Adding metadata

author: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
committer: root <root@alpha.trunkmasters.com> 2026-06-12 19:09:37 -0500
commit: b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree: 06f7a4102ea4e845df8b66660f252920d52952f9 /app-forensics
parent: 24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download: baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz
baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip
140 files changed, 5304 insertions, 0 deletions
diff --git a/app-forensics/afflib/Manifest b/app-forensics/afflib/Manifest
new file mode 100644
index 000000000000..f2f93676c644
--- /dev/null
+++ b/app-forensics/afflib/Manifest
@@ -0,0 +1,2 @@
+DIST afflib-3.7.20.tar.gz 560441 BLAKE2B 6934efc30566b4b72e55e5727c46657362237872acae9d161f2625439d3d6e12da702b3ed82e3442b7015d8cb707097152cc73a6d0cc31d1ad61467f4022f7d4 SHA512 1ac623cb8462fc929a8ad1c014e92d319a3ebf5226ef07aa0777e4cbb77a9ee20adf570f39c960c9186ac2a477e861dfd5565d3364fdff22f9870f8c9ab30479
+DIST afflib-3.7.22.tar.gz 588290 BLAKE2B d3c63125a5a3823c0bc6ba8040ad596a1669713017ac92e57333d0b847ff19617c11ee4cc9d1ba5d8170a6c0629c89a2dada963d317a4247c39c15c3648712c2 SHA512 d649ce8198d8e6f05b6ba503fd9b454fceb06bf182dec8bc135eb126ad4b100301d7c4fc9ef6dac0f3d98edd785133bc841332333634f4534b8f51041ba51f43
diff --git a/app-forensics/afflib/afflib-3.7.20-r1.ebuild b/app-forensics/afflib/afflib-3.7.20-r1.ebuild
new file mode 100644
index 000000000000..ac063d166fd2
--- /dev/null
+++ b/app-forensics/afflib/afflib-3.7.20-r1.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+inherit autotools python-single-r1
+
+MY_PN=AFFLIBv3
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="Library that implements the AFF image standard"
+HOMEPAGE="https://github.com/sshock/AFFLIBv3/"
+SRC_URI="https://github.com/sshock/${MY_PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 ~arm ~hppa ppc x86 ~x64-macos"
+IUSE="fuse ncurses python qemu readline s3 static-libs threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+# Tests don't play well with sandbox
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/expat
+	virtual/zlib:=
+	fuse? ( sys-fs/fuse:0 )
+	dev-libs/openssl:=
+	ncurses? ( sys-libs/ncurses:= )
+	python? (
+		${PYTHON_DEPS}
+		$(python_gen_cond_dep 'dev-python/cython[${PYTHON_USEDEP}]')
+	)
+	readline? ( sys-libs/readline:= )
+	s3? ( net-misc/curl )
+"
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-3.7.19-search-path.patch"
+	"${FILESDIR}/${PN}-3.7.20-c99.patch"
+	"${FILESDIR}/${PN}-3.7.20-missing-objects.patch"
+)
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e '/FLAGS/s: -g::' \
+		-e 's:-D_FORTIFY_SOURCE=2::' \
+		configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# Hacks for automagic dependencies
+	use ncurses || export ac_cv_lib_ncurses_initscr=no
+	use readline || export ac_cv_lib_readline_readline=no
+
+	local myeconfargs=(
+		$(use_enable fuse)
+		$(use_enable python)
+		$(use_enable qemu)
+		$(use_enable s3)
+		$(use_enable static-libs static)
+		$(use_enable threads threading)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/app-forensics/afflib/afflib-3.7.22.ebuild b/app-forensics/afflib/afflib-3.7.22.ebuild
new file mode 100644
index 000000000000..bdcb8026f80e
--- /dev/null
+++ b/app-forensics/afflib/afflib-3.7.22.ebuild
@@ -0,0 +1,81 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{13..14} )
+inherit autotools python-single-r1
+
+MY_PN=AFFLIBv3
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="Library that implements the AFF image standard"
+HOMEPAGE="https://github.com/sshock/AFFLIBv3/"
+SRC_URI="https://github.com/sshock/${MY_PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 ~arm ~hppa ppc x86 ~x64-macos"
+IUSE="fuse ncurses python qemu readline s3 static-libs threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+# Tests don't play well with sandbox
+RESTRICT="test"
+
+RDEPEND="
+	dev-libs/expat
+	virtual/zlib:=
+	fuse? ( sys-fs/fuse:3= )
+	dev-libs/openssl:=
+	ncurses? ( sys-libs/ncurses:= )
+	python? (
+		${PYTHON_DEPS}
+		$(python_gen_cond_dep 'dev-python/cython[${PYTHON_USEDEP}]')
+	)
+	readline? ( sys-libs/readline:= )
+	s3? ( net-misc/curl )
+"
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-3.7.19-search-path.patch"
+	"${FILESDIR}/${PN}-3.7.20-missing-objects.patch"
+)
+
+pkg_setup() {
+	use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e '/FLAGS/s: -g::' \
+		-e 's:-D_FORTIFY_SOURCE=2::' \
+		configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# Hacks for automagic dependencies
+	use ncurses || export ac_cv_lib_ncurses_initscr=no
+	use readline || export ac_cv_lib_readline_readline=no
+
+	local myeconfargs=(
+		$(use_enable fuse)
+		$(use_enable python)
+		$(use_enable qemu)
+		$(use_enable s3)
+		$(use_enable static-libs static)
+		$(use_enable threads threading)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name "*.la" -delete || die
+}
diff --git a/app-forensics/afflib/files/afflib-3.7.19-search-path.patch b/app-forensics/afflib/files/afflib-3.7.19-search-path.patch
new file mode 100644
index 000000000000..db646eb5065b
--- /dev/null
+++ b/app-forensics/afflib/files/afflib-3.7.19-search-path.patch
@@ -0,0 +1,29 @@
+diff --git a/configure.ac b/configure.ac
+index d902e4b..914ccf5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -30,24 +30,6 @@ AC_CONFIG_MACRO_DIR([m4])
+ m4_include([m4/acx_pthread.m4])
+ ACX_PTHREAD()
+ 
+-if test x"${cross_compiling}" = "xno" ; then
+-  # Bring additional directories where things might be found into our
+-  # search path. I don't know why autoconf doesn't do this by default
+-  for spfx in ${prefix} /sw /opt/local /usr/local ; do
+-    AC_MSG_NOTICE([checking ${spfx}/include])
+-    if test -d ${spfx}/include; then
+-        CPPFLAGS="$CPPFLAGS -I${spfx}/include"
+-        LDFLAGS="$LDFLAGS -L${spfx}/lib"
+-        AC_MSG_NOTICE([ *** ADDING ${spfx}/include to CPPFLAGS *** ])
+-        AC_MSG_NOTICE([ *** ADDING ${spfx}/lib to LDFLAGS *** ])
+-    fi
+-  done
+-  AC_MSG_NOTICE([ CPPFLAGS = ${CPPFLAGS} ])
+-  AC_MSG_NOTICE([ LDFLAGS = ${LDFLAGS} ])
+-else
+-  AC_MSG_NOTICE([Cross Compiling --- will not update CPPFALGS or LDFLAGS with /usr/local, /opt/local or /sw])
+-fi
+-
+ if test -r /bin/uname.exe ; then
+   if test `uname -o` == "Msys" ; then
+     AC_MSG_NOTICE([Compiling with Msys. Setting flags appropriately.])
diff --git a/app-forensics/afflib/files/afflib-3.7.20-c99.patch b/app-forensics/afflib/files/afflib-3.7.20-c99.patch
new file mode 100644
index 000000000000..faee6c48dd82
--- /dev/null
+++ b/app-forensics/afflib/files/afflib-3.7.20-c99.patch
@@ -0,0 +1,33 @@
+https://bugs.gentoo.org/921727
+https://github.com/sshock/AFFLIBv3/issues/53
+https://github.com/sshock/AFFLIBv3/commit/01210f488410a23838c54fcc22297cf08ac7de66
+
+From 01210f488410a23838c54fcc22297cf08ac7de66 Mon Sep 17 00:00:00 2001
+From: Phillip Hellewell <sshock@gmail.com>
+Date: Wed, 14 Feb 2024 00:43:56 -0700
+Subject: [PATCH] Fix #53: incompatible pointer types in pyaff.c
+
+--- a/pyaff/afflib.pxd
++++ b/pyaff/afflib.pxd
+@@ -2,7 +2,8 @@ from libc.stdint cimport int64_t, uint32_t, uint64_t
+ from posix.fcntl cimport O_RDONLY
+ 
+ cdef extern from "afflib/afflib.h":
+-    struct AFFILE
++    struct _AFFILE
++    ctypedef _AFFILE AFFILE
+ 
+     enum: AF_MAX_NAME_LEN
+ 
+--- a/pyaff/pyaff.c
++++ b/pyaff/pyaff.c
+@@ -1478,7 +1478,7 @@ struct __pyx_obj_5pyaff_affile;
+  */
+ struct __pyx_obj_5pyaff_affile {
+   PyObject_HEAD
+-  struct AFFILE *af;
++  AFFILE *af;
+   int64_t size;
+ };
+ 
+
diff --git a/app-forensics/afflib/files/afflib-3.7.20-missing-objects.patch b/app-forensics/afflib/files/afflib-3.7.20-missing-objects.patch
new file mode 100644
index 000000000000..27ef44026820
--- /dev/null
+++ b/app-forensics/afflib/files/afflib-3.7.20-missing-objects.patch
@@ -0,0 +1,18 @@
+https://bugs.gentoo.org/964738
+https://github.com/sshock/AFFLIBv3/issues/60
+
+--- a/lib/Makefile.am
++++ b/lib/Makefile.am
+@@ -100,10 +100,12 @@ LZMA_SOURCES =  \
+ 	@top_srcdir@/lzma443/C/7zip/Compress/LZ/LZInWindow.cpp \
+ 	@top_srcdir@/lzma443/C/7zip/Compress/LZ/LZOutWindow.cpp \
+ 	@top_srcdir@/lzma443/C/7zip/Compress/RangeCoder/RangeCoderBit.cpp \
++	@top_srcdir@/lzma443/C/7zip/Common/FileStreams.cpp \
+ 	@top_srcdir@/lzma443/C/7zip/Common/InBuffer.cpp \
+ 	@top_srcdir@/lzma443/C/7zip/Common/OutBuffer.cpp \
+ 	@top_srcdir@/lzma443/C/7zip/Common/StreamUtils.cpp \
+ 	@top_srcdir@/lzma443/C/Common/Alloc.cpp \
++ 	@top_srcdir@/lzma443/C/Common/C_FileIO.cpp \
+ 	@top_srcdir@/lzma443/C/Common/CommandLineParser.cpp \
+ 	@top_srcdir@/lzma443/C/Common/CRC.cpp \
+ 	@top_srcdir@/lzma443/C/Common/String.cpp \
diff --git a/app-forensics/afflib/metadata.xml b/app-forensics/afflib/metadata.xml
new file mode 100644
index 000000000000..1c4efc1f79df
--- /dev/null
+++ b/app-forensics/afflib/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="fuse">Enable extra fuse thingies</flag>
+    <flag name="qemu">Enable qemu stuff</flag>
+    <flag name="s3">Enable support for Amazon S3</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/afl/Manifest b/app-forensics/afl/Manifest
new file mode 100644
index 000000000000..f67a27b26981
--- /dev/null
+++ b/app-forensics/afl/Manifest
@@ -0,0 +1 @@
+DIST afl-2.57b.tar.gz 839871 BLAKE2B 69029d59451e468528386154e8938a1a7303765e039f98aa05e36f07314398f60ff2578f765142e1f1ff653e5ab93ea53a2efb98abe275046ebacdd3ca8363b6 SHA512 5d12b96229e966aeb11deb47cd8eb36cde2fa32656eb187db02c7240909d6acda36be59b2baf7e42cddd228d25ec94c8bffc3fa27f7f4b5e1e462b62929ce75d
diff --git a/app-forensics/afl/afl-2.57b-r2.ebuild b/app-forensics/afl/afl-2.57b-r2.ebuild
new file mode 100644
index 000000000000..1d63aae81046
--- /dev/null
+++ b/app-forensics/afl/afl-2.57b-r2.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs
+
+# See https://github.com/google/AFL/pull/117
+PATCHES=(
+	"${FILESDIR}/${P}-install-readmemd.diff"
+	"${FILESDIR}/${P}-implicit-int-clang16.patch"
+)
+
+DESCRIPTION="american fuzzy lop - compile-time instrumentation fuzzer"
+HOMEPAGE="https://lcamtuf.coredump.cx/afl/"
+SRC_URI="https://github.com/google/AFL/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="sys-devel/gcc:*
+	!app-forensics/aflplusplus"
+RDEPEND="${DEPEND}"
+QA_PREBUILT="/usr/share/afl/testcases/others/elf/small_exec.elf"
+
+S="${WORKDIR}/AFL-${PV}"
+
+src_compile() {
+	emake CC="$(tc-getCC)" \
+		PREFIX="${EPREFIX}/usr" \
+		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}"
+#	Not compatible with latest clang, see
+#	https://github.com/google/AFL/issues/151
+#
+#	CC="clang" CXX="clang++" strip-unsupported-flags
+#	cd llvm_mode || die
+#	emake \
+#		PREFIX="${EPREFIX}/usr" \
+#		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+#		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}"
+}
+
+src_install() {
+	emake DESTDIR="${D}" \
+		PREFIX="${EPREFIX}/usr" \
+		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}" \
+		install
+}
diff --git a/app-forensics/afl/files/afl-2.57b-implicit-int-clang16.patch b/app-forensics/afl/files/afl-2.57b-implicit-int-clang16.patch
new file mode 100644
index 000000000000..dc432c5c08c4
--- /dev/null
+++ b/app-forensics/afl/files/afl-2.57b-implicit-int-clang16.patch
@@ -0,0 +1,14 @@
+Bug: https://bugs.gentoo.org/894514
+diff --git a/Makefile b/Makefile
+index 3819312..536c20b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -50,7 +50,7 @@ ifndef AFL_NO_X86
+ 
+ test_x86:
+ 	@echo "[*] Checking for the ability to compile x86 code..."
+-	@echo 'main() { __asm__("xorb %al, %al"); }' | $(CC) -w -x c - -o .test || ( echo; echo "Oops, looks like your compiler can't generate x86 code."; echo; echo "Don't panic! You can use the LLVM or QEMU mode, but see docs/INSTALL first."; echo "(To ignore this error, set AFL_NO_X86=1 and try again.)"; echo; exit 1 )
++	@echo 'int main() { __asm__("xorb %al, %al"); }' | $(CC) -w -x c - -o .test || ( echo; echo "Oops, looks like your compiler can't generate x86 code."; echo; echo "Don't panic! You can use the LLVM or QEMU mode, but see docs/INSTALL first."; echo "(To ignore this error, set AFL_NO_X86=1 and try again.)"; echo; exit 1 )
+ 	@rm -f .test
+ 	@echo "[+] Everything seems to be working, ready to compile."
+ 
diff --git a/app-forensics/afl/files/afl-2.57b-install-readmemd.diff b/app-forensics/afl/files/afl-2.57b-install-readmemd.diff
new file mode 100644
index 000000000000..50b777413c19
--- /dev/null
+++ b/app-forensics/afl/files/afl-2.57b-install-readmemd.diff
@@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+index 5e800db26..381931289 100644
+--- a/Makefile
++++ b/Makefile
+@@ -133,7 +133,7 @@ endif
+ 	set -e; for i in afl-g++ afl-clang afl-clang++; do ln -sf afl-gcc $${DESTDIR}$(BIN_PATH)/$$i; done
+ 	install -m 755 afl-as $${DESTDIR}$(HELPER_PATH)
+ 	ln -sf afl-as $${DESTDIR}$(HELPER_PATH)/as
+-	install -m 644 docs/README docs/ChangeLog docs/*.txt $${DESTDIR}$(DOC_PATH)
++	install -m 644 README.md docs/ChangeLog docs/*.txt $${DESTDIR}$(DOC_PATH)
+ 	cp -r testcases/ $${DESTDIR}$(MISC_PATH)
+ 	cp -r dictionaries/ $${DESTDIR}$(MISC_PATH)
diff --git a/app-forensics/afl/metadata.xml b/app-forensics/afl/metadata.xml
new file mode 100644
index 000000000000..c6eb48b47eb8
--- /dev/null
+++ b/app-forensics/afl/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>hanno@gentoo.org</email>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/aflplusplus/Manifest b/app-forensics/aflplusplus/Manifest
new file mode 100644
index 000000000000..ea3e15d575da
--- /dev/null
+++ b/app-forensics/aflplusplus/Manifest
@@ -0,0 +1,6 @@
+DIST aflplusplus-4.30c-patches.tar.xz 5008 BLAKE2B 60031d726e0d1834d0791bb88e437ac81bca1995dd424d64a0694b7e518e3ddbcf490413d830d2fe7649a1eb5c4cfa0e34e8115505a8c5df5e3fddce80b31efd SHA512 6d9d6bf03f5e899b58252eb299029f1b3630f129e78dd7ec2512ae48244822e0614d915c04ba699b2b56d4f839451b0e76e3f1148eb3027e6e7f53a79111add3
+DIST aflplusplus-4.30c.tar.gz 3031558 BLAKE2B 7f9c7d32afc5316cef460a72e7603aee36161559c2bb5c03edc408c16e8ba8bf96ced2c90e5578caa401ace37caf3ff7bba72ab58b7070c7c5b69004dc2d4da7 SHA512 072c9524978843eec6be5428793be43d10f3530a3f569fd4015d950cdd87696e887c3b567440afee8cb5e359b234d0c5e668cf9ab90622783fc82f68e3ec5f98
+DIST aflplusplus-4.32c-patches.tar.xz 4776 BLAKE2B 75cbe9dfa1d3fccd358cb2f9c3d339d7854d2a690f7e32d57e65a76d7b8a34c30acd6776e2be28280a981d2b9cae7dc4685a28a8cd8b47a5e224074acaf257d1 SHA512 0c863c4d67fc535fdb96f27a429cc11e960820c9825667156987eb468b45d893caf3df37a6c949c47cdc95b250fa92791c3d03ffc4faa61fd728c116c25ae9db
+DIST aflplusplus-4.32c.tar.gz 3045679 BLAKE2B 259edf3fe4405a8703a7452f99406fd390e97763d687445e0a6104f884ba304b3f6755fcdef36f7f8d9743db945ef60791402462cf4599c5a90593ecbb414daf SHA512 9688f476129b45e842918b2e185c5fc82eb94aecd7ac27bfeecc74f5525aaf3754dbb4c442fec3902a93aad079178e1523a544f0808a4b6d21a11dc9508be0a0
+DIST aflplusplus-4.35c-patches.tar.xz 4932 BLAKE2B 3e564d1d035b9b9b6d7fcdd0a11a5a6c4e3302457a7e5d1ae1e61966623a684d5c78b3a4735c1f6fd446760fe4c9231f2d2e862335c761eab2d42ae5986b0dc5 SHA512 287abeed965749609fe18a43e559a807c4de60b9d9e21443a3def68f1902e44302eb6147cdd30f941e412caf857d561eec5744adb46fa842f59909bb5f554c2b
+DIST aflplusplus-4.35c.tar.gz 3117948 BLAKE2B b8b068a5b7eca17eee8bc71f70df9220adb438ed82a169fbfb8da1d7948012b712d3d7ac24bddb48f779abb33467211a3d708eb3b4f0b13bc6e5a832c88a922f SHA512 07a503d22c42f55092367255907d7173d2aef9beb8bcfa9c2d7aca24f6de342305a0310b780c692bc4db807042fd38c479c7ba3ba13210715bd7c0143499785e
diff --git a/app-forensics/aflplusplus/aflplusplus-4.30c.ebuild b/app-forensics/aflplusplus/aflplusplus-4.30c.ebuild
new file mode 100644
index 000000000000..ea57aa6c86ed
--- /dev/null
+++ b/app-forensics/aflplusplus/aflplusplus-4.30c.ebuild
@@ -0,0 +1,97 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..19} )
+PYTHON_COMPAT=( python3_{13..14} )
+inherit flag-o-matic toolchain-funcs llvm-r1 optfeature python-single-r1
+
+AFL_PATCHSET="${PN}-4.30c-patches"
+DESCRIPTION="Fork of AFL, the popular compile-time instrumentation fuzzer"
+HOMEPAGE="https://github.com/AFLplusplus/AFLplusplus"
+SRC_URI="https://github.com/AFLplusplus/AFLplusplus/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${AFL_PATCHSET}.tar.xz"
+S="${WORKDIR}"/AFLplusplus-${PV}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+IUSE="test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Tests involve heavy use of LD_PRELOAD in some cases
+# This isn't compatible with sandbox
+RESTRICT="test"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	$(llvm_gen_dep '
+		llvm-core/clang:${LLVM_SLOT}=
+		llvm-core/llvm:${LLVM_SLOT}=
+	')
+	!app-forensics/afl
+"
+DEPEND="
+	${RDEPEND}
+	test? ( dev-util/cmocka )
+"
+
+QA_FLAGS_IGNORED="
+	usr/lib.*/afl/afl-gcc-cmplog-pass.so
+	usr/lib.*/afl/afl-gcc-cmptrs-pass.so
+"
+QA_PREBUILT="usr/share/afl/testcases/others/elf/small_exec.elf"
+
+PATCHES=(
+	"${WORKDIR}"/${AFL_PATCHSET}
+)
+
+pkg_setup() {
+	llvm-r1_pkg_setup
+	python-single-r1_pkg_setup
+}
+
+mymake() {
+	# afl-fuzz spews garbage to stdout if the environment contains any
+	# variables whose name beginning with USE_ (including the underscore),
+	# regardless of their value (even if empty!).  The ebuild environment
+	# contains several such variables and the garbage that gets printed
+	# ends up in the generated man page.
+	#
+	# We can work around the problem by unsetting all these variables when
+	# running make.
+	local badvars=("${!USE_@}")
+
+	env "${badvars[@]/#/-u}" emake \
+		CC="$(tc-getCC)" \
+		CXX="$(tc-getCXX)" \
+		CFLAGS_FLTO="" \
+		PREFIX="${EPREFIX}/usr" \
+		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}" \
+		MAN_PATH="${EPREFIX}/usr/share/man/man8" \
+		"$@"
+}
+
+src_compile() {
+	# bug #945258
+	append-cflags -std=gnu17
+
+	mymake
+}
+
+src_test() {
+	mymake test
+}
+
+src_install() {
+	mymake DESTDIR="${D}" install
+	dostrip -x /usr/share/afl/testcases/
+}
+
+pkg_postinst() {
+	# TODO: Any others?
+	optfeature "fuzzing with AFL_USE_ASAN" llvm-runtimes/compiler-rt-sanitizers[asan]
+	optfeature "fuzzing with AFL_USE_MSAN" llvm-runtimes/compiler-rt-sanitizers[msan]
+}
diff --git a/app-forensics/aflplusplus/aflplusplus-4.32c.ebuild b/app-forensics/aflplusplus/aflplusplus-4.32c.ebuild
new file mode 100644
index 000000000000..73c78f77bd1d
--- /dev/null
+++ b/app-forensics/aflplusplus/aflplusplus-4.32c.ebuild
@@ -0,0 +1,101 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..20} )
+PYTHON_COMPAT=( python3_{13..14} )
+inherit flag-o-matic toolchain-funcs llvm-r1 optfeature python-single-r1
+
+AFL_PATCHSET="${PN}-4.32c-patches"
+DESCRIPTION="Fork of AFL, the popular compile-time instrumentation fuzzer"
+HOMEPAGE="https://github.com/AFLplusplus/AFLplusplus"
+SRC_URI="https://github.com/AFLplusplus/AFLplusplus/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${AFL_PATCHSET}.tar.xz"
+S="${WORKDIR}"/AFLplusplus-${PV}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 arm64"
+IUSE="test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+# Tests involve heavy use of LD_PRELOAD in some cases
+# This isn't compatible with sandbox
+RESTRICT="test"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	$(llvm_gen_dep '
+		llvm-core/clang:${LLVM_SLOT}=
+		llvm-core/llvm:${LLVM_SLOT}=
+	')
+	!app-forensics/afl
+"
+DEPEND="
+	${RDEPEND}
+	test? ( dev-util/cmocka )
+"
+
+QA_FLAGS_IGNORED="
+	usr/lib.*/afl/afl-gcc-cmplog-pass.so
+	usr/lib.*/afl/afl-gcc-cmptrs-pass.so
+"
+QA_PREBUILT="usr/share/afl/testcases/others/elf/small_exec.elf"
+
+PATCHES=(
+	"${WORKDIR}"/${AFL_PATCHSET}
+	"${FILESDIR}"/${PN}-4.32c-gcc16.patch
+)
+
+pkg_setup() {
+	llvm-r1_pkg_setup
+	python-single-r1_pkg_setup
+}
+
+mymake() {
+	# afl-fuzz spews garbage to stdout if the environment contains any
+	# variables whose name beginning with USE_ (including the underscore),
+	# regardless of their value (even if empty!).  The ebuild environment
+	# contains several such variables and the garbage that gets printed
+	# ends up in the generated man page.
+	#
+	# We can work around the problem by unsetting all these variables when
+	# running make.
+	local badvars=("${!USE_@}")
+
+	env "${badvars[@]/#/-u}" emake \
+		CC="$(tc-getCC)" \
+		CXX="$(tc-getCXX)" \
+		CFLAGS_FLTO="" \
+		PREFIX="${EPREFIX}/usr" \
+		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}" \
+		MAN_PATH="${EPREFIX}/usr/share/man/man8" \
+		"$@"
+}
+
+src_compile() {
+	# bug #945258
+	append-cflags -std=gnu17
+
+	strip-unsupported-flags
+	CC=clang CXX=clang++ strip-unsupported-flags
+
+	mymake
+}
+
+src_test() {
+	mymake test
+}
+
+src_install() {
+	mymake DESTDIR="${D}" install
+	dostrip -x /usr/share/afl/testcases/
+}
+
+pkg_postinst() {
+	# TODO: Any others?
+	optfeature "fuzzing with AFL_USE_ASAN" llvm-runtimes/compiler-rt-sanitizers[asan]
+	optfeature "fuzzing with AFL_USE_MSAN" llvm-runtimes/compiler-rt-sanitizers[msan]
+}
diff --git a/app-forensics/aflplusplus/aflplusplus-4.35c.ebuild b/app-forensics/aflplusplus/aflplusplus-4.35c.ebuild
new file mode 100644
index 000000000000..a91e0c0c8188
--- /dev/null
+++ b/app-forensics/aflplusplus/aflplusplus-4.35c.ebuild
@@ -0,0 +1,99 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+LLVM_COMPAT=( {15..22} )
+PYTHON_COMPAT=( python3_{13..14} )
+inherit flag-o-matic toolchain-funcs llvm-r2 optfeature python-single-r1
+
+AFL_PATCHSET="${PN}-4.35c-patches"
+DESCRIPTION="Fork of AFL, the popular compile-time instrumentation fuzzer"
+HOMEPAGE="https://github.com/AFLplusplus/AFLplusplus"
+SRC_URI="https://github.com/AFLplusplus/AFLplusplus/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${AFL_PATCHSET}.tar.xz"
+S="${WORKDIR}"/AFLplusplus-${PV}
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~ppc64"
+IUSE="test"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+# Tests involve heavy use of LD_PRELOAD in some cases
+# This isn't compatible with sandbox
+RESTRICT="test"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	$(llvm_gen_dep '
+		llvm-core/clang:${LLVM_SLOT}=
+		llvm-core/llvm:${LLVM_SLOT}=
+	')
+	!app-forensics/afl
+"
+DEPEND="
+	${RDEPEND}
+	test? ( dev-util/cmocka )
+"
+
+QA_FLAGS_IGNORED="
+	usr/lib.*/afl/afl-gcc-cmplog-pass.so
+	usr/lib.*/afl/afl-gcc-cmptrs-pass.so
+"
+QA_PREBUILT="usr/share/afl/testcases/others/elf/small_exec.elf"
+
+PATCHES=(
+	"${WORKDIR}"/${AFL_PATCHSET}
+)
+
+pkg_setup() {
+	llvm-r2_pkg_setup
+	python-single-r1_pkg_setup
+}
+
+mymake() {
+	# afl-fuzz spews garbage to stdout if the environment contains any
+	# variables whose name beginning with USE_ (including the underscore),
+	# regardless of their value (even if empty!).  The ebuild environment
+	# contains several such variables and the garbage that gets printed
+	# ends up in the generated man page.
+	#
+	# We can work around the problem by unsetting all these variables when
+	# running make.
+	local badvars=("${!USE_@}")
+
+	env "${badvars[@]/#/-u}" emake -Onone \
+		CC="$(tc-getCC)" \
+		CXX="$(tc-getCXX)" \
+		CFLAGS_FLTO="" \
+		PREFIX="${EPREFIX}/usr" \
+		HELPER_PATH="${EPREFIX}/usr/$(get_libdir)/afl" \
+		DOC_PATH="${EPREFIX}/usr/share/doc/${PF}" \
+		MAN_PATH="${EPREFIX}/usr/share/man/man8" \
+		"$@"
+}
+
+src_compile() {
+	# bug #945258
+	append-cflags -std=gnu17
+
+	strip-unsupported-flags
+	CC=clang CXX=clang++ strip-unsupported-flags
+
+	mymake
+}
+
+src_test() {
+	mymake test
+}
+
+src_install() {
+	mymake DESTDIR="${D}" install
+	dostrip -x /usr/share/afl/testcases/
+}
+
+pkg_postinst() {
+	# TODO: Any others?
