Adding metadata

6 files changed, 504 insertions, 0 deletions

diff --git a/dev-libs/libgcrypt/Manifest b/dev-libs/libgcrypt/Manifest
index d87beaacad24..b71dc11ecc06 100644
--- a/dev-libs/libgcrypt/Manifest
+++ b/dev-libs/libgcrypt/Manifest
@@ -1,2 +1,4 @@
 DIST libgcrypt-1.12.2.tar.bz2 4441855 BLAKE2B f52a10acdbf56a5adc927e22508a30d131a001e8f559d55c72d4ccfea4a514ef7983ab3f985af798c06a9c188639f21c54f1cc0ec6cba968172ddc6bd21ae0bd SHA512 dc1a4a6c00a0d84d90c8d71f4bd121b968c80df74137d6e8867f1f4cc014a539efb5238c1a1429d7cb95e493a40718fc19252edc592ffe0f43057b372896591c
 DIST libgcrypt-1.12.2.tar.bz2.sig 147 BLAKE2B 74adf984bda98e413f5f31aa3b2a60043773b387758caf3ec5e603ddd358bffdd58ec021c5828d1e45f2747f1766f0d63380ed4a5938565b829851e048b6279d SHA512 5991d26f0d59d646ba29c491e6952f31c970fb80b7928f999095d9f7d1435026c9304614558415c06254a81650ce08376ea09f7d93c657dfdb7ef014e58dbf28
+DIST libgcrypt-1.12.3.tar.bz2 4472486 BLAKE2B 52043c1defdbaf3ed0618bfbac13f4186dd28a4b2507a93bc24f08a7b2e66bb77014ff875801a3e39fcfbc905224f6ff1bcee43dcd53c555c32940305cfa92fe SHA512 84c150730af55669e35d3d9109250ae28175da1b506de84117701464ac5c7e542163977a1eb2e5df4cdaa8c723ea759aa8c004cccc98251902482aff7f847cad
+DIST libgcrypt-1.12.3.tar.bz2.sig 147 BLAKE2B 48fbd27b81535caac67f56f71cff08bffcd689963bc7335d807393eb718a14f18e5fede6113a2a582d23ec820d1ef01ad2b6dde00d2163cc905e4710ca934687 SHA512 1a621c62ebe15a706d65b69709d1f415d7c73b68c48f4cf0fed1730e458f49e5e88ef4583514218a76f8c5fb6bb1fd98f2348e12978772af14f8fff7fee04fff
diff --git a/dev-libs/libgcrypt/files/0001-cipher-rsa-oaep-Validate-all-zero-PS.patch b/dev-libs/libgcrypt/files/0001-cipher-rsa-oaep-Validate-all-zero-PS.patch
new file mode 100644
index 000000000000..4833d508d0de
--- /dev/null
+++ b/dev-libs/libgcrypt/files/0001-cipher-rsa-oaep-Validate-all-zero-PS.patch
@@ -0,0 +1,32 @@
+From cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53 Mon Sep 17 00:00:00 2001
+Message-ID: <cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53.1788185282.git.sam@gentoo.org>
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 27 Aug 2026 13:47:19 +0900
+Subject: [PATCH 1/3] cipher:rsa:oaep: Validate all-zero PS.
+
+* cipher/rsa-common.c (_gcry_rsa_oaep_decode): Reject non-zero PS.
+
+--
+
+GnuPG-bug-id: 8390
+Reported-by: JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/rsa-common.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/cipher/rsa-common.c b/cipher/rsa-common.c
+index 1c36c912..f8d06c72 100644
+--- a/cipher/rsa-common.c
++++ b/cipher/rsa-common.c
+@@ -755,6 +755,7 @@ _gcry_rsa_oaep_decode (unsigned char **r_result, size_t *r_resultlen,
+     {
+       not_found &= ct_not_equal_byte (db[n], 0x01);
+       n1 += not_found;
++      failed |= (not_found & ct_not_equal_byte (db[n], 0x00));
+     }
+   failed |= not_found;
+   failed |= ct_not_equal_byte (frame[0], 0x00);
+-- 
+2.55.0
+
diff --git a/dev-libs/libgcrypt/files/0002-cipher-rsa-pss-Validate-the-length-of-hashed-input.patch b/dev-libs/libgcrypt/files/0002-cipher-rsa-pss-Validate-the-length-of-hashed-input.patch
new file mode 100644
index 000000000000..a0b4f0d42ab0
--- /dev/null
+++ b/dev-libs/libgcrypt/files/0002-cipher-rsa-pss-Validate-the-length-of-hashed-input.patch
@@ -0,0 +1,43 @@
+From 612eb8c157c057feeaf17d30644fd65b05c5ea25 Mon Sep 17 00:00:00 2001
+Message-ID: <612eb8c157c057feeaf17d30644fd65b05c5ea25.1788185282.git.sam@gentoo.org>
+In-Reply-To: <cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53.1788185282.git.sam@gentoo.org>
+References: <cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53.1788185282.git.sam@gentoo.org>
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 27 Aug 2026 14:36:35 +0900
+Subject: [PATCH 2/3] cipher:rsa:pss: Validate the length of hashed input.
