gnu: emacs-svg-icon: Fix grammar.
[jackhill/guix/guix.git] / gnu / packages / compression.scm
index e7d74d8..37a7d23 100644 (file)
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2012, 2013, 2014, 2015, 2017, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2012, 2013, 2014, 2015, 2017, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2014, 2015, 2018 Mark H Weaver <mhw@netris.org>
 ;;; Copyright © 2015 Taylan Ulrich Bayırlı/Kammer <taylanbayirli@gmail.com>
@@ -7,10 +7,10 @@
 ;;; Copyright © 2015, 2016, 2017, 2018, 2020 Ricardo Wurmus <rekado@elephly.net>
 ;;; Copyright © 2015, 2017, 2018 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2015 Jeff Mickey <j@codemac.net>
-;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Efraim Flashner <efraim@flashner.co.il>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2016 Ben Woodcroft <donttrustben@gmail.com>
 ;;; Copyright © 2016 Danny Milosavljevic <dannym@scratchpost.org>
-;;; Copyright © 2016, 2017, 2018, 2019, 2020 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2016–2021 Tobias Geerinckx-Rice <me@tobias.gr>
 ;;; Copyright © 2016 David Craven <david@craven.ch>
 ;;; Copyright © 2016, 2019, 2020 Kei Kebreau <kkebreau@posteo.net>
 ;;; Copyright © 2016, 2018, 2019, 2020 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2019 Jan (janneke) Nieuwenhuizen <janneke@gnu.org>
 ;;; Copyright © 2020 Björn Höfling <bjoern.hoefling@bjoernhoefling.de>
 ;;; Copyright © 2020 Arun Isaac <arunisaac@systemreboot.net>
-;;; Copyright © 2020 Lars-Dominik Braun <lars@6xq.net>
+;;; Copyright © 2020, 2021 Lars-Dominik Braun <lars@6xq.net>
+;;; Copyright © 2020 Guillaume Le Vaillant <glv@posteo.net>
+;;; Copyright © 2020 Léo Le Bouter <lle-bout@zaclys.net>
+;;; Copyright © 2021 Antoine Côté <antoine.cote@posteo.net>
+;;; Copyright © 2021 Vincent Legoll <vincent.legoll@gmail.com>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -54,6 +58,7 @@
   #:use-module (guix build-system glib-or-gtk)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system go)
+  #:use-module (guix build-system meson)
   #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
   #:use-module (gnu packages)
@@ -69,7 +74,9 @@
   #:use-module (gnu packages gettext)
   #:use-module (gnu packages glib)
   #:use-module (gnu packages gnome)
+  #:use-module (gnu packages gnupg)
   #:use-module (gnu packages gtk)
+  #:use-module (gnu packages man)
   #:use-module (gnu packages maths)
   #:use-module (gnu packages perl)
   #:use-module (gnu packages pkg-config)
   #:use-module (gnu packages qt)
   #:use-module (gnu packages tls)
   #:use-module (gnu packages valgrind)
+  #:use-module (gnu packages version-control)
   #:use-module (gnu packages xml)
   #:use-module (ice-9 match)
-  #:use-module ((srfi srfi-1) #:select (last)))
+  #:use-module (srfi srfi-1))
 
 (define-public zlib
   (package
@@ -380,40 +388,63 @@ decompression.")
     (home-page "https://web.archive.org/web/20180801004107/http://www.bzip.org/")))
 
 (define-public lbzip2
-  (package
-    (name "lbzip2")
-    (version "2.5")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append "http://archive.lbzip2.org/lbzip2-"
-                                  version ".tar.gz"))
-              (sha256
-               (base32
-                "1sahaqc5bw4i0iyri05syfza4ncf5cml89an033fspn97klmxis6"))
-             (modules '((guix build utils)))
-             (snippet
-              '(begin
-                 (substitute* (find-files "lib" "\\.c$")
-                   (("#if defined _IO_ftrylockfile")
-                    "#if defined _IO_EOF_SEEN"))
-                 (substitute* "lib/stdio-impl.h"
-                   (("^/\\* BSD stdio derived implementations")
-                    (string-append "#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN\n"
-                                   "# define _IO_IN_BACKUP 0x100\n"
-                                   "#endif\n\n"
-                                   "/* BSD stdio derived implementations")))
-                 #t))))
-    (build-system gnu-build-system)
-    (synopsis "Parallel bzip2 compression utility")
-    (description
-     "lbzip2 is a multi-threaded compression utility with support for the
+  ;; The last 2.5 release is 4 years behind the newest commit (from 2018) and
+  ;; may create files that can't even be decompressed by newer bzip2 versions.
