Update from Gnulib

This incorporates:
2020-06-27 getloadavg: don’t depend on fopen-gnu
2020-06-25 c-dtoastr, c-ldtoastr: new modules
2020-06-01 getloadavg: fix double-increment bug
2020-06-01 tempname: use getrandom, not getentropy
2020-05-31 tempname: merge from glibc and coreutils
2020-05-31 getentropy: work around a macOS and Solaris problem
2020-05-31 fnmatch: merge from glibc
2020-05-30 unistd: remove conflicting declaration of getrandom
2020-05-30 don't assume that UNICODE is not defined
2020-05-29 fix compilation error on native Windows
2020-05-28 avoid dynamic loading of Windows API functions when possible
2020-05-28 at-internal: make more robust in multithreaded applications
2020-05-28 getloadavg: make more robust in multithreaded applications
2020-05-27 getloadavg: make more robust in multithreaded applications
2020-05-26 count-one-bits: fix MSVC specific code
2020-05-25 getentropy, getrandom: new modules
2020-05-24 open, openat: really support O_CLOEXEC
2020-05-23 verify: document ‘assume’ better
2020-05-21 regex: configure better with "clang -fsanitize=leak"
2020-05-21 memmem: configure better with "clang -fsanitize=undefined"
2020-05-19 ftoastr: fix ifndef typo
* build-aux/config.guess, build-aux/config.sub, doc/misc/texinfo.tex:
* lib/count-one-bits.h, lib/ftoastr.c, lib/ftoastr.h:
* lib/getloadavg.c, lib/gettimeofday.c, lib/libc-config.h:
* lib/open.c, lib/openat-proc.c, lib/tempname.c, lib/tempname.h:
* lib/unistd.in.h, lib/verify.h, m4/memmem.m4, m4/regex.m4:
* m4/unistd_h.m4:
Update from Gnulib.
* lib/getrandom.c, lib/sys_random.in.h:
* m4/getrandom.m4, m4/sys_random_h.m4:
New files, copied from Gnulib.
* lib/gnulib.mk.in, m4/gnulib-comp.m4: Regenerate.

15 files changed, 634 insertions, 222 deletions

diff --git a/lib/count-one-bits.h b/lib/count-one-bits.h
index eea56d85910..6c5b75708cf 100644
--- a/lib/count-one-bits.h
+++ b/lib/count-one-bits.h
@@ -34,29 +34,13 @@ _GL_INLINE_HEADER_BEGIN
 extern "C" {
 #endif
 
-/* Expand to code that computes the number of 1-bits of the local
-   variable 'x' of type TYPE (an unsigned integer type) and return it
-   from the current function.  */
-#define COUNT_ONE_BITS_GENERIC(TYPE)                                   \
-    do                                                                  \
-      {                                                                 \
-        int count = 0;                                                  \
-        int bits;                                                       \
-        for (bits = 0; bits < sizeof (TYPE) * CHAR_BIT; bits += 32)     \
-          {                                                             \
-            count += count_one_bits_32 (x);                             \
-            x = x >> 31 >> 1;                                           \
-          }                                                             \
-        return count;                                                   \
-      }                                                                 \
-    while (0)
-
-/* Assuming the GCC builtin is BUILTIN and the MSC builtin is MSC_BUILTIN,
+/* Assuming the GCC builtin is GCC_BUILTIN and the MSC builtin is MSC_BUILTIN,
    expand to code that computes the number of 1-bits of the local
    variable 'x' of type TYPE (an unsigned integer type) and return it
    from the current function.  */
 #if __GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)
-# define COUNT_ONE_BITS(BUILTIN, MSC_BUILTIN, TYPE) return BUILTIN (x)
+# define COUNT_ONE_BITS(GCC_BUILTIN, MSC_BUILTIN, TYPE) \
+    return GCC_BUILTIN (x)
 #else
 
 /* Compute and return the number of 1-bits set in the least
@@ -71,14 +55,46 @@ count_one_bits_32 (unsigned int x)
   return (x >> 8) + (x & 0x00ff);
 }
 
+/* Expand to code that computes the number of 1-bits of the local
+   variable 'x' of type TYPE (an unsigned integer type) and return it
+   from the current function.  */
+# define COUNT_ONE_BITS_GENERIC(TYPE)                                   \
+    do                                                                  \
+      {                                                                 \
+        int count = 0;                                                  \
+        int bits;                                                       \
+        for (bits = 0; bits < sizeof (TYPE) * CHAR_BIT; bits += 32)     \
+          {                                                             \
+            count += count_one_bits_32 (x);                             \
+            x = x >> 31 >> 1;                                           \
+          }                                                             \
+        return count;                                                   \
+      }                                                                 \
+    while (0)
+
 # if 1500 <= _MSC_VER && (defined _M_IX86 || defined _M_X64)
 
 /* While gcc falls back to its own generic code if the machine
    on which it's running doesn't support popcount, with Microsoft's
    compiler we need to detect and fallback ourselves.  */
-#  pragma intrinsic __cpuid
-#  pragma intrinsic __popcnt
-#  pragma intrinsic __popcnt64
+
+#  if 0
+#   include <intrin.h>
+#  else
+    /* Don't pollute the namespace with too many MSVC intrinsics.  */
+#   pragma intrinsic (__cpuid)
+#   pragma intrinsic (__popcnt)
+#   if defined _M_X64
+#    pragma intrinsic (__popcnt64)
+#   endif
+#  endif
+
+#  if !defined _M_X64
+static inline __popcnt64 (unsigned long long x)
+{
+  return __popcnt ((unsigned int) (x >> 32)) + __popcnt ((unsigned int) x);
+}
+#  endif
 
 /* Return nonzero if popcount is supported.  */
 
@@ -90,25 +106,30 @@ popcount_supported (void)
 {
   if (popcount_support < 0)
     {
+      /* Do as described in
+         <https://docs.microsoft.com/en-us/cpp/intrinsics/popcnt16-popcnt-popcnt64> */
       int cpu_info[4];
       __cpuid (cpu_info, 1);
-      popcount_support = (cpu_info[2] >> 23) & 1;  /* See MSDN.  */
+      popcount_support = (cpu_info[2] >> 23) & 1;
     }
   return popcount_support;
 }
 
-#  define COUNT_ONE_BITS(BUILTIN, MSC_BUILTIN, TYPE)    \
-     do                                                 \
-       {                                                \
-         if (popcount_supported ())                     \
-           return MSC_BUILTIN (x);                      \
-         else                                           \
-           COUNT_ONE_BITS_GENERIC (TYPE);               \
-       }                                                \
+#  define COUNT_ONE_BITS(GCC_BUILTIN, MSC_BUILTIN, TYPE) \
+     do                                                  \
+       {                                                 \
+         if (popcount_supported ())                      \
+           return MSC_BUILTIN (x);                       \
+         else                                            \
+           COUNT_ONE_BITS_GENERIC (TYPE);                \
+       }                                                 \
      while (0)
+
 # else
-#  define COUNT_ONE_BITS(BUILTIN, MSC_BUILTIN, TYPE)	\
+
+#  define COUNT_ONE_BITS(GCC_BUILTIN, MSC_BUILTIN, TYPE) \
      COUNT_ONE_BITS_GENERIC (TYPE)
+
 # endif
 #endif
 
diff --git a/lib/ftoastr.c b/lib/ftoastr.c
index 7a7d4113c22..47a83152e3f 100644
--- a/lib/ftoastr.c
+++ b/lib/ftoastr.c
@@ -33,20 +33,28 @@
 #include <stdio.h>
 #include <stdlib.h>
 
