix-locale-in-tests.patch	\
+  %D%/packages/patches/cadical-add-shared-library.patch		\
  %D%/packages/patches/calibre-no-updates-dialog.patch		\
  %D%/packages/patches/calibre-remove-test-sqlite.patch		\
  %D%/packages/patches/calibre-remove-test-unrar.patch		\
@ -1072,9 +1075,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/clang-17.0-libc-search-path.patch	\
  %D%/packages/patches/clang-17.0-link-dsymutil-latomic.patch	\
  %D%/packages/patches/clang-18.0-libc-search-path.patch	\
-  %D%/packages/patches/clang-cling-13-libc-search-path.patch	\
-  %D%/packages/patches/clang-cling-13-remove-crypt-interceptors.patch	\
-  %D%/packages/patches/clang-cling-runtime-13-glibc-2.36-compat.patch	\
  %D%/packages/patches/clang-runtime-asan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-esan-build-fixes.patch	\
  %D%/packages/patches/clang-runtime-12-remove-crypt-interceptors.patch \
@ -1089,7 +1089,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/clasp-hide-event-ids.patch		\
  %D%/packages/patches/classpath-aarch64-support.patch		\
  %D%/packages/patches/classpath-miscompilation.patch		\
-  %D%/packages/patches/cling-use-shared-library.patch		\
  %D%/packages/patches/clitest-grep-compat.patch		\
  %D%/packages/patches/clog-fix-shared-build.patch		\
  %D%/packages/patches/clucene-pkgconfig.patch			\
@ -1133,6 +1132,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/dbus-c++-gcc-compat.patch		\
  %D%/packages/patches/dbus-c++-threading-mutex.patch		\
  %D%/packages/patches/dbxfs-remove-sentry-sdk.patch		\
+  %D%/packages/patches/ddd-build.patch				\
  %D%/packages/patches/debops-constants-for-external-program-names.patch \
  %D%/packages/patches/debops-debops-defaults-fall-back-to-less.patch \
  %D%/packages/patches/dee-vapi.patch			\
@ -1607,6 +1607,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/libgeotiff-fix-tests-with-proj-9.3.0.patch	\
  %D%/packages/patches/libgeotiff-fix-tests-with-proj-9.3.1.patch	\
  %D%/packages/patches/libgeotiff-fix-tests-on-i386.patch	\
+  %D%/packages/patches/libguestfs-syms.patch            	\
  %D%/packages/patches/libobjc2-unbundle-robin-map.patch	\
  %D%/packages/patches/libvirt-add-install-prefix.patch	\
  %D%/packages/patches/libziparchive-add-includes.patch		\
@ -1692,7 +1693,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/libphonenumber-reproducible-build.patch	\
  %D%/packages/patches/libqalculate-3.8.0-libcurl-ssl-fix.patch	\
  %D%/packages/patches/libquicktime-ffmpeg.patch 		\
-  %D%/packages/patches/librewolf-add-paths-to-rdd-allowlist.patch	\
  %D%/packages/patches/libsepol-versioned-docbook.patch		\
  %D%/packages/patches/libtar-CVE-2013-4420.patch 		\
  %D%/packages/patches/libtgvoip-disable-sse2.patch 		\
@ -2006,7 +2006,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-3-search-paths.patch		\
  %D%/packages/patches/python-3-fix-tests.patch			\
  %D%/packages/patches/python-3-hurd-configure.patch		\
-  %D%/packages/patches/python-angr-addition-type-error.patch	\
  %D%/packages/patches/python-angr-check-exec-deps.patch	\
  %D%/packages/patches/python-3-reproducible-build.patch	\
  %D%/packages/patches/python-aionotify-0.2.0-py3.8.patch	\
@ -2041,7 +2040,6 @@ dist_patch_DATA =						\
  %D%/packages/patches/python-pytorch-runpath.patch		\
  %D%/packages/patches/python-pytorch-system-libraries.patch	\
  %D%/packages/patches/python-pytorch-without-kineto.patch	\
-  %D%/packages/patches/python-pyvex-remove-angr-dependency.patch	\
  %D%/packages/patches/python-robotframework-atest.patch	\
  %D%/packages/patches/python-robotframework-source-date-epoch.patch \
  %D%/packages/patches/python-robotframework-sshlibrary-rf5-compat.patch \
@ -2081,6 +2079,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/raptor2-heap-overflow.patch		\
  %D%/packages/patches/ratpoints-sturm_and_rp_private.patch	\
  %D%/packages/patches/ratpoison-shell.patch			\
+  %D%/packages/patches/retroarch-unbundle-spirv-cross.patch	\
  %D%/packages/patches/rct-add-missing-headers.patch		\
  %D%/packages/patches/readline-link-ncurses.patch		\
  %D%/packages/patches/readline-6.2-CVE-2014-2524.patch		\
@ -2098,6 +2097,7 @@ dist_patch_DATA =						\
  %D%/packages/patches/remake-impure-dirs.patch			\
  %D%/packages/patches/restartd-update-robust.patch             \
  %D%/packages/patches/restic-0.9.6-fix-tests-for-go1.15.patch	\
+  %D%/packages/patches/retroarch-improved-search-paths.patch	\
  %D%/packages/patches/rng-tools-revert-build-randstat.patch	\
  %D%/packages/patches/rocclr-5.6.0-enable-gfx800.patch		\
  %D%/packages/patches/rocm-bandwidth-test-5.5.0-fix-includes.patch	\
@ -2229,9 +2229,9 @@ dist_patch_DATA =						\
  %D%/packages/patches/tuxpaint-stamps-path.patch		\
  %D%/packages/patches/twinkle-bcg729.patch			\
  %D%/packages/patches/u-boot-allow-disabling-openssl.patch	\
-  %D%/packages/patches/u-boot-build-without-libcrypto.patch	\
  %D%/packages/patches/u-boot-nintendo-nes-serial.patch		\
  %D%/packages/patches/u-boot-rockchip-inno-usb.patch		\
+  %D%/packages/patches/u-boot-nanopi-r4s-ddr3.patch		\
  %D%/packages/patches/ucx-tcp-iface-ioctl.patch		\
  %D%/packages/patches/ultrastar-deluxe-no-freesans.patch		\
  %D%/packages/patches/ungoogled-chromium-extension-search-path.patch	\
--- a/gnu/machine/ssh.scm
+++ b/gnu/machine/ssh.scm
@ -23,6 +23,7 @@ (define-module (gnu machine ssh)
  #:use-module (gnu machine)
  #:autoload   (gnu packages gnupg) (guile-gcrypt)
  #:use-module (gnu system)
+  #:use-module (gnu system boot)
  #:use-module (gnu system file-systems)
  #:use-module (gnu system uuid)
  #:use-module ((gnu services) #:select (sexp->system-provenance))
@ -416,12 +417,10 @@ (define not-config?
    (('gnu _ ...) #t)
    (_ #f)))

-(define (machine-boot-parameters machine)
-  "Monadic procedure returning a list of 'boot-parameters' for the generations
-of MACHINE's system profile, ordered from most recent to oldest."
-  (define bootable-kernel-arguments
-    (@@ (gnu system) bootable-kernel-arguments))
-
+(define (machine->boot-alternatives machine)
+  "Monadic procedure returning a list of <boot-alternative> records for
+the generations of MACHINE's system profile, ordered from most recent to
+oldest."
  (define remote-exp
    (with-extensions (list guile-gcrypt)
      (with-imported-modules `(((guix config) => ,(make-config.scm))
@ -446,36 +445,37 @@ (define (read-file path)
                                                             generation))
                          (boot-parameters-path (string-append system-path
                                                               "/parameters"))
-                          (time (stat:mtime (lstat system-path))))
+                          (epoch (stat:mtime (lstat system-path))))
                     (list generation
                           system-path
-                           time
+                           epoch
                           (read-file boot-parameters-path))))
                 (reverse (generation-numbers %system-profile)))))))

-  (mlet* %store-monad ((generations (machine-remote-eval machine remote-exp)))
-    (return
-     (map (lambda (generation)
-            (match generation
-              ((generation system-path time serialized-params)
+  (define remote-result->boot-alternative
+    (match-lambda
+      ((generation system-path epoch serialized-params)
+       (boot-alternative
+         (generation generation)
+         (system-path system-path)
+         (epoch epoch)
+         (parameters
           (let* ((params (call-with-input-string serialized-params
                            read-boot-parameters))
                  (root (boot-parameters-root-device params))
-                      (label (boot-parameters-label params))
+                  (text (boot-parameters-label params))
                  (version (boot-parameters-version params)))
             (boot-parameters
               (inherit params)
-                  (label
-                   (string-append label " (#"
-                                  (number->string generation) ", "
-                                  (let ((time (make-time time-utc 0 time)))
-                                    (date->string (time-utc->date time)
-                                                  "~Y-~m-~d ~H:~M"))
-                                  ")"))
+               (label (decorated-boot-label text generation epoch))
               (kernel-arguments
-                   (append (bootable-kernel-arguments system-path root version)
-                           (boot-parameters-kernel-arguments params))))))))
-          generations))))
+                 (append
+                   (bootable-kernel-arguments system-path root version)
+                   (boot-parameters-kernel-arguments params))))))))))
+
+  (mlet %store-monad
+      ((remote-results (machine-remote-eval machine remote-exp)))
+    (return (map remote-result->boot-alternative remote-results))))

 (define-syntax-rule (with-roll-back should-roll-back? mbody ...)
  "Catch exceptions that arise when binding MBODY, a monadic expression in
@ -510,17 +510,15 @@ (define system (machine-ssh-configuration-system config))
                                  (machine-ssh-session machine)
                                  (machine-become-command machine)))

-  (mlet %store-monad ((_ (check-deployment-sanity machine))
-                      (boot-parameters (machine-boot-parameters machine)))
+  (mlet %store-monad ((_ (check-deployment-sanity machine)))
    ;; Make sure code that check %CURRENT-SYSTEM, such as
    ;; %BASE-INITRD-MODULES, gets to see the right value.
    (parameterize ((%current-system system)
                   (%current-target-system #f))
      (let* ((os (machine-operating-system machine))
             (eval (cut machine-remote-eval machine <>))
-             (menu-entries (map boot-parameters->menu-entry boot-parameters))
-             (bootloader-configuration (operating-system-bootloader os))
-             (bootcfg (operating-system-bootcfg os menu-entries)))
+             (bootloader-config (operating-system-bootloader os))
+             (bootmeta (operating-system-bootmeta os)))
        (define-syntax-rule (eval/error-handling condition handler ...)
          ;; Return a wrapper around EVAL such that HANDLER is evaluated if an
          ;; exception is raised.
@ -552,13 +550,15 @@ (define-syntax-rule (eval/error-handling condition handler ...)
                                                      (inferior-exception-arguments
                                                       c)))
                                           os)
-                (install-bootloader (eval/error-handling c
+                (mlet %store-monad
+                      ((boot-alternatives (machine->boot-alternatives machine)))
+                  (apply install-bootloader
+                    (eval/error-handling c
                      (raise (formatted-message
                               (G_ "\
 failed to install bootloader on '~a':~%~{~s ~}~%")
-                                              host
-                                              (inferior-exception-arguments c))))
-                                    bootloader-configuration bootcfg)))))))))
+                               host (inferior-exception-arguments c))))
+                    bootloader-config boot-alternatives bootmeta))))))))))


 ;;;
@ -589,33 +589,23 @@ (define target-generation
  (define roll-back-failure
    (condition (&message (message (G_ "could not roll-back machine")))))

-  (mlet* %store-monad ((boot-parameters (machine-boot-parameters machine))
-                       (_ -> (if (< (length boot-parameters) 2)
-                                 (raise roll-back-failure)))
-                       (entries -> (map boot-parameters->menu-entry
-                                        (list (second boot-parameters))))
-                       (locale -> (boot-parameters-locale
-                                   (second boot-parameters)))
-                       (crypto-dev -> (boot-parameters-store-crypto-devices
-                                       (second boot-parameters)))
-                       (store-dir -> (boot-parameters-store-directory-prefix
-                                      (second boot-parameters)))
-                       (old-entries -> (map boot-parameters->menu-entry
-                                            (drop boot-parameters 2)))
-                       (bootloader -> (operating-system-bootloader
-                                       (machine-operating-system machine)))
-                       (bootcfg (lower-object
-                                 ((bootloader-configuration-file-generator
-                                   (bootloader-configuration-bootloader
-                                    bootloader))
-                                  bootloader entries
-                                  #:locale locale
+  (mlet %store-monad
+      ((boot-alternatives (machine->boot-alternatives machine)))
+    (match boot-alternatives
+      ((first chosen rest ...)
+       (mlet %store-monad
+           ((remote-result (machine-remote-eval machine remote-exp)))
+         (when (eqv? 'error remote-result) (raise roll-back-failure)))
+       (let ((os (machine-operating-system machine))
+             (crypto-dev (boot-parameters-store-crypto-devices chosen))
+             (prefix (boot-parameters-store-directory-prefix chosen)))
+         (install-bootloader (cute machine-remote-eval machine <>)
+                             (operating-system-bootloader os)
+                             (cons* chosen first rest)
+                             #:locale (boot-parameters-locale chosen)
                             #:store-crypto-devices crypto-dev
-                                  #:store-directory-prefix store-dir
-                                  #:old-entries old-entries)))
-                       (remote-result (machine-remote-eval machine remote-exp)))
-    (when (eqv? 'error remote-result)
-      (raise roll-back-failure))))
+                             #:store-directory-prefix prefix)))
+      (_ (raise roll-back-failure)))))


 ;;;
--- a/gnu/packages/admin.scm
+++ b/gnu/packages/admin.scm
@ -5013,7 +5013,7 @@ (define-public pam-uaccess
 (define-public jc
  (package
    (name "jc")
-    (version "1.25.2")
+    (version "1.25.3")
    (source
     (origin
       ;; The PyPI tarball lacks the test suite.
@ -5023,7 +5023,7 @@ (define-public jc
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "17cik2jlj3ph7bsyn73gdp8d32nc56dmb96ijmzpwm0kdvd7sdj8"))))
+        (base32 "0ay5wh00fzblibvvcz3jh83n8mpkfsfqmix93fz9za5kf3gpk7na"))))
    (build-system pyproject-build-system)
    (arguments
     (list #:phases
@ -5031,8 +5031,7 @@ (define-public jc
               ;; XXX Guix's America/Los_Angeles time zone is somehow broken.
               (add-before 'check 'hack-time-zone
                 (lambda _
-                   (substitute* (find-files "tests" "^test.*\\.py$")
-                     (("America/Los_Angeles") "PST8PDT")))))))
+                   (setenv "TZ" "PST8PDT"))))))
    (native-inputs (list python-pytest))
    (propagated-inputs
     (list python-pygments python-ruamel.yaml python-xmltodict))
--- a/gnu/packages/astronomy.scm
+++ b/gnu/packages/astronomy.scm
--- a/gnu/packages/audio.scm
+++ b/gnu/packages/audio.scm
@ -765,7 +765,7 @@ (define ardour-bundled-media
 (define-public ardour
  (package
    (name "ardour")
-    (version "8.4")
+    (version "8.8")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -782,14 +782,13 @@ (define-public ardour
 namespace ARDOUR { const char* revision = \"" version "\" ; const char* date = \"\"; }")))))
              (sha256
               (base32
-                "17gh1yaaby17zwx43h5v8dsrcznks9pn8jddc3wadq13b5x7zb7a"))
-              (file-name (string-append name "-" version))))
+                "1wam4vq9l4g626x8rdvr6c3dqv8fc6llyxriiq77zyqc9sba3pjb"))
+              (file-name (git-file-name name version))))
    (build-system waf-build-system)
    (arguments
     (list
      #:configure-flags
-      '(list "--cxx11"                  ;required by gtkmm
-             "--optimize"
+      '(list "--optimize"
             "--no-phone-home"          ;don't contact ardour.org
             "--no-ytk"                 ;don't use bundled GTK2
             "--freedesktop"            ;build .desktop file
@ -5920,15 +5919,15 @@ (define-public libinstpatch
 (define-public lsp-dsp-lib
  (package
    (name "lsp-dsp-lib")
-    (version "0.5.14")
+    (version "1.0.26")
    (source
      (origin
        (method url-fetch)
-        (uri (string-append "https://github.com/sadko4u/lsp-dsp-lib/"
+        (uri (string-append "https://github.com/lsp-plugins/lsp-dsp-lib/"
                            "releases/download/" version
-                            "/lsp-dsp-lib-" version "-src.tar.gz"))
+                            "/lsp-dsp-lib-src-" version ".tar.gz"))
        (sha256
-         (base32 "1gcznkyybywbgdi2fhx27i8sckhy6ahvxax72b213g1lr5aaw7bq"))))
+         (base32 "07g02nglzrq9yp267m1aflrmr7i35pc3anlhasp35048i0xvy51i"))))
    (build-system gnu-build-system)
    (arguments
     (list #:tests? #f                  ; no tests
@ -5945,7 +5944,7 @@ (define-public lsp-dsp-lib
                 (lambda _
                   (invoke "make" "config"
                           (string-append "PREFIX=" #$output)))))))
-    (home-page "https://github.com/sadko4u/lsp-dsp-lib")
+    (home-page "https://github.com/lsp-plugins/lsp-dsp-lib")
    (synopsis "Digital signal processing library")
    (description "The LSP DSP library provides a set of functions that perform
 SIMD-optimized computing on several hardware architectures.  All functions
--- a/gnu/packages/bioinformatics.scm
+++ b/gnu/packages/bioinformatics.scm
@ -5786,7 +5786,7 @@ (define-public cwltool
           python-prov
           python-pydot
           python-psutil
-           python-rdflib
+           python-rdflib-6
           python-requests
           python-ruamel.yaml
           python-schema-salad
--- a/gnu/packages/bittorrent.scm
+++ b/gnu/packages/bittorrent.scm
@ -419,16 +419,10 @@ (define-public mktorrent
    (license (list l:public-domain      ; sha1.*, used to build without OpenSSL
                   l:gpl2+))))          ; with permission to link with OpenSSL

-(define %v2_empty_file.torrent
-  (origin (method url-fetch)
-          (uri "https://github.com/arvidn/libtorrent/raw/v2.0.9/test/test_torrents/v2_empty_file.torrent")
-          (sha256
-           (base32 "1hydgf0m9193hy9010wl0wrbz4k4cgrqg70jakx68pgi79jcqnrn"))))
-
 (define-public libtorrent-rasterbar
  (package
    (name "libtorrent-rasterbar")
-    (version "2.0.9")
+    (version "2.0.10")
    (source
     (origin
       (method url-fetch)
@ -437,35 +431,21 @@ (define-public libtorrent-rasterbar
                       "releases/download/v" version "/"
                       "libtorrent-rasterbar-" version ".tar.gz"))
       (sha256
-        (base32 "13kry578ifzz4m2f291bbd7v5v9zsi8y3mf38146cnqw0sv95kch"))
-       ;; https://github.com/arvidn/libtorrent/issues/7566
-       ;; Remove when resolved.  I would hope this to be fixed in 2.0.10.
-       (modules '((guix build utils)))
-       (snippet
-        #~(substitute* "test/test_copy_file.cpp"
-            (("EXT4_SUPER_MAGIC, EXT3_SUPER_MAGIC, XFS_SUPER_MAGIC" all)
-             (string-append all ", TMPFS_MAGIC\n"))))))
+        (base32 "0pc8rbcp7njbx8m02z47pcbbwcp5cjggbgq4sfjc19dc3n65p4zw"))))
    (build-system cmake-build-system)
    (arguments
-     `(#:configure-flags '("-Dpython-bindings=ON"
+     (list
+      #:configure-flags
+      #~(list "-Dpython-bindings=ON"
              "-Dbuild_tests=ON")
      ;; Tests do not reliably work when executed in parallel.
      #:parallel-tests? #f
      #:phases
-       (modify-phases %standard-phases
-         ;; https://github.com/arvidn/libtorrent/issues/7567
-         ;; Remove when resolved.  I would hope this to be fixed in 2.0.10.
-         ;; Do not forget to remove the %v2_empty_file.torrent variable.
-         (add-before 'configure 'copy-v2_empty_file.torrent
-           (lambda* (#:key native-inputs inputs #:allow-other-keys)
-             (copy-file (assoc-ref (or native-inputs inputs)
-                                   "%v2_empty_file.torrent")
-                        "test/test_torrents/v2_empty_file.torrent")))
+      #~(modify-phases %standard-phases
          (replace 'check
            (lambda* (#:key tests? parallel-tests? #:allow-other-keys)
              (let* ((disabled-tests
-                     '(
-                       ;; Requires a non-localhost IPv4 interface.
+                      '(;; Requires a non-localhost IPv4 interface.
                        "test_upnp"
                        ;; test_ssl needs to be run separately.
                        "test_ssl"))
@ -501,10 +481,10 @@ (define-public libtorrent-rasterbar
                  ;;         "--output-on-failure")
                  )))))))
    (inputs (list boost openssl))
-    (native-inputs `(("libfaketime" ,libfaketime)
-                     ("python-wrapper" ,python-wrapper)
-                     ("pkg-config" ,pkg-config)
-                     ("%v2_empty_file.torrent" ,%v2_empty_file.torrent)))
+    (native-inputs
+     (list libfaketime
+           python-wrapper
+           pkg-config))
    (home-page "https://www.libtorrent.org/")
    (synopsis "Feature-complete BitTorrent implementation")
    (description
--- a/gnu/packages/bootloaders.scm
+++ b/gnu/packages/bootloaders.scm
@ -18,9 +18,10 @@
 ;;; Copyright © 2022, 2023 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2021 Stefan <stefan-guix@vodafonemail.de>
 ;;; Copyright © 2022, 2023, 2024 Maxim Cournoyer <maxim.cournoyer@gmail.com>
-;;; Copyright © 2023 Herman Rimm <herman@rimm.ee>
+;;; Copyright © 2023-2024 Herman Rimm <herman@rimm.ee>
 ;;; Copyright © 2023 Simon Tournier <zimon.toutoune@gmail.com>
 ;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
+;;; Copyright © 2024 Lilah Tascheter <lilah@lunabee.space>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -38,6 +39,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu packages bootloaders)
+  #:use-module (gnu bootloader)
  #:use-module (gnu packages)
  #:use-module (gnu packages assembly)
  #:use-module (gnu packages base)
@ -47,12 +49,15 @@ (define-module (gnu packages bootloaders)
  #:use-module (gnu packages check)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages cross-base)
+  #:use-module (gnu packages crypto)
  #:use-module (gnu packages disk)
+  #:use-module (gnu packages efi)
  #:use-module (gnu packages firmware)
  #:use-module (gnu packages flex)
  #:use-module (gnu packages fontutils)
  #:use-module (gnu packages gcc)
  #:use-module (gnu packages gettext)
+  #:use-module (gnu packages gperf)
  #:use-module (gnu packages guile)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages llvm)
@ -76,11 +81,13 @@ (define-module (gnu packages bootloaders)
  #:use-module (gnu packages version-control)
  #:use-module (gnu packages virtualization)
  #:use-module (gnu packages xorg)
+  #:use-module (gnu packages python-crypto)
  #:use-module (gnu packages python-web)
  #:use-module (gnu packages python-xyz)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system meson)
  #:use-module (guix build-system pyproject)
+  #:use-module (guix build-system python)
  #:use-module (guix build-system trivial)
  #:use-module (guix download)
  #:use-module (guix gexp)
@ -501,92 +508,6 @@ (define-public grub-hybrid
                                                        basename))))
                            (scandir input-dir)))))))))))

-(define-public (make-grub-efi-netboot name subdir)
-  "Make a grub-efi-netboot package named NAME, which will be able to boot over
-network via TFTP by accessing its files in the SUBDIR of a TFTP root directory.
-This package is also able to boot from local storage devices.
-
-A bootloader-installer basically needs to copy the package content into the
-bootloader-target directory, which will usually be the TFTP root, as
-'grub-mknetdir' will be invoked already during the package creation.
-
-Alternatively the bootloader-target directory can be a mounted EFI System
-Partition (ESP), or a similar partition with a FAT file system, for booting
-from local storage devices.
-
-The name of the GRUB EFI binary will conform to the UEFI specification for
-removable media.  Depending on the system it will be e.g. bootx64.efi or
-bootaa64.efi below SUBDIR.
-
-The SUBDIR argument needs to be set to \"efi/boot\" to create a package which
-conforms to the UEFI specification for removable media.
-
-The SUBDIR argument defaults to \"efi/Guix\", as it is also the case for
-'grub-efi-bootloader'."
-  (package
-    (name name)
-    (version (package-version grub-efi))
-    ;; Source is not needed, but it cannot be omitted.
-    (source #f)
-    (build-system trivial-build-system)
-    (arguments
-     (let* ((system (string-split (nix-system->gnu-triplet
-                                   (or (%current-target-system)
-                                       (%current-system)))
-                                  #\-))
-            (arch (first system))
-            (boot-efi
-             (match system
-               ;; These are the supportend systems and the names defined by
-               ;; the UEFI standard for removable media.
-               (("i686" _ ...)        "/bootia32.efi")
-               (("x86_64" _ ...)      "/bootx64.efi")
-               (("arm" _ ...)         "/bootarm.efi")
-               (("aarch64" _ ...)     "/bootaa64.efi")
-               (("riscv" _ ...)       "/bootriscv32.efi")
-               (("riscv64" _ ...)     "/bootriscv64.efi")
-               ;; Other systems are not supported, although defined.
-               ;; (("riscv128" _ ...) "/bootriscv128.efi")
-               ;; (("ia64" _ ...)     "/bootia64.efi")
-               ((_ ...)               #f)))
-            (core-efi (string-append
-                       ;; This is the arch dependent file name of GRUB, e.g.
-                       ;; i368-efi/core.efi or arm64-efi/core.efi.
-                       (match arch
-                         ("i686"    "i386")
-                         ("aarch64" "arm64")
-                         ("riscv"   "riscv32")
-                         (_         arch))
-                       "-efi/core.efi")))
-       (list
-        #:modules '((guix build utils))
-        #:builder
-        #~(begin
-            (use-modules (guix build utils))
-            (let* ((bootloader #$(this-package-input "grub-efi"))
-                   (net-dir #$output)
-                   (sub-dir (string-append net-dir "/" #$subdir "/"))
-                   (boot-efi (string-append sub-dir #$boot-efi))
-                   (core-efi (string-append sub-dir #$core-efi)))
-              ;; Install GRUB, which refers to the grub.cfg, with support for
-              ;; encrypted partitions,
-              (setenv "GRUB_ENABLE_CRYPTODISK" "y")
-              (invoke/quiet (string-append bootloader "/bin/grub-mknetdir")
-                            (string-append "--net-directory=" net-dir)
-                            (string-append "--subdir=" #$subdir)
-                            ;; These modules must be pre-loaded to allow booting
-                            ;; from an ESP or a similar partition with a FAT
-                            ;; file system.
-                            (string-append "--modules=part_msdos part_gpt fat"))
-              ;; Move GRUB's core.efi to the removable media name.
-              (false-if-exception (delete-file boot-efi))
-              (rename-file core-efi boot-efi))))))
-    (inputs (list grub-efi))
-    (synopsis (package-synopsis grub-efi))
-    (description (package-description grub-efi))
-    (home-page (package-home-page grub-efi))
-    (license (package-license grub-efi))))
-
 (define-public syslinux
  (let ((commit "bb41e935cc83c6242de24d2271e067d76af3585c"))
    (package
@ -662,6 +583,103 @@ (define-public syslinux
                     ;; Also contains:
                     license:expat license:isc license:zlib)))))

+(define %systemd-version "255")
+(define systemd-source
+  (origin
+    (method git-fetch)
+    (uri (git-reference
+           (url "https://github.com/systemd/systemd")
+           (commit (string-append "v" %systemd-version))))
+    (file-name (git-file-name "systemd" %systemd-version))
+    (snippet #~(substitute* "src/ukify/ukify.py"
+                 ;; Remove after python 3.11.
+                 (("datetime\\.UTC") "datetime.timezone.utc")))
+    (modules '((guix build utils)))
+    (sha256
+      (base32
+        "1qdyw9g3jgvsbc1aryr11gpc3075w5pg00mqv4pyf3hwixxkwaq6"))))
+
+(define-public systemd-stub
+  (package
+    (name "systemd-stub")
+    (version %systemd-version)
+    (source systemd-source)
+    (build-system meson-build-system)
+    (arguments
+      (list #:configure-flags
+            #~(list "-Dmode=release" "-Defi=true" "-Dsbat-distro=guix"
+                    "-Dsbat-distro-generation=1" ; package revision!
+                    "-Dsbat-distro-summary=Guix System"
+                    "-Dsbat-distro-url=https://guix.gnu.org"
+                    #$(string-append "-Dsbat-distro-pkgname="
+                        (package-name this-package))
+                    #$(string-append "-Dsbat-distro-version="
+                        (package-version this-package)))
+            #:phases
+            ;; TODO: 32-bit support.
+            (let* ((stub (string-append "src/boot/efi/linux" (efi-arch)
+                                        ".efi.stub")))
+              #~(modify-phases %standard-phases
+                  (replace 'build
+                    (lambda* (#:key parallel-build? #:allow-other-keys)
+                      (invoke "ninja" #$stub "-j"
+                              (if parallel-build?
+                                  (number->string (parallel-job-count))
+                                  "1"))))
+                  (replace 'install
+                    (lambda _
+                      (install-file #$stub (string-append #$output
+                                                          "/libexec"))))
+                  (delete 'check)))))
+    (supported-systems %efi-supported-systems)
+    (inputs
+      (list libcap libxcrypt python-pyelftools `(,util-linux "lib")))
+    (native-inputs (list gperf pkg-config python-3 python-jinja2))
+    (home-page "https://systemd.io/")
+    (synopsis "Unified kernel image UEFI stub")
+    (description
+      "Simple UEFI boot stub that loads a conjoined kernel image and
+supporting data to their proper locations, before chainloading to the
+kernel.  It supports measured and/or verified boot environments.")
+    (license license:lgpl2.1+)))
+
+(define-public ukify
+  (package
+    (name "ukify")
+    (version %systemd-version)
+    (source systemd-source)
+    (build-system python-build-system)
+    (arguments
+      (list
+        #:phases
+        #~(modify-phases %standard-phases
+            (replace 'build
+              (lambda* (#:key inputs #:allow-other-keys)
+                (define (get-tool tool)
+                  (search-input-file inputs (string-append "bin/" tool)))
+                ;; Hardcode the tool paths.
+                (substitute* "src/ukify/ukify.py"
+                  (("(find_tool\\(')(readelf|sbsign|pesign)'," _ ctx tool)
+                   (string-append ctx (get-tool tool) "',"))
+                  (("('name': ')(sbverify|pesign)'," _ ctx tool)
+                   (string-append ctx (get-tool tool) "',")))))
+            (delete 'check)
+            (replace 'install
+              (lambda* (#:key inputs #:allow-other-keys)
+                (let* ((bin (string-append #$output "/bin"))
+                       (file (string-append bin "/ukify")))
+                  (mkdir-p bin)
+                  (copy-file "src/ukify/ukify.py" file)))))))
+    (inputs
+      (list binutils pesign python-cryptography python-pefile sbsigntools))
+    (home-page "https://systemd.io/")
+    (synopsis "Unified kernel image UEFI tool")
+    (description
+      "@command{ukify} joins together a UKI stub, linux kernel, initrd,
+kernel arguments, and optional secure boot signatures into a single,
+UEFI-bootable image.")
+    (license license:lgpl2.1+)))
+
 (define-public dtc
  (package
    (name "dtc")
@ -746,26 +764,26 @@ (define %u-boot-allow-disabling-openssl-patch
  ;; https://lists.denx.de/pipermail/u-boot/2021-October/462728.html
  (search-patch "u-boot-allow-disabling-openssl.patch"))

-(define %u-boot-build-without-libcrypto-patch
-  ;; Upstream commit to fix Amlogic builds in u-boot 2024.01.
-  (search-patch "u-boot-build-without-libcrypto.patch"))
+(define %u-boot-nanopi-r4s-ddr3-patch
+  ;; Use DDR3 instead of LPDDR4 for the Nano Pi R4S U-boot.
+  (search-patch "u-boot-nanopi-r4s-ddr3.patch"))

 (define u-boot
  (package
    (name "u-boot")
-    (version "2024.01")
+    (version "2024.07")
    (source (origin
              (patches
               (list %u-boot-rockchip-inno-usb-patch
-                     %u-boot-build-without-libcrypto-patch
-                     %u-boot-allow-disabling-openssl-patch))
+                     %u-boot-allow-disabling-openssl-patch
+                     %u-boot-nanopi-r4s-ddr3-patch))
              (method url-fetch)
              (uri (string-append
                    "https://ftp.denx.de/pub/u-boot/"
                    "u-boot-" version ".tar.bz2"))
              (sha256
               (base32
-                "1czmpszalc6b8cj9j7q6cxcy19lnijv3916w3dag6yr3xpqi35mr"))))
+                "13rwv28g6z8ihrs8k0066gblw37rvw6nsxkks6rxdwqfp6ddm4gm"))))
    (build-system gnu-build-system)
    (native-inputs
     (list bison
@ -862,9 +880,11 @@ (define-public u-boot-tools
               (("\\./tools/patman/patman") (which "true"))
               ;; FIXME: test fails, needs further investiation
               (("run_test \"binman\"") "# run_test \"binman\"")
-               ;; FIXME: test_spl fails, needs further investiation
-               (("test_ofplatdata or test_handoff or test_spl")
-                "test_ofplatdata or test_handoff")
+               ;; FIXME: tests fail without kwbimage, i.e. openssl.
+               (("run_test \"sandbox_noinst\"")
+                "# run_test \"sandbox_noinst\"")
+               (("run_test \"sandbox_vpl\"")
+                "# run_test \"sandbox_vpl\"")
               ;; FIXME: code coverage not working
               (("run_test \"binman code coverage\"")
                "# run_test \"binman code coverage\"")
@ -887,14 +907,16 @@ (define-public u-boot-tools
                           (("CONFIG_FIT_SIGNATURE=y")
                            "CONFIG_FIT_SIGNATURE=n
 CONFIG_UT_LIB_ASN1=n
-CONFIG_TOOLS_LIBCRYPTO=n")
+CONFIG_TOOLS_LIBCRYPTO=n
+CONFIG_TOOLS_KWBIMAGE=n")
                           ;; Catch instances of implied CONFIG_FIG_SIGNATURE
                           ;; with VPL targets
                           (("CONFIG_SANDBOX_VPL=y")
                            "CONFIG_SANDBOX_VPL=y
 CONFIG_FIT_SIGNATURE=n
 CONFIG_VPL_FIT_SIGNATURE=n
-CONFIG_TOOLS_LIBCRYPTO=n")
+CONFIG_TOOLS_LIBCRYPTO=n
+CONFIG_TOOLS_KWBIMAGE=n")
                           ;; This test requires a sound system, which is un-used
                           ;; in u-boot-tools.
                           (("CONFIG_SOUND=y") "CONFIG_SOUND=n")))
@ -957,6 +979,13 @@ (define-public python-u-boot-pylib
          (add-after 'unpack 'chdir
            (lambda _
              (chdir "tools/u_boot_pylib")))
+          (add-after 'chdir 'list-package
+            (lambda _
+              (let ((port (open-file "pyproject.toml" "a")))
+                (display "[tool.setuptools.packages.find]\n" port)
+                (display "where = [\"..\"]\n" port)
+                (display "include = [\"u_boot_pylib*\"]" port)
+                (close-port port))))
          (replace 'check
            (lambda* (#:key tests? #:allow-other-keys)
              (when tests?
@ -1103,7 +1132,8 @@ (define*-public (make-u-boot-package board triplet
                (lambda _
                  (substitute* ".config"
                    (("CONFIG_TOOLS_LIBCRYPTO=.*$")
-                     "CONFIG_TOOLS_LIBCRYPTO=n"))))
+                     "CONFIG_TOOLS_LIBCRYPTO=n
+CONFIG_TOOLS_KWBIMAGE=n"))))
              (replace 'install
                (lambda _
                  (let ((libexec (string-append #$output "/libexec"))
@ -1176,6 +1206,24 @@ (define*-public (make-u-boot-sunxi64-package board triplet scp-firmware
       (modify-inputs (package-inputs base)
         (append arm-trusted-firmware-sun50i-a64))))))

+(define-public u-boot-orangepi-zero2w
+  (let ((base (make-u-boot-package
+               "orangepi_zero2w" "aarch64-linux-gnu")))
+    (package
+      (inherit base)
+      (arguments
+       (substitute-keyword-arguments (package-arguments base)
+         ((#:phases phases)
+          #~(modify-phases #$phases
+              (add-after 'unpack 'set-environment
+                (lambda* (#:key native-inputs inputs #:allow-other-keys)
+                  (setenv "SCP" "/dev/null")
+                  (setenv "BL31" (search-input-file inputs "bl31.bin"))))))))
+      (inputs
+       (modify-inputs (package-inputs base)
+         ;; The Zero 2W uses the slightly revised Allwinner H618.
+         (append arm-trusted-firmware-sun50i-h616))))))
+
 (define-public u-boot-pine64-plus
  (make-u-boot-sunxi64-package "pine64_plus" "aarch64-linux-gnu"
                               (delay crust-pine64-plus)))
@ -1247,6 +1295,21 @@ (define-public u-boot-novena
 version, contrary to Novena upstream, does not load u-boot.img from the first
 partition."))

+(define-public u-boot-nanopi-r4s-rk3399
+  (let ((base (make-u-boot-package "nanopi-r4s-rk3399" "aarch64-linux-gnu")))
+    (package
+      (inherit base)
+      (arguments
+       (substitute-keyword-arguments (package-arguments base)
+         ((#:phases phases)
+          #~(modify-phases #$phases
+              (add-after 'unpack 'set-environment
+                (lambda* (#:key inputs #:allow-other-keys)
+                  (setenv "BL31" (search-input-file inputs "/bl31.elf"))))))))
+      (inputs
+       (modify-inputs (package-inputs base)
+         (append arm-trusted-firmware-rk3399))))))
+
 (define-public u-boot-orangepi-r1-plus-lts-rk3328
  (let ((base (make-u-boot-package "orangepi-r1-plus-lts-rk3328" "aarch64-linux-gnu")))
    (package
@ -1323,9 +1386,7 @@ (define-public u-boot-sandbox
                               "# CONFIG_IMAGE_PRE_LOAD is not set"
                               "# CONFIG_IMAGE_PRE_LOAD_SIG is not set"
                               "# CONFIG_CMD_BOOTM_PRE_LOAD is not set"
-                               "CONFIG_RSA=y"
-                               "# CONFIG_EFI_SECURE_BOOT is not set"
-                               "# CONFIG_TOOLS_LIBCRYPTO is not set")
+                               "# CONFIG_EFI_SECURE_BOOT is not set")
               #:append-description
               "The sandbox configuration of U-Boot provides a
@command{u-boot} command that runs as a normal user space application.  It can
@ -1446,7 +1507,6 @@ (define-public u-boot-rockpro64-rk3399
                                               "CONFIG_SATA_SIL=y"
                                               "CONFIG_SCSI=y"
                                               "CONFIG_SCSI_AHCI=y"
-                                               "CONFIG_DM_SCSI=y"
                                               ;; Disable SPL FIT signatures,
                                               ;; due to GPLv2 and Openssl
                                               ;; license incompatibilities
@ -1505,40 +1565,8 @@ (define-public u-boot-pinebook-pro-rk3399
       (modify-inputs (package-inputs base)
         (append arm-trusted-firmware-rk3399))))))

-(define*-public (make-u-boot-bin-package u-boot-package
-                                         #:key
-                                         (u-boot-bin "u-boot.bin"))
-  "Return a package with a single U-BOOT-BIN file from the U-BOOT-PACKAGE.
-The package name will be that of the U-BOOT package suffixed with \"-bin\"."
-  (package
-    (name (string-append (package-name u-boot-package) "-bin"))
-    (version (package-version u-boot-package))
-    (source #f)
-    (build-system trivial-build-system)
-    (arguments
-     (list
-      #:builder
-      (with-imported-modules '((guix build utils))
-        #~(begin
-            (use-modules (guix build utils))
-            (mkdir #$output)
-            (symlink (search-input-file %build-inputs
-                                        (string-append "libexec/" #$u-boot-bin))
-                     (string-append #$output "/" #$u-boot-bin))))))
-    (inputs (list u-boot-package))
-    (home-page (package-home-page u-boot-package))
-    (synopsis (package-synopsis u-boot-package))
-    (description (string-append
-                  (package-description u-boot-package)
-                  "\n\n"
-                  (format #f
-                          "This package only contains the file ~a."
-                          u-boot-bin)))
-    (license (package-license u-boot-package))))
-
-(define-public %u-boot-rpi-efi-configs
-  '("CONFIG_OF_EMBED"
-    "CONFIG_OF_BOARD=y"))
+;; get dtbs from firmware to support dtoverlays
+(define-public %u-boot-rpi-configs '("CONFIG_OF_EMBED" "CONFIG_OF_BOARD=y"))

 (define %u-boot-rpi-description-32-bit
  "This is a 32-bit build of U-Boot.")
@ -1547,76 +1575,26 @@ (define %u-boot-rpi-description-64-bit
  "This is a common 64-bit build of U-Boot for all 64-bit capable Raspberry Pi
 variants.")