+  (let ((commit "b6dc48a7b9bfe6b340ed1f6d72133608ad57144b")
+        (revision "0"))
+    (package
+      (name "lbzip2")
+      (version (git-version "2.5" revision commit))
+      (source
+       (origin
+         (method git-fetch)
+         (uri (git-reference
+               (url "https://github.com/kjn/lbzip2")
+               (commit commit)))
+         (sha256
+          (base32 "140xp00dmjsr6c3dwb4dwf0pzlgf159igri321inbinsjiclkngy"))
+         (file-name (git-file-name name version))))
+      (build-system gnu-build-system)
+      (arguments
+       `(#:phases
+         (modify-phases %standard-phases
+           (add-after 'unpack 'unpack-gnulib
+             (lambda* (#:key inputs #:allow-other-keys)
+               (let ((gnulib (assoc-ref inputs "gnulib")))
+                 (copy-recursively gnulib "lib")
+                 (setenv "PATH" (string-append "lib:" (getenv "PATH")))
+                 #t)))
+           (delete 'bootstrap)          ; gnulib still has unpatched shebangs
+           (add-after 'patch-source-shebangs 'bootstrap
+             (lambda _
+               (invoke "sh" "build-aux/autogen.sh")
+               #t)))))
+      (native-inputs
+       `(("autoconf" ,autoconf)
+         ("automake" ,automake)
+         ("gnulib"
+          ,(let ((commit "2d431ac35c4943a3655c07ba91870d2323321b43"))
+             (origin
+               (method git-fetch)
+               (uri (git-reference
+                     (url "git://git.savannah.gnu.org/gnulib.git")
+                     (commit commit)))
+               (sha256
+                (base32 "1f0xr4w89bqvhzsfcflcagdixidrk41k00k7kpr91w9lazfis4kf"))
+               (file-name (git-file-name "gnulib" commit)))))
+         ("perl" ,perl)))
+      (synopsis "Parallel bzip2 compression utility")
+      (description
+       "lbzip2 is a multi-threaded compression utility with support for the
 bzip2 compressed file format.  lbzip2 can process standard bz2 files in
 parallel.  It uses POSIX threading model (pthreads), which allows it to take
 full advantage of symmetric multiprocessing (SMP) systems.  It has been proven
 to scale linearly, even to over one hundred processor cores.  lbzip2 is fully
 compatible with bzip2 – both at file format and command line level.")
-    (home-page "http://www.lbzip2.org/")
-    (license license:gpl3+)))
+      ;; lbzip2.org now looks fishy.  There is no source code to be found.
+      ;; Reported upstream: <https://github.com/kjn/lbzip2/issues/26>.
+      (home-page "https://github.com/kjn/lbzip2")
+      (license license:gpl3+))))
 
 (define-public pbzip2
   (package
@@ -597,14 +628,14 @@ archiving.  Lzip is a clean implementation of the LZMA algorithm.")
 (define-public lziprecover
   (package
     (name "lziprecover")
-    (version "1.21")
+    (version "1.22")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://savannah/lzip/lziprecover/"
                                   "lziprecover-" version ".tar.gz"))
               (sha256
                (base32
-                "094w2z8fz41yaq0gkyr61cl7pb1d7kchpl5dka7rvm3qvbb7ncd2"))))
+                "0qh8dnhr5rly2k9dnx43qqynqwqzi5kfb15pyd29qwppfl4qm5gx"))))
     (build-system gnu-build-system)
     (home-page "https://www.nongnu.org/lzip/lziprecover.html")
     (synopsis "Recover and decompress data from damaged lzip files")
@@ -679,7 +710,7 @@ This package is mostly for compatibility and historical interest.")
     (source (origin
               (method git-fetch)
               (uri (git-reference
-                     (url "https://github.com/raboof/sfArkLib.git")
+                     (url "https://github.com/raboof/sfArkLib")
                      (commit version)))
               (file-name (git-file-name name version))
               (sha256
@@ -715,7 +746,7 @@ with the sfArk algorithm.")
                 ;; commit at this time.
                 (method git-fetch)
                 (uri (git-reference
-                      (url "https://github.com/raboof/sfarkxtc.git")
+                      (url "https://github.com/raboof/sfarkxtc")
                       (commit commit)))
                 (file-name (git-file-name name version))
                 (sha256
@@ -763,39 +794,46 @@ decompression of some loosely related file formats used by Microsoft.")
 (define-public lz4
   (package
     (name "lz4")
-    (version "1.9.2")
+    (version "1.9.3")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference (url "https://github.com/lz4/lz4")
                            (commit (string-append "v" version))))
        (sha256
-        (base32
-         "0lpaypmk70ag2ks3kf2dl4ac3ba40n5kc1ainkp9wfjawz76mh61"))
+        (base32 "1w02kazh1fps3sji2sn89fz862j1199c5ajrqcgl1bnlxj09kcbz"))
        (file-name (git-file-name name version))))
     (build-system gnu-build-system)
+    (outputs (list "out" "static"))
     (native-inputs
      `(;; For tests.
        ("python" ,python)
        ("valgrind" ,valgrind)))
     (arguments
-     `(#:test-target "test"
-       #:make-flags (list "CC=gcc"
+     `(;; Not designed for parallel testing.