+#ifdef C_LOCALE
+# include "c-snprintf.h"
+# include "c-strtod.h"
+# define PREFIX(name) c_ ## name
+#else
+# define PREFIX(name) name
+#endif
+
 #if LENGTH == 3
 # define FLOAT long double
 # define FLOAT_DIG LDBL_DIG
 # define FLOAT_MIN LDBL_MIN
 # define FLOAT_PREC_BOUND _GL_LDBL_PREC_BOUND
-# define FTOASTR ldtoastr
+# define FTOASTR PREFIX (ldtoastr)
 # define PROMOTED_FLOAT long double
-# define STRTOF strtold
+# define STRTOF PREFIX (strtold)
 #elif LENGTH == 2
 # define FLOAT double
 # define FLOAT_DIG DBL_DIG
 # define FLOAT_MIN DBL_MIN
 # define FLOAT_PREC_BOUND _GL_DBL_PREC_BOUND
-# define FTOASTR dtoastr
+# define FTOASTR PREFIX (dtoastr)
 # define PROMOTED_FLOAT double
 #else
 # define LENGTH 1
@@ -54,7 +62,7 @@
 # define FLOAT_DIG FLT_DIG
 # define FLOAT_MIN FLT_MIN
 # define FLOAT_PREC_BOUND _GL_FLT_PREC_BOUND
-# define FTOASTR ftoastr
+# define FTOASTR PREFIX (ftoastr)
 # define PROMOTED_FLOAT double
 # if HAVE_STRTOF
 #  define STRTOF strtof
@@ -65,13 +73,16 @@
    may generate one or two extra digits, but that's better than not
    working at all.  */
 #ifndef STRTOF
-# define STRTOF strtod
+# define STRTOF PREFIX (strtod)
 #endif
 
 /* On hosts where it's not known that snprintf works, use sprintf to
    implement the subset needed here.  Typically BUFSIZE is big enough
    and there's little or no performance hit.  */
-#if ! GNULIB_SNPRINTF
+#ifdef C_LOCALE
+# undef snprintf
+# define snprintf c_snprintf
+#elif ! GNULIB_SNPRINTF
 # undef snprintf
 # define snprintf ftoastr_snprintf
 static int
diff --git a/lib/ftoastr.h b/lib/ftoastr.h
index d945cc064a7..78b569f3d97 100644
--- a/lib/ftoastr.h
+++ b/lib/ftoastr.h
@@ -18,6 +18,7 @@
 /* Written by Paul Eggert.  */
 
 #ifndef _GL_FTOASTR_H
+#define _GL_FTOASTR_H
 
 #include "intprops.h"
 #include <float.h>
@@ -48,6 +49,12 @@ int  ftoastr (char *buf, size_t bufsize, int flags, int width,       float x);
 int  dtoastr (char *buf, size_t bufsize, int flags, int width,      double x);
 int ldtoastr (char *buf, size_t bufsize, int flags, int width, long double x);
 
+/* The last two functions except that the formatting takes place in
+   the C locale.  */
+int  c_dtoastr (char *buf, size_t bufsize, int flags, int width,      double x);
+int c_ldtoastr (char *buf, size_t bufsize, int flags, int width, long double x);
+
+
 /* Flag values for ftoastr etc.  These can be ORed together.  */
 enum
   {
diff --git a/lib/getloadavg.c b/lib/getloadavg.c
index ebb6f5d5dba..468e2506709 100644
--- a/lib/getloadavg.c
+++ b/lib/getloadavg.c
@@ -512,7 +512,7 @@ getloadavg (double loadavg[], int nelem)
   char const *ptr = ldavgbuf;
   int fd, count, saved_errno;
 
-  fd = open (LINUX_LDAV_FILE, O_RDONLY);
+  fd = open (LINUX_LDAV_FILE, O_RDONLY | O_CLOEXEC);
   if (fd == -1)
     return -1;
   count = read (fd, ldavgbuf, sizeof ldavgbuf - 1);
@@ -550,7 +550,7 @@ getloadavg (double loadavg[], int nelem)
         for (ptr++; '0' <= *ptr && *ptr <= '9'; ptr++)
           numerator = 10 * numerator + (*ptr - '0'), denominator *= 10;
 
-      loadavg[elem++] = numerator / denominator;
+      loadavg[elem] = numerator / denominator;
     }
 
   return elem;
@@ -567,15 +567,22 @@ getloadavg (double loadavg[], int nelem)
 
