gnu: node-lts: Replace customized c-ares-for-node by c-ares.

* gnu/packages/node.scm (node-lts) [native-inputs]: Replace c-ares-for-node by
c-ares.
[inputs]: Ditto.

Change-Id: Ibef027d55c14e302d406d6478fed474f67c0d508

gnu: Remove nghttp2-for-node.

This hidden package is not needed as the ancient version of node we use to
bootstrap llhttp can be built using the standard nghttp2 package.

* gnu/packages/web.scm (assimp-5.0): Delete variable.

Change-Id: Ib077fcc55c9bf7fd3caab69220aa8c86e5c33f8a

gnu: node: Replace customized nghttp2-for-node by nghttp2.

* gnu/packages/node.scm (node) [native-inputs]: Replace nghttp2-for-node by
nghttp2.
[inputs]: Ditto.
[arguments]<#:phases>: Adjust accordingly by skipping failing tests.

Change-Id: Ia3d63ea1c428c1353d6ec6fda394ccb016eb6603

system: examples: Fix typo in bare-hurd.tmpl.

* gnu/system/examples/bare-hurd.tmpl: Add missing line-continuation backslash.

Change-Id: Ib918cff3ca96f2a199869e876b6a75fedb09c983

gnu: Add tests/shadow.scm

This is a follow-up to commit
    a1ecd7f56c4ffadc49d5501a0df7f4c4556120c2
    system: Add /etc/subuid and /etc/subgid support.

This file was already registered in gnu/local.mk.

* gnu/tests/shadow.scm: New file.

Change-Id: I1785206d56357f8262bd4277ef48f29183c47adc

etc: ungraft: Use ‘package-mapping’ directly.

* etc/manifests/ungraft.scm (ungraft): New procedure.
<top-level>: Use it.  Remove ‘ungraft-all’.

Change-Id: I6f1badf06dad9116d4242c7d1fff5ca53e6522f8

etc: upgrade: Really compute joint upgrades.

Previously, since input rewriting did not happen recursively, libgcrypt
would for instance be built against the old libgpg-error.

* etc/manifests/upgrade.scm (joint-security-upgrades): Pass #:recursive? #t
to ‘package-input-rewriting’.

Change-Id: I7daaa11629aa12b833ca941a3a996c3db2754a7a

packages: Add #:recursive? to ‘package-input-rewriting’.

* guix/packages.scm (package-input-rewriting): Add #:recursive?
[cut?]: Honor it.
* tests/packages.scm ("package-input-rewriting, recursive"): New test.
* doc/guix.texi (Defining Package Variants): Document it.

Change-Id: Ie82f35ae0ae873dc68f8b1c0dd6616f552772e65

services: Add rootless-podman-service-type.

* gnu/services/containers.scm: New file;
(rootless-podman-configuration): new variable;
(rootless-podman-service-subids): new variable;
(rootless-podman-service-accounts): new variable;
(rootless-podman-service-profile): new variable;
(rootless-podman-shepherd-services): new variable;
(rootless-podman-service-etc): new variable;
(rootless-podman-service-type): new variable.
* gnu/local.mk: Test it.
* gnu/local.mk: Add them.
* doc/guix.texi (Miscellaneous Services): Document it.

Change-Id: I041496474c1027da353bd6852f2554a065914d7a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

services: iptables: Provide a default value.

There doesn't seem to be a reason to force users to write

(service iptables-service-type
         (iptables-configuration))

instead of simply

(service iptables-service-type)

This patch provides a default value for the iptables-service-type.

* gnu/services/networking.scm (iptables-service-type): Set default-value.

Change-Id: I93b6c544dfb064c7a0a999549dff61007a38f842
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

services: pam: Allow extension of pam limits.

* gnu/services/pam.scm (pam-limits-service-type): Allow extension of pam
limits rules from users and services.

Change-Id: I93a363d1a2887493d52ef3ae32fc9721f81ddfa8
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

system: pam: Export pam records predicates.

* gnu/system/pam.scm: Export pam-service-name?, pam-entry? and pam-limits-entry?.

Change-Id: I609acfcaae85b4969dc385b72b307e470f5a246e
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

system: Add /etc/subuid and /etc/subgid support.

This commit adds a Guix System service to handle allocation of subuid
and subgid requests.  Users that don't care can just add themselves as a
subid-range and don't need to specify anything but their user name.
Users that care about specific ranges, such as possibly LXD, can specify
a start and a count.