-(define %u-boot-rpi-efi-description
-  "It allows network booting and uses the device-tree from the firmware,
-allowing the usage of overlays.  It can act as an EFI firmware for the
-grub-efi-netboot-removable-bootloader.")
-
-(define %u-boot-rpi-efi-description-32-bit
-  (string-append %u-boot-rpi-efi-description "  "
-                 %u-boot-rpi-description-32-bit))
-
 (define-public u-boot-rpi-2
  (make-u-boot-package "rpi_2" "arm-linux-gnueabihf"
+                       #:configs %u-boot-rpi-configs
                       #:append-description %u-boot-rpi-description-32-bit))

 (define-public u-boot-rpi-3-32b
  (make-u-boot-package "rpi_3_32b" "arm-linux-gnueabihf"
+                       #:configs %u-boot-rpi-configs
                       #:append-description %u-boot-rpi-description-32-bit))

 (define-public u-boot-rpi-4-32b
  (make-u-boot-package "rpi_4_32b" "arm-linux-gnueabihf"
+                       #:configs %u-boot-rpi-configs
                       #:append-description %u-boot-rpi-description-32-bit))

 (define-public u-boot-rpi-arm64
  (make-u-boot-package "rpi_arm64" "aarch64-linux-gnu"
+                       #:configs %u-boot-rpi-configs
                       #:append-description %u-boot-rpi-description-64-bit))

-(define-public u-boot-rpi-2-efi
-  (make-u-boot-package "rpi_2" "arm-linux-gnueabihf"
-                       #:name-suffix "-efi"
-                       #:configs %u-boot-rpi-efi-configs
-                       #:append-description %u-boot-rpi-efi-description-32-bit))
-
-(define-public u-boot-rpi-3-32b-efi
-  (make-u-boot-package "rpi_3_32b" "arm-linux-gnueabihf"
-                       #:name-suffix "-efi"
-                       #:configs %u-boot-rpi-efi-configs
-                       #:append-description %u-boot-rpi-efi-description-32-bit))
-
-(define-public u-boot-rpi-4-32b-efi
-  (make-u-boot-package "rpi_4_32b" "arm-linux-gnueabihf"
-                       #:name-suffix "-efi"
-                       #:configs %u-boot-rpi-efi-configs
-                       #:append-description %u-boot-rpi-efi-description-32-bit))
-
-(define-public u-boot-rpi-arm64-efi
-  (make-u-boot-package "rpi_arm64""aarch64-linux-gnu"
-                       #:name-suffix "-efi"
-                       #:configs %u-boot-rpi-efi-configs
-                       #:append-description (string-append
-                                             %u-boot-rpi-efi-description "  "
-                                             %u-boot-rpi-description-64-bit)))
-
-(define-public u-boot-rpi-2-bin (make-u-boot-bin-package u-boot-rpi-2))
-
-(define-public u-boot-rpi-3_32b-bin (make-u-boot-bin-package u-boot-rpi-3-32b))
-
-(define-public u-boot-rpi-4_32b-bin (make-u-boot-bin-package u-boot-rpi-4-32b))
-
-(define-public u-boot-rpi-arm64-bin (make-u-boot-bin-package u-boot-rpi-arm64))
-
-(define-public u-boot-rpi-2-efi-bin (make-u-boot-bin-package u-boot-rpi-2-efi))
-
-(define-public u-boot-rpi-3-32b-efi-bin
-  (make-u-boot-bin-package u-boot-rpi-3-32b-efi))
-
-(define-public u-boot-rpi-4-32b-efi-bin
-  (make-u-boot-bin-package u-boot-rpi-4-32b-efi))
-
-(define-public u-boot-rpi-arm64-efi-bin
-  (make-u-boot-bin-package u-boot-rpi-arm64-efi))
-
 (define u-boot-ts-mx6
  ;; There is no release; use the latest commit of the
  ;; 'imx_v2015.04_3.14.52_1.1.0_ga' branch.
--- a/gnu/packages/browser-extensions.scm
+++ b/gnu/packages/browser-extensions.scm
@ -256,7 +256,7 @@ (define-public keepassxc-browser/icecat
 (define noscript
  (package
    (name "noscript")
-    (version "11.4.35")
+    (version "11.4.40")
    (source (origin
              (method url-fetch/zipbomb)
              (uri (string-append
@ -264,7 +264,7 @@ (define noscript
                    ".xpi"))
              (sha256
               (base32
-                "1yqn60mvzgzi4h2dvv5cdzpag4bbb2y8jcbd3gxsaz7bw31f8j54"))))
+                "1cmvmplr49pf79j5rp3cfkd9gg4aw2z2q1hk19473n2rc51asbi4"))))
    (build-system copy-build-system)
    (properties '((addon-id . "{73a6fe31-595d-460b-a920-fcc0f8843232}")))
    (arguments
--- a/gnu/packages/chez.scm
+++ b/gnu/packages/chez.scm
@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2016 Federico Beffa <beffa@fbengineering.ch>
-;;; Copyright © 2016 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2016, 2024 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2017, 2019 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2019 Brett Gilio <brettg@gnu.org>
 ;;; Copyright © 2020 Brendan Tildesley <mail@brendan.scot>
@ -331,6 +331,9 @@ (define-public chez-scheme-for-racket
        (srfi srfi-34))
      #:out-of-source? #t
      #:test-target "test" ; test-one test-some-fast test-some test test-more
+      ;; Tests take more than 30 hours on riscv64.
+      #:tests? (and (not (target-riscv64?))
+                    (not (%current-target-system)))
      #:configure-flags
      #~`(,@(let* ((chez+version (strip-store-file-name #$output))
                   (doc-dir (string-append #$output:doc
@ -610,6 +613,11 @@ (define-public chez-scheme-for-racket-bootstrap-bootfiles
               (else
                ;; bootstrapping
                #~(lambda* (#:key native-inputs inputs #:allow-other-keys)
+                     ;; Make sure we're building for the correct machine type.
+                     (setenv "MACH"
+                             #$@(if (nix-system->native-chez-machine-type)
+                                    #~(#$(nix-system->native-chez-machine-type))
+                                    #~(#$(nix-system->pbarch-machine-type))))
                    (invoke
                     (search-input-file (or native-inputs inputs)
                                        "/opt/racket-vm/bin/racket")
--- a/gnu/packages/ci.scm
+++ b/gnu/packages/ci.scm
@ -61,8 +61,8 @@ (define-module (gnu packages ci)
  #:use-module ((guix search-paths) #:select ($SSL_CERT_DIR)))

 (define-public cuirass
-  (let ((commit "88f85da199bcfeddfdbe4f4ff8cd5900079afd66")
-        (revision "9"))
+  (let ((commit "fc4624cdac28f013e5a31165cb64ecb5e4f6de41")
+        (revision "10"))
    (package
      (name "cuirass")
      (version (git-version "1.2.0" revision commit))
@ -75,7 +75,7 @@ (define-public cuirass
         (file-name (git-file-name name version))
         (sha256
          (base32
-           "1csbdmmqayyi65dqyjlp1xxs1apgw52xqi008qw16ip1h985s54m"))))
+           "0rjd27jzahv4cl4qw9zpx2b0cniziqd6wxc4dr6dc9x8c561fs8g"))))
      (build-system gnu-build-system)
      (arguments
       (list #:modules `((guix build utils)
--- a/gnu/packages/clifm.scm
+++ b/gnu/packages/clifm.scm
@ -30,7 +30,7 @@ (define-module (gnu packages clifm)
 (define-public clifm
  (package
    (name "clifm")
-    (version "1.20")
+    (version "1.21")
    (source
     (origin
       (method git-fetch)
@ -39,7 +39,7 @@ (define-public clifm
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1hmky0rdrdp5zs1pgayrcgrf0ylvl2xh135r2c0g8k4ibwv3392c"))))
+        (base32 "0r2w11v5nsz9d9wdi0zmymkwg0y9x4xg4dksd2qxlknwqnvivcy7"))))
    (build-system gnu-build-system)
    (arguments
     `(#:make-flags (list (string-append "CC="
--- a/gnu/packages/containers.scm
+++ b/gnu/packages/containers.scm
@ -606,7 +606,7 @@ (define-public podman-compose
 (define-public buildah
  (package
    (name "buildah")
-    (version "1.37.1")
+    (version "1.37.3")
    (source
     (origin
       (method git-fetch)
@ -614,7 +614,7 @@ (define-public buildah
             (url "https://github.com/containers/buildah")
             (commit (string-append "v" version))))
       (sha256
-        (base32 "1c15djlnqiawrahcyp7nl7bsnj0nz60ngncbwbab09f28szfk61g"))
+        (base32 "1xwlkybqb4wvxki4c8sgp185jakwf052676gvma9jyv9ggb9fvgx"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (arguments
--- a/gnu/packages/cpp.scm
+++ b/gnu/packages/cpp.scm
@ -2,7 +2,7 @@
 ;;; Copyright © 2017 Ethan R. Jones <doubleplusgood23@gmail.com>
 ;;; Copyright © 2018–2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2018 Fis Trivial <ybbs.daans@hotmail.com>
-;;; Copyright © 2018, 2021, 2023 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2018, 2021, 2023-2024 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2019, 2020, 2022 Mathieu Othacehe <m.othacehe@gmail.com>
 ;;; Copyright © 2019 Pierre Neidhardt <mail@ambrevar.xyz>
 ;;; Copyright © 2019 Jan Wielkiewicz <tona_kosmicznego_smiecia@interia.pl>
@ -34,7 +34,7 @@
 ;;; Copyright © 2022, 2023, 2024 Maxim Cournoyer <maxim.cournoyer@gmail.com>
 ;;; Copyright © 2022 Antero Mejr <antero@mailbox.org>
 ;;; Copyright © 2023 Sughosha <Sughosha@proton.me>
-;;; Copyright © 2023 Artyom V. Poptsov <poptsov.artyom@gmail.com>
+;;; Copyright © 2023, 2024 Artyom V. Poptsov <poptsov.artyom@gmail.com>
 ;;; Copyright © 2023 Liliana Marie Prikler <liliana.prikler@gmail.com>
 ;;; Copyright © 2023 Denis 'GNUtoo' Carikli <GNUtoo@cyberdimension.org>
 ;;; Copyright © 2023 Foundation Devices, Inc. <hello@foundationdevices.com>
@ -1239,7 +1239,7 @@ (define-public cpplint
 (define-public reproc
  (package
    (name "reproc")
-    (version "14.2.4")
+    (version "14.2.5")
    (source
      (origin
        (method git-fetch)
@ -1248,7 +1248,7 @@ (define-public reproc
               (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-          (base32 "09xnf8hmld1fk8j33zwlz1qcxnjdx1ncbg62csic9va4m1wc2v1d"))))
+         (base32 "07h11rzhvplgmd420v650h8abyvwcbws4w1xlq8x18nxbp4nnqn1"))))
   (build-system cmake-build-system)
   (arguments
    (list #:tests? #f     ; No tests.
@ -1368,6 +1368,11 @@ (define-public kokkos
    ;; Code exhibits integer size mismatches when compiled on 32-bit systems.
    (supported-systems %64bit-supported-systems)

+    ;; This code can benefit from SIMD optimizations; tuning gives an effect
+    ;; equivalent to setting the 'KOKKOS_ARCH_NATIVE' CMake flag, except for
+    ;; the configuration metadata recorded in 'Kokkos_Core.cpp'.
+    (properties '((tunable? . #t)))
+
    (license license:asl2.0))) ; With LLVM exception

 (define-public tweeny
--- a/gnu/packages/cran.scm
+++ b/gnu/packages/cran.scm
@ -11163,6 +11163,19 @@ (define-public r-cli
        (base32
         "0ha8mijnzlz1cxsjk502j2gzspd8fnk3j79bvnqm871225ghi5a2"))))
    (build-system r-build-system)
+    (arguments
+     (list
+      #:phases
+      '(modify-phases %standard-phases
+         ;; Do not embed the PID of the build process.
+         (add-after 'unpack 'build-reproducibly
+           (lambda _
+             (setenv "GUIX_BUILD" "yes")
+             (substitute* '("R/onload.R" "R/app.R")
+               (("\\<- Sys\\.getpid\\(\\)")
+                (lambda _
+                  (string-append
+                   "<- if (Sys.getenv(\"GUIX_BUILD\") == \"\") { Sys.getpid() } else { 12345 }")))))))))
    (home-page "https://github.com/r-lib/cli#readme")
    (synopsis "Helpers for developing command line interfaces")
    (description "This package provides a suite of tools designed to build
@ -34829,8 +34842,7 @@ (define-public r-rserve
       (uri (string-append "http://www.rforge.net/Rserve/snapshot/Rserve_"
                           version ".tar.gz"))
       (sha256
-        (base32
-         "017kkzv9lxlz9qhg3gprrf1wcyflxrif6wjk27x9b4bdzylw6bsx"))))
+        (base32 "0z1xvx8ifvlwfl3rf1wwhpbwp4ivh7sn71xhlqihqpsclpmljg8p"))))
    (build-system r-build-system)
    (arguments
     `(#:phases
--- a/gnu/packages/datastructures.scm
+++ b/gnu/packages/datastructures.scm
@ -214,14 +214,14 @@ (define-public libcuckoo
 (define-public liburcu
  (package
    (name "liburcu")
-    (version "0.14.0")
+    (version "0.14.1")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://www.lttng.org/files/urcu/"
                                  "userspace-rcu-" version ".tar.bz2"))
              (sha256
               (base32
-                "0kwx4fi3gn4p4sdxqkz2zh4z0fv06q449bnz43zjqfad3lkbyhya"))))
+                "1h5bg0k94by2v7cjq7fb3ridqixbd9pndw506vl27h3fvh9wn6i3"))))
    (build-system gnu-build-system)
    (native-inputs
     (list perl))                 ; for tests
--- a/gnu/packages/debug.scm
+++ b/gnu/packages/debug.scm
@ -52,6 +52,7 @@ (define-module (gnu packages debug)
  #:use-module (gnu packages code)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages flex)
+  #:use-module (gnu packages fontutils)
  #:use-module (gnu packages gcc)
  #:use-module (gnu packages gdb)
  #:use-module (gnu packages glib)
@ -1006,23 +1007,24 @@ (define-public seer-gdb
 (define-public ddd
  (package
    (name "ddd")
-    (version "3.4.0")
+    (version "3.4.1")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/ddd/ddd-" version ".tar.gz"))
+              (patches (search-patches "ddd-build.patch"))
              (sha256
               (base32
-                "03sqsfiri5p130cmmzh2wikg0gisql496rvdhr1qaidh1f5bqk2x"))))
+                "12gfyh139rim49m56lxm36ckdyiiz4n3la3y6ik1aqgrqfk1fxdq"))))
    (build-system gnu-build-system)
    (arguments
     (list #:tests? #f                 ;tests require manual intervention
-           ;; Avoid "friend declaration specifies default arguments and isn’t
-           ;; a definition" errors.
-           #:configure-flags #~(list "CXXFLAGS=-fpermissive")))
+           #:configure-flags
+           #~(list (string-append "--with-freetype-includes="
+                   #$(this-package-input "freetype") "/include/freetype2"))))
    (native-inputs
-     (list pkg-config))
+     (list pkg-config bison flex perl))
    (inputs
-     (list motif ncurses gdb))
+     (list libxaw libxft freetype motif ncurses gdb))
    (synopsis "Graphical front-end for GDB and other debuggers")
    (description "GNU DDD, the Data Display Debugger, is a graphical front-end
 for command-line debuggers.  Many back-end debuggers are supported, notably
--- a/gnu/packages/disk.scm
+++ b/gnu/packages/disk.scm
@ -726,14 +726,14 @@ (define-public greaseweazle-host-tools
 (define-public gparted
  (package
    (name "gparted")
-    (version "1.5.0")
+    (version "1.6.0")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "mirror://sourceforge/gparted/gparted/gparted-"
                           version "/gparted-" version ".tar.gz"))
       (sha256
-        (base32 "1pm8jah6lakv83zm3isx4bgmi5xdwaqkjxmiv7qky224m4kfm59w"))))
+        (base32 "0nzaqvbdwq3daddby79k9rh3d560g5kaxqamkasxqka9rsrm37wv"))))
    (build-system glib-or-gtk-build-system)
    (arguments
      ;; Tests require access to files outside the build container, such
--- a/gnu/packages/display-managers.scm
+++ b/gnu/packages/display-managers.scm
@ -7,7 +7,7 @@
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2020 L  p R n  d n <guix@lprndn.info>
-;;; Copyright © 2020 Fredrik Salomonsson <plattfot@gmail.com>
+;;; Copyright © 2020, 2024 Fredrik Salomonsson <plattfot@posteo.net>
 ;;; Copyright © 2020 Vincent Legoll <vincent.legoll@gmail.com>
 ;;; Copyright © 2021 Zheng Junjie <873216071@qq.com>
 ;;; Copyright © 2021-2023 Efraim Flashner <efraim@flashner.co.il>
@ -222,26 +222,33 @@ (define-public dexy-color-sddm-theme
 (define-public guix-simplyblack-sddm-theme
  (package
    (name "guix-simplyblack-sddm-theme")
-    (version "0.1")
-    (source (origin
+    (version "0.2")
+    (source
+     (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/plattfot/guix-simplyblack-sddm")
             (commit version)))
       (file-name (git-file-name name version))
       (sha256
-               (base32 "1fwny6b0xpjs8ad2b16pyxd27gf0sr0nillmhc2h5k0q7dva21vi"))))
+        (base32 "09vb9b0pmyhj6fh0b6by59bykszbkdayhz678pnb4pyrdmlvv1am"))))
    (build-system trivial-build-system)
    (arguments
-     `(#:modules ((guix build utils))
-       #:builder
-       (begin
-         (use-modules (guix build utils))
+     `(#:modules ((guix build utils)
+                  (srfi srfi-26))
+       #:builder (begin
+                   (use-modules (guix build utils)
+                                (srfi srfi-26))
                   (let* ((out (assoc-ref %outputs "out"))
-                (sddm-themes (string-append out "/share/sddm/themes")))
-           (mkdir-p sddm-themes)
+                          (themes-dir (string-append out
+                                       "/share/sddm/themes/guix-simplyblack-sddm/")))
+                     (mkdir-p themes-dir)
                     (copy-recursively (assoc-ref %build-inputs "source")
-                             (string-append sddm-themes "/guix-simplyblack-sddm"))))))
+                                       themes-dir)
+                     (substitute* (map (cut string-append themes-dir <>)
+                                       '("Main.qml" "theme.conf"))
+                       (("file:")
+                        themes-dir))))))
    (home-page "https://github.com/plattfot/guix-simplyblack-sddm")
    (synopsis "Guix based theme for SDDM")
    (description
@ -250,6 +257,19 @@ (define-public guix-simplyblack-sddm-theme
    ;; Theme under cc-by-sa3.0, guix logo under license:cc-by-sa4.0
    (license (list license:cc-by-sa3.0 license:cc-by-sa4.0))))

+(define-public guix-simplyblack-sddm-theme-qt5
+  (package
+    (inherit guix-simplyblack-sddm-theme)
+    (name "guix-simplyblack-sddm-theme-qt5")
+    (source
+     (origin
+       (inherit (package-source guix-simplyblack-sddm-theme))
+       (modules '((guix build utils)))
+       (snippet '(begin
+                   (substitute* "metadata.desktop"
+                     (("QtVersion=6")
+                      "QtVersion=5"))))))))
+
 (define-public chili-sddm-theme
  (package
    (name "chili-sddm-theme")
--- a/gnu/packages/dns.scm
+++ b/gnu/packages/dns.scm
@ -22,6 +22,7 @@
 ;;; Copyright © 2023 Bruno Victal <mirai@makinata.eu>
 ;;; Copyright © 2023 Hilton Chain <hako@ultrarare.space>
 ;;; Copyright © 2024 John Kehayias <john.kehayias@protonmail.com>
+;;; Copyright © 2024 Ashish SHUKLA <ashish.is@lostca.se>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -635,14 +636,14 @@ (define-public rbldnsd
 (define-public unbound
  (package
    (name "unbound")
-    (version "1.21.0")
+    (version "1.21.1")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "https://www.unbound.net/downloads/unbound-"
                           version ".tar.gz"))
       (sha256
-        (base32 "08a5l5z0c99433pqg2i7x5d9m6as7c2z3sv4zakdy6zqn3bagp77"))))
+        (base32 "0ipam47nnh86v1wbjvk337wch6pcplbk353yr39kcav24cyd4dih"))))
    (build-system gnu-build-system)
    (outputs '("out" "python"))
    (native-inputs
--- a/gnu/packages/efi.scm
+++ b/gnu/packages/efi.scm
@ -24,8 +24,10 @@ (define-module (gnu packages efi)
  #:use-module (gnu packages bash)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages man)
+  #:use-module (gnu packages nss)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages popt)
  #:use-module (gnu packages tls)
  #:use-module ((guix licenses) #:prefix license:)
  #:use-module (guix build-system gnu)
@ -153,6 +155,56 @@ (define-public sbsigntools
    (home-page "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/")
    (license license:gpl3+)))

+(define-public pesign
+  (package
+    (name "pesign")
+    (version "116")
+    (source
+      (origin
+        (method git-fetch)
+        (uri (git-reference
+               (url (string-append "https://github.com/rhboot/" name))
+               (commit version)))
+        (modules '((guix build utils)))
+        (snippet
+          #~(substitute* "Make.defaults"
+              (("RANLIB\t\\?= \\$\\(CROSS_COMPILE\\)") "RANLIB\t?=")
+              (("pkg-config-ccldflags") "pkg-config-ldflags")))
+        (sha256
+          (base32
+            "0fnqfiivj46bha4hsnwiqy8vq8b4i3w2dig0h9h2k4j7yq7r5qvj"))))
+    (build-system gnu-build-system)
+    (arguments
+      (list #:tests? #f ; The Makefile has no check target.
+            #:modules '((guix build gnu-build-system)
+                        (guix build utils)
+                        (ice-9 match))
+            #:phases #~(modify-phases %standard-phases (delete 'configure))
+            #:make-flags
+            (let ((system (%current-system))
+                  (target (%current-target-system)))
+              (define (arch s)
+                (if (target-x86-32? s)
+                    "ia32"
+                    (match (string-split s #\-)
+                      ((x _ ...) x))))
+              #~(list "prefix=/" "libdir=/lib/"
+                      (string-append "DESTDIR=" #$output)
+                      (string-append "HOSTARCH=" #$(arch system))
+                      (string-append "ARCH=" #$(arch (or target system)))
+                      (if #$target
+                          (string-append "CROSS_COMPILE=" #$target "-")
+                          "")))))
+    (inputs (list efivar nspr nss popt `(,util-linux "lib")))
+    (native-inputs (list mandoc pkg-config))
+    (synopsis "PE-COFF binary signing tools")
+    (description
+      "This package supports EFI keygen and subsequent signing of
+PE-COFF binaries. It contains the tools authvar, efikeygen, pesigcheck,
+pesign, pesign-client, and pesum.")
+    (home-page "https://github.com/rhboot/pesign")
+    (license license:gpl2+)))
+
 (define-public efitools
  (package
    (name "efitools")
--- a/gnu/packages/elf.scm
+++ b/gnu/packages/elf.scm
@ -28,6 +28,7 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu packages elf)
+  #:use-module (guix gexp)
  #:use-module (guix utils)
  #:use-module (guix packages)
  #:use-module (guix download)
@ -320,6 +321,32 @@ (define-public patchelf
 changed.")
    (license gpl3+)))

+;; Newer patchelf may break binaries.  e.g. When setting RUNPATH for a Go
+;; program.
+;; See also: https://github.com/NixOS/patchelf/issues/482
+(define-public patchelf-0.16
+  (package
+    (inherit patchelf)
+    (name "patchelf")
+    (version "0.16.1")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append
+                    "https://github.com/NixOS/patchelf/releases/download/"
+                    version
+                    "/patchelf-" version ".tar.bz2"))
+              (sha256
+               (base32
+                "0zdby3gpmm8q4735pviaq92zj41i2rdnhwhyrsb3sinc9hzmz4db"))))
+    (arguments
+     (substitute-keyword-arguments (package-arguments patchelf)
+       ((#:phases phases '%standard-phases)
+        #~(modify-phases #$phases
+            (add-after 'fix-tests 'skip-empty-rpath-test
+              (lambda _
+                (substitute* "tests/set-empty-rpath.sh"
+                  (("^\\$\\{SCRATCH\\}\\/simple.$") ""))))))))))
+
 (define-public libdwarf
  (package
    (name "libdwarf")
--- a/gnu/packages/emacs-xyz.scm
+++ b/gnu/packages/emacs-xyz.scm
@ -4832,6 +4832,26 @@ (define-public emacs-howm
 searches.  Unlike code@{emacs-wiki.el}, it can be combined with any format.")
    (license license:gpl1+)))

+(define-public emacs-mediawiki-el
+  (package
+    (name "emacs-mediawiki-el")
+    (version "2.3.1")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                     (url "https://github.com/hexmode/mediawiki-el.git")
+                     (commit version)))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "1d05jw2sa19rgzskvavh21bfmbh07yza1drfbgypsvay3nkjfd2z"))))
+    (build-system emacs-build-system)
+    (synopsis "emacs mediawiki editor")
+    (description "This package provides a way to edit mediawiki sites from
+within emacs.")
+    (home-page "https://github.com/hexmode/mediawiki-el")
+    (license license:agpl3+)))
+
 (define-public emacs-bm
  (package
    (name "emacs-bm")
@ -13586,7 +13606,7 @@ (define-public emacs-ivy
       (method url-fetch)
       (uri (string-append "https://elpa.gnu.org/packages/ivy-" version ".tar"))
       (sha256
-        (base32 "1zjksh0jvxyqhzgwmh9i26gaip6c04q400xckh730r2gjs287pjj"))))
+        (base32 "1h9gfkkcw9nfw85m0mh08qfmi2y0jkvdk54qx0iy5p04ysmhs6k1"))))
    (build-system emacs-build-system)
    (propagated-inputs
     (list))
@ -38170,7 +38190,7 @@ (define-public emacs-org-roam
 (define-public emacs-org-node
  (package
    (name "emacs-org-node")
-    (version "1.1.2")
+    (version "1.4.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -38179,7 +38199,7 @@ (define-public emacs-org-node
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0l6xk760sjj384fv06ihiv5shq08ly17ap1vla7d307d7nag9c1n"))))
+                "0gf8abfjm2hhp19g9zi38gbvr9lmx9li0jma838q8hj1f1k7ps1q"))))
    (build-system emacs-build-system)
    (propagated-inputs
     (list emacs-dash
--- a/gnu/packages/emacs.scm
+++ b/gnu/packages/emacs.scm
@ -567,12 +567,12 @@ (define-public emacs-wide-int
        #~(cons "--with-wide-int" #$flags))))))

 (define-public emacs-next-minimal
-  (let ((commit "4e22ef870c4b650f29c4441ac51b6a2ac506ea57")
+  (let ((commit "9a1c76bf7ff49d886cc8e1a3f360d71e62544802")
        (revision "1"))
   (package
    (inherit emacs-minimal)
    (name "emacs-next-minimal")
-    (version (git-version "30.0.60" revision commit))
+    (version (git-version "30.0.91" revision commit))
    (source
     (origin
       (method git-fetch)
@ -581,7 +581,7 @@ (define-public emacs-next-minimal
             (commit commit)))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1zl9ffj3ph4msr1r4qw09x1wljpv2lbr7ypqd0p3q89m2qpvfn80"))
+        (base32 "1m1qbdqj1p994wz6flxcswv5c3qqbvjyjfsv0dh65qqq2ph7g4jz"))
       (patches
        (search-patches "emacs-next-exec-path.patch"
                        "emacs-fix-scheme-indent-function.patch"
--- a/gnu/packages/emulators.scm
+++ b/gnu/packages/emulators.scm
--- a/gnu/packages/engineering.scm
+++ b/gnu/packages/engineering.scm
@ -1286,8 +1286,8 @@ (define-public kicad-templates

 (define-public librseq
  ;; There's no release.
-  (let ((commit "170f840b498e1aff068b90188727a656111bfc2f")
-        (revision "1"))
+  (let ((commit "c3ed6b64bbe1944bd8de8b9fde14e7c290f02a90")
+        (revision "2"))
    (package
      (name "librseq")
      (version (git-version "0.0.0" revision commit))
@ -1299,9 +1299,15 @@ (define-public librseq
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "0rdx59y8y9x8cfmmx5gl66gibkzpk3kw5lrrqhrxan8zr37a055y"))))
+                  "046lrfw87gjbr4rvs054s6wk22c4xcmrcww04wkpnxmy5vp33mk3"))))
      (build-system gnu-build-system)
-      (native-inputs (list autoconf automake libtool))
+      (inputs
+       (list numactl))
+      (native-inputs
+       (list autoconf
+             automake
+             libtool
+             pkg-config))
      (home-page "https://github.com/compudj/librseq")
      (synopsis "Userspace library for restartable sequences")
      (description "A restartable sequence is a critical region delimited by a
--- a/gnu/packages/erlang.scm
+++ b/gnu/packages/erlang.scm
@ -49,7 +49,7 @@ (define-module (gnu packages erlang)
 (define-public erlang
  (package
    (name "erlang")
-    (version "27.1")
+    (version "27.1.1")
    (source (origin
              (method git-fetch)
              ;; The tarball from http://erlang.org/download contains many
@ -61,7 +61,7 @@ (define-public erlang
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "099m8z5f9mq6hqv75hv73iydzmnpylcagss4ysrk9xg732xqcawb"))
+                "1rm85y75202p6qkbqglqgfyvw0fnpdfx3h5i0k6pwqm62wh5g23r"))
              (patches (search-patches "erlang-man-path.patch"))))
    (build-system gnu-build-system)
    (native-inputs
@ -74,7 +74,7 @@ (define-public erlang
                               "/OTP-" version "/otp_doc_man_" version ".tar.gz"))
           (sha256
            (base32
-             "1d4v664z9z4d8sfp9304kflgmymbl74hcgjpbcqkbhzwcjk8jrn0"))))))
+             "1sc6akmy8bsmmrw2mzaq4ai2gxmbr1cywvyz4a826m4v0z6qr0hp"))))))
    (inputs
     (list ncurses openssl wxwidgets))
    (propagated-inputs
--- a/gnu/packages/finance.scm
+++ b/gnu/packages/finance.scm
@ -2374,7 +2374,7 @@ (define-public xmrig
 (define-public p2pool
  (package
    (name "p2pool")
-    (version "4.1")
+    (version "4.1.1")
    (source
     (origin
       (method git-fetch)
@ -2383,7 +2383,7 @@ (define-public p2pool
             (commit (string-append "v" version))
             (recursive? #t)))
       (file-name (git-file-name name version))
-       (sha256 (base32 "1ijj3ci0kx87yjv29c6p9wqj15aij7r87sdbjwhzcmbdf46krj3q"))
+       (sha256 (base32 "1vcgzip0w4mdnaj49s539nlnkc8mnxw4idzy2935nx83p1p0l6xg"))
       (modules '((guix build utils)))
       (snippet
        #~(for-each delete-file-recursively
--- a/gnu/packages/firmware.scm
+++ b/gnu/packages/firmware.scm
@ -1105,18 +1105,17 @@ (define* (make-arm-trusted-firmware platform
                                       (gnu-triplet->nix-system triplet))))))
    (package
      (name (string-append "arm-trusted-firmware-" platform))
-      (version "2.9")
+      (version "2.10")
      (source
       (origin
         (method git-fetch)
         (uri (git-reference
-               ;; There are only GitHub generated release snapshots.
               (url "https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/")
               (commit (string-append "v" version))))
         (file-name (git-file-name "arm-trusted-firmware" version))
         (sha256
          (base32
-           "16fjbn1zck0d8b554h8lk1svqqn0zlawvrlkjxry9l71s9h4vd0p"))
+           "099r2c5vnvl83c2saca615dryr1byj2nm6imzkg5ix4kajsry2q8"))
         (snippet
          #~(begin
              (use-modules (guix build utils))
@ -1166,6 +1165,12 @@ (define-public arm-trusted-firmware-sun50i-a64
      (inherit base)
      (name "arm-trusted-firmware-sun50i-a64"))))

+(define-public arm-trusted-firmware-sun50i-h616
+  (let ((base (make-arm-trusted-firmware "sun50i_h616")))
+    (package
+      (inherit base)
+      (name "arm-trusted-firmware-sun50i-h616"))))
+
 (define-public arm-trusted-firmware-rk3328
  (make-arm-trusted-firmware "rk3328"))

--- a/gnu/packages/fontutils.scm
+++ b/gnu/packages/fontutils.scm
@ -62,6 +62,7 @@ (define-module (gnu packages fontutils)
  #:use-module (gnu packages java)
  #:use-module (gnu packages linux)
  #:use-module (gnu packages man)
+  #:use-module (gnu packages mc)
  #:use-module (gnu packages ninja)
  #:use-module (gnu packages perl)
  #:use-module (gnu packages pkg-config)
@ -2056,6 +2057,29 @@ (define-public libraqm
 can support most writing systems covered by Unicode.")
    (license license:expat)))

+
+(define-public fontopia
+  (package
+    (name "fontopia")
+    (version "2.0")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append "mirror://gnu/fontopia/fontopia-"
+                                 version ".tar.gz"))
+             (sha256
+              (base32 "0wv7bd7gdm1ma4xgq9av73ic3xhpwyszj6g6c6311xjk26xm9ahd"))))
+    (build-system gnu-build-system)
+    (inputs
+     (list gnudos))
+    (home-page "https://www.gnu.org/software/fontopia/")
+    (synopsis "Text-based, console font editor")
+    (description
+     "GNU fontopia is an easy-to-use, text-based, console font editor.  You can
+edit the fonts that your GNU/Linux kernel is using to display your text on text-
+based (vs graphical) terminals.")
+    (license license:gpl3+)))
+
+
 (define-public lcdf-typetools
  (package
    (name "lcdf-typetools")
--- a/gnu/packages/games.scm
+++ b/gnu/packages/games.scm
@ -2,7 +2,7 @@
 ;;; Copyright © 2013 John Darrington <jmd@gnu.org>
 ;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org>
 ;;; Copyright © 2014, 2015 David Thompson <dthompson2@worcester.edu>
-;;; Copyright © 2014-2023 Eric Bavier <bavier@posteo.net>
+;;; Copyright © 2014-2024 Eric Bavier <bavier@posteo.net>
 ;;; Copyright © 2014 Cyrill Schenkel <cyrill.schenkel@gmail.com>
 ;;; Copyright © 2014 Sylvain Beucler <beuc@beuc.net>
 ;;; Copyright © 2014, 2015, 2018, 2019, 2021 Ludovic Courtès <ludo@gnu.org>
@ -171,6 +171,7 @@ (define-module (gnu packages games)
  #:use-module (gnu packages image)
  #:use-module (gnu packages imagemagick)
  #:use-module (gnu packages javascript)
+  #:use-module (gnu packages kde-frameworks)
  #:use-module (gnu packages less)
  #:use-module (gnu packages lesstif)
  #:use-module (gnu packages libcanberra)
@ -486,6 +487,46 @@ (define-public anarch
 Doom clone shooter game.")
      (license license:cc0))))

+(define-public antimicrox
+  (package
+    (name "antimicrox")
+    (version "3.4.1")
+    (home-page "https://github.com/AntiMicroX/antimicrox")
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url home-page)
+             (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "04yb5nppn751asbihr90sqk5imamc937886lc24cihhgp0sila8y"))))
+    (build-system cmake-build-system)
+    (arguments
+     (list
+      #:tests? #f ;Tests are unmaintained
+      #:configure-flags #~(list "-DCHECK_FOR_UPDATES=NO" "-DWITH_TESTS=NO"
+                                #$(string-append "-DANTIMICROX_PKG_VERSION="
+                                                 version))
+      #:phases #~(modify-phases %standard-phases
+                   (add-after 'unpack 'patch-installation-target
+                     (lambda _
+                       (substitute* "CMakeLists.txt"
+                         (("/usr(/lib/udev/rules.d)" _ lib)
+                          (string-append #$output lib))))))))
+    (native-inputs (list extra-cmake-modules gettext-minimal itstool qttools))
+    (inputs (list libxtst libx11 qtbase sdl2))
+    (synopsis "Control your system with a gamepad")
+    (description
+     "AntiMicroX is a graphical program used to map gamepad keys to keyboard, mouse,
+scripts, and macros under both X.org and Wayland.  With it you can control
+your system using a gamepad or play games that don't natively support
+gamepads.  It can also be used for generating SDL2 configurations.
+
+For unprivileged access to input events, this package provides udev rules for
+use with @code{udev-service-type}.")
+    (license license:gpl3+)))
+
 (define-public armagetronad
  (package
    (name "armagetronad")
@ -6302,7 +6343,7 @@ (define-public bambam
 (define-public moonlight-qt
  (package
    (name "moonlight-qt")
-    (version "5.0.1")
+    (version "6.1.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -6311,7 +6352,7 @@ (define-public moonlight-qt
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1g1y736vw36lmh2bjymsf4b4ypr76x9lqz7frzpj7sn0vb9y5315"))))
+                "06fxf3m26k036asxjkkykk5q96nincwmpiqm953m7zgr9224gidx"))))
    (build-system qt-build-system)
    (arguments
     (list
@ -6357,11 +6398,11 @@ (define-public moonlight-qt