+	optfeature "fuzzing with AFL_USE_ASAN" llvm-runtimes/compiler-rt-sanitizers[asan]
+	optfeature "fuzzing with AFL_USE_MSAN" llvm-runtimes/compiler-rt-sanitizers[msan]
+}
diff --git a/app-forensics/aflplusplus/files/aflplusplus-4.32c-gcc16.patch b/app-forensics/aflplusplus/files/aflplusplus-4.32c-gcc16.patch
new file mode 100644
index 000000000000..8806a35d55f9
--- /dev/null
+++ b/app-forensics/aflplusplus/files/aflplusplus-4.32c-gcc16.patch
@@ -0,0 +1,45 @@
+https://bugs.gentoo.org/957401
+https://github.com/AFLplusplus/AFLplusplus/pull/2465
+--- a/instrumentation/afl-gcc-cmplog-pass.so.cc
++++ b/instrumentation/afl-gcc-cmplog-pass.so.cc
+@@ -44,8 +44,7 @@ static const struct pass_data afl_cmplog_pass_data = {
+     .properties_provided = 0,
+     .properties_destroyed = 0,
+     .todo_flags_start = 0,
+-    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_verify_il |
+-                          TODO_rebuild_cgraph_edges),
++    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_rebuild_cgraph_edges),
+ 
+ };
+ 
+--- a/instrumentation/afl-gcc-cmptrs-pass.so.cc
++++ b/instrumentation/afl-gcc-cmptrs-pass.so.cc
+@@ -44,8 +44,7 @@ static const struct pass_data afl_cmptrs_pass_data = {
+     .properties_provided = 0,
+     .properties_destroyed = 0,
+     .todo_flags_start = 0,
+-    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_verify_il |
+-                          TODO_rebuild_cgraph_edges),
++    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_rebuild_cgraph_edges),
+ 
+ };
+ 
+--- a/instrumentation/afl-gcc-pass.so.cc
++++ b/instrumentation/afl-gcc-pass.so.cc
+@@ -65,7 +65,6 @@
+    The new pass is to be a GIMPLE_PASS.  Given the sort of
+    instrumentation it's supposed to do, its todo_flags_finish will
+    certainly need TODO_update_ssa, and TODO_cleanup_cfg.
+-   TODO_verify_il is probably desirable, at least during debugging.
+    TODO_rebuild_cgraph_edges is required only in the out-of-line
+    instrumentation mode.
+ 
+@@ -148,7 +147,7 @@ static constexpr struct pass_data afl_pass_data = {
+     .properties_provided = 0,
+     .properties_destroyed = 0,
+     .todo_flags_start = 0,
+-    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg | TODO_verify_il),
++    .todo_flags_finish = (TODO_update_ssa | TODO_cleanup_cfg),
+ 
+ };
+ 
diff --git a/app-forensics/aflplusplus/metadata.xml b/app-forensics/aflplusplus/metadata.xml
new file mode 100644
index 000000000000..d9201802d6c5
--- /dev/null
+++ b/app-forensics/aflplusplus/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>sam@gentoo.org</email>
+    <name>Sam James</name>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/aide/Manifest b/app-forensics/aide/Manifest
new file mode 100644
index 000000000000..58481ccdd29b
--- /dev/null
+++ b/app-forensics/aide/Manifest
@@ -0,0 +1 @@
+DIST aide-0.18.8.tar.gz 383589 BLAKE2B a3b7efca89d0be99614e423a983fb0a3413f1cbdbc370b54f755e6dae8bb7f5612921ba998fd6db9248ae739fdaf3d344e092933b7dad7fd94dc1844e68a605e SHA512 38763f527cfbc11847eca2fca17eceabc46158624954f0457feb49b885f34e4311f2dbc50b5471f4ff972e9e4e9c9f55c2da8dd8d55c04063a9043ab4829ff05
diff --git a/app-forensics/aide/aide-0.18.8.ebuild b/app-forensics/aide/aide-0.18.8.ebuild
new file mode 100644
index 000000000000..5d5de463dfda
--- /dev/null
+++ b/app-forensics/aide/aide-0.18.8.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit readme.gentoo-r1
+
+DESCRIPTION="AIDE (Advanced Intrusion Detection Environment) is a file integrity checker"
+HOMEPAGE="https://aide.github.io/ https://github.com/aide/aide"
+SRC_URI="https://github.com/aide/aide/releases/download/v${PV}/${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 ~arm64 x86"
+IUSE="acl audit curl e2fs mhash selinux xattr"
+
+DEPEND="
+	dev-libs/libpcre2
+	virtual/zlib:=
+	acl? ( virtual/acl )
+	audit? ( sys-process/audit )
+	curl? ( net-misc/curl )
+	e2fs? ( sys-fs/e2fsprogs )
+	!mhash? (
+		dev-libs/libgcrypt:=
+		dev-libs/libgpg-error
+	)
+	mhash? ( app-crypt/mhash )
+	selinux? ( sys-libs/libselinux )
+	xattr? ( sys-apps/attr )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-aide )
+"
+BDEPEND="
+	sys-devel/bison
+	sys-devel/flex
+	virtual/pkgconfig
+"
+
+DISABLE_AUTOFORMATTING=1
+DOC_CONTENTS="
+Example configuration file was installed at '${EPREFIX}/etc/aide/aide.conf'.
+Please edit it to meet your needs. Refer to aide.conf(5) manual page
+for more information.
+
+A helper script, aideinit, was installed and can be used to make AIDE
+management easier. Please run 'aideinit --help' for more information."
+
+src_prepare() {
+	default
+
+	# Only needed for snapshots.
+	if [[ ${PV} == *_p* ]] ; then
+		echo "m4_define([AIDE_VERSION], [${PV}])" > version.m4 || die
+	fi
+}
+
+src_configure() {
+	# Needs Bison, flex
+	unset YACC
+	export LEX=flex
+
+	local myeconfargs=(
+		--sysconfdir="${EPREFIX}"/etc/${PN}
+
+		# Needed even in EAPI=8, >=portage-3.0.40 skips it here (bug #887177)
+		--disable-static
+
+		# Disable broken l10n support: https://sourceforge.net/p/aide/bugs/98/
+		# This doesn't affect anything because there are no localizations yet.
+		--without-locale
+
+		--with-zlib
+		$(use_with curl)
+		$(use_with acl posix-acl)
+		$(use_with selinux)
+		$(use_with xattr)
+		$(use_with e2fs e2fsattrs)
+		$(use_with mhash mhash)
+		$(use_with !mhash gcrypt)
+		$(use_with audit)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	readme.gentoo_create_doc
+
+	insinto /etc/${PN}
+	insopts -m0600
+	newins "${FILESDIR}"/aide.conf-r2 aide.conf
+
+	dosbin "${FILESDIR}"/aideinit
+	dodoc -r contrib/ "${FILESDIR}"/aide.cron-r2
+
+	keepdir /var/{lib,log}/${PN}
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/app-forensics/aide/files/aide.conf-r2 b/app-forensics/aide/files/aide.conf-r2
new file mode 100644
index 000000000000..4bce675f7da3
--- /dev/null
+++ b/app-forensics/aide/files/aide.conf-r2
@@ -0,0 +1,136 @@
+# Example configuration file for AIDE
+# See more: man 5 aide.conf
+
+database_in=file:/var/lib/aide/aide.db
+database_out=file:/var/lib/aide/aide.db.new
+
+# Change this to "no" or remove it to not gzip output
+# (only useful on systems with few CPU cycles to spare)
+gzip_dbout=yes
+
+# Default: warning
+#log_level=info
+
+# Default: changed_attributes
+#report_level=added_removed_attributes
+
+report_url=file:/var/log/aide/aide.log
+report_url=stdout
+#report_url=stderr
+
+# Here are all the things we can check - these are the default rules
+#
+# p:   permissions
+# ftype: file type
+# i:   inode
+# l:   link name
+# n:   number of links
+# u:   user
+# g:   group
+# s:   size
+# b:   block count
+# m:   mtime (modification time)
+# a:   atime (access time)
+# c:   ctime (change time)
+# S:   check for growing size
+# I:   ignore changed filename
+# ANF: allow new files
+# ARF: allow removed files
+# md5: md5 checksum
+# sha1: sha1 checksum
+# sha256: sha256 checksum
+# sha512: sha512 checksum
+# rmd160: rmd160 checksum
+# tiger: tiger checksum
+# crc32:    crc32 checksum
+# R:   p+ftype+i+l+n+u+g+s+m+c+md5+X
+# L:   p+ftype+i+l+n+u+g+X
+# E:   Empty group
+# X:   acl+selinux+xattrs+e2fsattrs (if groups are explicitly enabled)
+# >:   Growing file p+ftype+l+u+g+i+n+S+X
+
+# Defines formerly set here have been moved to /etc/default/aide.
+
+# Custom rules
+Binlib = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
+ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
+Logs = p+i+n+u+g+S
+Devices = p+i+n+u+g+s+b+c+md5+sha256+rmd160
+Databases = p+n+u+g
+StaticDir = p+i+n+u+g
+ManPages = p+i+n+u+g+s+b+m+c+md5+sha256+rmd160
+
+# Next decide what directories/files you want in the database
+
+# Kernel, system map, etc.
+=/boot$ Binlib
+# Configs
+/etc ConfFiles
+!/etc/mtab
+# Binaries
+/bin Binlib
+/sbin Binlib
+/usr/bin Binlib
+/usr/sbin Binlib
+/usr/libexec Binlib
+/usr/local/bin Binlib
+/usr/local/sbin Binlib
+#/usr/games Binlib
+# Libraries
+/lib(64)? Binlib
+/usr/lib(64)? Binlib
+/usr/local/lib(64)? Binlib
+# Log files
+=/var/log$ StaticDir
+#!/var/log/ksymoops
+/var/log/aide/aide.log(.[0-9])?(.gz)? Databases
+/var/log/aide/error.log(.[0-9])?(.gz)? Databases
+#/var/log/setuid.changes(.[0-9])?(.gz)? Databases
+!/var/log/aide
+/var/log Logs
+# Devices
+!/dev/pts
+# If you get spurious warnings about being unable to mmap() /dev/cpu/mtrr,
+# you may uncomment this to get rid of them. They're harmless but sometimes
+# annoying.
+#!/dev/cpu/mtrr
+#!/dev/xconsole
+/dev Devices
+# Other miscellaneous files
+/var/run$ StaticDir
+!/var/run
+# Test only the directory when dealing with /proc
+/proc$ StaticDir
+!/proc
+
+# You can look through these examples to get further ideas
+
+# MD5 sum files - especially useful with debsums -g
+#/var/lib/dpkg/info/([^\.]+).md5sums u+g+s+m+md5+sha1
+
+# Check crontabs
+#/var/spool/anacron/cron.daily Databases
+#/var/spool/anacron/cron.monthly Databases
+#/var/spool/anacron/cron.weekly Databases
+#/var/spool/cron Databases
+#/var/spool/cron/crontabs Databases
+
+# manpages can be trojaned, especially depending on *roff implementation
+#/usr/man ManPages
+#/usr/share/man ManPages
+#/usr/local/man ManPages
+
+# docs
+#/usr/doc ManPages
+#/usr/share/doc ManPages
+
+# check users' home directories
+#/home Binlib
+
+# check sources for modifications
+#/usr/src L
+#/usr/local/src L
+
+# Check headers for same
+#/usr/include L
+#/usr/local/include L
diff --git a/app-forensics/aide/files/aide.cron-r2 b/app-forensics/aide/files/aide.cron-r2
new file mode 100644
index 000000000000..b8a78ba2a856
--- /dev/null
+++ b/app-forensics/aide/files/aide.cron-r2
@@ -0,0 +1,188 @@
+#!/bin/bash
+# Modified: Benjamin Smee
+# Date: Fri Sep 10 11:35:41 BST 2004
+
+# This is the email address reports get mailed to
+MAILTO=root@localhost
+
+# Set this to suppress mailings when there's nothing to report
+QUIETREPORTS=1
+
+# This parameter defines which aide command to run from the cron script.
+# Sensible values are "update" and "check".
+# Default is "check", ensuring backwards compatibility.
+# Since "update" does not take any longer, it is recommended to use "update",
+# so that a new database is created every day. The new database needs to be
+# manually copied over the current one, though.
+COMMAND=update
+
+# This parameter defines how many lines to return per e-mail. Output longer
+# than this value will be truncated in the e-mail sent out.
+LINES=1000
+
+# This parameter gives a grep regular expression. If given, all output lines
+# that _don't_ match the regexp are listed first in the script's output. This
+# allows to easily remove noise from the aide report.
+NOISE="(/var/cache/|/var/lib/|/var/tmp)"
+PATH="/bin:/usr/bin:/sbin:/usr/sbin"
+LOGDIR="/var/log/aide"
+LOGFILE="aide.log"
+CONFFILE="/etc/aide/aide.conf"
+ERRORLOG="aide_error.log"
+MAILLOG="aide_mail.log"
+ERRORTMP=$(mktemp "${ERRORLOG}.XXXXXX")
+
+[ -f /usr/bin/aide ] || exit 0
+
+DATABASE=$(grep "^database=file:/" $CONFFILE | head -n 1 | cut --delimiter=: --fields=2)
+FQDN=$(hostname -f)
+DATE=$(date +"at %Y-%m-%d %H:%M")
+
+# default values
+
+DATABASE="${DATABASE:-/var/lib/aide/aide.db}"
+
+AIDEARGS=""
+
+if [ ! -f "$DATABASE" ]; then
+	/usr/sbin/sendmail $MAILTO <<EOF
+Subject: Daily AIDE report for $FQDN
+From: root@${FQDN}
+To: ${MAILTO}
+Fatal error: The AIDE database does not exist!
+This may mean you haven't created it, or it may mean that someone has removed it.
+EOF
+	exit 0
+fi
+
+aide $AIDEARGS --$COMMAND >"$LOGDIR/$LOGFILE" 2>"$ERRORTMP"
+RETVAL=$?
+
+if [ -n "$QUIETREPORTS" ] && ! [ -s "$LOGDIR/$LOGFILE" ] && ! [ -s "$ERRORTMP" ] ; then
+	# Bail now because there was no output and QUIETREPORTS is set
+	exit 0
+fi
+
+MAILTMP=$(mktemp "${MAILLOG}.XXXXXX")
+
+(cat << EOF
+This is an automated report generated by the Advanced Intrusion Detection
+Environment on $FQDN ${DATE}.
+
+EOF
+
+# include error log in daily report e-mail
+
+if [ "$RETVAL" != "0" ]; then
+	cat > "$LOGDIR/$ERRORLOG" << EOF
+
+*****************************************************************************
+*                    aide returned a non-zero exit value                    *
+*****************************************************************************
+
+EOF
+	echo "exit value is: $RETVAL" >> "$LOGDIR/$ERRORLOG"
+else
+	touch "$LOGDIR/$ERRORLOG"
+fi
+< "$ERRORTMP" cat >> "$LOGDIR/$ERRORLOG"
+rm -f "$ERRORTMP"
+
+if [ -s "$LOGDIR/$ERRORLOG" ]; then
+	errorlines=$(wc -l "$LOGDIR/$ERRORLOG" | awk '{ print $1 }')
+	if [ "${errorlines:=0}" -gt $LINES ]; then
+		cat << EOF
+
+****************************************************************************
+*                      aide has returned many errors.                      *
+*           the error log output has been truncated in this mail           *
+****************************************************************************
+
+EOF
+		echo "Error output is $errorlines lines, truncated to $LINES."
+		head -$LINES "$LOGDIR/$ERRORLOG"
+		echo "The full output can be found in $LOGDIR/$ERRORLOG."
+	else
+		echo "Errors produced  ($errorlines lines):"
+		cat "$LOGDIR/$ERRORLOG"
+	fi
+else
+	echo "AIDE produced no errors."
+fi
+
+# include de-noised log
+
+if [ -n "$NOISE" ]; then
+	NOISETMP=$(mktemp "aidenoise.XXXXXX")
+	NOISETMP2=$(mktemp "aidenoise.XXXXXX")
+	sed -n '1,/^Detailed information about changes:/p' "$LOGDIR/$LOGFILE" | \
+	grep '^\(changed\|removed\|added\):' | \
+	grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" > "$NOISETMP2"
+
+	if [ -n "$NOISE" ]; then
+		< "$NOISETMP2" grep -v "^\(changed\|removed\|added\):$NOISE" > "$NOISETMP"
+		rm -f "$NOISETMP2"
+		echo "De-Noised output removes everything matching $NOISE."
+	else
+		mv "$NOISETMP2" "$NOISETMP"
+		echo "No noise expression was given."
+	fi
+
+	if [ -s "$NOISETMP" ]; then
+		loglines=$(< "$NOISETMP" wc -l | awk '{ print $1 }')
+		if [ "${loglines:=0}" -gt $LINES ]; then
+			cat << EOF
+
+****************************************************************************
+*   aide has returned long output which has been truncated in this mail    *
+****************************************************************************
+
+EOF
+			echo "De-Noised output is $loglines lines, truncated to $LINES."
+			< "$NOISETMP" head -$LINES
+			echo "The full output can be found in $LOGDIR/$LOGFILE."
+		else
+			echo "De-Noised output of the daily AIDE run ($loglines lines):"
+			cat "$NOISETMP"
+		fi
+	else
+		echo "AIDE detected no changes after removing noise."
+	fi
+	rm -f "$NOISETMP"
+	echo "============================================================================"
+fi
+
+# include non-de-noised log
+
+if [ -s "$LOGDIR/$LOGFILE" ]; then
+	loglines=$(wc -l "$LOGDIR/$LOGFILE" | awk '{ print $1 }')
+	if [ "${loglines:=0}" -gt $LINES ]; then
+		cat << EOF
+
+****************************************************************************
+*   aide has returned long output which has been truncated in this mail    *
+****************************************************************************
+
+EOF
+		echo "Output is $loglines lines, truncated to $LINES."
+		head -$LINES "$LOGDIR/$LOGFILE"
+		echo "The full output can be found in $LOGDIR/$LOGFILE."
+	else
+		echo "Output of the daily AIDE run ($loglines lines):"
+		cat "$LOGDIR/$LOGFILE"
+	fi
+else
+	echo "AIDE detected no changes."
+fi
+) > "${MAILTMP}"
+
+(
+cat <<EOF
+Subject: Daily AIDE report for $FQDN
+From: root@${FQDN}
+To: ${MAILTO}
+EOF
+cat "${MAILTMP}"
+) | /usr/sbin/sendmail $MAILTO
+
+rm -f "$MAILTMP"
diff --git a/app-forensics/aide/files/aideinit b/app-forensics/aide/files/aideinit
new file mode 100644
index 000000000000..6a3c60c37837
--- /dev/null
+++ b/app-forensics/aide/files/aideinit
@@ -0,0 +1,145 @@
+#!/bin/sh
+# Copyright 2003 Mike Markley <mike@markley.org>
+# This script is free for any purpose whatseoever so long as the above
+# copyright notice remains in place.
+#
+# Modified for Gentoo: Benjamin Smee
+# Date: Fri Sep 10 11:36:04 BST 2004
+
+# This is the email address reports get mailed to
+MAILTO=root@localhost
+
+# Defaults
+#MAILTO="${MAILTO:-root}"
+
+# Options
+opt_f=0
+opt_y=0
+opt_c=0
+opt_b=0
+config="/etc/aide/aide.conf"
+
+aideinit_usage() {
+	echo "Usage: $0 [options] -- [aide options]"
+	echo "  -y|--yes         Overwrite output file"
+	echo "  -f|--force       Force overwrite of database"
+	echo "  -c|--config      Specify alternate config file"
+	echo "  -o|--output      Specify alternate output file"
+	echo "  -d|--database    Specify alternate database file"
+	echo "  -b|--background  Run in the background"
+}
+
+while [ -n "$1" ]; do
+	case "$1" in
+	    -h|--help)
+		aideinit_usage
+		exit 0
+		;;
+	    -f|--force)
+		opt_f=1
+		shift
+		;;
+	    -y|--yes)
+		opt_y=1
+		shift
+		;;
+	    -b|--background)
+		opt_b=1
+		shift
+		;;
+	    -o|--output)
+		shift
+		[ -z "$1" ] && aideinit_usage && exit 1
+		outfile=$1
+		shift
+		;;
+	    -d|--database)
+		shift
+		[ -z "$1" ] && aideinit_usage && exit 1
+		dbfile=$1
+		shift
+		;;
+	    -c|--config)
+		opt_c=1
+		shift
+		[ -z "$1" ] && aideinit_usage && exit 1
+		config=$1
+		shift
+		;;
+	    --)
+	    	shift
+		break 2
+		;;
+	    *)
+		echo "Unknown option $1 (use -- to delimit aideinit and aide options)"
+		exit
+		;;
+	esac
+done
+
+if [ ! -f "$config" ]; then
+	echo "$0: $config: file not found"
+	exit 1
+fi
+
+if [ -z "$outfile" ]; then
+	outfile=`egrep "database_out=file:" $config | cut -d: -f2`
+	[ -z "$outfile" ] && outfile="/var/lib/aide/aide.db.new"
+fi
+if [ -z "$dbfile" ]; then
+	dbfile=`egrep "database=file:" $config | cut -d: -f2`
+	[ -z "$dbfile" ] && dbfile="/var/lib/aide/aide.db"
+fi
+
+if [ -f $outfile ]; then
+	if [ $opt_y -eq 0 ]; then
+		echo -n "Overwrite existing $outfile [Yn]? "
+		read yn
+		case "$yn" in
+		    [Nn]*)
+			exit 0
+			;;
+		esac
+	fi
+fi
+
+extraflags=""
+
+if [ $opt_c -eq 1 ]; then
+	extraflags="$extraflags --config $config"
+fi
+
+if [ $opt_b -eq 1 ]; then
+	(aide --init $extraflags $@ >/var/log/aide/aideinit.log 2>/var/log/aide/aideinit.errors
+	if [ -f "$dbfile" -a $opt_f -eq 0 ]; then
+		echo "$dbfile exists and -f was not specified" >> /var/log/aide/aideinit.errors
+	fi
+	lines=`wc -l /var/log/aide/aideinit.errors | awk '{ print $1 }'`
+	if [ "$lines" -gt 0 ]; then
+		(echo "AIDE init errors:"; cat /var/log/aide/aideinit.errors) | /bin/mail -s "AIDE initialization problem" $MAILTO
+	else
+		cp -f $outfile $dbfile
+	fi) &
+	exit 0
+fi
+
+echo "Running aide --init..."
+aide --init $extraflags $@
+
+return=$?
+if [ $return -ne 0 ]; then
+	echo "Something didn't quite go right; see $outfile for details" >&2
+	exit $return
+fi
+
+if [ -f "$dbfile" -a $opt_f -eq 0 ]; then
+	echo -n "Overwrite $dbfile [yN]? "
+	read yn
+	case "$yn" in
+	    [yY]*)
+		cp -f $outfile $dbfile
+		;;
+	esac
+else
+	cp -f $outfile $dbfile
+fi
diff --git a/app-forensics/aide/metadata.xml b/app-forensics/aide/metadata.xml
new file mode 100644
index 000000000000..e4f5eea126b0
--- /dev/null
+++ b/app-forensics/aide/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="e2fs">Enable support for checking file attributes on ext2/ext3/ext4 filesystems</flag>
+    <flag name="curl">Use curl for http,https and ftp backends</flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:freebsd:advanced_intrusion_detection_environment</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/chkrootkit/Manifest b/app-forensics/chkrootkit/Manifest
new file mode 100644
index 000000000000..be732886f1c7
--- /dev/null
+++ b/app-forensics/chkrootkit/Manifest
@@ -0,0 +1,4 @@
+DIST chkrootkit-0.58b-gentoo.patch.bz2 5067 BLAKE2B f1690d72f40269429e437c4ea407e0edbb080b760457a85cfd0c32843f69dc7ecdada795545c390887658a34504243cb8a814f082da85fd78eb3c3e9a99f485f SHA512 266b981304fe129117cb11c304a44f39e2c76c9acc634e6aa5a6654ac7ea76480950652b80378e43cab57a3993d3a0c11b413c9b9e9699924f9b44f6f50a9ec1
+DIST chkrootkit-0.58b.tar.gz 42957 BLAKE2B 92a17d9bb01e2c713791404568a1a625138d2ccd898f2624b1e076dd7d29d6a9154013f6408ffdcf1a5e2cea7236d3c218849ee732dd89f53e1f121cd560d342 SHA512 50829446aa5a320ef3aa678c7bbc03ba2ebc14dca3b4c1f312fb46d3d8206345628d2e94b99cfea33e0d3971afbc025dbd387fb32c4e1135a7466c20eb3afab2
+DIST chkrootkit-0.59-gentoo.patch.bz2 5132 BLAKE2B 7107435ae5f9fc075d2730b63ca51353d2b44fa6e745854204fe723ac7a956e95f51c2714ccb3d642fdd9b53abe0488c071ac4d31f97ce9a03c744fda31527f9 SHA512 f6cebbbf5a429d2ebd9da9dd50120bc63c0403692c6dbe2bb14bcbd8992d66e72b012e0e1922f6233eea720850eb476b879a2cd90e716a9a3370ee61206d0693
+DIST chkrootkit-0.59.tar.gz 45088 BLAKE2B ca43a36f8c5f4c063268fad7ca5f1cd3db732b648dd0d0e8e2a94fa3d6a837be05cad186b07eec185eec2b0446e288c71df933d5ddd5c125a9853cbb762cb440 SHA512 b67b726e60e58d1486bae171f6de0ba6422f71822aa62cb14bc9fcc30edbb6e00d84673a58a9cb8cf21da18d41355d0ee14135b848eafb69045315f519ac33e4
diff --git a/app-forensics/chkrootkit/chkrootkit-0.58b.ebuild b/app-forensics/chkrootkit/chkrootkit-0.58b.ebuild
new file mode 100644
index 000000000000..029e83152960
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.58b.ebuild
@@ -0,0 +1,74 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs
+
+GENTOO_PATCH="${P}-gentoo.patch"
+
+DESCRIPTION="Tool to locally check for signs of a rootkit"
+HOMEPAGE="https://www.chkrootkit.org/"
+SRC_URI="ftp://ftp.chkrootkit.org/pub/seg/pac/${P}.tar.gz
+	https://md11.it.cx/download/${PN}/${GENTOO_PATCH}.bz2"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~hppa ~mips ppc ppc64 ~s390 ~sparc x86"
+IUSE="+cron selinux"
+
+RDEPEND="
+	cron? ( virtual/cron )
+	selinux? ( sec-policy/selinux-chkrootkit )
+"
+
+PATCHES=(
+	"${WORKDIR}/${P}-gentoo.patch"
+	"${FILESDIR}/${PN}-0.55-fcntl_h.patch"
+	"${FILESDIR}/${PN}-0.55-limits_h.patch"
+	"${FILESDIR}/${PN}-0.58b-fix_c23.patch"
+)
+
+src_prepare() {
+	default
+
+	sed -e 's:/var/adm/:/var/log/:g' \
+		-i chklastlog.c || die
+}
+
+src_compile() {
+	emake CC="$(tc-getCC)" STRIP=/bin/true sense
+}
+
+src_install() {
+	dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc strings-static
+	dodoc ACKNOWLEDGMENTS README*
+
+	if use cron ; then
+		exeinto /etc/cron.weekly
+		newexe "${FILESDIR}"/${PN}.cron ${PN}
+	fi
+
+	systemd_dounit "${FILESDIR}/${PN}.timer" "${FILESDIR}/${PN}.service"
+}
+
+pkg_postinst() {
+	if use cron ; then
+		elog
+		elog "Edit ${EROOT}/etc/cron.weekly/chkrootkit to activate chkrootkit!"
+		elog
+	fi
+
+	if systemd_is_booted || has_version sys-apps/systemd ; then
+		elog
+		elog "To enable the systemd timer, run the following command:"
+		elog "   systemctl enable --now chkrootkit.timer"
+		elog
+	fi
+
+	elog
+	elog "Some applications, such as portsentry, will cause chkrootkit"
+	elog "to produce false positives.  Read the chkrootkit FAQ at"
+	elog "http://www.chkrootkit.org/ for more information."
+	elog
+}
diff --git a/app-forensics/chkrootkit/chkrootkit-0.59.ebuild b/app-forensics/chkrootkit/chkrootkit-0.59.ebuild
new file mode 100644
index 000000000000..6c72e6a0829a
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.59.ebuild
@@ -0,0 +1,73 @@
+# Copyright 2022-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs
+
+GENTOO_PATCH="${P}-gentoo.patch"
+
+DESCRIPTION="Tool to locally check for signs of a rootkit"
+HOMEPAGE="https://www.chkrootkit.org/"
+SRC_URI="ftp://ftp.chkrootkit.org/pub/seg/pac/${P}.tar.gz
+	https://md11.it.cx/download/${PN}/${GENTOO_PATCH}.bz2"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="+cron selinux"
+
+RDEPEND="
+	cron? ( virtual/cron )
+	selinux? ( sec-policy/selinux-chkrootkit )
+"
+
+PATCHES=(
+	"${WORKDIR}/${P}-gentoo.patch"
+	"${FILESDIR}/${PN}-0.55-fcntl_h.patch"
+	"${FILESDIR}/${PN}-0.55-limits_h.patch"
+)
+
+src_prepare() {
+	default
+
+	sed -e 's:/var/adm/:/var/log/:g' \
+		-i chklastlog.c || die
+}
+
+src_compile() {
+	emake CC="$(tc-getCC)" STRIP=/bin/true sense
+}
+
+src_install() {
+	dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc strings-static
+	dodoc ACKNOWLEDGMENTS README*
+
+	if use cron ; then
+		exeinto /etc/cron.weekly
+		newexe "${FILESDIR}"/${PN}.cron ${PN}
+	fi
+
+	systemd_dounit "${FILESDIR}/${PN}.timer" "${FILESDIR}/${PN}.service"
+}
+
+pkg_postinst() {
+	if use cron ; then
+		elog
+		elog "Edit ${EROOT}/etc/cron.weekly/chkrootkit to activate chkrootkit!"
