Adding metadata

10 files changed, 561 insertions, 0 deletions

diff --git a/app-crypt/gpgme/Manifest b/app-crypt/gpgme/Manifest
index e92c185e0f95..23ca1c0dfc06 100644
--- a/app-crypt/gpgme/Manifest
+++ b/app-crypt/gpgme/Manifest
@@ -4,3 +4,5 @@ DIST gpgme-2.1.0.tar.bz2 1418236 BLAKE2B ed03f7603409e32b3a8792fe1515df09a9d16e9
 DIST gpgme-2.1.0.tar.bz2.sig 147 BLAKE2B 66a0f6536db3ab904311a230aa652ad6240f3c3599b5d902d80f73d537defb0133ff48ba3605f3b2b4e36d115b022fcfbd4cc1a67d3a54d8faf3141c20eccd46 SHA512 53dea5bdc4a46b64f7a7c0c363ecf6f596f52f61905e5f54eafd4d868edacc9259a8c3c3cb991d770a87090766e933ab1e1c1acab6e44db0b413229495efff57
 DIST gpgme-2.1.1.tar.bz2 1419085 BLAKE2B b70ba73898eab4a147f7af3af6d220be11a0ec1b473cd3a11d794c6bdc8dbc7f14800f679bb31c3cc856136d5219e1647c5b0991cc1975bb795fdbd608b53f24 SHA512 3bade9b29dd359c5ba13c8637a46a9bccadb0e4622d343f6de36f968be144c2a16f3cad5f494510f310d094aacfd8000f05d37bb94638b57d861bfe15c46a199
 DIST gpgme-2.1.1.tar.bz2.sig 147 BLAKE2B 139ca84d1b7130aa88b454b516d7084d172375cf06a76424a5d97fa142d62492cb679b56679c7a1cac8cbbf38ecfb73c45ee6d464b7dd29fd1c09b2d87767ef5 SHA512 d231f820b0339d8ae07d69edf5b2213dfc9ba61fe41dd77ecc057be34765d1ba114e9ce951e58118d43c10df8b7f6b075363a12134ab4931a665c045ea51ddb8
+DIST gpgme-2.1.2.tar.bz2 1420275 BLAKE2B 40606849c25a5cb95567b5dfe13012ec54c00026eaf43722ba32efda64974a78d442921d098a330c2d59ba8a97a0c7f5b9cac0b23465ff94425decdf1d98b2d2 SHA512 21ec03ea83b6178fdcf89d691053d4c3e356916ec6926ae33b045424c6e960ef2fe11249775a415a345f9b18c3db7f631423e0eac84f7b22ef24f37d4f8ad0bd
+DIST gpgme-2.1.2.tar.bz2.sig 294 BLAKE2B 1fa38ff89dd2c94db4dc47d19711d9c8a1b06b71132dda1c16e4dd93e679563d32441d4c3be7b05d159f79a3973e3ac4d1bfe77c6ab68038916076178853e2c3 SHA512 103bac16e88b087dc2325d9ac67721d2b3c34e4ac1fd6a2bbafe91af8109c0a714090700a95556040d688a71fa7d1de9ef8f6e179b315b7a9f27de419459d094
diff --git a/app-crypt/gpgme/gpgme-2.1.2.ebuild b/app-crypt/gpgme/gpgme-2.1.2.ebuild
new file mode 100644
index 000000000000..cfb998de2ab5
--- /dev/null
+++ b/app-crypt/gpgme/gpgme-2.1.2.ebuild
@@ -0,0 +1,96 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+# out-of-source b/c in-source builds are not supported:
+# * https://dev.gnupg.org/T6313#166339
+# * https://dev.gnupg.org/T6673#174545
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit libtool flag-o-matic out-of-source verify-sig
+
+DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
+HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
+SRC_URI="
+	mirror://gnupg/gpgme/${P}.tar.bz2
+	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
+"
+
+LICENSE="GPL-2 LGPL-2.1"
+# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
+# Subslot: SONAME of each: <libgpgme.FUDGE>
+SLOT="1/45.0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="common-lisp static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	|| (
+		app-alternatives/gpg[reference]
+		app-alternatives/gpg[freepg(-)]
+	)
+	>=dev-libs/libassuan-2.5.3:=
+	>=dev-libs/libgpg-error-1.46-r1:=
+"
+DEPEND="${RDEPEND}"
+#doc? ( app-text/doxygen[dot] )
+BDEPEND="
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.1.0-tests-start-stop-agent-use-command-v.patch
+)
+
+src_prepare() {
+	default
+
+	elibtoolize
+
+	# bug #697456
+	addpredict /run/user/$(id -u)/gnupg
+
+	local MAX_WORKDIR=66
+	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
+		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
+		die "Could not run tests as requested with too-long WORKDIR."
