Adding metadata

24 files changed, 1789 insertions, 1478 deletions

diff --git a/dev-libs/glib/files/glib-2.84.4-fix-const-attribute.patch b/dev-libs/glib/files/glib-2.84.4-fix-const-attribute.patch
deleted file mode 100644
index a8ddf97c35a5..000000000000
--- a/dev-libs/glib/files/glib-2.84.4-fix-const-attribute.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-https://bugs.gentoo.org/970774
-https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5145
-
-From 9f5903a96f419058d457de7b7544c2bc9e73e510 Mon Sep 17 00:00:00 2001
-From: Sam James <sam@gentoo.org>
-Date: Fri, 10 Apr 2026 02:28:48 +0100
-Subject: [PATCH] gvarianttype: use pure attribute, not inappropriate const
-
-As found in https://gcc.gnu.org/PR124837, it is wrong to use the const
-attribute [0] for g_variant_type_*is* because it may be called repeatedly
-with different pointed-to data. The pure attribute [1] is what we want
-here because it allows pointed-to data to change, so change to that.
-
-const would be OK here if it pointed to a constant buffer, but it doesn't,
-it points to newly malloc'd memory from all over the place.
-
-[0] https://gcc.gnu.org/onlinedocs/gcc-15.2.0/gcc/Common-Function-Attributes.html#index-const-function-attribute
-[1] https://gcc.gnu.org/onlinedocs/gcc-15.2.0/gcc/Common-Function-Attributes.html#index-pure-function-attribute
-
-Fixes: 49bfa7b9cf8b16f7f6a5b1db565575d61a37100f
-Signed-off-by: Sam James <sam@gentoo.org>
----
- glib/gvarianttype.h | 32 ++++++++++++++++----------------
- 1 file changed, 16 insertions(+), 16 deletions(-)
-
-diff --git a/glib/gvarianttype.h b/glib/gvarianttype.h
-index 38980af829..3a57b9131a 100644
---- a/glib/gvarianttype.h
-+++ b/glib/gvarianttype.h
-@@ -302,7 +302,7 @@ typedef struct _GVariantType GVariantType;
- 
- /* type string checking */
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_string_is_valid          (const gchar         *type_string) G_GNUC_CONST;
-+gboolean                        g_variant_type_string_is_valid          (const gchar         *type_string) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
- gboolean                        g_variant_type_string_scan              (const gchar         *string,
-                                                                          const gchar         *limit,
-@@ -326,21 +326,21 @@ gchar *                         g_variant_type_dup_string               (const G
- 
- /* classification */
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_definite              (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_definite              (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_container             (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_container             (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_basic                 (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_basic                 (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_maybe                 (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_maybe                 (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_array                 (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_array                 (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_tuple                 (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_tuple                 (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_dict_entry            (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_dict_entry            (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gboolean                        g_variant_type_is_variant               (const GVariantType  *type) G_GNUC_CONST;
-+gboolean                        g_variant_type_is_variant               (const GVariantType  *type) G_GNUC_PURE;
- 
- /* for hash tables */
- GLIB_AVAILABLE_IN_ALL