+		elog
+	fi
+
+	if systemd_is_booted || has_version sys-apps/systemd ; then
+		elog
+		elog "To enable the systemd timer, run the following command:"
+		elog "   systemctl enable --now chkrootkit.timer"
+		elog
+	fi
+
+	elog
+	elog "Some applications, such as portsentry, will cause chkrootkit"
+	elog "to produce false positives.  Read the chkrootkit FAQ at"
+	elog "http://www.chkrootkit.org/ for more information."
+	elog
+}
diff --git a/app-forensics/chkrootkit/files/chkrootkit-0.55-fcntl_h.patch b/app-forensics/chkrootkit/files/chkrootkit-0.55-fcntl_h.patch
new file mode 100644
index 000000000000..26ab42c0e437
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit-0.55-fcntl_h.patch
@@ -0,0 +1,30 @@
+--- a/chklastlog.c
++++ b/chklastlog.c
+@@ -41,6 +41,7 @@ int main () { return 0; }
+ #include <stdlib.h>
+ #endif
+ #include <sys/stat.h>
++#include <fcntl.h>
+ #include <unistd.h>
+ #include <string.h>
+ #include <signal.h>
+--- a/chkproc.c
++++ b/chkproc.c
+@@ -62,6 +62,7 @@ int main (){ return 0; }
+ #include <string.h>
+ #include <errno.h>
+ #include <sys/types.h>
++#include <fcntl.h>
+ #include <dirent.h>
+ #include <ctype.h>
+ #include <stdlib.h>
+--- a/chkwtmp.c
++++ b/chkwtmp.c
+@@ -25,6 +25,7 @@ int main () { return 0; }
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <unistd.h>
++#include <fcntl.h>
+ #include <string.h>
+ #include <utmp.h>
+ #include <time.h>
diff --git a/app-forensics/chkrootkit/files/chkrootkit-0.55-limits_h.patch b/app-forensics/chkrootkit/files/chkrootkit-0.55-limits_h.patch
new file mode 100644
index 000000000000..8046e9488992
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit-0.55-limits_h.patch
@@ -0,0 +1,10 @@
+--- a/chkdirs.c
++++ b/chkdirs.c
+@@ -33,6 +33,7 @@
+ #include <sys/syslimits.h>
+ #endif
+ 
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <sys/types.h>
diff --git a/app-forensics/chkrootkit/files/chkrootkit-0.58b-fix_c23.patch b/app-forensics/chkrootkit/files/chkrootkit-0.58b-fix_c23.patch
new file mode 100644
index 000000000000..9b3cac5bb4ed
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit-0.58b-fix_c23.patch
@@ -0,0 +1,35 @@
+fix c23, see https://bugs.gentoo.org/943851
+https://src.fedoraproject.org/rpms/chkrootkit/raw/rawhide/f/chkrootkit-0.57-sighandler-type.patch + remove old style definition
+--- a/chklastlog.c
++++ b/chklastlog.c
+@@ -77,7 +77,7 @@
+ long total_wtmp_bytes_read=0;
+ size_t wtmp_file_size;
+ uid_t *uid;
+-void read_status();
++void read_status(int signum);
+ 
+ struct s_localpwd {
+      int numentries;
+@@ -213,7 +213,7 @@
+ }
+ #endif
+ 
+-void read_status() {
++void read_status(int signum) {
+    double remaining_time;
+    static long last_total_bytes_read=0;
+    int diff;
+--- a/chkwtmp.c
++++ b/chkwtmp.c
+@@ -43,9 +43,7 @@ int main () { return 0; }
+ #endif
+ #endif
+ 
+-void printit(counter, start, end)
+-int counter;
+-long start,end;
++void printit(int counter, long start, long end)
+ {
+ 	char		buffer[30];
+ 
diff --git a/app-forensics/chkrootkit/files/chkrootkit.cron b/app-forensics/chkrootkit/files/chkrootkit.cron
new file mode 100644
index 000000000000..9f7eb17b13b1
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit.cron
@@ -0,0 +1,6 @@
+#!/bin/sh
+#
+# uncomment this to make it work
+#
+
+#exec /usr/sbin/chkrootkit -q
diff --git a/app-forensics/chkrootkit/files/chkrootkit.service b/app-forensics/chkrootkit/files/chkrootkit.service
new file mode 100644
index 000000000000..a4de628cae4a
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit.service
@@ -0,0 +1,7 @@
+[Unit]
+Description=local check for signs of a rootkit
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/chkrootkit -q
+SyslogIdentifier=chkrootkit
diff --git a/app-forensics/chkrootkit/files/chkrootkit.timer b/app-forensics/chkrootkit/files/chkrootkit.timer
new file mode 100644
index 000000000000..0a6c0e5f5c4a
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Periodic check for signs of a rootkit
+
+[Timer]
+# Run on Sunday at 3:20am, to avoid running afoul of DST changes
+OnCalendar=Sun *-*-* 03:20:00
+RandomizedDelaySec=120
+Persistent=true
+
+[Install]
+WantedBy=timers.target
diff --git a/app-forensics/chkrootkit/metadata.xml b/app-forensics/chkrootkit/metadata.xml
new file mode 100644
index 000000000000..51ec23820801
--- /dev/null
+++ b/app-forensics/chkrootkit/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>martin.dummer@gmx.net</email>
+    <name>Martin Dummer</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <use>
+    <flag name="cron">Install cron script for weekly rootkit scans</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/cmospwd/Manifest b/app-forensics/cmospwd/Manifest
new file mode 100644
index 000000000000..ac2101c39ca6
--- /dev/null
+++ b/app-forensics/cmospwd/Manifest
@@ -0,0 +1 @@
+DIST cmospwd-5.1.tar.bz2 36792 BLAKE2B 763bf04af7591843190570d7084e16c2a4490319bc4a3aba9b4a32e440c66ee981f8d90749dca9df69f963294a29500da4641b51e74c7bb6f0f0e4f23a165d63 SHA512 eb76bbab2e686b54421556c5228b90a35c2883d59b31815ab04494df8e2d03e7193abdd83c4a7fa5915abdff1f189eb69bd29fc02ea9d84565ea8767e2c455a8
diff --git a/app-forensics/cmospwd/cmospwd-5.1-r1.ebuild b/app-forensics/cmospwd/cmospwd-5.1-r1.ebuild
new file mode 100644
index 000000000000..c982da0f0866
--- /dev/null
+++ b/app-forensics/cmospwd/cmospwd-5.1-r1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs
+
+DESCRIPTION="CmosPwd decrypts password stored in cmos used to access BIOS SETUP"
+HOMEPAGE="https://www.cgsecurity.org/wiki/CmosPwd"
+SRC_URI="https://www.cgsecurity.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+
+src_compile() {
+	cd src || die
+	$(tc-getCC) ${CFLAGS} ${LDFLAGS} cmospwd.c -o cmospwd || die
+}
+
+src_install() {
+	dosbin src/cmospwd
+	dodoc cmospwd.txt
+}
diff --git a/app-forensics/cmospwd/metadata.xml b/app-forensics/cmospwd/metadata.xml
new file mode 100644
index 000000000000..ba43f3179f0e
--- /dev/null
+++ b/app-forensics/cmospwd/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+		CmosPwd decrypts password stored in cmos used to access BIOS SETUP.
+
+		Works with the following BIOSes
+		- ACER/IBM BIOS
+		- AMI BIOS
+		- AMI WinBIOS 2.5
+		- Award 4.5x/4.6x/6.0
+		- Compaq (1992)
+		- Compaq (New version)
+		- IBM (PS/2, Activa, Thinkpad)
+		- Packard Bell
+		- Phoenix 1.00.09.AC0 (1994), a486 1.03, 1.04, 1.10 A03, 4.05 rev 1.02.943, 4.06 rev 1.13.1107
+		- Phoenix 4 release 6 (User)
+		- Gateway Solo - Phoenix 4.0 release 6
+		- Toshiba
+		- Zenith AMI
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/dfxml/Manifest b/app-forensics/dfxml/Manifest
new file mode 100644
index 000000000000..bc3893f8c855
--- /dev/null
+++ b/app-forensics/dfxml/Manifest
@@ -0,0 +1 @@
+DIST dfxml-20170921.tar.gz 163616 BLAKE2B 17214d15596a136efb2afc7246ee0f5696620b5aac7c2d78e37764f51487ff816de5a7c0f59e7484d358a8cd8eab34841716970cd859f0ce868ac29c8532754c SHA512 0885947aaf8efe639c13324413ef0cca49750027b48b434f226fb9fbfba494e84e245da879dc0d77b46bddc27798f7f5df12590fce47b096683034bbc61280e1
diff --git a/app-forensics/dfxml/dfxml-20170921-r2.ebuild b/app-forensics/dfxml/dfxml-20170921-r2.ebuild
new file mode 100644
index 000000000000..2cd2be159d72
--- /dev/null
+++ b/app-forensics/dfxml/dfxml-20170921-r2.ebuild
@@ -0,0 +1,28 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="Digital Forensics XML"
+HOMEPAGE="https://github.com/simsong/dfxml"
+SRC_URI="https://api.github.com/repos/simsong/${PN}/tarball/7d11eaa7da8d31f588ce8aecb4b4f5e7e8169ba6 -> ${P}.tar.gz"
+S="${WORKDIR}/${P}/src"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="dev-libs/expat:="
+RDEPEND="${DEPEND}"
+
+src_unpack() {
+	default
+	mv simsong-dfxml-* ${P} || die
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
diff --git a/app-forensics/dfxml/metadata.xml b/app-forensics/dfxml/metadata.xml
new file mode 100644
index 000000000000..011d298371ee
--- /dev/null
+++ b/app-forensics/dfxml/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>netmon@gentoo.org</email>
+  </maintainer>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/examiner/Manifest b/app-forensics/examiner/Manifest
new file mode 100644
index 000000000000..87d13e95f8b2
--- /dev/null
+++ b/app-forensics/examiner/Manifest
@@ -0,0 +1 @@
+DIST examiner-0.5.tar.gz 34286 BLAKE2B e3dff787385896379bef21101797ae8f95ef060d2533ef5582d77fa4624984048986785debc894423dd8a2b81d3130870df0cf69f581fe3a8b30b2dccb2a78df SHA512 d10866f654e19e1c69e28488e39828026af65201fadb56cbed01a7fbab51069fe93476c6108927d042322ac8d15bb249f911acc412aad94985b4030c6c7e6d6b
diff --git a/app-forensics/examiner/examiner-0.5-r3.ebuild b/app-forensics/examiner/examiner-0.5-r3.ebuild
new file mode 100644
index 000000000000..1e4125c652e4
--- /dev/null
+++ b/app-forensics/examiner/examiner-0.5-r3.ebuild
@@ -0,0 +1,36 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="Utilizes the objdump command to disassemble and comment foreign binaries"
+HOMEPAGE="http://www.academicunderground.org/examiner/"
+SRC_URI="http://www.academicunderground.org/examiner/${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+
+RDEPEND="dev-lang/perl"
+
+src_prepare() {
+	default
+	# Do not install docs through Makefile wrt bug #241256
+	sed -i -e '/$(DOC)/d' Makefile || die 'sed failed'
+	eapply "${FILESDIR}"/${P}-perl.patch
+}
+
+src_compile() {	:; }
+
+src_install() {
+	dodir /usr/bin /usr/share/${PN} /usr/share/man/man1
+
+	emake \
+		MAN="${D}/usr/share/man/man1" \
+		BIN="${D}/usr/bin" \
+		SHARE="${D}/usr/share/examiner" \
+		install
+
+	dodoc docs/{README*,BUGS,CHANGELOG,TODO,TUTORIAL}
+	dodoc -r utils
+}
diff --git a/app-forensics/examiner/files/examiner-0.5-perl.patch b/app-forensics/examiner/files/examiner-0.5-perl.patch
new file mode 100644
index 000000000000..e9e838692539
--- /dev/null
+++ b/app-forensics/examiner/files/examiner-0.5-perl.patch
@@ -0,0 +1,38 @@
+--- a/os/linux/examiner_hashes.pl.orig	2005-05-22 10:39:56.000000000 +1000
++++ b/os/linux/examiner_hashes.pl	2005-05-22 10:40:11.000000000 +1000
+@@ -1,6 +1,6 @@
+ $loaded_library=1;
+ 
+-syscalls = (
++$syscalls = (
+ 	1 => "exit",
+ 	2 => "fork",
+ 	3 => "read",
+@@ -240,7 +240,7 @@
+ 	237 => "fremovexattr",
+ );
+ 
+-socketcall = (
++$socketcall = (
+ 	1 => "SOCKET",
+ 	2 => "BIND",
+ 	3 => "CONNECT",
+--- a/os/bsd/examiner_hashes.pl.orig	2005-05-22 10:45:39.000000000 +1000
++++ b/os/bsd/examiner_hashes.pl	2005-05-22 10:45:58.000000000 +1000
+@@ -1,6 +1,6 @@
+ $loaded_library=1;
+ 
+-syscalls = (
++$syscalls = (
+ 	1 => "exit",
+ 	2 => "fork",
+ 	3 => "read",
+@@ -186,7 +186,7 @@
+ 	281 => "MAXSYSCALL",
+ );
+ 
+-socketcall = (
++$socketcall = (
+         1 => "SOCKET",
+         2 => "BIND",
+         3 => "CONNECT",
diff --git a/app-forensics/examiner/metadata.xml b/app-forensics/examiner/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/examiner/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/foremost/Manifest b/app-forensics/foremost/Manifest
new file mode 100644
index 000000000000..96062d4cef62
--- /dev/null
+++ b/app-forensics/foremost/Manifest
@@ -0,0 +1 @@
+DIST foremost-1.5.7.tar.gz 52352 BLAKE2B 5642c1afd86aab0a2f90986c3b030d37b37700c5d0e4b04e4f4a2004d69745280fabd4086a72c33b9eab05b57d125d6b11105c9e11b0112e30077f101eeab7ac SHA512 8827c29d52496783be26374f3943eb26a154d842f34e50fb489f87b3a5045bf85f1e44d7d8d8b12b2355ba3fe4b06a0db979cc22c0f431593c5976001eb931ab
diff --git a/app-forensics/foremost/files/foremost-1.4-config-location.patch b/app-forensics/foremost/files/foremost-1.4-config-location.patch
new file mode 100644
index 000000000000..95372e1af9c0
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.4-config-location.patch
@@ -0,0 +1,12 @@
+diff -uNr foremost-1.4.orig/config.c foremost-1.4/config.c
+--- foremost-1.4.orig/config.c	2006-08-31 17:50:47.000000000 +0100
++++ foremost-1.4/config.c	2006-08-31 17:51:09.000000000 +0100
+@@ -288,7 +288,7 @@
+ #ifdef __WIN32
+ 		set_config_file(s, "/Program Files/foremost/foremost.conf");
+ #else
+-		set_config_file(s, "/usr/local/etc/foremost.conf");
++		set_config_file(s, "/etc/foremost.conf");
+ #endif
+ 		if ((f = fopen(get_config_file(s), "r")) == NULL)
+ 			{
diff --git a/app-forensics/foremost/files/foremost-1.5.7-fno-common.patch b/app-forensics/foremost/files/foremost-1.5.7-fno-common.patch
new file mode 100644
index 000000000000..8506f59cf95a
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.5.7-fno-common.patch
@@ -0,0 +1,99 @@
+diff -up foremost-1.5.7/api.c.me foremost-1.5.7/api.c
+--- foremost-1.5.7/api.c.me	2020-02-06 14:15:48.218200745 +0100
++++ foremost-1.5.7/api.c	2020-02-06 14:16:42.624853860 +0100
+@@ -20,6 +20,7 @@ int				currFATblk;
+ int				highblk = 0;
+ int				block_list[OUR_BLK_SIZE / sizeof(int)];
+ extern int		errno;
++struct DIRECTORY *dirlist, *dl;
+ 
+ /*Inititialize those globals used by extract_ole*/
+ void init_ole()
+diff -up foremost-1.5.7/extract.c.me foremost-1.5.7/extract.c
+--- foremost-1.5.7/extract.c.me	2020-02-06 14:10:30.446386101 +0100
++++ foremost-1.5.7/extract.c	2020-02-06 14:15:14.736798823 +0100
+@@ -25,6 +25,7 @@ extern char *extract_name;
+ extern int	extract;
+ extern int	FATblk;
+ extern int	highblk;
++extern struct DIRECTORY *dirlist, *dl;
+ 
+ /********************************************************************************
+  *Function: extract_zip
+diff -up foremost-1.5.7/main.h.me foremost-1.5.7/main.h
+--- foremost-1.5.7/main.h.me	2020-02-06 13:48:46.923922983 +0100
++++ foremost-1.5.7/main.h	2020-02-06 13:50:08.001849830 +0100
+@@ -292,7 +292,7 @@ char *__progname;
+ /* -----------------------------------------------------------------
+    State Variable and Global Variables
+    ----------------------------------------------------------------- */
+-char wildcard;
++extern char wildcard;
+ typedef struct f_state 
+ {
+   off_t mode;
+@@ -344,7 +344,7 @@ typedef struct s_spec
+     int written; /*used for -a mode*/
+ }s_spec;
+ 
+-s_spec search_spec[50];  /*ARRAY OF BUILTIN SEARCH TYPES*/
++extern s_spec search_spec[50];  /*ARRAY OF BUILTIN SEARCH TYPES*/
+ 
+ typedef struct f_info {
+   char *file_name;
+@@ -367,7 +367,7 @@ typedef struct f_info {
+ } f_info;
+ 
+ /* Set if the user hits ctrl-c */
+-int signal_caught;
++extern int signal_caught;
+ 
+ /* -----------------------------------------------------------------
+    Function definitions
+@@ -433,7 +433,7 @@ off_t find_file_size(FILE *f);
+ char *human_readable(off_t size, char *buffer);
+ char *units(unsigned int c);
+ unsigned int chop(char *buf);
+-void print_search_specs(f_state *s);
++extern void print_search_specs(f_state *s);
+ int memwildcardcmp(const void *s1, const void *s2,size_t n,int caseSensitive);
+ int charactersMatch(char a, char b, int caseSensitive);
+ void printx(unsigned char* buf,int start, int end);
+diff -up foremost-1.5.7/ole.h.me foremost-1.5.7/ole.h
+--- foremost-1.5.7/ole.h.me	2020-02-06 14:08:16.524783353 +0100
++++ foremost-1.5.7/ole.h	2020-02-06 14:10:02.954056080 +0100
+@@ -84,8 +84,8 @@ struct DIRECTORY
+ 	int		s2;
+ 	int		d1;
+ 	int		d2;
+-}
+-*dirlist, *dl;
++};
++
+ 
+ int				get_dir_block(unsigned char *fd, int blknum, int buffersize);
+ int				get_dir_info(unsigned char *src);
+diff -up foremost-1.5.7/state.c.me foremost-1.5.7/state.c
+--- foremost-1.5.7/state.c.me	2020-02-06 14:06:44.514684887 +0100
++++ foremost-1.5.7/state.c	2020-02-06 14:08:03.329625827 +0100
+@@ -2,6 +2,9 @@
+ 
+ #include "main.h"
+ 
++s_spec search_spec[50];
++char wildcard;
++
+ int initialize_state (f_state * s, int argc, char **argv)
+ 	{
+ 	char	**argv_copy = argv;
+diff -up foremost-1.5.7/main.c.me foremost-1.5.7/main.c
+--- foremost-1.5.7/main.c.me	2020-02-06 14:20:09.918342282 +0100
++++ foremost-1.5.7/main.c	2020-02-06 14:20:42.531733786 +0100
+@@ -15,6 +15,7 @@
+  *
+  */
+ #include "main.h"
++int signal_caught;
+ 
+ #ifdef __WIN32
+ 
diff --git a/app-forensics/foremost/files/foremost-1.5.7-format-security.patch b/app-forensics/foremost/files/foremost-1.5.7-format-security.patch
new file mode 100644
index 000000000000..32d1a4d3c7f6
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.5.7-format-security.patch
@@ -0,0 +1,22 @@
+diff --git a/extract.c b/extract.c
+index 30bdf54..9639117 100755
+--- a/extract.c
++++ b/extract.c
+@@ -2110,7 +2110,6 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 	int				i = 0;
+ 	time_t			compile_time = 0;
+ 	struct tm		*ret_time;
+-	char			comment[32];
+ 	char			ascii_time[32];
+ 
+ 	if (buflen < 100)
+@@ -2145,8 +2144,7 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 			ret_time->tm_sec);
+ 	chop(ascii_time);
+ 
+-	sprintf(comment, ascii_time);
+-	strcat(needle->comment, comment);
++	strcat(needle->comment, ascii_time);
+ 	exe_char = htos(&foundat[22], FOREMOST_LITTLE_ENDIAN);
+ 	if (exe_char & 0x2000)
+ 		{
diff --git a/app-forensics/foremost/files/foremost-1.5.7-musl.patch b/app-forensics/foremost/files/foremost-1.5.7-musl.patch
new file mode 100644
index 000000000000..18bca055c584
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.5.7-musl.patch
@@ -0,0 +1,33 @@
+Index: foremost-1.5.7/main.c
+===================================================================
+--- foremost-1.5.7.orig/main.c
++++ foremost-1.5.7/main.c
+@@ -232,9 +232,7 @@ int main(int argc, char **argv)
+ 	char	**temp = argv;
+ 	DIR* 	dir;
+ 
+-#ifndef __GLIBC__
+-	__progname = basename(argv[0]);
+-#endif
++	char * __progname = basename(argv[0]);
+ 
+ 	/*Initialize the global state struct*/
+ 	if (initialize_state(s, argc, argv))
+Index: foremost-1.5.7/main.h
+===================================================================
+--- foremost-1.5.7.orig/main.h
++++ foremost-1.5.7/main.h
+@@ -187,12 +187,8 @@ int getopt(int argc, char *const argv[],
+ #endif   /* ifdef _WIN32 */
+ 
+ 
+-/* On non-glibc systems we have to manually set the __progname variable */
+-#ifdef __GLIBC__
++/* On non-GNU systems we have to manually set the __progname variable */
+ extern char *__progname;
+-#else
+-char *__progname;
+-#endif /* ifdef __GLIBC__ */
+ 
+ /* -----------------------------------------------------------------
+    Program Defaults
diff --git a/app-forensics/foremost/files/foremost-1.5.7-set-but-unused.patch b/app-forensics/foremost/files/foremost-1.5.7-set-but-unused.patch
new file mode 100644
index 000000000000..59b52c68615d
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.5.7-set-but-unused.patch
@@ -0,0 +1,230 @@
+diff --git a/api.c b/api.c
+index e3ee339..67463a6 100755
+--- a/api.c
++++ b/api.c
+@@ -478,7 +478,7 @@ int dump_dirent(int which_one)
+ {
+ 	int				i;
+ 	char			*p;
+-	short			unknown;
++	// short			unknown;
+ 	struct OLE_DIR	*dir;
+ 
+ 	dir = (struct OLE_DIR *) &buffer[which_one * sizeof(struct OLE_DIR)];
+@@ -493,7 +493,7 @@ int dump_dirent(int which_one)
+ 	p = dir->name;
+ 	if (*p < ' ')
+ 		{
+-		unknown = *((short *)p);
++		//unknown = *((short *)p);
+ 
+ 		//fprintf (stderr, "%04x\t", unknown);
+ 		p += 2; /* step over unknown short */
+diff --git a/engine.c b/engine.c
+index 85add5f..4a1ef13 100755
+--- a/engine.c
++++ b/engine.c
+@@ -316,7 +316,6 @@ int search_chunk(f_state *s, unsigned char *buf, f_info *i, u_int64_t chunk_size
+ 	//u_int64_t               buf_off = 0;
+ 
+ 	unsigned char	*foundat = buf;
+-	unsigned char	*current_pos = NULL;
+ 	unsigned char	*header_pos = NULL;
+ 	unsigned char	*newbuf = NULL;
+ 	unsigned char	*ind_ptr = NULL;
+@@ -461,7 +460,6 @@ int search_chunk(f_state *s, unsigned char *buf, f_info *i, u_int64_t chunk_size
+ 				}
+ 
+ 				c_offset = (foundat - buf);
+-				current_pos = foundat;
+ 
+ 				/*Now lets analyze the file and see if we can determine its size*/
+ 
+@@ -511,12 +509,12 @@ int search_chunk(f_state *s, unsigned char *buf, f_info *i, u_int64_t chunk_size
+ 						newbuf = read_from_disk(c_offset + f_offset, i, needle->max_len);
+ 						if (newbuf == NULL)
+ 							break;
+-						current_pos = extract_file(s,
+-												   c_offset,
+-												   newbuf,
+-												   needle->max_len,
+-												   needle,
+-												   f_offset);
++						extract_file(s,
++								   c_offset,
++								   newbuf,
++								   needle->max_len,
++								   needle,
++								   f_offset);
+ 						
+ 						/*Lets put the fp back*/
+ 						fseeko(i->handle, saveme, SEEK_SET);
+diff --git a/extract.c b/extract.c
+index 9639117..4fecde5 100755
+--- a/extract.c
++++ b/extract.c
+@@ -553,7 +553,6 @@ unsigned char *extract_htm(f_state *s, u_int64_t c_offset, unsigned char *founda
+ {
+ 	unsigned char	*buf = foundat;
+ 	unsigned char	*extractbuf = NULL;
+-	unsigned char	*currentpos = NULL;
+ 
+ 	int				bytes_to_search = 0;
+ 	int				i = 0;
+@@ -582,7 +581,6 @@ unsigned char *extract_htm(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 		}
+ 
+ 	/*Store the current position and search for the HTML> tag*/
+-	currentpos = foundat;
+ 	foundat = bm_search(needle->footer,
+ 						needle->footer_len,
+ 						foundat,
+@@ -1146,15 +1144,15 @@ unsigned char *extract_mov(f_state *s, u_int64_t c_offset, unsigned char *founda
+ unsigned char *extract_wmv(f_state *s, u_int64_t c_offset, unsigned char *foundat, u_int64_t buflen,
+ 						   s_spec *needle, u_int64_t f_offset)
+ {
+-
+-	unsigned char	*currentpos = NULL;
++#ifdef DEBUG
++	u_int64_t			fileObjHeaderSize = 0;
++#endif
+ 	unsigned char	*header = foundat;
+ 	unsigned char	*extractbuf = NULL;
+ 	unsigned char	*buf = foundat;
+ 	unsigned int		size = 0;
+ 	u_int64_t		file_size = 0;
+ 	u_int64_t			headerSize = 0;
+-	u_int64_t			fileObjHeaderSize = 0;
+ 	int				numberofHeaderObjects = 0;
+ 	int				reserved[2];
+ 	int				bytes_to_search = 0;
+@@ -1184,7 +1182,6 @@ unsigned char *extract_wmv(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 		return foundat;
+ 		}
+ 
+-	currentpos = foundat;
+ 	if (buflen - (foundat - buf) >= needle->max_len)
+ 		bytes_to_search = needle->max_len;
+ 	else
+@@ -1201,7 +1198,9 @@ unsigned char *extract_wmv(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 	if (foundat)
+ 		{
+ 		foundat += 16;	/*jump to the headersize*/
++#ifdef DEBUG
+ 		fileObjHeaderSize = htoll(foundat, FOREMOST_LITTLE_ENDIAN);
++#endif
+ 		//printx(foundat,0,8);
+ 		foundat += 24;	//Jump to the file size obj
+ 		size = htoi(foundat, FOREMOST_LITTLE_ENDIAN);
+@@ -1401,7 +1400,6 @@ unsigned char *extract_gif(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 						   s_spec *needle, u_int64_t f_offset)
+ {
+ 	unsigned char	*buf = foundat;
+-	unsigned char	*currentpos = foundat;
+ 	unsigned char	*extractbuf = NULL;
+ 	int				bytes_to_search = 0;
+ 	unsigned short	width = 0;
+@@ -1420,7 +1418,6 @@ unsigned char *extract_gif(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 		sprintf(comment, " (%d x %d)", width, height);
+ 		strcat(needle->comment, comment);
+ 
+-		currentpos = foundat;
+ 		if (buflen - (foundat - buf) >= needle->max_len)
+ 			bytes_to_search = needle->max_len;
+ 		else
+@@ -1821,7 +1818,6 @@ unsigned char *extract_jpeg(f_state *s, u_int64_t c_offset, unsigned char *found
+ 							s_spec *needle, u_int64_t f_offset)
+ {
+ 	unsigned char	*buf = foundat;
+-	unsigned char	*currentpos = NULL;
+ 
+ 	unsigned char	*extractbuf = NULL;
+ 	unsigned short	headersize;
+@@ -1899,8 +1895,6 @@ unsigned char *extract_jpeg(f_state *s, u_int64_t c_offset, unsigned char *found
+ 		return buf + needle->header_len;
+ 	}
+ 
+-	currentpos = foundat;
+-
+ 	//sprintf("Searching for footer\n");
+ 	if (buflen < (foundat - buf)) {
+ #ifdef DEBUG
+@@ -2094,19 +2088,21 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 	unsigned char	*extractbuf = NULL;
+ 	u_int64_t		file_size = 0;
+ 	unsigned short	pe_offset = 0;
+-	unsigned int	SizeOfCode = 0;
+-	unsigned int	SizeOfInitializedData = 0;
+-	unsigned int	SizeOfUninitializedData = 0;
+-	unsigned int	rva = 0;
+ 	unsigned int	offset = 0;
+ 	unsigned short	sections = 0;
+-	unsigned int	sizeofimage = 0;
+ 	unsigned int	raw_section_size = 0;
+-	unsigned int	size_of_headers = 0;
+ 	unsigned short	dll = 0;
+ 	unsigned int	sum = 0;
+ 	unsigned short	exe_char = 0;
++#ifdef DEBUG
++	unsigned int	SizeOfInitializedData = 0;
++	unsigned int	SizeOfUninitializedData = 0;
++	unsigned int	SizeOfCode = 0;
++	unsigned int	rva = 0;
++	unsigned int	sizeofimage = 0;
++	unsigned int	size_of_headers = 0;
+ 	unsigned int	align = 0;
++#endif
+ 	int				i = 0;
+ 	time_t			compile_time = 0;
+ 	struct tm		*ret_time;
+@@ -2167,14 +2163,16 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 
+ 	foundat += 0x18;	/*Jump to opt header should be 0x0b 0x01*/
+ 
++#ifdef DEBUG
+ 	SizeOfCode = htoi(&foundat[4], FOREMOST_LITTLE_ENDIAN);
+ 	SizeOfInitializedData = htoi(&foundat[8], FOREMOST_LITTLE_ENDIAN);
+ 	SizeOfUninitializedData = htoi(&foundat[12], FOREMOST_LITTLE_ENDIAN);
+ 	rva = htoi(&foundat[16], FOREMOST_LITTLE_ENDIAN);
+ 	align = htoi(&foundat[36], FOREMOST_LITTLE_ENDIAN);
+-
+ 	sizeofimage = htoi(&foundat[56], FOREMOST_LITTLE_ENDIAN);
+ 	size_of_headers = htoi(&foundat[60], FOREMOST_LITTLE_ENDIAN);
++#endif
++
+ 	foundat += 224;
+ 
+ 	/*Start of sections*/
+@@ -2193,13 +2191,13 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 		sum = offset + raw_section_size;
+ 		}
+ 
+-	/*
++#ifdef DEBUG
+     printf("rva is %d sum= %d\n",rva,sum);
+     printf("soi is %d,soh is %d \n",sizeofimage,size_of_headers);
+     printf("we are off by %d\n",sum-buflen);
+     printf("soc=%d ,soidr=%d, souid=%d\n",SizeOfCode,SizeOfInitializedData,SizeOfUninitializedData);
+     printf("fs=%d ,extr=%d\n",SizeOfCode+SizeOfInitializedData,SizeOfUninitializedData);
+-		*/
++#endif
+ 	file_size = sum;
+ 	if (file_size < 512 || file_size > 4 * MEGABYTE)
+ 		{
+@@ -2267,7 +2265,6 @@ unsigned char *extract_rar(f_state *s, u_int64_t c_offset, unsigned char *founda
+ {
+ 	unsigned char	*buf = foundat;
+ 	unsigned char	*extractbuf = NULL;
+-	u_int64_t		file_size = 0;
+ 	unsigned short	headersize = 0;
+ 	unsigned short	flags = 0;
+ 	unsigned int	filesize = 0;
+@@ -2424,8 +2421,6 @@ unsigned char *extract_rar(f_state *s, u_int64_t c_offset, unsigned char *founda
+ 
+ 		/*We found the EOF, write the file to disk and return*/
+ 		tot_file_size = (foundat - buf);
+-		if (tot_file_size > buflen)
+-			file_size = buflen;
+ 
+ 		extractbuf = buf;
+ 		write_to_disk(s, needle, tot_file_size, extractbuf, c_offset + f_offset);
diff --git a/app-forensics/foremost/foremost-1.5.7-r4.ebuild b/app-forensics/foremost/foremost-1.5.7-r4.ebuild
new file mode 100644
index 000000000000..8175620881ee
--- /dev/null
+++ b/app-forensics/foremost/foremost-1.5.7-r4.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs prefix
+
+DESCRIPTION="Console program to recover files based on their headers and footers"
+HOMEPAGE="https://foremost.sourceforge.net/"
+#SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.gz"
+# starting to hate sf.net ...