   unsigned long int load_ave[3], scale;
   int count;
-  FILE *fp;
-
-  fp = fopen (NETBSD_LDAV_FILE, "r");
-  if (fp == NULL)
-    return -1;
-  count = fscanf (fp, "%lu %lu %lu %lu\n",
+  char readbuf[4 * INT_BUFSIZE_BOUND (unsigned long int) + 1];
+  int fd = open (NETBSD_LDAV_FILE, O_RDONLY | O_CLOEXEC);
+  if (fd < 0)
+    return fd;
+  int nread = read (fd, readbuf, sizeof readbuf - 1);
+  int err = errno;
+  close (fd);
+  if (nread < 0)
+    {
+      errno = err;
+      return -1;
+    }
+  readbuf[nread] = '\0';
+  count = sscanf (readbuf, "%lu %lu %lu %lu\n",
                   &load_ave[0], &load_ave[1], &load_ave[2],
                   &scale);
-  (void) fclose (fp);
   if (count != 4)
     {
       errno = ENOTSUP;
@@ -869,27 +876,11 @@ getloadavg (double loadavg[], int nelem)
   if (!getloadavg_initialized)
     {
 #  ifndef SUNOS_5
-      /* Set the channel to close on exec, so it does not
-         litter any child's descriptor table.  */
-#   ifndef O_CLOEXEC
-#    define O_CLOEXEC 0
-#   endif
       int fd = open ("/dev/kmem", O_RDONLY | O_CLOEXEC);
       if (0 <= fd)
         {
-#   if F_DUPFD_CLOEXEC
-          if (fd <= STDERR_FILENO)
-            {
-              int fd1 = fcntl (fd, F_DUPFD_CLOEXEC, STDERR_FILENO + 1);
-              close (fd);
-              fd = fd1;
-            }
-#   endif
-          if (0 <= fd)
-            {
-              channel = fd;
-              getloadavg_initialized = true;
-            }
+          channel = fd;
+          getloadavg_initialized = true;
         }
 #  else /* SUNOS_5 */
       /* We pass 0 for the kernel, corefile, and swapfile names
diff --git a/lib/getrandom.c b/lib/getrandom.c
new file mode 100644
index 00000000000..f0b3f535007
--- /dev/null
+++ b/lib/getrandom.c
@@ -0,0 +1,178 @@
+/* Obtain a series of random bytes.
+
+   Copyright 2020 Free Software Foundation, Inc.
+
+   This program is free software: you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
+
+/* Written by Paul Eggert.  */
+
+#include <config.h>
+
+#include <sys/random.h>
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdbool.h>
+#include <unistd.h>
+
+#if defined _WIN32 && ! defined __CYGWIN__
+# define WIN32_LEAN_AND_MEAN
+# include <windows.h>
+# include <bcrypt.h>
+# if !HAVE_LIB_BCRYPT
+#  include <wincrypt.h>
+#  ifndef CRYPT_VERIFY_CONTEXT
+#   define CRYPT_VERIFY_CONTEXT 0xF0000000
+#  endif
+# endif
+#endif
+
+#include "minmax.h"
+
+#if defined _WIN32 && ! defined __CYGWIN__
+
+/* Don't assume that UNICODE is not defined.  */
+# undef LoadLibrary
+# define LoadLibrary LoadLibraryA
+# undef CryptAcquireContext
+# define CryptAcquireContext CryptAcquireContextA
+
+# if !HAVE_LIB_BCRYPT
+
+/* Avoid warnings from gcc -Wcast-function-type.  */
+#  define GetProcAddress \
+    (void *) GetProcAddress
+
+/* BCryptGenRandom with the BCRYPT_USE_SYSTEM_PREFERRED_RNG flag works only
+   starting with Windows 7.  */
+typedef NTSTATUS (WINAPI * BCryptGenRandomFuncType) (BCRYPT_ALG_HANDLE, UCHAR *, ULONG, ULONG);
+static BCryptGenRandomFuncType BCryptGenRandomFunc = NULL;
+static BOOL initialized = FALSE;
+
+static void
+initialize (void)
+{
+  HMODULE bcrypt = LoadLibrary ("bcrypt.dll");
+  if (bcrypt != NULL)
+    {
+      BCryptGenRandomFunc =
+        (BCryptGenRandomFuncType) GetProcAddress (bcrypt, "BCryptGenRandom");
+    }
+  initialized = TRUE;
+}
+
+# else
+
+#  define BCryptGenRandomFunc BCryptGenRandom
+
+# endif
+
+#else
+/* These devices exist on all platforms except native Windows.  */
+
+/* Name of a device through which the kernel returns high quality random
+   numbers, from an entropy pool.  When the pool is empty, the call blocks
+   until entropy sources have added enough bits of entropy.  */
+# ifndef NAME_OF_RANDOM_DEVICE
+#  define NAME_OF_RANDOM_DEVICE "/dev/random"
+# endif
+
+/* Name of a device through which the kernel returns random or pseudo-random
+   numbers.  It uses an entropy pool, but, in order to avoid blocking, adds
+   bits generated by a pseudo-random number generator, as needed.  */
+# ifndef NAME_OF_NONCE_DEVICE
+#  define NAME_OF_NONCE_DEVICE "/dev/urandom"
+# endif
+
+#endif
+
+/* Set BUFFER (of size LENGTH) to random bytes under the control of FLAGS.
+   Return the number of bytes written (> 0).
+   Upon error, return -1 and set errno.  */
+ssize_t
+getrandom (void *buffer, size_t length, unsigned int flags)
+#undef getrandom
+{
+#if defined _WIN32 && ! defined __CYGWIN__
+  /* BCryptGenRandom, defined in <bcrypt.h>
+     <https://docs.microsoft.com/en-us/windows/win32/api/bcrypt/nf-bcrypt-bcryptgenrandom>
+     with the BCRYPT_USE_SYSTEM_PREFERRED_RNG flag
+     works in Windows 7 and newer.  */
+  static int bcrypt_not_working /* = 0 */;
+  if (!bcrypt_not_working)
+    {
+# if !HAVE_LIB_BCRYPT
+      if (!initialized)
+        initialize ();
+# endif
+      if (BCryptGenRandomFunc != NULL
+          && BCryptGenRandomFunc (NULL, buffer, length,
+                                  BCRYPT_USE_SYSTEM_PREFERRED_RNG)
+             == 0 /*STATUS_SUCCESS*/)
+        return length;
+      bcrypt_not_working = 1;
+    }
+# if !HAVE_LIB_BCRYPT
+  /* CryptGenRandom, defined in <wincrypt.h>
+     <https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptgenrandom>
+     works in older releases as well, but is now deprecated.
+     CryptAcquireContext, defined in <wincrypt.h>
+     <https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptacquirecontexta>  */
+  {
+    static int crypt_initialized /* = 0 */;
+    static HCRYPTPROV provider;
+    if (!crypt_initialized)
+      {
+        if (CryptAcquireContext (&provider, NULL, NULL, PROV_RSA_FULL,
+                                 CRYPT_VERIFY_CONTEXT))
+          crypt_initialized = 1;
+        else
+          crypt_initialized = -1;
+      }
+    if (crypt_initialized >= 0)
+      {
+        if (!CryptGenRandom (provider, length, buffer))
+          {
+            errno = EIO;
+            return -1;
+          }
+        return length;
+      }
+  }
+# endif
+  errno = ENOSYS;
+  return -1;
+#elif HAVE_GETRANDOM
+  return getrandom (buffer, length, flags);
+#else
+  static int randfd[2] = { -1, -1 };
+  bool devrandom = (flags & GRND_RANDOM) != 0;
+  int fd = randfd[devrandom];
+
+  if (fd < 0)
+    {
+      static char const randdevice[][MAX (sizeof NAME_OF_NONCE_DEVICE,
+                                          sizeof NAME_OF_RANDOM_DEVICE)]
+        = { NAME_OF_NONCE_DEVICE, NAME_OF_RANDOM_DEVICE };
+      int oflags = (O_RDONLY + O_CLOEXEC
+                    + (flags & GRND_NONBLOCK ? O_NONBLOCK : 0));
+      fd = open (randdevice[devrandom], oflags);
+      if (fd < 0)
+        return fd;
+      randfd[devrandom] = fd;
+    }
+
+  return read (fd, buffer, length);
+#endif
+}
diff --git a/lib/gettimeofday.c b/lib/gettimeofday.c
index b63f8f29292..057cebdb163 100644
--- a/lib/gettimeofday.c
+++ b/lib/gettimeofday.c
@@ -33,9 +33,15 @@
 
 #ifdef WINDOWS_NATIVE
 
+/* Don't assume that UNICODE is not defined.  */
+# undef LoadLibrary
+# define LoadLibrary LoadLibraryA
+
+# if !(_WIN32_WINNT >= _WIN32_WINNT_WIN8)
+
 /* Avoid warnings from gcc -Wcast-function-type.  */
-# define GetProcAddress \
-   (void *) GetProcAddress
+#  define GetProcAddress \
+    (void *) GetProcAddress
 
 /* GetSystemTimePreciseAsFileTime was introduced only in Windows 8.  */
 typedef void (WINAPI * GetSystemTimePreciseAsFileTimeFuncType) (FILETIME *lpTime);
@@ -54,6 +60,12 @@ initialize (void)
   initialized = TRUE;
 }
 
+# else
+
+#  define GetSystemTimePreciseAsFileTimeFunc GetSystemTimePreciseAsFileTime
+
+# endif
+
 #endif
 
 /* This is a wrapper for gettimeofday.  It is used only on systems
@@ -84,8 +96,10 @@ gettimeofday (struct timeval *restrict tv, void *restrict tz)
      <http://www.windowstimestamp.com/description>.  */
   FILETIME current_time;
 