-@@ -352,21 +352,21 @@ gboolean                        g_variant_type_equal                    (gconstp
- /* subtypes */
- GLIB_AVAILABLE_IN_ALL
- gboolean                        g_variant_type_is_subtype_of            (const GVariantType  *type,
--                                                                         const GVariantType  *supertype) G_GNUC_CONST;
-+                                                                         const GVariantType  *supertype) G_GNUC_PURE;
- 
- /* type iterator interface */
- GLIB_AVAILABLE_IN_ALL
--const GVariantType *            g_variant_type_element                  (const GVariantType  *type) G_GNUC_CONST;
-+const GVariantType *            g_variant_type_element                  (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--const GVariantType *            g_variant_type_first                    (const GVariantType  *type) G_GNUC_CONST;
-+const GVariantType *            g_variant_type_first                    (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--const GVariantType *            g_variant_type_next                     (const GVariantType  *type) G_GNUC_CONST;
-+const GVariantType *            g_variant_type_next                     (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--gsize                           g_variant_type_n_items                  (const GVariantType  *type) G_GNUC_CONST;
-+gsize                           g_variant_type_n_items                  (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--const GVariantType *            g_variant_type_key                      (const GVariantType  *type) G_GNUC_CONST;
-+const GVariantType *            g_variant_type_key                      (const GVariantType  *type) G_GNUC_PURE;
- GLIB_AVAILABLE_IN_ALL
--const GVariantType *            g_variant_type_value                    (const GVariantType  *type) G_GNUC_CONST;
-+const GVariantType *            g_variant_type_value                    (const GVariantType  *type) G_GNUC_PURE;
- 
- /* constructors */
- GLIB_AVAILABLE_IN_ALL
--- 
-GitLab
diff --git a/dev-libs/glib/files/glib-2.84.4-libpcre2-10.47.patch b/dev-libs/glib/files/glib-2.84.4-libpcre2-10.47.patch
deleted file mode 100644
index 69d80f81d95e..000000000000
--- a/dev-libs/glib/files/glib-2.84.4-libpcre2-10.47.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-https://gitlab.gnome.org/GNOME/glib/-/issues/3809
-https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4884
-
-From 8dceb68e6e6d6e205f70c7800c01e1fc23c04616 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
-Date: Thu, 23 Oct 2025 22:35:42 +0200
-Subject: [PATCH 1/3] gregex: Handle PCRE2_ERROR_MISSING_NUMBER_TERMINATOR if
- defined
-
-When the error is defined in a new enough PCRE2 we should handle it.
-
-However let's not define an error message for this in this commit (just
-let's use the old one that is generic enough), so that it can be backported
-to stable versions without having to require new translations.
-
-Closes: #3809
----
- glib/gregex.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/glib/gregex.c b/glib/gregex.c
-index 969c702b4d..fac3f58fe1 100644
---- a/glib/gregex.c
-+++ b/glib/gregex.c
-@@ -770,6 +770,9 @@ translate_compile_error (gint *errcode, const gchar **errmsg)
-       *errmsg = _("inconsistent NEWLINE options");
-       break;
-     case PCRE2_ERROR_BACKSLASH_G_SYNTAX:
-+#ifdef PCRE2_ERROR_MISSING_NUMBER_TERMINATOR
-+    case PCRE2_ERROR_MISSING_NUMBER_TERMINATOR:
-+#endif
-       *errcode = G_REGEX_ERROR_MISSING_BACK_REFERENCE;
-       *errmsg = _("\\g is not followed by a braced, angle-bracketed, or quoted name or "
-                   "number, or by a plain number");
--- 
-GitLab
-
-
-From ea5aa5419468c7c030a86b52878005bed7a31c60 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
-Date: Thu, 23 Oct 2025 22:37:35 +0200
-Subject: [PATCH 2/3] tests/regex: Add the error messages to tests
-