+       ;; See https://github.com/lz4/lz4/issues/957#issuecomment-737419821
+       #:parallel-tests? #f
+       #:test-target "test"
+       #:make-flags (list (string-append "CC=" ,(cc-for-target))
                           (string-append "prefix=" (assoc-ref %outputs "out")))
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)            ;no configure script
-                  (add-before 'check 'disable-broken-test
-                    (lambda _
-                      ;; XXX: test_install.sh fails when prefix is a subdirectory.
-                      (substitute* "tests/Makefile"
-                        (("^test: (.*) test-install" _ targets)
-                         (string-append "test: " targets)))
-                      #t))
-                  (add-after 'install 'delete-static-library
-                    (lambda* (#:key outputs #:allow-other-keys)
-                      (let ((out (assoc-ref outputs "out")))
-                        (delete-file (string-append out "/lib/liblz4.a"))
-                        #t))))))
+       #:phases
+       (modify-phases %standard-phases
+         (delete 'configure)            ; no configure script
+         (add-before 'check 'disable-broken-test
+           (lambda _
+             (substitute* "tests/Makefile"
+               ;; This fails when $prefix is not a single top-level directory.
+               (("^test: (.*) test-install" _ targets)
+                (string-append "test: " targets)))
+             #t))
+         (add-after 'install 'move-static-library
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out"))
+                   (static (assoc-ref outputs "static")))
+               (mkdir-p (string-append static "/lib"))
+               (rename-file (string-append out "/lib/liblz4.a")
+                            (string-append static "/lib/liblz4.a"))
+               #t))))))
     (home-page "https://www.lz4.org")
     (synopsis "Compression algorithm focused on speed")
     (description "LZ4 is a lossless compression algorithm, providing
@@ -821,9 +859,9 @@ time for compression ratio.")
                 "0zmhvczscqz0mzh4b9m8m42asq14db0a6lc8clp5ljq5ybrv70d9"))))
     (build-system gnu-build-system)
     (arguments
-     '(#:tests? #f                      ; no check target
+     `(#:tests? #f                      ; no check target
        #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
              "XZ_SUPPORT=1"
              "LZO_SUPPORT=1"
              "LZ4_SUPPORT=1"
@@ -853,14 +891,14 @@ extract such file systems.")
 (define-public pigz
   (package
     (name "pigz")
-    (version "2.4")
+    (version "2.6")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://zlib.net/pigz/"
                                   name "-" version ".tar.gz"))
               (sha256
                (base32
-                "0wsgw5vwl23jrnpsvd8v3xcp5k4waw5mk0164fynjhkv58i1dy54"))))
+                "0z9avc4mifwcpj3qdsf9m2rjw9jx03b2r9pj0c4xgla9fh6ppv9f"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
@@ -892,7 +930,7 @@ multiple processors and multiple cores when compressing data.")
 (define-public pixz
   (package
     (name "pixz")
-    (version "1.0.6")
+    (version "1.0.7")
     (source (origin
               (method url-fetch)
               (uri (string-append
@@ -900,7 +938,7 @@ multiple processors and multiple cores when compressing data.")
                     "/pixz-" version ".tar.xz"))
               (sha256
                (base32
-                "1s3j7zw6j5zi3fhdxg287ndr3wf6swac7z21mqd1pyiln530gi82"))))
+                "1ifxr18f2h75gkcrkx8033kwmwmrcgxshpaawyc2n4dzn1p2rqz5"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("pkg-config" ,pkg-config)
@@ -915,43 +953,6 @@ possible and can compress in parallel.  This is especially useful for large
 tarballs.")
     (license license:bsd-2)))
 
-(define-public bsdiff
-  (package
-    (name "bsdiff")
-    (version "4.3")
-    (home-page "https://www.daemonology.net/bsdiff/")
-    (source (origin
-              (method url-fetch)
-              (uri (string-append home-page name "-" version ".tar.gz"))
-              (sha256
-               (base32
-                "0j2zm3z271x5aw63mwhr3vymzn45p2vvrlrpm9cz2nywna41b0hq"))))
-    (build-system gnu-build-system)
-    (arguments
-     `(#:make-flags (list "INSTALL=install" "CC=gcc"
-                          (string-append "PREFIX=" (assoc-ref %outputs "out")))
-       #:phases (modify-phases %standard-phases
-                  (delete 'configure)
-                  (add-before 'build 'fix-Makefile
-                    (lambda _
-                      (substitute* "Makefile"
-                        ;; Adjust syntax to make it compatible with GNU Make.
-                        (("^\\.") "")
-                        ;; Help install(1) create the target directory.
-                        (("\\$\\{PREFIX\\}") "-D -t ${PREFIX}"))
-                      #t)))
-       #:tests? #f)) ;no tests
-    (inputs
-     `(("bzip2" ,bzip2)))
-    (synopsis "Patch binary files")
-    (description
-     "@command{bsdiff} and @command{bspatch} are tools for building and
-applying patches to binary files.  By using suffix sorting (specifically
-Larsson and Sadakane's @code{qsufsort}) and taking advantage of how
-executable files change, bsdiff routinely produces binary patches 50-80%
-smaller than those produced by @code{Xdelta}.")