 (define-public moonlight-common
  ;; Used as submodule in https://github.com/moonlight-stream/moonlight
-  (let ((commit "5de4a5b85a28d8d639482a1a105c3a06eb67a2fd")
+  (let ((commit "8599b6042a4ba27749b0f94134dd614b4328a9bc")
        (revision "1"))
    (package
      (name "moonlight-common")
-      (version (git-version "5.0.1" revision commit))
+      (version (git-version "6.1.0" revision commit))
      (source (origin
                (method git-fetch)
                (uri (git-reference
@ -6371,7 +6412,7 @@ (define-public moonlight-common
                (file-name (git-file-name name version))
                (sha256
                 (base32
-                  "05jm0vhyb6pizd8yj89rp6ak7bf5j9w06rrmbxh8jccxwqjgll92"))))
+                  "19k8rs2p51zs0h3wj22xw8bgj9c0ma0dc6y7qk5pk75p8ymqp9d3"))))
      (build-system cmake-build-system)
      (arguments
       (list #:tests? #f
@ -8066,26 +8107,61 @@ (define-public gzdoom
        (base32 "0i4hyg72z84fc6ca2ic9q82q5cbgrbd7bynl3kpkypxvyasq08wz"))
       (patches (search-patches "gzdoom-search-in-installed-share.patch"
                                "gzdoom-find-system-libgme.patch"))
-       (modules '((guix build utils)))
+       (modules '((guix build utils)
+                  (ice-9 regex)))
       (snippet
        '(begin
+           ;; Remove files which mustn't be commercially redistributed.  See
+           ;; <https://zdoom.org/wiki/License#Commercial_use>, the ‘Contribution
+           ;; Guidelines’ at <https://github.com/ZDoom>, and Guix issue #73435.
+           (for-each
+            (lambda (directory)
+              (delete-file-recursively directory)
+              (substitute* "CMakeLists.txt"
+                (((string-append "add_subdirectory\\([[:blank:]]*"
+                                 directory
+                                 "[[:blank:]]*\\)"))
+                 "")))
+            '( ;; "wadsrc_extra"        ;game_support.pk3
+              "wadsrc_bm"))             ;brightmaps.pk3
+
+           ;; Removing game_support.pk3 entirely would break Freedoom & remove
+           ;; users' ability to play commercial games, despite owning (only) the
+           ;; non-functional data.  That can't be right.  Out of an abundance of
+           ;; caution, remove anything from the PK3 that could conceivably be
+           ;; derived from copyrightable data that's not freely redistributable.
+           (display "Keeping only the following game_support.pk3 files:\n")
+           (let* ((regexps (list "/font\\.inf$"
+                                 "/harmony/.*\\.(txt|zs)$"
+                                 "/(iwadinfo|mapinfo|sprofs)\\.txt$"
+                                 "\\.z$"))
+                  (regexp* (format #f "(~{~a~^|~})" regexps))
+                  (regexp  (make-regexp regexp* regexp/icase)))
+             (define (keep-file? file stat)
+               (let ((keep? (regexp-exec regexp file)))
+                 (when keep?
+                   (format #t "  ~a~%" file))
+                 keep?))
+
+             (for-each delete-file (find-files "wadsrc_extra/static"
+                                               (negate keep-file?))))
+
           ;; Remove some bundled libraries.  XXX There are more, but removing
           ;; them would require, at least, patching the build system.
           (with-directory-excursion "libraries"
             (delete-file-recursively "bzip2")
             (delete-file-recursively "game-music-emu")
             (delete-file-recursively "jpeg")
-             (delete-file-recursively "zlib"))
-           #t))))
+             (delete-file-recursively "zlib"))))))
    (arguments
-     '(#:tests? #f
-       #:configure-flags
-       (let ((out (assoc-ref %outputs "out")))
     (list
+      #:tests? #f
+      #:configure-flags
+      #~(list
         (string-append
          "-DCMAKE_CXX_FLAGS:="
-           "-DSHARE_DIR=\\\"" out "/share/\\\" "
-           "-DGUIX_OUT_PK3=\\\"" out "/share/games/doom\\\"")
+          "-DSHARE_DIR=\\\"" #$output "/share/\\\" "
+          "-DGUIX_OUT_PK3=\\\"" #$output "/share/games/doom\\\"")

         ;; The build requires some extra convincing not to use the bundled
         ;; libgme previously deleted in the soure snippet.
@ -8096,44 +8172,40 @@ (define-public gzdoom
         "-DDYN_FLUIDSYNTH=OFF"
         "-DDYN_GTK=OFF"
         "-DDYN_MPG123=OFF"
-          "-DDYN_SNDFILE=OFF"))
+         "-DDYN_SNDFILE=OFF")
      #:phases
-       (modify-phases %standard-phases
-         (add-before 'configure 'fix-referenced-paths
-           (lambda* (#:key inputs outputs #:allow-other-keys)
-             (let ((fluid-3 (assoc-ref inputs "fluid-3"))
-                   (timidity++ (assoc-ref inputs "timidity++"))
-                   (out (assoc-ref outputs "out")))
-
-               (substitute*
-                   "src/CMakeLists.txt"
+      #~(modify-phases %standard-phases
+          (add-before 'configure 'fix-file-names
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* "src/CMakeLists.txt"
                (("COMMAND /bin/sh")
                 (string-append "COMMAND " (which "sh"))))
-
              (substitute*
                  "libraries/zmusic/mididevices/music_fluidsynth_mididevice.cpp"
                (("/usr/share/sounds/sf2/FluidR3_GM.sf2")
-                  (string-append fluid-3 "/share/soundfonts/FluidR3Mono_GM.sf3")))
-
+                 (search-input-file inputs
+                                    "share/soundfonts/FluidR3Mono_GM.sf3")))
              (substitute*
                  "libraries/zmusic/mididevices/music_timiditypp_mididevice.cpp"
-                 (("exename = \"timidity\"")
-                  (string-append "exename = \"" timidity++ "/bin/timidity\"")))
-               #t))))))
+                (("(exename = \")(timidity)(\".*)" _ prefix exe suffix)
+                 (string-append prefix
+                                (search-input-file inputs
+                                                   (string-append "bin/" exe))
+                                suffix))))))))
    (build-system cmake-build-system)
-    (inputs `(("bzip2" ,bzip2)
-              ("fluid-3" ,fluid-3)
-              ("fluidsynth" ,fluidsynth)
-              ("gtk+3" ,gtk+)
-              ("libgme" ,libgme)
-              ("libjpeg" ,libjpeg-turbo)
-              ("libsndfile" ,libsndfile)
-              ("mesa" ,mesa)
-              ("mpg123" ,mpg123)
-              ("openal" ,openal)
-              ("sdl2" ,sdl2)
-              ("timidity++" ,timidity++)
-              ("zlib" ,zlib)))
+    (inputs (list bzip2
+                  fluid-3
+                  fluidsynth
+                  gtk+
+                  libgme
+                  libjpeg-turbo
+                  libsndfile
+                  mesa
+                  mpg123
+                  openal
+                  sdl2
+                  timidity++
+                  zlib))
    (native-inputs (list pkg-config unzip))
    (synopsis "Modern Doom 2 source port")
    (description "GZdoom is a port of the Doom 2 game engine, with a modern
@ -9889,11 +9961,12 @@ (define-public jstest-gtk
      (native-inputs (list pkg-config))
      (inputs (list gtkmm-3 libsigc++-2))
      (home-page "https://github.com/Grumbel/jstest-gtk/")
-      (synopsis "Simple joystick tester GUI")
+      (synopsis "Joydev Joystick Tester")
      (description "@command{jstest-gtk} is a simple joystick tester based on
-GTK.  It provides a list of attached joysticks, a way to display which buttons
-and axis are pressed, a way to remap axis and buttons and a way to calibrate
-joysticks.")
+GTK, for testing devices using the older @code{joydev} Linux joystick
+@acronym{API, Application Programming Interface}.  It provides a list of
+attached joysticks, a way to display which buttons and axis are pressed, a way
+to remap axis and buttons and a way to calibrate joysticks.")
      (license license:gpl3+))))

 (define-public jumpnbump
@ -11140,6 +11213,85 @@ (define-public xblackjack
 System\" (high-low system).")
    (license (license:x11-style "" "See file headers."))))

+(define-public xevil
+  ;; This game is old.  Use a maintained fork that builds with modern toolchains
+  ;; on modern, 64-bit hardware.
+  (let ((commit "9ca85059d5195be0eb15e107de3bb9d1b49e5f99")
+        (revision "0"))
+    (package
+      (name "xevil")
+      (version (git-version "2.02" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/lvella/xevil")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "14hsmw9ll2asnp1s0zvniyp31kjw8ynm7vnycg74lpqf28h2rric"))))
+      (build-system gnu-build-system)
+      (arguments
+       (list
+        #:modules `(,@%default-gnu-imported-modules
+                    (srfi srfi-26))
+        #:make-flags
+        #~(list "SHELL=sh"
+                "DEBUG_OPT=-g -DNDEBUG")
+        #:tests? #f                     ;no test suite
+        #:phases
+        #~(modify-phases %standard-phases
+            (add-after 'unpack 'rename-licence-file
+              (lambda _ (rename-file "gpl.txt" "COPYING")))
+            (add-after 'unpack 'redefine
+              (lambda* (#:key inputs #:allow-other-keys)
+                (substitute* "cmn/game.cpp"
+                  (("(#define VERSION ).*" _ define)
+                   (string-append define "\"" #$version "\"\n")))
+                (substitute* "cmn/utils.cpp"
+                  (("[^\"]*/(bin/uname)" _ command)
+                   (search-input-file inputs command)))
+                (substitute* "x11/ui.cpp"
+                  ;; Neither DEFAULT_BIG_FONT_NAME nor BACKUP_FONT_NAME are
+                  ;; available from most Guix X11 servers, making the game
+                  ;; unplayable by default.  Substitute the closest match.
+                  (("9x15") "6x13")
+                  ;; ‘For fast machines’ need no longer default to False in C21.
+                  (("(smoothScroll = )False" _ assign)
+                   (string-append assign "True")))))
+            (delete 'configure)         ;no configure script
+            (replace 'install
+              (lambda _
+                (with-directory-excursion "x11/REDHAT_LINUX" ;yeah
+                  (for-each (cut install-file <>
+                                 (string-append #$output "/bin"))
+                            (list "xevil" "serverping")))
+                (let ((doc (string-append #$output "/share/doc/"
+                                          #$name "-" #$version)))
+                  (mkdir-p doc)
+                  (for-each (lambda (file)
+                              (copy-recursively file
+                                                (string-append
+                                                 doc "/" (basename file))))
+                            (list "instructions" "x11/app-defaults"))))))))
+      (inputs
+       (list coreutils-minimal          ;for uname
+             libx11 libxpm))
+      ;; The current home page has been ‘subtly’ vandalised with spam and is
+      ;; missing a lot of content from this older snapshot.
+      (home-page (string-append "https://web.archive.org/web/20060410005819/"
+                                "http://www.xevil.com/"))
+      (synopsis
+       "Third-person, side-scrolling, fast-action, kill-everything game")
+      (description
+       "XEvil is a violent third-person, side-scrolling, fast-action deathmatch.
+You run around a randomly generated two-dimensional map composed of walls,
+floors, ladders, doors, and horizontal and vertical elevators.  Your only object
+is to explore this world to find weapons and items, killing everything in sight
+before they kill you.  You can fight against either computer-controlled enemies
+or against other people.")
+      (license license:gpl2+))))
+
 (define-public azimuth
  (package
    (name "azimuth")
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@ -12349,7 +12349,7 @@ (define-public gitg
                                  name "-" version ".tar.xz"))
              (sha256
               (base32
-                "0m135v2qm5kaa2jki0y2lbh0wa69bqfh9a4cm7db153v7smrj3jv"))))
+                "0c152c1vrkckqkfq3862c02fxp2scv7f7lqv6k6p35mb9ml32ail"))))
    (build-system meson-build-system)
    (arguments
     (list
--- a/gnu/packages/gnucash.scm
+++ b/gnu/packages/gnucash.scm
@ -66,14 +66,14 @@ (define-public gnucash
  ;; directory.
  (package
    (name "gnucash")
-    (version "5.8")
+    (version "5.9")
    (source
     (origin
       (method url-fetch)
       (uri (string-append "mirror://sourceforge/gnucash/gnucash%20%28stable%29/"
                           version "/gnucash-" version ".tar.bz2"))
       (sha256
-        (base32 "14r5nmml40icxbjfz4giis6kiplvjna17j1fd6c4b78bf3xj7j52"))))
+        (base32 "1l1g4acangbf4r27vsvavds0yqqa8smy4s676by68r639wvfbqjv"))))
    (outputs '("out" "doc" "debug" "python"))
    (build-system cmake-build-system)
    (arguments
@ -220,7 +220,7 @@ (define gnucash-docs
               "mirror://sourceforge/gnucash/gnucash%20%28stable%29/"
               version "/gnucash-docs-" version revision ".tar.gz"))
         (sha256
-          (base32 "0gssmbwwiafp4g9v5waz5935bkgyzbna76ryz5lhc294b3n49wxq"))))
+          (base32 "1jclya8p005dfwhkx4yqbcml631y4xngl8v08kg33d0ws4mkmi4v"))))
      (build-system cmake-build-system)
      ;; These are native-inputs because they are only required for building the
      ;; documentation.
--- a/gnu/packages/gnuzilla.scm
+++ b/gnu/packages/gnuzilla.scm
@ -533,9 +533,9 @@ (define-public all-mozilla-locales
 ;; XXXX: Workaround 'snippet' limitations.
 (define computed-origin-method (@@ (guix packages) computed-origin-method))

-(define %icecat-base-version "115.15.0")
+(define %icecat-base-version "115.16.0")
 (define %icecat-version (string-append %icecat-base-version "-guix1"))
-(define %icecat-build-id "20240903000000") ;must be of the form YYYYMMDDhhmmss
+(define %icecat-build-id "20241001000000") ;must be of the form YYYYMMDDhhmmss

 ;; 'icecat-source' is a "computed" origin that generates an IceCat tarball
 ;; from the corresponding upstream Firefox ESR tarball, using the 'makeicecat'
@ -555,12 +555,12 @@ (define icecat-source
                  "firefox-" upstream-firefox-version ".source.tar.xz"))
            (sha256
             (base32
-              "10dfzvkwb4mwz42j93zyxgjp5aryzsfja4f62hb8fqfrl0mdkzpg"))))
+              "07w0mbj65nwni692x157fjzzdqnf5lrvlghax7ja5njwsl8nczyn"))))

         ;; The upstream-icecat-base-version may be older than the
         ;; %icecat-base-version.
-         (upstream-icecat-base-version "115.15.0")
-         (gnuzilla-commit "53ca891e1aac86153b65a12af97eef9752503313")
+         (upstream-icecat-base-version "115.16.0")
+         (gnuzilla-commit "08202dd51b8c05e17238549e7922b1e02f4a0d1a")
         (gnuzilla-source
          (origin
            (method git-fetch)
@ -572,7 +572,7 @@ (define icecat-source
                                      (string-take gnuzilla-commit 8)))
            (sha256
             (base32
-              "19bsci50bhg5wi9yndxwbi4f04gsmgkq2hrccqv01cjf1ajniw6k"))))
+              "0g12inrdp5n73sl3mcdys30j52n8hcqf2rxjv68yr5jbpykb86h5"))))

         ;; 'search-patch' returns either a valid file name or #f, so wrap it
         ;; in 'assume-valid-file-name' to avoid 'local-file' warnings.
--- a/gnu/packages/golang-compression.scm
+++ b/gnu/packages/golang-compression.scm
@ -388,7 +388,7 @@ (define-public go-github-com-pierrec-lz4-v4
 (define-public go-github-com-ulikunitz-xz
  (package
    (name "go-github-com-ulikunitz-xz")
-    (version "0.5.11")
+    (version "0.5.12")
    (source
     (origin
       (method git-fetch)
@ -397,7 +397,7 @@ (define-public go-github-com-ulikunitz-xz
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "1hbs3x7s7d5ch6ipaqi265w0fwpijs0j19xdbhbjjsyr4khxbqd0"))))
+        (base32 "09n4zawzycab4mmk20sv0490xrx9ighv25g5hj578vsjgzz842n1"))))
    (build-system go-build-system)
    (arguments
     (list
--- a/gnu/packages/golang.scm
+++ b/gnu/packages/golang.scm
@ -46,6 +46,7 @@
 ;;; Copyright © 2024 Troy Figiel <troy@troyfigiel.com>
 ;;; Copyright © 2024 Greg Hogan <code@greghogan.com>
 ;;; Copyright © 2024 Brennan Vincent <brennan@umanwizard.com>
+;;; Copyright © 2024 André Batista <nandre@riseup.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -2197,7 +2198,7 @@ (define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports
 (define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird
  (package
    (name "go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird")
-    (version "0.1.0")
+    (version "0.3.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -2206,7 +2207,7 @@ (define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "0rifg5kgqp4c3b44j48fjmx00m00ai7fa4gaqrgphiqs1fc5586s"))))
+                "1bmljd81vc8b4kzmpgmx1n1vvjn5y1s2w01hjxwplmnchv9dndkl"))))
    (build-system go-build-system)
    (arguments
     `(#:unpack-path "gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"
@ -2232,6 +2233,7 @@ (define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports
           go-github-com-refraction-networking-utls
           go-gitlab-com-yawning-edwards25519-extra
           go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-goptlib
+           go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-webtunnel
           go-golang-org-x-crypto
           go-golang-org-x-net
           go-golang-org-x-text))
@ -2241,6 +2243,31 @@ (define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports
 incorporates ideas and concepts from Philipp Winter's ScrambleSuit protocol.")
    (license (list license:bsd-2 license:bsd-3))))

+(define-public go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-webtunnel
+  (let ((commit "e64b1b3562f3ab50d06141ecd513a21ec74fe8c6")
+        (revision "0"))
+    (package
+      (name "go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-webtunnel")
+      (version (git-version "0.0.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri
+          (git-reference
+           (url "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webtunnel")
+           (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "0nvd0qp1mdy7w32arnkhghxm5k2g6gy33cxlarxc6vdm4yh6v5nv"))))
+      (build-system go-build-system)
+      (arguments
+       `(#:import-path "gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webtunnel"))
+      (home-page "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/webtunnel")
+      (synopsis "Go WebTunnel Pluggable Transport")
+      (description "WebTunnel is a Go Pluggable Transport that attempts to imitate
+web browsing activities based on HTTP Upgrade (HTTPT).")
+      (license license:bsd-2))))
+
 (define-public go-github-com-sevlyar-go-daemon
  (package
    (name "go-github-com-sevlyar-go-daemon")
--- a/gnu/packages/gpodder.scm
+++ b/gnu/packages/gpodder.scm
@ -22,6 +22,7 @@
 (define-module (gnu packages gpodder)
  #:use-module (guix download)
  #:use-module (guix git-download)
+  #:use-module (guix gexp)
  #:use-module (guix packages)
  #:use-module (guix utils)
  #:use-module ((guix licenses) #:prefix license:)
@ -50,7 +51,7 @@ (define-module (gnu packages gpodder)
 (define-public gpodder
  (package
    (name "gpodder")
-    (version "3.11.1")
+    (version "3.11.4")
    (source
     (origin
       (method git-fetch)
@ -58,7 +59,7 @@ (define-public gpodder
             (url "https://github.com/gpodder/gpodder")
             (commit version)))
       (sha256
-        (base32 "121cb8qz4rp6602lpbi6m2vqx3ar1cw2s4z4r7nr5qaxb0q3gk9n"))
+        (base32 "1zmp7kkldb59fx1y6k4mkff8ngmyb9pflcd3yqb28m9wb9bp4j4h"))
       (file-name (git-file-name name version))
       (patches (search-patches "gpodder-disable-updater.patch"))))
    (build-system python-build-system)
@ -81,18 +82,17 @@ (define-public gpodder
           python-mutagen
           python-mygpoclient
           python-podcastparser
-           youtube-dl
+           yt-dlp
           xdg-utils))
    (arguments
-     '(#:phases
-       (modify-phases %standard-phases
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
          ;; Avoid needing xdg-utils as a propagated input.
          (add-after 'unpack 'patch-xdg-open
            (lambda* (#:key inputs #:allow-other-keys)
-             (let ((xdg-utils (assoc-ref inputs "xdg-utils")))
              (substitute* "src/gpodder/util.py"
-                 (("xdg-open") (string-append xdg-utils "/bin/xdg-open")))
-               #t)))
+                (("xdg-open") (search-input-file inputs "bin/xdg-open")))))
          (replace 'check
            (lambda* (#:key tests? #:allow-other-keys)
              (when tests?
@ -102,26 +102,22 @@ (define-public gpodder
          (add-before 'install 'do-not-run-msgmerge
            (lambda _
              (substitute* "makefile"
-               (("msgmerge") "true"))
-             #t))
+                (("msgmerge") "true"))))
          (add-before 'install 'make-po-files-writable
            (lambda _
              (for-each
               (lambda (f)
                 (chmod f #o664))
-               (find-files "po"))
-             #t))
+               (find-files "po"))))
          (replace 'install
-           (lambda* (#:key outputs #:allow-other-keys)
-             (setenv "PREFIX" (assoc-ref outputs "out"))
+            (lambda _
+              (setenv "PREFIX" #$output)
              (invoke "make" "install")))
          (add-after 'install 'wrap-gpodder
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out"))
-                   (gi-typelib-path (getenv "GI_TYPELIB_PATH")))
-               (wrap-program (string-append out "/bin/gpodder")
-                 `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))
-               #t))))))
+            (lambda _
+              (let ((gi-typelib-path (getenv "GI_TYPELIB_PATH")))
+                (wrap-program (string-append #$output "/bin/gpodder")
+                  `("GI_TYPELIB_PATH" ":" prefix (,gi-typelib-path)))))))))
    (home-page "https://gpodder.github.io")
    (synopsis "Simple podcast client")
    (description "gPodder is a podcatcher, i.e. an application that allows
@ -147,9 +143,9 @@ (define-public libmygpo-qt
    (native-inputs
     (list pkg-config))
    (inputs
-     `(("qt" ,qtbase-5)))
+     (list qtbase-5))
    (arguments
-     `(#:configure-flags '("-DMYGPO_BUILD_TESTS=ON")
+     '(#:configure-flags '("-DMYGPO_BUILD_TESTS=ON")
       ;; TODO: Enable tests when https://github.com/gpodder/gpodder/issues/446
       ;; is fixed.
       #:tests? #f))
@ -163,19 +159,19 @@ (define-public libmygpo-qt
 (define-public python-mygpoclient
  (package
    (name "python-mygpoclient")
-    (version "1.8")
+    (version "1.9")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "mygpoclient" version))
       (sha256
        (base32
-         "1fi5x6k1mngr0iviw2s4n1f3y2x7pwqy5ivkcrjdprzvwr37f0mh"))))
+         "05hmjdb73m7vl6lzvh58bnliy4227pv8hprwfka0bg19cnvgpyf5"))))
    (build-system python-build-system)
    (native-inputs
-     (list python-coverage python-minimock python-nose))
+     (list python-coverage python-minimock python-nose python-pytest))
    (arguments
-     `(#:phases
+     '(#:phases
       (modify-phases %standard-phases
         (replace 'check
           (lambda _
@ -191,13 +187,13 @@ (define-public python-mygpoclient
 (define-public python-podcastparser
  (package
    (name "python-podcastparser")
-    (version "0.6.6")
+    (version "0.6.10")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "podcastparser" version))
       (sha256
-        (base32 "0m24r2qhck0win44xfhxajbppkss4ha6am0042s0xyq3408883m3"))))
+        (base32 "1mqkkxz928y430xx3mgw9dj78ilkgv9hjdha1hizbks6mmhcp6ib"))))
    (native-inputs
     (list python-pytest))
    (arguments
--- a/gnu/packages/graphics.scm
+++ b/gnu/packages/graphics.scm
@ -964,7 +964,8 @@ (define-public lib2geom
                        (("self-intersections-test") ""))))))
              ;; See https://gitlab.com/inkscape/lib2geom/-/issues/63
              ((or (target-aarch64?)
-                   (target-riscv64?))
+                   (target-riscv64?)
+                   (target-ppc64le?))
               #~((add-after 'unpack 'fix-aarch64-faulty-test
                    (lambda _
                      (substitute* "tests/CMakeLists.txt"
@ -2223,7 +2224,8 @@ (define skia.pc (string-append #$output
 Libs: -L${libdir} -lskia
 Cflags: -I${includedir}~%" #$output #$version)))))
            (replace 'check
-              (lambda* (#:key inputs native-inputs #:allow-other-keys)
+              (lambda* (#:key tests? inputs native-inputs #:allow-other-keys)
+                (if tests?
                  (let ((icu #$(this-package-native-input "icu4c-for-skia")))
                    ;; Unbundle SPIRV-Tools dependency.
                    (substitute* "BUILD.gn"
@ -2352,7 +2354,8 @@ (define skia.pc (string-append #$output
                            "8888" "lottie" "_" "_"
                            "gl" "skp" "_" "_"
                            "gl" "lottie" "_" "_"
-                          "_" "_" "_" "ES2BlendWithNoTexture")))))))
+                            "_" "_" "_" "ES2BlendWithNoTexture"))
+                  (format #t "test suite not run~%")))))))
  (native-inputs (list gn libjpeg-turbo ninja pkg-config python-wrapper
                       spirv-tools spirv-headers
                       icu4c-for-skia glu xorg-server-for-tests))
--- a/gnu/packages/instrumentation.scm
+++ b/gnu/packages/instrumentation.scm
@ -222,23 +222,8 @@ (define-public dyninst
       ;; source.
       #:configure-flags
       (list "-DSTERILE_BUILD=ON")
-       ;; NOTE: dyninst needs to search for shared libraries that are linked
-       ;; against the instrumented binary in order to rebuild the entire
-       ;; program.  For this purpose, one can use LD_LIBRARY_PATH or
-       ;; DYNISNT_REWRITER_PATHS environment variables to add paths for dyinst
-       ;; to search.  However, dyninst also tries to be smart by executing
-       ;; ldconfig, which is not portable.  If ldconfig is not available on
-       ;; the system, dyinst wrongly assumes that the shared libraries can not
-       ;; be found, even though it can.  This bad logic is still there with
-       ;; newer versions of dyinst.  Thus, this substitution makes the bad
-       ;; code path unreachable.
       #:phases
       (modify-phases %standard-phases
-         (add-after 'unpack 'patch-bad-logic
-           (lambda _
-             (substitute* "dyninstAPI/src/linux.C"
-               (("if\\(fgets\\(buffer, buffer_size, ldconfig\\)\\)")
-                "fgets(buffer, buffer_size, ldconfig); if (true)"))))
         (add-after 'unpack 'adjust-supported-platform-name
           (lambda _
             ;; That file checks for "i386" but
@ -363,14 +348,14 @@ (define-public libpatch
 (define-public lttng-modules
  (package
    (name "lttng-modules")
-    (version "2.13.10")
+    (version "2.13.14")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://lttng.org/files/lttng-modules/"
                                  "lttng-modules-" version ".tar.bz2"))
              (sha256
               (base32
-                "19xh8nm19vx6c2i1adqpa8q2xsvxn59qxa6z186iywbhr0dgpaqk"))))
+                "19jx1yz1hsbr4vwfp2nr6z52a5g50iimaak962k49diay5zryi66"))))
    (build-system linux-module-build-system)
    (arguments
     `(#:tests? #f ; no tests
@ -387,14 +372,14 @@ (define-public lttng-modules
 (define-public lttng-ust
  (package
    (name "lttng-ust")
-    (version "2.13.6")
+    (version "2.13.8")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://lttng.org/files/lttng-ust/"
                                  "lttng-ust-" version ".tar.bz2"))
              (sha256
               (base32
-                "1mffy0fmr8h8kfghjadxa7nhzfwxjh7h1k97kslpmb3kvnb4bq77"))))
+                "0dyr4j8f8y6fmfpxb3ajkc1ndwpl1baxzbyc4ksx8ym3p7d9ivyl"))))
    (build-system gnu-build-system)
    (inputs
     (list numactl))
@ -413,14 +398,14 @@ (define-public lttng-ust
 (define-public lttng-tools
  (package
    (name "lttng-tools")
-    (version "2.13.9")
+    (version "2.13.14")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://lttng.org/files/lttng-tools/"
                                  "lttng-tools-" version ".tar.bz2"))
              (sha256
               (base32
-                "0dzk13d0hdzll8hk9qmj5lipmfa2h8zkl801dchp1kq8nsaxr54d"))))
+                "1jxdwm0a3z70jrx6yg57x5cswi7ycgyazng41rkgxnq7mp2gggak"))))
    (build-system gnu-build-system)
    (arguments
     `(#:configure-flags '("--enable-python-bindings")
--- a/gnu/packages/iso-codes.scm
+++ b/gnu/packages/iso-codes.scm
@ -2,6 +2,7 @@
 ;;; Copyright © 2013 Cyril Roelandt <tipecaml@gmail.com>
 ;;; Copyright © 2016, 2019 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2018, 2022 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2024 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -25,9 +26,13 @@ (define-module (gnu packages iso-codes)
  #:use-module (guix git-download)
  #:use-module (guix build-system gnu)
  #:use-module (guix build-system python)
+  #:use-module (guix build-system pyproject)
+  #:use-module (gnu packages check)
  #:use-module (gnu packages gettext)
  #:use-module (gnu packages perl)
-  #:use-module (gnu packages python))
+  #:use-module (gnu packages python)
+  #:use-module (gnu packages python-build)
+  #:use-module (gnu packages python-science))

 (define-public iso-codes/official
  ;; This package variant is intended for ‘external’ use, such as users running
@ -101,6 +106,45 @@ (define-public iso-codes
               (base32
                "0a77b9aid68vakhsa3l3lx2jav5q9fp7vn50mwmzkr2lkr2l4k41"))))))

+(define-public python-country-converter
+  (package
+    (name "python-country-converter")
+    (version "1.2")
+    (source
+     (origin
+       (method git-fetch) ;no test data in PyPI archive
+       (uri (git-reference
+             (url "https://github.com/IndEcol/country_converter")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0i1nlbahfwgx1f5q4ib32539xmc694834s0flzp0wlki0hwzd4rd"))))
+    (build-system pyproject-build-system)
+    (native-inputs
+     (list python-pytest
+           python-setuptools))
+    (propagated-inputs
+     (list python-pandas))
+    (home-page "https://github.com/IndEcol/country_converter")
+    (synopsis "Auto conversion from different country name standards")
+    (description
+     "The country converter (coco) automates the conversion from different
+standards and version of country names.  Internally, coco is based on a table
+specifying the different ISO and UN standards per country together with the
+official name and a regular expression which aim to match all English versions
+of a specific country name.  In addition, coco includes classification based
+on UN-, EU-, OECD-membership, UN regions specifications, continents and
+various MRIO and IAM databases.
+
+Supported classification schemas: APEC, BASIC, BRIC, CC41, CIS, Cecilia 2050
+classification, DACcode, EEA membership, EU membership, EXIOBASE 1
+classification, EXIOBASE 2 classification, EXIOBASE 3 classification, Eora,
+FAOcode, G20, G7, GBDcode, GWcode, IEA, IMAGE, IOC ISO 3166-1 alpha-2, ISO
+3166-1 alpha-3, ISO 3166-1 numeric, MESSAGE 11-region classification, OECD
+membership, REMIND, Schengen region, UN membership, UN numeric code, UN
+region, WIOD classification, ccTLD.")
+    (license license:gpl3)))
+
 (define-public python-iso639
  (package
    (name "python-iso639")
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@ -212,7 +212,7 @@ (define rust-librewolf rust) ; 1.75 is the default in Guix, 1.65 is the minimum.
 ;; Update this id with every update to its release date.
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
-(define %librewolf-build-id "20240922110507")
+(define %librewolf-build-id "20241005085731")

 (define-public librewolf
  (package
@ -223,9 +223,7 @@ (define-public librewolf
      (inherit (make-librewolf-source
                #:version version
                #:firefox-hash "0w4z3fq5zhm63a0wmhvmqrj263bvy962dir25q3z0x5hx6hjawh2"
-                #:librewolf-hash "0f80pihn375bdjhjmmg2v1w96wpn76zb60ycy39wafwh1dnzybrd"))
-      (patches
-       (search-patches "librewolf-add-paths-to-rdd-allowlist.patch"))))
+                #:librewolf-hash "0f80pihn375bdjhjmmg2v1w96wpn76zb60ycy39wafwh1dnzybrd"))))
    (build-system gnu-build-system)
    (arguments
     (list
@ -324,9 +322,6 @@ (define (write-setting key value)
                            libavcodec)))))
                   (add-after 'unpack 'neuter-genai
                     (lambda* _
-                       ;; Don't compile the code in.
-                       (substitute* "browser/components/moz.build"
-                         (("\"genai\",") ""))
                       ;; Lock the preferences so they can't be enabled.
                       (substitute* "lw/librewolf.cfg"
                         (("defaultPref\\(\"browser\\.ml\\.")
@ -595,12 +590,26 @@ (define (runpaths-of-input label)
                                       ;; For U2F and WebAuthn
                                       "eudev")))

+                              ;; VA-API is run in the RDD (Remote Data Decoder) sandbox
+                              ;; and must be explicitly given access to files it needs.
+                              ;; Rather than adding the whole store (as Nix had
+                              ;; upstream do, see
+                              ;; <https://github.com/NixOS/nixpkgs/pull/165964> and
+                              ;; linked upstream patches), we can just follow the
+                              ;; runpaths of the needed libraries to add everything to
+                              ;; LD_LIBRARY_PATH.  These will then be accessible in the
+                              ;; RDD sandbox.
+                              (rdd-whitelist (map (cut string-append <> "/")
+                                                  (delete-duplicates (append-map
+                                                                      runpaths-of-input
+                                                                      '("mesa"
+                                                                        "ffmpeg")))))
                              (gtk-share (string-append (assoc-ref inputs
                                                                   "gtk+")
                                                        "/share")))
                         (wrap-program (car (find-files lib "^librewolf$"))
                           `("LD_LIBRARY_PATH" prefix
-                             ,libs)
+                             (,@libs ,@rdd-whitelist))
                           `("XDG_DATA_DIRS" prefix
                             (,gtk-share))
                           `("MOZ_LEGACY_PROFILES" =
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@ -7384,7 +7384,7 @@ (define-public hotspot
    (home-page "https://github.com/KDAB/hotspot")
    (synopsis "Performance analysis GUI for Linux perf")
    (description "Hotspot is a standalone GUI for performance data analysis.
-It aims to be similar to KCachegrind, but for data collected with the
+It aims to be similar to KCachegrind, but for data collected with
@command{perf}, a profiler for use with the kernel Linux.  Its main feature is
 graphically visualizing a @file{perf.data} file.")
    (license (list license:gpl2+ license:gpl3+)))) ;dual licensed
--- a/gnu/packages/lisp-xyz.scm
+++ b/gnu/packages/lisp-xyz.scm
@ -4152,8 +4152,8 @@ (define-public ecl-cl-async-future
  (sbcl-package->ecl-package sbcl-cl-async-future))

 (define libasyncprocess
-  (let ((commit "9690530fc92b59636d9f17d821afa7697e7c8ca4")
-        (revision "0"))
+  (let ((commit "8067007e283745b94a36a51320b41b65ac296e24")
+        (revision "1"))
    (package
      (name "libasyncprocess")
      (version (git-version "0.0.1" revision commit))
@ -4165,7 +4165,7 @@ (define libasyncprocess
               (commit commit)))
         (file-name (git-file-name name version))
         (sha256
-          (base32 "1m2sfgfg6c0gqqy1pqsahsiw3j25y473mfw7sx0akkqbhwhm7mjb"))
+          (base32 "0691z0vs5c65m24p1yi12iy27j59layzvzyy1yl19704x05442qh"))
         (modules '((guix build utils)))
         (snippet
          ;; Delete precompiled artifacts.
@ -4258,6 +4258,50 @@ (define-public cl-autowrap
 (define-public ecl-cl-autowrap
  (sbcl-package->ecl-package sbcl-cl-autowrap))

+(define-public sbcl-cl-base16
+  (let ((commit "ae4b7f416c0c91f6323e901be912c0f7378fe3da")
+        (revision "0"))
+    (package
+      (name "sbcl-cl-base16")
+      (version (git-version "0.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/tpine/cl-base16")
+               (commit commit)))
+         (file-name (git-file-name name version))
+         (sha256
+          (base32 "0m7ndmk4xhizn3q3ywjvw8sg4pfgp6lrd0wac5d1bf7wbw6afh5q"))))
+      (build-system asdf-build-system/sbcl)
+      (arguments
+       (list
+        #:phases
+        #~(modify-phases %standard-phases
+            (add-after 'unpack 'patch-git-executable
+              (lambda* (#:key inputs #:allow-other-keys)
+                (substitute* "builder.lisp"
+                  (("\"git")
+                   (string-append "\"" (search-input-file inputs
+                                                          "/bin/git")))))))))
+      (inputs
+       (list git
+             sbcl-cl-yaml
+             sbcl-cl-mustache
+             sbcl-cl-slug
+             sbcl-trivial-shell))
+      (synopsis "Common Lisp base 16 implementation")
+      (description
+       "This package provides an implementation of a base 16 builder for Common Lisp.")
+      (home-page "https://github.com/tpine/cl-base16")
+      (license license:gpl3+))))
+
+(define-public cl-base16
+  (sbcl-package->cl-source-package sbcl-cl-base16))
+
+(define-public ecl-cl-base16
+  (sbcl-package->ecl-package sbcl-cl-base16))
+
 (define-public sbcl-cl-base32
  (let ((commit "8cdee06fab397f7b0a19583b57e7f0c98405be85")
        (revision "1"))
@ -9558,7 +9602,7 @@ (define-public ecl-cl-store
 (define-public sbcl-cl-str
  (package
    (name "sbcl-cl-str")
-    (version "0.19")
+    (version "0.21")
    (home-page "https://github.com/vindarel/cl-str")
    (source (origin
              (method git-fetch)
@ -9566,7 +9610,7 @@ (define-public sbcl-cl-str
                    (url home-page)
                    (commit version)))
              (sha256
-               (base32 "1jyza2jhn7w6fl4w87pv0m87z5ia48m6dqw12k0mdh7l3mgjq839"))
+               (base32 "0r9niyvkj7jyc93rxys6pgqazzpl1ybfryjn8jig721xhjxrsblm"))
              (file-name (git-file-name name version))))
    (build-system asdf-build-system/sbcl)
    (inputs
@ -18625,8 +18669,8 @@ (define-public ecl-json-streams
  (sbcl-package->ecl-package sbcl-json-streams))

 (define-public sbcl-jsonrpc
-  (let ((commit "4abbd305bae7827ad39048f956887db11505ad50")
-        (revision "0"))
+  (let ((commit "a43dd933838bb9596a2bf40e821af0bafd3d5356")
+        (revision "1"))
    (package
      (name "sbcl-jsonrpc")
      (version (git-version "0.3.2" revision commit))
@ -18638,7 +18682,7 @@ (define-public sbcl-jsonrpc
               (commit commit)))
         (file-name (git-file-name "jsonrpc" version))
         (sha256
-          (base32 "08fz50wmbjic9m31av1fq4a3v5ahry58c8z2bmn3ib52k6nnjrk2"))))
+          (base32 "1wsc6bv8xpzad0lgrlldzrpb9r4aksnw7ss2ifwa7ykbzfxcr8gi"))))
      (build-system asdf-build-system/sbcl)
      (native-inputs (list sbcl-rove))
      (inputs (list sbcl-clack
@ -19677,6 +19721,40 @@ (define-public cl-listopia
 (define-public ecl-listopia
  (sbcl-package->ecl-package sbcl-listopia))