+# if !(_WIN32_WINNT >= _WIN32_WINNT_WIN8)
   if (!initialized)
     initialize ();
+# endif
   if (GetSystemTimePreciseAsFileTimeFunc != NULL)
     GetSystemTimePreciseAsFileTimeFunc (&current_time);
   else
diff --git a/lib/gnulib.mk.in b/lib/gnulib.mk.in
index 5c11dfc95ca..8174ea26fa5 100644
--- a/lib/gnulib.mk.in
+++ b/lib/gnulib.mk.in
@@ -311,6 +311,7 @@ GNULIB_GETCWD = @GNULIB_GETCWD@
 GNULIB_GETDELIM = @GNULIB_GETDELIM@
 GNULIB_GETDOMAINNAME = @GNULIB_GETDOMAINNAME@
 GNULIB_GETDTABLESIZE = @GNULIB_GETDTABLESIZE@
+GNULIB_GETENTROPY = @GNULIB_GETENTROPY@
 GNULIB_GETGROUPS = @GNULIB_GETGROUPS@
 GNULIB_GETHOSTNAME = @GNULIB_GETHOSTNAME@
 GNULIB_GETLINE = @GNULIB_GETLINE@
@@ -320,6 +321,7 @@ GNULIB_GETLOGIN_R = @GNULIB_GETLOGIN_R@
 GNULIB_GETOPT_POSIX = @GNULIB_GETOPT_POSIX@
 GNULIB_GETPAGESIZE = @GNULIB_GETPAGESIZE@
 GNULIB_GETPASS = @GNULIB_GETPASS@
+GNULIB_GETRANDOM = @GNULIB_GETRANDOM@
 GNULIB_GETSUBOPT = @GNULIB_GETSUBOPT@
 GNULIB_GETTIMEOFDAY = @GNULIB_GETTIMEOFDAY@
 GNULIB_GETUSERSHELL = @GNULIB_GETUSERSHELL@
@@ -565,12 +567,14 @@ HAVE_FTELLO = @HAVE_FTELLO@
 HAVE_FTRUNCATE = @HAVE_FTRUNCATE@
 HAVE_FUTIMENS = @HAVE_FUTIMENS@
 HAVE_GETDTABLESIZE = @HAVE_GETDTABLESIZE@
+HAVE_GETENTROPY = @HAVE_GETENTROPY@
 HAVE_GETGROUPS = @HAVE_GETGROUPS@
 HAVE_GETHOSTNAME = @HAVE_GETHOSTNAME@
 HAVE_GETLOGIN = @HAVE_GETLOGIN@
 HAVE_GETOPT_H = @HAVE_GETOPT_H@
 HAVE_GETPAGESIZE = @HAVE_GETPAGESIZE@
 HAVE_GETPASS = @HAVE_GETPASS@
+HAVE_GETRANDOM = @HAVE_GETRANDOM@
 HAVE_GETSUBOPT = @HAVE_GETSUBOPT@
 HAVE_GETTIMEOFDAY = @HAVE_GETTIMEOFDAY@
 HAVE_GRANTPT = @HAVE_GRANTPT@
@@ -667,6 +671,7 @@ HAVE_SYS_CDEFS_H = @HAVE_SYS_CDEFS_H@
 HAVE_SYS_INTTYPES_H = @HAVE_SYS_INTTYPES_H@
 HAVE_SYS_LOADAVG_H = @HAVE_SYS_LOADAVG_H@
 HAVE_SYS_PARAM_H = @HAVE_SYS_PARAM_H@
+HAVE_SYS_RANDOM_H = @HAVE_SYS_RANDOM_H@
 HAVE_SYS_SELECT_H = @HAVE_SYS_SELECT_H@
 HAVE_SYS_TIME_H = @HAVE_SYS_TIME_H@
 HAVE_SYS_TYPES_H = @HAVE_SYS_TYPES_H@
@@ -753,6 +758,7 @@ LIB_ACL = @LIB_ACL@
 LIB_CLOCK_GETTIME = @LIB_CLOCK_GETTIME@
 LIB_EACCESS = @LIB_EACCESS@
 LIB_EXECINFO = @LIB_EXECINFO@
+LIB_GETRANDOM = @LIB_GETRANDOM@
 LIB_MATH = @LIB_MATH@
 LIB_PTHREAD = @LIB_PTHREAD@
 LIB_PTHREAD_SIGMASK = @LIB_PTHREAD_SIGMASK@
@@ -782,6 +788,7 @@ NEXT_AS_FIRST_DIRECTIVE_STDINT_H = @NEXT_AS_FIRST_DIRECTIVE_STDINT_H@
 NEXT_AS_FIRST_DIRECTIVE_STDIO_H = @NEXT_AS_FIRST_DIRECTIVE_STDIO_H@
 NEXT_AS_FIRST_DIRECTIVE_STDLIB_H = @NEXT_AS_FIRST_DIRECTIVE_STDLIB_H@
 NEXT_AS_FIRST_DIRECTIVE_STRING_H = @NEXT_AS_FIRST_DIRECTIVE_STRING_H@
+NEXT_AS_FIRST_DIRECTIVE_SYS_RANDOM_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_RANDOM_H@
 NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_SELECT_H@
 NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_STAT_H@
 NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H = @NEXT_AS_FIRST_DIRECTIVE_SYS_TIME_H@
@@ -800,6 +807,7 @@ NEXT_STDINT_H = @NEXT_STDINT_H@
 NEXT_STDIO_H = @NEXT_STDIO_H@
 NEXT_STDLIB_H = @NEXT_STDLIB_H@
 NEXT_STRING_H = @NEXT_STRING_H@
+NEXT_SYS_RANDOM_H = @NEXT_SYS_RANDOM_H@
 NEXT_SYS_SELECT_H = @NEXT_SYS_SELECT_H@
 NEXT_SYS_STAT_H = @NEXT_SYS_STAT_H@
 NEXT_SYS_TIME_H = @NEXT_SYS_TIME_H@
@@ -884,6 +892,7 @@ REPLACE_GETLINE = @REPLACE_GETLINE@
 REPLACE_GETLOGIN_R = @REPLACE_GETLOGIN_R@
 REPLACE_GETPAGESIZE = @REPLACE_GETPAGESIZE@
 REPLACE_GETPASS = @REPLACE_GETPASS@
+REPLACE_GETRANDOM = @REPLACE_GETRANDOM@
 REPLACE_GETTIMEOFDAY = @REPLACE_GETTIMEOFDAY@
 REPLACE_GMTIME = @REPLACE_GMTIME@
 REPLACE_INITSTATE = @REPLACE_INITSTATE@
@@ -1003,6 +1012,7 @@ UINT64_MAX_EQ_ULONG_MAX = @UINT64_MAX_EQ_ULONG_MAX@
 UNDEFINE_STRTOK_R = @UNDEFINE_STRTOK_R@
 UNEXEC_OBJ = @UNEXEC_OBJ@
 UNISTD_H_DEFINES_STRUCT_TIMESPEC = @UNISTD_H_DEFINES_STRUCT_TIMESPEC@
+UNISTD_H_HAVE_SYS_RANDOM_H = @UNISTD_H_HAVE_SYS_RANDOM_H@
 UNISTD_H_HAVE_WINSOCK2_H = @UNISTD_H_HAVE_WINSOCK2_H@
 UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS = @UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS@
 USE_ACL = @USE_ACL@
@@ -1072,7 +1082,6 @@ gamegroup = @gamegroup@
 gameuser = @gameuser@
 gl_GNULIB_ENABLED_03e0aaad4cb89ca757653bd367a6ccb7 = @gl_GNULIB_ENABLED_03e0aaad4cb89ca757653bd367a6ccb7@
 gl_GNULIB_ENABLED_2049e887c7e5308faad27b3f894bb8c9 = @gl_GNULIB_ENABLED_2049e887c7e5308faad27b3f894bb8c9@
-gl_GNULIB_ENABLED_21ee726a3540c09237a8e70c0baf7467 = @gl_GNULIB_ENABLED_21ee726a3540c09237a8e70c0baf7467@
 gl_GNULIB_ENABLED_260941c0e5dc67ec9e87d1fb321c300b = @gl_GNULIB_ENABLED_260941c0e5dc67ec9e87d1fb321c300b@
 gl_GNULIB_ENABLED_5264294aa0a5557541b53c8c741f7f31 = @gl_GNULIB_ENABLED_5264294aa0a5557541b53c8c741f7f31@
 gl_GNULIB_ENABLED_6099e9737f757db36c47fa9d9f02e88c = @gl_GNULIB_ENABLED_6099e9737f757db36c47fa9d9f02e88c@
@@ -1086,7 +1095,6 @@ gl_GNULIB_ENABLED_getdtablesize = @gl_GNULIB_ENABLED_getdtablesize@
 gl_GNULIB_ENABLED_getgroups = @gl_GNULIB_ENABLED_getgroups@
 gl_GNULIB_ENABLED_lchmod = @gl_GNULIB_ENABLED_lchmod@
 gl_GNULIB_ENABLED_malloca = @gl_GNULIB_ENABLED_malloca@
-gl_GNULIB_ENABLED_open = @gl_GNULIB_ENABLED_open@
 gl_GNULIB_ENABLED_strtoll = @gl_GNULIB_ENABLED_strtoll@
 gl_GNULIB_ENABLED_utimens = @gl_GNULIB_ENABLED_utimens@
 gl_LIBOBJS = @gl_LIBOBJS@
@@ -1831,6 +1839,17 @@ EXTRA_libgnu_a_SOURCES += getopt.c getopt1.c
 endif
 ## end   gnulib module getopt-posix
 