* doc/guix.texi (Miscellaneous Services): Document it.
* gnu/build/activation.scm (activate-subuids+subgids): New variable.
* gnu/local.mk: Add gnu/tests/shadow.scm.
* gnu/system/accounts.scm (sexp->subid-range): New variable.
* gnu/system/shadow.scm (%root-subid): New variable;
(subids-configuration): new record;
(subid-range->gexp): new variable;
(assert-valid-subids): new variable;
(delete-duplicate-ranges): new variable;
(subids-activation): new variable;
(subids-extension): new record;
(append-subid-ranges): new variable;
(subids-extension-merge): new variable;
(subids-service-type): new variable.
* gnu/tests/shadow.scm (subids): New system test.

Change-Id: I3755e1c75771220c74fe8ae5de1a7d90f2376635
Signed-off-by: Giacomo Leidi <goodoldpaul@autistici.org>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

accounts: Add /etc/subid and /etc/subgid allocation logic.

This commit adds allocation logic for subid ranges. Subid ranges are
ranges of contiguous subids that are mapped to a user in the host
system. This patch implements a flexible allocation algorithm allowing
users that do not want (or need) to specify details of the subid ranges
that they are requesting to avoid doing so, while upholding requests of
users that need to have specific ranges.

* gnu/build/accounts.scm (%subordinate-id-min): New variable;
(%subordinate-id-max): new variable;
(%subordinate-id-count): new variable;
(subordinate-id?): new variable;
(&subordinate-id-error): new variable;
(&subordinate-id-overflow-error): new variable;
(&illegal-subid-range-error): new variable;
(&specific-subid-range-expected-error): new variable;
(&generic-subid-range-expected-error): new variable;
(within-interval?): new variable;
(allocate-unused-range): new variable;
(allocate-generic-range): new variable;
(allocate-specific-range): new variable;
(reserve-subids): new variable;
(range->entry): new variable;
(entry->range): new variable;
(allocate-subids): new variable;
(subuid+subgid-databases): new variable.

* gnu/system/accounts.scm (subid-range-end): New variable;
(subid-range-has-start?): new variable;
(subid-range-less): new variable.

* test/accounts.scm: Test them.

Change-Id: I8de1fd7cfe508b9c76408064d6f498471da0752d
Co-Authored-By: Ludovic Courtès <ludo@gnu.org>
Signed-off-by: Giacomo Leidi <goodoldpaul@autistici.org>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

accounts: Add /etc/subuid and /etc/subgid support.

This commit adds a new record type, <subid-entry> and serializers
and deserializers for it in (gnu build accounts).  Each instance of this
record represents one line in either /etc/subuid or /etc/subgid.  Since
Shadow uses the same representation for both files, it should be ok if
we do it as well.

This commit adds also <subid-range>, a user facing representation of
<subid-entry>. It is supposed to be usable directly in OS configurations.

* gnu/build/accounts.scm (subid-entry): New record;
(write-subgid): add serializer for subgids;
(write-subuid): add serializer for subuids;
(read-subgid): add serializer for subgids;
(read-subuid): add serializer for subuids.
* gnu/system/accounts.scm (subid-range): New record.
* test/accounts.scm: Test them.

Change-Id: I6b037e40e354c069bf556412bb5b626bd3ea1b2c
Signed-off-by: Giacomo Leidi <goodoldpaul@autistici.org>
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

gramps: Update to 5.2.3.

* gnu/packages/genealogy.scm (gramps): Update to 5.2.3.

Change-Id: Icfd3470989da905d50233564b894887305e9de1e

system: examples: Update instructions in {bare,devel}-hurd64.tmpl.

* gnu/system/examples/bare-hurd64.tmpl: Remove --machine q35, there seems to
be no longer any need for this.  Mention that there is no login prompt.
* gnu/system/examples/devel-hurd64.tmpl: Likewise.

Change-Id: Ib918cff3ca96f2a199869e876b6a75fedb09c983

gnu: Add privacy-redirect-icecat.

* gnu/packages/browser-extensions.scm (privacy-redirect)
(privacy-redirect/icecat): New variables.

Change-Id: I92778c4b46a30f88f23758cc65837b4aecccbd09

gnu: Add livemarks-icecat.

* gnu/packages/browser-extensions.scm (livemarks,livemarks/icecat): New
variables.

Change-Id: Ie13563ac62ed2d39c5b52e681c6f9351dbdab41c

gnu: Add adaptive-tab-bar-colour-icecat.

* gnu/packages/browser-extensions.scm (adaptive-tab-bar-colour)
(adaptive-tab-bar-colour/icecat): New variables.

Change-Id: I94343ef4246b1a7a0f5606b7d2214174475e7f03