-It can be useful for debugging purposes
----
- glib/tests/regex.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/glib/tests/regex.c b/glib/tests/regex.c
-index d7a698ec67..a052db9758 100644
---- a/glib/tests/regex.c
-+++ b/glib/tests/regex.c
-@@ -131,6 +131,8 @@ test_new_fail (gconstpointer d)
- 
-   g_assert (regex == NULL);
-   g_assert_error (error, G_REGEX_ERROR, data->expected_error);
-+  g_test_message ("Compiling pattern /%s/ failed with error: %s",
-+                  data->pattern, error->message);
-   g_error_free (error);
- }
- 
--- 
-GitLab
-
-
-From ef512a3f58ff4f918df0701d5bcfcd7de51775e3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
-Date: Thu, 23 Oct 2025 22:38:35 +0200
-Subject: [PATCH 3/3] gregex: Add translatable message for
- PCRE2_ERROR_MISSING_NUMBER_TERMINATOR
-
----
- glib/gregex.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/glib/gregex.c b/glib/gregex.c
-index fac3f58fe1..6dfb05f613 100644
---- a/glib/gregex.c
-+++ b/glib/gregex.c
-@@ -770,13 +770,16 @@ translate_compile_error (gint *errcode, const gchar **errmsg)
-       *errmsg = _("inconsistent NEWLINE options");
-       break;
-     case PCRE2_ERROR_BACKSLASH_G_SYNTAX:
--#ifdef PCRE2_ERROR_MISSING_NUMBER_TERMINATOR
--    case PCRE2_ERROR_MISSING_NUMBER_TERMINATOR:
--#endif
-       *errcode = G_REGEX_ERROR_MISSING_BACK_REFERENCE;
-       *errmsg = _("\\g is not followed by a braced, angle-bracketed, or quoted name or "
-                   "number, or by a plain number");
-       break;
-+#ifdef PCRE2_ERROR_MISSING_NUMBER_TERMINATOR
-+    case PCRE2_ERROR_MISSING_NUMBER_TERMINATOR:
-+      *errcode = G_REGEX_ERROR_MISSING_BACK_REFERENCE;
-+      *errmsg = _("syntax error in subpattern number (missing terminator?)");
-+      break;
-+#endif
-     case PCRE2_ERROR_VERB_ARGUMENT_NOT_ALLOWED:
-       *errcode = G_REGEX_ERROR_BACKTRACKING_CONTROL_VERB_ARGUMENT_FORBIDDEN;
-       *errmsg = _("an argument is not allowed for (*ACCEPT), (*FAIL), or (*COMMIT)");
--- 
-GitLab
diff --git a/dev-libs/glib/files/glib-2.84.4-setlocale-glibc-2.43.patch b/dev-libs/glib/files/glib-2.84.4-setlocale-glibc-2.43.patch
deleted file mode 100644
index 5ccaf21b0938..000000000000
--- a/dev-libs/glib/files/glib-2.84.4-setlocale-glibc-2.43.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-https://bugs.gentoo.org/969959
-https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5035
-
-From 7c837a520f51db74e482bc8196ed5ff40e432307 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Mon, 23 Feb 2026 12:30:08 +0000
-Subject: [PATCH] gdatetime: Fix comparison against cached LC_TIME value
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The string pointer returned by `setlocale (LC_TIME, NULL)` may change if
-other code calls `setlocale()` again. But because internally glibc
-implements it using `strdup()`, the pointer value itself may actually
-stay the same even if the string contents change.
-
-This started happening more commonly in glibc 2.43, due to an internal
-`malloc()` change which happened to trigger this latent bug.
-
-In the situations where this happened, it resulted in an outdated cached
-era value being used.
-
-Fix it by taking a copy of the `LC_TIME` string. Unfortunately this
-means a reachable (‘leaked’) static string allocation at the end of the
-process’ life, but tooling should ignore that if we mark it with
-`g_ignore_leak()`.
-
-Debugged by Sam James, Wilco and Douglas R. Reno. See also
-https://sourceware.org/bugzilla/show_bug.cgi?id=33899#c6.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-Fixes: #3895
----
- glib/gdatetime.c | 9 ++++++---
- 1 file changed, 6 insertions(+), 3 deletions(-)
-
-diff --git a/glib/gdatetime.c b/glib/gdatetime.c
-index c4d7445432..8d67354cf2 100644
---- a/glib/gdatetime.c
-+++ b/glib/gdatetime.c
-@@ -65,6 +65,7 @@
- #include <langinfo.h>
- #endif
- 
-+#include "glib-private.h"
- #include "gatomic.h"