-    (license license:bsd-2)))
-
 (define-public cabextract
  (package
    (name "cabextract")
@@ -996,6 +997,41 @@ smaller than those produced by @code{Xdelta}.")
     ;; Some source files specify gpl2+, lgpl2+, however COPYING is gpl3.
     (license license:gpl3+)))
 
+(define-public libjcat
+  (package
+    (name "libjcat")
+    (version "0.1.6")
+    (source
+     (origin
+       (method git-fetch)
+       (uri
+        (git-reference
+         (url "https://github.com/hughsie/libjcat")
+         (commit version)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "1a2z34m8611xvna9kwch8ralxx7c9mk4rm9vrxx7p9hr8sbqbsaz"))))
+    (build-system meson-build-system)
+    (native-inputs
+     `(("gobject-introspection" ,gobject-introspection)
+       ("help2man" ,help2man)
+       ("pkg-config" ,pkg-config)))
+    (inputs
+     `(("git" ,git)
+       ("glib" ,glib)
+       ("gnupg" ,gnupg)
+       ("gnutls" ,gnutls)
+       ("gpgme" ,gpgme)
+       ("json-glib" ,json-glib)
+       ("vala" ,vala)))
+    (home-page "https://github.com/hughsie/libjcat")
+    (synopsis "Library for reading and writing Jcat files")
+    (description
+     "This library allows reading and writing gzip-compressed JSON catalog
+files, which can be used to store GPG, PKCS-7 and SHA-256 checksums for each
+file.")
+    (license license:lgpl2.1+)))
+
 (define-public xdelta
   (package
     (name "xdelta")
@@ -1004,7 +1040,7 @@ smaller than those produced by @code{Xdelta}.")
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/jmacd/xdelta.git")
+             (url "https://github.com/jmacd/xdelta")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
@@ -1036,16 +1072,14 @@ human-readable output.")
 (define-public lrzip
   (package
     (name "lrzip")
-    (version "0.631")
+    (version "0.641")
     (source
      (origin
        (method url-fetch)
        (uri (string-append
-             "http://ck.kolivas.org/apps/lrzip/lrzip-" version ".tar.bz2"))
+             "http://ck.kolivas.org/apps/lrzip/lrzip-" version ".tar.xz"))
        (sha256
-        (base32
-         "0mb449vmmwpkalq732jdyginvql57nxyd31sszb108yps1lf448d"))
-       (patches (search-patches "lrzip-CVE-2017-8842.patch"))))
+        (base32 "0ziyanspd96dc3lp2qdcylc7aq8dhb511jhqrhxvlp502fjqjqrc"))))
     (build-system gnu-build-system)
     (native-inputs
      `(;; nasm is only required when building for 32-bit x86 platforms
@@ -1056,6 +1090,7 @@ human-readable output.")
        ("perl" ,perl)))
     (inputs
      `(("bzip2" ,bzip2)
+       ("lz4" ,lz4)
        ("lzo" ,lzo)
        ("zlib" ,zlib)))
     (home-page "http://ck.kolivas.org/apps/lrzip/")
@@ -1078,7 +1113,7 @@ well as bzip2.")
      (origin
        (method git-fetch)
        (uri (git-reference
-              (url "https://github.com/google/snappy.git")
+              (url "https://github.com/google/snappy")
               (commit version)))
        (file-name (git-file-name name version))
        (sha256
@@ -1189,6 +1224,12 @@ handles the 7z format which features very high compression ratios.")
      `(#:test-target "test"
        #:phases
        (modify-phases %standard-phases
+         ;; Enable PIC, so it can be used in shared libraries.
+         (add-after 'unpack 'use-pic
+           (lambda _
+             (substitute* "Makefile"
+               (("CPPFLAGS = " all) (string-append all "-fPIC ")))
+            #t))
          (delete 'configure)
          (replace 'install
            (lambda* (#:key outputs #:allow-other-keys)
@@ -1273,7 +1314,7 @@ or junctions, and always follows hard links.")
     (source
      (origin (method git-fetch)
              (uri (git-reference
-                    (url "http://github.com/twogood/unshield.git")
+                    (url "http://github.com/twogood/unshield")
                     (commit version)))
              (file-name (git-file-name name version))
              (sha256
@@ -1368,6 +1409,7 @@ or junctions, and always follows hard links.")
                            "v" version "/zstd-" version ".tar.gz"))
        (sha256
         (base32 "05ckxap00qvc0j51d3ci38150cxsw82w7s9zgd5fgzspnzmp1vsr"))))
+    (replacement zstd/fixed)
     (build-system gnu-build-system)
     (outputs '("out"                    ;1.2MiB executables and documentation
                "lib"                    ;1.2MiB shared library and headers
@@ -1398,7 +1440,10 @@ or junctions, and always follows hard links.")
 
                #t))))
        #:make-flags
-       (list "CC=gcc"
+       ;; TODO: Integrate in next rebuild cycle.