+SRC_URI="https://foremost.sourceforge.net/pkg/${P}.tar.gz"
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="amd64 ppc x86 ~arm64-macos ~x64-macos"
+
+src_prepare() {
+	PATCHES=(
+		"${FILESDIR}/${PN}-1.4-config-location.patch"
+		"${FILESDIR}/${PN}-1.5.7-format-security.patch" # bug 521038
+		"${FILESDIR}/${PN}-1.5.7-set-but-unused.patch" # bug 706886
+		"${FILESDIR}/${PN}-1.5.7-fno-common.patch" # bug 722196
+		"${FILESDIR}/${PN}-1.5.7-musl.patch" # bug 830473
+	)
+
+	default
+	hprefixify config.c
+}
+
+src_compile() {
+	# see also bug 906187
+
+	emake \
+		RAW_FLAGS="${CFLAGS} -Wall ${LDFLAGS} -D_LARGEFILE64_SOURCE" \
+		RAW_CC="$(tc-getCC) -DVERSION=\\\"${PV}\\\"" \
+		CONF=/etc
+}
+
+src_install() {
+	dobin foremost
+	gunzip foremost.8.gz || die
+	doman foremost.8
+	insinto /etc
+	doins foremost.conf
+	dodoc README CHANGES
+}
diff --git a/app-forensics/foremost/metadata.xml b/app-forensics/foremost/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/foremost/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/galleta/Manifest b/app-forensics/galleta/Manifest
new file mode 100644
index 000000000000..9bee80790614
--- /dev/null
+++ b/app-forensics/galleta/Manifest
@@ -0,0 +1 @@
+DIST galleta_20040505_1.tar.gz 2813 BLAKE2B bbdbd2e004986f51a48c254d3ebfb795e24bf9623dc9254060fb68ddc94e365decf083c38fb8f04818db5c0634fdfde5457d05b44b59c57d9da452c3261d4384 SHA512 7c420a413371cd9d7d818941026bc6981c8a749b8d3c97a9f0fc867116f9e642a06ad2832ded6de08780ed24885c2de7e8b655400569cb7ae56844161308dc3d
diff --git a/app-forensics/galleta/files/galleta-20040505_p1-Wimplicit-function-declaration.patch b/app-forensics/galleta/files/galleta-20040505_p1-Wimplicit-function-declaration.patch
new file mode 100644
index 000000000000..396739d358fc
--- /dev/null
+++ b/app-forensics/galleta/files/galleta-20040505_p1-Wimplicit-function-declaration.patch
@@ -0,0 +1,11 @@
+--- a/galleta.c
++++ b/galleta.c
+@@ -35,6 +35,8 @@
+ #include <stdio.h>
+ #include <time.h>
+ #include <math.h>
++#include <stdlib.h>
++#include <string.h>
+ 
+ #define STRSIZE		1000
+ 
diff --git a/app-forensics/galleta/files/galleta-20040505_p1-fix-build-system.patch b/app-forensics/galleta/files/galleta-20040505_p1-fix-build-system.patch
new file mode 100644
index 000000000000..125643c894df
--- /dev/null
+++ b/app-forensics/galleta/files/galleta-20040505_p1-fix-build-system.patch
@@ -0,0 +1,12 @@
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,6 @@
+-all: install
++LDLIBS += -lm 
+ 
+-install:  galleta.c
+-	gcc -o galleta galleta.c -lm -lc;cp galleta ../bin
++all: galleta
+ 
+ installwin:  galleta.c
+ 	gcc -DCYGWIN -o galleta.exe galleta.c -lm -lc;cp galleta.exe ../bin
diff --git a/app-forensics/galleta/galleta-20040505_p1-r1.ebuild b/app-forensics/galleta/galleta-20040505_p1-r1.ebuild
new file mode 100644
index 000000000000..dcb711dc235a
--- /dev/null
+++ b/app-forensics/galleta/galleta-20040505_p1-r1.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P="${PN}_${PV/_p/_}"
+
+DESCRIPTION="IE Cookie Parser"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="https://downloads.sourceforge.net/odessa/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}/src"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-fix-build-system.patch
+	"${FILESDIR}"/${P}-Wimplicit-function-declaration.patch
+)
+
+src_configure() {
+	tc-export CC
+}
+
+src_install() {
+	dobin ${PN}
+	dodoc ../{CHANGES,Readme.txt}
+}
diff --git a/app-forensics/galleta/metadata.xml b/app-forensics/galleta/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/galleta/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/honggfuzz/Manifest b/app-forensics/honggfuzz/Manifest
new file mode 100644
index 000000000000..521bc1519fe1
--- /dev/null
+++ b/app-forensics/honggfuzz/Manifest
@@ -0,0 +1 @@
+DIST honggfuzz-2.6.tar.gz 65227315 BLAKE2B 527d36dd66974b74be29e3dc22e22c893d0e35654a768bfd93c6a919de82841cc1552af2b479ac0d65ce2fcfd66886ca0e43bc95db5b8187c8d13191e65de320 SHA512 cdd97b65e679652be888b966e2c010fe29af262e88d6c94b94b2e78c88258c5c53b4928fdf9e8afe54029c0742c5dfb0f6f8e8cb8157093e7f5ffdcfa5c92fd4
diff --git a/app-forensics/honggfuzz/files/honggfuzz-2.6-no-werror.patch b/app-forensics/honggfuzz/files/honggfuzz-2.6-no-werror.patch
new file mode 100644
index 000000000000..d8af6bd046f8
--- /dev/null
+++ b/app-forensics/honggfuzz/files/honggfuzz-2.6-no-werror.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -26,7 +26,7 @@
+ BIN := honggfuzz
+ HFUZZ_CC_BIN := hfuzz_cc/hfuzz-cc
+ HFUZZ_CC_SRCS := hfuzz_cc/hfuzz-cc.c
+-COMMON_CFLAGS := -std=c11 -I/usr/local/include -D_GNU_SOURCE -Wall -Wextra -Werror -Wno-format-truncation -Wno-override-init -I.
++COMMON_CFLAGS := -std=c11 -I/usr/local/include -D_GNU_SOURCE -Wall -Wextra -Wno-format-truncation -Wno-override-init -I.
+ COMMON_LDFLAGS := -pthread -L/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib -lm
+ COMMON_SRCS := $(sort $(wildcard *.c))
+ CFLAGS ?= -O3 -mtune=native -funroll-loops
diff --git a/app-forensics/honggfuzz/honggfuzz-2.6.ebuild b/app-forensics/honggfuzz/honggfuzz-2.6.ebuild
new file mode 100644
index 000000000000..234ac8b97131
--- /dev/null
+++ b/app-forensics/honggfuzz/honggfuzz-2.6.ebuild
@@ -0,0 +1,56 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="A general purpose fuzzer with feedback support"
+HOMEPAGE="https://honggfuzz.dev/"
+SRC_URI="https://github.com/google/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="clang"
+
+RDEPEND="
+	>=sys-libs/binutils-libs-2.29:=
+	sys-libs/libunwind:=
+	app-arch/xz-utils
+	clang? ( sys-libs/blocksruntime )
+"
+
+DEPEND="${RDEPEND}
+	elibc_musl? ( sys-libs/queue-standalone )"
+
+DOCS=(
+	CHANGELOG
+	COPYING
+	CONTRIBUTING.md
+	README.md
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.6-no-werror.patch
+)
+
+pkg_pretend() {
+	if tc-is-clang; then
+		use clang || die "${P}: to use clang enable USE=clang for ${P} (bug #729256)."
+	fi
+}
+
+src_prepare() {
+	default
+	tc-export AR CC
+	export CFLAGS
+	export LDFLAGS
+}
+
+src_install() {
+	dobin ${PN}
+	dobin hfuzz_cc/hfuzz-cc
+
+	einstalldocs
+}
diff --git a/app-forensics/honggfuzz/metadata.xml b/app-forensics/honggfuzz/metadata.xml
new file mode 100644
index 000000000000..3b9a51f07010
--- /dev/null
+++ b/app-forensics/honggfuzz/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="clang">Enable clang support (pull <pkg>sys-libs/blocksruntime</pkg> dependency).</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/lynis/Manifest b/app-forensics/lynis/Manifest
new file mode 100644
index 000000000000..00a9032b2a8a
--- /dev/null
+++ b/app-forensics/lynis/Manifest
@@ -0,0 +1 @@
+DIST lynis-3.1.6.tar.gz 362815 BLAKE2B 54971cee772c968f6bdda974c9fb756696f6871ff3d4485d0020189ab764c84936afc4844e1b8fda52e332952feb1bcf7f6829b29873ac338c3268afa268d099 SHA512 d89ec356dc3cff4731d2bb228ee0bc3c4d0835837fa98e185ca51b5def68fbcc62808d6a3b0a0bf4898b13b3e7765313cf0461095697c68f555728d6698656f8
diff --git a/app-forensics/lynis/files/lynis.cron-new b/app-forensics/lynis/files/lynis.cron-new
new file mode 100644
index 000000000000..b5e4b0c23628
--- /dev/null
+++ b/app-forensics/lynis/files/lynis.cron-new
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/sbin/lynis audit system --auditor "automated" --cronjob
diff --git a/app-forensics/lynis/lynis-3.1.6.ebuild b/app-forensics/lynis/lynis-3.1.6.ebuild
new file mode 100644
index 000000000000..b74aea68257b
--- /dev/null
+++ b/app-forensics/lynis/lynis-3.1.6.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit bash-completion-r1 systemd
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="https://cisofy.com/lynis/"
+SRC_URI="https://github.com/CISOfy/${PN}/archive/refs/tags/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="+cron systemd"
+
+RDEPEND="
+	app-shells/bash
+	cron? ( !systemd? ( virtual/cron ) )"
+
+src_install() {
+	doman lynis.8
+	dodoc FAQ README
+	newdoc CHANGELOG.md CHANGELOG
+
+	# Remove the old one during the next stabilize progress
+	exeinto /etc/cron.daily
+	newexe "${FILESDIR}"/lynis.cron-new lynis
+
+	dobashcomp extras/bash_completion.d/lynis
+
+	# stricter default perms - bug 507436
+	diropts -m0700
+	insopts -m0600
+
+	insinto /usr/share/${PN}
+	doins -r db/ include/ plugins/
+
+	dosbin lynis
+
+	insinto /etc/${PN}
+	doins default.prf
+	sed -i -e 's/\/path\/to\///' "${S}/extras/systemd/${PN}.service" || die "Sed Failed!"
+	systemd_dounit "${S}/extras/systemd/${PN}.service" || die "Sed Failed!"
+	systemd_dounit "${S}/extras/systemd/${PN}.timer"
+
+	if ! use cron; then
+		ebegin "removing cron files from installation image"
+		rm -rfv "${ED}/etc/cron.daily" || die
+		eend "$?"
+	fi
+}
+
+pkg_postinst() {
+	if use cron; then
+		if systemd_is_booted || has_version sys-apps/systemd; then
+			echo
+			ewarn "Both 'cron' and 'systemd' flags are enabled."
+			ewarn "So both ${PN}.target and cron files were installed."
+			ewarn "Please don't use 2 implementations at the same time."
+			ewarn "Cronjobs are usually enabled by default via /etc/cron.* jobs"
+			ewarn "If you want to use systemd ${PN}.target timers"
+			ewarn "disable 'cron' flag and reinstall ${PN}"
+			echo
+		else
+			einfo "A cron script has been installed to ${ROOT}/etc/cron.daily/lynis."
+		fi
+	fi
+}
diff --git a/app-forensics/lynis/metadata.xml b/app-forensics/lynis/metadata.xml
new file mode 100644
index 000000000000..0cd9a7ec7bd0
--- /dev/null
+++ b/app-forensics/lynis/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>mpagano@gentoo.org</email>
+    <name>Mike Pagano</name>
+  </maintainer>
+  <use>
+    <flag name="cron">Install /etc/cron.* files</flag>
+  </use>
+  <upstream>
+    <bugs-to>https://github.com/CISOfy/lynis/issues</bugs-to>
+    <changelog>https://raw.githubusercontent.com/CISOfy/lynis/refs/heads/master/CHANGELOG.md</changelog>
+    <remote-id type="cpe">cpe:/a:cisofy:lynis</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/mac-robber/Manifest b/app-forensics/mac-robber/Manifest
new file mode 100644
index 000000000000..724ddea6be76
--- /dev/null
+++ b/app-forensics/mac-robber/Manifest
@@ -0,0 +1 @@
+DIST mac-robber-1.02.tar.gz 11708 BLAKE2B d6d35be3c52b5bc93eb779ca3693c4213c57dcb4ecfb24912e92f47b3f896d948c8ccadef39f49af3c455cdff3a92adbca7e3d1e35ef0ebc885034bfa3c0743b SHA512 5330f766eb08aa766ca3f430684e0a40ecf29b7230a582c30a36bbaaa481d52c2a8519fa04e82762f09259ada9e77466c1430aebdff22615a511d519916d54a7
diff --git a/app-forensics/mac-robber/files/mac-robber-1.02-posix.patch b/app-forensics/mac-robber/files/mac-robber-1.02-posix.patch
new file mode 100644
index 000000000000..a45d4718e51b
--- /dev/null
+++ b/app-forensics/mac-robber/files/mac-robber-1.02-posix.patch
@@ -0,0 +1,19 @@
+--- a/mac-robber.c
++++ b/mac-robber.c
+@@ -45,6 +45,7 @@
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <dirent.h>
++#include <limits.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -238,7 +239,7 @@
+     /* Make a buffer for the full path
+      * the 2 is for 1 NULL and 1 '/' for recursive directories 
+      */
+-    path_len = dir_len + MAXNAMLEN + 2;
++    path_len = dir_len + NAME_MAX + 2;
+     if (!(curpath = (char *) malloc(path_len))) {
+         printf("error allocating space for curpath\n");
+         exit(1);
diff --git a/app-forensics/mac-robber/mac-robber-1.02-r1.ebuild b/app-forensics/mac-robber/mac-robber-1.02-r1.ebuild
new file mode 100644
index 000000000000..364bc3224431
--- /dev/null
+++ b/app-forensics/mac-robber/mac-robber-1.02-r1.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="mac-robber is a digital forensics and incident response tool that collects data"
+HOMEPAGE="http://www.sleuthkit.org/mac-robber/index.php"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+
+PATCHES=( "${FILESDIR}"/${P}-posix.patch )
+
+src_prepare() {
+	default
+	# just rely on implicit rules
+	rm Makefile || die
+}
+
+src_configure() {
+	tc-export CC
+}
+
+src_compile() {
+	emake mac-robber
+}
+
+src_install() {
+	dobin mac-robber
+	einstalldocs
+}
diff --git a/app-forensics/mac-robber/metadata.xml b/app-forensics/mac-robber/metadata.xml
new file mode 100644
index 000000000000..2f02dec674d3
--- /dev/null
+++ b/app-forensics/mac-robber/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+	mac-robber is a digital forensics and incident response tool that collects data from allocated files in a mounted file system.
+	The data can be used by the mactime tool in The Sleuth Kit to make a timeline of file activity. The mac-robber tool is based on
+	the grave-robber tool from TCT and is written in C instead of Perl.
+
+	mac-robber requires that the file system be mounted by the operating system, unlike the tools in The Sleuth Kit that process the
+	file system themselves. Therefore, mac-robber will not collect data from deleted files or files that have been hidden by
+	rootkits. mac-robber will also modify the Access times on directories that are mounted with write permissions.
+
+
+	"What is mac-robber good for then", you ask? mac-robber is useful when dealing with a file system that is not supported by The
+	Sleuth Kit or other forensic tools. mac-robber is very basic C and should compile on any UNIX system. Therefore, you can run
+	mac-robber on an obscure, suspect UNIX file system that has been mounted read-only on a trusted system. I have also used
+	mac-robber during investigations of common UNIX systems such as AIX.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/magicrescue/Manifest b/app-forensics/magicrescue/Manifest
new file mode 100644
index 000000000000..8c38341739eb
--- /dev/null
+++ b/app-forensics/magicrescue/Manifest
@@ -0,0 +1 @@
+DIST magicrescue-1.1.10.tar.gz 227237 BLAKE2B a1584f4e6f4b6771783c565901775e181ba2e952e780565831e5d46245a4dd4670657cec7fb57b18d7dfc09954faec410da2dfe1b35130c23d22d8a6ccf0ab07 SHA512 54fc943a1f521563a3416040eb6b140e3ef79966b615ae0223be0558b810f9202c2d1e5ba0165c43a614caf78dbce1b0992775bef39e9611d2dc290e4582c29d
diff --git a/app-forensics/magicrescue/files/magicrescue-1.1.10-fhs-paths.patch b/app-forensics/magicrescue/files/magicrescue-1.1.10-fhs-paths.patch
new file mode 100644
index 000000000000..e249f67f280d
--- /dev/null
+++ b/app-forensics/magicrescue/files/magicrescue-1.1.10-fhs-paths.patch
@@ -0,0 +1,67 @@
+https://github.com/jbj/magicrescue/commit/0426af2a23918d7064d58ac5f9a2a752eb329501
+https://bugs.gentoo.org/875383
+
+From 0426af2a23918d7064d58ac5f9a2a752eb329501 Mon Sep 17 00:00:00 2001
+From: Jonas Jensen <jbj@knef.dk>
+Date: Sun, 29 Aug 2021 20:14:33 +0200
+Subject: [PATCH] Debian's 040_fix-install.patch
+
+Description: fix and modernize install, in accordance with FHS 3.0
+Author: Joao Eriberto Mota Filho <eriberto@debian.org>
+Last-Update: 2020-04-06
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -56,32 +56,32 @@ docs-clean:
+ maintainer-clean: distclean docs-clean
+ 
+ install: all
+-	mkdir -p $(INSTALLDIR)/share/magicrescue/tools \
++	mkdir -p $(INSTALLDIR)/libexec/magicrescue/tools \
+ 	    $(INSTALLDIR)/share/magicrescue/recipes \
+-	    $(INSTALLDIR)/man/man1 \
++	    $(INSTALLDIR)/share/man/man1 \
+ 	    $(INSTALLDIR)/bin
+ 	
+ 	cp magicrescue$(EXE) dupemap$(EXE) magicsort $(INSTALLDIR)/bin/
+ 	cp recipes/* $(INSTALLDIR)/share/magicrescue/recipes/
+-	cp $(DOCS) $(INSTALLDIR)/man/man1
++	cp $(DOCS) $(INSTALLDIR)/share/man/man1
+ 	
+ 	for f in tools/*; do \
+ 	  if [ -x "$$f" ]; then \
+-	    cp -f "$$f" $(INSTALLDIR)/share/magicrescue/tools/; \
++	    cp -f "$$f" $(INSTALLDIR)/libexec/magicrescue/tools/; \
+ 	  fi; \
+ 	done
+-	cp -f tools/laola.pl $(INSTALLDIR)/share/magicrescue/tools/
++	cp -f tools/laola.pl $(INSTALLDIR)/libexec/magicrescue/tools/
++	chmod 755 $(INSTALLDIR)/libexec/magicrescue/tools/laola.pl
+ 
+ uninstall:
+ 	rm -f $(INSTALLDIR)/bin/magicrescue$(EXE)
+ 	rm -f $(INSTALLDIR)/bin/dupemap$(EXE)
+ 	rm -f $(INSTALLDIR)/bin/magicsort
+ 	for f in $(DOCS); do \
+-	   rm -f "$(INSTALLDIR)/man/man1/`basename $$f`"; \
++	   rm -f "$(INSTALLDIR)/share/man/man1/`basename $$f`"; \
+ 	done
+-	rm -rf $(INSTALLDIR)/share/magicrescue/tools
+-	rm -rf $(INSTALLDIR)/share/magicrescue/recipes
+-	-rmdir $(INSTALLDIR)/share/magicrescue
++	rm -rf $(INSTALLDIR)/libexec/magicrescue/
++	rm -rf $(INSTALLDIR)/share/magicrescue/
+ 
+ .PHONY: all clean distclean docs-clean maintainer-clean install uninstall docs
+ 
+--- a/config.d/80magicrescue_defs
++++ b/config.d/80magicrescue_defs
+@@ -1,7 +1,7 @@
+ #!/bin/sh
+ 
+ cat >> config.h << EOF
+-#define COMMAND_PATH "$prefix/share/magicrescue/tools"
++#define COMMAND_PATH "$prefix/libexec/magicrescue/tools"
+ #define RECIPE_PATH  "$prefix/share/magicrescue/recipes"
+ #include "largefile.h"
+ EOF
+
diff --git a/app-forensics/magicrescue/files/magicrescue-1.1.10-ldflags.patch b/app-forensics/magicrescue/files/magicrescue-1.1.10-ldflags.patch
new file mode 100644
index 000000000000..773bab4ff19c
--- /dev/null
+++ b/app-forensics/magicrescue/files/magicrescue-1.1.10-ldflags.patch
@@ -0,0 +1,38 @@
+--- magicrescue-1.1.9/config.d/50dbm	2008-06-27 00:24:05.000000000 +0400
++++ magicrescue-1.1.9.new//config.d/50dbm	2012-05-13 07:56:16.000000000 +0400
+@@ -14,18 +14,14 @@
+ 	    flag="`echo $flag|sed 's/./-l&/'`"
+ 	    echo "trying to link with flags [$flag]" >&5
+ 	    
+-	    bak_LDFLAGS="$LDFLAGS"
+-	    LDFLAGS="$LDFLAGS $flag"
++            LIBS="$flag"
+ 	    if conftest_link; then
+ 		# we found it!
+-		LDFLAGS="$bak_LDFLAGS"
+ 		DBM_LDFLAGS="$flag"
+ 		env_vars="$env_vars DBM_LDFLAGS"
+ 		echo "#define $dbmdef" >> config.h
+ 		echo "#define HAVE_NDBM" >> config.h
+ 		return 0
+-	    else
+-		LDFLAGS="$bak_LDFLAGS"
+ 	    fi
+ 	done
+ 	
+Common subdirectories: a/config.d and b/config.d
+diff -u a/configure b/configure
+--- a/configure	2018-11-24 20:21:20.000000000 +0100
++++ b/configure	2019-11-12 22:13:03.744338398 +0100
+@@ -63,9 +63,9 @@
+ }
+ 
+ conftest_link() {
+-    echo "$CC -o conftest conftest.o $LDFLAGS" >&5
++    echo "$CC -o conftest conftest.o $LDFLAGS $LIBS" >&5
+     echo >&5
+-    $CC -o conftest conftest.o $LDFLAGS >&5 2>&5 \
++    $CC -o conftest conftest.o $LDFLAGS $LIBS >&5 2>&5 \
+ 	&& [ -x conftest ] && ./conftest 2>&5
+ }
+ 
diff --git a/app-forensics/magicrescue/magicrescue-1.1.10-r4.ebuild b/app-forensics/magicrescue/magicrescue-1.1.10-r4.ebuild
new file mode 100644
index 000000000000..5c3b26f1aa10
--- /dev/null
+++ b/app-forensics/magicrescue/magicrescue-1.1.10-r4.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="Find deleted files in block devices"
+HOMEPAGE="https://github.com/jbj/magicrescue"
+SRC_URI="https://github.com/jbj/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 ~ppc x86"
+
+# - File collision with net-mail/safecat, bug #702004
+# - BDEPEND on perl for pod2man, bug #852671
+DEPEND="sys-libs/gdbm:="
+RDEPEND="${DEPEND}
+	!net-mail/safecat"
+BDEPEND="dev-lang/perl"
+
+PATCHES=(
+	"${FILESDIR}/${P}-ldflags.patch"
+	"${FILESDIR}/${P}-fhs-paths.patch"
+)
+
+src_configure() {
+	tc-export CC
+
+	# Not autotools, just looks like it sometimes
+	./configure --prefix=/usr || die
+}
diff --git a/app-forensics/magicrescue/metadata.xml b/app-forensics/magicrescue/metadata.xml
new file mode 100644
index 000000000000..285da03c456a
--- /dev/null
+++ b/app-forensics/magicrescue/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <longdescription>
+	Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. It looks
+	at "magic bytes" in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or
+	partition. As long as the file data is there, it will find it.