- #include "gcharset.h"
- #include "gcharsetprivate.h"
-@@ -2981,14 +2982,14 @@ date_time_lookup_era (GDateTime *datetime,
- {
-   static GMutex era_mutex;
-   static GPtrArray *static_era_description = NULL;  /* (mutex era_mutex) (element-type GEraDescriptionSegment) */
--  static const char *static_era_description_locale = NULL;  /* (mutex era_mutex) */
-+  static char *static_era_description_locale = NULL;  /* (mutex era_mutex) (owned) */
-   const char *current_lc_time = setlocale (LC_TIME, NULL);
-   GPtrArray *local_era_description;  /* (element-type GEraDescriptionSegment) */
-   GEraDate datetime_date;
- 
-   g_mutex_lock (&era_mutex);
- 
--  if (static_era_description_locale != current_lc_time)
-+  if (g_strcmp0 (static_era_description_locale, current_lc_time) != 0)
-     {
-       const char *era_description_str;
-       size_t era_description_str_len;
-@@ -3061,7 +3062,9 @@ date_time_lookup_era (GDateTime *datetime,
- 
-       g_free (tmp);
- 
--      static_era_description_locale = current_lc_time;
-+      g_free (static_era_description_locale);
-+      static_era_description_locale = g_strdup (current_lc_time);
-+      g_ignore_leak (static_era_description_locale);
-     }
- 
-   if (static_era_description == NULL)
--- 
-GitLab
diff --git a/dev-libs/glib/files/glib-2.86-MR-4912.patch b/dev-libs/glib/files/glib-2.86-MR-4912.patch
deleted file mode 100644
index 4fdbb3a31195..000000000000
--- a/dev-libs/glib/files/glib-2.86-MR-4912.patch
+++ /dev/null
@@ -1,186 +0,0 @@
-From d3a16bc03c58a4f7c3222462110509e39c209ebf Mon Sep 17 00:00:00 2001
-From: Jehan <jehan@girinstud.io>
-Date: Fri, 7 Nov 2025 12:09:43 +0100
-Subject: [PATCH] Issue #3819: G_FILE_MONITOR_WATCH_HARD_LINK does not monitor
- files on Windows.
-
-Current code was clearly considering the case of having only a filename
-as a directory monitoring, instead of a hard-link monitoring. As I
-assume that hard links don't exist on Windows, this case should simply
-revert back to the basic file monitoring code path.
----
- gio/win32/gwin32fsmonitorutils.c | 121 ++++++++++++++++---------------
- 1 file changed, 63 insertions(+), 58 deletions(-)
-
-diff --git a/gio/win32/gwin32fsmonitorutils.c b/gio/win32/gwin32fsmonitorutils.c
-index d06dc458a0..cc2a60b116 100644
---- a/gio/win32/gwin32fsmonitorutils.c
-+++ b/gio/win32/gwin32fsmonitorutils.c
-@@ -245,9 +245,9 @@ g_win32_fs_monitor_init (GWin32FSMonitorPrivate *monitor,
-                          const gchar *filename,
-                          gboolean isfile)
- {
--  wchar_t *wdirname_with_long_prefix = NULL;
-+  gchar   *dirname_with_long_prefix;
-+  wchar_t *wdirname_with_long_prefix;
-   const gchar LONGPFX[] = "\\\\?\\";
--  gchar *fullpath_with_long_prefix, *dirname_with_long_prefix;
-   DWORD notify_filter = isfile ?
-                         (FILE_NOTIFY_CHANGE_FILE_NAME |
-                          FILE_NOTIFY_CHANGE_ATTRIBUTES |
-@@ -260,83 +260,88 @@ g_win32_fs_monitor_init (GWin32FSMonitorPrivate *monitor,
-   gboolean success_attribs;
-   WIN32_FILE_ATTRIBUTE_DATA attrib_data = {0, };
- 
-+  g_return_if_fail ((filename && isfile) || (dirname && ! isfile));
- 
-   if (dirname != NULL)
-     {
-       dirname_with_long_prefix = g_strconcat (LONGPFX, dirname, NULL);
--      wdirname_with_long_prefix = g_utf8_to_utf16 (dirname_with_long_prefix, -1, NULL, NULL, NULL);
--
--      if (isfile)
--        {
--          gchar *fullpath;
--          wchar_t wlongname[MAX_PATH_LONG];
--          wchar_t wshortname[MAX_PATH_LONG];
--          wchar_t *wfullpath, *wbasename_long, *wbasename_short;
-+    }
-+  else
-+    {
-+      gchar *tmp_dirname = g_path_get_dirname (filename);
-+      dirname_with_long_prefix = g_strconcat (LONGPFX, tmp_dirname, NULL);
-+      g_free (tmp_dirname);
-+    }
-+  wdirname_with_long_prefix = g_utf8_to_utf16 (dirname_with_long_prefix, -1, NULL, NULL, NULL);
- 