+(define-public sbcl-literate-lisp
+  (let ((commit "76d4d2c16ab08296d58e0ef3c41861b615e697c0")
+        (revision "1"))
+    (package
+      (name "sbcl-literate-lisp")
+      (version (git-version "0.6" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/jingtaozf/literate-lisp")
+               (commit commit)))
+         (file-name (git-file-name "cl-literate-lisp" version))
+         (sha256
+          (base32 "0smxf0a62dnwcfxsbsdkx4n5nqx9dlxdz6c2vfivxpqld6d6ap02"))))
+      (build-system asdf-build-system/sbcl)
+      (inputs
+       (list sbcl-cl-fad
+             sbcl-cl-ppcre
+             sbcl-iterate))
+      (native-inputs
+       (list sbcl-fiveam))
+      (home-page "https://github.com/jingtaozf/literate-lisp")
+      (synopsis "Load Common Lisp code blocks from Org-mode files")
+      (description "This package extends the Common Lisp reader
+syntax such that is accepts Org files as Lisp source code files.")
+      (license license:expat))))
+
+(define-public cl-literate-lisp
+  (sbcl-package->cl-source-package sbcl-literate-lisp))
+
+(define-public ecl-literate-lisp
+  (sbcl-package->ecl-package sbcl-literate-lisp))
+
 (define-public sbcl-livesupport
  (let ((commit "71e6e412df9f3759ad8378fabb203913d82e228a")
 	(revision "1"))
@ -25916,6 +25994,38 @@ (define-public cl-s-base64
 (define-public ecl-s-base64
  (sbcl-package->ecl-package sbcl-s-base64))

+(define-public sbcl-s-graphviz
+  (let ((commit "a06d9573f0d4e21751b0ae782515b63a40ad6eae")
+        (revision "1"))
+    (package
+      (name "sbcl-s-graphviz")
+      (version (git-version "2.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/jingtaozf/s-graphviz")
+               (commit commit)))
+         (file-name (git-file-name "cl-s-graphviz" version))
+         (sha256
+          (base32 "1841xwci6y1gfhg15464wrlnw8xgsh1mwbg4yy2y7di02q4fbma2"))))
+      (build-system asdf-build-system/sbcl)
+      (inputs
+       (list sbcl-iterate))
+      (native-inputs
+       (list sbcl-literate-lisp))
+      (home-page "https://github.com/jingtaozf/s-graphviz")
+      (synopsis "S-expression representation of the GraphViz DOT language")
+      (description "This package creates GraphViz DOT files from
+an equivalent s-expression representation.")
+      (license license:expat))))
+
+(define-public cl-s-graphviz
+  (sbcl-package->cl-source-package sbcl-s-graphviz))
+
+(define-public ecl-s-graphviz
+  (sbcl-package->ecl-package sbcl-s-graphviz))
+
 (define-public sbcl-s-sysdeps
  ;; No release since 2013.
  (let ((commit "7f8de283b7fbd8b038fdf08493063a736db36ce7")
@ -27373,8 +27483,8 @@ (define-public ecl-slot-extra-options
  (sbcl-package->ecl-package sbcl-slot-extra-options))

 (define-public sbcl-micros
-  (let ((commit "9fc7f1e5b0dbf1b9218a3f0aca7ed46e90aa86fd")
-        (revision "0"))
+  (let ((commit "af94fe5d6688f67a092f604765fb706ebae44e99")
+        (revision "1"))
    (package
      (name "sbcl-micros")
      (version (git-version "0.0.0" revision commit))
@ -27385,7 +27495,7 @@ (define-public sbcl-micros
               (url "https://github.com/lem-project/micros")
               (commit commit)))
         (sha256
-          (base32 "1p0s7a723w56vcgrbc7hgmkhnmjcb8nmc59im2wx9inm1la6mcbc"))
+          (base32 "1xn85zif10qkwnw4a1s584whnyvmjwn5sik949v1pwxykhq96qjy"))
         (file-name (git-file-name "micros" version))))
      (build-system asdf-build-system/sbcl)
      (native-inputs (list sbcl-rove))
--- a/gnu/packages/llvm.scm
+++ b/gnu/packages/llvm.scm
@ -67,6 +67,7 @@ (define-module (gnu packages llvm)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages libedit)
  #:use-module (gnu packages libffi)
+  #:use-module (gnu packages linux)
  #:use-module (gnu packages llvm-meta)
  #:use-module (gnu packages lua)
  #:use-module (gnu packages mpi)
@ -86,6 +87,11 @@ (define-module (gnu packages llvm)
  #:export (make-lld-wrapper
            system->llvm-target))

+;; Lazily resolve the gcc-toolchain to avoid a circular dependency.
+(define gcc-toolchain*
+  (delay (module-ref (resolve-interface '(gnu packages commencement))
+                     'gcc-toolchain)))
+
 (define* (system->llvm-target #:optional
                              (system (or (and=> (%current-target-system)
                                                 gnu-triplet->nix-system)
@ -2281,15 +2287,15 @@ (define-public llvm-julia
    (properties `((hidden? . #t)
                  ,@(package-properties llvm-13)))))

+(define llvm-cling-base llvm-16)
+
 (define llvm-cling
-  ;; To determine which version of LLVM a given release of Cling should use,
-  ;; consult the
-  ;; https://raw.githubusercontent.com/root-project/cling/master/LastKnownGoodLLVMSVNRevision.txt
-  ;; file.
-  (let ((base llvm-15))                 ;for a DYLIB build
+  (let ((base llvm-cling-base))
    (package/inherit base
      (name "llvm-cling")
-      (version "13-20240318-01")
+      ;; Use the latest tag for the major LLVM version currently targeted by
+      ;; Cling (often mentioned in Cling's release notes).
+      (version "16-20240621-02")
      (source
       (origin
         (inherit (package-source base))
@ -2300,14 +2306,17 @@ (define llvm-cling
         (file-name (git-file-name "llvm-cling" version))
         (sha256
          (base32
-           "1zh6yp8px9hla7v9i67a6anbph140f8ixxbsz65aj7fizksjs1h3"))
-         (patches (search-patches
-                   "clang-cling-13-libc-search-path.patch"
-                   "clang-cling-runtime-13-glibc-2.36-compat.patch"
-                   "clang-cling-13-remove-crypt-interceptors.patch")))))))
+           "05libb4mc385n8sq0bilalvidwzzrcyiqsfkn7j179kkx66a8rzy"))))
+      (arguments
+       ;; This reduces the package size on disk from 547 MiB to 311 MiB.
+       ;; Cling is intended to be used as a REPL on the host machine, not as a
+       ;; cross-compiling toolchain.
+       (substitute-keyword-arguments (package-arguments base)
+         ((#:configure-flags cf ''())
+          #~(cons* "-DLLVM_TARGETS_TO_BUILD=host;NVPTX" #$cf)))))))

 (define clang-cling-runtime
-  (let ((base clang-runtime-13))
+  (let ((base clang-runtime-16))
    (package/inherit base
      (name "clang-cling-runtime")
      (version (package-version llvm-cling))
@ -2316,9 +2325,6 @@ (define clang-cling-runtime
       (substitute-keyword-arguments (package-arguments base)
         ((#:phases phases '%standard-phases)
          #~(modify-phases #$phases
-              (add-after 'unpack 'change-directory
-                (lambda _
-                  (chdir "compiler-rt")))
              (add-after 'install 'delete-static-libraries
                ;; This reduces the size from 22 MiB to 4 MiB.
                (lambda _
@ -2327,22 +2333,11 @@ (define clang-cling-runtime
                (replace "llvm" llvm-cling))))))

 (define clang-cling
-  (let ((base clang-13))
+  (let ((base clang-16))
    (package/inherit base
      (name "clang-cling")
      (version (package-version llvm-cling))
      (source (package-source llvm-cling))
-      (arguments
-       (substitute-keyword-arguments (package-arguments base)
-         ((#:phases phases '%standard-phases)
-          #~(modify-phases #$phases
-              (add-after 'unpack 'change-directory
-                (lambda _
-                  (chdir "clang")))
-              (add-after 'install 'delete-static-libraries
-                ;; This reduces the size by half, from 220 MiB to 112 MiB.
-                (lambda _
-                  (for-each delete-file (find-files #$output "\\.a$"))))))))
      (propagated-inputs
       (modify-inputs (package-propagated-inputs base)
         (replace "llvm" llvm-cling)
@ -2351,7 +2346,7 @@ (define clang-cling
 (define-public cling
  (package
    (name "cling")
-    (version "1.0")
+    (version "1.1")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -2360,15 +2355,14 @@ (define-public cling
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "17n66wf5yg1xjc94d6yb8g2gydjz0b8cj4a2pn6xrygdvhh09vv1"))
-              ;; Patch submitted upstream here:
-              ;; https://github.com/root-project/cling/pull/433.
-              (patches (search-patches "cling-use-shared-library.patch"))))
+                "13ghbqjppvbmkhjgfk9xggxh17xpmx18ghdqgkkg9a3mh19hf69h"))))
    (build-system cmake-build-system)
    (arguments
     (list
      #:build-type "Release"            ;keep the build as lean as possible
-      #:tests? #f                       ;FIXME: 78 tests fail (out of ~200)
+      ;; FIXME: 79 tests fail, out of ~200 (see:
+      ;; https://github.com/root-project/cling/issues/534)
+      #:tests? #f
      #:test-target "check-cling"
      #:configure-flags
      #~(list (string-append "-DCLING_CXX_PATH="
@ -2390,12 +2384,6 @@ (define-public cling
              (substitute* "lib/Interpreter/CIFactory.cpp"
                (("\\bsed\\b")
                 (which "sed"))
-                ;; This ensures that the default C++ library used by Cling is
-                ;; that of the compiler that was used to build it, rather
-                ;; than that of whatever g++ happens to be on PATH.
-                (("ReadCompilerIncludePaths\\(CLING_CXX_RLTV")
-                 (format #f "ReadCompilerIncludePaths(~s"
-                         (search-input-file inputs "bin/g++")))
                ;; Cling uses libclang's CompilerInvocation::GetResourcesPath
                ;; to resolve Clang's library prefix, but this fails on Guix
                ;; because it is relative to the output of cling rather than
@ -2411,7 +2399,7 @@ (define-public cling
                                #$(first
                                   (take (string-split
                                          (package-version clang-cling) #\-)
-                                         1)) ".0.0" ;e.g. 13.0.0
+                                         1)) ;e.g. 16.0.6 -> 16
                                "\");")))
              ;; Check for the 'lit' command for the tests, not 'lit.py'
              ;; (see: https://github.com/root-project/cling/issues/432).
@ -2424,12 +2412,37 @@ (define-public cling
              (substitute* "test/lit.cfg"
                (("config.llvm_tools_dir \\+ '")
                 "config.cling_obj_root + '/bin"))))
+          (add-before 'check 'set-CLANG
+            (lambda* (#:key native-inputs inputs #:allow-other-keys)
+              ;; Otherwise, lit fails with "fatal: couldn't find 'clang'
+              ;; program, try setting CLANG in your environment".
+              (setenv "CLANG" (search-input-file (or native-inputs inputs)
+                                                 "bin/clang"))))
          (add-after 'install 'delete-static-libraries
            ;; This reduces the size from 17 MiB to 5.4 MiB.
            (lambda _
-              (for-each delete-file (find-files #$output "\\.a$")))))))
-    (native-inputs (list python python-lit))
-    (inputs (list clang-cling llvm-cling libxcrypt))
+              (for-each delete-file (find-files #$output "\\.a$"))))
+          (add-after 'install 'wrap-with-include-paths
+            ;; Cling is sensitive to miss-matched include directives; ensure
+            ;; the GCC includes used match that of the GCC used to build
+            ;; Cling.
+            (lambda* (#:key inputs #:allow-other-keys)
+              (let ((gcc-toolchain #$(this-package-input "gcc-toolchain")))
+                (wrap-program (string-append #$output "/bin/cling")
+                  `("C_INCLUDE_PATH" prefix
+                   (,(string-append gcc-toolchain "/include")))
+                  `("CPLUS_INCLUDE_PATH" prefix
+                    (,(string-append gcc-toolchain "/include/c++")
+                     ,(string-append gcc-toolchain "/include")))))))
+          (add-after 'wrap-with-include-paths 'fix-wrapper
+            (lambda _
+              ;; When -a $0 is used, the cling executable segfauts (see:
+              ;; https://issues.guix.gnu.org/73405).
+              (substitute* (string-append #$output "/bin/cling")
+                (("\"\\$0\"")
+                 "\"${0##*/}\"")))))))
+    (native-inputs (list clang-cling python python-lit))
+    (inputs (list clang-cling (force gcc-toolchain*) llvm-cling libxcrypt))
    (home-page "https://root.cern/cling/")
    (synopsis "Interactive C++ interpreter")
    (description "Cling is an interactive C++17 standard compliant
--- a/gnu/packages/lsof.scm
+++ b/gnu/packages/lsof.scm
@ -25,80 +25,56 @@ (define-module (gnu packages lsof)
  #:use-module (guix packages)
  #:use-module (guix git-download)
  #:use-module (guix build-system gnu)
+  #:use-module (guix gexp)
  #:use-module (guix utils)
  #:use-module (gnu packages)
+  #:use-module (gnu packages autotools)
  #:use-module (gnu packages groff)
-  #:use-module (gnu packages perl))
+  #:use-module (gnu packages perl)
+  #:use-module (gnu packages pkg-config)
+  #:use-module (gnu packages linux))

 (define-public lsof
  (package
    (name "lsof")
-    (version "4.94.0")
-    (source
-     (origin
+    (version "4.99.3")
+    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/lsof-org/lsof")
                    (commit version)))
              (file-name (git-file-name name version))
              (sha256
-        (base32 "0yxv2jg6rnzys49lyrz9yjb4knamah4xvlqj596y6ix3vm4k3chp"))
-       (patches (search-patches "lsof-fatal-test-failures.patch"))))
+               (base32
+                "1v32407al4j0hhcph95lv4xvr9h012lii29iyq41iwj39zwfavax"))))
    (build-system gnu-build-system)
-    (native-inputs
-     (list groff ; for soelim
-           perl))
+    (native-inputs (list automake
+                         autoconf
+                         groff ;for soelim
+                         libtool
+                         perl
+                         pkg-config
+                         procps ;for ps
+                         util-linux)) ;for unshare
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
-         (replace 'configure
+     (list #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'unpack 'fix-configure-ac-version
+                 ;; see https://github.com/lsof-org/lsof/commit/932a0b3b1992497e23fd9b8d31116b9ca9b0f98d
+                 ;; to fix tests/case-01-version.bash test fail.
                 (lambda _
-             (setenv "LSOF_CC" ,(cc-for-target))
-             ,@(if (%current-target-system)
-                   '((setenv "LINUX_CONF_CC" "gcc"))
-                   '())
-             (setenv "LSOF_MAKE" "make")
-
-             ;; By default, the makefile captures the output of 'uname -a'.
-             ;; Provide a fixed output instead to make builds reproducible.
-             (setenv "LSOF_SYSINFO"
-                     (string-append "GNU/" (utsname:sysname (uname))
-                                    " (GNU Guix)"))
-
-             (invoke "./Configure" "linux")))
-         (add-after 'configure 'patch-timestamps
+                   (substitute* "configure.ac"
+                     (("4\\.99\\.0")
+                      "4.99.3"))))
+               (add-before 'bootstrap 'disable-failing-tests
                 (lambda _
-             (substitute* "Makefile"
-               (("`date`") "`date --date=@1`"))))
-         (add-after 'build 'build-man-page
-           (lambda _
-             (with-output-to-file "lsof.8"
-               (lambda _ (invoke "soelim" "Lsof.8")))))
-         (add-before 'check 'disable-failing-tests
-           (lambda _
-             (substitute* "tests/Makefile"
+                   (substitute* "Makefile.am"
                     ;; Fails with ‘ERROR!!! client gethostbyaddr() failure’.
-               (("(STDTST=.*) LTsock" _ prefix) prefix)
-               ;; LTnfs fails without access to a remote NFS server, and LTlock
-               ;; fails when run on a Btrfs file system (see:
-               ;; https://github.com/lsof-org/lsof/issues/152).
-               (("OPTTST=[[:space:]]*LTbigf LTdnlc LTlock LTnfs")
-                "OPTTST = LTbigf LTdnlc"))))
-         (replace 'check
-           (lambda* (#:key tests? #:allow-other-keys)
-             (when tests?
-               (with-directory-excursion "tests"
-                 ;; Tests refuse to run on ‘unvalidated’ platforms.
-                 (make-file-writable "TestDB")
-                 (invoke "./Add2TestDB")
-
-                 ;; The ‘standard’ tests suggest running ‘optional’ ones as well.
-                 (invoke "make" "standard" "optional")))))
-         (replace 'install
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out")))
-               (install-file "lsof" (string-append out "/bin"))
-               (install-file "lsof.8" (string-append out "/share/man/man8"))))))))
+                     (("(TESTS \\+=.*) tests/LTsock" _ prefix)
+                      prefix)
+                     ;; Fails because /proc not mounted in sandbox
+                     (("\tdialects/linux/tests/case-20-epoll.bash \\\\")
+                      "\\")))))))
    (synopsis "Display information about open files")
    (description
     "Lsof stands for LiSt Open Files, and it does just that.
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@ -2303,20 +2303,20 @@ (define-public netcdf
    (native-inputs
     (list m4 doxygen graphviz))
    (inputs
-     `(("curl" ,curl)
-       ("hdf4" ,hdf4-alt)
-       ("hdf5" ,hdf5)
-       ("libjpeg" ,libjpeg-turbo)
-       ("libxml2" ,libxml2)
-       ("unzip" ,unzip)
-       ("zlib" ,zlib)))
+     (list curl
+           hdf4-alt
+           hdf5
+           libjpeg-turbo
+           libxml2
+           unzip
+           zlib))
    (arguments
-     `(#:configure-flags '("--enable-doxygen"
-                           "--enable-dot"
-                           "--enable-hdf4"
-                           "--disable-dap-remote-tests")
+     (list #:configure-flags
+           #~'("--enable-doxygen" "--enable-dot"
+               "--enable-hdf4" "--disable-dap-remote-tests")

-       #:phases (modify-phases %standard-phases
+           #:phases
+           #~(modify-phases %standard-phases
               (add-before 'configure 'fix-source-date
                 (lambda _
                   ;; As we ${SOURCE_DATE_EPOCH} evaluates to "1" in the build
@ -2334,7 +2334,8 @@ (define-public netcdf
                   ;; store items.
                   (substitute* "libnetcdf.settings"
                     (("(/gnu/store/)([0-9A-Za-z]*)" all prefix hash)
-                (string-append prefix (string-take hash 10) "...")))))
+                      (string-append prefix
+                                     (string-take hash 10) "...")))))
               (add-before 'check 'fix-test-rcmerge
                 (lambda _
                   ;; Set HOME, to fix the test-rcmerge test.
@ -2350,26 +2351,61 @@ (define-public netcdf
 sharing of scientific data.")
    (license (license:x11-style "file://COPYRIGHT"))))

+(define-public pnetcdf
+  (package
+    (name "pnetcdf")
+    (version "1.13.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append
+             "https://parallel-netcdf.github.io/Release/pnetcdf-"
+             version ".tar.gz"))
+       (sha256
+        (base32
+         "14f4nbcnw80y59cl0kjpxqqfaxzzd62kixnhb6ihp6aigb3z385b"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:configure-flags
+           #~(list "--enable-shared"
+                   (string-append "--with-mpi=" #$(this-package-input "openmpi")))
+           #:phases
+           #~(modify-phases %standard-phases
+               (add-after 'build 'mpi-setup
+                 #$%openmpi-setup))))
+    (inputs (list openmpi))
+    (native-inputs (list m4))
+    (home-page "https://parallel-netcdf.github.io/")
+    (synopsis "Parallel I/O Library for NetCDF File Access")
+    (description "PnetCDF is a high-performance parallel I/O library for accessing
+Unidata's NetCDF, files in classic formats, specifically the formats of CDF-1, 2, and
+5.")
+    (license (license:x11-style "file://COPYRIGHT"))))
+
 (define-public netcdf-parallel-openmpi
-  (package (inherit netcdf)
+  (package/inherit netcdf
    (name "netcdf-parallel-openmpi")
-    (inputs
-     `(("mpi" ,openmpi)
-       ,@(alist-replace "hdf5" (list hdf5-parallel-openmpi)
-                        (package-inputs netcdf))))
+    (inputs (modify-inputs (package-inputs netcdf)
+              (append openmpi pnetcdf)
+              (replace "hdf5" hdf5-parallel-openmpi)))
    ;; TODO: Replace pkg-config references in nc-config with absolute references
    (arguments
     (substitute-keyword-arguments (package-arguments netcdf)
       ((#:configure-flags flags)
-        `(cons* "CC=mpicc" "CXX=mpicxx"
+        #~(cons* "CC=mpicc"
+                 "CXX=mpicxx"
                 "--enable-parallel-tests"
-                ;; Shared libraries not supported with parallel IO.
-                "--disable-shared" "--with-pic"
-                ,flags))
-       ((#:phases phases '%standard-phases)
-        `(modify-phases ,phases
+                 ;; Enable support of CDF-1, 2 and 5 formats.
+                 "--enable-pnetcdf"
+                 ;; NetCDF supports both parallel and shared library building
+                 ;; See https://docs.unidata.ucar.edu/nug/current/getting_and_building_netcdf.html#build_parallel
+                 "--enable-shared"
+                 "--with-pic"
+                 #$flags))
+       ((#:phases phases #~%standard-phases)
+        #~(modify-phases #$phases
            (add-after 'build 'mpi-setup
-             ,%openmpi-setup)))))))
+              #$%openmpi-setup)))))))

 (define-public netcdf-fortran
  (package
@ -2912,20 +2948,18 @@ (define-public libflame
      (license license:bsd-3))))

 (define-public scasp
-  (let ((commit "89a427aa04ec6346425a40111c99b310901ffe51")
-        (revision "1"))
  (package
    (name "scasp")
-      (version (git-version "0.21.11.26" revision commit))
+    (version "1.1.4")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/SWI-Prolog/sCASP")
-                      (commit commit)))
+                    (commit (string-append "V" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                  "1ijqv9xr3imrdmz6nq7zqwsmmaxn638icig19m8900m7mjfpizs4"))))
+                "1m4fs1ywich9cwj55miqp5zxs7c1fw9wvy7lcj5rkrgcanks5qk4"))))
    (build-system copy-build-system)
    (arguments
     (list
@ -2944,7 +2978,7 @@ (define-public scasp
    (synopsis "Interpreter for ASP programs with constraints")
    (description "@code{s(CASP)} is a top-down interpreter for ASP programs
 with constraints.")
-      (license license:asl2.0))))
+    (license license:asl2.0)))

 (define-public ceres
  (package
@ -7668,7 +7702,7 @@ (define-public yices
 (define-public z3
  (package
    (name "z3")
-    (version "4.8.17")
+    (version "4.13.0")
    (home-page "https://github.com/Z3Prover/z3")
    (source (origin
              (method git-fetch)
@ -7677,7 +7711,7 @@ (define-public z3
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1vvb09q7w7zd29qc4qjysrrhyylszm1wf6azkff004ixwn026b05"))))
+                "0j46lckf3zgx2xjay7z6nvlgh47gisbbl4s3m5zn280a13fwz1ih"))))
    (build-system cmake-build-system)
    (arguments
     (list
@ -9025,7 +9059,7 @@ (define-public minisat
 (define-public kissat
  (package
    (name "kissat")
-    (version "3.0.0")
+    (version "4.0.1")
    (source
     (origin
       (method git-fetch)
@ -9035,7 +9069,7 @@ (define-public kissat
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "04x4w760srbdi4zci0s747qxk717x5d2x59ixraxh5104s9nyn8b"))))
+         "0acg61cfcjg13if2i375cyl4xvwmabhfhi9z8pnw971046am6bzv"))))
    (build-system gnu-build-system)
    (inputs (list xz gzip lzip bzip2 p7zip))
    (arguments
@ -9060,7 +9094,7 @@ (define-public kissat
                 "bool found = true;"))
              (substitute* "test/testmain.c"
                ;; SIGINT is ignored inside invoke.
-                (("^SIGNAL\\(SIGINT\\)") ""))))
+                (("^[ \t]*SIGNAL[ \t]*\\(SIGINT\\)") ""))))
          (replace 'configure
            (lambda* (#:key configure-flags #:allow-other-keys)
              ;; The configure script does not support standard GNU options.
@ -9213,20 +9247,18 @@ (define-public libpoly
   (license license:lgpl3+)))

 (define-public lingeling
-  (let ((commit "72d2b13eea5fbd95557a3d0d199cd98dfbdc76ee")
-        (revision "1"))
  (package
    (name "lingeling")
-     (version (git-version "sc2022" revision commit))
+    (version "1.0.0")
    (source (origin
              (method git-fetch)
              (uri (git-reference
                    (url "https://github.com/arminbiere/lingeling")
-                    (commit commit)))
+                    (commit (string-append "rel-" version))))
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "16s30x8s2cw6icchwm65zj56ph4qwz6i07g3hwkknvajisvjq85c"))))
+                "0hszkhyni7jcw580f41rrrnwz42x56sqvd8zpcjdagvdiag76lc1"))))
    (build-system gnu-build-system)
    (arguments
     (list #:test-target "test"
@ -9246,7 +9278,7 @@ (define-public lingeling
               (add-after 'unpack 'hard-code-commit
                 (lambda _
                   (substitute* "mkconfig.sh"
-                      (("`\\./getgitid`") #$commit))))
+                     (("`\\./getgitid`") ""))))
               (add-after 'unpack 'patch-source
                 (lambda* (#:key inputs #:allow-other-keys)
                   (substitute* (list "treengeling.c" "lgldimacs.c")
@ -9292,8 +9324,147 @@ (define-public lingeling
 the sequential @command{lingeling} and its parallel variants
@command{plingeling} and @command{treengeling}.  A bounded model checker is
 also included.")
+    (license license:expat)))
+
+(define-public cadical
+  (package
+    (name "cadical")
+    (version "2.0.0")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference
+                    (url "https://github.com/arminbiere/cadical")
+                    (commit (string-append "rel-" version))))
+              (file-name (git-file-name name version))
+              (patches (search-patches "cadical-add-shared-library.patch"))
+              (sha256
+               (base32 "1dzjah3z34v89ka48hncwqkxrwl4xqn9947p0ipf39lxshrq91xa"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:test-target "test"
+           #:modules `(((guix build copy-build-system) #:prefix copy:)
+                       (guix build gnu-build-system)
+                       (guix build utils)
+                       (ice-9 regex))
+           #:imported-modules %copy-build-system-modules
+           #:phases
+           #~(modify-phases %standard-phases
+               (replace 'configure
+                 (lambda* (#:key configure-flags #:allow-other-keys)
+                   (setenv "CXXFLAGS" "-DPIC -fPIC")
+                   (apply invoke "./configure" configure-flags)))
+               (replace 'check
+                 (lambda args
+                   ;; Tests are incorrectly linked upstream.
+                   ;; Since we don't install them, just work around this in the
+                   ;; check phase.
+                   (setenv "LD_LIBRARY_PATH" (string-append (getcwd) "/build"))
+                   (apply (assoc-ref %standard-phases 'check) args)
+                   (unsetenv "LD_LIBRARY_PATH")))
+               (replace 'install
+                 (lambda args
+                   (apply
+                    (assoc-ref copy:%standard-phases 'install)
+                    #:install-plan
+                    `(("build" "bin" #:include ("cadical" "mobical"))
+                      ("build" "lib" #:include-regexp ("libcadical\\.(a|so)$"))
+                      ("src" "include" #:include ("cadical.h"))
+                      ;; Internal headers used by cadiback.
+                      ("src" "include/cadical" #:include-regexp ("\\.hpp$")))
+                    args))))))
+    (home-page "https://github.com/arminbiere/cadical")
+    (synopsis "SAT solver")
+    (description "This package provides a SAT solver based on conflict-driven
+clause learning.")
+    (license license:expat)))
+
+(define-public cadiback
+  (let ((commit "789329d8fcda851085ed72f1b07d8c3f46243b8a")
+        (revision "1"))
+    (package
+      (name "cadiback")
+      ;; Note: version taken from VERSION file
+      (version (git-version "0.2.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/arminbiere/cadiback")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32 "137jxf9g7c1979pcgcqgfff1mqk5hs41a84780px8gpcrh469cks"))))
+      (build-system gnu-build-system)
+      (arguments
+       (list #:test-target "test"
+             #:modules `(((guix build copy-build-system) #:prefix copy:)
+                         (guix build gnu-build-system)
+                         (guix build utils)
+                         (ice-9 regex))
+             #:imported-modules %copy-build-system-modules
+             #:phases
+             #~(modify-phases %standard-phases
+                 (add-after 'unpack 'patch-build-files
+                   (lambda* (#:key inputs #:allow-other-keys)
+                     (substitute* "configure"
+                       (("\\$CADICAL/src") "$CADICAL/include/cadical")
+                       (("\\$CADICAL/build") "$CADICAL/lib"))
+                     (substitute* "generate"
+                       (("\\[ -d .git \\]" all) (string-append ": " all))
+                       (("GITID=.*") (string-append "GITID=\"" #$commit "\"")))
+                     (substitute* "makefile.in"
+                       (("\\.\\./cadical/build")
+                        (dirname
+                         (search-input-file inputs "lib/libcadical.a")))
+                       (("\\.\\./cadical/src")
+                        (search-input-directory inputs "include/cadical")))))
+                 (replace 'configure
+                   (lambda* (#:key configure-flags #:allow-other-keys)
+                     (setenv "CADICAL" #$(this-package-input "cadical"))
+                     (apply invoke "./configure" configure-flags)))
+                 (replace 'install
+                   (lambda args
+                     (apply
+                      (assoc-ref copy:%standard-phases 'install)
+                      #:install-plan
+                      `(("." "bin" #:include ("cadiback")))
+                      args))))))
+      (inputs (list cadical))
+      (home-page "https://github.com/arminbiere/cadiback")
+      (synopsis "Backbone extractor for cadical")
+      (description "This package provides a tool to determine the backbone of
+a satisfiable formula.  The backbone is the set of literals that are set to
+true in all models.")
      (license license:expat))))

+(define cadiback-for-cryptominisat
+  (let ((commit "ea65a9442fc2604ee5f4ffd0f0fdd0bf481d5b42")
+        (revision "1"))
+    (package
+      (inherit cadiback)
+      (name "cadiback-for-cryptominisat")
+      (version (git-version "0.2.1" revision commit))
+      (source (origin
+                (method git-fetch)
+                (uri (git-reference
+                      (url "https://github.com/meelgroup/cadiback")
+                      (commit commit)))
+                (file-name (git-file-name name version))
+                (sha256
+                 (base32 "1zznrlj4zp1mc7s4pfw11aq773q2lr9yl6pph630zg5mqijaim5g"))))
+      (arguments
+       (substitute-keyword-arguments (package-arguments cadiback)
+         ((#:phases phases)
+          #~(modify-phases #$phases
+              (add-after 'patch-build-files 'fix-prefix
+                (lambda _
+                  (substitute* "makefile.in"
+                    (("/usr") #$output))))
+              (replace 'install
+                (lambda args
+                  (mkdir-p (string-append #$output "/include"))
+                  (mkdir-p (string-append #$output "/lib"))
+                  (apply (assoc-ref %standard-phases 'install) args))))))))))
+
 (define-public louvain-community
  (let ((commit "8cc5382d4844af127b1c1257373740d7e6b76f1e")
        (revision "1"))
@ -9328,7 +9499,7 @@ (define-public louvain-community
 (define-public cryptominisat
  (package
    (name "cryptominisat")
-    (version "5.11.4")
+    (version "5.11.22")
    (source
     (origin
       (method git-fetch)
@ -9338,7 +9509,12 @@ (define-public cryptominisat
      (file-name (git-file-name name version))
      (sha256
       (base32
-        "1izjn44phjp9670s7bxrdx4p0r59idqwv3bm6sr0qnlqlha5z4zc"))))
+        "1c85gfqvy90yhh9jwmiiz2bz4i86prgpfyx1gbzl42hn2ixkcjgm"))
+      (modules '((guix build utils)))
+      (snippet
+       #~(begin
+           (substitute* "src/backbone.cpp"
+             (("\"\\.\\./cadiback/cadiback\\.h\"") "<cadiback.h>"))))))
    (build-system cmake-build-system)
    (arguments
     (list
@ -9362,7 +9538,15 @@ (define-public cryptominisat
                 "find_package(GTest REQUIRED)")
                (("add_subdirectory\\(\\$\\{PROJECT_SOURCE_DIR\\}/utils/.*\\)")
                 "")))))))
-    (inputs (list boost louvain-community python python-numpy sqlite zlib))
+    (inputs (list boost
+                  cadical
+                  cadiback-for-cryptominisat
+                  gmp
+                  louvain-community
+                  python
+                  python-numpy
+                  sqlite
+                  zlib))
    (native-inputs (list googletest lingeling python python-wrapper python-lit))
    (synopsis "Incremental SAT solver")
    (description
@ -9855,7 +10039,7 @@ (define-public optizelle
 (define-public scilab
  (package
    (name "scilab")
-    (version "2024.0.0")
+    (version "2024.1.0")
    (source
     (origin
       (method git-fetch)
@ -9865,7 +10049,7 @@ (define-public scilab
       (file-name (git-file-name name version))
       (sha256
        (base32
-         "08nyfli3x7gd396ffd1a8zn9fj3gm6a8yw0ggm547c09sp2rgvl7"))
+         "1qk0pf1cwcvdqjza9xqkynd90ywq0yh421bz59w5zjzbs40ijnrx"))
       (patches (search-patches "scilab-better-compiler-detection.patch"
                                "scilab-tbx_build_help.patch"))
       (modules '((guix build utils)
@ -9889,7 +10073,8 @@ (define-public scilab
                        "libs/GetWindowsVersion"
                        "Visual-Studio-settings"))
            (for-each delete-file
-                      (cons* "aclocal.m4"
+                      (append
+                       (list "aclocal.m4"
                             "configure"
                             "m4/ax_cxx_compile_stdcxx.m4"
                             "m4/lib-ld.m4"
@ -9899,8 +10084,9 @@ (define-public scilab
                             "m4/ltversion.m4"
                             "m4/lt~obsolete.m4"
                             "m4/pkg.m4"
-                             "Scilab.sln"
-                             (find-files "." "^Makefile\\.in$")))
+                             "Scilab.sln")
+                       (find-files "." "^Makefile\\.in$")
+                       (find-files "." "\\.bat$")))

            ;; And finally some files in the modules directory:
            (for-each
@ -9928,6 +10114,7 @@ (define-public scilab
           autoconf-archive
           automake
           bison
+           coreutils-minimal
           eigen
           flex
           gfortran
@ -10035,6 +10222,10 @@ (define-public scilab
                    (("PROGNAME.*") "\n")))))
            (add-before 'build 'pre-build
              (lambda* (#:key inputs #:allow-other-keys)
+                ;; Fix scilab script.
+                (substitute* "bin/scilab"
+                  (("/bin/ls")
+                   (search-input-file inputs "bin/ls")))
                ;; Fix core.start.
                (substitute* "modules/core/etc/core.start"
                  (("'SCI/modules")
@ -10070,7 +10261,12 @@ (define (bin path) (string-append #$output "/bin/" path))
                    "\"${XDG_STATE_HOME:-$HOME/.local/state}/scilab/"
                    #$(package-version this-package) "\""))
                  (("export SCI=")
-                   "unset LANGUAGE\nexport SCI="))))))))
+                   "unset LANGUAGE\nexport SCI="))))
+            (add-after 'rewrap-scilab-cli 'sanity-check
+              (lambda _
+                (setenv "HOME" (getcwd))
+                (invoke (string-append #$output "/bin/scilab-cli")
+                        "-e" "\"quit;\"")))))))
    (home-page "https://www.scilab.org/")
    (synopsis "Software for engineers and scientists")
    (description "This package provides the non-graphical version of the Scilab
--- a/gnu/packages/mold.scm
+++ b/gnu/packages/mold.scm
@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2023 Zhu Zihao <all_but_last@163.com>
 ;;; Copyright © 2023, 2024 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2024 Ashish SHUKLA <ashish.is@lostca.se>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -35,7 +36,7 @@ (define-module (gnu packages mold)
 (define-public mold
  (package
    (name "mold")
-    (version "2.34.0")
+    (version "2.34.1")
    (source
     (origin
       (method git-fetch)
@ -44,7 +45,7 @@ (define-public mold
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0n8ygaxsda9ybc1jc7ap7grbziah403wjm2hmmcxzahm52v6czs0"))
+        (base32 "0s5mlnchw8sz3mafifiwhjswp91j5ja6ds946w21qws5sbwx15y7"))
       (modules '((guix build utils)))
       (snippet
        #~(begin
--- a/gnu/packages/mtools.scm
+++ b/gnu/packages/mtools.scm
@ -29,14 +29,14 @@ (define-module (gnu packages mtools)
 (define-public mtools
  (package
    (name "mtools")
-    (version "4.0.44")
+    (version "4.0.45")
    (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/mtools/mtools-"
                                  version ".tar.bz2"))
              (sha256
               (base32
-                "1f6x3srkssjcnrmd9hkladc8nzkwq9rqkiy15r5ksg2k4bq4vp1p"))
+                "066ncw51da1h6w80p6cl6flw8sznk933sf545xa0xzhfpnb8l00b"))
              (patches
               (search-patches "mtools-mformat-uninitialized.patch"))))
    (build-system gnu-build-system)
--- a/gnu/packages/music.scm
+++ b/gnu/packages/music.scm
@ -2953,7 +2953,8 @@ (define-public tuxguitar
                                "TuxGuitar-gm-utils"
                                "TuxGuitar-alsa"
                                "TuxGuitar-midi"
-                                "TuxGuitar-midi-ui")))))
+                                "TuxGuitar-midi-ui"
+                                "TuxGuitar-compat")))))
         (add-after 'build 'build-jni
           (lambda _
             (setenv "CC" "gcc")
@ -4640,11 +4641,11 @@ (define-public gx-guvnor-lv2
    (license license:gpl3+)))

 (define-public gx-vbass-preamp-lv2
-  (let ((commit "eb999b0ca0ef4da40a59e458a9ab6e7042b96c99")
-        (revision "2"))
+  (let ((commit "f6a01c22fea71b155a797853c23653137ac89c1c")
+        (revision "3"))
    (package (inherit gx-guvnor-lv2)
      (name "gx-vbass-preamp-lv2")
-      (version (string-append "0-" revision "." (string-take commit 9)))
+      (version (git-version "0" revision commit))
      (source (origin
                (method git-fetch)
                (uri (git-reference
@ -4652,10 +4653,24 @@ (define-public gx-vbass-preamp-lv2
                      (commit commit)))
                (sha256
                 (base32
-                  "0firap073ldw4nrykkd7jvyyj0jbl1nslxyzjj4kswazp99x7d9h"))
-                (file-name (string-append name "-" version "-checkout"))))
+                  "1ssa2xkppn7cn8lfvglb6brm5qsd7kysmabfj34qrqbywf5hdisw"))
+                (file-name (git-file-name name version))))
+      (arguments
+       (list
+        ;; The check target is used only to output a warning.
+        #:tests? #false
+        #:make-flags
+        #~(list (string-append "DESTDIR=" #$output)
+                (string-append "CC=" #$(cc-for-target)))
+        #:phases
+        '(modify-phases %standard-phases
+           (replace 'configure
+             (lambda _
+               (substitute* "Makefile"
+                 (("INSTALL_DIR = .*") "INSTALL_DIR=/lib/lv2\n")
+                 (("install : all") "install :")))))))
      (inputs
-       (list lv2 gtk+-2))
+       (list lv2 gtk+))
      (native-inputs
       (list pkg-config))
      (home-page "https://github.com/brummer10/GxVBassPreAmp.lv2")
@ -4744,11 +4759,11 @@ (define-public gx-suppa-tone-bender-lv2
 pedal.")))