+       (list ,(if (%current-target-system)
+                (string-append "CC=" (cc-for-target))
+                "CC=gcc")
              (string-append "PREFIX=" (assoc-ref %outputs "out"))
              (string-append "LIBDIR=" (assoc-ref %outputs "lib") "/lib")
              (string-append "INCLUDEDIR=" (assoc-ref %outputs "lib") "/include")
@@ -1424,14 +1469,29 @@ speed.")
                    license:public-domain ; zlibWrapper/examples/fitblk*
                    license:zlib))))      ; zlibWrapper/{gz*.c,gzguts.h}
 
-(define-public pzstd
+(define zstd/fixed
   (package
+    (inherit zstd)
+    (source
+     (origin
+       (inherit (package-source zstd))
+       (patches
+        (search-patches
+         ;; From Ubuntu focal-security
+         "zstd-CVE-2021-24031_CVE-2021-24032.patch"))))))
+
+(define-public pzstd
+  (package/inherit zstd
     (name "pzstd")
-    (version (package-version zstd))
-    (source (package-source zstd))
-    (build-system gnu-build-system)
+    (outputs '("out"))
+    (inputs
+     `(,@(if (%current-target-system)
+           `(("googletest" ,googletest))
+           '())))
     (native-inputs
-     `(("googletest" ,googletest)))
+     `(,@(if (%current-system)
+           `(("googletest" ,googletest))
+           '())))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
@@ -1449,7 +1509,8 @@ speed.")
                (install-file "README.md" doc)
                #t))))
        #:make-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
+             (string-append "CXX=" ,(cxx-for-target))
              (string-append "PREFIX=" (assoc-ref %outputs "out")))))
     (home-page (package-home-page zstd))
     (synopsis "Threaded implementation of the Zstandard compression algorithm")
@@ -1532,6 +1593,7 @@ Compression ratios of 2:1 to 3:1 are common for text files.")
                                 "unzip-overflow-on-invalid-input.patch"
                                 "unzip-format-secure.patch"
                                 "unzip-overflow-long-fsize.patch"))))
+    (replacement unzip/fixed)
     (build-system gnu-build-system)
     ;; no inputs; bzip2 is not supported, since not compiled with BZ_NO_STDIO
     (arguments
@@ -1567,6 +1629,106 @@ recreates the stored directory structure by default.")
     (license (license:non-copyleft "file://LICENSE"
                                    "See LICENSE in the distribution."))))
 
+(define unzip/fixed
+  (package
+    (inherit unzip)
+    (version "6.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://sourceforge/infozip"
+                           "/UnZip%206.x%20%28latest%29/UnZip%206.0/unzip60.tar.gz"))
+       (sha256
+        (base32
+         "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83"))
+       (patches (search-patches "unzip-CVE-2014-8139.patch"
+                                "unzip-CVE-2014-8140.patch"
+                                "unzip-CVE-2014-8141.patch"
+                                "unzip-CVE-2014-9636.patch"
+                                "unzip-CVE-2015-7696.patch"
+                                "unzip-CVE-2015-7697.patch"
+                                "unzip-allow-greater-hostver-values.patch"
+                                "unzip-initialize-symlink-flag.patch"
+                                "unzip-remove-build-date.patch"
+                                "unzip-attribs-overflow.patch"
+                                "unzip-overflow-on-invalid-input.patch"
+                                "unzip-format-secure.patch"
+                                "unzip-overflow-long-fsize.patch"
+
+                                ;; From Fedora
+                                "unzip-alt-iconv-utf8.patch"
+                                "unzip-alt-iconv-utf8-print.patch"
+                                "unzip-fix-recmatch.patch"
+                                "unzip-case-insensitive.patch"
+                                "unzip-close.patch"
+                                "unzip-COVSCAN-fix-unterminated-string.patch"
+                                "unzip-CVE-2016-9844.patch"
+                                "unzip-CVE-2018-1000035.patch"
+                                "unzip-CVE-2018-18384.patch"
+                                "unzip-exec-shield.patch"
+                                "unzip-manpage-fix.patch"
+                                "unzip-overflow.patch"
+                                "unzip-timestamp.patch"
+                                "unzip-valgrind.patch"
+                                "unzip-x-option.patch"
+                                ;; CVE-2019-13232
+                                "unzip-zipbomb-manpage.patch"
+                                "unzip-zipbomb-part1.patch"
+                                "unzip-zipbomb-part2.patch"
+                                "unzip-zipbomb-part3.patch"
+
+                                ;; https://github.com/madler/unzip/issues/2
+                                "unzip-32bit-zipbomb-fix.patch"))))))
+
+(define-public ziptime
+  (let ((commit "2a5bc9dfbf7c6a80e5f7cb4dd05b4036741478bc")
+        (revision "0"))
+  (package
+    (name "ziptime")
+    (version (git-version "0.0.0" revision commit))
+    (source
+     (origin
+       (method git-fetch)
+       (uri (git-reference
+             (url "https://android.googlesource.com/platform/build")
+             (commit commit)))
+       (file-name (git-file-name name version))
+       (sha256
+        (base32 "0hrn61b3a97dlc4iqc28rwx8k8zf7ycbwzqqp93vj34zy5a541kn"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:tests? #f                      ; no test suite
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'change-directory
+           (lambda _
+             (chdir "tools/ziptime")))
+         (delete 'configure)            ; nothing to configure
+         (replace 'build
+           ;; There is no Makefile, only an ‘Android.bp’ file.  Ignore it.