--          fullpath = g_build_filename (dirname, filename, NULL);
--          fullpath_with_long_prefix = g_strconcat (LONGPFX, fullpath, NULL);
-+  if (isfile)
-+    {
-+      gchar *fullpath;
-+      gchar *fullpath_with_long_prefix;
-+      wchar_t wlongname[MAX_PATH_LONG];
-+      wchar_t wshortname[MAX_PATH_LONG];
-+      wchar_t *wfullpath, *wbasename_long, *wbasename_short;
-+
-+      if (dirname)
-+        fullpath = g_build_filename (dirname, filename, NULL);
-+      else
-+        fullpath = g_strdup (filename);
- 
--          wfullpath = g_utf8_to_utf16 (fullpath, -1, NULL, NULL, NULL);
-+      fullpath_with_long_prefix = g_strconcat (LONGPFX, fullpath, NULL);
- 
--          monitor->wfullpath_with_long_prefix =
--            g_utf8_to_utf16 (fullpath_with_long_prefix, -1, NULL, NULL, NULL);
-+      wfullpath = g_utf8_to_utf16 (fullpath, -1, NULL, NULL, NULL);
- 
--          /* ReadDirectoryChangesW() can return the normal filename or the
--           * "8.3" format filename, so we need to keep track of both these names
--           * so that we can check against them later when it returns
--           */
--          if (GetLongPathNameW (monitor->wfullpath_with_long_prefix, wlongname, MAX_PATH_LONG) == 0)
--            {
--              wbasename_long = wcsrchr (monitor->wfullpath_with_long_prefix, L'\\');
--              monitor->wfilename_long = wbasename_long != NULL ?
--                                        wcsdup (wbasename_long + 1) :
--                                        wcsdup (wfullpath);
--            }
--          else
--            {
--              wbasename_long = wcsrchr (wlongname, L'\\');
--              monitor->wfilename_long = wbasename_long != NULL ?
--                                        wcsdup (wbasename_long + 1) :
--                                        wcsdup (wlongname);
-+      monitor->wfullpath_with_long_prefix =
-+        g_utf8_to_utf16 (fullpath_with_long_prefix, -1, NULL, NULL, NULL);
- 
--            }
-+      /* ReadDirectoryChangesW() can return the normal filename or the
-+       * "8.3" format filename, so we need to keep track of both these names
-+       * so that we can check against them later when it returns
-+       */
-+      if (GetLongPathNameW (monitor->wfullpath_with_long_prefix, wlongname, MAX_PATH_LONG) == 0)
-+        {
-+          wbasename_long = wcsrchr (monitor->wfullpath_with_long_prefix, L'\\');
-+          monitor->wfilename_long = wbasename_long != NULL ?
-+            wcsdup (wbasename_long + 1) :
-+            wcsdup (wfullpath);
-+        }
-+      else
-+        {
-+          wbasename_long = wcsrchr (wlongname, L'\\');
-+          monitor->wfilename_long = wbasename_long != NULL ?
-+            wcsdup (wbasename_long + 1) :
-+            wcsdup (wlongname);
- 
--          if (GetShortPathNameW (monitor->wfullpath_with_long_prefix, wshortname, MAX_PATH_LONG) == 0)
--            {
--              wbasename_short = wcsrchr (monitor->wfullpath_with_long_prefix, L'\\');
--              monitor->wfilename_short = wbasename_short != NULL ?
--                                         wcsdup (wbasename_short + 1) :
--                                         wcsdup (wfullpath);
--            }
--          else
--            {
--              wbasename_short = wcsrchr (wshortname, L'\\');
--              monitor->wfilename_short = wbasename_short != NULL ?
--                                         wcsdup (wbasename_short + 1) :
--                                         wcsdup (wshortname);
--            }
-+        }
- 
--          g_free (wfullpath);
--          g_free (fullpath);
-+      if (GetShortPathNameW (monitor->wfullpath_with_long_prefix, wshortname, MAX_PATH_LONG) == 0)
-+        {
-+          wbasename_short = wcsrchr (monitor->wfullpath_with_long_prefix, L'\\');
-+          monitor->wfilename_short = wbasename_short != NULL ?