+	fi
+
+	# Make best effort to allow longer PORTAGE_TMPDIR as usock limitation
+	# fails build/tests.
+	ln -s "${P}" "${WORKDIR}/b" || die
+	S="${WORKDIR}/b"
+}
+
+my_src_configure() {
+	# bug #847955
+	append-lfs-flags
+
+	local languages=(
+		$(usev common-lisp 'cl')
+	)
+
+	local myeconfargs=(
+		--enable-languages="${languages[*]}"
+		$(use_enable static-libs static)
+		$(use_enable test gpgconf-test)
+		$(use_enable test gpg-test)
+		$(use_enable test gpgsm-test)
+		$(use_enable test g13-test)
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+my_src_install() {
+	emake DESTDIR="${D}" install
+	find "${ED}" -type f -name '*.la' -delete || die
+}
diff --git a/app-crypt/p11-kit/Manifest b/app-crypt/p11-kit/Manifest
index c9d1e6e95265..e0d4ce18f7b3 100644
--- a/app-crypt/p11-kit/Manifest
+++ b/app-crypt/p11-kit/Manifest
@@ -1,2 +1,4 @@
 DIST p11-kit-0.26.2.tar.xz 1069216 BLAKE2B a10eab0fe405ea1f99aaac823bdb48d09caa09decd6bfe134aa702430ed5c09af2416db503ea8954467179c30ab754cc2811b4d8e28ac02cf3847fa021e1a2e2 SHA512 662c77e3133a9ee00f155fc2c1f12fdb16492920f992ab6e9de587c8abf76f990d442643bf8464cc08ad4d1c584f4d6f8d3a006aa7fc791010fa9cb7acaf6b7b
 DIST p11-kit-0.26.2.tar.xz.sig 119 BLAKE2B f94f0269f327aeaf7f417f1eb6185fe0df9d61a447e942de11250a6d41d579126ac103a35da45bc1a0aab2f04279a9fec118241122df955268b61a449340355f SHA512 84f5d5363eb38a6a501b34103b5c1df08c88b80897fdd4f966c0692131cca0f21f590a58a7810b9e87e86656641ac4e0f4224b0327840890af4a4baf5186e264
+DIST p11-kit-0.26.4.tar.xz 1081912 BLAKE2B 91a8ff7679e34dbc9d3143c957ec2bba211da85f74c2aa3d150f3078de9387e1f04b4bbec56040e0c12249c1866e7ca191844c1dcdd6c1de29bec04e6d72ea96 SHA512 bebaf91589dd93ddf882a9f38ce897720c79fd56f5196a3b25fc552c3e49250f2ce94e33cb8fe74087bc1e5c4945fa179a0ccb202d0403252656161b2a48ce10
+DIST p11-kit-0.26.4.tar.xz.sig 119 BLAKE2B ed7707c5a0b4b097975fadaf23b7165e45908a05a2e1bc36fa2b507fba7d1a010ae70eda22b7f92970c769bf7740e9653a29a8a2675663c0407c203a4fa0352c SHA512 525d7bda0bed5e9549f92c02c0b7bdcdba2490037b985a93c0e968159711eeb735abb00c254949a0e75e4341470f092c90745b1289876210339d1e5a0ae324f1
diff --git a/app-crypt/p11-kit/p11-kit-0.26.4.ebuild b/app-crypt/p11-kit/p11-kit-0.26.4.ebuild
new file mode 100644
index 000000000000..33b992d5d05f
--- /dev/null
+++ b/app-crypt/p11-kit/p11-kit-0.26.4.ebuild
@@ -0,0 +1,81 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/p11-kit.asc
+inherit shell-completion meson-multilib python-any-r1 verify-sig
+
+DESCRIPTION="Provides a standard configuration setup for installing PKCS#11"
+HOMEPAGE="https://p11-glue.github.io/p11-glue/p11-kit.html"
+SRC_URI="
+	https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz
+	verify-sig? ( https://github.com/p11-glue/p11-kit/releases/download/${PV}/${P}.tar.xz.sig )
