Updating liguros repov21.1.3

35 files changed, 820 insertions, 397 deletions

diff --git a/app-crypt/cardpeek/Manifest b/app-crypt/cardpeek/Manifest
index 8ca76071dee1..1b38d9dc846d 100644
--- a/app-crypt/cardpeek/Manifest
+++ b/app-crypt/cardpeek/Manifest
@@ -1,2 +1 @@
-DIST cardpeek-0.7.2.tar.gz 1130295 BLAKE2B c2aec139c8834947dd2e04fe384719bccdbce9b75b24f791136d5afb5873e6e0afb8306ebb2ddf6fa4e8b4cb46078667fae8eb962b425278351172292df6faaf SHA512 9fd1790794b8d092859670bb36a0cdd235e7d098d563032ccdb8143eac00bb77532f1ab918897c4b753afd184079975de34a6f645e31eadb28b6c5a81d344ecd
 DIST cardpeek-0.8.4.tar.gz 1520613 BLAKE2B f31a0298ab8423b384b0ad62abb0599da75fd968385e9e6c9a5982e6fbaf7bec8a6098e3e7a5c30ce6634c65e05db084772f4a33c7ef5d6fdcdee0022cc56b86 SHA512 f6eebc7a17f270dd56529ee36815fee72b2f9d62b24d6cc90060f20c7604b9b99ab76858d9c04c60aaec838b02b8db76476a91ee22a4e10f01f852cd1f536efb
diff --git a/app-crypt/cardpeek/cardpeek-0.7.2.ebuild b/app-crypt/cardpeek/cardpeek-0.7.2.ebuild
deleted file mode 100644
index 94d0f8dea38f..000000000000
--- a/app-crypt/cardpeek/cardpeek-0.7.2.ebuild
+++ /dev/null
@@ -1,23 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit xdg
-
-DESCRIPTION="Tool to read the contents of smartcards"
-HOMEPAGE="https://pannetrat.com/Cardpeek"
-SRC_URI="https://${PN}.googlecode.com/files/${P}.tar.gz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~amd64"
-IUSE="libressl"
-
-RDEPEND=">=x11-libs/gtk+-2.12:2
-	sys-apps/pcsc-lite
-	dev-lang/lua:0
-	!libressl? ( dev-libs/openssl:0= )
-	libressl? ( dev-libs/libressl:0= )"
-DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
diff --git a/app-crypt/ccid/Manifest b/app-crypt/ccid/Manifest
index 9dc04ccd1f33..4f268011dce2 100644
--- a/app-crypt/ccid/Manifest
+++ b/app-crypt/ccid/Manifest
@@ -1,4 +1,2 @@
-DIST ccid-1.4.30.tar.bz2 642342 BLAKE2B fd43aa2a4c8840abb0545760f6ceb31bb9d7dc22d7283888c9a142e0c3b34310ec4530d18986451b21c6b1a3975b1212ab653a4c8d58466b28713f0f72ce1cdb SHA512 1761a4053a99eb28184d0ffece951aec5d4b646080597b4ae36b18a31fb7a76c55fabfa57ee8e5d7f2db1a6e13d209f7fa995fe6ed067f44558bea34a26d46da
-DIST ccid-1.4.31.tar.bz2 644039 BLAKE2B bd8e9c69e122348ffbeddc4f85f939d7d4c93dbfe5f712bc16f671af144570ce2c3bc6da04503851f4ce0f95f0c89bbbe6bbf0852be97cf5574993875d865870 SHA512 51d102c6be5b234ed568522d51b97bdb27c4c22d9610874abd7a18314f4e8ebe81fcb18a16a1edbdc814ee652a037d50202673a50de2fdeb0eac74063b149ed3
-DIST ccid-1.4.32.tar.bz2 657200 BLAKE2B 9598b010f2eb085d1d02d9363136b294dc30ea1cf9256d398838461016fae5572926d5f24e3065384c9a349b0a9783670c8cb9d4f59bf50171c7f5501b963d82 SHA512 80fc3bac547ee7c37ff0e72cc650d0a5e1102720698bdc1278581ec53ff1407e0e719eb0345775fbc76c0d56d9271dcb07a9ddc98450bba2ff37823f23a8adbf
 DIST ccid-1.4.33.tar.bz2 659673 BLAKE2B f8dd37ed4fd2bd15e6313417dc01feecd0303502d24eeae101ad13233510b5e26b08439c4de453abc734695618faa1c8031e545d045527aa841ab9056a3d729e SHA512 ccfcecbaca4c8f1ee4a4925bd313ced6d6f15ad422cbcc387627aef203a9ae0ff7775c4a2c5d25978ab33ebfd93c34de50e1f783df787b77ea7c774a45ed126b
+DIST ccid-1.4.34.tar.bz2 667477 BLAKE2B 81f8f97fdb4526fa2f0bfe0890cc447c87671989159022a51fa15ed6e85760f7fc3a9b3f673e2cbf72373a9fc67df5304c0a93a945b97f5ad483de213f5b1a45 SHA512 8a71c100e2f0adfd6de89a86dab6690629b10c91d1fddc0a810df2ebeaea978eaaa7c6a21fa964b5cd1ea277b0efe75a2885b490f9bd9ac4776b8ff1848e4122
diff --git a/app-crypt/ccid/ccid-1.4.30.ebuild b/app-crypt/ccid/ccid-1.4.30.ebuild
deleted file mode 100644
index 2440d2933a00..000000000000
--- a/app-crypt/ccid/ccid-1.4.30.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit toolchain-funcs udev
-
-DESCRIPTION="CCID free software driver"
-HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
-SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~hppa ~ia64 ppc ppc64 ~sparc x86"
-IUSE="twinserial kobil-midentity +usb"
-
-RDEPEND=">=sys-apps/pcsc-lite-1.8.3
-	usb? ( virtual/libusb:1 )"
-DEPEND="${RDEPEND}"
-BDEPEND="kernel_linux? ( virtual/pkgconfig )"
-
-DOCS=( README AUTHORS )
-
-src_configure() {
-	econf \
-		LEX=: \
-		$(use_enable twinserial) \
-		$(use_enable usb libusb)
-}
-
-src_compile() {
-	default
-	use kobil-midentity && emake -C contrib/Kobil_mIDentity_switch
-}
-
-src_install() {
-	default
-
-	if use kobil-midentity; then
-		dosbin contrib/Kobil_mIDentity_switch/Kobil_mIDentity_switch
-		doman contrib/Kobil_mIDentity_switch/Kobil_mIDentity_switch.8
-	fi
-
-	if use kernel_linux; then
-		# note: for eudev support, rules probably will always need to be
-		# installed to /usr
-
-		# ccid >=1.4.11 version changed the rules drastically in a minor
-		# release to no longer use the pcscd group. Using the old ones in
-		# the mean time.
-		udev_newrules "${FILESDIR}"/92_pcscd_ccid-2.rules 92-pcsc-ccid.rules
-
-		# disable Kobil_mIDentity_switch udev rule with USE=-kobil-midentity
-		if ! use kobil-midentity; then
-			sed \
-				-e '/Kobil_mIDentity_switch/s/^/#/' \
-				-i "${D}/$(get_udevdir)"/rules.d/92-pcsc-ccid.rules || die
-		fi
-
-	fi
-}
diff --git a/app-crypt/ccid/ccid-1.4.32.ebuild b/app-crypt/ccid/ccid-1.4.32.ebuild
deleted file mode 100644
index a47b8bea185c..000000000000
--- a/app-crypt/ccid/ccid-1.4.32.ebuild
+++ /dev/null
@@ -1,61 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit toolchain-funcs udev
-
-DESCRIPTION="CCID free software driver"
-HOMEPAGE="https://ccid.apdu.fr https://github.com/LudovicRousseau/CCID"
-SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
-IUSE="twinserial kobil-midentity +usb"
-
-RDEPEND=">=sys-apps/pcsc-lite-1.8.3
-	usb? ( virtual/libusb:1 )"
-DEPEND="${RDEPEND}"
-BDEPEND="kernel_linux? ( virtual/pkgconfig )"
-
-DOCS=( README.md AUTHORS )
-
-src_configure() {
-	econf \
-		LEX=: \
-		$(use_enable twinserial) \
-		$(use_enable usb libusb)
-}
-
-src_compile() {
-	default
-	use kobil-midentity && emake -C contrib/Kobil_mIDentity_switch
-}
-
-src_install() {
-	default
-
-	if use kobil-midentity; then
-		dosbin contrib/Kobil_mIDentity_switch/Kobil_mIDentity_switch
-		doman contrib/Kobil_mIDentity_switch/Kobil_mIDentity_switch.8
-	fi
-
-	if use kernel_linux; then
-		# note: for eudev support, rules probably will always need to be
-		# installed to /usr
-
-		# ccid >=1.4.11 version changed the rules drastically in a minor
-		# release to no longer use the pcscd group. Using the old ones in
-		# the mean time.
-		udev_newrules "${FILESDIR}"/92_pcscd_ccid-2.rules 92-pcsc-ccid.rules
-
-		# disable Kobil_mIDentity_switch udev rule with USE=-kobil-midentity
-		if ! use kobil-midentity; then
-			sed \
-				-e '/Kobil_mIDentity_switch/s/^/#/' \
-				-i "${D}/$(get_udevdir)"/rules.d/92-pcsc-ccid.rules || die
-		fi
-
-	fi
-}
diff --git a/app-crypt/ccid/ccid-1.4.33.ebuild b/app-crypt/ccid/ccid-1.4.33.ebuild
index a47b8bea185c..746a54f09fad 100644
--- a/app-crypt/ccid/ccid-1.4.33.ebuild
+++ b/app-crypt/ccid/ccid-1.4.33.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -11,7 +11,7 @@ SRC_URI="https://ccid.apdu.fr/files/${P}.tar.bz2"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~hppa ~ia64 ppc ppc64 ~sparc x86"
 IUSE="twinserial kobil-midentity +usb"
 