+
+* cipher/rsa-common.c (_gcry_rsa_pss_verify): Reject invalid input.
+
+--
+
+GnuPG-bug-id: 8391
+Reported-by: JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/rsa-common.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/cipher/rsa-common.c b/cipher/rsa-common.c
+index f8d06c72..8c732f65 100644
+--- a/cipher/rsa-common.c
++++ b/cipher/rsa-common.c
+@@ -1094,7 +1094,15 @@ _gcry_rsa_pss_verify (gcry_mpi_t value, int hashed_already,
+       _gcry_md_reset (hd);
+     }
+   else
+-    memcpy (mhash, p, hlen);
++    {
++      if ((input_nbits+7)/8 != hlen)
++        {
++          rc = GPG_ERR_INV_ARG;
++          goto leave;
++        }
++
++      memcpy (mhash, p, hlen);
++    }
+ 
+   /* Convert the signature into an octet string.  */
+   rc = octet_string_from_mpi (&em, NULL, encoded, emlen);
+-- 
+2.55.0
+
diff --git a/dev-libs/libgcrypt/files/0003-cipher-rsa-pss-Fix-SALT-LENGTH-handling.patch b/dev-libs/libgcrypt/files/0003-cipher-rsa-pss-Fix-SALT-LENGTH-handling.patch
new file mode 100644
index 000000000000..cd3c8e0858b8
--- /dev/null
+++ b/dev-libs/libgcrypt/files/0003-cipher-rsa-pss-Fix-SALT-LENGTH-handling.patch
@@ -0,0 +1,53 @@
+From 3ed69d3fb85bac0901dc5b4899d7983cf1f7bbe7 Mon Sep 17 00:00:00 2001
+Message-ID: <3ed69d3fb85bac0901dc5b4899d7983cf1f7bbe7.1788185282.git.sam@gentoo.org>
+In-Reply-To: <cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53.1788185282.git.sam@gentoo.org>
+References: <cf55ce42d0268f9cfd7abc43aa4ec62d2e8c3f53.1788185282.git.sam@gentoo.org>
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 28 Aug 2026 15:25:22 +0900
+Subject: [PATCH 3/3] cipher:rsa:pss: Fix SALT-LENGTH handling.
+
+* cipher/pubkey-util.c (_gcry_pk_util_data_to_mpi): For
+PUBKEY_OP_SIGN, just like for PUBKEY_OP_VERIFY, reject larger
+SALT-LENGTH as the comment says.  Fix releasing LIST on error.