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos ~x64-solaris"
+IUSE="+libffi gtk-doc nls systemd test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	app-misc/ca-certificates
+	>=dev-libs/libtasn1-3.4:=[${MULTILIB_USEDEP}]
+	libffi? ( dev-libs/libffi:=[${MULTILIB_USEDEP}] )
+	systemd? ( sys-apps/systemd )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	${PYTHON_DEPS}
+	app-text/docbook-xsl-stylesheets
+	dev-libs/libxslt
+	virtual/pkgconfig
+	gtk-doc? ( dev-util/gtk-doc )
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-p11-kit )
+"
+
+src_prepare() {
+	default
+
+	# Relies on dlopen which won't work for multilib tests (bug #913971)
+	cat <<-EOF > "${S}"/p11-kit/test-server.sh || die
+	#!/bin/sh
+	exit 77
+	EOF
+}
+
+multilib_src_configure() {
+	# Disable unsafe tests, bug#502088
+	export FAKED_MODE=1
+
+	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
+
+	# p11-kit doesn't need this to build and castxml needs Clang. To get
+	# a deterministic non-automagic build, always disable the search for
+	# castxml.
+	cat >> ${native_file} <<-EOF || die
+	[binaries]
+	castxml='castxml-falseified'
+	EOF
+
+	local emesonargs=(
+		--native-file "${native_file}"
+		-Dbash_completion=enabled
+		-Dzsh_completion=enabled
+		-Dbashcompdir="$(get_bashcompdir)"
+		-Dzshcompdir="$(get_zshcompdir)"
+		-Dtrust_module=enabled
+		-Dtrust_paths="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
+		$(meson_feature libffi)
+		$(meson_use nls)
+		$(meson_use test)
+		$(meson_native_use_bool gtk-doc gtk_doc)
+		$(meson_native_true man)
+		$(meson_native_use_feature systemd)
+	)
+
+	meson_src_configure
+}
diff --git a/app-crypt/pinentry/Manifest b/app-crypt/pinentry/Manifest
index 7a57b435e069..578eaa538b1f 100644
--- a/app-crypt/pinentry/Manifest
+++ b/app-crypt/pinentry/Manifest
@@ -1,2 +1,4 @@
 DIST pinentry-1.3.2.tar.bz2 612858 BLAKE2B 985bcf0b4f85d4e5001bfd714ddd064e05ba6d5bd6e1d3b6f1044f27ca148921d22148b301c91cce4fa7f2f7e7f3b743a9bc1383cb9d8e1d0583a595109a699e SHA512 3b4d50a42d412d649a7830f7378aa966342c2bc0157d03b0ad79cf0aed29d6698d48c734e23b1dccada5f6ef81d0c09d3ead6cd703eadfc8082987e6bea0aafc
 DIST pinentry-1.3.2.tar.bz2.sig 266 BLAKE2B 1c428abb285dd56566a83fe4ceef5e0efc3b2a9ed40a2a0b48e7dc06575d24044677091f6a042e1f08ac6308f2bb1e82eddc82f22b78f1a316ca78ed670745f3 SHA512 82352cb5183a7922ab27619e19fc4d7adaa461847040232610b002365db605200961d1d950887aa5b09d12488d70f432fe739e0e2501a28465a28fb428b62aad
+DIST pinentry-1.3.3.tar.bz2 620687 BLAKE2B d907056dfdc2830d41983601ce73df8650c7329bf12d22b5462c2f81921fa3aa8695ae4c420aba8bdef257a34ab502d8c22bb730fb5d713cf59c317f767bee35 SHA512 3562d6a83af01ab9c12fb3e4710e3233078296c1275a69c6ac5ebe7461e95404d6504c4fde82f501f861b3ae960b7d13052bcb359a62dfc078ade29e08b86735