-+            wcsdup (wbasename_short + 1) :
-+            wcsdup (wfullpath);
-         }
-       else
-         {
--          monitor->wfilename_short = NULL;
--          monitor->wfilename_long = NULL;
--          monitor->wfullpath_with_long_prefix = g_utf8_to_utf16 (dirname_with_long_prefix, -1, NULL, NULL, NULL);
-+          wbasename_short = wcsrchr (wshortname, L'\\');
-+          monitor->wfilename_short = wbasename_short != NULL ?
-+            wcsdup (wbasename_short + 1) :
-+            wcsdup (wshortname);
-         }
- 
--      monitor->isfile = isfile;
-+      g_free (wfullpath);
-+      g_free (fullpath);
-+      g_free (fullpath_with_long_prefix);
-     }
-   else
-     {
--      dirname_with_long_prefix = g_strconcat (LONGPFX, filename, NULL);
--      monitor->wfullpath_with_long_prefix = g_utf8_to_utf16 (dirname_with_long_prefix, -1, NULL, NULL, NULL);
--      monitor->wfilename_long = NULL;
-       monitor->wfilename_short = NULL;
--      monitor->isfile = FALSE;
-+      monitor->wfilename_long = NULL;
-+      monitor->wfullpath_with_long_prefix = g_utf8_to_utf16 (dirname_with_long_prefix, -1, NULL, NULL, NULL);
-     }
- 
-+  monitor->isfile = isfile;
-+
-   success_attribs = GetFileAttributesExW (monitor->wfullpath_with_long_prefix,
-                                           GetFileExInfoStandard,
-                                           &attrib_data);
-@@ -345,7 +350,7 @@ g_win32_fs_monitor_init (GWin32FSMonitorPrivate *monitor,
-   else
-     monitor->file_attribs = INVALID_FILE_ATTRIBUTES;
-   monitor->pfni_prev = NULL;
--  monitor->hDirectory = CreateFileW (wdirname_with_long_prefix != NULL ? wdirname_with_long_prefix : monitor->wfullpath_with_long_prefix,
-+  monitor->hDirectory = CreateFileW (wdirname_with_long_prefix,
-                                      FILE_LIST_DIRECTORY,
-                                      FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
-                                      NULL,
--- 
-GitLab
-
diff --git a/dev-libs/glib/files/glib-2.86-MR-4915-CVE-2025-13601.patch b/dev-libs/glib/files/glib-2.86-MR-4915-CVE-2025-13601.patch
deleted file mode 100644
index acba3fd7bd2d..000000000000
--- a/dev-libs/glib/files/glib-2.86-MR-4915-CVE-2025-13601.patch
+++ /dev/null
@@ -1,261 +0,0 @@
-From 9bcd65ba5fa1b92ff0fb8380faea335ccef56253 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Thu, 13 Nov 2025 18:27:22 +0000
-Subject: [PATCH 1/2] gconvert: Error out if g_escape_uri_string() would
- overflow
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-If the string to escape contains a very large number of unacceptable
-characters (which would need escaping), the calculation of the length of
-the escaped string could overflow, leading to a potential write off the
-end of the newly allocated string.
-
-In addition to that, the number of unacceptable characters was counted
-in a signed integer, which would overflow to become negative, making it
-easier for an attacker to craft an input string which would cause an
-out-of-bounds write.
-
-Fix that by validating the allocation length, and using an unsigned
-integer to count the number of unacceptable characters.
-
-Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
-from the Sovereign Tech Agency. ID: #YWH-PGM9867-134
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-Fixes: #3827
-
-Backport 2.86: Changed the translatable error message to re-use an
-existing translatable string, to avoid adding new translatable strings
-to a stable branch. The re-used string doesn’t perfectly match the
-error, but it’s good enough given that no users will ever see it.