+## begin gnulib module getrandom
+ifeq (,$(OMIT_GNULIB_MODULE_getrandom))
+
+
+EXTRA_DIST += getrandom.c
+
+EXTRA_libgnu_a_SOURCES += getrandom.c
+
+endif
+## end   gnulib module getrandom
+
 ## begin gnulib module gettext-h
 ifeq (,$(OMIT_GNULIB_MODULE_gettext-h))
 
@@ -1988,9 +2007,7 @@ endif
 ## begin gnulib module libc-config
 ifeq (,$(OMIT_GNULIB_MODULE_libc-config))
 
-ifneq (,$(gl_GNULIB_ENABLED_21ee726a3540c09237a8e70c0baf7467))
 
-endif
 EXTRA_DIST += cdefs.h libc-config.h
 
 endif
@@ -2151,9 +2168,7 @@ endif
 ## begin gnulib module open
 ifeq (,$(OMIT_GNULIB_MODULE_open))
 
-ifneq (,$(gl_GNULIB_ENABLED_open))
 
-endif
 EXTRA_DIST += open.c
 
 EXTRA_libgnu_a_SOURCES += open.c
@@ -2906,6 +2921,40 @@ EXTRA_libgnu_a_SOURCES += symlink.c
 endif
 ## end   gnulib module symlink
 
+## begin gnulib module sys_random
+ifeq (,$(OMIT_GNULIB_MODULE_sys_random))
+
+BUILT_SOURCES += sys/random.h
+
+# We need the following in order to create <sys/random.h> when the system
+# doesn't have one.
+sys/random.h: sys_random.in.h $(top_builddir)/config.status $(CXXDEFS_H) $(ARG_NONNULL_H) $(WARN_ON_USE_H)
+	$(AM_V_at)$(MKDIR_P) sys
+	$(AM_V_GEN)rm -f $@-t $@ && \
+	{ echo '/* DO NOT EDIT! GENERATED AUTOMATICALLY! */'; \
+	  sed -e 's|@''GUARD_PREFIX''@|GL|g' \
+	      -e 's|@''INCLUDE_NEXT''@|$(INCLUDE_NEXT)|g' \
+	      -e 's|@''PRAGMA_SYSTEM_HEADER''@|@PRAGMA_SYSTEM_HEADER@|g' \
+	      -e 's|@''PRAGMA_COLUMNS''@|@PRAGMA_COLUMNS@|g' \
+	      -e 's|@''NEXT_SYS_RANDOM_H''@|$(NEXT_SYS_RANDOM_H)|g' \
+	      -e 's|@''HAVE_SYS_RANDOM_H''@|$(HAVE_SYS_RANDOM_H)|g' \
+	      -e 's/@''GNULIB_GETRANDOM''@/$(GNULIB_GETRANDOM)/g' \
+	      -e 's/@''HAVE_GETRANDOM''@/$(HAVE_GETRANDOM)/g' \
+	      -e 's/@''REPLACE_GETRANDOM''@/$(REPLACE_GETRANDOM)/g' \
+	      -e '/definitions of _GL_FUNCDECL_RPL/r $(CXXDEFS_H)' \
+	      -e '/definition of _GL_ARG_NONNULL/r $(ARG_NONNULL_H)' \
+	      -e '/definition of _GL_WARN_ON_USE/r $(WARN_ON_USE_H)' \
+	      < $(srcdir)/sys_random.in.h; \
+	} > $@-t && \
+	mv -f $@-t $@
+MOSTLYCLEANFILES += sys/random.h sys/random.h-t
+MOSTLYCLEANDIRS += sys
+
+EXTRA_DIST += sys_random.in.h
+
+endif
+## end   gnulib module sys_random
+
 ## begin gnulib module sys_select
 ifeq (,$(OMIT_GNULIB_MODULE_sys_select))
 
@@ -3246,6 +3295,7 @@ unistd.h: unistd.in.h $(top_builddir)/config.status $(CXXDEFS_H) $(ARG_NONNULL_H
 	      -e 's/@''GNULIB_GETCWD''@/$(GNULIB_GETCWD)/g' \
 	      -e 's/@''GNULIB_GETDOMAINNAME''@/$(GNULIB_GETDOMAINNAME)/g' \
 	      -e 's/@''GNULIB_GETDTABLESIZE''@/$(GNULIB_GETDTABLESIZE)/g' \
+	      -e 's/@''GNULIB_GETENTROPY''@/$(GNULIB_GETENTROPY)/g' \
 	      -e 's/@''GNULIB_GETGROUPS''@/$(GNULIB_GETGROUPS)/g' \
 	      -e 's/@''GNULIB_GETHOSTNAME''@/$(GNULIB_GETHOSTNAME)/g' \
 	      -e 's/@''GNULIB_GETLOGIN''@/$(GNULIB_GETLOGIN)/g' \
@@ -3294,6 +3344,7 @@ unistd.h: unistd.in.h $(top_builddir)/config.status $(CXXDEFS_H) $(ARG_NONNULL_H
 	      -e 's|@''HAVE_FSYNC''@|$(HAVE_FSYNC)|g' \
 	      -e 's|@''HAVE_FTRUNCATE''@|$(HAVE_FTRUNCATE)|g' \
 	      -e 's|@''HAVE_GETDTABLESIZE''@|$(HAVE_GETDTABLESIZE)|g' \
+	      -e 's|@''HAVE_GETENTROPY''@|$(HAVE_GETENTROPY)|g' \
 	      -e 's|@''HAVE_GETGROUPS''@|$(HAVE_GETGROUPS)|g' \
 	      -e 's|@''HAVE_GETHOSTNAME''@|$(HAVE_GETHOSTNAME)|g' \
 	      -e 's|@''HAVE_GETPAGESIZE''@|$(HAVE_GETPAGESIZE)|g' \
@@ -3363,6 +3414,7 @@ unistd.h: unistd.in.h $(top_builddir)/config.status $(CXXDEFS_H) $(ARG_NONNULL_H
 	      -e 's|@''REPLACE_UNLINKAT''@|$(REPLACE_UNLINKAT)|g' \
 	      -e 's|@''REPLACE_USLEEP''@|$(REPLACE_USLEEP)|g' \
 	      -e 's|@''REPLACE_WRITE''@|$(REPLACE_WRITE)|g' \
+	      -e 's|@''UNISTD_H_HAVE_SYS_RANDOM_H''@|$(UNISTD_H_HAVE_SYS_RANDOM_H)|g' \
 	      -e 's|@''UNISTD_H_HAVE_WINSOCK2_H''@|$(UNISTD_H_HAVE_WINSOCK2_H)|g' \
 	      -e 's|@''UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS''@|$(UNISTD_H_HAVE_WINSOCK2_H_AND_USE_SOCKETS)|g' \
 	      -e '/definitions of _GL_FUNCDECL_RPL/r $(CXXDEFS_H)' \
diff --git a/lib/libc-config.h b/lib/libc-config.h
index 124f1d77e01..1300c3a2ac8 100644
--- a/lib/libc-config.h
+++ b/lib/libc-config.h
@@ -180,4 +180,5 @@
 
