* admin/merge-gnulib (GNULIB_MODULES): Add getrandom.
* doc/lispref/text.texi (Format of GnuTLS Cryptography Inputs):
Don’t say that iv-auto uses GNUTLS_RND_NONCE.  Also, don’t say
that it returns the IV’s actual value, as it never has done that.
* src/fns.c, src/sysdep.c: Include sys/random.h, for getrandom.
* src/fns.c (Fsecure_hash_algorithms): Use getrandom so that this
function does not depend on HAVE_GNUTLS3.
* src/sysdep.c: Do not include <gnutls/crypto.h>.
(random_seed) [HAVE_LRAND48]: Can be long int now.
(init_random) [!WINDOWSNT]: Use getrandom syscall instead
of opening /dev/urandom, as this works even on GNU/Linux
hosts that lack /dev/urandom.  Don’t bother with gnutls_rnd
as it’s not needed now that we have getrandom.

Code is supposed to use the filename module now.
* admin/merge-gnulib (GNULIB_MODULES): Replace dosname with filename.
* lib/dosname.h: Remove this forwarding stub.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* lib-src/emacsclient.c, src/fileio.c:
Include filename.h instead of dosname.h.

This is a companion to the recent set-file-modes patch.
It adds support for a ‘nofollow’ flag to set-file-times (Bug#39773).
Like the set-file-modes patch, it needs work in the w32 port.
* admin/merge-gnulib (GNULIB_MODULES): Add futimens, utimensat.
Remove utimens.
* doc/lispref/files.texi (Changing Files):
* etc/NEWS: Mention the change.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* lisp/files.el (copy-directory):
* lisp/gnus/gnus-cloud.el (gnus-cloud-replace-file):
* lisp/net/tramp-adb.el (tramp-adb-handle-copy-file):
* lisp/net/tramp-smb.el (tramp-smb-handle-copy-file):
* lisp/tar-mode.el (tar-copy):
* test/lisp/filenotify-tests.el (file-notify-test03-events):
* test/lisp/files-tests.el:
(files-tests-file-name-non-special-set-file-times):
* test/lisp/net/tramp-tests.el (tramp-test22-file-times):
When setting file times, avoid following symbolic links
when the file is not supposed to be a symbolic link.
* lib/futimens.c, lib/utimensat.c, m4/futimens.m4, m4/utimensat.m4:
New files, copied from Gnulib.
* lisp/gnus/gnus-cloud.el (gnus-cloud-replace-file):
When creating a file that is not supposed to exist already,
use the excl flag to check this.
* lisp/net/tramp-adb.el (tramp-adb-handle-set-file-times):
* lisp/net/tramp-sh.el (tramp-sh-handle-set-file-times):
* lisp/net/tramp-sudoedit.el (tramp-sudoedit-handle-set-file-times):
Accept an optional FLAG arg that is currently ignored,
and add a FIXME comment for it.
* lisp/net/tramp-gvfs.el (tramp-gvfs-handle-set-file-times):
* src/fileio.c (Fset_file_times):
Support an optional FLAG arg.
* src/fileio.c (Fcopy_file): Use futimens instead of set_file_times,
as it’s simpler and is a POSIX API.
* src/sysdep.c (set_file_times): Move from here ...
* src/w32.c (set_file_times): ... to here, and make it static,
since it is now used only in w32.c.  Presumably w32.c should also
add support for futimens and utimensat (the POSIX APIs, which
Emacs now uses) and it can remove fdutimens (the Gnulib API,
which Emacs no longer uses).

This avoids some race conditions (Bug#39683).  E.g., if some other
program changes a file to a symlink between the time Emacs creates
the file and the time it changes the file’s permissions, using the
new flag prevents Emacs from inadvertently changing the
permissions of a victim in some completely unrelated directory.
* admin/merge-gnulib (GNULIB_MODULES): Add fchmodat.
* doc/lispref/files.texi (Testing Accessibility, Changing Files):
* doc/lispref/os.texi (File Notifications):
* etc/NEWS:
Adjust documentation accordingly.
* lib/chmodat.c, lib/fchmodat.c, lib/lchmod.c, m4/fchmodat.m4:
* m4/lchmod.m4: New files, copied from Gnulib.
* lib/gnulib.mk.in: Regenerate.
* lisp/dired-aux.el (dired-do-chmod):
* lisp/doc-view.el (doc-view-make-safe-dir):
* lisp/emacs-lisp/autoload.el (autoload--save-buffer):
* lisp/emacs-lisp/bytecomp.el (byte-compile-file):
* lisp/eshell/em-pred.el (eshell-pred-file-mode):
* lisp/files.el (backup-buffer-copy, copy-directory):
* lisp/gnus/mail-source.el (mail-source-movemail):
* lisp/gnus/mm-decode.el (mm-display-external):
* lisp/gnus/nnmail.el (nnmail-write-region):
* lisp/net/tramp-adb.el (tramp-adb-handle-file-local-copy)
(tramp-adb-handle-write-region):
* lisp/net/tramp-sh.el (tramp-do-copy-or-rename-file-directly):
* lisp/net/tramp-sudoedit.el (tramp-sudoedit-handle-write-region):
* lisp/net/tramp.el (tramp-handle-write-region)
(tramp-make-tramp-temp-file):
* lisp/server.el (server-ensure-safe-dir):
* lisp/url/url-util.el (url-make-private-file):
When getting or setting file modes, avoid following symbolic links
when the file is not supposed to be a symbolic link.
* lisp/doc-view.el (doc-view-make-safe-dir):
Omit no-longer-needed separate symlink test.
* lisp/gnus/gnus-util.el (gnus-set-file-modes):
* lisp/net/tramp.el (tramp-handle-file-modes):
* lisp/net/tramp-gvfs.el (tramp-gvfs-handle-set-file-modes):
* src/fileio.c (symlink_nofollow_flag): New function.
(Ffile_modes, Fset_file_modes):
Support an optional FLAG arg.  All C callers changed.
* lisp/net/ange-ftp.el (ange-ftp-set-file-modes):
* lisp/net/tramp-adb.el (tramp-adb-handle-set-file-modes):
* lisp/net/tramp-sh.el (tramp-sh-handle-set-file-modes):
* lisp/net/tramp-smb.el (tramp-smb-handle-set-file-modes):
* lisp/net/tramp-sudoedit.el (tramp-sudoedit-handle-set-file-modes):
Accept an optional FLAG arg that is currently ignored,
and add a FIXME comment for it.
* m4/gnulib-comp.m4: Regenerate.