----
- glib/gconvert.c | 36 +++++++++++++++++++++++++-----------
- 1 file changed, 25 insertions(+), 11 deletions(-)
-
-diff --git a/glib/gconvert.c b/glib/gconvert.c
-index 7ad8ca018f..367e9b4661 100644
---- a/glib/gconvert.c
-+++ b/glib/gconvert.c
-@@ -1336,8 +1336,9 @@ static const gchar hex[] = "0123456789ABCDEF";
- /* Note: This escape function works on file: URIs, but if you want to
-  * escape something else, please read RFC-2396 */
- static gchar *
--g_escape_uri_string (const gchar *string, 
--		     UnsafeCharacterSet mask)
-+g_escape_uri_string (const gchar         *string,
-+                     UnsafeCharacterSet   mask,
-+                     GError             **error)
- {
- #define ACCEPTABLE(a) ((a)>=32 && (a)<128 && (acceptable[(a)-32] & use_mask))
- 
-@@ -1345,7 +1346,7 @@ g_escape_uri_string (const gchar *string,
-   gchar *q;
-   gchar *result;
-   int c;
--  gint unacceptable;
-+  size_t unacceptable;
-   UnsafeCharacterSet use_mask;
-   
-   g_return_val_if_fail (mask == UNSAFE_ALL
-@@ -1362,7 +1363,14 @@ g_escape_uri_string (const gchar *string,
-       if (!ACCEPTABLE (c)) 
- 	unacceptable++;
-     }
--  
-+
-+  if (unacceptable >= (G_MAXSIZE - (p - string)) / 2)
-+    {
-+      g_set_error_literal (error, G_CONVERT_ERROR, G_CONVERT_ERROR_BAD_URI,
-+                           _("Invalid hostname"));
-+      return NULL;
-+    }
-+
-   result = g_malloc (p - string + unacceptable * 2 + 1);
-   
-   use_mask = mask;
-@@ -1387,12 +1395,13 @@ g_escape_uri_string (const gchar *string,
- 
- 
- static gchar *
--g_escape_file_uri (const gchar *hostname,
--		   const gchar *pathname)
-+g_escape_file_uri (const gchar  *hostname,
-+                   const gchar  *pathname,
-+                   GError      **error)
- {
-   char *escaped_hostname = NULL;
--  char *escaped_path;
--  char *res;
-+  char *escaped_path = NULL;
-+  char *res = NULL;
- 
- #ifdef G_OS_WIN32
-   char *p, *backslash;
-@@ -1413,10 +1422,14 @@ g_escape_file_uri (const gchar *hostname,
- 
-   if (hostname && *hostname != '\0')
-     {
--      escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST);
-+      escaped_hostname = g_escape_uri_string (hostname, UNSAFE_HOST, error);
-+      if (escaped_hostname == NULL)
-+        goto out;
-     }
- 
--  escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH);
-+  escaped_path = g_escape_uri_string (pathname, UNSAFE_PATH, error);
-+  if (escaped_path == NULL)
-+    goto out;
- 
-   res = g_strconcat ("file://",
- 		     (escaped_hostname) ? escaped_hostname : "",
-@@ -1424,6 +1437,7 @@ g_escape_file_uri (const gchar *hostname,
- 		     escaped_path,
- 		     NULL);
- 
-+out:
- #ifdef G_OS_WIN32
-   g_free ((char *) pathname);
- #endif
-@@ -1757,7 +1771,7 @@ g_filename_to_uri (const gchar *filename,
-     hostname = NULL;
- #endif
- 
--  escaped_uri = g_escape_file_uri (hostname, filename);
-+  escaped_uri = g_escape_file_uri (hostname, filename, error);
- 
-   return escaped_uri;
- }
--- 
-GitLab
-
-
-From 7e5489cb921d0531ee4ebc9938da30a02084b2fa Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Thu, 13 Nov 2025 18:31:43 +0000
-Subject: [PATCH 2/2] fuzzing: Add fuzz tests for g_filename_{to,from}_uri()
-
-These functions could be called on untrusted input data, and since they
-do URI escaping/unescaping, they have non-trivial string handling code.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-See: #3827
----
- fuzzing/fuzz_filename_from_uri.c | 40 ++++++++++++++++++++++++++++++++
- fuzzing/fuzz_filename_to_uri.c   | 40 ++++++++++++++++++++++++++++++++
- fuzzing/meson.build              |  2 ++
- 3 files changed, 82 insertions(+)
- create mode 100644 fuzzing/fuzz_filename_from_uri.c
- create mode 100644 fuzzing/fuzz_filename_to_uri.c
-
-diff --git a/fuzzing/fuzz_filename_from_uri.c b/fuzzing/fuzz_filename_from_uri.c
-new file mode 100644
-index 0000000000..9b7a715f07
---- /dev/null
-+++ b/fuzzing/fuzz_filename_from_uri.c
-@@ -0,0 +1,40 @@
-+/*
-+ * Copyright 2025 GNOME Foundation, Inc.