+
+	It works on any file system, but on very fragmented file systems it can only recover the first chunk of each file. Practical
+	experience (this program was not written for fun) shows, however, that chunks of 30-50MB are not uncommon.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/memdump/Manifest b/app-forensics/memdump/Manifest
new file mode 100644
index 000000000000..daf49e69f2b1
--- /dev/null
+++ b/app-forensics/memdump/Manifest
@@ -0,0 +1 @@
+DIST memdump-1.01.tar.gz 12713 BLAKE2B 96fac28977f55e99cc31aec61761d91e83074c2e45d1e4c832dab6b7326f3361e902d02b5b59191daf81f81659adfb6209c41d51ed917c8375d03ba107446e28 SHA512 46d013f812b0a5807c7ba38d6c3940e105057ba8e64b4f45b75a0800cab212d164caf881efbc1958d5c5c239236fdcb61f6fe093886ff3e28bc0b70791aaee3e
diff --git a/app-forensics/memdump/files/memdump-1.01-linux3.patch b/app-forensics/memdump/files/memdump-1.01-linux3.patch
new file mode 100644
index 000000000000..55563c4e077a
--- /dev/null
+++ b/app-forensics/memdump/files/memdump-1.01-linux3.patch
@@ -0,0 +1,24 @@
+--- memdump-1.01.orig/makedefs
++++ memdump-1.01/makedefs
+@@ -30,9 +30,7 @@
+     SunOS.5*)	DEFS="-DSUNOS5 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ 		RANLIB=":"
+ 		;;
+-  Linux.2.4*)   DEFS="-DLINUX2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+-		;;
+-    Linux.2*)   DEFS="-DLINUX2"
++    Linux.*)   DEFS="-DLINUX -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ 		;;
+            *)   echo unsupported system: $SYSTEM.$RELEASE 1>&2; exit 1
+ 		;;
+--- memdump-1.01.orig/memdump.c
++++ memdump-1.01/memdump.c
+@@ -118,7 +118,7 @@
+ #define SUPPORTED
+ #endif
+ 
+-#ifdef LINUX2
++#ifdef LINUX
+ #include <paths.h>
+ #define GETPAGESIZE getpagesize
+ #define SUPPORTED
diff --git a/app-forensics/memdump/memdump-1.01-r1.ebuild b/app-forensics/memdump/memdump-1.01-r1.ebuild
new file mode 100644
index 000000000000..d95964dbd548
--- /dev/null
+++ b/app-forensics/memdump/memdump-1.01-r1.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs
+
+DESCRIPTION="Simple memory dumper for UNIX-Like systems"
+HOMEPAGE="http://www.porcupine.org/forensics"
+SRC_URI="http://www.porcupine.org/forensics/${P}.tar.gz"
+
+LICENSE="IBM"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+
+PATCHES=( "${FILESDIR}"/${P}-linux3.patch )
+
+src_prepare() {
+	default
+	sed -i -e 's:$(CFLAGS):\0 $(LDFLAGS):' Makefile || die
+}
+
+src_compile() {
+	emake CC="$(tc-getCC)" XFLAGS="${CFLAGS}" OPT= DEBUG=
+}
+
+src_test() {
+	if [[ ${EUID} -ne 0 ]];
+	then
+		einfo "Cannot test with FEATURES=userpriv"
+	elif [ -x /bin/wc ];
+	then
+		einfo "testing"
+		if [ "`./memdump -s 344 | wc -c`" = "344" ];
+		then
+			einfo "passed test"
+		else
+			die "failed test"
+		fi
+	fi
+}
+
+src_install() {
+	dosbin memdump
+	dodoc README
+	doman memdump.1
+}
diff --git a/app-forensics/memdump/metadata.xml b/app-forensics/memdump/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/memdump/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/metadata.xml b/app-forensics/metadata.xml
new file mode 100644
index 000000000000..763c50015647
--- /dev/null
+++ b/app-forensics/metadata.xml
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<catmetadata>
+	<longdescription lang="en">
+		The app-forensics category contains software which helps detect and
+		analyse security breaches.
+	</longdescription>
+	<longdescription lang="de">
+		Die Kategorie app-forensics enthält Programme welche beim Erkennen
+		und Analysieren von Sicherheitsbrüchen helfen.
+	</longdescription>
+	<longdescription lang="es">
+		La categoría app-forensics contiene programas para ayudar a detectar
+		y analizar problemas de seguridad.
+	</longdescription>
+	<longdescription lang="ja">
+		app-forensicsカテゴリには安全保侵犯を捜し当てると取調べる
+		ソフトウェアが含まれます。
+	</longdescription>
+	<longdescription lang="nl">
+		De app-forensics categorie bevat applicaties voor het detecteren en
+		analyseren van inbreuken op de veiligheid van het systeem.
+	</longdescription>
+	<longdescription lang="vi">
+		Nhóm app-forensics chứa các phần mềm hỗ trợ dò tìm,
+		phân tích các lỗ hổng bảo mật.
+	</longdescription>
+	<longdescription lang="it">
+		La categoria app-forensics contiene programmi che aiutono a trovare
+		ed analizzare problemi di sicurezza.
+	</longdescription>
+	<longdescription lang="pt">
+		A categoria app-forensics contém programas que ajudam a detectar
+		e analisar problemas de segurança.
+	</longdescription>
+	<longdescription lang="pl">
+		Kategoria app-forensics zawiera oprogramowanie ułatwiające
+		przeprowadzanie audytu bezpieczeństwa systemu.
+	</longdescription>
+</catmetadata>
diff --git a/app-forensics/pasco/Manifest b/app-forensics/pasco/Manifest
new file mode 100644
index 000000000000..620936abc55e
--- /dev/null
+++ b/app-forensics/pasco/Manifest
@@ -0,0 +1 @@
+DIST pasco_20040505_1.tar.gz 4032 BLAKE2B 2a6520f48fbe8410b73ab01e95d14c1ff7e1f872dd8b4ab0e02a70c5880abd99d1d0418f82ea65fb19bd941bd8104d3a8e96697652cefc18e01c16f873fa3c79 SHA512 fd3c1b31618a64ea9a381c68971800a511f8c826a26ca0f554bd6c69f4992312c0c34adf7067da97ff6d7c11b7ed8a64401435fa9ceb218e165cf83a3b6083db
diff --git a/app-forensics/pasco/files/pasco-20040505_p1-Wimplicit-function-declaration.patch b/app-forensics/pasco/files/pasco-20040505_p1-Wimplicit-function-declaration.patch
new file mode 100644
index 000000000000..22acc9edd9f0
--- /dev/null
+++ b/app-forensics/pasco/files/pasco-20040505_p1-Wimplicit-function-declaration.patch
@@ -0,0 +1,10 @@
+--- a/pasco.c
++++ b/pasco.c
+@@ -36,6 +36,7 @@
+ #include <stdio.h>
+ #include <time.h>
+ #include <math.h>
++#include <string.h>
+ 
+ //
+ /* This is the default block size for an activity record */
diff --git a/app-forensics/pasco/files/pasco-20040505_p1-fix-build-system.patch b/app-forensics/pasco/files/pasco-20040505_p1-fix-build-system.patch
new file mode 100644
index 000000000000..63a6102c8c13
--- /dev/null
+++ b/app-forensics/pasco/files/pasco-20040505_p1-fix-build-system.patch
@@ -0,0 +1,12 @@
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,6 @@
+-all: install
++LDLIBS += -lm
+ 
+-install:  pasco.c
+-	gcc -o pasco pasco.c -lm -lc;cp pasco ../bin
++all: pasco
+ 
+ installwin:  pasco.c
+ 	gcc -DCYGWIN -o pasco.exe pasco.c -lm -lc;cp pasco.exe ../bin
diff --git a/app-forensics/pasco/metadata.xml b/app-forensics/pasco/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/pasco/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/pasco/pasco-20040505_p1-r2.ebuild b/app-forensics/pasco/pasco-20040505_p1-r2.ebuild
new file mode 100644
index 000000000000..a75dc503ae1f
--- /dev/null
+++ b/app-forensics/pasco/pasco-20040505_p1-r2.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P="${PN}_${PV/_p/_}"
+
+DESCRIPTION="IE Activity Parser"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="https://downloads.sourceforge.net/odessa/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}/src"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-fix-build-system.patch
+	"${FILESDIR}"/${P}-Wimplicit-function-declaration.patch
+)
+
+src_configure() {
+	tc-export CC
+}
+
+src_install() {
+	dobin ${PN}
+	dodoc ../{CHANGES,Readme.txt}
+}
diff --git a/app-forensics/radamsa/Manifest b/app-forensics/radamsa/Manifest
new file mode 100644
index 000000000000..34877e4c9408
--- /dev/null
+++ b/app-forensics/radamsa/Manifest
@@ -0,0 +1,2 @@
+DIST radamsa-0.7.c.gz 139939 BLAKE2B ae3e2fca777bdc672431810ec6e9a245774e3f761fb4552ae973caf3b82348c73221e9cfac023e80f161c37fb3e63ff043aac2f98cb932056c1618a842245f52 SHA512 f0b0c21034cb33182be74d8927c879a2a49cb20c992e97556bb9d76c35c8a39f1caf2042a3d001f0063b09e80705fa5d285d1d95b9f8a2dd5c62deb9a18d9bde
+DIST radamsa-v0.7.tar.bz2 49194 BLAKE2B a3e24302c67ed887373109ce3bd1b3b796c742ad50c04d83980caf7b5e92793668c9262791749653e72e15d65d7a4971d498013d3c5a8fafda9033cddc5b3e03 SHA512 ca55e499b739e4a24038b36115106dc10b6f68e3e127d3c45b0ab79676a1e6e82021be02e378bd6fd09f6df537d266ea4cf8f3528a25ed9e788548d6edc62fb5
diff --git a/app-forensics/radamsa/files/radamsa-0.7-no-which.patch b/app-forensics/radamsa/files/radamsa-0.7-no-which.patch
new file mode 100644
index 000000000000..6a6d04a9c806
--- /dev/null
+++ b/app-forensics/radamsa/files/radamsa-0.7-no-which.patch
@@ -0,0 +1,10 @@
+--- a/tests/uniq.sh
++++ b/tests/uniq.sh
+@@ -2,6 +2,6 @@
+ 
+ set -e
+ echo "HAL 9000" | $@ -o tmp/uniq-%n -n 100 -p od -m num 
+-md5cmd=$(test -x "$(which md5)" && echo "md5 -r" || echo "md5sum")
++md5cmd=md5sum
+ test 0 = $($md5cmd tmp/uniq-* | sed -e 's/ .*//' | sort | uniq -c | grep -v " 1 " | wc -l)
+ rm tmp/uniq-*
diff --git a/app-forensics/radamsa/files/radamsa-0.7_prebuilt-c.patch b/app-forensics/radamsa/files/radamsa-0.7_prebuilt-c.patch
new file mode 100644
index 000000000000..94fad4879f91
--- /dev/null
+++ b/app-forensics/radamsa/files/radamsa-0.7_prebuilt-c.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -15,7 +15,7 @@
+ 	mkdir -p bin
+ 	$(CC) $(CFLAGS) $(LDFLAGS) -o bin/radamsa radamsa.c
+ 
+-bin/radamsa: radamsa.c
++bin/radamsa:
+ 	mkdir -p bin
+ 	$(CC) $(CFLAGS) $(LDFLAGS) -o bin/radamsa radamsa.c
+ 
diff --git a/app-forensics/radamsa/metadata.xml b/app-forensics/radamsa/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/radamsa/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/radamsa/radamsa-0.7-r1.ebuild b/app-forensics/radamsa/radamsa-0.7-r1.ebuild
new file mode 100644
index 000000000000..226d86d3a64b
--- /dev/null
+++ b/app-forensics/radamsa/radamsa-0.7-r1.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P="${PN}-v${PV}"
+
+DESCRIPTION="A general-purpose fuzzer"
+HOMEPAGE="https://gitlab.com/akihe/radamsa"
+SRC_URI="
+	https://gitlab.com/akihe/${PN}/-/archive/v${PV}/${MY_P}.tar.bz2
+	https://gitlab.com/akihe/${PN}/uploads/d774a42f7893012d0a56c490a75ae12b/${P}.c.gz
+"
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+BDEPEND="test? ( dev-scheme/owl-lisp )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.7_prebuilt-c.patch
+	"${FILESDIR}"/${PN}-0.7-no-which.patch
+)
+
+src_prepare() {
+	default
+
+	cp "${WORKDIR}"/${P}.c "${S}"/${PN}.c || die
+}
+
+src_compile() {
+	emake -Onone bin/radamsa CC="$(tc-getCC)" CFLAGS="${CFLAGS}"
+}
+
+src_test() {
+	ln -s "${BROOT}"/usr/bin/ol bin/ol || die
+	emake -Onone test
+}
+
+src_install() {
+	dobin bin/radamsa
+	# avoid man compression by build system
+	doman doc/radamsa.1
+
+	einstalldocs
+}
diff --git a/app-forensics/radamsa/radamsa-0.7.ebuild b/app-forensics/radamsa/radamsa-0.7.ebuild
new file mode 100644
index 000000000000..baf922c968eb
--- /dev/null
+++ b/app-forensics/radamsa/radamsa-0.7.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P="${PN}-v${PV}"
+
+DESCRIPTION="A general-purpose fuzzer"
+HOMEPAGE="https://gitlab.com/akihe/radamsa"
+SRC_URI="
+	https://gitlab.com/akihe/${PN}/-/archive/v${PV}/${MY_P}.tar.bz2
+	https://gitlab.com/akihe/${PN}/uploads/d774a42f7893012d0a56c490a75ae12b/${P}.c.gz
+"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+# needs an owl-lisp
+RESTRICT=test
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.7_prebuilt-c.patch
+)
+
+S="${WORKDIR}"/${MY_P}
+
+src_prepare() {
+	default
+
+	cp "${WORKDIR}"/${P}.c "${S}"/${PN}.c || die
+}
+
+src_compile() {
+	emake bin/radamsa CC="$(tc-getCC)" CFLAGS="${CFLAGS}"
+}
+
+src_install() {
+	dobin bin/radamsa
+	# avoid man compression by build system
+	doman doc/radamsa.1
+
+	einstalldocs
+}
diff --git a/app-forensics/rifiuti/Manifest b/app-forensics/rifiuti/Manifest
new file mode 100644
index 000000000000..6ef0760e0947
--- /dev/null
+++ b/app-forensics/rifiuti/Manifest
@@ -0,0 +1 @@
+DIST rifiuti_20040505_1.tar.gz 2823 BLAKE2B 786ad2b6b4f2744b960300cf7cd35e46782a3b6a56a23b6cf1157855d5df8237806cf35243409efdab6e41f6fb004f1954a9291e608152f961a4107a11c37f65 SHA512 9d7e77c3eb74b97fedd66c0cac9c1960d3de0f284fcdee81c1e523eb9898cc9758194d7913b1bd7e0bc82eae4eeed656b7b3c699bcdd536325604d17c41da6de
diff --git a/app-forensics/rifiuti/files/rifiuti-20040505_p1-Wimplicit-function-declaration.patch b/app-forensics/rifiuti/files/rifiuti-20040505_p1-Wimplicit-function-declaration.patch
new file mode 100644
index 000000000000..1ac3207a7c4f
--- /dev/null
+++ b/app-forensics/rifiuti/files/rifiuti-20040505_p1-Wimplicit-function-declaration.patch
@@ -0,0 +1,11 @@
+--- a/rifiuti.c
++++ b/rifiuti.c
+@@ -35,6 +35,8 @@
+ #include <stdio.h>
+ #include <time.h>
+ #include <math.h>
++#include <stdlib.h>
++#include <string.h>
+ 
+ #ifdef CYGWIN
+ ssize_t pread( int d, void *buf, size_t nbytes, off_t offset) {
diff --git a/app-forensics/rifiuti/files/rifiuti-20040505_p1-fix-build-system.patch b/app-forensics/rifiuti/files/rifiuti-20040505_p1-fix-build-system.patch
new file mode 100644
index 000000000000..a1c452047913
--- /dev/null
+++ b/app-forensics/rifiuti/files/rifiuti-20040505_p1-fix-build-system.patch
@@ -0,0 +1,12 @@
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,6 @@
+-all: install
++LDLIBS += -lm
+ 
+-install:  rifiuti.c
+-	gcc -o rifiuti rifiuti.c -lm -lc;cp rifiuti ../bin
++all: rifiuti
+ 
+ installwin:  rifiuti.c
+ 	gcc -DCYGWIN -o rifiuti.exe rifiuti.c -lm -lc;cp rifiuti.exe ../bin
diff --git a/app-forensics/rifiuti/metadata.xml b/app-forensics/rifiuti/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/rifiuti/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/rifiuti/rifiuti-20040505_p1-r1.ebuild b/app-forensics/rifiuti/rifiuti-20040505_p1-r1.ebuild
new file mode 100644
index 000000000000..e56d1acac3ef
--- /dev/null
+++ b/app-forensics/rifiuti/rifiuti-20040505_p1-r1.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_P="${PN}_${PV/_p/_}"
+
+DESCRIPTION="Recycle Bin Analyzer"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="https://downloads.sourceforge.net/odessa/${MY_P}.tar.gz"
+S="${WORKDIR}/${MY_P}/src"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-fix-build-system.patch
+	"${FILESDIR}"/${P}-Wimplicit-function-declaration.patch
+)
+
+src_configure() {
+	tc-export CC
+}
+
+src_install() {
+	dobin ${PN}
+	dodoc ../{CHANGES,Readme.txt}
+}
diff --git a/app-forensics/rkhunter/Manifest b/app-forensics/rkhunter/Manifest
new file mode 100644
index 000000000000..a181f515787e
--- /dev/null
+++ b/app-forensics/rkhunter/Manifest
@@ -0,0 +1,2 @@
+DIST rkhunter-1.4.6-grep-3.8.patch.xz 7232 BLAKE2B a4be08fbe2094f531b0b71fe30dca3e3fb54f9be566f578b4008c7139737cee8d19aca20beb1369bbd877faa270f4ea43c195042b1431eeb34817f0d9063c100 SHA512 c5d21da2fbd8bffa282c716acc2550268fd5f436791635481b79986b1fa1dc631d6551f735344ff7bebbb835748b0e3a508949fb9a45bc4f76a4650732920230
+DIST rkhunter-1.4.6.tar.gz 302137 BLAKE2B 89c61386b57f743f4205f8c826eaa8a9dc9a0d413ac47efb26b6f93d8d642f619f35b7a4c021521b662547c02a16071b8980d158cfb9e081a64870558dbaeff0 SHA512 c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216
diff --git a/app-forensics/rkhunter/files/rkhunter-1.4.6-conf.patch b/app-forensics/rkhunter/files/rkhunter-1.4.6-conf.patch
new file mode 100644
index 000000000000..5642436ed412
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter-1.4.6-conf.patch
@@ -0,0 +1,38 @@
+
+--- a/rkhunter.conf
++++ b/rkhunter.conf
+@@ -72,6 +72,7 @@
+ # to use.
+ #
+ 
++INSTALLDIR=/usr
+ 
+ #
+ # If this option is set to '1', it specifies that the mirrors file
+@@ -154,7 +155,7 @@
+ # subsequently commented out or removed, then the program will assume a
+ # default directory beneath the installation directory.
+ #
+-#TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter
+ 
+ #
+ # This option specifies the database directory to use.
+@@ -163,7 +164,7 @@
+ # subsequently commented out or removed, then the program will assume a
+ # default directory beneath the installation directory.
+ #
+-#DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+ 
+ #
+ # This option specifies the script directory to use.
+@@ -171,7 +172,7 @@
+ # The installer program will set the default directory. If this default is
+ # subsequently commented out or removed, then the program will not run.
+ #
+-#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/lib/rkhunter/scripts
+ 
+ #
+ # This option can be used to modify the command directory list used by rkhunter
diff --git a/app-forensics/rkhunter/files/rkhunter-1.4.6-no-insecure-web.patch b/app-forensics/rkhunter/files/rkhunter-1.4.6-no-insecure-web.patch
new file mode 100644
index 000000000000..ed3b68c669bc
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter-1.4.6-no-insecure-web.patch
@@ -0,0 +1,46 @@
+Disable insecure web operations (CVE-2017-7480).
+
+Bug: https://bugs.gentoo.org/623150
+
+--- a/rkhunter
++++ b/rkhunter
+@@ -19462,7 +19462,7 @@
+ 	#
+ 
+ 	echo $ECHOOPT ""
+-	echo $ECHOOPT "Usage: rkhunter {--check | --unlock | --update | --versioncheck |"
++	echo $ECHOOPT "Usage: rkhunter {--check | --unlock |"
+ 	echo $ECHOOPT "                 --propupd [{filename | directory | package name},...] |"
+ 	echo $ECHOOPT "                 --list [{tests | {lang | languages} | rootkits | perl | propfiles}] |"
+ 	echo $ECHOOPT "                 --config-check | --version | --help} [options]"
+@@ -19518,10 +19518,8 @@
+ 	echo $ECHOOPT "                                       (Default level is $SYSLOG_DFLT_PRIO)"
+ 	echo $ECHOOPT "         --tmpdir <directory>          Use the specified temporary directory"
+ 	echo $ECHOOPT "         --unlock                      Unlock (remove) the lock file"
+-	echo $ECHOOPT "         --update                      Check for updates to database files"
+ 	echo $ECHOOPT "   --vl, --verbose-logging             Use verbose logging (on by default)"
+ 	echo $ECHOOPT "     -V, --version                     Display the version number, then exit"
+-	echo $ECHOOPT "         --versioncheck                Check for latest version of program"
+ 	echo $ECHOOPT "     -x, --autox                       Automatically detect if X is in use"
+ 	echo $ECHOOPT "     -X, --no-autox                    Do not automatically detect if X is in use"
+ 	echo $ECHOOPT ""
+@@ -20396,9 +20394,6 @@
+ 	--unlock)
+ 		UNLOCK=1
+ 		;;
+-	--update)
+-		UPDATE=1
+-		;;
+ 	--vl | --verboselogging | --verbose-logging)
+ 		VERBOSE_LOGGING=1
+ 		;;
+@@ -20407,9 +20402,6 @@
+ 		echo "${PROGRAM_blurb}"
+ 		exit 0
+ 		;;
+-	--versioncheck | --version-check)
+-		VERSIONCHECK=1
+-		;;
+ 	-x | --autox)
+ 		AUTO_X_OPT=1
+ 		AUTO_X_DTCT=1
diff --git a/app-forensics/rkhunter/files/rkhunter-1.4.cron b/app-forensics/rkhunter/files/rkhunter-1.4.cron
new file mode 100644
index 000000000000..6c73305d3e8c
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter-1.4.cron
@@ -0,0 +1,134 @@
+#!/bin/bash
+# original author: Aaron Walker <ka0ttic@gentoo.org>
+
+########################## Begin Configuration ###############################
+
+# Default options - more options may be added depending on the
+# configuration variables you set below
+# --cronjob implies -c, --nocolor, --sk
+RKHUNTER_OPTS="--cronjob --summary"
+
+# Set this to 'yes' to enable ; this script does nothing otherwise
+ENABLE=no
+
+# Automatically update rkhunter's dat files prior to running?
+UPDATE=no
+
+# Set this to 'yes' if you wish the output to be mailed to you
+SEND_EMAIL=no
+
+# NOTE: the following EMAIL_* variables are only relevant if you set the
+# SEND_EMAIL variable to 'yes'
+EMAIL_SUBJECT="${HOSTNAME}: rkhunter output"
+EMAIL_RECIPIENT=root
+EMAIL_CMD="|mail -s \"${EMAIL_SUBJECT}\" ${EMAIL_RECIPIENT}"
+
+# Log rkhunter output?
+LOG=no
+
+# The default log location is /var/log/rkhunter.log. Set this variable if
+# you'd like to use an alternate location.
+#LOGFILE=""
+
+# By default, the log file created by rkhunter is world-readable (0644). If
+# you'd like to modify the permissions afterwards, set this variable.  The 
+# value of this variable, must be a valid chmod argument such as '0600' or 
+# 'u+rw,go-rwx'.  See the chmod(1) manual page for more information.
+#LOGFILE_PERMS="0600"
+
+# By default, rkhunter overwrites the previous log.  Set this variable
+# to 'yes' if you'd like the log output appended to the logfile, instead
+# of overwriting it.
+SAVE_OLD_LOGS=no
+
+# Set to 1 to recieve only warnings & errors
+# Set to 2 to recieve ALL rkhunter output
+# Set to 3 to recieve rkhunter report
+VERBOSITY=3
+
+########################### End Configuration ################################
+
+# exit immediately, unless enabled
+[[ "${ENABLE}" == "yes" ]] || exit 0
+
+# debug mode?  (mainly for my benefit)
+if [[ -n "${1}" ]] && [[ ${1} = "-d" ]] ; then
+        set -o verbose -o xtrace
+fi
+
+[[ -z "${LOGFILE}" ]] && LOGFILE="/var/log/rkhunter.log"
+
+# moved this out of config section since it'll
+# probably never need to be changed
+RKHUNTER_EXEC="/usr/sbin/rkhunter"
+
+# sanity check
+if [[ ! -x "${RKHUNTER_EXEC}" ]] ; then
+        echo "${RKHUNTER_EXEC} does not exist or is not executable!"
+        exit 1
+fi
+
+# we create a few tmp files, so let's at least make
+# them readable/writable by root only
+umask 0077
+
+# all output goes to this temp file
+_tmpout=$(mktemp /tmp/rkhunter.cron.XXXXXX)
+exec > ${_tmpout} 2>&1
+
+# update data files
+if [[ "${UPDATE}" == "yes" ]] ; then
+        # save the output of --update in a tmp file so that it can be mailed
+        # along with the scan output; otherwise the user will get 2 mails
+        #${RKHUNTER_EXEC} --nocolor --update
+        echo "In Gentoo, update option is disabled due to CVE-2017-7480."
+fi
+
+# formulate options string according to user configuration
+[[ "${LOG}" == "yes" ]] && \
+    RKHUNTER_OPTS="${RKHUNTER_OPTS} --createlogfile ${LOGFILE}"
+
+case "${VERBOSITY}" in
+        # warnings and errors only
+        1)      RKHUNTER_OPTS="${RKHUNTER_OPTS} --quiet" ;;
+        # default rkhunter output (no extra options)
+#       2)      ;;
+        # default to option 3
+        *)      ;;
+esac
+
+# save old log
+if [[ "${LOG}" == "yes" && "${SAVE_OLD_LOGS}" == "yes" ]] ; then
+        if [[ -e "${LOGFILE}" ]] ; then
+                _tmpfile=$(mktemp ${LOGFILE}.XXXXXX)
+                mv -f ${LOGFILE} ${_tmpfile}
+                echo -e "--\nrkhunter.cron commencing at: $(date)\n--" >> ${_tmpfile}
+        fi
+fi
+
+# finally, run rkhunter
+CMD="${RKHUNTER_EXEC} ${RKHUNTER_OPTS}"
+eval ${CMD}
+RV=$?
+
+# email output?
+if [[ "${SEND_EMAIL}" == "yes" ]] ; then
+        CMD="cat ${_tmpout} ${EMAIL_CMD}"
+        eval ${CMD}
+fi
+
+# remove temp file
+[[ -n "${_tmpout}" ]] && rm -f ${_tmpout}
+
+[[ "${LOG}" != "yes" ]] && exit ${RV}
+
+# from this point on, we can assume logging is enabled
+
+# append new log to old log and restore
+if [[ -n "${_tmpfile}" ]] ; then
+        cat ${LOGFILE} >> ${_tmpfile}
+        mv ${_tmpfile} ${LOGFILE}
+fi
+
+chmod ${LOGFILE_PERMS:-0644} ${LOGFILE}
+exit ${RV}
diff --git a/app-forensics/rkhunter/files/rkhunter.bash-completion b/app-forensics/rkhunter/files/rkhunter.bash-completion
new file mode 100644
index 000000000000..a28f96f510d1
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter.bash-completion
@@ -0,0 +1,87 @@
+# rkhunter completion
+
+_rkhunter() {
+	local cur prev opts
+	COMPREPLY=()
+	cur=${COMP_WORDS[COMP_CWORD]}
+	prev=${COMP_WORDS[COMP_CWORD-1]}
+	opts="-c --checkall --createlogfile --cronjob --display-logfile -h --help\
+		 --nocolors --report-mode --report-warnings-only \
+		 --skip-application-check --skip-keypress --quick --quiet --update \
+		 --version --versioncheck --bindir --configfile --dbdir --rootdir \
+		 --tmpdir --disable-md5-check --disable-passwd-check \
+		 --scan-knownbad-files" 
+
+	if [[ "${cur}" == -* ]] || [[ ${COMP_CWORD} -eq 1 ]]; then
+		COMPREPLY=($(compgen -W "${opts}" -- "${cur}"))
+	fi
+
+	case "${prev}" in
+		--createlogfile)
+			COMPREPLY=($(compgen -o filenames -A file -W "${opts/--createlogfile}" \
+			    -- "${cur}"))
+			;;
+		--display-logfile)
+			COMPREPLY=($(compgen -W "${opts/--display-logfile}" -- "${cur}"))
+			;;
+		--*dir)	
+			COMPREPLY=($(compgen -o dirnames -A directory -- "${cur}"))
+			;;
+		--*file)
+			COMPREPLY=($(compgen -o filenames -A file -- "${cur}"))
+			;;
+		-c|--checkall)
+			COMPREPLY=($(compgen -W "${opts/-c --checkall}" -- "${cur}"))
+			;;
+		--cronjob)
+			COMPREPLY=($(compgen -W "${opts/--cronjob}" -- "${cur}"))
+			;;
+		-h|--help)
+			COMPREPLY=($(compgen -W "${opts/-h --help}" -- "${cur}"))
+			;;
+		--nocolors)
+			COMPREPLY=($(compgen -W "${opts/--nocolors}" -- "${cur}"))
+			;;
+		--report-mode)
+			COMPREPLY=($(compgen -W "${opts/--report-mode}" -- "${cur}"))
+			;;
+		--report-warnings-only)
+			COMPREPLY=($(compgen -W "${opts/--report-warnings-only}" -- \
+				"${cur}"))
+			;;
+		--skip-application-check)
+			COMPREPLY=($(compgen -W "${opts/--skip-application-check}" -- \
+				"${cur}"))
+			;;
+		--skip-keypress)
+			COMPREPLY=($(compgen -W "${opts/--skip-keypress}" -- "${cur}"))
+			;;
+		--quick)
+			COMPREPLY=($(compgen -W "${opts/--quick}" -- "${cur}"))
+			;;
+		--quiet)
+			COMPREPLY=($(compgen -W "${opts/--quiet}" -- "${cur}"))
+			;;
+		--update)
+			COMPREPLY=($(compgen -W "${opts/--update}" -- "${cur}"))
+			;;
+		--version)
+			COMPREPLY=($(compgen -W "${opts/--version}" -- "${cur}"))
+			;;
+		--versioncheck)
+			COMPREPLY=($(compgen -W "${opts/--versioncheck}" -- "${cur}"))
+			;;
+		--disable-md5-check)
+			COMPREPLY=($(compgen -W "${opts/--disable-md5-check}" -- "${cur}"))
+			;;
+		--disable-passwd-check)
+			COMPREPLY=($(compgen -W "${opts/--disable-passwd-check}" -- \
+				"${cur}"))
+			;;
+		--scan-knownbad-files)
+			COMPREPLY=($(compgen -W "${opts/--scan-knownbad-files}" -- \
+				"${cur}"))
+			;;
+	esac
+}
+complete -F _rkhunter rkhunter
diff --git a/app-forensics/rkhunter/metadata.xml b/app-forensics/rkhunter/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/rkhunter/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/rkhunter/rkhunter-1.4.6-r2.ebuild b/app-forensics/rkhunter/rkhunter-1.4.6-r2.ebuild
new file mode 100644
index 000000000000..dc225c9b3dd8
--- /dev/null
+++ b/app-forensics/rkhunter/rkhunter-1.4.6-r2.ebuild
@@ -0,0 +1,66 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1
+
+DESCRIPTION="Rootkit Hunter scans for known and unknown rootkits, backdoors, and sniffers"
+HOMEPAGE="https://rkhunter.sf.net/"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}-grep-3.8.patch.xz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~arm ~mips ppc x86"
+IUSE="selinux"
+
+RDEPEND="
+	app-shells/bash
+	dev-lang/perl
+	sys-process/lsof[rpc]
+	selinux? ( sec-policy/selinux-rkhunter )
+"
+
+S="${WORKDIR}/${P}/files"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-1.4.6-conf.patch"
+	"${FILESDIR}/${PN}-1.4.6-no-insecure-web.patch"
+	"${WORKDIR}/${PN}-1.4.6-grep-3.8.patch"
+)
+
+src_install() {
+	# rkhunter requires to be root
+	dosbin ${PN}
+
+	insinto /etc
+	doins ${PN}.conf
+
+	exeinto /usr/lib/${PN}/scripts
+	doexe *.pl
+
+	insinto /var/lib/${PN}/db
+	doins *.dat
+
+	insinto /var/lib/${PN}/db/i18n
+	doins i18n/*
+
+	doman ${PN}.8
+	dodoc ACKNOWLEDGMENTS CHANGELOG FAQ README
+
+	exeinto /etc/cron.daily
+	newexe "${FILESDIR}/${PN}-1.4.cron" ${PN}
+
+	newbashcomp "${FILESDIR}/${PN}.bash-completion" ${PN}
+}
+
+pkg_postinst() {
+	elog "A cron script has been installed to /etc/cron.daily/rkhunter."