+DIST pinentry-1.3.3.tar.bz2.sig 147 BLAKE2B 454c98cc0c2997baccc9b5b669030a1da63c2991fa76a5c2b29a405759a281c73a29e18c96099b7ee0a572b0915d1b584ec310f23edbbe425becee3f9229590c SHA512 130e8b2096739e632218e11b7a9bb6b8d7af2dcaec94bb1a5019e1579d0eff1de525fb9473412fb7830aec0dc4268b5bfbe1f7e6479ec0caffe69b1da1fa55b7
diff --git a/app-crypt/pinentry/pinentry-1.3.3.ebuild b/app-crypt/pinentry/pinentry-1.3.3.ebuild
new file mode 100644
index 000000000000..06610dbf2e3f
--- /dev/null
+++ b/app-crypt/pinentry/pinentry-1.3.3.ebuild
@@ -0,0 +1,121 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools qt-utils verify-sig
+
+DESCRIPTION="Simple passphrase entry dialogs which utilize the Assuan protocol"
+HOMEPAGE="https://gnupg.org/related_software/pinentry/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="caps efl emacs gtk keyring ncurses qt6 selinux wayland X"
+
+DEPEND="
+	>=dev-libs/libassuan-2.1:=
+	>=dev-libs/libgcrypt-1.6.3
+	>=dev-libs/libgpg-error-1.17
+	efl? ( dev-libs/efl[X] )
+	keyring? ( app-crypt/libsecret )
+	ncurses? ( sys-libs/ncurses:= )
+	qt6? (
+		dev-qt/qtbase:6[gui,widgets]
+		wayland? (
+			kde-frameworks/kguiaddons:6
+			kde-frameworks/kwindowsystem:6
+		)
+	)
+"
+RDEPEND="
+	${DEPEND}
+	gtk? (
+		app-crypt/gcr:4[gtk]
+		gnome-base/gnome-keyring
+	)
+	selinux? ( sec-policy/selinux-gpg )
+"
+BDEPEND="
+	sys-devel/gettext
+	virtual/pkgconfig
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+PDEPEND="emacs? ( app-emacs/pinentry )"
+IDEPEND=">=app-eselect/eselect-pinentry-0.7.4"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS TODO )
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.3.0-automagic.patch" # bug #819939, bug #837719
+)
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	unset FLTK_CONFIG
+
+	local myeconfargs=(
+		$(use_enable efl pinentry-efl)
+		$(use_enable emacs pinentry-emacs)
+		$(use_enable keyring libsecret)
+		$(use_enable gtk pinentry-gnome3)
+		$(use_enable ncurses fallback-curses)
+		$(use_enable ncurses pinentry-curses)
+		$(use_enable qt6 pinentry-qt)
+		$(use_with X x)
+
+		--enable-pinentry-tty
+		--disable-kf5-wayland
+		--disable-pinentry-fltk
+		--disable-pinentry-gtk2
+		--disable-pinentry-qt5
+		--disable-qtx11extras
+
+		ac_cv_path_GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -- '--without-.*-prefix' | sed -e 's/^ *\([^ ]*\) .*/\1/g')
+	)
+
+	if use qt6 ; then
+		export PATH="${BROOT}$(qt_get_bindir 6):${PATH}"
+		export MOC="$(qt_get_broot_binary 6 moc)"
+
+		myeconfargs+=(
+			$(use_enable wayland kf6-wayland)
+		)
+	else
+		myeconfargs+=(
+			--disable-kf6-wayland
+		)
+	fi
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED}"/usr/bin/pinentry || die
+
+	# The preferred Qt implementation upstream gets installed as just 'qt'.