 (define-public gx-saturator-lv2
-  (let ((commit "605330f432c94b6eb3f8203cbe472befae959532")
-        (revision "3"))
+  (let ((commit "2142b14a86a4e6f2ab69446160d90f23b1ed3939")
+        (revision "4"))
    (package (inherit gx-vbass-preamp-lv2)
      (name "gx-saturator-lv2")
-      (version (string-append "0-" revision "." (string-take commit 9)))
+      (version (git-version "0" revision commit))
      (source (origin
                (method git-fetch)
                (uri (git-reference
@ -4756,8 +4771,8 @@ (define-public gx-saturator-lv2
                      (commit commit)))
                (sha256
                 (base32
-                  "1w4nvh0rmxrv3s3hmh4fs74f3hc0jn31v00j769j7v68mqr7kawy"))
-                (file-name (string-append name "-" version "-checkout"))))
+                  "16mq0k50pachg61vw88hjmyla5zwy0drfhi4d3f9hviivcfigg03"))
+                (file-name (git-file-name name version))))
      (home-page "https://github.com/brummer10/GxSaturator.lv2")
      (synopsis "Saturation effect")
      (description "This package provides the LV2 plugin \"GxSaturator\", a
--- a/gnu/packages/musl.scm
+++ b/gnu/packages/musl.scm
@ -44,12 +44,14 @@ (define-public musl
     (list #:tests? #f                      ; musl has no tests
           #:configure-flags
           #~(list "--enable-wrapper=all"
-                   (string-append "--syslibdir=" #$output "/lib"))))
+                   (string-append "--syslibdir=" #$output "/lib"))
+           #:license-file-regexp "COPYRIGHT"))
    (inputs (list bash-minimal))
    (synopsis "Small C standard library")
    (description "musl is a simple and lightweight C standard library.  It
 strives to be correct in the sense of standards-conformance and safety.")
    (home-page "https://musl.libc.org")
+    (properties `((release-monitoring-url . ,home-page)))
    ;; Musl as a whole is released under the Expat license.  Parts of it are
    ;; derived from various third-party projects that are released under
    ;; non-copyleft licenses.  See the COPYRIGHT file for details.
--- a/gnu/packages/ncurses.scm
+++ b/gnu/packages/ncurses.scm
@ -323,11 +323,13 @@ (define-public stfl
    (source
      (origin
        (method url-fetch)
-        (uri (string-append "http://www.clifford.at/stfl/stfl-"
+        ;; The original home page has been taken over by gamblespammers.
+        ;; Luckily, the original is archived and even includes the tarball.
+        (uri (string-append "https://web.archive.org/web/20211113222004/"
+                            "http://www.clifford.at/stfl/stfl-"
                            version ".tar.gz"))
        (sha256
-         (base32
-          "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl"))))
+         (base32 "1460d5lc780p3q38l3wc9jfr2a7zlyrcra0li65aynj738cam9yl"))))
    (build-system gnu-build-system)
    (arguments
     `(#:tests? #f ; no test target
@ -336,7 +338,7 @@ (define-public stfl
       #:phases
       (modify-phases %standard-phases
         (delete 'configure) ; there is no configure script
-         ;; in our ncurses, the headers are in /include
+         ;; In our ncurses, the headers are in /include.
         (add-before 'build 'patch-ncursesw
           (lambda _
             (substitute* "stfl_internals.h"
@ -349,8 +351,19 @@ (define-public stfl
               (symlink "libstfl.so" (string-append lib "/libstfl.so.0"))))))))
    (inputs (list ncurses))
    (native-inputs (list ncurses swig))
-    (home-page "https://www.clifford.at/stfl/")
+    (home-page (string-append "https://web.archive.org/web/20211113222004/"
+                              "http://www.clifford.at/stfl/"))
    (synopsis "Structured terminal forms library")
-    (description "Stfl is a library which implements a curses-based widget
-set for text terminals.")
+    (description "@acronym{STFL, Structured Terminal Forms Language} is a
+language for easily describing @acronym{GUIs, Graphical User Interfaces}.
+@acronym{STFL, Structured Terminal Forms Library} is also the name of this
+library which translates those descriptions into a curses-based widget set for
+text terminals.
+
+STFL descriptions do not contain any concrete layouting information, such as x/y
+coordinates of widgets.  Instead, container widgets such as vertical and
+horizontal boxes, as well as tables, are used to group widgets.  The actual
+layouting work is done by the STFL library.  This allows STFL GUIs to handle
+terminals of different sizes and terminal resize events transparently for the
+application programmer.")
    (license lgpl3+)))
--- a/gnu/packages/package-management.scm
+++ b/gnu/packages/package-management.scm
@ -767,7 +767,7 @@ (define-public guix-backgrounds
 (define-public guix-modules
  (package
    (name "guix-modules")
-    (version "0.1.0")
+    (version "0.2.0")
    (home-page "https://gitlab.inria.fr/guix-hpc/guix-modules")
    (source (origin
              (method git-fetch)
@ -776,7 +776,7 @@ (define-public guix-modules
              (file-name (string-append "guix-modules-" version "-checkout"))
              (sha256
               (base32
-                "1ckvrrmkgzz93i35sj1372wxs7ln4gzszpri1pcdf473z0p7nh7w"))))
+                "0k3mz2d1qjx7nclg7mgk77rwvyjsmz3j0hpzihvmznx5bly8wg92"))))
    (build-system guile-build-system)
    (arguments
     '(#:phases (modify-phases %standard-phases
--- a/gnu/packages/parallel.scm
+++ b/gnu/packages/parallel.scm
@ -193,7 +193,7 @@ (define-public xjobs
 (define-public slurm
  (package
    (name "slurm")
-    (version "23.02.6")
+    (version "23.11.10")
    (source (origin
              (method url-fetch)
              (uri (string-append
@ -201,9 +201,7 @@ (define-public slurm
                    version ".tar.bz2"))
              (sha256
               (base32
-                "08rz3r1rlnb3pmfdnbh542gm44ja0fdy8rkj4vm4lclc48cvqp2a"))
-              (patches
-               (search-patches "slurm-23-salloc-fallback-shell.patch"))
+                "0gf7x85bzpkrx87mb16wyiyvkjxqq01sbajsjxwrspyi2v675hgr"))
              (modules '((guix build utils)))
              (snippet
               '(begin
@ -300,13 +298,29 @@ (define-public slurm
 ;; As noted in the link, YY.MM is the release scheme, and the 'maintenance'
 ;; digit does not introduce incompatibilities.

-(define-public slurm-22.05
+(define-public slurm-23.02
  (package
   (inherit slurm)
-    (version "22.05.1")
+   (version "23.02.6")
    (source (origin
             (inherit (package-source slurm))
             (method url-fetch)
+             (uri (string-append
+                   "https://download.schedmd.com/slurm/slurm-"
+                   version ".tar.bz2"))
+             (patches
+              (search-patches "slurm-23-salloc-fallback-shell.patch"))
+             (sha256
+              (base32
+               "08rz3r1rlnb3pmfdnbh542gm44ja0fdy8rkj4vm4lclc48cvqp2a"))))))
+
+(define-public slurm-22.05
+  (package
+    (inherit slurm-23.02)
+    (version "22.05.1")
+    (source (origin
+              (inherit (package-source slurm-23.02))
+              (method url-fetch)
              (uri (string-append
                    "https://download.schedmd.com/slurm/slurm-"
                    version ".tar.bz2"))
--- a/gnu/packages/patches/cadical-add-shared-library.patch
+++ b/gnu/packages/patches/cadical-add-shared-library.patch
@ -0,0 +1,49 @@
+From fcb865786b524917aa9d3df8745aca66716794bf Mon Sep 17 00:00:00 2001
+From: Mate Soos <soos.mate@gmail.com>
+Date: Sun, 2 Jun 2024 21:50:06 -0400
+Subject: [PATCH] Also add a dynamic library
+
+---
+Liliana Marie Prikler <liliana.prikler@gmail.com>:
+  Added -L.
+  Squashed fix for cadical and mobical.
+
+ makefile.in | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/makefile.in b/makefile.in
+index 291cb3e3..d179f591 100644
+--- a/makefile.in
+++ b/makefile.in
+@@ -34,7 +34,7 @@ COMPILE=$(CXX) $(CXXFLAGS) -I$(DIR) -I$(ROOT)/src
+ 
+ #--------------------------------------------------------------------------#
+ 
+-all: libcadical.a cadical mobical
+all: libcadical.so libcadical.a cadical mobical
+ 
+ #--------------------------------------------------------------------------#
+ 
+@@ -54,10 +54,10 @@ contrib/%.o: $(ROOT)/contrib/%.cpp $(ROOT)/contrib/%.hpp $(ROOT)/src/*.hpp makef
+ # tester 'mobical') and the library are the main build targets.
+ 
+ cadical: src/cadical.o libcadical.a makefile
+-	$(COMPILE) -o $@ $< -L. -lcadical $(LIBS)
+	$(COMPILE) -static -o $@ $< -L. -lcadical $(LIBS)
+ 
+ mobical: src/mobical.o libcadical.a makefile $(LIBS)
+-	$(COMPILE) -o $@ $< -L. -lcadical
+	$(COMPILE) -static -o $@ $< -L. -lcadical
+ 
+ libcadical.a: $(OBJ_SOLVER) $(OBJ_CONTRIB) makefile
+ 	ar rc $@ $(OBJ_SOLVER) $(OBJ_CONTRIB)
+@@ -62,5 +62,8 @@ mobical: src/mobical.o libcadical.a makefile $(LIBS)
+ libcadical.a: $(OBJ_SOLVER) $(OBJ_CONTRIB) makefile
+ 	ar rc $@ $(OBJ_SOLVER) $(OBJ_CONTRIB)
+ 
+libcadical.so: $(OBJ_SOLVER) $(OBJ_CONTRIB) $(LIBS) makefile
+	$(COMPILE) -shared -o $@ $(OBJ_SOLVER) $(OBJ_CONTRIB) $(LIBS)
+
+ #--------------------------------------------------------------------------#
+ 
+ # Note that 'build.hpp' is generated and resides in the build directory.
--- a/gnu/packages/patches/clang-cling-13-libc-search-path.patch
+++ b/gnu/packages/patches/clang-cling-13-libc-search-path.patch
@ -1,96 +0,0 @@
-Clang attempts to guess file names based on the OS and distro (yes!),
-but unfortunately, that doesn't work for us.
-
-This patch makes it easy to insert libc's $libdir so that Clang passes the
-correct absolute file name of crt1.o etc. to 'ld'.  It also disables all
-the distro-specific stuff and removes the hard-coded FHS directory names
-to make sure Clang also works on foreign distros.
-
-diff --git a/clang/lib/Driver/Distro.cpp b/clang/lib/Driver/Distro.cpp
-index ee4fe841..f0313bbe 100644
--- a/clang/lib/Driver/Distro.cpp
-+++ b/clang/lib/Driver/Distro.cpp
-@@ -93,6 +93,10 @@ static Distro::DistroType DetectLsbRelease(llvm::vfs::FileSystem &VFS) {
- }
- 
- static Distro::DistroType DetectDistro(llvm::vfs::FileSystem &VFS) {
-+  // The compiler should always behave the same, even when used via Guix on a
-+  // foreign distro.
-+  return Distro::UnknownDistro;
-+
-   Distro::DistroType Version = Distro::UnknownDistro;
- 
-   // Newer freedesktop.org's compilant systemd-based systems
-diff --git a/clang/lib/Driver/ToolChains/Cuda.cpp b/clang/lib/Driver/ToolChains/Cuda.cpp
-index d14776c5..88bc3ccd 100644
--- a/clang/lib/Driver/ToolChains/Cuda.cpp
-+++ b/clang/lib/Driver/ToolChains/Cuda.cpp
-@@ -119,6 +119,9 @@ CudaInstallationDetector::CudaInstallationDetector(
-     const Driver &D, const llvm::Triple &HostTriple,
-     const llvm::opt::ArgList &Args)
-     : D(D) {
-+  // Don't look for CUDA in /usr.
-+  return;
-+
-   struct Candidate {
-     std::string Path;
-     bool StrictChecking;
-diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
--- a/clang/lib/Driver/ToolChains/Linux.cpp
-+++ b/clang/lib/Driver/ToolChains/Linux.cpp
-@@ -186,6 +186,10 @@
- 
-   Generic_GCC::PushPPaths(PPaths);
- 
-+  // Comment out the distro-specific tweaks so that they don't bite when
-+  // using Guix on a foreign distro.
-+#if 0
-+
-   Distro Distro(D.getVFS(), Triple);
- 
-   if (Distro.IsAlpineLinux() || Triple.isAndroid()) {
-@@ -251,6 +255,7 @@
- 
-   if (IsAndroid || Distro.IsOpenSUSE())
-     ExtraOpts.push_back("--enable-new-dtags");
-+#endif
- 
-   // The selection of paths to try here is designed to match the patterns which
-   // the GCC driver itself uses, as this is part of the GCC-compatible driver.
-@@ -264,6 +269,7 @@
- 
-   Generic_GCC::AddMultilibPaths(D, SysRoot, OSLibDir, MultiarchTriple, Paths);
- 
-+#if 0
-   addPathIfExists(D, SysRoot + "/lib/" + MultiarchTriple, Paths);
-   addPathIfExists(D, SysRoot + "/lib/../" + OSLibDir, Paths);
- 
-@@ -295,9 +301,11 @@
-     addPathIfExists(D, SysRoot + "/" + OSLibDir + "/" + ABIName, Paths);
-     addPathIfExists(D, SysRoot + "/usr/" + OSLibDir + "/" + ABIName, Paths);
-   }
-+#endif
- 
-   Generic_GCC::AddMultiarchPaths(D, SysRoot, OSLibDir, Paths);
- 
-+#if 0
-   // Similar to the logic for GCC above, if we are currently running Clang
-   // inside of the requested system root, add its parent library path to those
-   // searched.
-@@ -305,9 +313,14 @@
-   // directory ('Dir' below) or the ResourceDir.
-   if (StringRef(D.Dir).startswith(SysRoot))
-     addPathIfExists(D, D.Dir + "/../lib", Paths);
-+#endif
-+
-+  // Add libc's lib/ directory to the search path, so that crt1.o, crti.o,
-+  // and friends can be found.
-+  addPathIfExists(D, "@GLIBC_LIBDIR@", Paths);
- 
-  addPathIfExists(D, SysRoot + "/lib", Paths);
-  addPathIfExists(D, SysRoot + "/usr/lib", Paths);
-+  // Add GCC's lib/ directory so libstdc++.so can be found.
-+  addPathIfExists(D, GCCInstallation.getParentLibPath(), Paths);
- }
- 
- ToolChain::RuntimeLibType Linux::GetDefaultRuntimeLibType() const {
--- a/gnu/packages/patches/clang-cling-13-remove-crypt-interceptors.patch
+++ b/gnu/packages/patches/clang-cling-13-remove-crypt-interceptors.patch
@ -1,214 +0,0 @@
-From d7bead833631486e337e541e692d9b4a1ca14edd Mon Sep 17 00:00:00 2001
-From: Fangrui Song <i@maskray.me>
-Date: Fri, 28 Apr 2023 09:59:17 -0700
-Subject: [PATCH] [sanitizer] Remove crypt and crypt_r interceptors
-
-From Florian Weimer's D144073
-
-> On GNU/Linux (glibc), the crypt and crypt_r functions are not part of the main shared object (libc.so.6), but libcrypt (with multiple possible sonames). The sanitizer libraries do not depend on libcrypt, so it can happen that during sanitizer library initialization, no real implementation will be found because the crypt, crypt_r functions are not present in the process image (yet). If its interceptors are called nevertheless, this results in a call through a null pointer when the sanitizer library attempts to forward the call to the real implementation.
->
-> Many distributions have already switched to libxcrypt, a library that is separate from glibc and that can be build with sanitizers directly (avoiding the need for interceptors). This patch disables building the interceptor for glibc targets.
-
-Let's remove crypt and crypt_r interceptors (D68431) to fix issues with
-newer glibc.
-
-For older glibc, msan will not know that an uninstrumented crypt_r call
-initializes `data`, so there is a risk for false positives. However, with some
-codebase survey, I think crypt_r uses are very few and the call sites typically
-have a `memset(&data, 0, sizeof(data));` anyway.
-
-Fix https://github.com/google/sanitizers/issues/1365
-Related: https://bugzilla.redhat.com/show_bug.cgi?id=2169432
-
-Reviewed By: #sanitizers, fweimer, thesamesam, vitalybuka
-
-Differential Revision: https://reviews.llvm.org/D149403
---
- .../sanitizer_common_interceptors.inc         | 37 -------------------
- .../sanitizer_platform_interceptors.h         |  2 -
- .../sanitizer_platform_limits_posix.cpp       |  8 ----
- .../sanitizer_platform_limits_posix.h         |  1 -
- .../TestCases/Linux/crypt_r.cpp               | 36 ------------------
- .../TestCases/Posix/crypt.cpp                 | 32 ----------------
- 6 files changed, 116 deletions(-)
- delete mode 100644 compiler-rt/test/sanitizer_common/TestCases/Linux/crypt_r.cpp
- delete mode 100644 compiler-rt/test/sanitizer_common/TestCases/Posix/crypt.cpp
-
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
-index b30c91f06cfeb0..490a8b12d8b17d 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc
-@@ -10086,41 +10086,6 @@ INTERCEPTOR(SSIZE_T, getrandom, void *buf, SIZE_T buflen, unsigned int flags) {
- #define INIT_GETRANDOM
- #endif
- 
-#if SANITIZER_INTERCEPT_CRYPT
-INTERCEPTOR(char *, crypt, char *key, char *salt) {
-  void *ctx;
-  COMMON_INTERCEPTOR_ENTER(ctx, crypt, key, salt);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, key, internal_strlen(key) + 1);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, salt, internal_strlen(salt) + 1);
-  char *res = REAL(crypt)(key, salt);
-  if (res != nullptr)
-    COMMON_INTERCEPTOR_INITIALIZE_RANGE(res, internal_strlen(res) + 1);
-  return res;
-}
-#define INIT_CRYPT COMMON_INTERCEPT_FUNCTION(crypt);
-#else
-#define INIT_CRYPT
-#endif
-
-#if SANITIZER_INTERCEPT_CRYPT_R
-INTERCEPTOR(char *, crypt_r, char *key, char *salt, void *data) {
-  void *ctx;
-  COMMON_INTERCEPTOR_ENTER(ctx, crypt_r, key, salt, data);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, key, internal_strlen(key) + 1);
-  COMMON_INTERCEPTOR_READ_RANGE(ctx, salt, internal_strlen(salt) + 1);
-  char *res = REAL(crypt_r)(key, salt, data);
-  if (res != nullptr) {
-    COMMON_INTERCEPTOR_WRITE_RANGE(ctx, data,
-                                   __sanitizer::struct_crypt_data_sz);
-    COMMON_INTERCEPTOR_INITIALIZE_RANGE(res, internal_strlen(res) + 1);
-  }
-  return res;
-}
-#define INIT_CRYPT_R COMMON_INTERCEPT_FUNCTION(crypt_r);
-#else
-#define INIT_CRYPT_R
-#endif
-
- #if SANITIZER_INTERCEPT_GETENTROPY
- INTERCEPTOR(int, getentropy, void *buf, SIZE_T buflen) {
-   void *ctx;
-@@ -10698,8 +10663,6 @@ static void InitializeCommonInterceptors() {
-   INIT_GETUSERSHELL;
-   INIT_SL_INIT;
-   INIT_GETRANDOM;
-  INIT_CRYPT;
-  INIT_CRYPT_R;
-   INIT_GETENTROPY;
-   INIT_QSORT;
-   INIT_QSORT_R;
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h b/compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h
-index eb39fabfd59839..c82ab5c2105621 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_interceptors.h
-@@ -569,8 +569,6 @@
- #define SANITIZER_INTERCEPT_FDEVNAME SI_FREEBSD
- #define SANITIZER_INTERCEPT_GETUSERSHELL (SI_POSIX && !SI_ANDROID)
- #define SANITIZER_INTERCEPT_SL_INIT (SI_FREEBSD || SI_NETBSD)
-#define SANITIZER_INTERCEPT_CRYPT (SI_POSIX && !SI_ANDROID)
-#define SANITIZER_INTERCEPT_CRYPT_R (SI_LINUX && !SI_ANDROID)
- 
- #define SANITIZER_INTERCEPT_GETRANDOM \
-   ((SI_LINUX && __GLIBC_PREREQ(2, 25)) || SI_FREEBSD)
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-index a04eed7aa5a6e..6d61d276d77e3 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-@@ -142,5 +142,4 @@
- #include <linux/serial.h>
- #include <sys/msg.h>
- #include <sys/ipc.h>
-#include <crypt.h>
- #endif  // SANITIZER_ANDROID
-@@ -243,7 +244,6 @@
-   unsigned struct_ustat_sz = SIZEOF_STRUCT_USTAT;
-   unsigned struct_rlimit64_sz = sizeof(struct rlimit64);
-   unsigned struct_statvfs64_sz = sizeof(struct statvfs64);
-  unsigned struct_crypt_data_sz = sizeof(struct crypt_data);
- #endif // SANITIZER_LINUX && !SANITIZER_ANDROID
- 
- #if SANITIZER_LINUX && !SANITIZER_ANDROID
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-index e6f298c26e1fb6..58244c9944a03a 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.h
-@@ -309,7 +309,6 @@ extern unsigned struct_msqid_ds_sz;
- extern unsigned struct_mq_attr_sz;
- extern unsigned struct_timex_sz;
- extern unsigned struct_statvfs_sz;
-extern unsigned struct_crypt_data_sz;
- #endif  // SANITIZER_LINUX && !SANITIZER_ANDROID
- 
- struct __sanitizer_iovec {
-diff --git a/test/sanitizer_common/TestCases/Linux/crypt_r.cpp b/test/sanitizer_common/TestCases/Linux/crypt_r.cpp
-deleted file mode 100644
-index 69bfb46aa5f171..00000000000000
--- a/compiler-rt/test/sanitizer_common/TestCases/Linux/crypt_r.cpp
-+++ /dev/null
-@@ -1,36 +0,0 @@
-// RUN: %clangxx -O0 -g %s -lcrypt -o %t && %run %t
-
-// crypt.h is missing from Android.
-// UNSUPPORTED: android
-
-#include <assert.h>
-#include <unistd.h>
-#include <cstring>
-#include <crypt.h>
-
-int main(int argc, char **argv) {
-  {
-    crypt_data cd;
-    cd.initialized = 0;
-    char *p = crypt_r("abcdef", "xz", &cd);
-    volatile size_t z = strlen(p);
-  }
-  {
-    crypt_data cd;
-    cd.initialized = 0;
-    char *p = crypt_r("abcdef", "$1$", &cd);
-    volatile size_t z = strlen(p);
-  }
-  {
-    crypt_data cd;
-    cd.initialized = 0;
-    char *p = crypt_r("abcdef", "$5$", &cd);
-    volatile size_t z = strlen(p);
-  }
-  {
-    crypt_data cd;
-    cd.initialized = 0;
-    char *p = crypt_r("abcdef", "$6$", &cd);
-    volatile size_t z = strlen(p);
-  }
-}
-diff --git a/test/sanitizer_common/TestCases/Posix/crypt.cpp b/test/sanitizer_common/TestCases/Posix/crypt.cpp
-deleted file mode 100644
-index 3a8faaa1ae7682..00000000000000
--- a/compiler-rt/test/sanitizer_common/TestCases/Posix/crypt.cpp
-+++ /dev/null
-@@ -1,32 +0,0 @@
-// RUN: %clangxx -O0 -g %s -o %t -lcrypt && %run %t
-
-// crypt() is missing from Android and -lcrypt from darwin.
-// UNSUPPORTED: android, darwin
-
-#include <assert.h>
-#include <unistd.h>
-#include <cstring>
-#if __has_include(<crypt.h>)
-#include <crypt.h>
-#endif
-
-int
-main (int argc, char** argv)
-{
-  {
-    char *p = crypt("abcdef", "xz");
-    volatile size_t z = strlen(p);
-  }
-  {
-    char *p = crypt("abcdef", "$1$");
-    volatile size_t z = strlen(p);
-  }
-  {
-    char *p = crypt("abcdef", "$5$");
-    volatile size_t z = strlen(p);
-  }
-  {
-    char *p = crypt("abcdef", "$6$");
-    volatile size_t z = strlen(p);
-  }
-}
--- a/gnu/packages/patches/clang-cling-runtime-13-glibc-2.36-compat.patch
+++ b/gnu/packages/patches/clang-cling-runtime-13-glibc-2.36-compat.patch
@ -1,50 +0,0 @@
-This commit is from upstream and is included in the llvm-15 release
-
-commit b379129c4beb3f26223288627a1291739f33af02
-Author: Fangrui Song <i@maskray.me>
-Date:   Mon Jul 11 11:38:28 2022 -0700
-
-    [sanitizer] Remove #include <linux/fs.h> to resolve fsconfig_command/mount_attr conflict with glibc 2.36
-    
-    It is generally not a good idea to mix usage of glibc headers and Linux UAPI
-    headers (https://sourceware.org/glibc/wiki/Synchronizing_Headers). In glibc
-    since 7eae6a91e9b1670330c9f15730082c91c0b1d570 (milestone: 2.36), sys/mount.h
-    defines `fsconfig_command` which conflicts with linux/mount.h:
-    
-        .../usr/include/linux/mount.h:95:6: error: redeclaration of ‘enum fsconfig_command’
-    
-    Remove #include <linux/fs.h> which pulls in linux/mount.h. Expand its 4 macros manually.
-    
-    Fix https://github.com/llvm/llvm-project/issues/56421
-    
-    Reviewed By: #sanitizers, vitalybuka, zatrazz
-    
-    Differential Revision: https://reviews.llvm.org/D129471
-
-diff --git a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-index 4bd425435d56..81740bf4ab39 100644
--- a/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-+++ b/compiler-rt/lib/sanitizer_common/sanitizer_platform_limits_posix.cpp
-@@ -73,7 +73,6 @@
- #include <sys/vt.h>
- #include <linux/cdrom.h>
- #include <linux/fd.h>
-#include <linux/fs.h>
- #include <linux/hdreg.h>
- #include <linux/input.h>
- #include <linux/ioctl.h>
-@@ -876,10 +875,10 @@ unsigned struct_ElfW_Phdr_sz = sizeof(Elf_Phdr);
-   unsigned IOCTL_EVIOCGPROP = IOCTL_NOT_PRESENT;
-   unsigned IOCTL_EVIOCSKEYCODE_V2 = IOCTL_NOT_PRESENT;
- #endif
-  unsigned IOCTL_FS_IOC_GETFLAGS = FS_IOC_GETFLAGS;
-  unsigned IOCTL_FS_IOC_GETVERSION = FS_IOC_GETVERSION;
-  unsigned IOCTL_FS_IOC_SETFLAGS = FS_IOC_SETFLAGS;
-  unsigned IOCTL_FS_IOC_SETVERSION = FS_IOC_SETVERSION;
-+  unsigned IOCTL_FS_IOC_GETFLAGS = _IOR('f', 1, long);
-+  unsigned IOCTL_FS_IOC_GETVERSION = _IOR('v', 1, long);
-+  unsigned IOCTL_FS_IOC_SETFLAGS = _IOW('f', 2, long);
-+  unsigned IOCTL_FS_IOC_SETVERSION = _IOW('v', 2, long);
-   unsigned IOCTL_GIO_CMAP = GIO_CMAP;
-   unsigned IOCTL_GIO_FONT = GIO_FONT;
-   unsigned IOCTL_GIO_UNIMAP = GIO_UNIMAP;
--- a/gnu/packages/patches/cling-use-shared-library.patch
+++ b/gnu/packages/patches/cling-use-shared-library.patch
@ -1,107 +0,0 @@
-Upstream status: https://github.com/root-project/root/pull/15563
-
-diff --git a/interpreter/cling/CMakeLists.txt b/interpreter/cling/CMakeLists.txt
-index 9775b07f10..7028042096 100644
--- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -13,81 +13,22 @@ endif(WIN32)
- if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
-   project(Cling)
- 
-  # Rely on llvm-config.
-  set(CONFIG_OUTPUT)
-  find_program(LLVM_CONFIG "llvm-config")
-  if(LLVM_CONFIG)
-    message(STATUS "Found LLVM_CONFIG as ${LLVM_CONFIG}")
-    set(CONFIG_COMMAND ${LLVM_CONFIG}
-      "--assertion-mode"
-      "--bindir"
-      "--libdir"
-      "--includedir"
-      "--prefix")
-    execute_process(
-      COMMAND ${CONFIG_COMMAND}
-      RESULT_VARIABLE HAD_ERROR
-      OUTPUT_VARIABLE CONFIG_OUTPUT
-    )
-    if(NOT HAD_ERROR)
-      string(REGEX REPLACE
-        "[ \t]*[\r\n]+[ \t]*" ";"
-        CONFIG_OUTPUT ${CONFIG_OUTPUT})
-    else()
-      string(REPLACE ";" " " CONFIG_COMMAND_STR "${CONFIG_COMMAND}")
-      message(STATUS "${CONFIG_COMMAND_STR}")
-      message(FATAL_ERROR "llvm-config failed with status ${HAD_ERROR}")
-    endif()
-  else()
-    message(FATAL_ERROR "llvm-config not found -- ${LLVM_CONFIG}")
-  endif()
-+  # See <https://llvm.org/docs/CMake.html#embedding-llvm-in-your-project>.
-+  find_package(LLVM REQUIRED CONFIG)
-+  message(STATUS "Found LLVM ${LLVM_PACKAGE_VERSION}")
-+  message(STATUS "Using LLVMConfig.cmake in: ${LLVM_DIR}")
- 
-  list(GET CONFIG_OUTPUT 0 ENABLE_ASSERTIONS)
-  list(GET CONFIG_OUTPUT 1 TOOLS_BINARY_DIR)
-  list(GET CONFIG_OUTPUT 2 LIBRARY_DIR)
-  list(GET CONFIG_OUTPUT 3 INCLUDE_DIR)
-  list(GET CONFIG_OUTPUT 4 LLVM_OBJ_ROOT)
-
-  if(NOT MSVC_IDE)
-    set(LLVM_ENABLE_ASSERTIONS ${ENABLE_ASSERTIONS}
-      CACHE BOOL "Enable assertions")
-    # Assertions should follow llvm-config's.
-    mark_as_advanced(LLVM_ENABLE_ASSERTIONS)
-  endif()
-+  separate_arguments(LLVM_DEFINITIONS_LIST NATIVE_COMMAND ${LLVM_DEFINITIONS})
-+  add_definitions(${LLVM_DEFINITIONS_LIST})
- 
-  set(LLVM_TOOLS_BINARY_DIR ${TOOLS_BINARY_DIR} CACHE PATH "Path to llvm/bin")
-  set(LLVM_LIBRARY_DIR ${LIBRARY_DIR} CACHE PATH "Path to llvm/lib")
-  set(LLVM_MAIN_INCLUDE_DIR ${INCLUDE_DIR} CACHE PATH "Path to llvm/include")
-  set(LLVM_BINARY_DIR ${LLVM_OBJ_ROOT} CACHE PATH "Path to LLVM build tree")
-+  find_package(Clang REQUIRED CONFIG)
-+  message(STATUS "Found supported version: Clang ${CLANG_PACKAGE_VERSION}")
-+  message(STATUS "Using ClangConfig.cmake in: ${Clang_DIR}")
- 
-   find_program(LLVM_TABLEGEN_EXE "llvm-tblgen" ${LLVM_TOOLS_BINARY_DIR}
-     NO_DEFAULT_PATH)
- 
-  set(LLVM_CMAKE_PATH "${LLVM_BINARY_DIR}/lib${LLVM_LIBDIR_SUFFIX}/cmake/llvm")
-  set(LLVMCONFIG_FILE "${LLVM_CMAKE_PATH}/LLVMConfig.cmake")
-  if(EXISTS ${LLVMCONFIG_FILE})
-    list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_PATH}")
-    include(${LLVMCONFIG_FILE})
-  else()
-    message(FATAL_ERROR "Not found: ${LLVMCONFIG_FILE}")
-  endif()
-
-  # They are used as destination of target generators.
-  set(LLVM_RUNTIME_OUTPUT_INTDIR ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin)
-  set(LLVM_LIBRARY_OUTPUT_INTDIR ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
-  if(WIN32 OR CYGWIN)
-    # DLL platform -- put DLLs into bin.
-    set(LLVM_SHLIB_OUTPUT_INTDIR ${LLVM_RUNTIME_OUTPUT_INTDIR})
-  else()
-    set(LLVM_SHLIB_OUTPUT_INTDIR ${LLVM_LIBRARY_OUTPUT_INTDIR})
-  endif()
-
-  option(LLVM_INSTALL_TOOLCHAIN_ONLY
-    "Only include toolchain files in the 'install' target." OFF)
-
-  option(LLVM_FORCE_USE_OLD_HOST_TOOLCHAIN
-    "Set to ON to force using an old, unsupported host toolchain." OFF)
-
-+  list(APPEND CMAKE_MODULE_PATH "${LLVM_CMAKE_DIR}")
-   include(AddLLVM)
-   include(TableGen)
-   include(HandleLLVMOptions)
-@@ -99,7 +40,7 @@ if( CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR )
-     set(LLVM_INCLUDE_TESTS ON)
-   endif()
- 
-  include_directories("${LLVM_BINARY_DIR}/include" "${LLVM_MAIN_INCLUDE_DIR}")
-+  include_directories("${LLVM_INCLUDE_DIRS}")
-   link_directories("${LLVM_LIBRARY_DIR}")
- 
-   set( CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin )
--- a/gnu/packages/patches/ddd-build.patch
+++ b/gnu/packages/patches/ddd-build.patch
@ -0,0 +1,24 @@
+Add missing '-I' flag.
+
+--- old/ddd/Makefile.am	(revision 7508)
+++ new/ddd/Makefile.am	(working copy)
+@@ -655,7 +655,7 @@
+ LIBXFT = @XFT_LIBS@ -lfontconfig
+
+ # Freetype2 headers
+-XFTINCLUDE = @XFT_INCLUDE@
+XFTINCLUDE = -I@XFT_INCLUDE@
+
+ # X Miscellaneous  Utilities needed for Athena and Motif >= 2.0 (lXmu)
+ LIBXMU = @XMU_LIBS@
+--- old/ddd/Makefile.in	(revision 7508)
+++ new/ddd/Makefile.in	(working copy)
+@@ -1307,7 +1307,7 @@
+ LIBXFT = @XFT_LIBS@ -lfontconfig
+
+ # Freetype2 headers
+-XFTINCLUDE = @XFT_INCLUDE@
+XFTINCLUDE = -I@XFT_INCLUDE@
+
+ # X Miscellaneous  Utilities needed for Athena and Motif >= 2.0 (lXmu)
+ LIBXMU = @XMU_LIBS@
--- a/gnu/packages/patches/libguestfs-syms.patch
+++ b/gnu/packages/patches/libguestfs-syms.patch
@ -0,0 +1,44 @@
+diff -urN a/lib/Makefile.am b/lib/Makefile.am
+
+Without this patch the build phase fails during linking with:
+
+ld:./libguestfs.syms: file format not recognized; treating as linker script
+ld:./libguestfs.syms:23: syntax error
+collect2: error: ld returned 1 exit status
+make[3]: *** [Makefile:1252: libguestfs.la] Error 1
+make[3]: *** Waiting for unfinished jobs....
+Wide character in print at /tmp/guix-build-libguestfs-1.53.6.drv-0/libguestfs-1.50.1/podwrapper.pl line 633.
+touch stamp-guestfs.pod
+make[3]: Leaving directory '/tmp/guix-build-libguestfs-1.53.6.drv-0/libguestfs-1.50.1/lib'
+make[2]: *** [Makefile:1161: all] Error 2
+make[2]: Leaving directory '/tmp/guix-build-libguestfs-1.53.6.drv-0/libguestfs-1.50.1/lib'
+make[1]: *** [Makefile:1083: all-recursive] Error 1
+make[1]: Leaving directory '/tmp/guix-build-libguestfs-1.53.6.drv-0/libguestfs-1.50.1'
+make: *** [Makefile:989: all] Error 2
+error: in phase 'build': uncaught exception:
+
+--- a/lib/Makefile.am	2023-07-20 17:35:16.489080853 +0200
+++ b/lib/Makefile.am	2023-07-20 17:35:47.305793499 +0200
+@@ -160,8 +160,7 @@
+ # Force libtool to name the library 'libguestfs.so.0.$(MAX_PROC_NR).0'.
+ # Include the version script to limit which symbols are exported.
+ libguestfs_la_LDFLAGS = \
+-	-version-info $(MAX_PROC_NR):0:$(MAX_PROC_NR) \
+-	$(VERSION_SCRIPT_FLAGS)$(srcdir)/libguestfs.syms
+	-version-info $(MAX_PROC_NR):0:$(MAX_PROC_NR)
+ 
+ if HAVE_FUSE
+ # XXX Unfortunately FUSE_CFLAGS defines _FILE_OFFSET_BITS=64.
+diff -urN a/lib/Makefile.in b/lib/Makefile.in
+--- a/lib/Makefile.in	2023-07-20 17:35:16.489080853 +0200
+++ b/lib/Makefile.in	2023-07-20 17:36:05.474213641 +0200
+@@ -1109,8 +1109,7 @@
+ # Force libtool to name the library 'libguestfs.so.0.$(MAX_PROC_NR).0'.
+ # Include the version script to limit which symbols are exported.
+ libguestfs_la_LDFLAGS = \
+-	-version-info $(MAX_PROC_NR):0:$(MAX_PROC_NR) \
+-	$(VERSION_SCRIPT_FLAGS)$(srcdir)/libguestfs.syms
+	-version-info $(MAX_PROC_NR):0:$(MAX_PROC_NR)
+ 
+ @HAVE_LIBVIRT_TRUE@libvirt_is_version_SOURCES = libvirt-is-version.c
+ @HAVE_LIBVIRT_TRUE@libvirt_is_version_LDADD = \
--- a/gnu/packages/patches/librewolf-add-paths-to-rdd-allowlist.patch
+++ b/gnu/packages/patches/librewolf-add-paths-to-rdd-allowlist.patch
@ -1,11 +0,0 @@
--- a/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-+++ b/security/sandbox/linux/broker/SandboxBrokerPolicyFactory.cpp
-@@ -920,6 +920,8 @@
-   policy->AddDir(rdonly, "/usr/lib64");
-   policy->AddDir(rdonly, "/run/opengl-driver/lib");
-   policy->AddDir(rdonly, "/nix/store");
-+  policy->AddDir(rdonly, "/gnu/store");
-+  policy->AddDir(rdonly, "/run/current-system/profile/lib");
-
-   // Bug 1647957: memory reporting.
-   AddMemoryReporting(policy.get(), aPid);
--- a/gnu/packages/patches/python-angr-addition-type-error.patch
+++ b/gnu/packages/patches/python-angr-addition-type-error.patch
@ -1,18 +0,0 @@
-This fixes failures of the test_ln_gcc_O2 and other related tests
-in the angr test suite.  The patch has been proposed upstream.
-
-Taken form: https://github.com/angr/angr/pull/4443
-
-diff --git a/angr/analyses/reassembler.py b/angr/analyses/reassembler.py
-index 7a2399a60..b09b3a8cb 100644
--- a/angr/analyses/reassembler.py
-+++ b/angr/analyses/reassembler.py
-@@ -730,7 +730,7 @@ class Instruction:
-             elif operand.type == capstone.CS_OP_MEM:
-                 operand_offsets.append(capstone_instr.disp_offset)
-             else:
-                operand_offsets.append(None)
-+                operand_offsets.append(0)
- 
-         if self.addr is not None:
-             self._initialize(capstone_instr.operands, operand_offsets)
--- a/gnu/packages/patches/python-angr-check-exec-deps.patch
+++ b/gnu/packages/patches/python-angr-check-exec-deps.patch
@ -8,11 +8,11 @@ For Guix, this files as the glibc shared objects cannot be found.
 Additionally, we don't really want to execute pre-compiled binaries
 on Guix, hence we disable those tests.