+	elog "To enable it, edit /etc/cron.daily/rkhunter and follow the"
+	elog "directions."
+	elog "If you want ${PN} to send mail, you will need to install"
+	elog "virtual/mailx or alter the EMAIL_CMD variable in the"
+	elog "cron script and possibly the MAIL_CMD variable in the"
+	elog "${PN}.conf file to use another mail client."
+}
diff --git a/app-forensics/scalpel/Manifest b/app-forensics/scalpel/Manifest
new file mode 100644
index 000000000000..f5dc0da44e6d
--- /dev/null
+++ b/app-forensics/scalpel/Manifest
@@ -0,0 +1 @@
+DIST scalpel-2.1_pre20210326.tar.gz 1445147 BLAKE2B f70e16d6854c6f781c2ec389b4595e25055bedc5c69b4c0713ae263d138f0bd9824641099e224cd1969688f6b0acb07c707072afe43955c8752391132eb9b84e SHA512 76811437f01125dcdb27e185ad4f82ba589461eb47638a32af4291b0b81803180e095ccf89440d6c50e35e641e9c3eed63d6ffb33715b5ebe0a3a73389c25e5f
diff --git a/app-forensics/scalpel/files/gcc-11-fix-literal-suffix.patch b/app-forensics/scalpel/files/gcc-11-fix-literal-suffix.patch
new file mode 100644
index 000000000000..55809d58e178
--- /dev/null
+++ b/app-forensics/scalpel/files/gcc-11-fix-literal-suffix.patch
@@ -0,0 +1,255 @@
+fix "invalid suffix on literal; C++11 requires a space between literal and string macro"
+
+--- a/src/dig.cpp
++++ b/src/dig.cpp
+@@ -378,10 +378,10 @@
+ 
+ 
+     if(state->skip) {
+-        fprintf(state->auditFile, "\nSkipped the first %"PRIu64 "bytes of %s...\n",
++        fprintf(state->auditFile, "\nSkipped the first %" PRIu64 "bytes of %s...\n",
+             state->skip, scalpelInputGetId(state->inReader));
+         if(state->modeVerbose) {
+-            fprintf(stdout, "\nSkipped the first %"PRIu64 "bytes of %s...\n",
++            fprintf(stdout, "\nSkipped the first %" PRIu64 "bytes of %s...\n",
+                 state->skip, scalpelInputGetId(state->inReader));
+         }
+     }
+@@ -448,7 +448,7 @@
+             // found a header--record location in header offsets database
+             if(state->modeVerbose) {
+ 
+-                fprintf(stdout, "A %s header was found at : %"PRIu64 "\n",
++                fprintf(stdout, "A %s header was found at : %" PRIu64 "\n",
+                     currentneedle->suffix,
+                     positionUseCoverageBlockmap(state, startLocation));
+ 
+@@ -478,7 +478,7 @@
+ 
+                     if(state->modeVerbose) {
+                         fprintf(stdout,
+-                            "Memory reallocation performed, total header storage = %"PRIu64 "\n",
++                            "Memory reallocation performed, total header storage = %" PRIu64 "\n",
+                             currentneedle->offsets.headerstorage);
+                     }
+             }
+@@ -494,7 +494,7 @@
+             // found a footer--record location in footer offsets database
+             if(state->modeVerbose) {
+ 
+-                fprintf(stdout, "A %s footer was found at : %"PRIu64 "\n",
++                fprintf(stdout, "A %s footer was found at : %" PRIu64 "\n",
+                     currentneedle->suffix,
+                     positionUseCoverageBlockmap(state, startLocation));
+ 
+@@ -524,7 +524,7 @@
+                     if(state->modeVerbose) {
+ 
+                         fprintf(stdout,
+-                            "Memory reallocation performed, total footer storage = %"PRIu64 "\n",
++                            "Memory reallocation performed, total footer storage = %" PRIu64 "\n",
+                             currentneedle->offsets.footerstorage);
+                     }
+             }
+@@ -618,7 +618,7 @@
+             // found a header--record location in header offsets database
+             if(state->modeVerbose) {
+ 
+-                fprintf(stdout, "A %s header was found at : %"PRIu64 "\n",
++                fprintf(stdout, "A %s header was found at : %" PRIu64 "\n",
+                     currentneedle->suffix,
+                     positionUseCoverageBlockmap(state, startLocation));
+             }
+@@ -647,7 +647,7 @@
+                     if(state->modeVerbose) {
+ 
+                         fprintf(stdout,
+-                            "Memory reallocation performed, total header storage = %"PRIu64 "\n",
++                            "Memory reallocation performed, total header storage = %" PRIu64 "\n",
+                             currentneedle->offsets.headerstorage);
+ 
+                     }
+@@ -756,7 +756,7 @@
+             startLocation = offset + (foundat[needlenum][i] - readbuffer);
+             if(state->modeVerbose) {
+ 
+-                fprintf(stdout, "A %s footer was found at : %"PRIu64 "\n",
++                fprintf(stdout, "A %s footer was found at : %" PRIu64 "\n",
+                     currentneedle->suffix,
+                     positionUseCoverageBlockmap(state, startLocation));
+             }
+@@ -784,7 +784,7 @@
+                     if(state->modeVerbose) {
+ 
+                         fprintf(stdout,
+-                            "Memory reallocation performed, total footer storage = %"PRIu64 "\n",
++                            "Memory reallocation performed, total footer storage = %" PRIu64 "\n",
+                             currentneedle->offsets.footerstorage);
+                     }
+             }
+@@ -991,7 +991,7 @@
+         state->inReader)) > longestneedle - 1) {
+ 
+             if(state->modeVerbose) {
+-                fprintf(stdout, "Read %"PRIu64 " bytes from image file.\n", bytesread);
++                fprintf(stdout, "Read %" PRIu64 " bytes from image file.\n", bytesread);
+             }
+ 
+             if((err = scalpelInputGetError(state->inReader))) {
+@@ -1106,7 +1106,7 @@
+ 
+ 
+     if(state->modeVerbose) {
+-        fprintf(stdout, "Total file size is %"PRIu64 " bytes\n", filesize);
++        fprintf(stdout, "Total file size is %" PRIu64 " bytes\n", filesize);
+     }
+ 
+ 
+@@ -1537,7 +1537,7 @@
+             fprintf(stdout, "%s", currentneedle->endtext);
+         }
+ 
+-        fprintf(stdout, "\" --> %"PRIu64 " files\n", currentneedle->numfilestocarve);
++        fprintf(stdout, "\" --> %" PRIu64 " files\n", currentneedle->numfilestocarve);
+ 
+ 
+     }
+@@ -1915,7 +1915,7 @@
+             (unsigned long
+             long)(ceil((double)filesize / (double)state->coverageblocksize));
+ 
+-        fprintf(stdout, "# of blocks in coverage blockmap is %"PRIu64 ".\n",
++        fprintf(stdout, "# of blocks in coverage blockmap is %" PRIu64 ".\n",
+             state->coveragenumblocks);
+ 
+ 
+@@ -1970,7 +1970,7 @@
+             (unsigned long long)ceil((double)filesize /
+             (double)state->coverageblocksize);
+ 
+-        fprintf(stdout, "# of blocks in coverage blockmap is %"PRIu64 ".\n",
++        fprintf(stdout, "# of blocks in coverage blockmap is %" PRIu64 ".\n",
+             state->coveragenumblocks);
+ 
+         fprintf(stdout, "Allocating and clearing in-core coverage bitmap.\n");
+@@ -2374,7 +2374,7 @@
+ 
+         if(state->modeVerbose && state->useCoverageBlockmap) {
+             fprintf(stdout,
+-                "Coverage map decreased current file position by %"PRIu64 " bytes.\n",
++                "Coverage map decreased current file position by %" PRIu64 " bytes.\n",
+                 (unsigned long long)decrease);
+         }
+     }
+@@ -2399,7 +2399,7 @@
+     if(state->useCoverageBlockmap) {
+         if(state->modeVerbose) {
+             fprintf(stdout,
+-                "Issuing coverage map-based READ, wants %"PRIu64 " bytes.\n",
++                "Issuing coverage map-based READ, wants %" PRIu64 " bytes.\n",
+                 neededbytes);
+         }
+ 
+@@ -2425,7 +2425,7 @@
+ 
+                 if(state->modeVerbose) {
+                     fprintf(stdout,
+-                        "fread using coverage map to skip %"PRIu64 " bytes.\n", bytestoskip);
++                        "fread using coverage map to skip %" PRIu64 " bytes.\n", bytestoskip);
+                 }
+ 
+                 scalpelInputSeeko(inReader, (off64_t) bytestoskip, SCALPEL_SEEK_CUR);
+@@ -2450,7 +2450,7 @@
+ 
+                 if(state->modeVerbose) {
+                     fprintf(stdout,
+-                        "fread using coverage map found %"PRIu64 " consecutive bytes.\n",
++                        "fread using coverage map found %" PRIu64 " consecutive bytes.\n",
+                         bytestoread);
+                 }
+ 
+@@ -2465,7 +2465,7 @@
+                 curpos += bytestoread;
+ 
+                 if(state->modeVerbose) {
+-                    fprintf(stdout, "fread using coverage map read %"PRIu64 " bytes.\n",
++                    fprintf(stdout, "fread using coverage map read %" PRIu64 " bytes.\n",
+                         bytesread);
+                 }
+         }
+@@ -2879,7 +2879,7 @@
+             }
+ 
+             // # of headers
+-            if(fprintf(dbfile, "%"PRIu64 "\n", currentneedle->offsets.numheaders)
++            if(fprintf(dbfile, "%" PRIu64 "\n", currentneedle->offsets.numheaders)
+                 <= 0) {
+ 
+                     fprintf(stderr,
+@@ -2893,7 +2893,7 @@
+             for(i = 0; i < currentneedle->offsets.numheaders; i++) {
+ #ifdef _WIN32
+                 if(fprintf
+-                    (dbfile, "%"PRIu64 "\n",
++                    (dbfile, "%" PRIu64 "\n",
+                     positionUseCoverageBlockmap(state,
+                     currentneedle->offsets.
+                     headers[i])) <= 0) {
+@@ -2913,7 +2913,7 @@
+             }
+ 
+             // # of footers
+-            if(fprintf(dbfile, "%"PRIu64 "\n", currentneedle->offsets.numfooters)
++            if(fprintf(dbfile, "%" PRIu64 "\n", currentneedle->offsets.numfooters)
+                 <= 0) {
+                     fprintf(stderr,
+                         "Error writing to header/footer database file: %s\n", fn);
+@@ -2925,7 +2925,7 @@
+             // all footer positions for current suffix
+             for(i = 0; i < currentneedle->offsets.numfooters; i++) {
+                 if(fprintf
+-                    (dbfile, "%"PRIu64 "\n",
++                    (dbfile, "%" PRIu64 "\n",
+                     positionUseCoverageBlockmap(state,
+                     currentneedle->offsets.
+                     footers[i])) <= 0) {
+--- a/src/helpers.cpp
++++ b/src/helpers.cpp
+@@ -528,7 +528,7 @@
+         if((scalpelInputSeeko(inReader, state->skip, SCALPEL_SEEK_SET))) {
+ 
+             fprintf(stderr,
+-                "ERROR: Couldn't skip %"PRIu64 " bytes at the start of input file %s\n",
++                "ERROR: Couldn't skip %" PRIu64 " bytes at the start of input file %s\n",
+                 state->skip, inputId);
+ 
+ 
+@@ -543,7 +543,7 @@
+         }
+         else {
+ 
+-            fprintf(stderr, "\nSkipped the first %"PRIu64 " bytes of %s...\n",
++            fprintf(stderr, "\nSkipped the first %" PRIu64 " bytes of %s...\n",
+                 state->skip, inputId);
+ 
+ 
+--- a/src/scalpel_exec.cpp
++++ b/src/scalpel_exec.cpp
+@@ -141,7 +141,7 @@
+     }
+ 
+     fprintf(stdout,
+-        "\nScalpel is done, files carved = %"PRIu64 ", elapsed  = %ld secs.\n",
++        "\nScalpel is done, files carved = %" PRIu64 ", elapsed  = %ld secs.\n",
+         state.fileswritten, (int)time(0) - starttime);
+ 
+     destroy_threading_model(&state);
+@@ -348,7 +348,7 @@
+             numopts++;
+             state->skip = strtoull(optarg, NULL, 10);
+             fprintf(stdout,
+-                "Skipping the first %"PRIu64 " bytes of each image file.\n", state->skip);
++                "Skipping the first %" PRIu64 " bytes of each image file.\n", state->skip);
+             break;
+ 
+         case 'c':
diff --git a/app-forensics/scalpel/files/musl-error_h.patch b/app-forensics/scalpel/files/musl-error_h.patch
new file mode 100644
index 000000000000..7f8139cf67a6
--- /dev/null
+++ b/app-forensics/scalpel/files/musl-error_h.patch
@@ -0,0 +1,83 @@
+https://raw.githubusercontent.com/gentoo/musl/master/dev-libs/elfutils/files/0.178/musl-error_h.patch
+
+From 9cb8fad40329cc6445233af0b6ac3f2adde19c65 Mon Sep 17 00:00:00 2001
+From: 
+Date: Thu, 12 Dec 2019 22:00:47 -0600
+Subject: [PATCH 9/9] Add hacked up error header for non GLIBC machines
+
+---
+ lib/error.h | 27 +++++++++++++++++++++++++++
+ src/error.h | 27 +++++++++++++++++++++++++++
+ 2 files changed, 54 insertions(+)
+ create mode 100644 lib/error.h
+ create mode 100644 src/error.h
+
+diff --git a/lib/error.h b/lib/error.h
+new file mode 100644
+index 0000000..ef06827
+--- /dev/null
++++ b/error.h
+@@ -0,0 +1,27 @@
++#ifndef _ERROR_H_
++#define _ERROR_H_
++
++#include <stdarg.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <errno.h>
++
++static unsigned int error_message_count = 0;
++
++static inline void error(int status, int errnum, const char* format, ...)
++{
++	va_list ap;
++	fprintf(stderr, "%s: ", program_invocation_name);
++	va_start(ap, format);
++	vfprintf(stderr, format, ap);
++	va_end(ap);
++	if (errnum)
++		fprintf(stderr, ": %s", strerror(errnum));
++	fprintf(stderr, "\n");
++	error_message_count++;
++	if (status)
++		exit(status);
++}
++
++#endif	/* _ERROR_H_ */
+diff --git a/src/error.h b/src/error.h
+new file mode 100644
+index 0000000..ef06827
+--- /dev/null
++++ b/src/error.h
+@@ -0,0 +1,27 @@
++#ifndef _ERROR_H_
++#define _ERROR_H_
++
++#include <stdarg.h>
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++#include <errno.h>
++
++static unsigned int error_message_count = 0;
++
++static inline void error(int status, int errnum, const char* format, ...)
++{
++	va_list ap;
++	fprintf(stderr, "%s: ", program_invocation_name);
++	va_start(ap, format);
++	vfprintf(stderr, format, ap);
++	va_end(ap);
++	if (errnum)
++		fprintf(stderr, ": %s", strerror(errnum));
++	fprintf(stderr, "\n");
++	error_message_count++;
++	if (status)
++		exit(status);
++}
++
++#endif	/* _ERROR_H_ */
+-- 
+2.24.1
+
diff --git a/app-forensics/scalpel/metadata.xml b/app-forensics/scalpel/metadata.xml
new file mode 100644
index 000000000000..993bfae01577
--- /dev/null
+++ b/app-forensics/scalpel/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>martin.dummer@gmx.net</email>
+    <name>Martin Dummer</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription lang="en">
+		Scalpel is a fast file carver that reads a database of header and footer
+		definitions and extracts matching files or data fragments from a set of image
+		files or raw device files. Scalpel is filesystem-independent and will carve
+		files from FATx, NTFS, ext2/3, HFS+, or raw partitions. It is useful for both
+		digital forensics investigation and file recovery.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/scalpel/scalpel-2.1_pre20210326.ebuild b/app-forensics/scalpel/scalpel-2.1_pre20210326.ebuild
new file mode 100644
index 000000000000..dd1fe9be6aed
--- /dev/null
+++ b/app-forensics/scalpel/scalpel-2.1_pre20210326.ebuild
@@ -0,0 +1,46 @@
+# Copyright 2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit autotools flag-o-matic
+
+DESCRIPTION="A high performance file carver"
+HOMEPAGE="https://github.com/sleuthkit/scalpel"
+SCALPEL_COMMIT="35e1367ef2232c0f4883c92ec2839273c821dd39"
+SRC_URI="https://github.com/sleuthkit/scalpel/archive/${SCALPEL_COMMIT}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/scalpel-${SCALPEL_COMMIT}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+DEPEND="dev-libs/tre"
+RDEPEND="${DEPEND}"
+BDEPEND="${DEPEND}"
+
+PATCHES=( "${FILESDIR}/gcc-11-fix-literal-suffix.patch" )
+DOCS=( Changelog README )
+
+src_prepare() {
+	# Set the default config file location
+	sed -e "s:scalpel.conf:/etc/\0:" -i src/scalpel.h || die "sed failed"
+
+	sed -e 's|AM_CPPFLAGS =.*|AM_CPPFLAGS = -std=c++11|' -i Makefile.am src/Makefile.am || die "sed failed"
+
+	# #716104 compile with musl misses error.h, solution borrowed from #701478
+	if use elibc_musl; then
+		eapply "${FILESDIR}/musl-error_h.patch"
+	fi
+
+	default
+	eautoreconf
+
+	filter-lto # https://bugs.gentoo.org/865687
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	doins scalpel.conf
+}
diff --git a/app-forensics/sleuthkit/Manifest b/app-forensics/sleuthkit/Manifest
new file mode 100644
index 000000000000..9c30a719b94b
--- /dev/null
+++ b/app-forensics/sleuthkit/Manifest
@@ -0,0 +1,3 @@
+DIST sleuthkit-4.12.1.tar.gz 3768424 BLAKE2B 506d21645cfe809994ebe3edac47402b3590ab4d5bc16260daa706b1fba5ceacf5eb2c3baa96cfa1b7404fbdfcf77705d6f28ddaf293e8d71a1e4cbde93f74a6 SHA512 f3efe1339edc9eb07023975a1e2e2dc7bc47d61d838aada941b7591e2c5beb74fc5298ebf68ae71875bf8f0f09c0d7929a11762fa47840e7e18398d3ff80b9fc
+DIST sleuthkit-libewf_64bit-20130416.tar.gz 23818247 BLAKE2B 23be933ed8a74e4834ee6571a28d81ba16e98e4e4e27b5b1b3b655d1d92a6eadcba35aadf96aa404e6e0a225b27f3f5daff2836879b87fe58440a3ad5645de44 SHA512 611cbb57de17600caee0330bbe9917c4481d7711a35dba8c072fd49cd3e1714e0a3ce30fd8fcac9981db848e80870bf5d215326c56808bb6f5b4c8dcc1e5a3c9
+DIST sqlite-jdbc-3.42.0.0.jar 13030515 BLAKE2B 02ffee9875fefd3f2ba4e9115d0b4fee53163bab994830b28033159ab08df264e5f86bbcfb7d1fae145c9aaafc6537fb9084594ce6b21c9715226a1cf644f174 SHA512 6d0491f7f2f542629f4e69d5891ded85e887f0d8dad8c4568ead07b1eda79e0b97f625374a635f12d419d2f42a4049976365e0a8265ee371172f330be9571616
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch
new file mode 100644
index 000000000000..efa335068333
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch
@@ -0,0 +1,55 @@
+--- sleuthkit-4.1.0/tools/autotools/Makefile.am
++++ sleuthkit-4.1.0/tools/autotools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+ 
+ bin_PROGRAMS = tsk_recover tsk_loaddb tsk_comparedir tsk_gettimes
+--- sleuthkit-4.1.0/tools/fstools/Makefile.am
++++ sleuthkit-4.1.0/tools/fstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall 
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro fscheck.cpp
+ 
+ bin_PROGRAMS = blkcalc blkcat blkls blkstat ffind fls fcat fsstat icat ifind ils \
+--- sleuthkit-4.1.0/tools/hashtools/Makefile.am
++++ sleuthkit-4.1.0/tools/hashtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall 
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro md5.c sha1.c
+ 
+ bin_PROGRAMS = hfind
+--- sleuthkit-4.1.0/tools/imgtools/Makefile.am
++++ sleuthkit-4.1.0/tools/imgtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+ 
+ bin_PROGRAMS = img_cat img_stat
+--- sleuthkit-4.1.0/tools/srchtools/Makefile.am
++++ sleuthkit-4.1.0/tools/srchtools/Makefile.am
+@@ -6,7 +6,6 @@
+ 
+ sigfind_SOURCES = sigfind.cpp 
+ sigfind_LDADD = ../../tsk/libtsk.la
+-sigfind_LDFLAGS = -static
+ 
+ indent:
+ 	indent *.c *.cpp
+--- sleuthkit-4.1.0/tools/vstools/Makefile.am
++++ sleuthkit-4.1.0/tools/vstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall 
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+ 
+ bin_PROGRAMS = mmls mmstat mmcat
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.10.1-exclude-usr-local.patch b/app-forensics/sleuthkit/files/sleuthkit-4.10.1-exclude-usr-local.patch
new file mode 100644
index 000000000000..256dc54548b0
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.10.1-exclude-usr-local.patch
@@ -0,0 +1,28 @@
+From: Gokturk Yuksek <gokturk@gentoo.org>
+
+Do not allow the build system to use libs from /usr/local.
+
+Bug: https://bugs.gentoo.org/774039
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -92,19 +92,6 @@
+ dnl Enable multithreading by default in the presence of pthread
+ AS_IF([test "x$ax_pthread_ok" = "xyes" && test "x$enable_multithreading" != "xno"], [ax_multithread=yes], [ax_multithread=no])
+ 
+-case "$host" in
+-*-*-mingw*)
+-  dnl Adding the native /usr/local is wrong for cross-compiling
+-  ;;
+-*)
+-  dnl Not all compilers include /usr/local in the include and link path
+-  if test -d /usr/local/include; then
+-    CPPFLAGS="$CPPFLAGS -I/usr/local/include"
+-    LDFLAGS="$LDFLAGS -L/usr/local/lib"
+-  fi
+-  ;;
+-esac
+-
+ dnl Add enable/disable option
+ AC_ARG_ENABLE([java],
+     [AS_HELP_STRING([--disable-java], [Do not build the java bindings or jar file])])
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.12.0-configure-ac-test-fix.patch b/app-forensics/sleuthkit/files/sleuthkit-4.12.0-configure-ac-test-fix.patch
new file mode 100644
index 000000000000..2bb52435fd9a
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.12.0-configure-ac-test-fix.patch
@@ -0,0 +1,34 @@
+https://github.com/sleuthkit/sleuthkit/pull/2835
+
+From fd19051920849343631df1cbf8d4b86f1bf98b2c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=B6kt=C3=BCrk=20Y=C3=BCksek?= <gokturk@gentoo.org>
+Date: Mon, 26 Jun 2023 22:05:47 -0700
+Subject: [PATCH] configure.ac: use '=' for comparison instead of '=='
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The operator '==' isn't POSIX compliant[0]. Use the standard '=', as it's
+done everywhere else in configure.ac.
+
+[0] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/test.html
+
+Bug: https://bugs.gentoo.org/870250
+Signed-off-by: Göktürk Yüksek <gokturk@gentoo.org>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index c4226f5be4..bec6ddbf62 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -252,7 +252,7 @@ AS_IF([test "x$enable_java" != "xno"], [
+ dnl if we found everything we need, set ax_java_support for the
+ dnl status message and set X_JNI for use in Makefile
+ AS_IF([test "x$JNI_CPPFLAGS" != x && test "x$ANT_FOUND" != x && test "x$JAVA" != x], [ax_java_support=yes], [ax_java_support=no])
+-AM_CONDITIONAL([X_JNI],[test "x$ax_java_support" == "xyes"])
++AM_CONDITIONAL([X_JNI],[test "x$ax_java_support" = "xyes"])
+ 
+ AC_CONFIG_COMMANDS([tsk/tsk_incs.h],
+     [echo "#ifndef _TSK_INCS_H" > tsk/tsk_incs.h
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.12.1-c23.patch b/app-forensics/sleuthkit/files/sleuthkit-4.12.1-c23.patch
new file mode 100644
index 000000000000..59b8083c6fd6
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.12.1-c23.patch
@@ -0,0 +1,30 @@
+https://bugs.gentoo.org/943976
+https://github.com/sleuthkit/sleuthkit/commit/dc9b299ea2c4fd4d79305df1e62073aac14fdb2e
+
+From dc9b299ea2c4fd4d79305df1e62073aac14fdb2e Mon Sep 17 00:00:00 2001
+From: Joel Uckelman <joel.uckelman@aon.com>
+Date: Fri, 1 Nov 2024 18:11:25 +0000
+Subject: [PATCH] Don't redefine bool. That causes collisions.
+
+--- a/tsk/base/crc.h
++++ b/tsk/base/crc.h
+@@ -91,7 +91,6 @@ Status  : Copyright (C) Ross Williams, 1993. However, permission is
+ #ifndef DONE_STYLE
+ 
+ typedef unsigned long   ulong;
+-typedef unsigned        bool;
+ typedef unsigned char * p_ubyte_;
+ 
+ #ifndef TRUE
+@@ -120,8 +119,8 @@ typedef struct
+    int   cm_width;   /* Parameter: Width in bits [8,32].       */
+    ulong cm_poly;    /* Parameter: The algorithm's polynomial. */
+    ulong cm_init;    /* Parameter: Initial register value.     */
+-   bool  cm_refin;   /* Parameter: Reflect input bytes?        */
+-   bool  cm_refot;   /* Parameter: Reflect output CRC?         */
++   unsigned cm_refin;   /* Parameter: Reflect input bytes?        */
++   unsigned cm_refot;   /* Parameter: Reflect output CRC?         */
+    ulong cm_xorot;   /* Parameter: XOR this to output CRC.     */
+ 
+    ulong cm_reg;     /* Context: Context during execution.     */
+
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.6.4-default-jar-location-fix.patch b/app-forensics/sleuthkit/files/sleuthkit-4.6.4-default-jar-location-fix.patch
new file mode 100644
index 000000000000..126fce904a8f
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.6.4-default-jar-location-fix.patch
@@ -0,0 +1,58 @@
+From f8c1cada7f01826b15a82b20600b8df7562fa2ed Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=B6kt=C3=BCrk=20Y=C3=BCksek?= <gokturk@gentoo.org>
+Date: Wed, 28 Nov 2018 21:33:46 -0500
+Subject: [PATCH v1] Allow --enable-offline to accept a directory argument for
+ jar libs
+
+Allow the hardcoded default_jar_location in build.xml to
+/usr/share/java to be changed using the argument provided to
+--enable-offline. Note that this changes the behavior of the switch
+from "anything other than yes or no is incorrect" to "anything other
+than no implies offline mode".