 RDEPEND=">=sys-apps/pcsc-lite-1.8.3
diff --git a/app-crypt/ccid/ccid-1.4.31.ebuild b/app-crypt/ccid/ccid-1.4.34.ebuild
index a47b8bea185c..54ad487a2623 100644
--- a/app-crypt/ccid/ccid-1.4.31.ebuild
+++ b/app-crypt/ccid/ccid-1.4.34.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
diff --git a/app-crypt/ekeyd/ekeyd-1.1.5-r1.ebuild b/app-crypt/ekeyd/ekeyd-1.1.5-r1.ebuild
deleted file mode 100644
index d5339e647caa..000000000000
--- a/app-crypt/ekeyd/ekeyd-1.1.5-r1.ebuild
+++ /dev/null
@@ -1,163 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit linux-info systemd toolchain-funcs udev
-
-DESCRIPTION="Entropy Key userspace daemon"
-HOMEPAGE="https://www.entropykey.co.uk/"
-SRC_URI="mirror://ubuntu/pool/universe/e/ekeyd/ekeyd_${PV}.orig.tar.gz"
-
-LICENSE="MIT GPL-2" # GPL-2 (only) for init script
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-IUSE="kernel_linux munin minimal usb"
-REQUIRED_USE="minimal? ( !munin )"
-
-EKEYD_RDEPEND="dev-lang/lua:0"
-EKEYD_DEPEND="${EKEYD_RDEPEND}"
-EKEYD_RDEPEND="${EKEYD_RDEPEND}
-	dev-lua/luasocket
-	kernel_linux? ( virtual/udev )
-	munin? ( net-analyzer/munin )"
-
-RDEPEND="!minimal? ( ${EKEYD_RDEPEND} )
-	virtual/service-manager"
-DEPEND="!minimal? ( ${EKEYD_DEPEND} )"
-
-CONFIG_CHECK="~USB_ACM"
-
-pkg_setup() {
-	if ! use minimal && use kernel_linux && ! use usb && linux_config_exists; then
-		check_extra_config
-	fi
-}
-
-PATCHES=(
-	"${FILESDIR}"/${P}-const_char_usage.patch
-	"${FILESDIR}"/${P}-enoent.patch
-	"${FILESDIR}"/${P}-path-fixes.patch
-	"${FILESDIR}"/${P}-udev-rule.patch
-	"${FILESDIR}"/${P}-remove-werror.patch
-	"${FILESDIR}"/${P}-misc.patch
-)
-
-src_compile() {
-	local osname
-
-	# Override automatic detection: upstream provides this with uname,
-	# we don't like using uname.
-	case ${CHOST} in
-		*-linux-*)
-			osname=linux;;
-		*-freebsd*)
-			osname=freebsd;;
-		*-kfrebsd-gnu)
-			osname=gnukfreebsd;;
-		*-openbsd*)
-			osname=openbsd;;
-		*)
-			die "Unsupported operating system!"
-			;;
-	esac
-
-	# We don't slot LUA so we don't really need to have the variables
-	# set at all.
-	emake -C host \
-		CC="$(tc-getCC)" \
-		LUA_V= LUA_INC= \
-		OSNAME=${osname} \
-		OPT="${CFLAGS}" \
-		BUILD_ULUSBD=no \
-		$(use minimal && echo egd-linux)
-}
-
-src_install() {
-	exeinto /usr/libexec
-	newexe host/egd-linux   ekey-egd-linux
-	newman host/egd-linux.8 ekey-egd-linux.8
-
-	newconfd "${FILESDIR}"/ekey-egd-linux.conf.2 ekey-egd-linux
-	newinitd "${FILESDIR}"/ekey-egd-linux.init.2 ekey-egd-linux
-
-	dodoc doc/* AUTHORS ChangeLog THANKS
-
-	use minimal && return
-	# from here on, install everything that is not part of the minimal
-	# support.
-
-	emake -C host \
-		DESTDIR="${D}" \
-		MANZCMD=cat MANZEXT= \
-		install-ekeyd
-
-	# We move the daemons around to avoid polluting the available
-	# commands.
-	dodir /usr/libexec
-	mv "${D}"/usr/sbin/ekey*d "${D}"/usr/libexec
-
-	systemd_dounit "${FILESDIR}/ekeyd.service"
-
-	newinitd "${FILESDIR}"/${PN}.init.2 ${PN}
-
-	if use kernel_linux; then
-		local rules="${FILESDIR}/90-ekeyd.rules"
-		udev_newrules ${rules} 90-${PN}.rules
-	fi
-
-	if use munin; then
-		exeinto /usr/libexec/munin/plugins
-		doexe munin/ekeyd_stat_
-
-		insinto /etc/munin/plugin-conf.d
-		newins munin/plugin-conf.d_ekeyd ekeyd
-	fi
-}
-
-pkg_postinst() {
-	elog "${CATEGORY}/${PN} now install also the EGD client service ekey-egd-linux."
-	elog "To use this service, you need enable EGDTCPSocket for the ekeyd service"
-	elog "managing the key(s)."
-	elog ""
-	elog "The daemon will send more entropy to the kernel once the available pool"
-	elog "falls below the value set in the kernel.random.write_wakeup_threshold"
-	elog "sysctl entry."
-	elog ""
-	ewarn "Since version 1.1.4-r1, ekey-egd-linux will *not* set the watermark for"
-	ewarn "you, instead you'll have to configure the sysctl in /etc/sysctl.conf"
-
-	use minimal && return
-	# from here on, document everything that is not part of the minimal
-	# support.
-
-	elog ""
-	elog "To make use of your EntropyKey, make sure to execute ekey-rekey"
-	elog "the first time, and then start the ekeyd service."
-	elog ""
-	elog "By default ekeyd will feed the entropy directly to the kernel's pool;"
-	elog "if your system has jumps in load average, you might prefer using the"
-	elog "EGD compatibility mode, by enabling EGDTCPSocket for ekeyd and then"
-	elog "starting the ekey-egd-linux service."
-	elog ""
-	elog "The same applies if you intend to provide entropy for multiple hosts"