It’s not needed, since Emacs always uses the system putenv and all
platforms have putenv.  This improves on the fix for Bug#19874.
Suggested by Bruno Haible.
* admin/merge-gnulib (GNULIB_MODULES): Remove putenv.
* configure.ac: Remove workarounds for Gnulib putenv module.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* lib/putenv.c, m4/putenv.m4: Remove.

Run "TZ=UTC0 admin/update-copyright $(git ls-files)".

This incorporates:
2019-12-06 nstrftime: better width support for %N, %z
2019-12-03 Avoid hassles caused by [[noreturn]] in C++
2019-12-02 Fix mistakes in --enable-threads=isoc fixes from 2019-12-01
* admin/merge-gnulib (AVOIDED_MODULES): Avoid pthread-h.
* lib/_Noreturn.h, lib/nstrftime.c, m4/gnulib-common.m4:
* m4/timer_time.m4:
Copy from Gnulib.
* lib/gnulib.mk.in: Regenerate.

etags had undefined behavior if input files, lines, tags, etc.,
had more than INT_MAX bytes.  Clean up the usage of integer types
to fix the overflow errors I found.
* admin/merge-gnulib (GNULIB_MODULES): Add mempcpy.
* lib-src/etags.c: Include inttypes.h, intprops.h.
(memcpyz): New function.  Use it to simplify several occurrences
of memcpy followed by storing a trailing '\0'.
(xnew): Use xnmalloc, to catch overflow on integer multiplication.
(xrnew): Change last arg to multiplier.  The type is not needed.
All callers changed.
(node, lineno, charno, linecharno, invalidcharno, make_tag):
(pfnote, add_node, number_len, C_symtype, lbz, Makefile_targets)
(readline):
Use intmax_t for line numbers and character positions, instead of
int or long.
(linebuffer, make_tag, pfnote, total_size_of_entries, put_entry)
(in_word_set, C_symtype, token, cstack, pushclass_above):
(popclass_above, write_classname, consider_token, C_entries)
(Ruby_functions, Makefile_targets, Lua_functions, TeX_commands)
(TeX_decode_env, erlang_func, erlang_attribute, erlang_atom)
(substitute, regex_tag_multiline, nocase_tail, readline_interval)
(readline, savenstr, concat, etags_getcwd, relative_filename)
(linebuffer_setlen):
Use ptrdiff_t for object sizes, instead of int or long or unsigned
or size_t.
(write_classname, C_entries):
Avoid sprintf, as the result could exceed INT_MAX bytes
and then behavior goes haywire.
(main): Use int, instead of unsigned, for argv counts.
(get_language_from_filename): Use bool for boolean.
(Ruby_functions): Prefer strcpy to memcpy when copying "=".
(linebuffer_setlen): Use ‘if’ instead of ‘while’.
(memory_full, xnmalloc, xnrealloc): New functions.
(xmalloc): Use memory_full, and take a ptrdiff_t instead of a size_t.
(xrealloc): Remove; no longer needed.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* lib/mempcpy.c, m4/mempcpy.m4: New files, copied from Gnulib.

* admin/merge-gnulib (GNULIB_MODULES): Add double-slash-root.
Emacs was already using this Gnulib module indirectly, so this
is merely noting that there is now a direct dependency.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* src/fileio.c (search_embedded_absfilename):
Use DOUBLE_SLASH_IS_DISTINCT_ROOT instead of (WINDOWSNT || CYGWIN).
Simplify.

PATH_MAX is standardized, MAXPATHLEN is not.
Also, the Gnulib pathmax module fixes some rare bugs with PATH_MAX.
So prefer PATH_MAX to MAXPATHLEN unless we know the latter is
also correct (for some platform-specific code).
* admin/merge-gnulib (GNULIB_MODULES): Add pathmax.
This module was already present, as a dependency of canonicalize-lgpl,
but now Emacs is using it directly.  Sort.
* lib-src/emacsclient.c: Include stdint.h, pathmax.h.
(get_current_dir_name): Sync to current src/sysdep.c.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.
* src/sysdep.c: Include pathmax.h.
(get_current_dir_name_or_unreachable):
Use PATH_MAX instead of MAXPATHLEN.