+           (lambda _
+             (let ((c++ ,(cxx-for-target)))
+               (apply invoke c++ "-O2" "-o" "ziptime"
+                      (find-files "." "\\.cpp$")))))
+         (replace 'install
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let* ((out (assoc-ref outputs "out"))
+                    (bin (string-append out "/bin"))
+                    (doc (string-append out "/share/doc/" ,name "-" ,version)))
+               (install-file "ziptime" bin)
+               (install-file "README.txt" doc)))))))
+    ;; There is no separate home page for this tiny bundled build tool.
+    (home-page (string-append "https://android.googlesource.com/platform/build/"
+                              "+/master/tools/ziptime/README.txt"))
+    (synopsis "Normalize @file{.zip} archive header timestamps")
+    (description
+     "Ziptime helps make @file{.zip} archives reproducible by replacing
+timestamps in the file header with a fixed time (1 January 2008).
+
+``Extra fields'' are not changed, so you'll need to use the @code{-X} option to
+@command{zip} to prevent it from storing the ``universal time'' field.")
+    (license license:asl2.0))))
+
 (define-public zziplib
   (package
     (name "zziplib")
@@ -1581,6 +1743,7 @@ recreates the stored directory structure by default.")
               (sha256
                (base32
                 "0fbk9k7ryas2wh2ykwkvm1pbi40i88rfvc3dydh9xyd7w2jcki92"))))
+    (replacement zziplib/fixed)
     (build-system gnu-build-system)
     (arguments
      `(#:phases (modify-phases %standard-phases
@@ -1609,17 +1772,51 @@ recreates the stored directory structure by default.")
     ;; files carry the Zlib license; see "docs/copying.html" for details.
     (license (list license:lgpl2.0+ license:mpl1.1))))
 
+(define-public zziplib/fixed
+  (package
+    (inherit zziplib)
+    (name "zziplib")
+    (version "0.13.72")
+    (home-page "https://github.com/gdraheim/zziplib")
+    (source (origin
+              (method git-fetch)
+              (uri (git-reference (url home-page)
+                                  (commit (string-append "v" version))))
+              (file-name (git-file-name name version))
+              (sha256
+               (base32
+                "0i6bpa2b13z19alm6ig80364dnin1w28cvif18k6wkkb0w3dzp8y"))))
+    (arguments
+     `(#:phases
+       (modify-phases %standard-phases
+         (add-after 'install 'install-compatibility-symlinks
+           (lambda* (#:key outputs #:allow-other-keys)
+             (with-directory-excursion
+               (string-append (assoc-ref outputs "out") "/lib")
+               (map (lambda (lib new-symlink)
+                      (symlink lib new-symlink))
+                    (list "libzzip.so.13" "libzzipfseeko.so.13"
+                          "libzzipmmapped.so.13" "libzzipwrap.so.13")
+                    (list "libzzip-0.so.13" "libzzipfseeko-0.so.13"
+                          "libzzipmmapped-0.so.13" "libzzipwrap-0.so.13")))
+             #t)))))
+    (native-inputs
+     `(("python" ,python)
+       ,@(alist-delete "python"
+                       (package-native-inputs zziplib))))
+    (build-system cmake-build-system)))
+
 (define-public libzip
   (package
     (name "libzip")
-    (version "1.6.1")
+    (version "1.7.3")
     (source (origin
               (method url-fetch)
               (uri (string-append
                     "https://libzip.org/download/libzip-" version ".tar.xz"))
               (sha256
                (base32
-                "0h9nsgkw0dk4srsvmz6xy6f9l4h815xn07j8h40l8gqvcxxaqpbh"))))
+                "0ck1dk7zn5qzpgxklg0r26nfsf04xb6c46gsig060hkvvgzp6156"))))
     (native-inputs
      `(("perl" ,perl)))
     (inputs
@@ -1643,7 +1840,7 @@ archive can be reverted.")
     (source
      (origin
        (method url-fetch)
-       (uri (string-append "http://savannah.nongnu.org/download/atool/atool-"
+       (uri (string-append "mirror://savannah/atool/atool-"
                            version ".tar.gz"))
        (sha256
         (base32
@@ -1675,14 +1872,14 @@ of archives.")
 (define-public lunzip
   (package
     (name "lunzip")
-    (version "1.11")
+    (version "1.12")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/lzip/lunzip/"
                            "lunzip-" version ".tar.gz"))
        (sha256
-        (base32 "19zq3gmlbia2krq4k4zs1j0xjdv7nsdzqvfb0pyca5n53h2mzb91"))))
+        (base32 "1liaynyy3qcs29hfk1pnb7i9r1mnmpw557j5v356qsv6qnm4lnz5"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -1702,14 +1899,14 @@ Lunzip is intended to be fully compatible with the regular lzip package.")