-	elog "over the network. If you want to have the ekey-egd-linux service on"
-	elog "other hosts, you can enable the 'minimal' USE flag."
-	elog ""
-	elog "The service supports multiplexing if you wish to use multiple"
-	elog "keys, just symlink /etc/init.d/ekeyd -> /etc/init.d/ekeyd.identifier"
-	elog "and it'll be looking for /etc/entropykey/identifier.conf"
-	elog ""
-
-		if use kernel_linux; then
-			elog "Some versions of Linux have a faulty CDC ACM driver that stops"
-			elog "EntropyKey from working properly; please check the compatibility"
-			elog "table at http://www.entropykey.co.uk/download/"
-		else
-			elog "Make sure your operating system supports the CDC ACM driver"
-			elog "or otherwise you won't be able to use the EntropyKey."
-		fi
-		elog ""
-		elog "If you're unsure about the working state of the CDC ACM driver"
-		elog "enable the usb USE flag and use the userland USB daemon"
-}
diff --git a/app-crypt/gcr/Manifest b/app-crypt/gcr/Manifest
index 1776e37e7627..73db9ba79c65 100644
--- a/app-crypt/gcr/Manifest
+++ b/app-crypt/gcr/Manifest
@@ -1,2 +1,3 @@
 DIST gcr-3.36.0.tar.xz 1025760 BLAKE2B 03f0d0ed40b600ed80e894111fedff3efcbbaaf6f261d6a44a3649a1acb50c4f35f3dc9a7ddb60f56cab241f68fef83aa5a02a94036e70a6556b35300f2c8fb5 SHA512 0431e7971b73accc62869c9497fcff7c111c453aa6a8ff25b42f19ceae1be0aec52e0e4eb504676f967c6e4f179198c15c521278690822e3457dbc5fe512fd5e
 DIST gcr-3.38.0.tar.xz 1029784 BLAKE2B cf295a9f497d6c54067717e806439166965f90670ed5f7283802bb70c547465d9cc28d452970269d4315d02d24cc31f483a0a1fc1807f9b9720e70aa2b8249b9 SHA512 24c35ac514a67a1dee6a5738e829b55921a490b060ffa597421cea0abac3ddc62695370d2c7b3504c0adfd55b1ade878ad3ca5e6cb869428b4a19f4a11563bc6
+DIST gcr-3.38.1.tar.xz 1030360 BLAKE2B 474b501a5f6c339b0b4fb460a094dec6d5a297ca44daf050c6c88bc05ee822358309f57490f92c42f84a1e9f36a1d3c09c4b2788d7142ee5e86e2acf7987ea14 SHA512 4dc8c3f84023a7cd6f069f4529cb063d7153e589c2f9547410c7eeb5298dc238ea7fc4f22e22d8c237391f31bfcd814190e55125195f20b913665b9ca81d9c21
diff --git a/app-crypt/gcr/gcr-3.38.1.ebuild b/app-crypt/gcr/gcr-3.38.1.ebuild
new file mode 100644
index 000000000000..f5fde2560c94
--- /dev/null
+++ b/app-crypt/gcr/gcr-3.38.1.ebuild
@@ -0,0 +1,84 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+VALA_USE_DEPEND="vapigen"
+PYTHON_COMPAT=( python3_{6,7,8,9,10} )
+
+inherit gnome.org gnome2-utils meson python-any-r1 vala xdg
+
+DESCRIPTION="Libraries for cryptographic UIs and accessing PKCS#11 modules"
+HOMEPAGE="https://gitlab.gnome.org/GNOME/gcr"
+
+LICENSE="GPL-2+ LGPL-2+"
+SLOT="0/1" # subslot = suffix of libgcr-base-3 and co
+
+IUSE="gtk gtk-doc +introspection test +vala"
+REQUIRED_USE="vala? ( introspection )"
+RESTRICT="!test? ( test )"
+
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-linux ~x86-linux ~sparc-solaris ~x86-solaris"
+
+DEPEND="
+	>=dev-libs/glib-2.44.0:2
+	>=dev-libs/libgcrypt-1.2.2:0=
+	>=app-crypt/p11-kit-0.19.0
+	gtk? ( >=x11-libs/gtk+-3.12:3[X,introspection?] )
+	>=sys-apps/dbus-1
+	introspection? ( >=dev-libs/gobject-introspection-1.58:= )
+"
+RDEPEND="${DEPEND}"
+PDEPEND="app-crypt/gnupg"
+BDEPEND="
+	${PYTHON_DEPS}
+	gtk? ( dev-libs/libxml2:2 )
+	dev-util/gdbus-codegen
+	dev-util/glib-utils
+	gtk-doc? (
+		>=dev-util/gtk-doc-1.9
+		app-text/docbook-xml-dtd:4.1.2
+	)
+	>=sys-devel/gettext-0.19.8
+	test? ( app-crypt/gnupg )
+	virtual/pkgconfig
+	vala? ( $(vala_depend) )
+"
+
+PATCHES=(
+	"${FILESDIR}"/3.38.0-avoid-gnupg-circular-dep.patch
+	"${FILESDIR}"/3.38.0-optional-vapi.patch
+)
+
+pkg_setup() {
+	python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	use vala && vala_src_prepare
+	xdg_src_prepare
+}
+
+src_configure() {
+	local emesonargs=(
+		$(meson_use introspection)
+		$(meson_use gtk)
+		$(meson_use gtk-doc gtk_doc)
+		-Dgpg_path="${EPREFIX}"/usr/bin/gpg
+		$(meson_use vala vapi)
+	)
+	meson_src_configure
+}
+
+src_test() {
+	dbus-run-session meson test -C "${BUILD_DIR}" || die 'tests failed'
+}
+
+pkg_postinst() {
+	xdg_pkg_postinst
+	gnome2_schemas_update
+}
+
+pkg_postrm() {
+	xdg_pkg_postrm
+	gnome2_schemas_update
+}
diff --git a/app-crypt/heimdal/heimdal-7.7.0-r1.ebuild b/app-crypt/heimdal/heimdal-7.7.0-r1.ebuild
index 7f1b887ec720..80ad4bed246f 100644
--- a/app-crypt/heimdal/heimdal-7.7.0-r1.ebuild
+++ b/app-crypt/heimdal/heimdal-7.7.0-r1.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://github.com/${PN}/${PN}/releases/download/${P}/${P}.tar.gz"
 