+	# Make a symlink for eselect-pinentry and friends.
+	if use qt6 ; then
+		dosym pinentry-qt /usr/bin/pinentry-qt6
+	fi
+}
+
+pkg_postinst() {
+	eselect pinentry update ifunset
+}
+
+pkg_postrm() {
+	eselect pinentry update ifunset
+}
diff --git a/app-crypt/tpm2-tss/Manifest b/app-crypt/tpm2-tss/Manifest
index 52e82a3ab58d..ee034b89d589 100644
--- a/app-crypt/tpm2-tss/Manifest
+++ b/app-crypt/tpm2-tss/Manifest
@@ -1 +1,3 @@
 DIST tpm2-tss-4.1.3.tar.gz 1902009 BLAKE2B d8592f4797a4254883667476efb2fdf3c95547d9c472fe3557031e934c725e20e3cc70a9b7b41eaddac71e8d9f94beb5fbb39aec5d81b3eeb1b612df27312923 SHA512 c9a5e1e90f6545a466d43790ab2d67c52c4b788a0b21f8212575e27e04e0ac663105863fe00824e08a4e56a4f8c6b00c48c1a1c132531b8569cd5042c3bb9e69
+DIST tpm2-tss-4.1.4.tar.gz 1909284 BLAKE2B 05dda1002acd6fee0fbbee6928a6fb7dcbfac012729dfc33a91c1c2dafec66811b44d9abfb7c5c55888b280129596e10c7871342bfb113411ed1ceb4d6bcf953 SHA512 d6a883e411be8c1eeb0bc44d58a26ea8ea30c720d1833cb14bb7a501f4aba740767be0caa47cac64ea0ab6a6c11b965dd3761ab6c718c86a9d1cff76eb90f37a
+DIST tpm2-tss-4.2.0.tar.gz 2023505 BLAKE2B 347b4e6a7984bb588cc96b6de2b1108ad48a8f18c3f9da8cb9c8670de8d8a7736f43b1f884d9c8093f63b5406e216d4bcb7855293c9e61783dc1d6152ef34c58 SHA512 d122cacd07f3fa229b4f9d988eb8cd4cf8e8021cf3cb32724c13cafa2a94091f1a0fe2bf3df327709e257c6a006277388923939525f33d84782efce7e5dc61c8
diff --git a/app-crypt/tpm2-tss/files/tpm2-tss-4.1.4-use-mbedtls-3.patch b/app-crypt/tpm2-tss/files/tpm2-tss-4.1.4-use-mbedtls-3.patch
new file mode 100644
index 000000000000..35465b5c12ca
--- /dev/null
+++ b/app-crypt/tpm2-tss/files/tpm2-tss-4.1.4-use-mbedtls-3.patch
@@ -0,0 +1,31 @@
+diff --git a/configure.ac b/configure.ac
+index 4a1f1b02..fdbd80c3 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -170,6 +170,10 @@ AS_IF([test "x$enable_vendor" != "xyes"],
+ 
+ m4_define([ossl_min_version], [1.1.0])
+ m4_define([ossl_err], [OpenSSL libcrypto is missing or version requirements not met. OpenSSL version must be >= ossl_min_version])
++# mbedtls 2.x is obsolete
++m4_define([mbed_min_version], [3.0.0])
++m4_define([mbed_err], [mbedtls is missing or version requirements not met. mbedtls version must be >= mbed_min_version])
++
+ AS_IF([test "x$enable_esys" = xyes],
+       [AS_IF([test "x$with_crypto" = xossl], [
+            PKG_CHECK_MODULES([CRYPTO],
+@@ -185,10 +189,12 @@ AS_IF([test "x$enable_esys" = xyes],
+            TSS2_ESYS_CFLAGS_CRYPTO="$CRYPTO_CFLAGS"
+            TSS2_ESYS_LDFLAGS_CRYPTO="$CRYPTO_LIBS"
+        ], [test "x$with_crypto" = xmbed], [
+-           AC_CHECK_HEADER(mbedtls/md.h, [], [AC_MSG_ERROR([Missing required mbedTLS library])])
++           PKG_CHECK_MODULES([MBEDCRYPTO],
++                             [mbedcrypto-3 > mbed_min_version],,
++                             [AC_MSG_ERROR([mbed_err])])
+            AC_DEFINE([MBED], [1], [mbedTLS cryptographic backend])
+-           TSS2_ESYS_CFLAGS_CRYPTO="$LIBMBED_CFLAGS"