+
+--
+
+Fixes-commit: 0bd8137e68c201b6c2290710e348aaf57efa2b2e
+GnuPG-bug-id: 8377
+Reported-by: JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr>
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ cipher/pubkey-util.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/cipher/pubkey-util.c b/cipher/pubkey-util.c
+index 4e8350a8..aac5c3f8 100644
+--- a/cipher/pubkey-util.c
++++ b/cipher/pubkey-util.c
+@@ -1305,10 +1305,15 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
+           if (!s)
+             {
+               rc = GPG_ERR_NO_OBJ;
++              sexp_release (list);
+               goto leave;
+             }
+           ctx->saltlen = (unsigned int)strtoul (s, NULL, 10);
++          if (ctx->saltlen > 16384)
++            rc = GPG_ERR_TOO_LARGE;
+           sexp_release (list);
++          if (rc)
++            goto leave;
+         }
+ 
+       /* Get optional RANDOM-OVERRIDE.  */
+@@ -1416,6 +1421,7 @@ _gcry_pk_util_data_to_mpi (gcry_sexp_t input, gcry_mpi_t *ret_mpi,
+           if (!s)
+             {
+               rc = GPG_ERR_NO_OBJ;
++              sexp_release (list);
+               goto leave;
+             }
+           ctx->saltlen = (unsigned int)strtoul (s, NULL, 10);
+-- 
+2.55.0
+
diff --git a/dev-libs/libgcrypt/libgcrypt-1.12.3-r1.ebuild b/dev-libs/libgcrypt/libgcrypt-1.12.3-r1.ebuild
new file mode 100644
index 000000000000..7c78e06b8ad3
--- /dev/null
+++ b/dev-libs/libgcrypt/libgcrypt-1.12.3-r1.ebuild
@@ -0,0 +1,189 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.56[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.12.0-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+	# Post-1.12.3 fixes
+	"${FILESDIR}"/0001-cipher-rsa-oaep-Validate-all-zero-PS.patch
+	"${FILESDIR}"/0002-cipher-rsa-pss-Validate-the-length-of-hashed-input.patch
+	"${FILESDIR}"/0003-cipher-rsa-pss-Fix-SALT-LENGTH-handling.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Temporary workaround for a build failure (known gcc issue):
+	#  * https://bugs.gentoo.org/956605
+	#  * https://gcc.gnu.org/PR110812
+	use riscv && filter-lto
+
+	# Temporary workaround for mfpmath=sse on x86 causing issues when -msse is
+	# stripped as it's not clear cut on how to handle in flag-o-matic we can at
+	# least solve it the ebuild see https://bugs.gentoo.org/959349
+	use x86 && filter-flags -mfpmath=sse
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}
diff --git a/dev-libs/libgcrypt/libgcrypt-1.12.3.ebuild b/dev-libs/libgcrypt/libgcrypt-1.12.3.ebuild
new file mode 100644
index 000000000000..9e9d7fb63e22
--- /dev/null
+++ b/dev-libs/libgcrypt/libgcrypt-1.12.3.ebuild
@@ -0,0 +1,185 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit autotools flag-o-matic linux-info multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="General purpose crypto library based on the code used in GnuPG"
+HOMEPAGE="https://www.gnupg.org/"
+SRC_URI="mirror://gnupg/${PN}/${P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/${PN}/${P}.tar.bz2.sig )"
+
+LICENSE="LGPL-2.1+ GPL-2+ MIT"
+SLOT="0/20" # subslot = soname major version
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="+asm doc +getentropy static-libs"
+IUSE+=" cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_arm_sve"
+IUSE+=" cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3"
+IUSE+=" cpu_flags_x86_aes cpu_flags_x86_avx cpu_flags_x86_avx2 cpu_flags_x86_avx512f cpu_flags_x86_padlock cpu_flags_x86_sha cpu_flags_x86_sse4_1"
+
+# Build system only has --disable-arm-crypto-support right now
+# If changing this, update src_configure logic too.
+# ARM CPUs seem to, right now, support all-or-nothing for crypto extensions,
+# but this looks like it might change in future. This is just a safety check
+# in case people somehow do have a CPU which only supports some. They must
+# for now disable them all if that's the case.
+REQUIRED_USE="
+	cpu_flags_arm_aes? ( cpu_flags_arm_sha1 cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha1? ( cpu_flags_arm_aes cpu_flags_arm_sha2 )
+	cpu_flags_arm_sha2? ( cpu_flags_arm_aes cpu_flags_arm_sha1 )
+	cpu_flags_ppc_vsx3? ( cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 )
+	cpu_flags_ppc_vsx2? ( cpu_flags_ppc_altivec )
+"
+
+RDEPEND="
+	>=dev-libs/libgpg-error-1.56[${MULTILIB_USEDEP}]
+	getentropy? (
+		kernel_linux? (
+			elibc_glibc? ( >=sys-libs/glibc-2.25 )
+			elibc_musl? ( >=sys-libs/musl-1.1.20 )
+		)
+	)
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	doc? ( virtual/texi2dvi )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.12.0-multilib-syspath.patch
+	"${FILESDIR}"/${PN}-powerpc-darwin.patch
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/libgcrypt-config
+)
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} == buildonly ]]; then
+		return
+	fi
+	if use kernel_linux && use getentropy; then
+		unset KV_FULL
+		get_running_version
+		if [[ -n ${KV_FULL} ]] && kernel_is -lt 3 17; then
+			eerror "The getentropy function requires the getrandom syscall."