 /* A substitute for glibc <shlib-compat.h>, good enough for Gnulib.  */
 #define SHLIB_COMPAT(lib, introduced, obsoleted) 0
-#define versioned_symbol(lib, local, symbol, version)
+#define compat_symbol(lib, local, symbol, version) extern int dummy
+#define versioned_symbol(lib, local, symbol, version) extern int dummy
diff --git a/lib/open.c b/lib/open.c
index bb180fde292..751b42d7dcf 100644
--- a/lib/open.c
+++ b/lib/open.c
@@ -124,7 +124,7 @@ open (const char *filename, int flags, ...)
 #endif
 
   fd = orig_open (filename,
-                  flags & ~(have_cloexec <= 0 ? O_CLOEXEC : 0), mode);
+                  flags & ~(have_cloexec < 0 ? O_CLOEXEC : 0), mode);
 
   if (flags & O_CLOEXEC)
     {
diff --git a/lib/openat-proc.c b/lib/openat-proc.c
index 9111cd3d7ee..b5aaee8b1d3 100644
--- a/lib/openat-proc.c
+++ b/lib/openat-proc.c
@@ -73,8 +73,9 @@ openat_proc_name (char buf[OPENAT_BUFFER_SIZE], int fd, char const *file)
            problem is exhibited on code that built on Solaris 8 and
            running on Solaris 10.  */
 
-        int proc_self_fd = open ("/proc/self/fd",
-                                 O_SEARCH | O_DIRECTORY | O_NOCTTY | O_NONBLOCK);
+        int proc_self_fd =
+          open ("/proc/self/fd",
+                O_SEARCH | O_DIRECTORY | O_NOCTTY | O_NONBLOCK | O_CLOEXEC);
         if (proc_self_fd < 0)
           proc_status = -1;
         else
diff --git a/lib/sys_random.in.h b/lib/sys_random.in.h
new file mode 100644
index 00000000000..f14ac1f5723
--- /dev/null
+++ b/lib/sys_random.in.h
@@ -0,0 +1,92 @@
+/* Substitute for <sys/random.h>.
+   Copyright (C) 2020 Free Software Foundation, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3, or (at your option)
+   any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, see <https://www.gnu.org/licenses/>.  */
+
+# if __GNUC__ >= 3
+@PRAGMA_SYSTEM_HEADER@
+# endif
+@PRAGMA_COLUMNS@
+
+#ifndef _@GUARD_PREFIX@_SYS_RANDOM_H
+
+#if @HAVE_SYS_RANDOM_H@
+
+/* On Mac OS X 10.5, <sys/random.h> assumes prior inclusion of <sys/types.h>.
+   On Max OS X 10.13, <sys/random.h> assumes prior inclusion of a file that
+   includes <Availability.h>, such as <stdlib.h> or <unistd.h>.  */
+# if defined __APPLE__ && defined __MACH__                  /* Mac OS X */
+#  include <sys/types.h>
+#  include <stdlib.h>
+# endif
+
+/* The include_next requires a split double-inclusion guard.  */
+# @INCLUDE_NEXT@ @NEXT_SYS_RANDOM_H@
+
+#endif
+
+#ifndef _@GUARD_PREFIX@_SYS_RANDOM_H
+#define _@GUARD_PREFIX@_SYS_RANDOM_H
+
+#include <sys/types.h>
+
+/* Define the GRND_* constants.  */
+#ifndef GRND_NONBLOCK
+# define GRND_NONBLOCK 1
+# define GRND_RANDOM 2
+#endif
+
+/* The definitions of _GL_FUNCDECL_RPL etc. are copied here.  */
+
+/* The definition of _GL_ARG_NONNULL is copied here.  */
+
+/* The definition of _GL_WARN_ON_USE is copied here.  */
+
+
+/* Declare overridden functions.  */
+
+
+#if @GNULIB_GETRANDOM@
+/* Fill a buffer with random bytes.  */
+# if @REPLACE_GETRANDOM@
+#  if !(defined __cplusplus && defined GNULIB_NAMESPACE)
+#   undef getrandom
+#   define getrandom rpl_getrandom
+#  endif
+_GL_FUNCDECL_RPL (getrandom, ssize_t,
+                  (void *buffer, size_t length, unsigned int flags)
+                  _GL_ARG_NONNULL ((1)));
+_GL_CXXALIAS_RPL (getrandom, ssize_t,
+                  (void *buffer, size_t length, unsigned int flags));
+# else
+#  if !@HAVE_GETRANDOM@
+_GL_FUNCDECL_SYS (getrandom, ssize_t,
+                  (void *buffer, size_t length, unsigned int flags)
+                  _GL_ARG_NONNULL ((1)));
+#  endif
+_GL_CXXALIAS_SYS (getrandom, ssize_t,
+                  (void *buffer, size_t length, unsigned int flags));
+# endif
+_GL_CXXALIASWARN (getrandom);
+#elif defined GNULIB_POSIXCHECK
+# undef getrandom
+# if HAVE_RAW_DECL_GETRANDOM
+_GL_WARN_ON_USE (getrandom, "getrandom is unportable - "
+                 "use gnulib module getrandom for portability");
+# endif
+#endif
+
+
+#endif /* _@GUARD_PREFIX@_SYS_RANDOM_H */
+#endif /* _@GUARD_PREFIX@_SYS_RANDOM_H */
diff --git a/lib/tempname.c b/lib/tempname.c
index 0aad0616c85..cfb0fc42eca 100644
--- a/lib/tempname.c
+++ b/lib/tempname.c
@@ -1,24 +1,22 @@
-/* tempname.c - generate the name of a temporary file.
+/* Copyright (C) 1991-2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
 
-   Copyright (C) 1991-2003, 2005-2007, 2009-2020 Free Software Foundation, Inc.
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU General Public
+   License as published by the Free Software Foundation; either
+   version 3 of the License, or (at your option) any later version.
 
-   This program is free software: you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 3 of the License, or
-   (at your option) any later version.
-
-   This program is distributed in the hope that it will be useful,
+   The GNU C Library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
 
-/* Extracted from glibc sysdeps/posix/tempname.c.  See also tmpdir.c.  */
+   You should have received a copy of the GNU General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
 
 #if !_LIBC
-# include <config.h>
+# include <libc-config.h>
 # include "tempname.h"
 #endif
 
@@ -26,9 +24,6 @@
 #include <assert.h>
 
 #include <errno.h>
-#ifndef __set_errno
-# define __set_errno(Val) errno = (Val)
-#endif
 
 #include <stdio.h>
 #ifndef P_tmpdir
@@ -52,51 +47,39 @@
 #include <string.h>
 
 #include <fcntl.h>
-#include <sys/time.h>
 #include <stdint.h>
-#include <unistd.h>
-
+#include <sys/random.h>
 #include <sys/stat.h>
 
 #if _LIBC
 # define struct_stat64 struct stat64
+# define __secure_getenv __libc_secure_getenv
 #else
 # define struct_stat64 struct stat
-# define __try_tempname try_tempname
 # define __gen_tempname gen_tempname
-# define __getpid getpid
-# define __gettimeofday gettimeofday
 # define __mkdir mkdir
 # define __open open
 # define __lxstat64(version, file, buf) lstat (file, buf)
 #endif
 