+-           TSS2_ESYS_LDFLAGS_CRYPTO="-lmbedcrypto"
++           TSS2_ESYS_CFLAGS_CRYPTO="$MBEDCRYPTO_CFLAGS"
++           TSS2_ESYS_LDFLAGS_CRYPTO="$MBEDCRYPTO_LDFLAGS"
+        ], [test "x$with_crypto" = xnone], [
+            AC_MSG_NOTICE([No crypto backend selected! Users must set crypto functions!])
+        ], [AC_MSG_ERROR([Bad value for --with-crypto $with_crypto])])])
diff --git a/app-crypt/tpm2-tss/tpm2-tss-4.1.4.ebuild b/app-crypt/tpm2-tss/tpm2-tss-4.1.4.ebuild
new file mode 100644
index 000000000000..47c4f0de0fb8
--- /dev/null
+++ b/app-crypt/tpm2-tss/tpm2-tss-4.1.4.ebuild
@@ -0,0 +1,112 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic linux-info multilib-minimal tmpfiles udev
+
+DESCRIPTION="TCG Trusted Platform Module 2.0 Software Stack"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tss"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0/4"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	^^ ( mbedtls openssl )
+	fapi? ( openssl !mbedtls )
+	policy? ( openssl !mbedtls )
+"
+
+RDEPEND="
+	acct-group/tss
+	acct-user/tss
+	sys-apps/util-linux:=[${MULTILIB_USEDEP}]
+	fapi? (
+		dev-libs/json-c:=[${MULTILIB_USEDEP}]
+		>=net-misc/curl-7.80.0[${MULTILIB_USEDEP}]
+	)
+	mbedtls? ( net-libs/mbedtls:3=[${MULTILIB_USEDEP}] )
+	openssl? ( dev-libs/openssl:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="
+	${RDEPEND}
+	test? ( app-crypt/swtpm
+		dev-libs/uthash
+		dev-util/cmocka
+		sys-apps/iproute2[-minimal]
+		fapi? ( >=net-misc/curl-7.80.0 ) )
+"
+
+BDEPEND="
+	sys-apps/acl
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.2-Dont-install-files-into-run.patch"
+	"${FILESDIR}/${PN}-4.1.4-use-mbedtls-3.patch"
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~TCG_TPM"
+	linux-info_pkg_setup
+	kernel_is ge 4 12 0 || ewarn "At least kernel 4.12.0 is required"
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# Fails with inlining
+	filter-flags -fno-semantic-interposition
+	# tests fail with LTO enabbled. See bug 865275 and 865279
+	filter-lto
+
+	local myconf=(
+		--localstatedir=/var
+		$(multilib_native_use_enable doc doxygen-doc)
+		$(use_enable fapi)
+		$(use_enable policy)
+		$(use_enable static-libs static)
+		$(multilib_native_use_enable test unit)
+		$(multilib_native_use_enable test integration)
+		$(multilib_native_use_enable test self-generated-certificate)
+		--disable-tcti-libtpms
+		--disable-tcti-spi-ltt2go
+		--disable-tcti-spi-ftdi
+		--disable-tcti-i2c-ftdi
+		--disable-defaultflags
+		--disable-weakcrypto
+		--with-crypto="$(usex mbedtls mbed ossl)"
+		--with-runstatedir=/run
+		--with-udevrulesdir="$(get_udevdir)/rules.d"
+		--with-udevrulesprefix=60-
+		--without-sysusersdir
+		--with-tmpfilesdir="/usr/lib/tmpfiles.d"
+	)
+
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	default
+	keepdir /var/lib/tpm2-tss/system/keystore