 LICENSE="BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 sparc ~x86"
 IUSE="afs +berkdb caps gdbm hdb-ldap libressl +lmdb otp selinux ssl static-libs test X"
 RESTRICT="!test? ( test )"
 
diff --git a/app-crypt/libnitrokey/Manifest b/app-crypt/libnitrokey/Manifest
index abed557f9936..0a7271fec1e5 100644
--- a/app-crypt/libnitrokey/Manifest
+++ b/app-crypt/libnitrokey/Manifest
@@ -1 +1,2 @@
 DIST libnitrokey-3.5.tar.gz 94356 BLAKE2B 9e53213f309e903d26e0e8e01ab213d6bc42c5b8d720e4b19f27adb607f20ad0c6e1707bf7b55c525efbd6a4fbf7b9c87983decf6b05dab7d03701ae0ea8277f SHA512 d2a95071e92d839c8cde4ac1435158bb469c25662f2988a4e824dbc0dfe83af841e6d04589293deddd77746dbec17b30c50fab69af58cc727ed5e0f2dbd0b5e7
+DIST libnitrokey-3.6.tar.gz 98038 BLAKE2B 27f99e7b6de93548fc7a373f37ce784da0aa50503a5c635b4d90282e6330a5ff4c0dcc03a83a7e57045b8a1aabaab27d76a090d7c49693a6ff1037b81e75ece9 SHA512 a00a6724e5c64715eca688ec254efd979acceb5ff4cad28a205f7128e44db8674a5924634fd7da6c69d589deafca7b28b99e1d05a244c321d5cb429f2e5a3bec
diff --git a/app-crypt/libnitrokey/libnitrokey-3.6.ebuild b/app-crypt/libnitrokey/libnitrokey-3.6.ebuild
new file mode 100644
index 000000000000..8687d0d1b4e3
--- /dev/null
+++ b/app-crypt/libnitrokey/libnitrokey-3.6.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit udev cmake
+
+DESCRIPTION="Support library for the Nitrokey"
+HOMEPAGE="https://github.com/Nitrokey/libnitrokey"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/Nitrokey/libnitrokey.git"
+
+	# Disable pulling in bundled dependencies
+	EGIT_SUBMODULES=()
+else
+	SRC_URI="https://github.com/Nitrokey/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~ppc64 ~x86"
+fi
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/hidapi:=
+	virtual/udev"
+DEPEND="
+	${RDEPEND}
+	test? ( >=dev-cpp/catch-2.5.0:0 )"
+BDEPEND="virtual/pkgconfig"
+
+src_configure() {
+	local mycmakeargs=(
+		-DCMAKE_INSTALL_UDEVRULESDIR="$(get_udevdir)"/rules.d
+
+		# actual hardware tests
+		#   1. require a connected Nitrokey
+		#   2. may kill data on your Nitrokey
+		# hence the main testsuite is disabled
+		-DCOMPILE_TESTS=OFF
+		-DCOMPILE_OFFLINE_TESTS=$(usex test)
+	)
+	cmake_src_configure
+}
diff --git a/app-crypt/libnitrokey/libnitrokey-9999.ebuild b/app-crypt/libnitrokey/libnitrokey-9999.ebuild
index 37864f5ac542..8687d0d1b4e3 100644
--- a/app-crypt/libnitrokey/libnitrokey-9999.ebuild
+++ b/app-crypt/libnitrokey/libnitrokey-9999.ebuild
@@ -1,9 +1,9 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
 
-inherit cmake-utils udev
+inherit udev cmake
 
 DESCRIPTION="Support library for the Nitrokey"
 HOMEPAGE="https://github.com/Nitrokey/libnitrokey"
@@ -43,5 +43,5 @@ src_configure() {
 		-DCOMPILE_TESTS=OFF
 		-DCOMPILE_OFFLINE_TESTS=$(usex test)
 	)
-	cmake-utils_src_configure
+	cmake_src_configure
 }
diff --git a/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch b/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch
new file mode 100644
index 000000000000..ec901ce9c31f
--- /dev/null
+++ b/app-crypt/mit-krb5/files/mit-krb5-1.18.2-krb5-config.patch
@@ -0,0 +1,15 @@
+--- a/build-tools/krb5-config.in
++++ b/build-tools/krb5-config.in
+@@ -208,12 +208,6 @@
+ 
+ 
+ if test -n "$do_libs"; then
+-    # Assumes /usr/lib is the standard library directory everywhere...
+-    if test "$libdir" = /usr/lib; then
+-	libdirarg=
+-    else
+-	libdirarg="-L$libdir"
+-    fi
+     # Ugly gross hack for our build tree
+     lib_flags=`echo $CC_LINK | sed -e 's/\$(CC)//' \
+ 	    -e 's/\$(PURE)//' \
diff --git a/app-crypt/mit-krb5/mit-krb5-1.18.2-r3.ebuild b/app-crypt/mit-krb5/mit-krb5-1.18.2-r3.ebuild
new file mode 100644
index 000000000000..f495fb986193
--- /dev/null
+++ b/app-crypt/mit-krb5/mit-krb5-1.18.2-r3.ebuild
@@ -0,0 +1,169 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{6,7,8,9,10} )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils libressl lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+# Test suite requires network access
+RESTRICT="test"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+	pkinit? (
+		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+		libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
+	)
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? (
+		${PYTHON_DEPS}
+		dev-lang/tcl:0
+		dev-util/dejagnu
+		dev-util/cmocka
+	)"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+	"${FILESDIR}/${PN}-1.16.3-libressl-r1.patch"
+	"${FILESDIR}/${PN}_dont_create_run.patch"
+	"${FILESDIR}/${PN}-1.18-libressl.patch"
+	"${FILESDIR}/CVE-2020-28196.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# QA
+	append-flags -fno-strict-aliasing
+	append-flags -fno-strict-overflow
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_enable threads thread-support) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--disable-rpath \
+		\
+		AR="$(tc-getAR)"
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+}
diff --git a/app-crypt/mit-krb5/mit-krb5-1.18.3-r1.ebuild b/app-crypt/mit-krb5/mit-krb5-1.18.3-r1.ebuild
new file mode 100644
index 000000000000..e8bf217b83c1
--- /dev/null
+++ b/app-crypt/mit-krb5/mit-krb5-1.18.3-r1.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+PYTHON_COMPAT=( python3_{6,7,8,9,10} )
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
+
+MY_P="${P/mit-}"
+P_DIR=$(ver_cut 1-2)
+DESCRIPTION="MIT Kerberos V"
+HOMEPAGE="https://web.mit.edu/kerberos/www/"
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
+
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="cpu_flags_x86_aes doc +keyutils libressl lmdb nls openldap +pkinit selinux +threads test xinetd"
+
+# Test suite requires network access
+RESTRICT="test"
+
+DEPEND="
+	!!app-crypt/heimdal
+	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
+	|| (
+		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
+		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
+	)
+	keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] )
+	lmdb? ( dev-db/lmdb )
+	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
+	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
+	pkinit? (
+		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
+		libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
+	)
+	xinetd? ( sys-apps/xinetd )
+	"
+BDEPEND="
+	${PYTHON_DEPS}
+	virtual/yacc
+	cpu_flags_x86_aes? (
+		amd64? ( dev-lang/yasm )
+		x86? ( dev-lang/yasm )
+	)
+	doc? ( virtual/latex-base )
+	test? (
+		${PYTHON_DEPS}
+		dev-lang/tcl:0
+		dev-util/dejagnu
+		dev-util/cmocka
+	)"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-kerberos )"
+
+S=${WORKDIR}/${MY_P}/src
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
+	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
+	"${FILESDIR}/${PN}-1.16.3-libressl-r1.patch"
+	"${FILESDIR}/${PN}_dont_create_run.patch"
+	"${FILESDIR}/${PN}-1.18-libressl.patch"
+	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/krb5-config
+)
+
+src_prepare() {
+	default
+	# Make sure we always use the system copies.
+	rm -rf util/{et,ss,verto}
+	sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# QA
+	append-flags -fno-strict-aliasing
+	append-flags -fno-strict-overflow
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE=${S} \
+	WARN_CFLAGS="set" \
+	econf \
+		$(use_with openldap ldap) \
+		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
+		$(use_enable nls) \
+		$(use_enable pkinit) \
+		$(use_enable threads thread-support) \
+		$(use_with lmdb) \
+		$(use_with keyutils) \
+		--without-hesiod \
+		--enable-shared \
+		--with-system-et \
+		--with-system-ss \
+		--enable-dns-for-realm \
+		--enable-kdc-lookaside-cache \
+		--with-system-verto \
+		--disable-rpath \
+		\
+		AR="$(tc-getAR)"
+}
+
+multilib_src_compile() {
+	emake -j1
+}
+
+multilib_src_test() {
+	multilib_is_native_abi && emake -j1 check
+}
+
+multilib_src_install() {
+	emake \
+		DESTDIR="${D}" \
+		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
+		install
+}
+
+multilib_src_install_all() {
+	# default database dir
+	keepdir /var/lib/krb5kdc
+
+	cd ..
+	dodoc README
+
+	if use doc; then
+		dodoc -r doc/html
+		docinto pdf
+		dodoc doc/pdf/*.pdf
+	fi
+
+	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
+	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
+	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
+	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
+	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
+	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
+
+	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
+	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
+
+	insinto /etc
+	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
+	insinto /var/lib/krb5kdc
+	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
+
+	if use openldap ; then
+		insinto /etc/openldap/schema
+		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
+	fi
+
+	if use xinetd ; then
+		insinto /etc/xinetd.d
+		newins "${FILESDIR}/kpropd.xinetd" kpropd
+	fi
+}
diff --git a/app-crypt/nitrocli/nitrocli-0.3.4.ebuild b/app-crypt/nitrocli/nitrocli-0.3.4.ebuild
index 145850be6321..87bedec282a1 100644
--- a/app-crypt/nitrocli/nitrocli-0.3.4.ebuild
+++ b/app-crypt/nitrocli/nitrocli-0.3.4.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2017-2020 Gentoo Authors
+# Copyright 2017-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -49,7 +49,7 @@ SRC_URI="$(cargo_crate_uris ${CRATES})"
 