+			eerror "This was introduced in Linux 3.17."
+			eerror "Your system is currently running Linux ${KV_FULL}."
+			eerror "Disable the 'getentropy' USE flag or upgrade your kernel."
+			die "Kernel is too old for getentropy"
+		fi
+	fi
+}
+
+pkg_setup() {
+	:
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# Temporary workaround for a build failure (known gcc issue):
+	#  * https://bugs.gentoo.org/956605
+	#  * https://gcc.gnu.org/PR110812
+	use riscv && filter-lto
+
+	# Temporary workaround for mfpmath=sse on x86 causing issues when -msse is
+	# stripped as it's not clear cut on how to handle in flag-o-matic we can at
+	# least solve it the ebuild see https://bugs.gentoo.org/959349
+	use x86 && filter-flags -mfpmath=sse
+
+	# Hardcodes the path to FGREP in libgcrypt-config
+	export ac_cv_path_SED="sed"
+	export ac_cv_path_EGREP="grep -E"
+	export ac_cv_path_EGREP_TRADITIONAL="grep -E"
+	export ac_cv_path_FGREP="grep -F"
+	export ac_cv_path_GREP="grep"
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	if [[ ${CHOST} == powerpc* ]] ; then
+		# ./configure does a lot of automagic, prevent that
+		# generic ppc32+ppc64 altivec
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec=no
+		use cpu_flags_ppc_altivec || local -x gcry_cv_cc_ppc_altivec_cflags=no
+		# power8 vector extension, aka arch 2.07 ISA, also checked below via ppc-crypto-support
+		use cpu_flags_ppc_vsx2 || local -x gcry_cv_gcc_inline_asm_ppc_altivec=no
+		# power9 vector extension, aka arch 3.00 ISA
+		use cpu_flags_ppc_vsx3 || local -x gcry_cv_gcc_inline_asm_ppc_arch_3_00=no
+	fi
+
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	local myeconfargs=(
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+
+		--enable-noexecstack
+		$(use_enable cpu_flags_arm_neon neon-support)
+		# See REQUIRED_USE comment above
+		$(use_enable cpu_flags_arm_aes arm-crypto-support)
+		$(use_enable cpu_flags_arm_sve sve-support)
+		$(use_enable cpu_flags_ppc_vsx2 ppc-crypto-support)
+		$(use_enable cpu_flags_x86_aes aesni-support)
+		$(use_enable cpu_flags_x86_avx avx-support)
+		$(use_enable cpu_flags_x86_avx2 avx2-support)
+		$(use_enable cpu_flags_x86_avx512f avx512-support)
+		$(use_enable cpu_flags_x86_padlock padlock-support)
+		$(use_enable cpu_flags_x86_sha shaext-support)
+		$(use_enable cpu_flags_x86_sse4_1 sse41-support)
+		# required for sys-power/suspend[crypt], bug 751568
+		$(use_enable static-libs static)
+
+		# disabled due to various applications requiring privileges
+		# after libgcrypt drops them (bug #468616)
+		--without-capabilities
+
+		$(use asm || echo "--disable-asm")
+
+		GPG_ERROR_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpg-error-config"
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	if use kernel_linux; then
+		# --enable-random=getentropy requires getentropy/getrandom.
+		# --enable-random=linux enables legacy code that tries getrandom
+		# and falls back to reading /dev/random.
+		myeconfargs+=( --enable-random=$(usex getentropy getentropy linux) )
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}" \
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+}
+
+multilib_src_compile() {
+	default
+	multilib_is_native_abi && use doc && VARTEXFONTS="${T}/fonts" emake -C doc gcrypt.pdf
+}
+
+multilib_src_test() {
+	# t-secmem and t-sexp need mlock which requires extra privileges; nspawn
+	# at least disallows that by default.
+	local -x GCRYPT_IN_ASAN_TEST=1
+	# Avoid running (very) expensive bench-slope test. On hppa, it
+	# takes at least 7 hours.
+	local -x GCRYPT_NO_BENCHMARKS=1
+
+	default
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+	multilib_is_native_abi && use doc && dodoc doc/gcrypt.pdf
+}
+
+multilib_src_install_all() {
+	default
+	find "${ED}" -type f -name '*.la' -delete || die
+}