 #ifdef _LIBC
-# include <hp-timing.h>
-# if HP_TIMING_AVAIL
-#  define RANDOM_BITS(Var) \
-  if (__builtin_expect (value == UINT64_C (0), 0))                            \
-    {                                                                         \
-      /* If this is the first time this function is used initialize           \
-         the variable we accumulate the value in to some somewhat             \
-         random value.  If we'd not do this programs at startup time          \
-         might have a reduced set of possible names, at least on slow         \
-         machines.  */                                                        \
-      struct timeval tv;                                                      \
-      __gettimeofday (&tv, NULL);                                             \
-      value = ((uint64_t) tv.tv_usec << 16) ^ tv.tv_sec;                      \
-    }                                                                         \
-  HP_TIMING_NOW (Var)
-# endif
-#endif
-
-/* Use the widest available unsigned type if uint64_t is not
-   available.  The algorithm below extracts a number less than 62**6
-   (approximately 2**35.725) from uint64_t, so ancient hosts where
-   uintmax_t is only 32 bits lose about 3.725 bits of randomness,
-   which is better than not having mkstemp at all.  */
-#if !defined UINT64_MAX && !defined uint64_t
-# define uint64_t uintmax_t
+# include <random-bits.h>
+# define RANDOM_BITS(Var) ((Var) = random_bits ())
+typedef uint32_t random_value;
+# define RANDOM_VALUE_MAX UINT32_MAX
+# define BASE_62_DIGITS 5 /* 62**5 < UINT32_MAX */
+# define BASE_62_POWER (62 * 62 * 62 * 62 * 62) /* 2**BASE_62_DIGITS */
+#else
+/* Use getrandom if it works, falling back on a 64-bit linear
+   congruential generator that starts with whatever Var's value
+   happens to be.  */
+# define RANDOM_BITS(Var) \
+    ((void) (getrandom (&(Var), sizeof (Var), 0) == sizeof (Var) \
+             || ((Var) = 2862933555777941757 * (Var) + 3037000493)))
+typedef uint_fast64_t random_value;
+# define RANDOM_VALUE_MAX UINT_FAST64_MAX
+# define BASE_62_DIGITS 10 /* 62**10 < UINT_FAST64_MAX */
+# define BASE_62_POWER (62LL * 62 * 62 * 62 * 62 * 62 * 62 * 62 * 62 * 62)
 #endif
 
 #if _LIBC
@@ -172,18 +155,80 @@ __path_search (char *tmpl, size_t tmpl_len, const char *dir, const char *pfx,
 }
 #endif /* _LIBC */
 
+#if _LIBC
+static int try_tempname_len (char *, int, void *, int (*) (char *, void *),
+                             size_t);
+#endif
+
+static int
+try_file (char *tmpl, void *flags)
+{
+  int *openflags = flags;
+  return __open (tmpl,
+                 (*openflags & ~O_ACCMODE)
+                 | O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
+}
+
+static int
+try_dir (char *tmpl, void *flags _GL_UNUSED)
+{
+  return __mkdir (tmpl, S_IRUSR | S_IWUSR | S_IXUSR);
+}
+
+static int
+try_nocreate (char *tmpl, void *flags _GL_UNUSED)
+{
+  struct_stat64 st;
+
+  if (__lxstat64 (_STAT_VER, tmpl, &st) == 0 || errno == EOVERFLOW)
+    __set_errno (EEXIST);
+  return errno == ENOENT ? 0 : -1;
+}
+
 /* These are the characters used in temporary file names.  */
 static const char letters[] =
 "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
 
+/* Generate a temporary file name based on TMPL.  TMPL must match the
+   rules for mk[s]temp (i.e., end in at least X_SUFFIX_LEN "X"s,
+   possibly with a suffix).
+   The name constructed does not exist at the time of the call to
+   this function.  TMPL is overwritten with the result.
+
+   KIND may be one of:
+   __GT_NOCREATE:       simply verify that the name does not exist
+                        at the time of the call.
+   __GT_FILE:           create the file using open(O_CREAT|O_EXCL)
+                        and return a read-write fd.  The file is mode 0600.
+   __GT_DIR:            create a directory, which will be mode 0700.
+
+   We use a clever algorithm to get hard-to-predict names. */
+#ifdef _LIBC
+static
+#endif
 int
-__try_tempname (char *tmpl, int suffixlen, void *args,
-                int (*tryfunc) (char *, void *))
+gen_tempname_len (char *tmpl, int suffixlen, int flags, int kind,
+                  size_t x_suffix_len)
 {
-  int len;
+  static int (*const tryfunc[]) (char *, void *) =
+    {
+      [__GT_FILE] = try_file,
+      [__GT_DIR] = try_dir,
+      [__GT_NOCREATE] = try_nocreate
+    };
+  return try_tempname_len (tmpl, suffixlen, &flags, tryfunc[kind],
+                           x_suffix_len);
+}
+
+#ifdef _LIBC
+static
+#endif
+int
+try_tempname_len (char *tmpl, int suffixlen, void *args,
+                  int (*tryfunc) (char *, void *), size_t x_suffix_len)
+{
+  size_t len;
   char *XXXXXX;
-  static uint64_t value;
-  uint64_t random_time_bits;
   unsigned int count;
   int fd = -1;
   int save_errno = errno;
@@ -193,7 +238,8 @@ __try_tempname (char *tmpl, int suffixlen, void *args,
      can exist for a given template is 62**6.  It should never be
      necessary to try all of these combinations.  Instead if a reasonable
      number of names is tried (we define reasonable as 62**3) fail to
-     give the system administrator the chance to remove the problems.  */
+     give the system administrator the chance to remove the problems.
+     This value requires that X_SUFFIX_LEN be at least 3.  */
 #define ATTEMPTS_MIN (62 * 62 * 62)
 
   /* The number of times to attempt to generate a temporary file.  To
@@ -204,44 +250,45 @@ __try_tempname (char *tmpl, int suffixlen, void *args,
   unsigned int attempts = ATTEMPTS_MIN;
 #endif
 
+  /* A random variable.  */
+  random_value v;
+
+  /* How many random base-62 digits can currently be extracted from V.  */
+  int vdigits = 0;
+
+  /* Least unfair value for V.  If V is less than this, V can generate
+     BASE_62_DIGITS digits fairly.  Otherwise it might be biased.  */
+  random_value const unfair_min
+    = RANDOM_VALUE_MAX - RANDOM_VALUE_MAX % BASE_62_POWER;
+
   len = strlen (tmpl);
-  if (len < 6 + suffixlen || memcmp (&tmpl[len - 6 - suffixlen], "XXXXXX", 6))
+  if (len < x_suffix_len + suffixlen
+      || strspn (&tmpl[len - x_suffix_len - suffixlen], "X") < x_suffix_len)
     {
       __set_errno (EINVAL);
       return -1;
     }
 
   /* This is where the Xs start.  */
-  XXXXXX = &tmpl[len - 6 - suffixlen];
-
-  /* Get some more or less random data.  */
-#ifdef RANDOM_BITS
-  RANDOM_BITS (random_time_bits);
-#else
-  {
-    struct timeval tv;
-    __gettimeofday (&tv, NULL);
-    random_time_bits = ((uint64_t) tv.tv_usec << 16) ^ tv.tv_sec;
-  }
-#endif
-  value += random_time_bits ^ __getpid ();
+  XXXXXX = &tmpl[len - x_suffix_len - suffixlen];
 
-  for (count = 0; count < attempts; value += 7777, ++count)
+  for (count = 0; count < attempts; ++count)
     {
-      uint64_t v = value;
-
-      /* Fill in the random bits.  */
-      XXXXXX[0] = letters[v % 62];
-      v /= 62;
-      XXXXXX[1] = letters[v % 62];
-      v /= 62;
-      XXXXXX[2] = letters[v % 62];
-      v /= 62;
-      XXXXXX[3] = letters[v % 62];
-      v /= 62;
-      XXXXXX[4] = letters[v % 62];
-      v /= 62;
-      XXXXXX[5] = letters[v % 62];
+      for (size_t i = 0; i < x_suffix_len; i++)
+        {
+          if (vdigits == 0)
+            {
+              do
+                RANDOM_BITS (v);
+              while (unfair_min <= v);
+
+              vdigits = BASE_62_DIGITS;
+            }
+
+          XXXXXX[i] = letters[v % 62];
+          v /= 62;
+          vdigits--;
+        }
 
       fd = tryfunc (tmpl, args);
       if (fd >= 0)
@@ -258,66 +305,17 @@ __try_tempname (char *tmpl, int suffixlen, void *args,
   return -1;
 }
 