 LICENSE="Apache-2.0 GPL-3+ LGPL-3 MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~ppc64 ~x86"
+KEYWORDS="amd64 ~ppc64 x86"
 
 DEPEND="
 	dev-libs/hidapi
diff --git a/app-crypt/nitrokey-app/nitrokey-app-1.4.2.ebuild b/app-crypt/nitrokey-app/nitrokey-app-1.4.2.ebuild
index fbcae50c1f6b..3240ee318cd4 100644
--- a/app-crypt/nitrokey-app/nitrokey-app-1.4.2.ebuild
+++ b/app-crypt/nitrokey-app/nitrokey-app-1.4.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -16,7 +16,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_SUBMODULES=()
 else
 	SRC_URI="https://github.com/Nitrokey/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 ~ppc64 ~x86"
+	KEYWORDS="amd64 ~ppc64 ~x86"
 fi
 
 LICENSE="GPL-3"
diff --git a/app-crypt/openpgp-keys-python/Manifest b/app-crypt/openpgp-keys-python/Manifest
new file mode 100644
index 000000000000..f840a28391c5
--- /dev/null
+++ b/app-crypt/openpgp-keys-python/Manifest
@@ -0,0 +1,5 @@
+DIST 0d96df4d4110e5c43fbfb17f2d347ea6aa65421d.asc 9704 BLAKE2B 2639ab1b08b725d87048c963b9680e8fe0d84a3e56a57b519c3071b354b6826068f71a450484caa7b521b98bade8fb6ee85ffa65d1fb12f61df893607c97c82f SHA512 8bc92419736b0b0a363c4f28f37b083083e84b9e34113ad65b8696c44e8d45717a53569ee5b17cda38e6a5c51b15cc3d674cee3425959074e872351cf38e6ffb
+DIST a035c8c19219ba821ecea86b64e628f8d684696d.asc 6884 BLAKE2B 3cb0826e3ccce466f7ccef5f6a2dcfa8a2c98cbb3b7bb067da220f57e0003197ef7b5efdd75f033e5818f701bcad7ca2eade0bd2ff1b8892a2a80e94e2fc5e44 SHA512 b54c02ae19f90e6a50b1b46e470ea8e0c07d5d7d2509ddc8303008837db37b275f4b951fa532c2d5c30f18951d160748e0e10406df16d66e09e3ec39a2f3d61c
+DIST c01e1cad5ea2c4f0b8e3571504c367c218add4ff.asc 11972 BLAKE2B 56a943a1a6f0ed45d7d891f22092d15ac13f0e31adf430f47e970e9f2a1d93223362c35e72e8e5107acab5fec345134980e4826a8a4cf50362faba3bfa340e8c SHA512 6d1bf0ae7bafb34aa7080bed468fcec09d9b279beeedcc91be6180e52026f1543e27f3fec159fafc38ab433af23c928bfd2fcae7571bd099170cdef9fefe0605
+DIST c9b104b3dd3aa72d7ccb1066fb9921286f5e1540.asc 3403 BLAKE2B 8be2e6de6dbd4150a9167ef12eff278107103e4962b6de409959c5cf03cf506ed64c0e1d735856db6e94b812390383f126de8b1fc440f34294adb4b1cbfa994c SHA512 d32322792fb4d1dc0c548ae7158c1c4e368d9c0fa62898f0b5f03b8d57a9497fbf8c5b2c0175027ea5f09afac36886fbb3cf89900c3d3e8f49de70a17228b6ce
+DIST e3ff2839c048b25c084debe9b26995e310250568.asc 65279 BLAKE2B e689213feeef4bc210906feb6cb07eb9478fe8e4856d43a2bb899b0ae24a50b87a478c5ca8df9326cfb848d6502d4d5b8359b29335ff201300dc054253471958 SHA512 4935edb7fe0bd5072f12bc68b31bfb171f0b0dea65786ae3ff3aaa5101694990b67bc0198f84111cf694bdda5900966fd8d6faa32bc8441d3bd8c71a2fbc561a
diff --git a/app-crypt/openpgp-keys-python/metadata.xml b/app-crypt/openpgp-keys-python/metadata.xml
new file mode 100644
index 000000000000..20429c3d3fc5
--- /dev/null
+++ b/app-crypt/openpgp-keys-python/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>python@gentoo.org</email>
+	</maintainer>
+	<stabilize-allarches/>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/app-crypt/openpgp-keys-python/openpgp-keys-python-20210121.ebuild b/app-crypt/openpgp-keys-python/openpgp-keys-python-20210121.ebuild
new file mode 100644
index 000000000000..5ae822f73311
--- /dev/null
+++ b/app-crypt/openpgp-keys-python/openpgp-keys-python-20210121.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="OpenPGP keys used to sign CPython releases"
+HOMEPAGE="https://www.python.org/downloads/"
+SRC_URI="
+	https://keybase.io/pablogsal/pgp_keys.asc?fingerprint=a035c8c19219ba821ecea86b64e628f8d684696d
+		-> a035c8c19219ba821ecea86b64e628f8d684696d.asc
+	https://keybase.io/ambv/pgp_keys.asc?fingerprint=e3ff2839c048b25c084debe9b26995e310250568
+		-> e3ff2839c048b25c084debe9b26995e310250568.asc
+	https://keybase.io/nad/pgp_keys.asc?fingerprint=0d96df4d4110e5c43fbfb17f2d347ea6aa65421d
+		-> 0d96df4d4110e5c43fbfb17f2d347ea6aa65421d.asc
+	https://keybase.io/nad/pgp_keys.asc?fingerprint=c9b104b3dd3aa72d7ccb1066fb9921286f5e1540
+		-> c9b104b3dd3aa72d7ccb1066fb9921286f5e1540.asc
+	https://keybase.io/bp/pgp_keys.asc?fingerprint=c01e1cad5ea2c4f0b8e3571504c367c218add4ff
+		-> c01e1cad5ea2c4f0b8e3571504c367c218add4ff.asc
+"
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 sparc ~x86"
+
+S=${WORKDIR}
+
+src_install() {
+	local files=( ${A} )
+	insinto /usr/share/openpgp-keys
+	newins - python.org.asc < <(cat "${files[@]/#/${DISTDIR}/}")
+}
diff --git a/app-crypt/pinentry/Manifest b/app-crypt/pinentry/Manifest
index 96c7370bde23..034a29fa6e0a 100644
--- a/app-crypt/pinentry/Manifest
+++ b/app-crypt/pinentry/Manifest
@@ -1 +1,2 @@
 DIST pinentry-1.1.0.tar.bz2 467702 BLAKE2B cf43555848ab0dc60756fca123aba7599ebb1bfe0458b973ed9d84479f8de9ee69ef309b518b40aa340434d64d37793cf97c94f78f99820bc5c71ecd2aac7a49 SHA512 5012672925bcb5f683358c259e55e4b87c67cf063ad52c759308933733025c33f7ce08e5b8019ffc101cbf7ef30499040ef2fd34a7611698e65e1593f80948cd
+DIST pinentry-1.1.1.tar.bz2 515723 BLAKE2B f257fe552852e6d1ff2c23aeb0c1127b43e3a60e44c78dfa764d569e659ccb78528ce3ee863114af273a4b6f6c24686cda2cb14bb04995eb8c41ccd4541a9fbd SHA512 d6ab5af8ac2f3c9c05e09703e95d8e2676f9b2b7ceb97f6a31d101d0e9da7a1e106a6d3eabe86cab1bb35a4b119a7cba1380ac64bf13c61af0b3c48803116c12
diff --git a/app-crypt/pinentry/pinentry-1.1.0-r3.ebuild b/app-crypt/pinentry/pinentry-1.1.0-r4.ebuild
index b1f94a63c96a..967f928b26f7 100644
--- a/app-crypt/pinentry/pinentry-1.1.0-r3.ebuild
+++ b/app-crypt/pinentry/pinentry-1.1.0-r4.ebuild
@@ -12,7 +12,7 @@ SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
 LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="caps emacs gnome-keyring fltk gtk ncurses qt5"
+IUSE="caps emacs gnome-keyring gtk ncurses qt5"
 