-diff --git a/tests/test_ctype_locale.py b/tests/test_ctype_locale.py
-index 08cb89836..2b9233558 100644
--- a/tests/test_ctype_locale.py
-+++ b/tests/test_ctype_locale.py
-@@ -14,7 +14,7 @@ test_location = os.path.dirname(os.path.abspath(__file__))
+diff --git a/tests/procedures/glibc/test_ctype_locale.py b/tests/procedures/glibc/test_ctype_locale.py
+index ac3e1ee16..1fb0fd095 100755
+--- a/tests/procedures/glibc/test_ctype_locale.py
+++ b/tests/procedures/glibc/test_ctype_locale.py
+@@ -15,7 +15,7 @@ test_location = os.path.join(bin_location, "tests")
 
 
 class TestCtypeLocale(unittest.TestCase):
@ -21,7 +21,7 @@ index 08cb89836..2b9233558 100644
     def test_ctype_b_loc(self):
         """
         test_ctype_locale.test_ctype_b_loc
-@@ -60,7 +60,7 @@ class TestCtypeLocale(unittest.TestCase):
+@@ -61,7 +61,7 @@ class TestCtypeLocale(unittest.TestCase):
         output = subprocess.check_output(bin_path, shell=True)
         assert result == output
 
@ -30,7 +30,7 @@ index 08cb89836..2b9233558 100644
     def test_ctype_tolower_loc(self):
         """
         test_ctype_locale.test_ctype_tolower_loc
-@@ -109,7 +109,7 @@ class TestCtypeLocale(unittest.TestCase):
+@@ -110,7 +110,7 @@ class TestCtypeLocale(unittest.TestCase):
         output = subprocess.check_output(bin_path, shell=True)
         assert result == output
 
@ -39,50 +39,24 @@ index 08cb89836..2b9233558 100644
     def test_ctype_toupper_loc(self):
         """
         test_ctype_locale.test_ctype_toupper_loc
-diff --git a/tests/test_signed_div.py b/tests/test_signed_div.py
-index 59cb9b8d1..994ed9c65 100644
--- a/tests/test_signed_div.py
-+++ b/tests/test_signed_div.py
-@@ -1,6 +1,7 @@
- import angr
- import subprocess
- import sys
-+import pytest
- 
- import logging
- 
-@@ -13,7 +14,7 @@ import os
- test_location = os.path.dirname(os.path.realpath(__file__))
- 
- 
-@skipUnless(sys.platform.startswith("linux"), "linux only")
-+@pytest.mark.skip(reason="test executes pre-compiled binaries")
- def test_signed_div():
-     test_bin = os.path.join(test_location, "..", "..", "binaries", "tests", "x86_64", "test_signed_div")
-     b = angr.Project(test_bin, auto_load_libs=False)
-diff --git a/tests/test_sscanf.py b/tests/test_sscanf.py
-index 29d2c8403..ea799b310 100644
--- a/tests/test_sscanf.py
-+++ b/tests/test_sscanf.py
-@@ -1,3 +1,4 @@
-+import pytest
- import angr
- import subprocess
- import sys
-@@ -14,7 +15,7 @@ test_location = os.path.dirname(os.path.realpath(__file__))
+diff --git a/tests/procedures/libc/test_sscanf.py b/tests/procedures/libc/test_sscanf.py
+index 7c2da6f5e..e20952f54 100755
+--- a/tests/procedures/libc/test_sscanf.py
+++ b/tests/procedures/libc/test_sscanf.py
+@@ -14,7 +14,7 @@ test_location = os.path.join(bin_location, "tests")
 
 
 class TestSscanf(unittest.TestCase):
 -    @unittest.skipUnless(sys.platform.startswith("linux"), "linux only")
 +    @unittest.skip("test executes pre-compiled binaries")
     def test_sscanf(self):
-         test_bin = os.path.join(test_location, "..", "..", "binaries", "tests", "x86_64", "sscanf_test")
+         test_bin = os.path.join(test_location, "x86_64", "sscanf_test")
         b = angr.Project(test_bin, auto_load_libs=False)
-diff --git a/tests/test_strtol.py b/tests/test_strtol.py
-index 6c29cab22..f36181407 100644
--- a/tests/test_strtol.py
-+++ b/tests/test_strtol.py
-@@ -11,7 +11,7 @@ class TestStrtol(unittest.TestCase):
+diff --git a/tests/procedures/libc/test_strtol.py b/tests/procedures/libc/test_strtol.py
+index 4d7982b86..8818ced3b 100755
+--- a/tests/procedures/libc/test_strtol.py
+++ b/tests/procedures/libc/test_strtol.py
+@@ -15,7 +15,7 @@ class TestStrtol(unittest.TestCase):
     # pylint: disable=no-self-use
 
     @slow_test
@ -91,3 +65,24 @@ index 6c29cab22..f36181407 100644
     def test_strtol(self, threads=None):
         test_bin = os.path.join(bin_location, "tests", "x86_64", "strtol_test")
         # disabling auto_load_libs increases the execution time of the test case.
+diff --git a/tests/sim/exec_insn/test_signed_div.py b/tests/sim/exec_insn/test_signed_div.py
+index 46581020f..d5acc5370 100755
+--- a/tests/sim/exec_insn/test_signed_div.py
+++ b/tests/sim/exec_insn/test_signed_div.py
+@@ -2,6 +2,7 @@
+ # pylint: disable=missing-class-docstring,no-self-use,line-too-long
+ __package__ = __package__ or "tests.sim.exec_insn"  # pylint:disable=redefined-builtin
+ 
+import pytest
+ import os
+ import subprocess
+ import sys
+@@ -16,7 +17,7 @@ test_location = os.path.join(bin_location, "tests")
+ 
+ 
+ class TestSignedDiv(TestCase):
+-    @skipUnless(sys.platform.startswith("linux"), "linux only")
+    @pytest.mark.skip(reason="test executes pre-compiled binaries")
+     def test_signed_div(self):
+         test_bin = os.path.join(test_location, "x86_64", "test_signed_div")
+         b = angr.Project(test_bin, auto_load_libs=False)
--- a/gnu/packages/patches/python-pyvex-remove-angr-dependency.patch
+++ b/gnu/packages/patches/python-pyvex-remove-angr-dependency.patch
@ -1,80 +0,0 @@
-This patch removes the angr dependency from the pyvex these, thus
-resolving a circular dependency (as angr depends on pyvex). This
-patch has been taken from upstream.
-
-This patch is a squashed version of the following upstream patches:
-
-* https://github.com/angr/pyvex/commit/61fb26f223a8d8a276b702d2448a12e02c5c9c6b
-* https://github.com/angr/pyvex/commit/a1fb2a4d0826b0e43bd8bbdd00b6db032643ec95
-
-diff --git a/tests/test_spotter.py b/tests/test_spotter.py
-index 9271ccd..bed7dd4 100644
--- a/tests/test_spotter.py
-+++ b/tests/test_spotter.py
-@@ -1,6 +1,5 @@
- import os
- 
-import angr
- import archinfo
- 
- import pyvex
-@@ -98,53 +97,28 @@ class CortexSpotter(GymratLifter):
- register(CortexSpotter, "ARMEL")
- 
- 
-def test_full_binary():
-    p = angr.Project(
-        os.path.join(test_location, "armel", "RTOSDemo.axf.issue_685"),
-        arch="ARMEL",
-        auto_load_libs=False,
-    )
-    st = p.factory.call_state(0x000013CE + 1)
-    b = st.block().vex
-    simgr = p.factory.simulation_manager(st)
-    simgr.step()
-    assert b.jumpkind == "Ijk_Sys_syscall"
-    assert simgr.active[0].regs.ip_at_syscall.args[0] == 0x13FB
-
-
- def test_tmrs():
-    test_location = str(os.path.join(os.path.dirname(os.path.realpath(__file__)), "../../binaries/tests"))
-    p = angr.Project(
-        os.path.join(test_location, "armel", "helloworld"),
-        arch="ARMEL",
-        auto_load_libs=False,
-    )
-+    arch = archinfo.arch_from_id("ARMEL")
-     ins = b"\xef\xf3\x08\x82"
-    b = pyvex.block.IRSB(ins, 1, p.arch)
-+    b = pyvex.block.IRSB(ins, 1, arch)
-     assert b.jumpkind == "Ijk_Boring"
-     assert type(b.statements[1].data) == pyvex.expr.Get
-    assert p.arch.register_names.get(b.statements[1].data.offset, "") == "sp"
-+    assert arch.register_names.get(b.statements[1].data.offset, "") == "sp"
-     assert type(b.statements[2]) == pyvex.stmt.Put
- 
- 
- def test_tmsr():
-    test_location = str(os.path.join(os.path.dirname(os.path.realpath(__file__)), "../../binaries/tests"))
-    p = angr.Project(
-        os.path.join(test_location, "armel", "helloworld"),
-        arch="ARMEL",
-        auto_load_libs=False,
-    )
-+    arch = archinfo.arch_from_id("ARMEL")
-     inss = b"\x82\xf3\x08\x88"
-    b = pyvex.block.IRSB(inss, 1, p.arch, opt_level=3)
-+    b = pyvex.block.IRSB(inss, 1, arch, opt_level=3)
-     assert b.jumpkind == "Ijk_Boring"
-     assert type(b.statements[1].data) == pyvex.expr.Get
-    assert p.arch.register_names.get(b.statements[1].data.offset, "") == "r2"
-+    assert arch.register_names.get(b.statements[1].data.offset, "") == "r2"
-     assert type(b.statements[2]) == pyvex.stmt.Put
- 
- 
- if __name__ == "__main__":
-     test_basic()
-     test_embedded()
-    test_full_binary()
-     test_tmrs()
-     test_tmsr()
--- a/gnu/packages/patches/retroarch-improved-search-paths.patch
+++ b/gnu/packages/patches/retroarch-improved-search-paths.patch
@ -0,0 +1,298 @@
+Allows discovery of assets file via the LIBRETRO_ASSETS_DIRECTORY environment
+variable.
+
+Upstream-status: https://github.com/libretro/RetroArch/pull/17054
+
+diff --git a/configuration.c b/configuration.c
+index 5808a3f21c..0cc2909102 100644
+--- a/configuration.c
+++ b/configuration.c
+@@ -3573,6 +3573,11 @@ static bool config_load_file(global_t *global,
+ {
+    unsigned i;
+    char tmp_str[PATH_MAX_LENGTH];
+   char* libretro_directory                        = NULL;
+   char* libretro_assets_directory                 = NULL;
+   char* libretro_autoconfig_directory             = NULL;
+   char* libretro_video_filter_directory           = NULL;
+   char* libretro_video_shader_directory           = NULL;
+    static bool first_load                          = true;
+    bool without_overrides                          = false;
+    unsigned msg_color                              = 0;
+@@ -3848,12 +3853,6 @@ static bool config_load_file(global_t *global,
+          strlcpy(path_settings[i].ptr, tmp_str, PATH_MAX_LENGTH);
+    }
+ 
+-#if !IOS
+-   if (config_get_path(conf, "libretro_directory", tmp_str, sizeof(tmp_str)))
+-      configuration_set_string(settings,
+-            settings->paths.directory_libretro, tmp_str);
+-#endif
+-
+ #ifdef RARCH_CONSOLE
+    if (conf)
+       video_driver_load_settings(global, conf);
+@@ -3861,6 +3860,20 @@ static bool config_load_file(global_t *global,
+ 
+    /* Post-settings load */
+ 
+   libretro_directory = getenv("LIBRETRO_DIRECTORY");
+   if (libretro_directory) {
+      configuration_set_string(settings,
+            settings->paths.directory_libretro, libretro_directory);
+      configuration_set_string(settings,
+            settings->paths.path_libretro_info, libretro_directory);
+   }
+
+   libretro_autoconfig_directory = getenv("LIBRETRO_AUTOCONFIG_DIRECTORY");
+   if (libretro_autoconfig_directory)
+       configuration_set_string(settings,
+				settings->paths.directory_autoconfig,
+				libretro_autoconfig_directory);
+
+    if (     (rarch_flags & RARCH_FLAGS_HAS_SET_USERNAME)
+          && (override_username))
+    {
+@@ -4032,15 +4045,27 @@ static bool config_load_file(global_t *global,
+       *settings->paths.path_menu_wallpaper = '\0';
+    if (string_is_equal(settings->paths.path_rgui_theme_preset, "default"))
+       *settings->paths.path_rgui_theme_preset = '\0';
+-   if (string_is_equal(settings->paths.directory_video_shader, "default"))
+   libretro_video_shader_directory = getenv("LIBRETRO_VIDEO_SHADER_DIRECTORY");
+   if (libretro_video_shader_directory) { /* override configuration value */
+      configuration_set_string(settings, settings->paths.directory_video_shader,
+			       libretro_video_shader_directory);
+   } else if (string_is_equal(settings->paths.directory_video_shader, "default"))
+       *settings->paths.directory_video_shader = '\0';
+-   if (string_is_equal(settings->paths.directory_video_filter, "default"))
+   libretro_video_filter_directory = getenv("LIBRETRO_VIDEO_FILTER_DIRECTORY");
+   if (libretro_video_filter_directory) { /* override configuration value */
+       configuration_set_string(settings, settings->paths.directory_video_filter,
+				libretro_video_filter_directory);
+   } else if (string_is_equal(settings->paths.directory_video_filter, "default"))
+       *settings->paths.directory_video_filter = '\0';
+    if (string_is_equal(settings->paths.directory_audio_filter, "default"))
+       *settings->paths.directory_audio_filter = '\0';
+    if (string_is_equal(settings->paths.directory_core_assets, "default"))
+       *settings->paths.directory_core_assets = '\0';
+-   if (string_is_equal(settings->paths.directory_assets, "default"))
+   libretro_assets_directory = getenv("LIBRETRO_ASSETS_DIRECTORY");
+   if (libretro_assets_directory) { /* override configuration value */
+      configuration_set_string(settings,
+           settings->paths.directory_assets, libretro_assets_directory);
+   } else if (string_is_equal(settings->paths.directory_assets, "default"))
+       *settings->paths.directory_assets = '\0';
+ #ifdef _3DS
+    if (string_is_equal(settings->paths.directory_bottom_assets, "default"))
+diff --git a/docs/retroarch.6 b/docs/retroarch.6
+index 7478040e17..f864e0e0d5 100644
+--- a/docs/retroarch.6
+++ b/docs/retroarch.6
+@@ -1,6 +1,6 @@
+ .\" retroarch.6:
+ 
+-.TH  "RETROARCH" "6" "November 1, 2011" "RETROARCH" "System Manager's Manual: retroarch"
+.TH  "RETROARCH" "6" "September 28, 2024" "RETROARCH" "System Manager's Manual: retroarch"
+ 
+ .SH NAME
+ 
+@@ -239,3 +239,36 @@ Disables all kinds of content patching.
+ .TP
+ \fB-D, --detach\fR
+ Detach from the current console. This is currently only relevant for Microsoft Windows.
+
+.SH ENVIRONMENT
+\fBretroarch\fR honors the following environment variables:
+
+.TP
+\fBLIBRETRO_DIRECTORY\fR
+Specify the directory where RetroArch looks for core and info files,
+overriding the value of the "libretro_directory" configuration file
+option.
+
+.TP
+\fBLIBRETRO_ASSETS_DIRECTORY\fR
+Specify the directory where RetroArch looks for assets, overriding
+the value of the "assets_directory" configuration file
+option.
+
+.TP
+\fBLIBRETRO_AUTOCONFIG_DIRECTORY\fR
+Specify the directory where RetroArch looks for controller
+auto-configuration files, overriding the value of the
+"joypad_autoconfig_dir" configuration file option.
+
+.TP
+\fBLIBRETRO_VIDEO_FILTER_DIRECTORY\fR
+Specify the directory where RetroArch looks for video filters,
+overriding the value of the "video_filter_dir" configuration file
+option.
+
+.TP
+\fBLIBRETRO_VIDEO_SHADER_DIRECTORY\fR
+Specify the directory where RetroArch looks for video shaders,
+overriding the value of the "video_shader_dir" configuration file
+option.
+diff --git a/frontend/drivers/platform_unix.c b/frontend/drivers/platform_unix.c
+index c157d355a1..ddf0b5ca87 100644
+--- a/frontend/drivers/platform_unix.c
+++ b/frontend/drivers/platform_unix.c
+@@ -1324,6 +1324,10 @@ static void frontend_unix_get_env(int *argc,
+ {
+    unsigned i;
+    const char* libretro_directory = getenv("LIBRETRO_DIRECTORY");
+   const char* libretro_assets_directory = getenv("LIBRETRO_ASSETS_DIRECTORY");
+   const char* libretro_autoconfig_directory = getenv("LIBRETRO_AUTOCONFIG_DIRECTORY");
+   const char* libretro_video_filter_directory = getenv("LIBRETRO_VIDEO_FILTER_DIRECTORY");
+   const char* libretro_video_shader_directory = getenv("LIBRETRO_VIDEO_SHADER_DIRECTORY");
+ #ifdef ANDROID
+    int32_t major, minor, rel;
+    char device_model[PROP_VALUE_MAX]  = {0};
+@@ -1765,12 +1769,20 @@ static void frontend_unix_get_env(int *argc,
+             "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+    else
+ #endif
+-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
+-         "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+   if (!string_is_empty(libretro_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], libretro_directory,
+            sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+   else
+      fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], base_path,
+            "cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+ #endif
+-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG], base_path,
+-         "autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+-
+   if (!string_is_empty(libretro_autoconfig_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG],
+	    libretro_autoconfig_directory,
+            sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+   else
+       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG], base_path,
+            "autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+ #ifdef ASSETS_DIR
+    if (path_is_directory(ASSETS_DIR "/assets"))
+       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
+@@ -1778,7 +1790,10 @@ static void frontend_unix_get_env(int *argc,
+             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+    else
+ #endif
+-   if (path_is_directory("/usr/local/share/retroarch/assets"))
+   if (!string_is_empty(libretro_assets_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_ASSETS], libretro_assets_directory,
+	      sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+   else if (path_is_directory("/usr/local/share/retroarch/assets"))
+       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_ASSETS],
+             "/usr/local/share/retroarch",
+             "assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+@@ -1838,7 +1853,11 @@ static void frontend_unix_get_env(int *argc,
+             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+    else
+ #endif
+-   if (path_is_directory("/usr/local/share/retroarch/filters/video"))
+   if (!string_is_empty(libretro_video_filter_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
+	      libretro_video_filter_directory,
+	      sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+   else if (path_is_directory("/usr/local/share/retroarch/filters/video"))
+       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
+             "/usr/local/share/retroarch",
+             "filters/video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+@@ -1872,8 +1891,13 @@ static void frontend_unix_get_env(int *argc,
+          "records", sizeof(g_defaults.dirs[DEFAULT_DIR_RECORD_OUTPUT]));
+    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_DATABASE], base_path,
+          "database/rdb", sizeof(g_defaults.dirs[DEFAULT_DIR_DATABASE]));
+-   fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_SHADER], base_path,
+-         "shaders", sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+   if (!string_is_empty(libretro_video_shader_directory))
+       strlcpy(g_defaults.dirs[DEFAULT_DIR_SHADER],
+	       libretro_video_shader_directory,
+	       sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+   else
+       fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_SHADER], base_path,
+             "shaders", sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_CHEATS], base_path,
+          "cheats", sizeof(g_defaults.dirs[DEFAULT_DIR_CHEATS]));
+    fill_pathname_join(g_defaults.dirs[DEFAULT_DIR_OVERLAY], base_path,
+diff --git a/frontend/drivers/platform_win32.c b/frontend/drivers/platform_win32.c
+index 26ed25c04f..0cc9a9dc95 100644
+--- a/frontend/drivers/platform_win32.c
+++ b/frontend/drivers/platform_win32.c
+@@ -565,24 +565,38 @@ static void frontend_win32_env_get(int *argc, char *argv[],
+ {
+    const char *tmp_dir = getenv("TMP");
+    const char *libretro_directory = getenv("LIBRETRO_DIRECTORY");
+   const char *libretro_assets_directory = getenv("LIBRETRO_ASSETS_DIRECTORY");
+   const char* libretro_autoconfig_directory = getenv("LIBRETRO_AUTOCONFIG_DIRECTORY");
+   const char* libretro_video_filter_directory = getenv("LIBRETRO_VIDEO_FILTER_DIRECTORY");
+   const char* libretro_video_shader_directory = getenv("LIBRETRO_VIDEO_SHADER_DIRECTORY");
+    if (!string_is_empty(tmp_dir))
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CACHE],
+          tmp_dir, sizeof(g_defaults.dirs[DEFAULT_DIR_CACHE]));
+ 
+    gfx_set_dwm();
+ 
+-   fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_ASSETS],
+-      ":\\assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+   if (!string_is_empty(libretro_assets_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_ASSETS], libretro_assets_directory,
+	      sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+   else
+       fill_pathname_expand_special(
+	   g_defaults.dirs[DEFAULT_DIR_ASSETS],
+	   ":\\assets", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER],
+       ":\\filters\\audio", sizeof(g_defaults.dirs[DEFAULT_DIR_AUDIO_FILTER]));
+-   fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
+-      ":\\filters\\video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+   if (!string_is_empty(libretro_video_filter_directory))
+       strlcpy(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
+	       libretro_video_filter_directory,
+	       sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+   else
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER],
+           ":\\filters\\video", sizeof(g_defaults.dirs[DEFAULT_DIR_VIDEO_FILTER]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CHEATS],
+       ":\\cheats", sizeof(g_defaults.dirs[DEFAULT_DIR_CHEATS]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_DATABASE],
+       ":\\database\\rdb", sizeof(g_defaults.dirs[DEFAULT_DIR_DATABASE]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_PLAYLIST],
+-      ":\\playlists", sizeof(g_defaults.dirs[DEFAULT_DIR_ASSETS]));
+      ":\\playlists", sizeof(g_defaults.dirs[DEFAULT_DIR_PLAYLIST]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_RECORD_CONFIG],
+       ":\\config\\record", sizeof(g_defaults.dirs[DEFAULT_DIR_RECORD_CONFIG]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_RECORD_OUTPUT],
+@@ -605,12 +619,26 @@ static void frontend_win32_env_get(int *argc, char *argv[],
+    else
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CORE],
+             ":\\cores", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE]));
+-   fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CORE_INFO],
+-      ":\\info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+-   fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG],
+-      ":\\autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+-   fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_SHADER],
+-      ":\\shaders", sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+   if (!string_is_empty(libretro_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_CORE_INFO], libretro_directory,
+            sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+   else
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CORE_INFO],
+           ":\\info", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_INFO]));
+   if (!string_is_empty(libretro_autoconfig_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG],
+	      libretro_autoconfig_directory,
+	      sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+   else
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG],
+             ":\\autoconfig", sizeof(g_defaults.dirs[DEFAULT_DIR_AUTOCONFIG]));
+   if (!string_is_empty(libretro_video_filter_directory))
+      strlcpy(g_defaults.dirs[DEFAULT_DIR_SHADER],
+	      libretro_video_shader_directory,
+	      sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+   else
+       fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_SHADER],
+             ":\\shaders", sizeof(g_defaults.dirs[DEFAULT_DIR_SHADER]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_CORE_ASSETS],
+       ":\\downloads", sizeof(g_defaults.dirs[DEFAULT_DIR_CORE_ASSETS]));
+    fill_pathname_expand_special(g_defaults.dirs[DEFAULT_DIR_SCREENSHOT],
--- a/gnu/packages/patches/retroarch-unbundle-spirv-cross.patch
+++ b/gnu/packages/patches/retroarch-unbundle-spirv-cross.patch
@ -0,0 +1,92 @@
+Upstream-status: https://github.com/libretro/RetroArch/issues/17079
+
+diff --git a/Makefile.common b/Makefile.common
+index 8ba76cf6c7..e9e8b8a643 100644
+--- a/Makefile.common
+++ b/Makefile.common
+@@ -1869,6 +1869,7 @@ endif
+ 
+ ifeq ($(HAVE_SPIRV_CROSS), 1)
+    DEFINES += -DHAVE_SPIRV_CROSS
+ifeq ($(HAVE_BUILTINSPIRV_CROSS), 1)
+    INCLUDE_DIRS += -I$(DEPS_DIR)/SPIRV-Cross
+    OBJ += $(DEPS_DIR)/SPIRV-Cross/spirv_cross.o
+    OBJ += $(DEPS_DIR)/SPIRV-Cross/spirv_cfg.o
+@@ -1877,6 +1878,13 @@ ifeq ($(HAVE_SPIRV_CROSS), 1)
+    OBJ += $(DEPS_DIR)/SPIRV-Cross/spirv_msl.o
+    OBJ += $(DEPS_DIR)/SPIRV-Cross/spirv_parser.o
+    OBJ += $(DEPS_DIR)/SPIRV-Cross/spirv_cross_parsed_ir.o
+else
+   CXXFLAGS += $(SPIRV_CROSS_CFLAGS)
+   LIBS += -lspirv-cross-core \
+           -lspirv-cross-glsl \
+           -lspirv-cross-reflect \
+           -lspirv-cross-msl
+endif
+ endif
+ 
+ ifeq ($(WANT_WGL), 1)
+diff --git a/qb/config.libs.sh b/qb/config.libs.sh
+index 2daa6b5e45..649a62690d 100644
+--- a/qb/config.libs.sh
+++ b/qb/config.libs.sh
+@@ -32,7 +32,10 @@ CLIB=-lc
+ PTHREADLIB=-lpthread
+ SOCKETLIB=-lc
+ SOCKETHEADER=
+-INCLUDES='usr/include usr/local/include'
+TR='tr'
+INCLUDES="$(echo $C_INCLUDE_PATH | $TR ':' ' ') \
+$(echo $CPLUS_INCLUDE_PATH | $TR ':' ' ') \
+usr/include usr/local/include"
+ SORT='sort'
+ EXTRA_GL_LIBS=''
+ VC_PREFIX=''
+@@ -625,6 +628,7 @@ check_enabled CXX GLSLANG glslang 'The C++ compiler is' false
+ check_enabled CXX SPIRV_CROSS SPIRV-Cross 'The C++ compiler is' false
+ 
+ check_enabled GLSLANG BUILTINGLSLANG 'builtin glslang' 'glslang is' true
+check_enabled SPIRV_CROSS BUILTINSPIRV_CROSS 'builtin spirv-cross' 'spirv-cross is' true
+ 
+ if [ "$HAVE_GLSLANG" != no ]; then
+    check_header cxx GLSLANG \
+@@ -657,6 +661,27 @@ if [ "$HAVE_GLSLANG" != no ]; then
+    fi
+ fi
+ 
+if [ "$HAVE_SPIRV_CROSS" != no ]; then
+   check_lib cxx SPIRV_CROSS -lspirv-cross-core '' '' 'spirv_cross.hpp' 'spirv_cross'
+   check_lib cxx SPIRV_CROSS_GLSL -lspirv-cross-glsl
+   check_lib cxx SPIRV_CROSS_MSL -lspirv-cross-msl
+   check_lib cxx SPIRV_CROSS_REFLECT -lspirv-cross-reflect
+   if [ "$HAVE_SPIRV_CROSS" = no ] ||
+      [ "$HAVE_SPIRV_CROSS_GLSL" = no ] ||
+      [ "$HAVE_SPIRV_CROSS_MSL" = no ] ||
+      [ "$HAVE_SPIRV_CROSS_REFLECT" = no ]; then
+      if [ "$HAVE_BUILTINSPIRV_CROSS" != yes ]; then
+         die : "Notice: System spirv-cross libraries not found, \
+disabling spirv-cross support"
+         HAVE_SPIRV_CROSS=no
+      else
+         HAVE_SPIRV_CROSS=yes
+      fi
+   else
+      HAVE_SPIRV_CROSS=yes
+   fi
+fi
+
+ if [ "$HAVE_CRTSWITCHRES" != no ]; then
+    if [ "$HAVE_CXX11" = 'no' ]; then
+       HAVE_CRTSWITCHRES=no
+diff --git a/qb/config.params.sh b/qb/config.params.sh
+index 1f1ea15637..a1653cb3cf 100644
+--- a/qb/config.params.sh
+++ b/qb/config.params.sh
+@@ -191,6 +191,7 @@ C89_GLSLANG=no
+ HAVE_BUILTINGLSLANG=auto   # Bake in glslang support
+ C89_BUILTINGLSLANG=no
+ HAVE_SPIRV_CROSS=auto      # SPIRV-Cross support (requires C++11)
+HAVE_BUILTINSPIRV_CROSS=auto    # Use bundled SPIRV-Cross source
+ C89_SPIRV_CROSS=no
+ HAVE_METAL=no              # Metal support (macOS-only)
+ C89_METAL=no
--- a/gnu/packages/patches/scilab-tbx_build_help.patch
+++ b/gnu/packages/patches/scilab-tbx_build_help.patch
@ -1,38 +1,35 @@
-From c59d78c5a5c8c187450f157cf7f8480455e8e6a2 Mon Sep 17 00:00:00 2001
+From 24a9bc240729b7630e20a7b83b75f086024ae03d Mon Sep 17 00:00:00 2001
 From: Nicolas Graves <ngraves@ngraves.fr>
-Date: Wed, 3 Apr 2024 03:32:23 +0200
+Date: Wed, 21 Aug 2024 15:42:35 +0200
 Subject: [PATCH] scilab: tbx_build_help: Allow for some flexibility under
 -nwni.

 upstream reference: https://gitlab.com/scilab/scilab/-/merge_requests/818
-
 ---
- .../modules_manager/macros/tbx_build_help.sci        | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
+ scilab/modules/modules_manager/macros/tbx_build_help.sci | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)

 diff --git a/scilab/modules/modules_manager/macros/tbx_build_help.sci b/scilab/modules/modules_manager/macros/tbx_build_help.sci
-index 7862e33a868..5593ee3dc04 100644
+index ab06b3fa8dc..cbb1b4cadf8 100644
 --- a/scilab/modules/modules_manager/macros/tbx_build_help.sci
 +++ b/scilab/modules/modules_manager/macros/tbx_build_help.sci
-@@ -58,12 +58,12 @@ function tbx_build_help(moduletitle, path)
+@@ -57,8 +57,8 @@ function tbx_build_help(moduletitle, path)
 
     // Check scilab mode
     if and(getscilabmode() <> ["STD" "NW"]) then
 -        error(msprintf(gettext("%s: documentation cannot be built in this scilab mode: %s.\n"),"tbx_build_help",getscilabmode()));
+-    end
 +        msprintf(gettext("%s: documentation cannot be built in this scilab mode: %s.\n"),"tbx_build_help",getscilabmode());
 +    else
-+        directory_language = basename(path);
-+        default_language = "en_US"
-+
-+        xmltojar(path, moduletitle, directory_language, default_language);
-     end
 
-    directory_language = basename(path);
-    default_language = "en_US"
-
-    xmltojar(path, moduletitle, directory_language, default_language);
-
+     directory_language = basename(path);
+     default_language = "en_US"
+@@ -89,4 +89,5 @@ function tbx_build_help(moduletitle, path)
+         warning(_(".start file was not found, build of help pages using <scilab:image> tag may failed."));
+         xmltojar(path, moduletitle, directory_language, default_language);
+     end
+    end
 endfunction
 -- 
-2.41.0
+2.45.2

--- a/gnu/packages/patches/u-boot-build-without-libcrypto.patch
+++ b/gnu/packages/patches/u-boot-build-without-libcrypto.patch
@ -1,123 +0,0 @@
-From 03e598263e3878b6f5d58f5525577903edadc644 Mon Sep 17 00:00:00 2001
-From: Paul-Erwan Rio <paulerwan.rio@gmail.com>
-Date: Thu, 21 Dec 2023 08:26:11 +0100
-Subject: [PATCH] tools: fix build without LIBCRYPTO support
-
-Commit cb9faa6f98ae ("tools: Use a single target-independent config to
-enable OpenSSL") introduced a target-independent configuration to build
-crypto features in host tools.
-
-But since commit 2c21256b27d7 ("hash: Use Kconfig to enable hashing in
-host tools and SPL") the build without OpenSSL is broken, due to FIT
-signature/encryption features. Add missing conditional compilation
-tokens to fix this.
-
-Signed-off-by: Paul-Erwan Rio <paulerwan.rio@gmail.com>
-Tested-by: Alexander Dahl <ada@thorsis.com>
-Cc: Simon Glass <sjg@chromium.org>
-Reviewed-by: Tom Rini <trini@konsulko.com>
-Reviewed-by: Simon Glass <sjg@chromium.org>
---
- include/image.h    | 2 +-
- tools/Kconfig      | 1 +
- tools/fit_image.c  | 2 +-
- tools/image-host.c | 4 ++++
- tools/mkimage.c    | 5 +++--
- 5 files changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/include/image.h b/include/image.h
-index 432ec927b1..21de70f0c9 100644
--- a/include/image.h
-+++ b/include/image.h
-@@ -1465,7 +1465,7 @@ int calculate_hash(const void *data, int data_len, const char *algo,
-  * device
-  */
- #if defined(USE_HOSTCC)
-# if defined(CONFIG_FIT_SIGNATURE)
-+# if CONFIG_IS_ENABLED(FIT_SIGNATURE)
- #  define IMAGE_ENABLE_SIGN	1
- #  define FIT_IMAGE_ENABLE_VERIFY	1
- #  include <openssl/evp.h>
-diff --git a/tools/Kconfig b/tools/Kconfig
-index f8632cd59d..f01ed783e6 100644
--- a/tools/Kconfig
-+++ b/tools/Kconfig
-@@ -51,6 +51,7 @@ config TOOLS_FIT_RSASSA_PSS
- 	  Support the rsassa-pss signature scheme in the tools builds
- 
- config TOOLS_FIT_SIGNATURE
-+	depends on TOOLS_LIBCRYPTO
- 	def_bool y
- 	help
- 	  Enable signature verification of FIT uImages in the tools builds
-diff --git a/tools/fit_image.c b/tools/fit_image.c
-index 71e031c855..beef1fa86e 100644
--- a/tools/fit_image.c
-+++ b/tools/fit_image.c
-@@ -61,7 +61,7 @@ static int fit_add_file_data(struct image_tool_params *params, size_t size_inc,
- 		ret = fit_set_timestamp(ptr, 0, time);
- 	}
- 
-	if (!ret)
-+	if (CONFIG_IS_ENABLED(FIT_SIGNATURE) && !ret)
- 		ret = fit_pre_load_data(params->keydir, dest_blob, ptr);
- 
- 	if (!ret) {
-diff --git a/tools/image-host.c b/tools/image-host.c
-index ca4950312f..90bc9f905f 100644
--- a/tools/image-host.c
-+++ b/tools/image-host.c
-@@ -14,8 +14,10 @@
- #include <image.h>
- #include <version.h>
- 
-+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
- #include <openssl/pem.h>
- #include <openssl/evp.h>
-+#endif
- 
- /**
-  * fit_set_hash_value - set hash value in requested has node
-@@ -1131,6 +1133,7 @@ static int fit_config_add_verification_data(const char *keydir,
- 	return 0;
- }
- 
-+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
- /*
-  * 0) open file (open)
-  * 1) read certificate (PEM_read_X509)
-@@ -1239,6 +1242,7 @@ int fit_pre_load_data(const char *keydir, void *keydest, void *fit)
-  out:
- 	return ret;
- }
-+#endif
- 
- int fit_cipher_data(const char *keydir, void *keydest, void *fit,
- 		    const char *comment, int require_keys,
-diff --git a/tools/mkimage.c b/tools/mkimage.c
-index 6dfe3e1d42..ac62ebbde9 100644
--- a/tools/mkimage.c
-+++ b/tools/mkimage.c
-@@ -115,7 +115,7 @@ static void usage(const char *msg)
- 		"          -B => align size in hex for FIT structure and header\n"
- 		"          -b => append the device tree binary to the FIT\n"
- 		"          -t => update the timestamp in the FIT\n");
-#ifdef CONFIG_FIT_SIGNATURE
-+#if CONFIG_IS_ENABLED(FIT_SIGNATURE)
- 	fprintf(stderr,
- 		"Signing / verified boot options: [-k keydir] [-K dtb] [ -c <comment>] [-p addr] [-r] [-N engine]\n"
- 		"          -k => set directory containing private keys\n"
-@@ -130,8 +130,9 @@ static void usage(const char *msg)
- 		"          -o => algorithm to use for signing\n");
- #else
- 	fprintf(stderr,
-		"Signing / verified boot not supported (CONFIG_FIT_SIGNATURE undefined)\n");
-+		"Signing / verified boot not supported (CONFIG_TOOLS_FIT_SIGNATURE undefined)\n");
- #endif
-+
- 	fprintf(stderr, "       %s -V ==> print version information and exit\n",
- 		params.cmdname);
- 	fprintf(stderr, "Use '-T list' to see a list of available image types\n");
-- 
-2.41.0
-
--- a/gnu/packages/patches/u-boot-nanopi-r4s-ddr3.patch
+++ b/gnu/packages/patches/u-boot-nanopi-r4s-ddr3.patch
@ -0,0 +1,35 @@
+Someone created a thread on the U-Boot mailing list [1], referencing work
+done to support variants of RK3399 SoCs with different types of DRAM [2].
+This patch configures the Nano Pi R4S to use DDR3 instead of LPDDR4, but
+will be removed once [2] is included in a future U-Boot release.  This
+patch was created around April 2023 by Herman Rimm <herman@rimm.ee> for
+personal use and has only been submitted to GNU Guix.
+
+[1]: https://patchwork.ozlabs.org/project/uboot/patch/WwCslkoi6ts6A8RCd6KlxuRAMpItkfneEG-3BbNbG61gWVz0A2A3-0hl_Jg7W9quLr19luuiiT7naEi7djncCaEruUOnVq3pnb9dQFU_GqY=@protonmail.com/#2973664
+[2]: https://github.com/anaelorlinski/OpenWrt-NanoPi-R2S-R4S-Builds/commit/9d836044340ddef53f5d9f1946ac48c946a78284
+
+diff --git a/arch/arm/dts/rk3399-nanopi-r4s-u-boot.dtsi b/arch/arm/dts/rk3399-nanopi-r4s-u-boot.dtsi
+index 69800cc368..a3054849f8 100644
+--- a/arch/arm/dts/rk3399-nanopi-r4s-u-boot.dtsi
+++ b/arch/arm/dts/rk3399-nanopi-r4s-u-boot.dtsi
+@@ -13,7 +13,7 @@
+  */
+ 
+ #include "rk3399-nanopi4-u-boot.dtsi"
+-#include "rk3399-sdram-lpddr4-100.dtsi"
+#include "rk3399-sdram-ddr3-1866.dtsi"
+ 
+ / {
+ 	smbios {
+diff --git a/configs/nanopi-r4s-rk3399_defconfig b/configs/nanopi-r4s-rk3399_defconfig
+index 4f4363cb0f..bfa7ee628d 100644
+--- a/configs/nanopi-r4s-rk3399_defconfig
+++ b/configs/nanopi-r4s-rk3399_defconfig
+@@ -54,7 +54,6 @@ CONFIG_PMIC_RK8XX=y
+ CONFIG_REGULATOR_PWM=y
+ CONFIG_REGULATOR_RK8XX=y
+ CONFIG_PWM_ROCKCHIP=y
+-CONFIG_RAM_ROCKCHIP_LPDDR4=y
+ CONFIG_BAUDRATE=1500000
+ CONFIG_DEBUG_UART_SHIFT=2
+ CONFIG_SYS_NS16550_MEM32=y
--- a/gnu/packages/photo.scm
+++ b/gnu/packages/photo.scm
@ -823,14 +823,14 @@ (define-public hugin
 (define-public rawtherapee
  (package
    (name "rawtherapee")
-    (version "5.10")
+    (version "5.11")
    (source (origin
              (method url-fetch)
              (uri (string-append "https://rawtherapee.com/shared/source/"
                                  "rawtherapee-" version ".tar.xz"))
              (sha256
               (base32
-                "1nnjxc6xyfn1biys5hynsd21rny5r7zl5qvr2hhlmfjdslybb6d7"))))
+                "0977dnik78szwznl4knabigah0m394a4gdmjajcy4b8ixj6w3175"))))
    (build-system cmake-build-system)
    (arguments
     (list
@ -848,7 +848,9 @@ (define-public rawtherapee
              ;; See the file 'RELEASE_NOTES.txt' in the source distribution.
              "-DCMAKE_CXX_FLAGS=-O3 -fPIC"
              "-DCMAKE_C_FLAGS=-O3 -fPIC"
-              "-DCACHE_NAME_SUFFIX=\"\"")))
+              "-DCACHE_NAME_SUFFIX=\"\""
+              "-DWITH_JXL=ON"
+              "-DWITH_SYSTEM_LIBRAW=ON")))
    (native-inputs
     (list pkg-config))
    (inputs
@ -864,8 +866,10 @@ (define-public rawtherapee
           libcanberra
           libiptcdata
           libjpeg-turbo
+           libjxl
           libpng
           (librsvg-for-system)
+           libraw
           libsigc++
           libtiff
           zlib))
--- a/gnu/packages/prolog.scm
+++ b/gnu/packages/prolog.scm
@ -182,7 +182,7 @@ (define bin `(,(string-append #$output "/bin")))
 (define-public trealla
  (package
    (name "trealla")
-    (version "2.56.0")
+    (version "2.56.4")
    (source
     (origin
       (method git-fetch)
@ -191,7 +191,7 @@ (define-public trealla
         (url "https://github.com/trealla-prolog/trealla")
         (commit (string-append "v" version))))
       (sha256
-        (base32 "0dpjz2qfnbm6ls7wd8radfywa2vd32zckarbic1ka4gjsii95ir6"))
+        (base32 "0wr33z3rcmfwq7793k3q3lh45d5p5hl8c6pnwjj0gipcxgyh8nnm"))
       (file-name (git-file-name name version))))
    (build-system gnu-build-system)
    (native-inputs
--- a/gnu/packages/python-check.scm
+++ b/gnu/packages/python-check.scm
@ -1784,6 +1784,44 @@ (define-public python-pytest-celery
     "This package provides a shim Pytest plugin to enable a Celery marker.")
    (license license:bsd-3)))