+---
+ bindings/java/Makefile.am |  4 ++++
+ configure.ac              | 10 +++++++++-
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+diff --git a/bindings/java/Makefile.am b/bindings/java/Makefile.am
+index ad27526e..f0bb9f68 100644
+--- a/bindings/java/Makefile.am
++++ b/bindings/java/Makefile.am
+@@ -7,6 +7,10 @@ jar_DATA = $(tsk_jar)
+ 
+ if OFFLINE
+  ant_args=-Doffline=true
++if CUSTOM_DEFAULT_JAR_LOCATION
++  ant_args+= -Ddefault-jar-location="@DEFAULT_JAR_LOCATION@"
++else
++endif
+ else
+ 
+ endif
+diff --git a/configure.ac b/configure.ac
+index dc9026ed..d3d41646 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -221,10 +221,18 @@ AC_ARG_ENABLE([offline],
+     [case "${enableval}" in
+ 	yes) offline=true ;;
+ 	no) offline=false ;;
+-	*) AC_MSG_ERROR([bad value ${enableval} for --enable-online]) ;;
++	*)
++	    offline=true
++	    default_jar_location="${enableval}"
++	    ;;
+      esac],[offline=false])
+ 
+ AM_CONDITIONAL([OFFLINE], [test "x$offline" = xtrue])
++AM_CONDITIONAL([CUSTOM_DEFAULT_JAR_LOCATION], [test "x$default_jar_location" != "x"])
++AM_COND_IF([CUSTOM_DEFAULT_JAR_LOCATION],
++    [AC_SUBST([DEFAULT_JAR_LOCATION], [$default_jar_location])]
++)
++
+ 
+ 
+ dnl Check if we should link libewf.
+-- 
+2.19.1
+
diff --git a/app-forensics/sleuthkit/metadata.xml b/app-forensics/sleuthkit/metadata.xml
new file mode 100644
index 000000000000..041fb969b6fe
--- /dev/null
+++ b/app-forensics/sleuthkit/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="aff">Enable extra aff formats</flag>
+    <flag name="ewf">Enable libewf support</flag>
+  </use>
+  <slots>
+    <subslots>Reflect ABI compatibility for libtsk.so</subslots>
+  </slots>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:sleuthkit:the_sleuth_kit</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/sleuthkit/sleuthkit-4.12.1-r2.ebuild b/app-forensics/sleuthkit/sleuthkit-4.12.1-r2.ebuild
new file mode 100644
index 000000000000..4857ab4ddaeb
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.12.1-r2.ebuild
@@ -0,0 +1,327 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools java-pkg-opt-2
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="https://www.sleuthkit.org/sleuthkit/"
+# TODO: sqlite-jdbc does not exist in the tree, we bundle it for now
+#		See: https://bugs.gentoo.org/690010
+# TODO: Upstream uses a very specific version of libewf which is not in
+#       the tree anymore. So we statically compile and link to sleuthkit.
+#       Hopefully upstream will figure something out in the future.
+#		See: https://bugs.gentoo.org/689752
+SRC_URI="https://github.com/${PN}/${PN}/releases/download/${P}/${P}.tar.gz
+	java? (
+		https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.42.0.0/sqlite-jdbc-3.42.0.0.jar
+	)
+	ewf? ( https://github.com/sleuthkit/libewf_64bit/archive/VisualStudio_2010.tar.gz
+			-> sleuthkit-libewf_64bit-20130416.tar.gz )"
+
+LICENSE="BSD CPL-1.0 GPL-2+ IBM java? ( Apache-2.0 )"
+SLOT="0/19" # subslot = major soname version
+KEYWORDS="amd64 ~hppa ppc x86"
+IUSE="aff doc ewf java static-libs test +threads zlib"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-db/sqlite:3
+	dev-lang/perl:*
+	aff? ( app-forensics/afflib )
+	ewf? ( virtual/zlib:= )
+	java? (
+		>=dev-java/c3p0-0.9.5.5:0
+		dev-java/commons-lang:3.6
+		>=dev-java/commons-validator-1.6:0
+		>=dev-java/gson-2.8.5:0
+		dev-java/guava:0
+		>=dev-java/jdbc-postgresql-9.4:0
+		>=dev-java/joda-time-2.4:0
+		>=dev-java/mchange-commons-0.2.20:0
+		dev-java/sparsebitset:0
+	)
+	zlib? ( virtual/zlib:= )
+"
+# TODO: add support for not-in-tree libraries:
+# libvhdi: https://github.com/libyal/libvhdi
+# libvmdk: https://github.com/libyal/libvmdk
+# libvslvm: https://github.com/libyal/libvslvm
+#   Upstream also says "A stand-alone version of libbfio is needed
+#   to allow libvslvm to directly read from a TSK_IMAGE." Not sure
+#   what it means yet.
+#
+# DEPEND="${DEPEND}
+# 	vhdi? ( dev-libs/libvhdi )
+# 	vmdk? ( dev-libs/libvmdk )
+#   vslvm? ( dev-libs/libvslvm dev-libs/libbfio )
+# "
+
+RDEPEND="${DEPEND}
+	java? ( virtual/jre:1.8 )
+"
+DEPEND="${DEPEND}
+	java? ( virtual/jdk:1.8 )
+	test? (
+		>=dev-util/cppunit-1.2.1
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	java? ( >=dev-java/ant-1.10.14-r3:0 )
+	doc? ( app-text/doxygen )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.1.0-tools-shared-libs.patch
+	"${FILESDIR}"/${PN}-4.6.4-default-jar-location-fix.patch
+	"${FILESDIR}"/${PN}-4.10.1-exclude-usr-local.patch
+	"${FILESDIR}"/${PN}-4.12.0-configure-ac-test-fix.patch
+	"${FILESDIR}"/${PN}-4.12.1-c23.patch
+)
+
+src_unpack() {
+	local f
+
+	unpack ${P}.tar.gz
+
+	if use ewf; then
+		pushd "${T}" &>/dev/null || die
+		unpack sleuthkit-libewf_64bit-20130416.tar.gz
+		export TSK_LIBEWF_SRCDIR="${T}"/libewf_64bit-VisualStudio_2010
+		popd &>/dev/null || die
+	fi
+
+	# Copy the jar files that don't exist in the tree yet
+	if use java; then
+		TSK_JAR_DIR="${T}/lib"
+		mkdir "${TSK_JAR_DIR}" || die
+		for f in ${A}; do
+			if [[ ${f} =~ .jar$ ]]; then
+				cp "${DISTDIR}"/"${f}" "${TSK_JAR_DIR}" || die
+			fi
+		done
+		export TSK_JAR_DIR
+	fi
+}
+
+tsk_prepare_libewf() {
+	# Inlining breaks the compilation, disable it
+	sed -e 's/LIBUNA_INLINE inline/LIBUNA_INLINE/' \
+		-i "${TSK_LIBEWF_SRCDIR}"/libuna/libuna_inline.h || die
+}
+
+src_prepare() {
+	use ewf && tsk_prepare_libewf
+
+	# Do not pass '-Werror'. This is overkill for user builds.
+	sed -e '/AM_CXXFLAGS/ s/-Werror//g' \
+		-i tsk/util/Makefile.am \
+		-i tsk/pool/Makefile.am || die
+	# Remove -static from LDFLAGS because it doesn't actually create
+	# a static binary. It confuses libtool, who then inserts rpath
+	sed -e '/LDFLAGS/ s/-static//' \
+		-i tools/pooltools/Makefile.am || die
+
+	if use java; then
+		pushd "${S}"/bindings/java &>/dev/null || die
+
+		# Prevent "make install" from installing
+		# jar files under /usr/share/java
+		# We'll use the java eclasses for this
+		# See: https://github.com/sleuthkit/sleuthkit/pull/1379
+		sed -e '/^jar_DATA/ d;' -i Makefile.am || die
+
+		java-pkg-opt-2_src_prepare
+
+		popd &>/dev/null || die
+
+		# Call ant with jar target for case-uco.
+		# The default invocation of ant tries to
+		# run junit tests, which there are none.
+		# It ends up failing with:
+		# junit.framework.AssertionFailedError: No tests found in org.sleuthkit.caseuco.TestSuite
+		sed -e '/\tant \$(ant_args)/ s|$| jar|' \
+			-i "${S}"/case-uco/java/Makefile.am \
+			|| die
+
+		export ANT_OPTS=" -Dant.build.javac.source=$(java-pkg_get-source)"
+		export ANT_OPTS+=" -Dant.build.javac.target=$(java-pkg_get-target)"
+
+		java-pkg-opt-2_src_prepare
+	fi
+
+	# Override the doxygen output directories
+	if use doc; then
+		sed -e "/^OUTPUT_DIRECTORY/ s|=.*$|= ${T}/doc|" \
+			-i tsk/docs/Doxyfile \
+			-i bindings/java/doxygen/Doxyfile || die
+	fi
+
+	# It's safe to call this even after java-pkg-opt-2_src_prepare
+	# because future calls to eapply_user do nothing and return 0
+	default
+
+	eautoreconf
+}
+
+tsk_compile_libewf() {
+	local myeconfargs=(
+		--prefix=/
+		--libdir=/lib
+		--enable-static
+		--disable-shared
+		--disable-winapi
+		--without-libbfio
+		--with-zlib
+		--without-bzip2
+		--without-libhmac
+		--without-openssl
+		--without-libuuid
+		--without-libfuse
+
+		--with-libcstring=no
+		--with-libcerror=no
+		--with-libcdata=no
+		--with-libclocale=no
+		--with-libcnotify=no
+		--with-libcsplit=no
+		--with-libuna=no
+		--with-libcfile=no
+		--with-libcpath=no
+		--with-libbfio=no
+		--with-libfcache=no
+		--with-libfvalue=no
+
+	)
+	# We want to contain our build flags
+	local CFLAGS="${CFLAGS}"
+	local LDFLAGS="${LDFLAGS}"
+
+	pushd "${TSK_LIBEWF_SRCDIR}" &>/dev/null || die
+
+	# Produce relocatable code
+	CFLAGS+=" -fPIC"
+	LDFLAGS+=" -fPIC"
+	econf "${myeconfargs[@]}"
+
+	# Do not waste CPU cycles on building ewftools
+	sed -e '/ewftools/ d' -i Makefile || die
+	emake
+
+	# Only install the headers and the library
+	emake -C libewf DESTDIR="${T}"/image install
+	emake -C include DESTDIR="${T}"/image install
+	find "${T}"/image -name '*.la' -delete || die
+
+	popd &>/dev/null || die
+}
+
+src_configure() {
+	local myeconfargs=(
+		--enable-offline="${TSK_JAR_DIR}"
+		$(use_enable java)
+		$(use_enable static-libs static)
+		$(use_enable test cppunit)
+		$(use_enable threads multithreading)
+		$(use_with aff afflib)
+		$(use_with zlib)
+	)
+	# TODO: add support for non-existing libraries:
+	# myeconfargs+=(
+	# 	$(use_with vhdi libvhdi)
+	# 	$(use_with vmdk libvmdk)
+	# 	$(use_with vslvm libvslvm)
+	# 	$(use_with vslvm libbfio) # not a typo
+	# )
+	myeconfargs+=(
+		--without-libvhdi
+		--without-libvmdk
+		--without-libvslvm
+		--without-libbfio
+	)
+
+	use ewf && tsk_compile_libewf
+	myeconfargs+=( $(use_with ewf libewf "${T}"/image) )
+
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	# Give it an existing bogus ivy home #672220
+	local -x IVY_HOME="${T}"
+
+	# Create symlinks of jars for the required dependencies
+	if use java; then
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" c3p0
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" commons-lang:3.6
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" commons-validator
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" gson
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" guava
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" jdbc-postgresql
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" joda-time
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" mchange-commons
+		java-pkg_jar-from --into "${TSK_JAR_DIR}" sparsebitset
+
+		# case-uco needs gson and expects it under case-uco/java/lib
+		# symlink it to the jar dir we create for java bindings
+		ln -s "${TSK_JAR_DIR}" "${S}"/case-uco/java/lib || die
+		ln -s ./gson.jar "${TSK_JAR_DIR}"/gson-2.8.5.jar || die
+	fi
+
+	# Create the doc output dirs if requested
+	if use doc; then
+		mkdir -p "${T}"/doc/{api-docs,jni-docs} || die
+	fi
+
+	emake all $(usex doc api-docs "")
+}
+
+src_install() {
+	# Give it an existing bogus ivy home #756766
+	local -x IVY_HOME="${T}"
+	local f
+
+	if use java; then
+		pushd "${S}"/bindings/java &>/dev/null || die
+
+		# Install case-uco
+		pushd "${S}"/case-uco/java &>/dev/null || die
+		java-pkg_newjar "dist/${PN}-caseuco-${PV}".jar "${PN}-caseuco.jar"
+		popd || die
+
+		# Install the bundled jar files as well as the
+		# sleuthkit jar installed here by case-uco
+		pushd "${TSK_JAR_DIR}" &>/dev/null || die
+		for f in *; do
+			# Skip the symlinks java-pkg_jar-from created
+			[[ -L ${f} ]] && continue
+
+			# Strip the version numbers as per eclass recommendation
+			[[ ${f} =~ -([0-9]+\.)+jar$ ]] || continue
+
+			java-pkg_newjar "${f}" "${f/${BASH_REMATCH[0]}/.jar}"
+		done
+		popd &>/dev/null || die
+
+		popd &>/dev/null || die
+	fi
+
+	default
+	# Default install target for case-uco installs the jar in the wrong place
+	rm -r "${ED}"/usr/share/java
+
+	# It unconditionally builds both api and jni docs
+	# We install conditionally based on the provided use flags
+	if use doc; then
+		dodoc -r "${T}"/doc/api-docs
+		use java && dodoc -r "${T}"/doc/jni-docs
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
+
+src_test() {
+	emake -C "${S}"/unit_tests check
+}
diff --git a/app-forensics/unhide/Manifest b/app-forensics/unhide/Manifest
new file mode 100644
index 000000000000..fece606b0e0b
--- /dev/null
+++ b/app-forensics/unhide/Manifest
@@ -0,0 +1 @@
+DIST unhide-20220611.tgz 80219 BLAKE2B 70cd485197aa22387852b2f71831d9dcf02e2357b798184844d9289796717256ab28d555c29503c53b32718246dc32afccd386decce75dde5a50a35782569ba4 SHA512 0b2bb7d1a536fe572cce94b438cae0495a969e40014e95b2d19406c3108ce05ec8d722d77b76d4095a1dc5cf8fb6613f3e5df295ce10a08648d7c7390aa4500e
diff --git a/app-forensics/unhide/metadata.xml b/app-forensics/unhide/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/unhide/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/unhide/unhide-20220611.ebuild b/app-forensics/unhide/unhide-20220611.ebuild
new file mode 100644
index 000000000000..50157b6d2d57
--- /dev/null
+++ b/app-forensics/unhide/unhide-20220611.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit edo toolchain-funcs
+
+DESCRIPTION="Forensic tool to find hidden processes and TCP/UDP ports by rootkits/LKMs"
+HOMEPAGE="https://www.unhide-forensics.info"
+SRC_URI="https://github.com/YJesus/Unhide/archive/refs/tags/v${PV}.tar.gz -> ${P}.tgz"
+S="${WORKDIR}/Unhide-${PV}"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+src_compile() {
+	edo $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static -pthread \
+		unhide-linux*.c unhide-output.c -o unhide
+	edo $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static \
+		unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp
+}
+
+src_install() {
+	dobin ${PN}
+	dobin ${PN}-tcp
+	dodoc changelog README.txt TODO LEEME.txt LISEZ-MOI.TXT NEWS TODO
+	doman man/unhide.8 man/unhide-tcp.8
+	has "fr" ${LINGUAS} && newman man/fr/unhide.8 unhide.fr.8
+	has "es" ${LINGUAS} && newman man/es/unhide.8 unhide.es.8
+}
diff --git a/app-forensics/volatility3/Manifest b/app-forensics/volatility3/Manifest
new file mode 100644
index 000000000000..7a1f58904e8e
--- /dev/null
+++ b/app-forensics/volatility3/Manifest
@@ -0,0 +1,12 @@
+DIST volatility3-2.27.0-symbols-linux.zip 2980184 BLAKE2B 53cd49663938c6f39e71193ae225e4985f8d0e6d301f2420eaa021c2722bfa6f9c9e7d029854b81f4cdd47bf2870e28efeff432fdc1281842b54ee9ffe6e3807 SHA512 59056044c3702c1ffd5f1490cb457831d65d1f48fbc523da92b950963155df994a2ff2f11abd5f3b1a977c7f28ed48b3b256c88f81dfa96a66419cb50934ba49
+DIST volatility3-2.27.0-symbols-mac.zip 84808562 BLAKE2B d10ecf88cc17653373a765b5b49a6025b334565c8aeeeb2069651ad93ad610c613097ada02fedab734f02f4004fc029204d552b44b049ba9ae2d0c72f05d166f SHA512 51063f2023227ecc4492063054e898a99d094a03b9777b1dd6da8dffe38686a6836fdffa22c44bd62f1bd4119aeee0b84714857dc61e434dcbfb7f41fec22c12
+DIST volatility3-2.27.0-symbols-windows.zip 839727133 BLAKE2B a9631b35fc57f079ca3c856d2b8082b263683895c832e468efa9daf5103ce000dde313f343c37b37266eaf5c7b616ccae797a98a7504095640a30e07bb2c432f SHA512 077dde23120ce03d999580acff3c5b10a657d71bcedc3c6373d89e3b3211e1cf0759e22793b49f34ad397c4acf4c150410aff6ec3a4ef9c097de948e3369801b
+DIST volatility3-2.27.0.gh.tar.gz 1176116 BLAKE2B 36ea52b126174d02eb6fb0072130b956e47dbe0bbba7150f28615ab2f784ec30893e3d6f9f92a3d02dc08ac2cd54cc7fa77722ee96f570fbf9a81411747c3995 SHA512 f3a6e0ccbe24275db834389f077e957bbb7a398d62b8cc41bbf253d74e684348586ff33c6ba403260098a3598a61f9bccf7dfe2fafecfc936da3da7cf6437c69
+DIST volatility3-2.28.0-symbols-linux.zip 2980184 BLAKE2B 53cd49663938c6f39e71193ae225e4985f8d0e6d301f2420eaa021c2722bfa6f9c9e7d029854b81f4cdd47bf2870e28efeff432fdc1281842b54ee9ffe6e3807 SHA512 59056044c3702c1ffd5f1490cb457831d65d1f48fbc523da92b950963155df994a2ff2f11abd5f3b1a977c7f28ed48b3b256c88f81dfa96a66419cb50934ba49
+DIST volatility3-2.28.0-symbols-mac.zip 84808562 BLAKE2B d10ecf88cc17653373a765b5b49a6025b334565c8aeeeb2069651ad93ad610c613097ada02fedab734f02f4004fc029204d552b44b049ba9ae2d0c72f05d166f SHA512 51063f2023227ecc4492063054e898a99d094a03b9777b1dd6da8dffe38686a6836fdffa22c44bd62f1bd4119aeee0b84714857dc61e434dcbfb7f41fec22c12
+DIST volatility3-2.28.0-symbols-windows.zip 839727133 BLAKE2B a9631b35fc57f079ca3c856d2b8082b263683895c832e468efa9daf5103ce000dde313f343c37b37266eaf5c7b616ccae797a98a7504095640a30e07bb2c432f SHA512 077dde23120ce03d999580acff3c5b10a657d71bcedc3c6373d89e3b3211e1cf0759e22793b49f34ad397c4acf4c150410aff6ec3a4ef9c097de948e3369801b
+DIST volatility3-2.28.0.gh.tar.gz 1191907 BLAKE2B 9e3720bba5df03b432619dafabe6efa30caa2646dceefab21788ba83aca4a04c922964ccc44310daeb9eef52a80af0e2afdbf5d24b11496e8330483df07560eb SHA512 d92ef665b89b4085531b527e2f51f57a3172f121ce3dca1a3d9b2e14fb684803b5f57e821999154d2f635d3e446e5db7b1ad8adfecb9301a36be9e5132c3968c
+DIST volatility3-linux-sample-1.bin.gz 143967523 BLAKE2B 3321e991a50b6e4ccf19e0ee48d779664f43f4cdbdb950ca31a5d08c8ee9de0018e2d4f69f42206f7e8f1c6ea735c47f8aa42806ed0f85e9a837b611f07b3289 SHA512 82a34aa1d4e7d7deb9ea12e892f14ba0a28908b2da2e31ca76efd1e9e59d87769064a1ffffe8979a58b992cea7005fa20954df50984dbe1dd186513ad95168d7
+DIST volatility3-symbols-symbols_win-10_19041-2025_03.zip 789065 BLAKE2B efe8fb700e1f9388807fe36277faf7459f5e23af0ff11cac713057611a3679315ef6f155d3bf8c768ff0802d0ca807bb529e52b2600e99b8e31fd876e960fa05 SHA512 381c982753f628cef4997d894a7569453ecd34774e09259e87481b94c46a068332f5eb23d0290ee75308752b41cb6abecf322eb50d73bd7e1c5b097aec32ae1f
+DIST volatility3-win-10_19041-2025_03.dmp.gz 693221397 BLAKE2B 4549ef7631150cf88c0e82025ff7f14b8ce3e238abe9ffbc540a9262b17e06fcfad96b4bd633596d02b40394c7a546c9d61ed36b4adb466ec5f6a39afd644dca SHA512 7554ad59a086f18b972a4306975d96e79f595b853680052efe98954a9108b8368acc47276c7c48af5e42cecc309dfb454b1c42ac538dd2b007ab0b7036e73aba
+DIST volatility3-win-xp-laptop-2005-06-25.img.gz 180343409 BLAKE2B 9fc10ddb9208d7023854e9619f6cf5ce140f2a2aa5772ccd8bcd852dd50c6f77e36298dbf7df1512334e7976b6ab35dd77f4c49505e531c3a289dd0f26cfc01e SHA512 a1f758cc1b4febcf11f64bc01b872c7528d19c686d81f8e03d742424fa0600254914e656cdf35c3752b406354f769a8aa256622b2f2afe2d691c4bb6d3be3f52
diff --git a/app-forensics/volatility3/metadata.xml b/app-forensics/volatility3/metadata.xml
new file mode 100644
index 000000000000..997a7196a173
--- /dev/null
+++ b/app-forensics/volatility3/metadata.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>mario.haustein@hrz.tu-chemnitz.de</email>
+    <name>Mario Haustein</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>sam@gentoo.org</email>
+    <name>Sam James</name>
+  </maintainer>
+  <longdescription>
+		Volatility is the world's most widely used framework for extracting
+		digital artifacts from volatile memory (RAM) samples. The extraction
+		techniques are performed completely independent of the system being
+		investigated but offer visibility into the runtime state of the system.
+	</longdescription>
+  <use>
+    <flag name="crypt">support plugins that decrypt passwords, password hashes, etc.</flag>
+    <flag name="disasm">support plugins that perform malware analysis and disassemble code</flag>
+    <flag name="jsonschema">improve error messages regarding improperly configured ISF files</flag>
+    <flag name="leechcore">support memory acquisition via leechcore</flag>
+    <flag name="snappy">support AVMLs native compression format</flag>
+    <flag name="yara">support YARA pattern matching engine</flag>
+  </use>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/volatility3/volatility3-2.27.0.ebuild b/app-forensics/volatility3/volatility3-2.27.0.ebuild
new file mode 100644
index 000000000000..cae987af5ad0
--- /dev/null
+++ b/app-forensics/volatility3/volatility3-2.27.0.ebuild
@@ -0,0 +1,102 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+inherit distutils-r1
+
+MY_PV=${PV//_beta/-beta.}
+
+DESCRIPTION="Framework for analyzing volatile memory"
+HOMEPAGE="https://github.com/volatilityfoundation/volatility3/ https://www.volatilityfoundation.org/"
+SRC_URI="
+	https://github.com/volatilityfoundation/volatility3/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz
+	https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip -> ${P}-symbols-linux.zip
+	https://downloads.volatilityfoundation.org/volatility3/symbols/mac.zip -> ${P}-symbols-mac.zip
+	https://downloads.volatilityfoundation.org/volatility3/symbols/windows.zip -> ${P}-symbols-windows.zip
+	test?
+	(
+		https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz -> ${PN}-linux-sample-1.bin.gz
+		https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz -> ${PN}-win-xp-laptop-2005-06-25.img.gz
+		https://downloads.volatilityfoundation.org/volatility3/images/win-10_19041-2025_03.dmp.gz -> ${PN}-win-10_19041-2025_03.dmp.gz
+		https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip -> ${PN}-symbols-symbols_win-10_19041-2025_03.zip
+	)
+"
+S="${WORKDIR}"/${PN}-${MY_PV}
+
+LICENSE="Volatility-1.0"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE="crypt disasm jsonschema leechcore snappy test yara"
+
+# We need to select *all* subslots of app-arch/snappy which select
+# SONAME=libsnappy.so.1. See (https://github.com/gentoo/gentoo/pull/30585#discussion_r1167753625)
+RDEPEND="
+	>=dev-python/pefile-2024.8.26[${PYTHON_USEDEP}]
+	crypt? ( >=dev-python/pycryptodome-3.21.0[${PYTHON_USEDEP}] )
+	disasm? (
+		>=dev-libs/capstone-5.0.3[python,${PYTHON_USEDEP}]
+		<dev-libs/capstone-6[python,${PYTHON_USEDEP}]
+	)
+	jsonschema? ( >=dev-python/jsonschema-4.23.0[${PYTHON_USEDEP}] )
+	leechcore? ( >=dev-python/leechcorepyc-2.19.2[${PYTHON_USEDEP}] )
+	snappy? ( app-arch/snappy:0/1.1 )
+	yara? (
+		|| (
+			>=app-forensics/yara-x-0.10.0[${PYTHON_USEDEP}]
+			>=dev-python/yara-python-4.5.0[${PYTHON_USEDEP}]
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/unzip
+"
+
+# Tests require optional features
+REQUIRED_USE="test? ( yara )"
+
+RESTRICT="!test? ( test )"
+
+distutils_enable_tests pytest
+
+src_prepare() {
+	default
+
+	mv "${WORKDIR}/linux" "${S}/${PN}/symbols" || die
+	mv "${WORKDIR}"/*.dmg.json.xz "${S}/${PN}/symbols" || die
+	mv "${WORKDIR}/windows" "${S}/${PN}/symbols" || die
+
+	if use test; then
+		# tests want the images in a common directory
+		mkdir "${T}/test_images" || die
+		mv "${WORKDIR}/${PN}-linux-sample-1.bin" "${T}/test_images/linux-sample-1.bin" || die
+		mv "${WORKDIR}/${PN}-win-xp-laptop-2005-06-25.img" "${T}/test_images/win-xp-laptop-2005-06-25.img" || die
+		mv "${WORKDIR}/${PN}-win-10_19041-2025_03.dmp" "${T}/test_images/win-10_19041-2025_03.dmp" || die
+		mv "${WORKDIR}/167FE94B5641C005AC3036212A01F8DC-1.json" "${S}/${PN}/symbols" || die
+	fi
+}
+
+python_test() {
+	# see .github/workflows/test.yaml
+	epytest "${S}/test/plugins/windows/windows.py" \
+		--volatility=volshell.py \
+		--image-dir "${T}/test_images" \
+		-k test_windows_volshell -v
+	epytest "${S}/test/plugins/linux/linux.py" \
+		--volatility=volshell.py \
+		--image-dir "${T}/test_images" \
+		-k test_linux_volshell -v
+
+	# unable to get tests working
+	# epytest "${S}/test/plugins/windows/windows.py" \
+	# 	--volatility=vol.py \
+	# 	--image "${T}/test_images/win-10_19041-2025_03.dmp" \
+	# 	-k "test_windows and not test_windows_volshell" -v --durations=0
+	# epytest "${S}/test/plugins/linux/linux.py" \
+	# 	--volatility=vol.py \
+	# 	--image-dir "${T}/test_images" \
+	# 	-k "test_linux and not test_linux_volshell" -v
+}
diff --git a/app-forensics/volatility3/volatility3-2.28.0.ebuild b/app-forensics/volatility3/volatility3-2.28.0.ebuild
new file mode 100644
index 000000000000..c218baa30e68
--- /dev/null
+++ b/app-forensics/volatility3/volatility3-2.28.0.ebuild
@@ -0,0 +1,102 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{13..14} )
+inherit distutils-r1
+
+MY_PV=${PV//_beta/-beta.}
+
+DESCRIPTION="Framework for analyzing volatile memory"
+HOMEPAGE="https://github.com/volatilityfoundation/volatility3/ https://www.volatilityfoundation.org/"
+SRC_URI="
+	https://github.com/volatilityfoundation/volatility3/archive/v${MY_PV}.tar.gz -> ${P}.gh.tar.gz
+	https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/linux.zip -> ${P}-symbols-linux.zip
+	https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/mac.zip -> ${P}-symbols-mac.zip
+	https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/windows.zip -> ${P}-symbols-windows.zip
+	test?