-static int
-try_file (char *tmpl, void *flags)
-{
-  int *openflags = flags;
-  return __open (tmpl,
-                 (*openflags & ~O_ACCMODE)
-                 | O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR);
-}
-
-static int
-try_dir (char *tmpl, void *flags _GL_UNUSED)
-{
-  return __mkdir (tmpl, S_IRUSR | S_IWUSR | S_IXUSR);
-}
-
-static int
-try_nocreate (char *tmpl, void *flags _GL_UNUSED)
+int
+__gen_tempname (char *tmpl, int suffixlen, int flags, int kind)
 {
-  struct_stat64 st;
-
-  if (__lxstat64 (_STAT_VER, tmpl, &st) == 0 || errno == EOVERFLOW)
-    __set_errno (EEXIST);
-  return errno == ENOENT ? 0 : -1;
+  return gen_tempname_len (tmpl, suffixlen, flags, kind, 6);
 }
 
-/* Generate a temporary file name based on TMPL.  TMPL must match the
-   rules for mk[s]temp (i.e. end in "XXXXXX", possibly with a suffix).
-   The name constructed does not exist at the time of the call to
-   __gen_tempname.  TMPL is overwritten with the result.
-
-   KIND may be one of:
-   __GT_NOCREATE:       simply verify that the name does not exist
-                        at the time of the call.
-   __GT_FILE:           create the file using open(O_CREAT|O_EXCL)
-                        and return a read-write fd.  The file is mode 0600.
-   __GT_DIR:            create a directory, which will be mode 0700.
-
-   We use a clever algorithm to get hard-to-predict names. */
+#if !_LIBC
 int
-__gen_tempname (char *tmpl, int suffixlen, int flags, int kind)
+try_tempname (char *tmpl, int suffixlen, void *args,
+              int (*tryfunc) (char *, void *))
 {
-  int (*tryfunc) (char *, void *);
-
-  switch (kind)
-    {
-    case __GT_FILE:
-      tryfunc = try_file;
-      break;
-
-    case __GT_DIR:
-      tryfunc = try_dir;
-      break;
-
-    case __GT_NOCREATE:
-      tryfunc = try_nocreate;
-      break;
-
-    default:
-      assert (! "invalid KIND in __gen_tempname");
-      abort ();
-    }
-  return __try_tempname (tmpl, suffixlen, &flags, tryfunc);
+  return try_tempname_len (tmpl, suffixlen, args, tryfunc, 6);
 }
+#endif
diff --git a/lib/tempname.h b/lib/tempname.h
index abb92650827..00dcbe4c93b 100644
--- a/lib/tempname.h
+++ b/lib/tempname.h
@@ -50,6 +50,9 @@ extern "C" {
 
    We use a clever algorithm to get hard-to-predict names. */
 extern int gen_tempname (char *tmpl, int suffixlen, int flags, int kind);
+/* Similar, except X_SUFFIX_LEN gives the number of Xs.  */
+extern int gen_tempname_len (char *tmpl, int suffixlen, int flags, int kind,
+                             size_t x_suffix_len);
 
 /* Similar to gen_tempname, but TRYFUNC is called for each temporary
    name to try.  If TRYFUNC returns a non-negative number, TRY_GEN_TEMPNAME
@@ -57,6 +60,10 @@ extern int gen_tempname (char *tmpl, int suffixlen, int flags, int kind);
    name is tried, or else TRY_GEN_TEMPNAME returns -1. */
 extern int try_tempname (char *tmpl, int suffixlen, void *args,
                          int (*tryfunc) (char *, void *));
+/* Similar, except X_SUFFIX_LEN gives the number of Xs.  */
+extern int try_tempname_len (char *tmpl, int suffixlen, void *args,
+                             int (*tryfunc) (char *, void *),
+                             size_t x_suffix_len);
 
 #ifdef __cplusplus
 }
diff --git a/lib/unistd.in.h b/lib/unistd.in.h
index c9b9ac95821..b211e4d61f7 100644
--- a/lib/unistd.in.h
+++ b/lib/unistd.in.h
@@ -118,6 +118,17 @@
 # include <netdb.h>
 #endif
 
+/* Mac OS X 10.13, Solaris 11.4, and Android 9.0 declare getentropy in
+   <sys/random.h>, not in <unistd.h>.  */
+/* But avoid namespace pollution on glibc systems.  */
+#if (@GNULIB_GETENTROPY@ || defined GNULIB_POSIXCHECK) \
+    && ((defined __APPLE__ && defined __MACH__) || defined __sun \
+        || defined __ANDROID__) \
+    && @UNISTD_H_HAVE_SYS_RANDOM_H@ \
+    && !defined __GLIBC__
+# include <sys/random.h>
+#endif
+
 /* Android 4.3 declares fchownat in <sys/stat.h>, not in <unistd.h>.  */
 /* But avoid namespace pollution on glibc systems.  */
 #if (@GNULIB_FCHOWNAT@ || defined GNULIB_POSIXCHECK) && defined __ANDROID__ \
@@ -763,6 +774,22 @@ _GL_WARN_ON_USE (getdtablesize, "getdtablesize is unportable - "
 #endif
 
 
+#if @GNULIB_GETENTROPY@
+/* Fill a buffer with random bytes.  */
+# if !@HAVE_GETENTROPY@
+_GL_FUNCDECL_SYS (getentropy, int, (void *buffer, size_t length));
+# endif
+_GL_CXXALIAS_SYS (getentropy, int, (void *buffer, size_t length));
+_GL_CXXALIASWARN (getentropy);
+#elif defined GNULIB_POSIXCHECK
+# undef getentropy
+# if HAVE_RAW_DECL_GETENTROPY
+_GL_WARN_ON_USE (getentropy, "getentropy is unportable - "
+                 "use gnulib module getentropy for portability");
+# endif
+#endif
+
+
 #if @GNULIB_GETGROUPS@
 /* Return the supplemental groups that the current process belongs to.
    It is unspecified whether the effective group id is in the list.
diff --git a/lib/verify.h b/lib/verify.h
index d9ab89a570c..f1097612704 100644
--- a/lib/verify.h
+++ b/lib/verify.h
@@ -277,10 +277,22 @@ template <int w>
 #endif
 
 /* Assume that R always holds.  Behavior is undefined if R is false,
-   fails to evaluate, or has side effects.  Although assuming R can
-   help a compiler generate better code or diagnostics, performance
-   can suffer if R uses hard-to-optimize features such as function
-   calls not inlined by the compiler.  */
+   fails to evaluate, or has side effects.
+
+   'assume (R)' is a directive from the programmer telling the
+   compiler that R is true so the compiler needn't generate code to
+   test R.  This is why 'assume' is in verify.h: it's related to
+   static checking (in this case, static checking done by the
+   programmer), not dynamic checking.
+
+   'assume (R)' can affect compilation of all the code, not just code
+   that happens to be executed after the assume (R) is "executed".
+   For example, if the code mistakenly does 'assert (R); assume (R);'
+   the compiler is entitled to optimize away the 'assert (R)'.
+
+   Although assuming R can help a compiler generate better code or
+   diagnostics, performance can suffer if R uses hard-to-optimize
+   features such as function calls not inlined by the compiler.  */
 
 #if _GL_HAS_BUILTIN_UNREACHABLE
 # define assume(R) ((R) ? (void) 0 : __builtin_unreachable ())