 (define-public clzip
   (package
     (name "clzip")
-    (version "1.11")
+    (version "1.12")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/lzip/clzip/"
                            "clzip-" version ".tar.gz"))
        (sha256
-        (base32 "1h14dmc9fi10gcdpdpbgq1bwvcxvivppilj64pf720x8mw915mfr"))))
+        (base32 "1s7yidqvmxi61hh569h5aci816l6qkffjgx0zx57qyyq0qq2pjgw"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -1728,18 +1925,19 @@ Clzip is intended to be fully compatible with the regular lzip package.")
 (define-public lzlib
   (package
     (name "lzlib")
-    (version "1.11")
+    (version "1.12")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/lzip/lzlib/"
                            "lzlib-" version ".tar.gz"))
        (sha256
-        (base32 "0djdj4sg33rzi4k84cygvnp09bfsv6i8wy2k7i67rayib63myp3c"))))
+        (base32 "1c9pwd6by8is4z8bs6j306jyy6pgm2dvsn4fr7fg2b5m5qj88pcf"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
-       (list "CC=gcc"
+       (list (string-append "CC=" ,(cc-for-target))
+             "--disable-static"
              "--enable-shared")))       ; only static (.a) is built by default
     (home-page "https://www.nongnu.org/lzip/lzlib.html")
     (synopsis "Lzip data compression C library")
@@ -1754,14 +1952,14 @@ corrupted input.")
 (define-public plzip
   (package
     (name "plzip")
-    (version "1.8")
+    (version "1.9")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/lzip/plzip/"
                            "plzip-" version ".tar.gz"))
        (sha256
-        (base32 "04indil809qgfmz776imb3dnhkysh7zk28jcv3mw0ahl2lyaxbzd"))))
+        (base32 "19zinpx7hssl6r3vilpvq2s7wha3545xan8b0vcvsxnyipdx3n0l"))))
     (build-system gnu-build-system)
     (inputs
      `(("lzlib" ,lzlib)))
@@ -1784,20 +1982,18 @@ single-member files which can't be decompressed in parallel.")
 (define-public innoextract
   (package
    (name "innoextract")
-   (version "1.8")
+   (version "1.9")
    (source
     (origin
      (method url-fetch)
-     (uri (string-append "https://github.com/dscharrer/innoextract/releases"
-                         "/download/" version
+     (uri (string-append "https://constexpr.org/innoextract/files/"
+                         "innoextract-" version "/"
                          "/innoextract-" version ".tar.gz"))
      (sha256
-      (base32
-       "0saj50n8ds85shygy4mq1h6s99510r9wgjjdll4dmvhra4lzcy2y"))))
+      (base32 "09l1z1nbl6ijqqwszdwch9mqr54qb7df0wp2sd77v17dq6gsci33"))))
    (build-system cmake-build-system)
    (arguments
-    `(#:tests? #f
-      #:configure-flags '("-DBoost_NO_BOOST_CMAKE=ON")))
+    `(#:tests? #f))
    (inputs `(("boost" ,boost)
              ("libiconv" ,libiconv)
              ("xz" ,xz)))
@@ -1811,16 +2007,24 @@ non-Windows systems without running the actual installer using wine.")
 (define-public google-brotli
   (package
     (name "google-brotli")
-    (version "1.0.7")
+    (version "1.0.9")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/google/brotli.git")
+             (url "https://github.com/google/brotli")
              (commit (string-append "v" version))))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "1811b55wdfg4kbsjcgh1kc938g118jpvif97ilgrmbls25dfpvvw"))))
+        (base32 "1fikasxf7r2dwlk8mv8w7nmjkn0jw5ic31ky3mvpkdzwgd4xfndl"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           ;; Cherry-picked from upstream since the latest release
+           ;; https://github.com/google/brotli/commit/09b0992b6acb7faa6fd3b23f9bc036ea117230fc
+           (substitute* (find-files "scripts" "^lib.*pc\\.in")
+             (("-R\\$\\{libdir\\} ") ""))
+           #t))))
     (build-system cmake-build-system)
     (arguments
      `(#:phases
@@ -1904,7 +2108,8 @@ decompression is a little bit slower.")
                                  version "/upx-" version "-src.tar.xz"))
              (sha256
               (base32
-               "051pk5jk8fcfg5mpgzj43z5p4cn7jy5jbyshyn78dwjqr7slsxs7"))))
+               "051pk5jk8fcfg5mpgzj43z5p4cn7jy5jbyshyn78dwjqr7slsxs7"))
+             (patches (search-patches "upx-CVE-2021-20285.patch"))))
     (build-system gnu-build-system)
     (native-inputs
      `(("perl" ,perl)))
@@ -1947,7 +2152,7 @@ download times, and other distribution and storage costs.")