 DEPEND="
 	app-eselect/eselect-pinentry
@@ -20,9 +20,7 @@ DEPEND="
 	>=dev-libs/libgcrypt-1.6.3
 	>=dev-libs/libgpg-error-1.17
 	caps? ( sys-libs/libcap )
-	fltk? ( x11-libs/fltk )
 	gnome-keyring? ( app-crypt/libsecret )
-	gtk? ( x11-libs/gtk+:2 )
 	ncurses? ( sys-libs/ncurses:0= )
 	qt5? (
 		dev-qt/qtcore:5
@@ -31,7 +29,7 @@ DEPEND="
 	)
 "
 RDEPEND="${DEPEND}
-	gnome-keyring? ( app-crypt/gcr )
+	gtk? ( app-crypt/gcr )
 "
 BDEPEND="
 	sys-devel/gettext
@@ -48,6 +46,7 @@ PATCHES=(
 
 src_prepare() {
 	default
+	unset FLTK_CONFIG
 	eautoreconf
 }
 
@@ -58,40 +57,29 @@ src_configure() {
 
 	econf \
 		$(use_enable emacs pinentry-emacs) \
-		$(use_enable fltk pinentry-fltk) \
 		$(use_enable gnome-keyring libsecret) \
-		$(use_enable gnome-keyring pinentry-gnome3) \
-		$(use_enable gtk pinentry-gtk2) \
+		$(use_enable gtk pinentry-gnome3) \
 		$(use_enable ncurses fallback-curses) \
 		$(use_enable ncurses pinentry-curses) \
 		$(use_enable qt5 pinentry-qt) \
 		$(use_with caps libcap) \
 		--enable-pinentry-tty \
-		FLTK_CONFIG="${EROOT}/usr/bin/fltk-config" \
+		--disable-pinentry-fltk \
+		--disable-pinentry-gtk2 \
 		MOC="$(qt5_get_bindir)"/moc \
-		GPG_ERROR_CONFIG="${EROOT}/usr/bin/${CHOST}-gpg-error-config" \
-		LIBASSUAN_CONFIG="${EROOT}/usr/bin/libassuan-config" \
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config" \
+		LIBASSUAN_CONFIG="${ESYSROOT}/usr/bin/libassuan-config" \
 		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
 }
 
 src_install() {
 	default
-	rm -f "${ED}"/usr/bin/pinentry
+	rm "${ED}"/usr/bin/pinentry || die
 
-	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt4
+	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt5
 }
 
 pkg_postinst() {
-	if ! has_version 'app-crypt/pinentry' || has_version '<app-crypt/pinentry-0.7.3'; then
-		elog "We no longer install pinentry-curses and pinentry-qt SUID root by default."
-		elog "Linux kernels >=2.6.9 support memory locking for unprivileged processes."
-		elog "The soft resource limit for memory locking specifies the limit an"
-		elog "unprivileged process may lock into memory. You can also use POSIX"
-		elog "capabilities to allow pinentry to lock memory. To do so activate the caps"
-		elog "USE flag and add the CAP_IPC_LOCK capability to the permitted set of"
-		elog "your users."
-	fi
-
 	eselect pinentry update ifunset
 }
 
diff --git a/app-crypt/pinentry/pinentry-1.1.1.ebuild b/app-crypt/pinentry/pinentry-1.1.1.ebuild
new file mode 100644
index 000000000000..5d2943485111
--- /dev/null
+++ b/app-crypt/pinentry/pinentry-1.1.1.ebuild
@@ -0,0 +1,88 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic qmake-utils toolchain-funcs
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/aegypten2/index.html"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="caps emacs gnome-keyring gtk ncurses qt5"
+
+DEPEND="
+	app-eselect/eselect-pinentry
+	>=dev-libs/libassuan-2.1
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	caps? ( sys-libs/libcap )
+	gnome-keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:0= )
+	qt5? (
+		dev-qt/qtcore:5
+		dev-qt/qtgui:5
+		dev-qt/qtwidgets:5
+	)
+"
+RDEPEND="${DEPEND}
+	gtk? ( app-crypt/gcr )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.0.0-make-icon-work-under-Plasma-Wayland.patch"
+	"${FILESDIR}/${PN}-0.8.2-ncurses.patch"
+	"${FILESDIR}/${PN}-1.0.0-AR.patch"
+)
+
+src_prepare() {
+	default
+	unset FLTK_CONFIG
+	eautoreconf
+}
+
+src_configure() {
+	[[ "$(gcc-major-version)" -ge 5 ]] && append-cxxflags -std=gnu++11
+
+	export QTLIB="$(qt5_get_libdir)"
+
+	econf \
+		$(use_enable emacs pinentry-emacs) \
+		$(use_enable gnome-keyring libsecret) \
+		$(use_enable gtk pinentry-gnome3) \
+		$(use_enable ncurses fallback-curses) \
+		$(use_enable ncurses pinentry-curses) \
+		$(use_enable qt5 pinentry-qt) \
+		$(use_with caps libcap) \
+		--enable-pinentry-tty \
+		--disable-pinentry-fltk \
+		--disable-pinentry-gtk2 \
+		MOC="$(qt5_get_bindir)"/moc \
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config" \
+		LIBASSUAN_CONFIG="${ESYSROOT}/usr/bin/libassuan-config" \
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+}
+
+src_install() {
+	default
+	rm "${ED}"/usr/bin/pinentry || die
+
+	use qt5 && dosym pinentry-qt /usr/bin/pinentry-qt5
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}
diff --git a/app-crypt/pius/pius-3.0.0-r1.ebuild b/app-crypt/pius/pius-3.0.0-r1.ebuild
index fe3767650249..197dd4b65ea2 100644
--- a/app-crypt/pius/pius-3.0.0-r1.ebuild
+++ b/app-crypt/pius/pius-3.0.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -23,10 +23,10 @@ RDEPEND="${DEPEND}
 	dev-lang/perl"
 