+(define-public python-pytest-cython
+  (package
+    (name "python-pytest-cython")
+    (version "0.3.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pytest-cython" version))
+       (sha256
+        (base32 "0ma496dgmmrpgqd3zk6vin29dgajcplh63yqd8jh2a3ai954fr22"))))
+    (build-system pyproject-build-system)
+    (arguments
+     (list
+      #:test-flags
+      #~(list "tests"
+              ;; FIXME: Failed: nomatch: '*sqr*PASSED*
+              "-k" (string-append
+                    "not test_wrap_cpp_ext_module[importlib]"
+                    " and not test_wrap_c_ext_module[importlib]"
+                    " and not test_cython_ext_module[importlib]"))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-before 'check 'build-extensions
+            (lambda _
+              (with-directory-excursion "tests/example-project"
+                (invoke "python" "setup.py" "build_ext" "--inplace")))))))
+    (native-inputs
+     (list python-nox
+           python-cython-3
+           python-setuptools))
+    (propagated-inputs
+     (list python-pytest-8))
+    (home-page "https://github.com/lgpage/pytest-cython")
+    (synopsis "Cython extension modules testing plugin")
+    (description
+     "This package provides a plugin for testing Cython extension modules.")
+    (license license:expat)))
+
 (define-public python-pytest-env
  (package
    (name "python-pytest-env")
--- a/gnu/packages/python-science.scm
+++ b/gnu/packages/python-science.scm
@ -25,6 +25,7 @@
 ;;; Copyright © 2023, 2024 Troy Figiel <troy@troyfigiel.com>
 ;;; Copyright © 2024 Sharlatan Hellseher <sharlatanus@gmail.com>
 ;;; Copyright © 2024 Marco Baggio <marco.baggio@mdc-berlin.de>
+;;; Copyright © 2024 Nicolas Graves <ngraves@ngraves.fr>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -3475,6 +3476,45 @@ (define-public python-pynrrd
 and from numpy arrays.")
    (license license:expat)))

+(define-public python-pynsee
+  (package
+    (name "python-pynsee")
+    (version "0.1.8")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pynsee" version))
+       (sha256
+        (base32 "1w084ynwdd9f4wpcnakqc0nxcbj9gr8vppv4rd258i3dp1qq4sw5"))))
+    (build-system pyproject-build-system)
+    (arguments (list #:tests? #f))  ; XXX: Tests require network access.
+    (native-inputs
+     (list python-setuptools
+           python-wheel))
+    (propagated-inputs
+     (list python-appdirs
+           python-openpyxl
+           python-pandas
+           python-platformdirs
+           python-pyarrow
+           python-requests
+           python-shapely
+           python-tqdm
+           python-unidecode
+           python-urllib3
+           python-xlrd))
+    (home-page "https://pynsee.readthedocs.io")
+    (synopsis
+     "Tools to Easily Search and Download French Data From INSEE and IGN APIs")
+    (description
+     "This package provides tools to easily search and download French data
+from INSEE and IGN APIs.  This data includes more than 150 000 macroeconomic
+series, a dozen datasets of local french data, numerous sources available on
+@url{insee.fr}, geographical limits of administrative areas taken from IGN as
+well as key metadata and SIRENE database containing data on all French
+compagnies.")
+    (license license:expat)))
+
 (define-public python-libneuroml
  (package
    (name "python-libneuroml")
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@ -23859,6 +23859,27 @@ (define-public python-pypeg2
     parse many formal languages.")
    (license license:gpl2)))

+(define-public python-pyformlang
+  (package
+    (name "python-pyformlang")
+    (version "1.0.10")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (pypi-uri "pyformlang" version))
+       (sha256
+        (base32 "0szgy4pqfixmswjs37qgma4qa3bsadpp3l1xflrpfi10aa8hh2sp"))))
+    (build-system pyproject-build-system)
+    (propagated-inputs (list python-networkx python-numpy python-pydot))
+    (home-page "https://github.com/Aunsiels/pyformlang")
+    (synopsis "Framework for interacting with formal grammars")
+    (description
+     "This package provides a framework for working with formal
+language grammars.  The library was originally developed for educational
+purposes and therefore implements many textbook algorithms regarding the
+manipulation and interaction with formal grammars.")
+    (license license:expat)))
+
 (define-public python-incremental
  (package
    (name "python-incremental")
@ -25010,7 +25031,7 @@ (define-public python-prov
                (("\\.serialize\\(format=\"nt\"\\)")
                 ".serialize(format=\"nt\", encoding=\"utf-8\")")))))))
    (propagated-inputs
-     (list python-dateutil python-lxml python-networkx python-rdflib))
+     (list python-dateutil python-lxml python-networkx python-rdflib-6))
    (native-inputs
     (list graphviz python-pydot))
    (home-page "https://github.com/trungdong/prov")
@ -31012,6 +31033,36 @@ (define-public python-json-logger
 we can stop writing custom parsers for syslog-type records.")
    (license license:bsd-3)))

+(define-public python-unique-log-filter
+  (package
+    (name "python-unique-log-filter")
+    (version "0.1.0")
+    (source
+     ;; The version on pypi does not include test files.
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/twizmwazin/unique_log_filter")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "036mh6nqskck2fa1q2inasqxb9wcz2p09qcpldnnffzcy1a6kzba"))))
+    (build-system pyproject-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      (when tests?
+                        (invoke "python" "test_unique_log_filter.py")))))))
+    (native-inputs (list python-flit-core))
+    (home-page "https://github.com/twizmwazin/unique_log_filter")
+    (synopsis "Log filter that removes duplicate log messages")
+    (description
+     "This library provides a filter for the @code{logging} module
+from the Python standard library which allows removing duplicate log
+messages.")
+    (license license:bsd-2)))
+
 (define-public python-daiquiri
  (package
    (name "python-daiquiri")
@ -32413,23 +32464,25 @@ (define-public python-pypandoc
       (sha256
        (base32
         "0l6a8ngzpx363q2jskxxkx6psfhqrvc4js80dmn16r3vw6m2cb40"))))
-    (build-system python-build-system)
-    (inputs
-     (list pandoc python-pandocfilters))
-    (propagated-inputs
-     `(("wheel" ,python-wheel)))
-    (native-inputs
-     `(("texlive" ,(texlive-updmap.cfg (list texlive-lm texlive-xcolor)))))
+    (build-system pyproject-build-system)
    (arguments
-     `(#:phases
-       (modify-phases %standard-phases
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
          (add-before 'check 'disable-tests
            (lambda _
              ;; Disable test requiring network access
              (substitute* "tests.py"
                (("test_basic_conversion_from_http_url")
-                "skip_test_basic_conversion_from_http_url"))
-             #t)))))
+                 "skip_test_basic_conversion_from_http_url")))))))
+    (native-inputs
+     (list python-poetry-core
+           (texlive-updmap.cfg
+            (list texlive-etoolbox texlive-lm texlive-xcolor))))
+    (inputs
+     (list pandoc python-pandocfilters))
+    (propagated-inputs
+     (list python-wheel))
    (home-page "https://github.com/bebraw/pypandoc")
    (synopsis "Python wrapper for pandoc")
    (description "pypandoc is a thin Python wrapper around pandoc
@ -34055,17 +34108,47 @@ (define-public python-opcodes
 and BMI2).")
      (license license:bsd-2))))

+(define-public python-cart
+  (package
+    (name "python-cart")
+    (version "1.2.2")
+    (source
+     (origin
+       ;; No source releases available on pypi, hence fetching from GitHub.
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://github.com/CybercentreCanada/cart")
+             (commit (string-append "v" version))))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1zycv620iljrsval5rai1wsn0hr25ddx9xhjsyy6xxrgprfxvlfi"))))
+    (build-system pyproject-build-system)
+    (arguments
+     `(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      (when tests?
+                        (invoke "python" "-m" "unittest" "discover")))))))
+    (propagated-inputs (list python-pycryptodome))
+    (home-page "https://github.com/CybercentreCanada/cart")
+    (synopsis "Library for interacting with the CaRT file format")
+    (description
+     "This Python library implements the CaRT file format which is commonly
+used to store and transmit information about computer malware and associated
+metadata.")
+    (license license:bsd-2)))
+
 (define-public python-ailment
  (package
    (name "python-ailment")
    ;; Must be the same version as python-angr.
-    (version "9.2.46")
+    (version "9.2.112")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "ailment" version))
       (sha256
-        (base32 "073fcssbjis1ckwv2w0dcz2dfl6715bj4d4qdhspajj911mvng2f"))))
+        (base32 "1rv8rwvdm7fc9mf8z5hqb54dsj0n7jlnwghd12ll0b2jmh2ix8mn"))))
    (build-system pyproject-build-system)
    (arguments
     `(#:phases (modify-phases %standard-phases
@ -34087,19 +34170,19 @@ (define-public python-cle
  (package
    (name "python-cle")
    ;; Must be the same version as python-angr.
-    (version "9.2.46")
+    (version "9.2.112")
    (source
     (origin
       (method url-fetch)
       (uri (pypi-uri "cle" version))
       (sha256
-        (base32 "0mswv9gd2p2ws7zfsshqv5ybbj27wkdwakdcknq4vsrx9ry9k4yc"))))
+        (base32 "11jbvg12wqxz74iy83ax0q8k156xrw6iqv75dix5cpqgacds3gdj"))))
    (build-system pyproject-build-system)
    (arguments
     (list
      #:tests? #f))
    (propagated-inputs (list python-pefile python-pyelftools python-pyvex
-                             python-sortedcontainers))
+                             python-sortedcontainers python-cart))
    (native-inputs (list python-cffi))
    (home-page "https://github.com/angr/cle")
    (synopsis "Python loader for binaries and their associated libraries")
@ -34113,14 +34196,13 @@ (define-public python-pyvex
  (package
    (name "python-pyvex")
    ;; Must be the same version as python-angr.
-    (version "9.2.46")
+    (version "9.2.112")
    (source
     (origin
       (method url-fetch)
-       (patches (search-patches "python-pyvex-remove-angr-dependency.patch"))
       (uri (pypi-uri "pyvex" version))
       (sha256
-        (base32 "1v64rn7gxy6fg065bgsy38z6r494k5ri5r6sn4g08hjj32ihx1ka"))))
+        (base32 "0z1jiflp7h07mfc26am3v7v5z2n6mw9hkfylbs86qgpm93qcf6i3"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@ -34149,7 +34231,7 @@ (define-public python-claripy
  (package
    (name "python-claripy")
    ;; Must be the same version as python-angr.
-    (version "9.2.46")
+    (version "9.2.112")
    (source
     (origin
       ;; Fetching from Git as pypi release doesn't include all test files.
@ -34159,13 +34241,13 @@ (define-public python-claripy
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "0nmawpi1596d9plafrp2db36cjsidy2fagkzkja51jwlx2m1ngai"))
+        (base32 "0c6q6imxjwhxn87d9yz8zvyrszk94r25w8x0g1lr6mrpa9bx7wai"))
       (modules '((guix build utils)))
       (snippet '(begin
                   (substitute* "setup.cfg"
                     ;; Relax the z3 version constraint.
                     ;; See https://github.com/angr/claripy/commit/d1fe2df
-                     (("z3-solver==4.10.2.0")
+                     (("z3-solver==4.13.0.0")
                      ""))))))
    (build-system pyproject-build-system)
    (arguments
@ -34337,19 +34419,18 @@ (define-public python-itanium-demangler
 (define-public python-angr
  (package
    (name "python-angr")
-    (version "9.2.46")
+    (version "9.2.112")
    (source
     (origin
       ;; Fetching from Git as pypi release doesn't include all test files.
       (method git-fetch)
-       (patches (search-patches "python-angr-addition-type-error.patch"
-                                "python-angr-check-exec-deps.patch"))
+       (patches (search-patches "python-angr-check-exec-deps.patch"))
       (uri (git-reference
             (url "https://github.com/angr/angr")
             (commit (string-append "v" version))))
       (file-name (git-file-name name version))
       (sha256
-        (base32 "18y9wyf7va7gvp9zd6lhw82j9a2x2ajsvbawh96xnxzml0jwlwjm"))))
+        (base32 "1179926xbfh2930laz33p90vj532jk7g2qylzzpw1185yhlf9cis"))))
    (build-system pyproject-build-system)
    (arguments
     (list
@ -34357,9 +34438,18 @@ (define-public python-angr
                   (add-after 'unpack 'patch-tests
                     (lambda* (#:key inputs #:allow-other-keys)
                       (let ((coreutils (assoc-ref inputs "coreutils")))
-                         (substitute* "tests/test_vault.py"
-                           (("/bin/false")
-                            (which "false")))
+                         ;; The constraint exists because of a capstone bug for which
+                         ;; we backport a patch, hence we can relax the constraint.
+                         ;;
+                         ;; See https://github.com/angr/angr/issues/4656
+                         (substitute* "setup.cfg"
+                          (("capstone==5.0.0.post1")
+                           "capstone"))
+                         ;; Relax constraint on python-rich, the constraint is too strict,
+                         ;; angr work well with our packaged version of python-rich.
+                         (substitute* "setup.cfg"
+                           (("rich>=13.1.0")
+                            "rich"))
                         (substitute* "tests/common.py"
                           (("\\[\"cc\"\\]")
                            "[\"gcc\"]")))))
@ -34398,11 +34488,13 @@ (define-public python-angr
                             python-itanium-demangler
                             python-pycparser
                             python-pyvex
-                             python-progressbar2
+                             python-pyformlang
+                             python-rich
                             python-rpyc
                             python-sortedcontainers
                             python-sqlalchemy
                             python-sympy
+                             python-unique-log-filter
                             unicorn))
    (native-inputs `(("python-pytest" ,python-pytest)
                     ("python-pytest-xdist" ,python-pytest-xdist)
@ -34420,7 +34512,7 @@ (define-public python-angr
                                                                    version))))
                         (file-name (git-file-name "angr-binaries" version))
                         (sha256 (base32
-                                  "1f286b2239zavxzwg1184hj1zs380cr9qr549mvy3vywvm8bsmgr"))))))
+                                  "0bxzf6alkczv9r0151ksvcwyksnw8077acz1wd8drbxw0zl0qnmr"))))))
    (home-page "https://github.com/angr/angr")
    (synopsis "Multi-architecture binary analysis toolkit")
    (description
--- a/gnu/packages/raspberry-pi.scm
+++ b/gnu/packages/raspberry-pi.scm
@ -19,8 +19,6 @@
 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

 (define-module (gnu packages raspberry-pi)
-  #:use-module (gnu bootloader)
-  #:use-module (gnu bootloader grub)
  #:use-module (gnu packages)
  #:use-module (gnu packages admin)
  #:use-module (gnu packages algebra)
@ -329,22 +327,6 @@ (define (make-raspi-bcm28-dtbs linux)
     (format #f "The device-tree files for Raspberry Pi models from ~a."
             (package-name linux)))))

-(define-public grub-efi-bootloader-chain-raspi-64
-  ;; A bootloader capable to boot a Raspberry Pi over network via TFTP or from
-  ;; a local storage like a micro SD card.  It neither installs firmware nor
-  ;; device-tree files for the Raspberry Pi.  It just assumes them to be
-  ;; existing in boot/efi in the same way that some UEFI firmware with ACPI
-  ;; data is usually assumed to be existing on PCs.  It creates firmware
-  ;; configuration files and a bootloader-chain with U-Boot to provide an EFI
-  ;; API for the final GRUB bootloader.  It also serves as a blue-print to
-  ;; create an a custom bootloader-chain with firmware and device-tree
-  ;; packages or files.
-  (efi-bootloader-chain grub-efi-netboot-removable-bootloader
-                        #:packages (list u-boot-rpi-arm64-efi-bin)
-                        #:files (list %raspi-config-txt
-                                      %raspi-bcm27-dtb-txt
-                                      %raspi-u-boot-bootloader-txt)))
-
 (define (make-raspi-defconfig arch defconfig sha256-as-base32)
  "Make for the architecture ARCH a file-like object from the DEFCONFIG file
 with the hash SHA256-AS-BASE32.  This object can be used as the #:defconfig
--- a/gnu/packages/rdf.scm
+++ b/gnu/packages/rdf.scm
@ -328,6 +328,49 @@ (define-public sord
    (license license:isc)))

 (define-public python-rdflib
+  (package
+    (name "python-rdflib")
+    (version "7.0.0")
+    (source
+      (origin
+        (method url-fetch)
+        (uri (pypi-uri "rdflib" version))
+        (sha256
+         (base32
+          "1blmx4v003afr3l9qg84ymj0sldcbsr2dzdgq6w5k022d62yp5cr"))))
+    (build-system pyproject-build-system)
+    (arguments
+     '(#:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'adjust-tests
+           (lambda _
+             (for-each delete-file
+                       '(;; The tests in this file miss a test fixture.
+                         ;; fixture 'no_cover' not found
+                         "test/test_misc/test_plugins.py"
+                         ;; These tests need internet access.
+                         "test/jsonld/test_onedotone.py"
+                         "test/test_examples.py"
+                         "test/test_extras/test_infixowl/test_basic.py"
+                         "test/test_extras/test_infixowl/test_context.py"
+                         "test/test_sparql/test_service.py"))))
+         (replace 'check
+           (lambda* (#:key tests? #:allow-other-keys)
+             (when tests?
+               (invoke "pytest" "-vv" "test/")))))))
+    (native-inputs
+     (list python-pytest python-poetry-core))
+    (propagated-inputs
+      (list python-html5lib python-isodate python-pyparsing))
+    (home-page "https://github.com/RDFLib/rdflib")
+    (synopsis "Python RDF library")
+    (description
+      "RDFLib is a Python library for working with RDF, a simple yet
+powerful language for representing information.")
+    (license (license:non-copyleft "file://LICENSE"
+                                   "See LICENSE in the distribution."))))
+
+(define-public python-rdflib-6
  (package
    (name "python-rdflib")
    (version "6.1.1")
--- a/gnu/packages/sdl.scm
+++ b/gnu/packages/sdl.scm
@ -608,8 +608,8 @@ (define-public sdl2-ttf
    (properties '((upstream-name . "SDL2_ttf")))))

 (define-public sdl2-gamecontrollerdb
-  (let ((commit "9d0994523206c9d73925d78d185531c4c7331db7")
-        (revision "1"))
+  (let ((commit "414eaee7aacc0d2ccdf281663c3d3bc65a8dbedd")
+        (revision "2"))
    (package
      (name "sdl2-gamecontrollerdb")
      (version (git-version "0" revision commit))
@ -617,15 +617,15 @@ (define-public sdl2-gamecontrollerdb
       (origin
         (method git-fetch)
         (uri (git-reference
-               (url "https://github.com/gabomdq/SDL_GameControllerDB")
+               (url "https://github.com/mdqinc/SDL_GameControllerDB")
               (commit commit)))
         (file-name (git-file-name name version))
         (sha256
-          (base32 "08rv3i6sh90ibphxnv9r6h1zjyq88x9hq3smvf6cnlqvirnam94s"))))
+          (base32 "04x3g7vshagxaklwm5hxawh1pk6j1h0rip9xccpgr1r3gpxqs5df"))))
      (build-system copy-build-system)
      (arguments
       '(#:install-plan '(("gamecontrollerdb.txt" "share/sdl2/"))))
-      (home-page "https://github.com/gabomdq/SDL_GameControllerDB")
+      (home-page "https://github.com/mdqinc/SDL_GameControllerDB")
      (synopsis "SDL2 game controller database")
      (description
       "This package provides a community sourced database of game controller
--- a/gnu/packages/shells.scm
+++ b/gnu/packages/shells.scm
@ -26,6 +26,7 @@
 ;;; Copyright © 2024 Tanguy Le Carrour <tanguy@bioneland.org>
 ;;; Copyright © 2024 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2024 Luís Henriques <henrix@camandro.org>
+;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -916,27 +917,20 @@ (define-public mksh
    (license (list license:miros
                   license:isc))))              ; strlcpy.c

-(define-public oil
+(define-public oils
  (package
-    (name "oil")
-    (version "0.20.0")
+    (name "oils")
+    (version "0.22.0")
    (source
-     ;; oil's sources contain a modified version of CPython 2.7.13.
-     ;; According to https://www.oilshell.org/blog/2017/05/05.html
-     ;; this bundles version of CPython had certain unused parts removed
-     ;; and its build system has been replaced by a custom one.
-     ;; This would probably make it quite complicated to replace the
-     ;; bundled CPython with the one from the python2 package.
     (origin
       (method url-fetch)
-       (uri (string-append "https://www.oilshell.org/download/oil-"
+       (uri (string-append "https://www.oilshell.org/download/oils-for-unix-"
                           version ".tar.gz"))
       (sha256
-        (base32 "1jpxhixwq29ik01jx372g9acib59wmww8lrdlcypq7jpg5b0b7pi"))))
+        (base32 "0pylgbxbnp683g51lcbmmd0y149jm7q7vh8g67yviagsa7clmmks"))))
    (build-system gnu-build-system)
    (arguments
-     (list #:strip-binaries? #f         ; strip breaks the binary
-           #:phases
+     (list #:phases
           #~(modify-phases %standard-phases
               (replace 'configure
                 (lambda _
@ -945,24 +939,40 @@ (define-public oil
                     ((" cc ") " $CC "))
                   (invoke "./configure" (string-append "--prefix=" #$output)
                           "--with-readline")))
+               (replace 'build
+                 (lambda _
+                   (invoke "_build/oils.sh")))
+               (replace 'install
+                 (lambda _
+                   (setenv "PREFIX" #$output)
+                   (invoke "./install")))
               (replace 'check
                 ;; The tests are not distributed in the tarballs but upstream
                 ;; recommends running this smoke test.
-                 ;; https://github.com/oilshell/oil/blob/release/0.8.0/INSTALL.txt#L38-L48
+                 ;; https://github.com/oilshell/oil/blob/release/0.22.0/INSTALL.txt#L30-L50
                 (lambda* (#:key tests? #:allow-other-keys)
                   (when tests?
-                     (let* ((oil "_bin/oil.ovm"))
-                       (invoke/quiet oil "osh" "-c" "echo hi")
-                       (invoke/quiet oil "osh" "-n" "configure"))))))))
+                     (let ((osh "_bin/cxx-opt-sh/osh")
+                           (ysh "_bin/cxx-opt-sh/ysh"))
+                       (invoke/quiet osh "-c" "echo hi")
+                       (invoke/quiet osh "-n" "configure")
+                       (invoke/quiet ysh "-c" "echo hi")
+                       (invoke/quiet ysh "-c"
+                                     "json write ({x: 42})"))))))))
    (inputs
     (list readline))
    (home-page "https://www.oilshell.org")
    (synopsis "Programming language and Bash-compatible Unix shell")
-    (description "Oil is a programming language with automatic translation for
-Bash.  It includes osh, a Unix/POSIX shell that runs unmodified Bash
-scripts.")
-    (license (list license:psfl                 ; tarball includes python2.7
-                   license:asl2.0))))
+    (description "Oils is a programming language with automatic translation for
+Bash.  It includes OSH, a Unix/POSIX shell that runs unmodified Bash
+scripts and YSH is a legacy-free shell, with structured data for Python and
+JavaScript users who avoid shell.")
+    (license (list license:asl2.0))))
+
+(define-public oil
+  ;; Since release 0.16.0 the former Oil project has been renamed to Oils:
+  ;; <https://www.oilshell.org/blog/2023/03/rename.html>.
+  (deprecated-package "oil" oils))

 (define-public gash
  (package
--- a/gnu/packages/statistics.scm
+++ b/gnu/packages/statistics.scm
@ -4892,8 +4892,7 @@ (define-public r-googlesheets
       (method url-fetch)
       (uri (cran-uri "googlesheets" version))
       (sha256
-        (base32
-         "11q07nxys72wkxx9mawmjyf20gvwvrb7h3gpa73h6lgh2vgrwnv8"))))
+        (base32 "13n6vkdcbz78sbxq5xrj0zhq0dpriz6cyq13v3raa92152l88rm5"))))
    (build-system r-build-system)
    (propagated-inputs
     (list r-cellranger
--- a/gnu/packages/sugar.scm
+++ b/gnu/packages/sugar.scm
@ -990,20 +990,16 @@ (define-public sugar-physics-activity
      (license license:gpl3+))))

 (define-public sugar-read-activity
-  (let ((commit "25f69e41a4fa69d93c73c0c9367b4777a014b1cd")
-        (revision "1"))
  (package
    (name "sugar-read-activity")
-      (version (git-version "123" revision commit))
+    (version "124")
    (source (origin
-                (method git-fetch)
-                (uri (git-reference
-                      (url "https://github.com/sugarlabs/read-activity")
-                      (commit commit)))
-                (file-name (git-file-name name version))
+              (method url-fetch)
+              (uri (string-append "https://download.sugarlabs.org/sources/sucrose/fructose/"
+                                  "Read/Read-" version ".tar.bz2"))
              (sha256
               (base32
-                  "03piap3r6j58s38cza55bm16g5icrmnhl0s6kpy5hj46vaa5x4fh"))))
+                "1hla80vclprqzahr8yfnin09spv4mab7il6a00ilz4anyahrzgzy"))))
    (build-system python-build-system)
    (arguments
     (list
@ -1036,7 +1032,7 @@ (define-public sugar-read-activity
 image-based book-like materials.  It will have particular strengths in
 handheld mode, with extremely low power consumption and simple navigation
 controls.")
-      (license license:gpl2+))))
+    (license license:gpl2+)))

 (define-public sugar-river-crossing-activity
  (let ((commit "0abbeb455363672ed29d734e6e48f50ef78ec48b")
--- a/gnu/packages/text-editors.scm
+++ b/gnu/packages/text-editors.scm
@ -25,7 +25,7 @@
 ;;; Copyright © 2022 Foo Chuan Wei <chuanwei.foo@hotmail.com>
 ;;; Copyright © 2022 zamfofex <zamfofex@twdb.moe>
 ;;; Copyright © 2022 Jai Vetrivelan <jaivetrivelan@gmail.com>
-;;; Copyright © 2022 jgart <jgart@dismail.de>
+;;; Copyright © 2022, 2024 jgart <jgart@dismail.de>
 ;;; Copyright © 2022 Andy Tai <atai@atai.org>
 ;;; Copyright © 2022 ( <paren@disroot.org>
 ;;; Copyright © 2023 Eidvilas Markevičius <markeviciuseidvilas@gmail.com>
@ -55,6 +55,7 @@ (define-module (gnu packages text-editors)
  #:use-module (guix gexp)
  #:use-module (guix git-download)
  #:use-module (guix utils)
+  #:use-module (guix build-system asdf)
  #:use-module (guix build-system cargo)
  #:use-module (guix build-system cmake)
  #:use-module (guix build-system gnu)
@ -92,6 +93,8 @@ (define-module (gnu packages text-editors)
  #:use-module (gnu packages image)
  #:use-module (gnu packages lesstif)
  #:use-module (gnu packages libbsd)
+  #:use-module (gnu packages lisp-check)
+  #:use-module (gnu packages lisp-xyz)
  #:use-module (gnu packages llvm)
  #:use-module (gnu packages lua)
  #:use-module (gnu packages ncurses)
@ -144,6 +147,116 @@ (define-public ed
 extensions over the standard utility.")
    (license license:gpl3+)))

+(define-public lem
+  (let ((commit "3f2f0adb6db2dbed57b5cccca34f47ab9d5a2314")
+        (revision "0"))
+    (package
+      (name "lem")
+      (version (git-version "2.2.0" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/lem-project/lem/")
+               (commit commit)))
+         (sha256
+          (base32 "00b4wn75ssywrhr4b7h4vk7hyd6dac2618339k56vg9vwni1bbxi"))
+         (file-name (git-file-name name version))
+         (snippet
+          #~(begin
+              (use-modules (guix build utils))
+              (delete-file-recursively "roswell")
+              ;; Delete precompiled shared object files.
+              (delete-file-recursively "extensions/terminal/lib")))))
+      (build-system asdf-build-system/sbcl)
+      (arguments
+       (list
+        #:phases
+        #~(modify-phases %standard-phases
+            (add-after 'unpack 'patch-shared-object-files
+              (lambda* (#:key inputs outputs #:allow-other-keys)
+                (let* ((libvterm-lib (assoc-ref inputs "libvterm"))
+                       (lib-dir (string-append libvterm-lib "/lib"))
+                       (shared-lib-dir (string-append (assoc-ref outputs "out")
+                                                      "/lib"))
+                       (shared-lib (string-append shared-lib-dir
+                                                  "/terminal.so")))
+
+                  (substitute* "extensions/terminal/ffi.lisp"
+                    (("terminal.so") shared-lib)))))
+            (add-after 'create-asdf-configuration 'build-program
+              (lambda* (#:key outputs #:allow-other-keys)
+                (build-program
+                 (string-append (assoc-ref outputs "out") "/bin/lem")
+                 outputs
+                 #:dependencies '("lem-ncurses" "lem-sdl2")
+                 #:entry-program '((lem:main) 0))))
+            (add-after 'build 'build-terminal-library
+              (lambda* (#:key inputs outputs #:allow-other-keys)
+                (let* ((libvterm-lib (assoc-ref inputs "libvterm"))
+                       (lib-dir (string-append libvterm-lib "/lib"))
+                       (shared-lib-dir (string-append (assoc-ref outputs "out")
+                                                      "/lib"))
+                       (shared-lib (string-append shared-lib-dir
+                                                  "/terminal.so")))
+                  (mkdir-p shared-lib-dir)
+                  (invoke "gcc" "extensions/terminal/terminal.c"
+                          "-L" lib-dir "-lvterm"
+                          "-Wl,-Bdynamic"
+                          "-o" shared-lib
+                          "-fPIC" "-shared")))))))
+      (native-inputs
+       (list sbcl-cl-ansi-text
+             sbcl-rove
+             sbcl-trivial-package-local-nicknames))
+      (inputs
+       (list
+        libvterm
+        sbcl-alexandria
+        sbcl-trivia
+        sbcl-trivial-gray-streams
+        sbcl-trivial-types
+        sbcl-cl-ppcre
+        sbcl-closer-mop
+        sbcl-iterate
+        sbcl-lem-mailbox
+        sbcl-inquisitor
+        sbcl-babel
+        sbcl-bordeaux-threads
+        sbcl-yason
+        sbcl-log4cl
+        sbcl-split-sequence
+        sbcl-cl-str
+        sbcl-dexador
+        sbcl-3bmd
+        sbcl-micros
+        sbcl-lisp-preprocessor
+        sbcl-trivial-ws
+        sbcl-trivial-open-browser
+        sbcl-sdl2
+        sbcl-sdl2-ttf
+        sbcl-sdl2-image
+        sbcl-trivial-main-thread
+        sbcl-cffi
+        sbcl-cl-charms
+        sbcl-cl-setlocale
+        sbcl-log4cl
+        sbcl-jsonrpc
+        sbcl-usocket
+        sbcl-quri
+        sbcl-cl-change-case
+        sbcl-async-process
+        sbcl-cl-iconv
+        sbcl-esrap
+        sbcl-parse-number
+        sbcl-cl-package-locks
+        sbcl-slime-swank
+        sbcl-trivial-utf-8))
+      (home-page "http://lem-project.github.io/")
+      (synopsis "Integrated IDE/editor for Common Lisp")
+      (description "Lem is a Common Lisp editor/IDE with high expansibility.")
+      (license license:expat))))
+
 (define-public vis
  (package
    (name "vis")
--- a/gnu/packages/tmux.scm
+++ b/gnu/packages/tmux.scm
@ -50,7 +50,7 @@ (define-module (gnu packages tmux)
 (define-public tmux
  (package
    (name "tmux")
-    (version "3.5")
+    (version "3.5a")
    (source (origin
              (method git-fetch)
              (uri (git-reference
@ -59,7 +59,7 @@ (define-public tmux
              (file-name (git-file-name name version))
              (sha256
               (base32
-                "1bdah5b8fbxwba3z7i46yx5vcvhwmn7yvdh3wn0in1ijnn7mj97h"))))
+                "14alj3jyy0biyrr5ci39aaw223qq8987r4lg4f0shqvq52kwgmb7"))))
    (build-system gnu-build-system)
    (inputs
     (list libevent ncurses))
--- a/gnu/packages/tor-browsers.scm
+++ b/gnu/packages/tor-browsers.scm
@ -21,7 +21,7 @@
 ;;; Copyright © 2021 Baptiste Strazzul <bstrazzull@hotmail.fr>
 ;;; Copyright © 2022 SeerLite <seerlite@disroot.org>
 ;;; Copyright © 2024 Aleksandr Vityazev <avityazew@gmail.com>
-;;; Copyright © 2020, 2021 André Batista <nandre@riseup.net>
+;;; Copyright © 2020, 2021, 2024 André Batista <nandre@riseup.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -90,77 +90,48 @@ (define-module (gnu packages tor-browsers)
  #:use-module (ice-9 regex)
  #:use-module (guix utils))

-(define (mozilla-locale locale changeset hash-string)
+;; See browser/locales/l10n-changesets.json for the commit.
+(define firefox-locales
+  (let ((commit "d8d587117c7b9dcc6a4fbc38407ed2c831bb008f")
+        (revision "0"))
+    (package
+      (name "firefox-locales")
+      (version (git-version "0.0.0" revision commit))
+      (source
        (origin
-    (method hg-fetch)
-    (uri (hg-reference
-          (url (string-append "https://hg.mozilla.org/l10n-central/"
-                              locale))
-          (changeset changeset)))
-    (file-name (string-append "mozilla-locale-" locale))
-    (sha256 (base32 hash-string))))
-
-(define-syntax-rule (mozilla-locales (hash-string changeset locale) ...)
-  #~(list (cons #$locale #$(mozilla-locale locale changeset hash-string))
-          ...))
-
-;; See tor-browser-build/rbm.conf for the list.
-;; See browser/locales/l10n-changesets.json for the changeset.
-;; See update-mozilla-locales in gnuzilla.scm to automate updating changeset.
-(define %torbrowser-locales
-  (mozilla-locales
-   ;;                      sha256                            changeset    locale
-   ;;---------------------------------------------------------------------------
-   ("1218mldjxybhgzdi0myzkwjr2fgnysl71pl847kr7wyn1j8wk3a5" "c25d00080479" "ar")
-   ("11c96jhfzd3h46qhblhvn2acsn895ykynarai8r5pf0655nfjs0j" "2de60e3d6d0c" "ca")
-   ("0yhycgb3s3kydbzy6f2q7f7g2lp975spr092prf9xp8ha62ghby7" "609edd15f9a9" "cs")
-   ("1kzx94n36c5vv954j7w65djvb37c178zazy25b35l71q2rvhmlhj" "2197a99c9a08" "da")
-   ("13h7hk11bbd0yq8gqdv7ndbizkgwlm3ybz225l3x2b5cnyjxyg14" "b7a533e5edc9" "de")
-   ("13ay27vdrqfv2ysyi7c2jmz50lps7rff9rmnws1z7jkj0a5chwrn" "20baf15379d8" "el")
-   ("0mdr5b6pqxjmg9c8064x3hpf53h6w9j8ghl32655sx9jh4v3ykza" "beff1baac7c5" "es-ES")
-   ("1pnyg09j6r15w8m62lwj89x6rz4br877z60p8s1hlrb9hj2s3vdx" "ebe0b60b0b36" "fa")
-   ("067r505626cvlrsalnndf2ykz3nnkiy0b8yaxzf1rracpzmp0hni" "d5ae6a933d71" "fi")
-   ("0026zzjv2bqc8sg06yvyd0mhny6mwwvhpvzjrhv2fi5v4wkxapdj" "496c2eb73b82" "fr")
-   ("1dxcp26y8siap4k54zsw7mqa7k0l4f1505rdf4hnnxrzf9a643g5" "2fcccb5b19b3" "ga-IE")
-   ("14v6xnlyj65hzaz2rmzxcl4skjgm48426jgr9mwkwiqis587lp4a" "c53cea027f8f" "he")
-   ("04fdw2gzb64fb51bvs0bwsidzlvkdahmcy76vdg3gfcxslnlpi3y" "5a76dd3b5d5c" "hu")
-   ("0bpyxpclfy74bcsjrs1ajh2am4zv6j6j9q4gc4vz8pgvzy9354zp" "6e6de17dcac4" "id")
-   ("131ph8n235kr6nj1pszk0m00nh6kl360r4qvx4hjm8s22mw0k8qd" "536265635dfe" "is")
-   ("03fbp4vgkwyimfmbm4n8blx1m16yhms2wm8j4wlx2h3cpxp5r71k" "91951e37e2b8" "it")
-   ("0ncm531d7ih7phcn9d83zwq0dfphvmzg3gmhqmrrkkbydi1g3pbb" "895dcf8bb524" "ja")
-   ("1x3110v730ak522zfm8j3r3v1x5lq3ig82kcgyxkc49xywajy0ni" "d0819a64fc40" "ka")
-   ("14rc9mr4ngxdzwpjagzhz47jazgp1a6vwb0vbwj31yxv9iwkrgzi" "6ef881aff44b" "ko")
-   ("1gl85z550amhbaxp39zdj6yyvashj9xd4ampfhm9jdpbf6n5j2l8" "afcbc29a15e5" "lt")
-   ("1hz5g3iprfkbd88ncppyksbhlws73lhs75nf62hangw8l73wdn69" "84f3d6c7e2da" "mk")
-   ("14aq37ngnav5m2kcb4wavxwhp28ad4jzdkzc7i64h0qvvxq5n3hf" "c9ec27a5db3d" "ms")
-   ("0h7dlnawm5mbcx4qdlz5c7n4axz2dpa677v13ljdgm2b5w76msmq" "5c1480ccc040" "my")
-   ("1b12azc1n8j1i2l20v66r74q79zqjvc5sf9pd8rmj3xd0fkxzdp2" "fc1896a0a24d" "nb-NO")
-   ("1fh4dhlb6hynlpb2997gssv9v8zk5b7qrw0sclggczb5pcpjk6wc" "7e6da4f01bdb" "nl")
-   ("1w8x3jjrd28f6g6ywwxldizpiipfkr63dzqd74kjpg24s2lqzp80" "e86a451a9cb5" "pl")
-   ("1v3v4n82sn7a4h2d9n653fmgc31mikacf59lvdj6gbwvzpjb5yfa" "94c3dbb67a5d" "pt-BR")
-   ("061a4z0lffgks3wlr6yh5z7x9arcn804mjwvffcmibs106vzamyq" "470b13b5805b" "ro")
-   ("1fxgh7nfxpg2zknvfff8igq9q1vm5n4q033v7lm2c0xn3dbl8m28" "402b2ecbf04d" "ru")
-   ("1i119g6dnhzxmpaz5r2jr9yzm1v24v2q6m3z6bfz2yihj0w7m133" "f637484e72b6" "sq")
-   ("1nllh3ax323sxwhj7xvwvbfnh4179332pcmpfyybw1vaid3nr39k" "bb2d5d96d69e" "sv-SE")
-   ("136m68fd0641k3qqmsw6zp016cvvd0sipsyv6rx2b9nli56agz57" "0e6c56bf2ac9" "th")
-   ("0q8p8bwq8an65yfdwzm4dhl6km68r83bv5i17kay2gak8msxxhsb" "91e611ae3f19" "tr")
-   ("1f2g7rnxpr2gjzngfsv19g11vk9zqpyrv01pz07mw2z3ffbkxf0j" "99d5ffa0b81e" "uk")
-   ("1rizwsfgr7vxm31bin3i7bwhcqa67wcylak3xa387dvgf1y9057i" "5fd44724e22d" "vi")
-   ("02ifa94jfii5f166rwdvv8si3bazm4bcf4qhi59c8f1hxbavb52h" "081aeb1aa308" "zh-CN")
-   ("0qx9sh56pqc2x5qrh386cp1fi1gidhcmxxpvqkg9nh2jbizahznr" "9015a180602e" "zh-TW")))
+          (method git-fetch)
+          (uri (git-reference
+                (url "https://github.com/mozilla-l10n/firefox-l10n")
+                (commit commit)))
+          (file-name (git-file-name name version))
+          (sha256
+           (base32
+            "0a2ly29lli02jflqw78zjk7bp7h18fz935cc9csavi0cpdiixjv1"))))
+      (build-system copy-build-system)
+      (home-page "https://github.com/mozilla-l10n/firefox-l10n")
+      (synopsis "Firefox Locales")
+      (description "This package contains localized messages for all
+Firefox locales.")
+      (license license:mpl2.0))))