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	use fapi && tmpfiles_process tpm2-tss-fapi.conf
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}
diff --git a/app-crypt/tpm2-tss/tpm2-tss-4.2.0.ebuild b/app-crypt/tpm2-tss/tpm2-tss-4.2.0.ebuild
new file mode 100644
index 000000000000..47c4f0de0fb8
--- /dev/null
+++ b/app-crypt/tpm2-tss/tpm2-tss-4.2.0.ebuild
@@ -0,0 +1,112 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic linux-info multilib-minimal tmpfiles udev
+
+DESCRIPTION="TCG Trusted Platform Module 2.0 Software Stack"
+HOMEPAGE="https://github.com/tpm2-software/tpm2-tss"
+SRC_URI="https://github.com/tpm2-software/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0/4"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="doc +fapi +openssl mbedtls +policy static-libs test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="
+	^^ ( mbedtls openssl )
+	fapi? ( openssl !mbedtls )
+	policy? ( openssl !mbedtls )
+"
+
+RDEPEND="
+	acct-group/tss
+	acct-user/tss
+	sys-apps/util-linux:=[${MULTILIB_USEDEP}]
+	fapi? (
+		dev-libs/json-c:=[${MULTILIB_USEDEP}]
+		>=net-misc/curl-7.80.0[${MULTILIB_USEDEP}]
+	)
+	mbedtls? ( net-libs/mbedtls:3=[${MULTILIB_USEDEP}] )
+	openssl? ( dev-libs/openssl:=[${MULTILIB_USEDEP}] )
+"
+
+DEPEND="
+	${RDEPEND}
+	test? ( app-crypt/swtpm
+		dev-libs/uthash
+		dev-util/cmocka
+		sys-apps/iproute2[-minimal]
+		fapi? ( >=net-misc/curl-7.80.0 ) )
+"
+
+BDEPEND="
+	sys-apps/acl
+	virtual/pkgconfig
+	doc? ( app-text/doxygen )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-4.0.2-Dont-install-files-into-run.patch"
+	"${FILESDIR}/${PN}-4.1.4-use-mbedtls-3.patch"
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~TCG_TPM"
+	linux-info_pkg_setup
+	kernel_is ge 4 12 0 || ewarn "At least kernel 4.12.0 is required"
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# Fails with inlining
+	filter-flags -fno-semantic-interposition
+	# tests fail with LTO enabbled. See bug 865275 and 865279
+	filter-lto
+
+	local myconf=(
+		--localstatedir=/var
+		$(multilib_native_use_enable doc doxygen-doc)
+		$(use_enable fapi)
+		$(use_enable policy)
+		$(use_enable static-libs static)
+		$(multilib_native_use_enable test unit)
+		$(multilib_native_use_enable test integration)
+		$(multilib_native_use_enable test self-generated-certificate)
+		--disable-tcti-libtpms
+		--disable-tcti-spi-ltt2go
+		--disable-tcti-spi-ftdi
+		--disable-tcti-i2c-ftdi
+		--disable-defaultflags
+		--disable-weakcrypto
+		--with-crypto="$(usex mbedtls mbed ossl)"
+		--with-runstatedir=/run
+		--with-udevrulesdir="$(get_udevdir)/rules.d"
+		--with-udevrulesprefix=60-
+		--without-sysusersdir
+		--with-tmpfilesdir="/usr/lib/tmpfiles.d"
+	)
+
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+	default
+	keepdir /var/lib/tpm2-tss/system/keystore
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	use fapi && tmpfiles_process tpm2-tss-fapi.conf
+	udev_reload
+}
+
+pkg_postrm() {
+	udev_reload
+}