     (source (origin
               (method git-fetch)
               (uri (git-reference
-                    (url "https://github.com/stachenov/quazip.git")
+                    (url "https://github.com/stachenov/quazip")
                     (commit (string-append "v" version))))
               (file-name (git-file-name name version))
               (sha256
@@ -1980,20 +2185,26 @@ reading from and writing to ZIP archives. ")
 (define-public zutils
   (package
     (name "zutils")
-    ;; Check and remove the lint-hidden-cve property when updating.
-    (version "1.8")
+    (version "1.10")
     (source
      (origin
        (method url-fetch)
        (uri (string-append "mirror://savannah/zutils/zutils-" version ".tar.lz"))
        (sha256
-        (base32 "0dx35mv78fgqgz6sszs05ng8ipz2xy09ry9vpmka2rmy08b7x907"))))
+        (base32 "15dimqp8zlqaaa2l46r22srp1py38mlmn69ph1j5fmrd54w43m0d"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
        (list "--sysconfdir=/etc")
        #:phases
        (modify-phases %standard-phases
+         (add-before 'check 'disable-failing-tests
+           ;; XXX https://lists.nongnu.org/archive/html/zutils-bug/2020-07/msg00005.html
+           (lambda _
+             (substitute* "testsuite/check.sh"
+               (("\"\\$\\{ZGREP\\}\" -N -L \"GNU\"") "true")
+               (("\"\\$\\{ZGREP\\}\" -N -L \"nx_pattern\"") "false"))
+             #t))
          (replace 'install
           (lambda* (#:key make-flags outputs #:allow-other-keys)
             (apply invoke "make" "install"
@@ -2003,7 +2214,6 @@ reading from and writing to ZIP archives. ")
     (native-inputs
      ;; Needed to extract the source tarball and run the test suite.
      `(("lzip" ,lzip)))
-    (properties `((lint-hidden-cve . ("CVE-2018-1000637"))))
     (home-page "https://www.nongnu.org/zutils/zutils.html")
     (synopsis "Utilities that transparently operate on compressed files")
     (description
@@ -2102,16 +2312,16 @@ file compression algorithm.")
 (define-public xarchiver
   (package
     (name "xarchiver")
-    (version "0.5.4.15")
+    (version "0.5.4.17")
     (source
      (origin
        (method git-fetch)
        (uri (git-reference
-             (url "https://github.com/ib/xarchiver.git")
+             (url "https://github.com/ib/xarchiver")
              (commit version)))
        (file-name (git-file-name name version))
        (sha256
-        (base32 "0a3y54r5zp2c0cqm77r07qrl1vh200wvqmbhm35diy22fvkq5mwc"))))
+        (base32 "00adrjpxqlaccrwjf65w3vhxfswdj0as8aj263c6f9b85llypc5v"))))
     (build-system glib-or-gtk-build-system)
     (native-inputs
      `(("gettext" ,gettext-minimal)
@@ -2137,7 +2347,7 @@ archiver is not installed.")
     (source (origin
               (method git-fetch)
               (uri (git-reference
-                    (url "https://github.com/AQUAOSOTech/tarsplitter.git")
+                    (url "https://github.com/AQUAOSOTech/tarsplitter")
                     (commit (string-append "v" version))))
               (file-name (git-file-name name version))
               (sha256
@@ -2171,7 +2381,7 @@ chunks.")
     (source (origin
               (method git-fetch)
               (uri (git-reference
-                    (url "https://github.com/Blosc/c-blosc.git")
+                    (url "https://github.com/Blosc/c-blosc")
                     (commit (string-append "v" version))))
               (file-name (git-file-name name version))
               (sha256
@@ -2223,3 +2433,31 @@ computations.")
 with their error correction data losslessly rearranged for better compression,
 to their original, binary CD format.")
     (license license:gpl3+)))
+
+(define-public tarlz
+  (package
+    (name "tarlz")
+    (version "0.19")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://savannah/lzip/tarlz/"
+                           "tarlz-" version ".tar.lz"))
+       (sha256
+        (base32 "09xal55973ivzpaja93jcc1pfla8gb3vrk8dx7pj9qvvz5aynf9n"))))
+    (build-system gnu-build-system)
+    (native-inputs
+     `(("lzip" ,lzip)))
+    (inputs
+     `(("lzlib" ,lzlib)))
+    (home-page "https://www.nongnu.org/lzip/tarlz.html")
+    (synopsis "Combination of the tar archiver and the lzip compressor")
+    (description
+     "Tarlz is a massively parallel (multi-threaded) combined implementation of
+the tar archiver and the lzip compressor.  Tarlz creates, lists, and extracts
+archives in a simplified and safer variant of the POSIX pax format compressed
+with lzip, keeping the alignment between tar members and lzip members.  The
+resulting multimember tar.lz archive is fully backward compatible with standard
+tar tools like GNU tar, which treat it like any other tar.lz archive.  Tarlz
+can append files to the end of such compressed archives.")
+    (license license:gpl2+)))