 ;; We copy the official build id, which is defined at
 ;; tor-browser-build/rbm.conf (browser_release_date).
-(define %torbrowser-build-date "20240510190000")
+(define %torbrowser-build-date "20240903073000")

 ;; To find the last version, look at https://www.torproject.org/download/.
-(define %torbrowser-version "13.0.16")
+(define %torbrowser-version "13.5.3")

 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/torbrowser/<%torbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-tor-browser-".
-(define %torbrowser-firefox-version "115.12.0esr-13.0-1-build1")
+(define %torbrowser-firefox-version "115.15.0esr-13.5-1-build3")
+
+;; See tor-browser-build/rbm.conf for the list.
+(define %torbrowser-locales (list "ar" "ca" "cs" "da" "de" "el" "es-ES" "fa" "fi" "fr"
+                                  "ga-IE" "he" "hu" "id" "is" "it" "ja" "ka" "ko" "lt"
+                                  "mk" "ms" "my" "nb-NO" "nl" "pl" "pt-BR" "ro" "ru"
+                                  "sq" "sv-SE" "th" "tr" "uk" "vi" "zh-CN" "zh-TW"))

 ;; See tor-browser-build/projects/translation/config.
 (define torbrowser-translation-base
@ -168,11 +139,11 @@ (define torbrowser-translation-base
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "f28525699864f4e3d764c354130bd898ce5b20aa")))
+          (commit "daed2afc487d1b20efc17feb153156524c6f714b")))
    (file-name "translation-base-browser")
    (sha256
     (base32
-      "1vf6nl7fdmlmg2gskf3w1xlsgcm0pxi54z2daz5nwr6q9gyi0lkf"))))
+      "0psmmgw9dnjwdhjbqkd69q5q7sdwyjcwagh93ffrjk0v7ybc79dq"))))

 ;; See tor-browser-build/projects/translation/config.
 (define torbrowser-translation-specific
@ -180,11 +151,11 @@ (define torbrowser-translation-specific
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "b5d79336411e5a59c4861341ef9aa7353e0bcad9")))
+          (commit "6374e3b09c0894b8452fa1ba0b99c807722fc805")))
    (file-name "translation-tor-browser")
    (sha256
     (base32
-      "0ahz69pxhgik7ynmdkbnx7v5l2v392i6dswjz057g4hwnd7d34fb"))))
+      "1wd9iwcj2h70bp017pcdhgfiw2bs8zi68kljmpnk69pssd6cn8l3"))))

 (define torbrowser-assets
  ;; This is a prebuilt Torbrowser from which we take the assets we need.
@ -200,7 +171,7 @@ (define torbrowser-assets
         version "/tor-browser-linux-x86_64-" version ".tar.xz"))
       (sha256
        (base32
-         "1kffam66bsaahzx212hw9lb03jwfr24hivzg067iyzilsldpc9c1"))))
+         "0laz6yrm310iidddnas2w1s5wad183n9axjkgrf5cm5paj615343"))))
    (arguments
     (list
      #:install-plan
@ -215,6 +186,10 @@ (define torbrowser-assets
 Browser.")
    (license license:silofl1.1)))

+;;; A LLD wrapper that can be used as a (near) drop-in replacement to GNU ld.
+(define lld-as-ld-wrapper-16
+  (make-lld-wrapper lld-16 #:lld-as-ld? #t))
+
 (define* (make-torbrowser #:key
                          moz-app-name
                          moz-app-remotingname
@ -238,10 +213,11 @@ (define* (make-torbrowser #:key
         ".tar.xz"))
       (sha256
        (base32
-         "1b70zyjyai6kk4y1kkl8jvrs56gg7z31kkad6bmdpd8jw4n71grx"))))
+         "13b9ni6anv279drhbb5m95nnmgslrp6frsm0y4028nfqiprs7vj5"))))
    (build-system mozilla-build-system)
    (inputs
     (list go-gitlab-torproject-org-tpo-anti-censorship-pluggable-transports-lyrebird
+           firefox-locales
           tor-client
           alsa-lib
           bash-minimal                 ;for wrap-program
@ -293,8 +269,9 @@ (define* (make-torbrowser #:key
      rust
      `(,rust "cargo")
      rust-cbindgen
-      llvm-15
-      clang-15
+      lld-as-ld-wrapper-16  ; for cargo rustc
+      llvm-16
+      clang-16
      perl
      node-lts
      python-wrapper
@ -541,7 +518,7 @@ (define (runpaths-of-input label)
              (setenv "MOZBUILD_STATE_PATH"
                      (in-vicinity (getcwd) ".mozbuild"))
              (setenv "MOZ_CHROME_MULTILOCALE"
-                      (string-join (map car #$locales)))
+                      (string-join (list #$@locales)))
              ;; Make build reproducible.
              (setenv "MOZ_BUILD_DATE" #$build-date)))
          (add-before 'configure 'mozconfig
@ -555,14 +532,14 @@ (define (runpaths-of-input label)
          ;; See tor-browser-build/projects/firefox/build.
          (add-before 'configure 'copy-firefox-locales
            (lambda _
-              (let ((l10ncentral ".mozbuild/l10n-central"))
+              (let ((l10ncentral ".mozbuild/l10n-central")
+                    (ff-locales #$(this-package-input "firefox-locales")))
                (mkdir-p l10ncentral)
                (for-each
                 (lambda (lang)
-                   (copy-recursively (cdr lang)
-                                     (in-vicinity l10ncentral
-                                                  (car lang))))
-                 #$locales))))
+                   (copy-recursively (string-append ff-locales "/" lang)
+                                     (in-vicinity l10ncentral lang)))
+                 (list #$@locales)))))
          (add-after 'copy-firefox-locales 'copy-basebrowser-locales
            (lambda _
              (let ((l10ncentral ".mozbuild/l10n-central"))
@ -577,7 +554,7 @@ (define (runpaths-of-input label)
                     #f (string-join
                         '("mv"
                           "translation-base-browser/~a/base-browser.ftl"
-                           "~a/~a/browser/browser/"))
+                           "~a/~a/toolkit/toolkit/global/"))
                     lang l10ncentral lang))
                   (system
                    (format
@ -586,7 +563,7 @@ (define (runpaths-of-input label)
                           "translation-base-browser/~a/*"
                           "~a/~a/browser/chrome/browser/"))
                     lang l10ncentral lang)))
-                 (map car #$locales)))))
+                 (list #$@locales)))))
          (add-after 'copy-basebrowser-locales 'copy-torbrowser-locales
            (lambda _
              (let ((l10ncentral ".mozbuild/l10n-central"))
@ -601,7 +578,7 @@ (define (runpaths-of-input label)
                     #f (string-join
                         '("mv"
                           "translation-tor-browser/~a/tor-browser.ftl"
-                           "~a/~a/browser/browser/"))
+                           "~a/~a/toolkit/toolkit/global/"))
                     lang l10ncentral lang))
                   (system
                    (format
@ -623,7 +600,7 @@ (define (runpaths-of-input label)
                     (format port "  locale/~a/ (chrome/locale/~a/*)~%"
                             lang lang)
                     (close port)))
-                 (map car #$locales)))))
+                 (list #$@locales)))))
          (replace 'configure
            (lambda _
              (invoke "./mach" "configure")))
@ -632,14 +609,6 @@ (define (runpaths-of-input label)
              (substitute*
                  "toolkit/locales/en-US/toolkit/about/aboutAddons.ftl"
                (("addons.mozilla.org") "gnuzilla.gnu.org"))))
-          (add-before 'build 'add-bridges ;see deploy.sh
-            (lambda _
-              (let ((port (open-file
-                           "browser/app/profile/000-tor-browser.js" "a")))
-                (display
-                 "#include ../../../tools/torbrowser/bridges.js" port)
-                (newline port)
-                (close port))))
          (replace 'build
            (lambda* (#:key (make-flags '()) (parallel-build? #t)
                      #:allow-other-keys)
@ -739,7 +708,7 @@ (define (runpaths-of-input label)
                (copy-recursively (in-vicinity #$assets "fontconfig")
                                  (in-vicinity lib "fontconfig"))
                (substitute* (in-vicinity lib "fontconfig/fonts.conf")
-                  (("<dir>fonts</dir>")
+                  (("<dir prefix=\"cwd\">fonts</dir>")
                   (format #f "<dir>~a</dir>" (in-vicinity lib "fonts"))))
                (delete-file-recursively (in-vicinity lib "fonts"))
                (copy-recursively (in-vicinity #$assets "fonts")
@ -805,11 +774,7 @@ (define (runpaths-of-input label)
                            "https://gnuzilla.gnu.org/mozzarella")
                    (format #t "pref(~s, ~s);~%"
                            "lightweightThemes.getMoreURL"
-                            "https://gnuzilla.gnu.org/mozzarella")
-                    ;; FIXME: https://github.com/NixOS/nixpkgs/issues/307095
-                    (format #t "pref(~s, ~a);~%"
-                            "widget.use-xdg-desktop-portal.file-picker"
-                            "1"))))))
+                            "https://gnuzilla.gnu.org/mozzarella"))))))
          (add-after 'autoconfig 'autoconfig-tor
            (lambda* (#:key inputs #:allow-other-keys)
              (let ((lib (in-vicinity #$output "lib/torbrowser"))
@ -853,47 +818,23 @@ (define-public torbrowser


 ;; See tor-browser-build/rbm.conf for the list.
-;; See browser/locales/l10n-changesets.json for the changeset.
-;; See update-mozilla-locales in gnuzilla.scm to automate updating changeset.
-(define %mullvadbrowser-locales
-  (mozilla-locales
-   ;;                      sha256                            changeset    locale
-   ;;---------------------------------------------------------------------------
-   ("1218mldjxybhgzdi0myzkwjr2fgnysl71pl847kr7wyn1j8wk3a5" "c25d00080479" "ar")
-   ("1kzx94n36c5vv954j7w65djvb37c178zazy25b35l71q2rvhmlhj" "2197a99c9a08" "da")
-   ("13h7hk11bbd0yq8gqdv7ndbizkgwlm3ybz225l3x2b5cnyjxyg14" "b7a533e5edc9" "de")
-   ("0mdr5b6pqxjmg9c8064x3hpf53h6w9j8ghl32655sx9jh4v3ykza" "beff1baac7c5" "es-ES")
-   ("1pnyg09j6r15w8m62lwj89x6rz4br877z60p8s1hlrb9hj2s3vdx" "ebe0b60b0b36" "fa")
-   ("067r505626cvlrsalnndf2ykz3nnkiy0b8yaxzf1rracpzmp0hni" "d5ae6a933d71" "fi")
-   ("0026zzjv2bqc8sg06yvyd0mhny6mwwvhpvzjrhv2fi5v4wkxapdj" "496c2eb73b82" "fr")
-   ("03fbp4vgkwyimfmbm4n8blx1m16yhms2wm8j4wlx2h3cpxp5r71k" "91951e37e2b8" "it")
-   ("0ncm531d7ih7phcn9d83zwq0dfphvmzg3gmhqmrrkkbydi1g3pbb" "895dcf8bb524" "ja")
-   ("14rc9mr4ngxdzwpjagzhz47jazgp1a6vwb0vbwj31yxv9iwkrgzi" "6ef881aff44b" "ko")
-   ("0h7dlnawm5mbcx4qdlz5c7n4axz2dpa677v13ljdgm2b5w76msmq" "5c1480ccc040" "my")
-   ("1b12azc1n8j1i2l20v66r74q79zqjvc5sf9pd8rmj3xd0fkxzdp2" "fc1896a0a24d" "nb-NO")
-   ("1fh4dhlb6hynlpb2997gssv9v8zk5b7qrw0sclggczb5pcpjk6wc" "7e6da4f01bdb" "nl")
-   ("1w8x3jjrd28f6g6ywwxldizpiipfkr63dzqd74kjpg24s2lqzp80" "e86a451a9cb5" "pl")
-   ("1v3v4n82sn7a4h2d9n653fmgc31mikacf59lvdj6gbwvzpjb5yfa" "94c3dbb67a5d" "pt-BR")
-   ("1fxgh7nfxpg2zknvfff8igq9q1vm5n4q033v7lm2c0xn3dbl8m28" "402b2ecbf04d" "ru")
-   ("1nllh3ax323sxwhj7xvwvbfnh4179332pcmpfyybw1vaid3nr39k" "bb2d5d96d69e" "sv-SE")
-   ("136m68fd0641k3qqmsw6zp016cvvd0sipsyv6rx2b9nli56agz57" "0e6c56bf2ac9" "th")
-   ("0q8p8bwq8an65yfdwzm4dhl6km68r83bv5i17kay2gak8msxxhsb" "91e611ae3f19" "tr")
-   ("02ifa94jfii5f166rwdvv8si3bazm4bcf4qhi59c8f1hxbavb52h" "081aeb1aa308" "zh-CN")
-   ("0qx9sh56pqc2x5qrh386cp1fi1gidhcmxxpvqkg9nh2jbizahznr" "9015a180602e" "zh-TW")))
+(define %mullvadbrowser-locales (list "ar" "da" "de" "es-ES" "fa" "fi" "fr" "it"
+                                      "ja" "ko" "my" "nb-NO" "nl" "pl" "pt-BR"
+                                      "ru" "sv-SE" "th" "tr" "zh-CN" "zh-TW"))

 ;; We copy the official build id, which can be found there:
 ;; https://cdn.mullvad.net/browser/update_responses/update_1/release.
-(define %mullvadbrowser-build-date "20240510190000")
+(define %mullvadbrowser-build-date "20240903073000")

 ;; To find the last version, look at
 ;; https://mullvad.net/en/download/browser/linux.
-(define %mullvadbrowser-version "13.0.16")
+(define %mullvadbrowser-version "13.5.3")

 ;; To find the last Firefox version, browse
 ;; https://archive.torproject.org/tor-package-archive/mullvadbrowser/<%mullvadbrowser-version>
 ;; There should be only one archive that starts with
 ;; "src-firefox-mullvad-browser-".
-(define %mullvadbrowser-firefox-version "115.12.0esr-13.0-1-build1")
+(define %mullvadbrowser-firefox-version "115.15.0esr-13.5-1-build2")

 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-base
@ -901,11 +842,11 @@ (define mullvadbrowser-translation-base
    (method git-fetch)
    (uri (git-reference
          (url "https://gitlab.torproject.org/tpo/translation.git")
-          (commit "f28525699864f4e3d764c354130bd898ce5b20aa")))
+          (commit "daed2afc487d1b20efc17feb153156524c6f714b")))
    (file-name "translation-base-browser")
    (sha256
     (base32
-      "1vf6nl7fdmlmg2gskf3w1xlsgcm0pxi54z2daz5nwr6q9gyi0lkf"))))
+      "0psmmgw9dnjwdhjbqkd69q5q7sdwyjcwagh93ffrjk0v7ybc79dq"))))

 ;; See tor-browser-build/projects/translation/config.
 (define mullvadbrowser-translation-specific
@ -933,7 +874,7 @@ (define mullvadbrowser-assets
         version "/mullvad-browser-linux-x86_64-" version ".tar.xz"))
       (sha256
        (base32
-         "1bpchiz12zjyrzpgyk71naf1jdf3msjcjwggb1mziyawc6pyxj7v"))))
+         "17sqin4fnvq96plarv0iv8r801i19gh7v7szg2vrmcynay8qx4mc"))))
    (arguments
     (list
      #:install-plan
@ -976,7 +917,7 @@ (define-public mullvadbrowser
         %mullvadbrowser-firefox-version ".tar.xz"))
       (sha256
        (base32
-         "1xs4qwa3c6nfq6cj5q6asfrzki4brafg65g6hbn0fc9qqcmrhkv5"))))
+         "1c6jjw0x8bjz74q15a7vskrd0ji5ic19mzr9f2laivhznjy0r12c"))))
    (arguments
     (substitute-keyword-arguments (package-arguments mullvadbrowser-base)
       ((#:phases phases)
@ -998,7 +939,7 @@ (define-public mullvadbrowser
                   (system
                    (format #f "cp -Lr ~a/~a .mozbuild/l10n-central/"
                            #$mullvadbrowser-translation-specific lang)))
-                 (map car #$%mullvadbrowser-locales))))
+                 (list #$@%mullvadbrowser-locales))))
            (add-before 'build 'fix-profiles
              ;; Otherwise the profile would change every time the install
              ;; location changes, that is: at every package update.  These
--- a/gnu/packages/version-control.scm
+++ b/gnu/packages/version-control.scm
@ -1337,8 +1337,8 @@ (define-public git-remote-gcrypt
   (license license:gpl3+)))

 (define-public cgit
-  (let ((commit "9811bf07ef6868cdf5618cbbd8b9db5ada936622")
-        (rev "5"))
+  (let ((commit "2a13177f3dce660954b1ce78bc83338fe64f6b33")
+        (rev "6"))
    (package
      (name "cgit")
      ;; Update the ‘git-source’ input as well.
@ -1350,7 +1350,7 @@ (define-public cgit
                      (commit commit)))
                (sha256
                 (base32
-                  "1ga73789lixd7l7f1vs7vi8c0lvqjzq036k64lyrv7v6r7yxpn5p"))
+                  "0g02rghwx6gda15ip1pd3rli6smis1mrcb904zlxfqmm6dlc7lca"))
                (file-name (git-file-name name version))))
      (build-system gnu-build-system)
      (arguments
@ -1426,9 +1426,9 @@ (define (quoted-file-name input path)
             (method url-fetch)
             ;; cgit is tightly bound to git.  Use GIT_VER from the Makefile,
             ;; which may not match the current (package-version git).
-             (uri "mirror://kernel.org/software/scm/git/git-2.46.0.tar.xz")
+             (uri "mirror://kernel.org/software/scm/git/git-2.46.2.tar.xz")
             (sha256
-              (base32 "15bzq9m6c033qiz5q5gw1nqw4m452vvqax30wbms6z4bl9i384kz"))))
+              (base32 "18rcmvximgyg3v1a9papi9djfamiak0ys5cmgx7ll29nhp3a3s2y"))))
         ("bash-minimal" ,bash-minimal)
         ("openssl" ,openssl)
         ("python" ,python)
@ -3425,13 +3425,15 @@ (define-public src
  (package
    (name "src")
    (version "1.32")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append
-                    "http://www.catb.org/~esr/src/src-" version ".tar.gz"))
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://gitlab.com/esr/src.git/")
+             (commit version)))
+       (file-name (git-file-name name version))
       (sha256
-               (base32
-                "0r9i399kkagpwj08nwf1f7c6lr50xjzzgmzwyjjy6ppgcc53a809"))))
+        (base32 "0kxbmpjr98kfacjidizxcghl541fwnf8yzfvwfq5f9zbv42p8l41"))))
    (build-system gnu-build-system)
    (arguments
     (list
@ -3447,14 +3449,17 @@ (define-public src
                (wrap-program prog
                  `("PATH" ":" prefix (,(dirname rcs)))))))
          (replace 'check
-            (lambda _
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
                (setenv "HOME" (getenv "TMPDIR"))
                (invoke "git" "config" "--global" "user.name" "guix")
                (invoke "git" "config" "--global" "user.email" "guix")
-              (invoke "./srctest"))))))
+                (invoke "./srctest")))))))
    (native-inputs
+     (list asciidoc
           ;; For testing.
-     (list git perl))
+           git
+           perl))
    (inputs
     (list bash-minimal
           cssc
--- a/gnu/packages/virtualization.scm
+++ b/gnu/packages/virtualization.scm
@ -37,6 +37,7 @@
 ;;; Copyright © 2024 jgart <jgart@dismail.de>
 ;;; Copyright © 2024 Ashish SHUKLA <ashish.is@lostca.se>
 ;;; Copyright © 2024 Jakob Kirsch <jakob.kirsch@web.de>
+;;; Copyright © 2024 Giacomo Leidi <goodoldpaul@autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -60,6 +61,8 @@ (define-module (gnu packages virtualization)
  #:use-module (gnu packages apparmor)
  #:use-module (gnu packages assembly)
  #:use-module (gnu packages attr)
+  #:use-module (gnu packages apparmor)
+  #:use-module (gnu packages augeas)
  #:use-module (gnu packages autotools)
  #:use-module (gnu packages backup)
  #:use-module (gnu packages base)
@ -67,22 +70,26 @@ (define-module (gnu packages virtualization)
  #:use-module (gnu packages bison)
  #:use-module (gnu packages bootloaders)
  #:use-module (gnu packages build-tools)
+  #:use-module (gnu packages cdrom)
  #:use-module (gnu packages check)
  #:use-module (gnu packages cluster)
  #:use-module (gnu packages cmake)
  #:use-module (gnu packages compression)
  #:use-module (gnu packages containers)
+  #:use-module (gnu packages cpio)
  #:use-module (gnu packages cross-base)
  #:use-module (gnu packages crypto)
  #:use-module (gnu packages cryptsetup)
  #:use-module (gnu packages curl)
  #:use-module (gnu packages cyrus-sasl)
+  #:use-module (gnu packages dbm)
  #:use-module (gnu packages debian)
  #:use-module (gnu packages disk)
  #:use-module (gnu packages dns)
  #:use-module (gnu packages docbook)
  #:use-module (gnu packages documentation)
  #:use-module (gnu packages figlet)
+  #:use-module (gnu packages file)
  #:use-module (gnu packages firmware)
  #:use-module (gnu packages flex)
  #:use-module (gnu packages fonts)
@ -95,8 +102,10 @@ (define-module (gnu packages virtualization)
  #:use-module (gnu packages gnome)
  #:use-module (gnu packages gnupg)
  #:use-module (gnu packages golang)
+  #:use-module (gnu packages gperf)
  #:use-module (gnu packages graphviz)
  #:use-module (gnu packages gtk)
+  #:use-module (gnu packages java)
  #:use-module (gnu packages haskell)
  #:use-module (gnu packages haskell-apps)
  #:use-module (gnu packages haskell-check)
@ -107,6 +116,7 @@ (define-module (gnu packages virtualization)
  #:use-module (gnu packages libbsd)
  #:use-module (gnu packages libusb)
  #:use-module (gnu packages linux)
+  #:use-module (gnu packages lua)
  #:use-module (gnu packages m4)
  #:use-module (gnu packages man)
  #:use-module (gnu packages multiprecision)
@ -114,6 +124,7 @@ (define-module (gnu packages virtualization)
  #:use-module (gnu packages nettle)
  #:use-module (gnu packages networking)
  #:use-module (gnu packages ninja)
+  #:use-module (gnu packages ocaml)
  #:use-module (gnu packages onc-rpc)
  #:use-module (gnu packages package-management)
  #:use-module (gnu packages pciutils)
@ -2900,3 +2911,320 @@ (define-public riscv-pk
 supervisor execution environment for tethered RISC-V systems.  It is designed
 to host the RISC-V Linux port.")
    (license license:bsd-3)))
+
+(define-public hivex
+  (package
+    (name "hivex")
+    (version "1.3.24")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://libguestfs.org/download/"
+                                  name "/" name "-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0g0rib62qg81fda8lxsaa7a1ykqy4rl5sq185pdqm9y9xifa8bx5"))))
+    (build-system gnu-build-system)
+    (native-inputs (list automake
+                         autoconf
+                         gettext-minimal
+                         libtool
+                         ocaml
+                         pkg-config
+                         perl-io-stringy
+                         python-wrapper
+                         ruby
+                         ruby-rake
+                         ruby-rdoc))
+    (inputs
+     (list bash-minimal
+           libxml2
+           perl
+           readline))
+    (arguments
+     (list
+      #:configure-flags
+      #~(list "--disable-static" "--with-readline" "--disable-rpath"
+              (string-append "LDFLAGS=-Wl,-rpath=" #$output "/lib"))
+      #:phases
+      #~(modify-phases %standard-phases
+          (add-after 'unpack 'patch-makefiles
+            (lambda _
+              (let* ((current-system (or #$(%current-target-system)
+                                         #$(%current-system)))
+                     (ocamllib
+                      (string-append #$output "/lib/ocaml/"
+                                     #$(package-version
+                                        (this-package-native-input "ocaml")) "/site-lib"))
+                     (python-installdir
+                      (string-append #$output "/lib/python"
+                                     #$(version-major+minor
+                                        (package-version
+                                         (this-package-native-input
+                                          "python-wrapper")))
+                                     "/site-packages"))
+                     (ruby-version
+                      #$(package-version
+                         (this-package-native-input "ruby")))
+                     (ruby-libdir
+                      (string-append #$output
+                                     "/lib/ruby/site_ruby/"
+                                     ruby-version))
+                     (ruby-archdir
+                      (string-append ruby-libdir "/" current-system)))
+                (substitute* "lib/Makefile.am"
+                  (((string-append "\\$\\(VERSION_SCRIPT_FLAGS\\)"
+                                   "\\$\\(srcdir\\)/hivex\\.syms"))
+                   ""))
+                (substitute* "python/Makefile.am"
+                  (("\\$\\(PYTHON_INSTALLDIR\\)")
+                   python-installdir))
+                (substitute* "ocaml/Makefile.am"
+                  (("\\$\\(DESTDIR\\)\\$\\(OCAMLLIB\\)")
+                   ocamllib))
+                (substitute* "ruby/Makefile.am"
+                  (("\\$\\(DESTDIR\\)\\$\\(RUBY_ARCHDIR\\)")
+                   ruby-archdir)
+                  (("\\$\\(DESTDIR\\)\\$\\(RUBY_LIBDIR\\)")
+                   ruby-libdir))
+                ;; The ‘validate-runpath’ phase fails to find libhivex.so.0.
+                (substitute* "perl/Makefile.PL.in"
+                  (("CCFLAGS => \\$Config\\{ccflags\\} \\. ' @CFLAGS@',")
+                   (string-append "CCFLAGS => $Config{ccflags} . ' @CFLAGS@',
+    LDDLFLAGS => $Config{lddlflags} . ' -Wl,-rpath," #$output "/lib',")))
+                (substitute* "ruby/ext/hivex/extconf.rb"
+                  (("create_header")
+                   (string-append "
+$LDFLAGS += \" -Wl,-rpath=" #$output "/lib \"
+create_header"))))))
+          (add-after 'install 'wrap-binaries
+            (lambda _
+              (let ((hivexregedit
+                     (string-append #$output "/bin/hivexregedit"))
+                    (hivexml
+                     (string-append #$output "/bin/hivexml")))
+                (wrap-program hivexregedit
+                  `("PERL5LIB" ":" prefix
+                    (,(string-append #$output "/lib/perl5/site_perl")))
+                  `("PATH" ":" prefix
+                    (,(string-append #$output "/bin"))))
+                (wrap-program hivexml
+                  `("PATH" ":" prefix
+                    (,(string-append #$output "/bin"))))))))))
+    (home-page "https://github.com/libguestfs/hivex")
+    (synopsis "Windows registry hive extraction library")
+    (description
+     "This package provides a self-contained library for reading and writing
+Windows Registry \"hive\" binary files.  Unlike many other tools in this area,
+it doesn't use the textual @code{.REG} format for output, because parsing that
+is as much trouble as parsing the original binary format.  Instead it makes the
+file available through a C API, or through a separate program to export the
+hive as XML.")
+    (license license:lgpl2.1)))
+
+(define-public libguestfs-minimal
+  (package
+    (name "libguestfs-minimal")
+    (version "1.53.6")
+    (source (origin
+              (method url-fetch)
+              (uri (string-append "https://libguestfs.org/download/"
+                                  (version-major+minor version)
+                                  "-stable/libguestfs-" version ".tar.gz"))
+              (sha256
+               (base32
+                "0vssarc3n4kv26fyjmkrrcvh55v41fhycba43pij3rc2izl72s2y"))
+              (patches
+               (search-patches "libguestfs-syms.patch"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list #:configure-flags
+           #~(list "--disable-appliance"
+                   "--disable-daemon"
+                   "--disable-static"
+                   "--disable-erlang"
+                   "--disable-golang"
+                   "--disable-haskell"
+                   "--disable-java"
+                   "--disable-lua"
+                   ;; FIXME: Perl bindings have wrong rpath and break the
+                   ;; validate-runpath phase.  Temporarily disable them until
+                   ;; a way is found to correctly patch perl/Build.PL.in.
+                   "--disable-perl"
+                   "--disable-php"
+                   "--with-distro=\"Guix System\""
+                   "--with-readline"
+                   (string-append "LDFLAGS=-Wl,-rpath," %output "/lib"))
+           #:make-flags #~`("REALLY_INSTALL=yes")
+           #:phases
+           #~(let* ((lib (string-append #$output "/lib"))
+                    (lib/ocaml (string-append lib "/ocaml")))
+               (modify-phases %standard-phases
+                 (add-after 'unpack 'patch-makefiles
+                   (lambda _
+                     (for-each patch-shebang
+                               (find-files "."))
+                     (substitute* "ocaml/Makefile.in"
+                       (("\\$\\(DESTDIR\\)\\$\\(OCAMLLIB\\)")
+                        lib/ocaml))
+                     ;; FIXME: Perl bindings have broken runpath,
+                     ;; this substitution doesn't seem to work.
+                     (substitute* "perl/Build.PL.in"
+                       (("extra_linker_flags => \\[")
+                        (string-append "extra_linker_flags => [
+        '-L" #$output "/lib',")))))
+                 (replace 'check
+                   (lambda* (#:key tests? make-flags #:allow-other-keys)
+                     (when tests?
+                       (apply invoke `("make" ,@make-flags "check-direct")))))
+                 (replace 'install
+                   (lambda* (#:key make-flags #:allow-other-keys)
+                     (mkdir-p "temp-build-dir")
+                     (apply invoke `("make" ,@make-flags "INSTALLDIRS=vendor"
+                                     "install"))))
+                 (add-after 'install 'wrap-binaries
+                   (lambda _
+                     (let ((bin (string-append #$output "/bin")))
+                       (for-each
+                        (lambda (binary)
+                          (use-modules (srfi srfi-1))
+                          (wrap-program binary
+                            `("PERL5LIB" ":" prefix
+                              (,(string-append #$output
+                                               "/lib/perl5/site_perl")))
+                            `("PATH" ":" prefix
+                              ,(search-path-as-list
+                                '("bin")
+                                (map second
+                                     '#$(package-inputs this-package))))))
+                        (find-files bin)))))
+                 (replace 'validate-documentation-location
+                   (lambda _
+                     (let ((man-dir
+                            (string-append #$output "/man"))
+                           (info-dir
+                            (string-append #$output "/info")))
+                       (for-each (lambda (d)
+                                   (invoke "rm" "-rf" d))
+                                 (list man-dir info-dir)))))))))
+    (native-inputs (list augeas
+                         bison
+                         cpio
+                         flex
+                         gettext-minimal
+                         gperf
+                         libtool
+                         ocaml
+                         ocaml-findlib
+                         ncurses
+                         perl
+                         perl-getopt-long
+                         perl-module-build
+                         pkg-config
+                         po4a
+                         xorriso
+                         xz
+                         zstd))
+    (inputs
+     (list file
+           fuse
+           jansson
+           hivex
+           libtirpc
+           pcre2
+           readline
+           qemu))
+    (home-page "https://libguestfs.org/")
+    (synopsis "Access and modify virtual machine disk images")
+    (description
+     "@code{libguestfs} is a set of tools for accessing and modifying virtual
+machine (VM) disk images.  You can use this for viewing and editing files inside
+guests, scripting changes to VMs, monitoring disk used/free statistics, creating
+guests, P2V, V2V, performing backups, cloning VMs, building VMs, formatting
+disks, resizing disks, and much more.")
+    (license (list license:gpl2+ license:lgpl2.1+))))
+
+(define-public libguestfs
+  (package/inherit libguestfs-minimal
+    (name "libguestfs")
+    (arguments
+     (substitute-keyword-arguments (package-arguments libguestfs-minimal)
+       ((#:configure-flags flags)
+        #~(append
+           (filter
+            (lambda (flag)
+              (not (string-prefix? "LDFLAGS" flag)))
+            #$flags)
+           (list
+            "--enable-vala=yes"
+            (string-append "--with-python-installdir="
+                           #$output "/lib/python"
+                           #$(version-major+minor
+                              (package-version python))
+                           "/site-packages")
+            (string-append "LDFLAGS=-Wl,-rpath," %output "/lib"))))
+       ((#:phases phases)
+        #~(modify-phases #$phases
+            (add-after 'patch-makefiles 'patch-additional-makefiles
+              (lambda _
+                (let* ((current-system (or #$(%current-target-system)
+                                           #$(%current-system)))
+                       (lib (string-append #$output "/lib"))
+                       (share (string-append #$output "/share"))
+                       (completions
+                        (string-append share "/bash-completion/completions"))
+                       (lib/lua (string-append lib "/lua"))
+                       (lib/ocaml (string-append lib "/ocaml"))
+                       (ruby-version
+                        #$(package-version
+                           (this-package-native-input "ruby")))
+                       (ruby-libdir
+                        (string-append lib
+                                       "/ruby/site_ruby/"
+                                       ruby-version))
+                       (ruby-archdir
+                        (string-append ruby-libdir "/" current-system)))
+                  (substitute* "m4/guestfs-bash-completion.m4"
+                    (("`pkg-config --variable=completionsdir bash-completion`")
+                     completions))
+                  (substitute* "ocaml/Makefile.am"
+                    (("\\$\\(DESTDIR\\)\\$\\(OCAMLLIB\\)")
+                     lib/ocaml))
+                  (substitute* "lua/Makefile.am"
+                    (("\\$\\(DESTDIR\\)\\$\\(lualibdir\\)")
+                     lib/lua))
+                  (substitute* "ruby/Makefile.am"
+                    (("\\$\\(DESTDIR\\)\\$\\(RUBY_ARCHDIR\\)")
+                     ruby-archdir)
+                    (("\\$\\(DESTDIR\\)\\$\\(RUBY_LIBDIR\\)")
+                     ruby-libdir))
+                  ;; The ‘validate-runpath’ phase fails to find libguestfs.so.0.
+                  (substitute* "ruby/ext/guestfs/extconf.rb.in"
+                    (("create_header")
+                     (string-append "
+$LDFLAGS += \" -Wl,-rpath=" #$output "/lib \"
+create_header"))))))))))
+    (native-inputs
+     (modify-inputs (package-native-inputs libguestfs-minimal)
+       (prepend autoconf
+                automake
+                bash-completion
+                cdrtools
+                gobject-introspection
+                python
+                ruby
+                util-linux
+                vala)))
+    (inputs
+     (modify-inputs (package-inputs libguestfs-minimal)
+       (prepend acl
+                bdb
+                fuse
+                gmp
+                libapparmor
+                libcap
+                libcap-ng
+                libconfig
+                libvirt
+                libxcrypt
+                numactl
+                yajl)))))
--- a/gnu/packages/web-browsers.scm
+++ b/gnu/packages/web-browsers.scm
@ -22,6 +22,7 @@
 ;;; Copyright © 2020 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;; Copyright © 2021 Christopher Howard <christopher@librehacker.com>
 ;;; Copyright © 2023 Herman Rimm <herman@rimm.ee>
+;;; Copyright © 2024 Zheng Junjie <873216071@qq.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@ -559,7 +560,7 @@ (define-public qutebrowser
 (define-public vimb
  (package
    (name "vimb")
-    (version "3.6.0")
+    (version "3.7.0")
    (source
     (origin
       (method git-fetch)
@ -567,17 +568,22 @@ (define-public vimb
             (url "https://github.com/fanglingsu/vimb/")
             (commit version)))
       (sha256
-        (base32 "0228khh3lqbal046k6akqah7s5igq9s0wjfjbdjam75kjj42pbhj"))
+        (base32 "1yazd0hm6vsz7sqp5qf3zzjmvqs3can6sbm2ijlfcj4v3kz42vrm"))
       (file-name (git-file-name name version))))
    (build-system glib-or-gtk-build-system)
    (arguments
-     '(#:tests? #f                      ; no tests
-       #:make-flags (list "CC=gcc"
+     (list #:tests? #f                      ; no tests
+           #:make-flags #~(list (string-append "CC=" #$(cc-for-target))
                                "DESTDIR="
-                          (string-append "PREFIX=" %output))
+                                (string-append "PREFIX=" #$output))
           #:phases
-       (modify-phases %standard-phases
-         (delete 'configure))))
+           #~(modify-phases %standard-phases
+               (delete 'configure)
+               (add-after 'unpack 'fix-config-mk
+                 (lambda* _
+                   (substitute* "config.mk"
+                     (("webkit2gtk-4\\.1")
+                      "webkit2gtk-4.0")))))))
    (inputs
     `(("glib-networking" ,glib-networking)
       ("gsettings-desktop-schemas" ,gsettings-desktop-schemas)
--- a/Show more
+++ b/Show more