 PATCHES=(
-  "${FILESDIR}/${P}-Fix-typos-132.patch"
-  "${FILESDIR}/${P}-pius-keyring-mgr-Fix-constants-134.patch"
-  "${FILESDIR}/${P}-Fix-typo-in-readme-135.patch"
-  "${FILESDIR}/${P}-Minor-fixes-for-pius-report-137.patch"
+	"${FILESDIR}/${P}-Fix-typos-132.patch"
+	"${FILESDIR}/${P}-pius-keyring-mgr-Fix-constants-134.patch"
+	"${FILESDIR}/${P}-Fix-typo-in-readme-135.patch"
+	"${FILESDIR}/${P}-Minor-fixes-for-pius-report-137.patch"
 )
 
 python_test() {
diff --git a/app-crypt/rainbowcrack/rainbowcrack-1.8.ebuild b/app-crypt/rainbowcrack/rainbowcrack-1.8.ebuild
index 7a4aba0ea140..99a25ac62f03 100644
--- a/app-crypt/rainbowcrack/rainbowcrack-1.8.ebuild
+++ b/app-crypt/rainbowcrack/rainbowcrack-1.8.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -11,7 +11,7 @@ SRC_URI="https://project-${PN}.com/${P}-linux64.zip"
 
 LICENSE="all-rights-reserved"
 SLOT="0"
-KEYWORDS="-* ~amd64"
+KEYWORDS="-* amd64"
 IUSE=""
 
 RESTRICT="bindist mirror" #444426
diff --git a/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-fno-common.patch b/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-fno-common.patch
new file mode 100644
index 000000000000..88bfb33433c1
--- /dev/null
+++ b/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-fno-common.patch
@@ -0,0 +1,48 @@
+https://bugs.gentoo.org/707256
+--- a/tpm/tpm_emulator_extern.h
++++ b/tpm/tpm_emulator_extern.h
+@@ -29,7 +29,7 @@ enum {
+   TPM_LOG_ERROR
+ };
+ 
+-void (*tpm_log)(int priority, const char *fmt, ...);
++extern void (*tpm_log)(int priority, const char *fmt, ...);
+ 
+ #if defined(_WIN32) || defined(_WIN64)
+ #define __BFILE__ ((strrchr(__FILE__, '\\') ? : __FILE__ - 1) + 1)
+@@ -44,27 +44,27 @@ void (*tpm_log)(int priority, const char *fmt, ...);
+ #define error(fmt, ...) tpm_log(TPM_LOG_ERROR, "%s:%d: Error: " fmt "\n", \
+                                 __BFILE__, __LINE__, ## __VA_ARGS__)
+ /* initialization */
+-int (*tpm_extern_init)(void);
+-void (*tpm_extern_release)(void);
++extern int (*tpm_extern_init)(void);
++extern void (*tpm_extern_release)(void);
+ 
+ /* memory allocation */
+ 
+-void* (*tpm_malloc)(size_t size);
++extern void* (*tpm_malloc)(size_t size);
+ 
+-void (*tpm_free)(/*const*/ void *ptr);
++extern void (*tpm_free)(/*const*/ void *ptr);
+ 
+ /* random numbers */
+ 
+-void (*tpm_get_extern_random_bytes)(void *buf, size_t nbytes);
++extern void (*tpm_get_extern_random_bytes)(void *buf, size_t nbytes);
+ 
+ /* usec since last call */
+ 
+-uint64_t (*tpm_get_ticks)(void);
++extern uint64_t (*tpm_get_ticks)(void);
+ 
+ /* file handling */
+ 
+-int (*tpm_write_to_storage)(uint8_t *data, size_t data_length);
+-int (*tpm_read_from_storage)(uint8_t **data, size_t *data_length);
++extern int (*tpm_write_to_storage)(uint8_t *data, size_t data_length);
++extern int (*tpm_read_from_storage)(uint8_t **data, size_t *data_length);
+ 
+ #endif /* _TPM_EMULATOR_EXTERN_H_ */
+ 
diff --git a/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-static-libs.patch b/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-static-libs.patch
new file mode 100644
index 000000000000..845229bd7670
--- /dev/null
+++ b/app-crypt/tpm-emulator/files/tpm-emulator-0.7.5-static-libs.patch
@@ -0,0 +1,26 @@
+https://bugs.gentoo.org/726492
+--- a/tddl/CMakeLists.txt
++++ b/tddl/CMakeLists.txt
+@@ -5,21 +5,18 @@
+ 
+ set(tddl-tpm-emulator_SRCS "tddl.c" "tddl-tpm-emulator.h")
+ add_library(tddl-tpm-emulator SHARED ${tddl-tpm-emulator_SRCS})
+-add_library(tddl-tpm-emulator_static STATIC ${tddl-tpm-emulator_SRCS})
+ if(UNIX)
+   set_target_properties(tddl-tpm-emulator PROPERTIES SOVERSION "1.2"
+     VERSION "1.2.${${PROJECT_NAME}_VERSION_MAJOR}.${${PROJECT_NAME}_VERSION_MINOR}")
+-  set_target_properties(tddl-tpm-emulator_static PROPERTIES OUTPUT_NAME tddl-tpm-emulator)
+ elseif(WIN32)
+   set_target_properties(tddl-tpm-emulator PROPERTIES OUTPUT_NAME ifxtpm)
+   set_target_properties(tddl-tpm-emulator PROPERTIES PREFIX "")
+ endif()
+ 
+ install(TARGETS tddl-tpm-emulator DESTINATION ${CMAKE_INSTALL_LIBDIR})
+-install(TARGETS tddl-tpm-emulator_static DESTINATION ${CMAKE_INSTALL_LIBDIR})
+ install(FILES "tddl-tpm-emulator.h" DESTINATION ${CMAKE_INSTALL_INCLUDEDIR})
+ 
+ include_directories(${CMAKE_CURRENT_SOURCE_DIR})
+ add_executable(test_tddl test_tddl.c)
+-target_link_libraries(test_tddl tddl-tpm-emulator_static)
++target_link_libraries(test_tddl tddl-tpm-emulator)
+ 
diff --git a/app-crypt/tpm-emulator/tpm-emulator-0.7.5-r2.ebuild b/app-crypt/tpm-emulator/tpm-emulator-0.7.5-r3.ebuild
index 9323c1f7edcb..38a0d0182708 100644
--- a/app-crypt/tpm-emulator/tpm-emulator-0.7.5-r2.ebuild
+++ b/app-crypt/tpm-emulator/tpm-emulator-0.7.5-r3.ebuild
@@ -1,30 +1,34 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
+
 MODULES_OPTIONAL_USE="modules"
-inherit user linux-mod cmake-utils udev
+inherit cmake linux-mod udev
 
 MY_P=${P/-/_}
 DESCRIPTION="Emulator driver for tpm"
 HOMEPAGE="https://github.com/PeterHuewe/tpm-emulator"
 SRC_URI="https://github.com/PeterHuewe/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-LICENSE="GPL-2"
 
+LICENSE="GPL-2"
 SLOT="0"
 KEYWORDS="~amd64 ~x86"
-
 IUSE="mtm-emulator"
-RDEPEND="dev-libs/gmp:="
+
+RDEPEND="
+	acct-group/tpm
+	acct-user/tpm
+	dev-libs/gmp:="
 DEPEND="${RDEPEND}"
 
 PATCHES=(
-	"${FILESDIR}/${P}-build.patch"
+	"${FILESDIR}"/${P}-build.patch
+	"${FILESDIR}"/${P}-fno-common.patch
+	"${FILESDIR}"/${P}-static-libs.patch
 )
 
 pkg_setup() {
-	enewgroup tss
-	enewuser tss -1 -1 /var/lib/tpm tss
 	if use modules; then
 		CONFIG_CHECK="MODULES"
 		MODULE_NAMES="tpmd_dev(extra:tpmd_dev/linux:)"
@@ -39,18 +43,20 @@ src_configure() {
 		-DMTM_EMULATOR=$(usex mtm-emulator ON OFF)
 		-DBUILD_DEV=OFF
 	)
-	cmake-utils_src_configure
+	cmake_src_configure
 