+	(
+		https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/linux-sample-1.bin.gz -> ${PN}-linux-sample-1.bin.gz
+		https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/win-xp-laptop-2005-06-25.img.gz -> ${PN}-win-xp-laptop-2005-06-25.img.gz
+		https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/win-10_19041-2025_03.dmp.gz -> ${PN}-win-10_19041-2025_03.dmp.gz
+		https://github.com/volatilityfoundation/volatility3-test-data/releases/download/v0.0.1/symbols_win-10_19041-2025_03.zip -> ${PN}-symbols-symbols_win-10_19041-2025_03.zip
+	)
+"
+S="${WORKDIR}"/${PN}-${MY_PV}
+
+LICENSE="Volatility-1.0"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="crypt disasm jsonschema leechcore snappy test yara"
+
+# We need to select *all* subslots of app-arch/snappy which select
+# SONAME=libsnappy.so.1. See (https://github.com/gentoo/gentoo/pull/30585#discussion_r1167753625)
+RDEPEND="
+	>=dev-python/pefile-2024.8.26[${PYTHON_USEDEP}]
+	crypt? ( >=dev-python/pycryptodome-3.21.0[${PYTHON_USEDEP}] )
+	disasm? (
+		>=dev-libs/capstone-5.0.3[python,${PYTHON_USEDEP}]
+		<dev-libs/capstone-6[python,${PYTHON_USEDEP}]
+	)
+	jsonschema? ( >=dev-python/jsonschema-4.23.0[${PYTHON_USEDEP}] )
+	leechcore? ( >=dev-python/leechcorepyc-2.19.2[${PYTHON_USEDEP}] )
+	snappy? ( app-arch/snappy:0/1.1 )
+	yara? (
+		|| (
+			>=app-forensics/yara-x-0.10.0[${PYTHON_USEDEP}]
+			>=dev-python/yara-python-4.5.0[${PYTHON_USEDEP}]
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/unzip
+"
+
+# Tests require optional features
+REQUIRED_USE="test? ( yara )"
+
+RESTRICT="!test? ( test )"
+
+distutils_enable_tests pytest
+
+src_prepare() {
+	default
+
+	mv "${WORKDIR}/linux" "${S}/${PN}/symbols" || die
+	mv "${WORKDIR}"/*.dmg.json.xz "${S}/${PN}/symbols" || die
+	mv "${WORKDIR}/windows" "${S}/${PN}/symbols" || die
+
+	if use test; then
+		# tests want the images in a common directory
+		mkdir "${T}/test_images" || die
+		mv "${WORKDIR}/${PN}-linux-sample-1.bin" "${T}/test_images/linux-sample-1.bin" || die
+		mv "${WORKDIR}/${PN}-win-xp-laptop-2005-06-25.img" "${T}/test_images/win-xp-laptop-2005-06-25.img" || die
+		mv "${WORKDIR}/${PN}-win-10_19041-2025_03.dmp" "${T}/test_images/win-10_19041-2025_03.dmp" || die
+		mv "${WORKDIR}/167FE94B5641C005AC3036212A01F8DC-1.json" "${S}/${PN}/symbols" || die
+	fi
+}
+
+python_test() {
+	# see .github/workflows/test.yaml
+	epytest "${S}/test/plugins/windows/windows.py" \
+		--volatility=volshell.py \
+		--image-dir "${T}/test_images" \
+		-k test_windows_volshell -v
+	epytest "${S}/test/plugins/linux/linux.py" \
+		--volatility=volshell.py \
+		--image-dir "${T}/test_images" \
+		-k test_linux_volshell -v
+
+	# unable to get tests working
+	# epytest "${S}/test/plugins/windows/windows.py" \
+	# 	--volatility=vol.py \
+	# 	--image "${T}/test_images/win-10_19041-2025_03.dmp" \
+	# 	-k "test_windows and not test_windows_volshell" -v --durations=0
+	# epytest "${S}/test/plugins/linux/linux.py" \
+	# 	--volatility=vol.py \
+	# 	--image-dir "${T}/test_images" \
+	# 	-k "test_linux and not test_linux_volshell" -v
+}
diff --git a/app-forensics/yara-x/Manifest b/app-forensics/yara-x/Manifest
new file mode 100644
index 000000000000..b34b1aa3eb01
--- /dev/null
+++ b/app-forensics/yara-x/Manifest
@@ -0,0 +1,6 @@
+DIST yara-x-1.14.0-crates.tar.xz 37085572 BLAKE2B c9c5b6b736e6b7b7ddde4282b414bf357462eb295f28123225f388c87cdcd51b9ecff540f98be2bc1d24f3b8aecbf8fc14a0555b6aa31a615a7372d9847dd0e1 SHA512 0e0c97e4021323b539ba6ee27187a9caa084fc5a020673d01d4e86cb18fe7b2cf38bee141f7d89b901ed55e97295d5372f60de38e7f66ca5ddd79f17d5690f68
+DIST yara-x-1.14.0.tar.gz 53590528 BLAKE2B ec4e4a50cb65b2fd1e56466920130ff4425be5ac9ce82d493cfc0462137656c390683a5cd2000ec8e970baf55181943f32d362c7d168a8714219678979e5db84 SHA512 43c1bdcc793ce7d22ae947ad8b397c32eae2e97ef7b7580dcbb6002da92b897e35f3fe797782d01e343a576c666009af2843abd4b98549da0bd4fc4c8166dd13
+DIST yara-x-1.15.0-crates.tar.xz 36337136 BLAKE2B edaf62976cfed38e191fca21e1d8d45fedd32d3e291b5c0f1998995d1d2bdc22ff0993fc08d2772407d556b370d7baf94115ec99f5aeb11902e460b0ebcabfc8 SHA512 26d04ab7c425237cf83202d13c7e1a68ba5982ed41b9334d14527209aafaae080f8649a5127d552ee6b8398a8677175bd1d6d6a6dfb58eb26a7041f9c30fb13c
+DIST yara-x-1.15.0.tar.gz 56858329 BLAKE2B c4de015dfc0ea638d843ce26fc4cdff34a8b958f2fa643f3336ddc37dad3be7538dc2a30c14c2b2e298709a8dc41b4ce14942f6a7da25f2a737770be69ac2955 SHA512 fbe3d37bc59a7bcf018fab4d6ad44ca56a8a2bee07b2bd5ca50b45ba69325e226d737cb7c86dd00596aa44a69738f98ef072fddb590702f7ec5965a219ad6b15
+DIST yara-x-1.16.0-crates.tar.xz 29258360 BLAKE2B 788fa263443f7fd7fd504445677be571328cf7998b58f00b685faed0a70b699ab7620e48a9f1440a0d0128486686cb8639769eb30b79dd797faafd7fd77fda57 SHA512 8f23b25c7be1310f5991d1c8b6c9a51d1700af5858e3c8f9e1b14f43b3b5ee77d73458dcbf999ba45d2b399987fc6022c9cc846958c5f7a2207cddb9919a021e
+DIST yara-x-1.16.0.tar.gz 56884651 BLAKE2B 9464ef1f657fcdd62cdde78aa9a713de18257f91fab66bd6865afb4de5c607df907d4101c815c762530fdcf51e3b7c8b6c89f087342d2b2a830181e41a410566 SHA512 4ff0de59c24de257db1e0410cc901b52373ca0f2bfca5d0a5e310647c848cd59872fe81f8d8fb11ab06bc4bc559b88368fe07583a1d2d7159d0f29265282aeb1
diff --git a/app-forensics/yara-x/metadata.xml b/app-forensics/yara-x/metadata.xml
new file mode 100644
index 000000000000..1d8b2170561e
--- /dev/null
+++ b/app-forensics/yara-x/metadata.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>mario.haustein@hrz.tu-chemnitz.de</email>
+    <name>Mario Haustein</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription>
+		YARA is a tool aimed at (but not limited to) helping malware
+		researchers to identify and classify malware samples. With YARA you can
+		create descriptions of malware families (or whatever you want to
+		describe) based on textual or binary patterns.
+
+		YARA-X is a re-incarnation of YARA rewritten in Rust, eventually
+		replacing YARA.
+	</longdescription>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/yara-x/yara-x-1.14.0.ebuild b/app-forensics/yara-x/yara-x-1.14.0.ebuild
new file mode 100644
index 000000000000..51edf1060d61
--- /dev/null
+++ b/app-forensics/yara-x/yara-x-1.14.0.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{13..14} )
+RUST_MIN_VER="1.89.0"
+
+CRATES=""
+
+inherit cargo distutils-r1
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara-x/"
+SRC_URI="https://github.com/VirusTotal/yara-x/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-crate-dist/${PN}/releases/download/v${PV}/${P}-crates.tar.xz"
+
+LICENSE="BSD"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD CC0-1.0 EPL-2.0 ISC
+	MIT MPL-2.0 Unicode-3.0 Unicode-DFS-2016 WTFPL-2 ZLIB
+"
+
+SLOT="0"
+# Note: cranelift dependency only supports amd64, arm64, s390, and riscv64 as of 2025
+KEYWORDS="amd64"
+IUSE="python"
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+RDEPEND="
+	python? ( ${PYTHON_DEPS} )
+"
+BDEPEND="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+wrap_python() {
+	local phase=$1
+	shift
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_${phase} "$@"
+		popd >/dev/null || die
+	fi
+}
+
+# https://bugs.gentoo.org/933231, https://bugs.gentoo.org/933232
+QA_FLAGS_IGNORED="usr/bin/yr"
+
+pkg_setup() {
+	# https://bugs.gentoo.org/933233
+	QA_SONAME="usr/$(get_libdir)/libyara_x.*\\.so usr/lib.*/py.*/site-packages/yara_x/yara_x.*\\.so"
+
+	rust_pkg_setup
+}
+
+src_prepare() {
+	default
+	wrap_python ${FUNCNAME}
+}
+
+src_compile() {
+	cargo_src_compile --workspace
+	wrap_python ${FUNCNAME}
+}
+
+python_test() {
+	epytest
+}
+
+src_test() {
+	export RUST_BACKTRACE=full
+	cargo_src_test
+	wrap_python ${FUNCNAME}
+}
+
+src_install() {
+	dobin "$(cargo_target_dir)"/yr
+	dolib.so "$(cargo_target_dir)"/*.so
+
+	wrap_python ${FUNCNAME}
+}
diff --git a/app-forensics/yara-x/yara-x-1.15.0.ebuild b/app-forensics/yara-x/yara-x-1.15.0.ebuild
new file mode 100644
index 000000000000..ceede093e4f3
--- /dev/null
+++ b/app-forensics/yara-x/yara-x-1.15.0.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{13..14} )
+RUST_MIN_VER="1.89.0"
+
+CRATES=""
+
+inherit cargo distutils-r1
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara-x/"
+SRC_URI="https://github.com/VirusTotal/yara-x/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-crate-dist/${PN}/releases/download/v${PV}/${P}-crates.tar.xz"
+
+LICENSE="BSD"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD CC0-1.0 EPL-2.0 ISC
+	MIT MPL-2.0 Unicode-3.0 Unicode-DFS-2016 WTFPL-2 ZLIB
+"
+
+SLOT="0"
+# Note: cranelift dependency only supports amd64, arm64, s390, and riscv64 as of 2025
+KEYWORDS="~amd64"
+IUSE="python"
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+RDEPEND="
+	python? ( ${PYTHON_DEPS} )
+"
+BDEPEND="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+wrap_python() {
+	local phase=$1
+	shift
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_${phase} "$@"
+		popd >/dev/null || die
+	fi
+}
+
+# https://bugs.gentoo.org/933231, https://bugs.gentoo.org/933232
+QA_FLAGS_IGNORED="usr/bin/yr"
+
+pkg_setup() {
+	# https://bugs.gentoo.org/933233
+	QA_SONAME="usr/$(get_libdir)/libyara_x.*\\.so usr/lib.*/py.*/site-packages/yara_x/yara_x.*\\.so"
+
+	rust_pkg_setup
+}
+
+src_prepare() {
+	default
+	wrap_python ${FUNCNAME}
+}
+
+src_compile() {
+	cargo_src_compile --workspace
+	wrap_python ${FUNCNAME}
+}
+
+python_test() {
+	epytest
+}
+
+src_test() {
+	export RUST_BACKTRACE=full
+	cargo_src_test
+	wrap_python ${FUNCNAME}
+}
+
+src_install() {
+	dobin "$(cargo_target_dir)"/yr
+	dolib.so "$(cargo_target_dir)"/*.so
+
+	wrap_python ${FUNCNAME}
+}
diff --git a/app-forensics/yara-x/yara-x-1.16.0.ebuild b/app-forensics/yara-x/yara-x-1.16.0.ebuild
new file mode 100644
index 000000000000..14755411ee6a
--- /dev/null
+++ b/app-forensics/yara-x/yara-x-1.16.0.ebuild
@@ -0,0 +1,92 @@
+# Copyright 2025-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=maturin
+DISTUTILS_OPTIONAL=1
+PYTHON_COMPAT=( python3_{13..14} )
+RUST_MIN_VER="1.91.0"
+
+CRATES=""
+
+inherit cargo distutils-r1
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara-x/"
+SRC_URI="https://github.com/VirusTotal/yara-x/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://github.com/gentoo-crate-dist/${PN}/releases/download/v${PV}/${P}-crates.tar.xz"
+
+LICENSE="BSD"
+# Dependent crate licenses
+LICENSE+="
+	Apache-2.0 Apache-2.0-with-LLVM-exceptions BSD CC0-1.0 EPL-2.0 ISC
+	MIT MPL-2.0 Unicode-3.0 Unicode-DFS-2016 WTFPL-2 ZLIB
+"
+
+SLOT="0"
+# Note: cranelift dependency only supports amd64, arm64, s390, and riscv64 as of 2025
+KEYWORDS="amd64"
+IUSE="python"
+REQUIRED_USE="
+	python? ( ${PYTHON_REQUIRED_USE} )
+"
+
+RDEPEND="
+	python? ( ${PYTHON_DEPS} )
+"
+BDEPEND="
+	python? (
+		${PYTHON_DEPS}
+		${DISTUTILS_DEPS}
+	)
+"
+
+wrap_python() {
+	local phase=$1
+	shift
+
+	if use python; then
+		pushd py >/dev/null || die
+		distutils-r1_${phase} "$@"
+		popd >/dev/null || die
+	fi
+}
+
+# https://bugs.gentoo.org/933231, https://bugs.gentoo.org/933232
+QA_FLAGS_IGNORED="usr/bin/yr"
+
+pkg_setup() {
+	# https://bugs.gentoo.org/933233
+	QA_SONAME="usr/$(get_libdir)/libyara_x.*\\.so usr/lib.*/py.*/site-packages/yara_x/yara_x.*\\.so"
+
+	rust_pkg_setup
+}
+
+src_prepare() {
+	default
+	wrap_python ${FUNCNAME}
+}
+
+src_compile() {
+	cargo_src_compile --workspace
+	wrap_python ${FUNCNAME}
+}
+
+python_test() {
+	epytest
+}
+
+src_test() {
+	export RUST_BACKTRACE=full
+	cargo_src_test
+	wrap_python ${FUNCNAME}
+}
+
+src_install() {
+	dobin "$(cargo_target_dir)"/yr
+	dolib.so "$(cargo_target_dir)"/*.so
+
+	wrap_python ${FUNCNAME}
+}
diff --git a/app-forensics/yara/Manifest b/app-forensics/yara/Manifest
new file mode 100644
index 000000000000..80d8d1366978
--- /dev/null
+++ b/app-forensics/yara/Manifest
@@ -0,0 +1,2 @@
+DIST yara-4.5.4.tar.gz 2201555 BLAKE2B 4a3c6c97031b0033be1cc9e3d0436c2def2c732bc3cc6289b8eec58b99336d15eb9d491858ac4744ee05e35fc6cfc61c071947ecc8ad01401d0863968c3aa283 SHA512 b1da40636f9e55bb07cc911479e6dfa8dc7a4fa3f6b9f10b9f669d741d7af51a1d31e044f9842ec3ab9c6ac9788fbdb89a1686c9e3f22f68d1f9e5fb3db22167
+DIST yara-4.5.5.tar.gz 2202497 BLAKE2B c990d2a1ae24cabb9e873b369dc5803157663c996ba8cf327cb12059cb704998f7bc437df2eb8ac9973a163163352cbb19ec5edc0a508a3ee8c25a2733b9a39c SHA512 e71d6e435cb2ad7b5875ccabcfe3abe42e2f37187a22e778867c5c5762134961369c2cbd4bea8da9193d5381af4569e39a50156d4077dc3a23b9a2240b741b60
diff --git a/app-forensics/yara/metadata.xml b/app-forensics/yara/metadata.xml
new file mode 100644
index 000000000000..35619bffd0fc
--- /dev/null
+++ b/app-forensics/yara/metadata.xml
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person" proxied="yes">
+    <email>mario.haustein@hrz.tu-chemnitz.de</email>
+    <name>Mario Haustein</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>sam@gentoo.org</email>
+    <name>Sam James</name>
+  </maintainer>
+  <maintainer type="project" proxied="proxy">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+  <longdescription>
+		YARA is a tool aimed at (but not limited to) helping malware
+		researchers to identify and classify malware samples. With YARA you can
+		create descriptions of malware families (or whatever you want to
+		describe) based on textual or binary patterns.
+	</longdescription>
+  <use>
+    <flag name="cuckoo">Enable cockoo module</flag>
+    <flag name="dex">Enable dex module</flag>
+    <flag name="dotnet">Enable dotnet module</flag>
+    <flag name="macho">Enable macho module</flag>
+    <flag name="magic">Enable magic module</flag>
+    <flag name="profiling">Enable rules profiling</flag>
+    <flag name="python">Pulls in python binding via <pkg>dev-python/yara-python</pkg>
+    </flag>
+  </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:virustotal:yara</remote-id>
+  </upstream>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/yara/yara-4.5.4.ebuild b/app-forensics/yara/yara-4.5.4.ebuild
new file mode 100644
index 000000000000..af8966134e93
--- /dev/null
+++ b/app-forensics/yara/yara-4.5.4.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara/"
+
+if [[ ${PV} == "9999" ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/VirusTotal/yara.git"
+else
+	SRC_URI="https://github.com/virustotal/yara/archive/v${PV/_/-}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${PN}-${PV/_/-}"
+	KEYWORDS="amd64 ~arm64 ~ppc64 x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/10"
+IUSE="+dex +dotnet +cuckoo +macho +magic profiling python test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-libs/openssl:=
+	cuckoo? ( dev-libs/jansson:= )
+	magic? ( sys-apps/file:= )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+PDEPEND="python? ( =dev-python/yara-python-$(ver_cut 1)* )"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable profiling) \
+		$(use_enable cuckoo) \
+		$(use_enable magic) \
+		$(use_enable dotnet) \
+		$(use_enable macho) \
+		$(use_enable dex) \
+		$(use_enable test static)
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+
+	# TODO: Allow tests to work against dyn. lib rather than building
+	# statically just for tests.
+	find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+}
diff --git a/app-forensics/yara/yara-4.5.5.ebuild b/app-forensics/yara/yara-4.5.5.ebuild
new file mode 100644
index 000000000000..12d75cd6c3a5
--- /dev/null
+++ b/app-forensics/yara/yara-4.5.5.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara/"
+
+if [[ ${PV} == "9999" ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/VirusTotal/yara.git"
+else
+	SRC_URI="https://github.com/virustotal/yara/archive/v${PV/_/-}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${PN}-${PV/_/-}"
+	KEYWORDS="amd64 ~arm64 ~ppc64 x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/10"
+IUSE="+dex +dotnet +cuckoo +macho +magic profiling python test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-libs/openssl:=
+	cuckoo? ( dev-libs/jansson:= )
+	magic? ( sys-apps/file:= )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+PDEPEND="python? ( =dev-python/yara-python-$(ver_cut 1)* )"
+
+src_prepare() {
+	default
+
+	sed -i -e "/yara_LDFLAGS = -static/d" Makefile.am || die
+
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable profiling) \
+		$(use_enable cuckoo) \
+		$(use_enable magic) \
+		$(use_enable dotnet) \
+		$(use_enable macho) \
+		$(use_enable dex) \
+		$(use_enable test static)
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+
+	# TODO: Allow tests to work against dyn. lib rather than building
+	# statically just for tests.
+	find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+}
diff --git a/app-forensics/yara/yara-9999.ebuild b/app-forensics/yara/yara-9999.ebuild
new file mode 100644
index 000000000000..7a5d2e71ff55
--- /dev/null
+++ b/app-forensics/yara/yara-9999.ebuild
@@ -0,0 +1,63 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools
+
+DESCRIPTION="A malware identification and classification tool"
+HOMEPAGE="https://virustotal.github.io/yara/"
+
+if [[ ${PV} == "9999" ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/VirusTotal/yara.git"
+else
+	SRC_URI="https://github.com/virustotal/yara/archive/v${PV/_/-}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/${PN}-${PV/_/-}"
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0/10"
+IUSE="+dex +dotnet +cuckoo +macho +magic profiling python test"
+RESTRICT="!test? ( test )"
+
+DEPEND="
+	dev-libs/openssl:=
+	cuckoo? ( dev-libs/jansson:= )
+	magic? ( sys-apps/file:= )
+"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+PDEPEND="python? ( =dev-python/yara-python-$(ver_cut 1)* )"
+
+src_prepare() {
+	default
+
+	sed -i -e "/yara_LDFLAGS = -static/d" Makefile.am || die
+
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable profiling) \
+		$(use_enable cuckoo) \
+		$(use_enable magic) \
+		$(use_enable dotnet) \
+		$(use_enable macho) \
+		$(use_enable dex) \
+		$(use_enable test static)
+}
+
+src_test() {
+	emake check
+}
+
+src_install() {
+	default
+
+	# TODO: Allow tests to work against dyn. lib rather than building
+	# statically just for tests.
+	find "${ED}" \( -name '*.a' -o -name '*.la' \) -delete || die
+}
diff --git a/app-forensics/zzuf/Manifest b/app-forensics/zzuf/Manifest
new file mode 100644
index 000000000000..134d8d844623
--- /dev/null
+++ b/app-forensics/zzuf/Manifest
@@ -0,0 +1,2 @@
+DIST zzuf-0.15_p20190208.tar.gz 140812 BLAKE2B 908661fdb51a5b2d5b188ac7df2731c5f069db8489651145f6d4a5cb0f02dc99fa10c3771a034645043f547ef92dfe9e3cfa3f1442dbad690d88ef620f2cfdd8 SHA512 e4d6b4356385642323520c1f1d476b572465881df539d0c6e7110ca7974da81b4b744896df7deac8b462707ca9e0db578ca0c118d6ba2da4bc78ffe31328f711
+DIST zzuf-0.15_p20220529.tar.gz 140825 BLAKE2B a36207082210e062575bed45eac4a83923cbe5f0e60c0b093053ac96abef085a0e6506d5b7db6b11ed7f0979462fbb92f69767ac548de1a1f96a12d84aac8584 SHA512 50e3c8908f579a70d41d7887ff7d87634f3b856ae82bb7ec6dccacccf363a6494d825e0b6debf683ed29408dcd5dc83dbb39c2d2000be0d79aee5f819d69185a
diff --git a/app-forensics/zzuf/files/zzuf-0.15_autoconf-hardcoded-cflags.patch b/app-forensics/zzuf/files/zzuf-0.15_autoconf-hardcoded-cflags.patch
new file mode 100644
index 000000000000..f8cbfa5c7642
--- /dev/null
+++ b/app-forensics/zzuf/files/zzuf-0.15_autoconf-hardcoded-cflags.patch
@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -39,8 +39,6 @@
+ AC_MSG_RESULT($SONAME)
+ AC_DEFINE_UNQUOTED(SONAME, "$SONAME", [Define to the libzzuf full name])
+ 
+-# Optimizations
+-AC_TRY_CFLAGS(-g -O2, CFLAGS="${CFLAGS} -g -O2")
+ # Code qui fait des warnings == code de porc == deux baffes dans ta gueule
+ AC_TRY_CFLAGS(-Wall, CFLAGS="${CFLAGS} -Wall")
+ AC_TRY_CFLAGS(-W, CFLAGS="${CFLAGS} -W")
diff --git a/app-forensics/zzuf/files/zzuf-0.15_autoconf-musl.patch b/app-forensics/zzuf/files/zzuf-0.15_autoconf-musl.patch
new file mode 100644
index 000000000000..0a56a968e84d
--- /dev/null
+++ b/app-forensics/zzuf/files/zzuf-0.15_autoconf-musl.patch
@@ -0,0 +1,24 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -6,6 +6,8 @@
+ 
+ AC_PREREQ(2.50)
+ 
++AC_USE_SYSTEM_EXTENSIONS
++
+ AM_PROG_CC_C_O
+ AC_PROG_CPP
+ AC_PROG_LIBTOOL
+@@ -172,6 +174,12 @@
+ AC_TRY_COMPILE(
+  [#define _LARGEFILE64_SOURCE
+   #define _LARGEFILE_SOURCE
++  #include <stdio.h>],
++ [fpos64_t x; long long int y = x.__lldata;],
++ [ac_v_fpos64_t="(x).__lldata"])
++AC_TRY_COMPILE(
++ [#define _LARGEFILE64_SOURCE
++  #define _LARGEFILE_SOURCE
+   #include <stdio.h>],
+  [fpos64_t x; long long int y = (long long int)x;],
+  [ac_v_fpos64_t="(x)"])
diff --git a/app-forensics/zzuf/files/zzuf-0.15_implicit_functions.patch b/app-forensics/zzuf/files/zzuf-0.15_implicit_functions.patch
new file mode 100644
index 000000000000..aa73a6f03d2b
--- /dev/null
+++ b/app-forensics/zzuf/files/zzuf-0.15_implicit_functions.patch
@@ -0,0 +1,32 @@
+--- a/src/libc_fcns.h
++++ b/src/libc_fcns.h
+@@ -0,0 +1,8 @@
++#ifndef _ZZUF_LIBC_FCNS_H
++#define _ZZUF_LIBC_FCNS_H
++
++/* Prototypes for internal libc functions zzuf hooks into */
++extern int __fseeko64(FILE *fp, off64_t offset, int whence);
++extern int _IO_getc(FILE *__fp);
++
++#endif
+--- a/src/libzzuf/lib-stream.c
++++ b/src/libzzuf/lib-stream.c
+@@ -57,6 +57,7 @@
+ #include "debug.h"
+ #include "fuzz.h"
+ #include "fd.h"
++#include "libc_fcns.h"
+ 
+ #if defined HAVE_FPOS64_T
+ #   define FPOS64_T fpos64_t
+--- a/src/zzat.c
++++ b/src/zzat.c
+@@ -51,6 +51,8 @@
+ 
+ #include "util/getopt.h"
+ 
++#include "libc_fcns.h"
++
+ static int run(char const *sequence, char const *file);
+ static void output(char const *buf, size_t len);
+ 
diff --git a/app-forensics/zzuf/files/zzuf-0.15_use-after-free.patch b/app-forensics/zzuf/files/zzuf-0.15_use-after-free.patch
new file mode 100644
index 000000000000..3de95d91608c
--- /dev/null
+++ b/app-forensics/zzuf/files/zzuf-0.15_use-after-free.patch
@@ -0,0 +1,20 @@
+--- a/test/zzone.c
++++ b/test/zzone.c
+@@ -64,14 +64,14 @@
+             last++;
+     }
+ 
+-    free(buf);
+-    free(tmp);
+-
+     size_t total = 0;
+     for (size_t i = last; i < size; i++)
+         total += countzeroes(buf[i]);
+     printf("%li\n", (long)total);
+ 
++    free(buf);
++    free(tmp);
++
+     return EXIT_SUCCESS;
+ }
+ 
diff --git a/app-forensics/zzuf/metadata.xml b/app-forensics/zzuf/metadata.xml
new file mode 100644
index 000000000000..5f33304011d5
--- /dev/null
+++ b/app-forensics/zzuf/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
+<pkgmetadata>
+  <origin>baldeagleos-repo</origin>
+</pkgmetadata>
diff --git a/app-forensics/zzuf/zzuf-0.15_p20190208.ebuild b/app-forensics/zzuf/zzuf-0.15_p20190208.ebuild
new file mode 100644
index 000000000000..e20563debda6
--- /dev/null
+++ b/app-forensics/zzuf/zzuf-0.15_p20190208.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools multilib-minimal
+
+EGIT_COMMIT="e598eef77a98d77dc6aec6fd2c845e3cd07dc4fd"
+DESCRIPTION="Transparent application input fuzzer"
+HOMEPAGE="http://caca.zoy.org/wiki/zzuf"
+SRC_URI="https://github.com/samhocevar/${PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="WTFPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+# Uses dlopen hack to hijack many libc functions.
+# Fails 2 tests with sandbox enabled: check-zzuf-A-autoinc check-utils
+RESTRICT="test"
+
+DOCS=( AUTHORS COPYING TODO )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.15_autoconf-musl.patch
+)
+
+S="${WORKDIR}"/${PN}-${EGIT_COMMIT}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE="${S}" econf
+}
+
+multilib_src_install_all() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/app-forensics/zzuf/zzuf-0.15_p20220529.ebuild b/app-forensics/zzuf/zzuf-0.15_p20220529.ebuild
new file mode 100644
index 000000000000..8b4f9015fa3c
--- /dev/null
+++ b/app-forensics/zzuf/zzuf-0.15_p20220529.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2023 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools multilib-minimal
+
+EGIT_COMMIT="a7111e51eac3086264fcca0c7026de22b5ab55c7"
+DESCRIPTION="Transparent application input fuzzer"
+HOMEPAGE="http://caca.zoy.org/wiki/zzuf"
+SRC_URI="https://github.com/samhocevar/${PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="WTFPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+# Uses dlopen hack to hijack many libc functions.
+# Fails 2 tests with sandbox enabled: check-zzuf-A-autoinc check-utils
+RESTRICT="test"
+
+DOCS=( AUTHORS COPYING TODO )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.15_autoconf-hardcoded-cflags.patch
+	"${FILESDIR}"/${PN}-0.15_autoconf-musl.patch
+	"${FILESDIR}"/${PN}-0.15_implicit_functions.patch
+	"${FILESDIR}"/${PN}-0.15_use-after-free.patch
+)
+
+S="${WORKDIR}"/${PN}-${EGIT_COMMIT}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	ECONF_SOURCE="${S}" econf
+}
+
+multilib_src_install_all() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+}
author	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
committer	root <root@alpha.trunkmasters.com>	2026-06-12 19:09:37 -0500
commit	b590c8d7572b727d565cc0b8ff660d43569845de (patch)
tree	06f7a4102ea4e845df8b66660f252920d52952f9 /app-forensics
parent	24f9cbfc4c34fdb6a6e03311674414e881ceab47 (diff)
download	baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.gz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.tar.xz baldeagleos-repo-b590c8d7572b727d565cc0b8ff660d43569845de.zip