-	use modules && ln -s "${BUILD_DIR}/config.h" tpmd_dev/linux
+	if use modules; then
+		ln -s "${BUILD_DIR}/config.h" tpmd_dev/linux || die
+	fi
 }
 
 src_compile() {
-	cmake-utils_src_compile
+	cmake_src_compile
 	use modules && linux-mod_src_compile
 }
 
 src_install() {
-	cmake-utils_src_install
+	cmake_src_install
 	if use modules; then
 		linux-mod_src_install
 		udev_newrules "tpmd_dev/linux/tpmd_dev.rules" 60-tpmd_dev.rules
diff --git a/app-crypt/tpm2-tools/files/tpm2-tools-4.2.1-libressl.patch b/app-crypt/tpm2-tools/files/tpm2-tools-4.2.1-libressl.patch
deleted file mode 100644
index 2f39db3283c3..000000000000
--- a/app-crypt/tpm2-tools/files/tpm2-tools-4.2.1-libressl.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From a1ac2ee0c6592e6f730458c03a2abd1532c66046 Mon Sep 17 00:00:00 2001
-From: Salah Coronya <salah.coronya@gmail.com>
-Date: Sun, 12 Jan 2020 19:17:48 -0600
-Subject: [PATCH] lib/tpm2_openssl.c: Fix build for libressl
-
-Signed-off-by: Salah Coronya <salah.coronya@gmail.com>
----
- lib/tpm2_openssl.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/tpm2_openssl.c b/lib/tpm2_openssl.c
-index 505dd7a0..fd3861d9 100644
---- a/lib/tpm2_openssl.c
-+++ b/lib/tpm2_openssl.c
-@@ -14,7 +14,7 @@
- #include "tpm2_openssl.h"
- 
- /* compatibility function for OpenSSL versions < 1.1.0 */
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- static int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen) {
-     int r;
-     int topad;
--- 
-2.24.1
-
diff --git a/app-crypt/tpm2-tools/files/tpm2-tools-4.3.0-libressl.patch b/app-crypt/tpm2-tools/files/tpm2-tools-4.3.0-libressl.patch
new file mode 100644
index 000000000000..88948546353f
--- /dev/null
+++ b/app-crypt/tpm2-tools/files/tpm2-tools-4.3.0-libressl.patch
@@ -0,0 +1,26 @@
+diff --git a/lib/tpm2_identity_util.c b/lib/tpm2_identity_util.c
+index a3b0e387..9519ca7b 100644
+--- a/lib/tpm2_identity_util.c
++++ b/lib/tpm2_identity_util.c
+@@ -17,7 +17,7 @@
+ 
+ // Identity-related functionality that the TPM normally does, but using OpenSSL
+ 
+-#if defined(LIBRESSL_VERSION_NUMBER)
++#if 0
+ static int RSA_padding_add_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
+         const unsigned char *from, int flen, const unsigned char *param, int plen,
+         const EVP_MD *md, const EVP_MD *mgf1md) {
+diff --git a/lib/tpm2_openssl.c b/lib/tpm2_openssl.c
+index 6d29c0d4..bd375ce3 100644
+--- a/lib/tpm2_openssl.c
++++ b/lib/tpm2_openssl.c
+@@ -14,7 +14,7 @@
+ #include "tpm2_openssl.h"
+ 
+ /* compatibility function for OpenSSL versions < 1.1.0 */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ static int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen) {
+     int r;
+     int topad;
diff --git a/app-crypt/tpm2-tools/files/tpm2-tools-5.0-libressl.patch b/app-crypt/tpm2-tools/files/tpm2-tools-5.0-libressl.patch
new file mode 100644
index 000000000000..b41c9f50e272
--- /dev/null
+++ b/app-crypt/tpm2-tools/files/tpm2-tools-5.0-libressl.patch
@@ -0,0 +1,39 @@
+diff --git a/lib/tpm2_identity_util.c b/lib/tpm2_identity_util.c
+index a3b0e387..9519ca7b 100644
+--- a/lib/tpm2_identity_util.c
++++ b/lib/tpm2_identity_util.c
+@@ -17,7 +17,7 @@
+ 
+ // Identity-related functionality that the TPM normally does, but using OpenSSL
+ 
+-#if defined(LIBRESSL_VERSION_NUMBER)
++#if 0
+ static int RSA_padding_add_PKCS1_OAEP_mgf1(unsigned char *to, int tlen,
+         const unsigned char *from, int flen, const unsigned char *param, int plen,
+         const EVP_MD *md, const EVP_MD *mgf1md) {
+diff --git a/lib/tpm2_openssl.c b/lib/tpm2_openssl.c
+index e769d6df..54f124c9 100644
+--- a/lib/tpm2_openssl.c
++++ b/lib/tpm2_openssl.c
+@@ -15,7 +15,7 @@
+ #include "tpm2_systemdeps.h"
+ 
+ /* compatibility function for OpenSSL versions < 1.1.0 */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ static int BN_bn2binpad(const BIGNUM *a, unsigned char *to, int tolen) {
+     int r;
+     int topad;
+diff --git a/lib/tpm2_openssl.h b/lib/tpm2_openssl.h
+index 46c8f9c0..71206309 100644
+--- a/lib/tpm2_openssl.h
++++ b/lib/tpm2_openssl.h
+@@ -17,7 +17,7 @@
+ #define LIB_TPM2_OPENSSL_OPENSSL_PRE11
+ #endif
+ 
+-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
++#if (OPENSSL_VERSION_NUMBER >= 0x10101000L) && !defined(LIBRESSL_VERSION_NUMBER)
+ #define EC_POINT_set_affine_coordinates_tss(group, tpm_pub_key, bn_x, bn_y, dmy) \
+         EC_POINT_set_affine_coordinates(group, tpm_pub_key, bn_x, bn_y, dmy)
+ 
diff --git a/app-crypt/tpm2-tools/tpm2-tools-4.3.0.ebuild b/app-crypt/tpm2-tools/tpm2-tools-4.3.0-r1.ebuild
index 7ccea9899c4b..f9edff247c56 100644
--- a/app-crypt/tpm2-tools/tpm2-tools-4.3.0.ebuild
+++ b/app-crypt/tpm2-tools/tpm2-tools-4.3.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,13 +24,17 @@ RDEPEND="net-misc/curl:=
 	!libressl? ( dev-libs/openssl:0= )
 	libressl? ( dev-libs/libressl:0= )"
 DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
+BDEPEND="virtual/pkgconfig
+	sys-devel/autoconf-archive"
 PATCHES=(
-	"${FILESDIR}/${PN}-4.2.1-libressl.patch"
+	"${FILESDIR}/${PN}-4.3.0-libressl.patch"
 	"${FILESDIR}/${PN}-4.3.0-Remove-WError.patch"
 )
 
 src_prepare() {
+	sed -i \
+	"s/m4_esyscmd_s(\[git describe --tags --always --dirty\])/${PV}/" \
+	"${S}/configure.ac" || die
 	eautoreconf
 	default
 }
diff --git a/app-crypt/tpm2-tools/tpm2-tools-5.0.ebuild b/app-crypt/tpm2-tools/tpm2-tools-5.0-r1.ebuild
index 3252b0db14e7..375c04e216eb 100644
--- a/app-crypt/tpm2-tools/tpm2-tools-5.0.ebuild
+++ b/app-crypt/tpm2-tools/tpm2-tools-5.0-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2021 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -24,13 +24,17 @@ RDEPEND="net-misc/curl:=
 	!libressl? ( dev-libs/openssl:0= )
 	libressl? ( dev-libs/libressl:0= )"
 DEPEND="${RDEPEND}"
-BDEPEND="virtual/pkgconfig"
+BDEPEND="virtual/pkgconfig
+	sys-devel/autoconf-archive"
 PATCHES=(
-	"${FILESDIR}/${PN}-4.2.1-libressl.patch"
+	"${FILESDIR}/${PN}-5.0-libressl.patch"
 	"${FILESDIR}/${PN}-4.3.0-Remove-WError.patch"
 )
 
 src_prepare() {
+	sed -i \
+	"s/m4_esyscmd_s(\[git describe --tags --always --dirty\])/${PV}/" \
+	"${S}/configure.ac" || die
 	eautoreconf
 	default
 }