-+ *
-+ * SPDX-License-Identifier: LGPL-2.1-or-later
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "fuzz.h"
-+
-+int
-+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
-+{
-+  unsigned char *nul_terminated_data = NULL;
-+  char *filename = NULL;
-+  GError *local_error = NULL;
-+
-+  fuzz_set_logging_func ();
-+
-+  /* ignore @size (g_filename_from_uri() doesn’t support it); ensure @data is nul-terminated */
-+  nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size);
-+  filename = g_filename_from_uri ((const char *) nul_terminated_data, NULL, &local_error);
-+  g_free (nul_terminated_data);
-+
-+  g_free (filename);
-+  g_clear_error (&local_error);
-+
-+  return 0;
-+}
-diff --git a/fuzzing/fuzz_filename_to_uri.c b/fuzzing/fuzz_filename_to_uri.c
-new file mode 100644
-index 0000000000..acb3192035
---- /dev/null
-+++ b/fuzzing/fuzz_filename_to_uri.c
-@@ -0,0 +1,40 @@
-+/*
-+ * Copyright 2025 GNOME Foundation, Inc.
-+ *
-+ * SPDX-License-Identifier: LGPL-2.1-or-later
-+ *
-+ * This library is free software; you can redistribute it and/or
-+ * modify it under the terms of the GNU Lesser General Public
-+ * License as published by the Free Software Foundation; either
-+ * version 2.1 of the License, or (at your option) any later version.
-+ *
-+ * This library is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-+ * Lesser General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU Lesser General Public
-+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
-+#include "fuzz.h"
-+
-+int
-+LLVMFuzzerTestOneInput (const unsigned char *data, size_t size)
-+{
-+  unsigned char *nul_terminated_data = NULL;
-+  char *uri = NULL;
-+  GError *local_error = NULL;
-+
-+  fuzz_set_logging_func ();
-+
-+  /* ignore @size (g_filename_to_uri() doesn’t support it); ensure @data is nul-terminated */
-+  nul_terminated_data = (unsigned char *) g_strndup ((const char *) data, size);
-+  uri = g_filename_to_uri ((const char *) nul_terminated_data, NULL, &local_error);
-+  g_free (nul_terminated_data);
-+
-+  g_free (uri);
-+  g_clear_error (&local_error);
-+
-+  return 0;
-+}
-diff --git a/fuzzing/meson.build b/fuzzing/meson.build
-index addbe90717..05f936eeb2 100644
---- a/fuzzing/meson.build
-+++ b/fuzzing/meson.build
-@@ -25,6 +25,8 @@ fuzz_targets = [
-   'fuzz_date_parse',
-   'fuzz_date_time_new_from_iso8601',
-   'fuzz_dbus_message',
-+  'fuzz_filename_from_uri',
-+  'fuzz_filename_to_uri',
-   'fuzz_get_locale_variants',
-   'fuzz_inet_address_mask_new_from_string',
-   'fuzz_inet_address_new_from_string',
--- 
-GitLab
-
diff --git a/dev-libs/glib/files/glib-2.86-MR-4934-CVE-2025-14087.patch b/dev-libs/glib/files/glib-2.86-MR-4934-CVE-2025-14087.patch
deleted file mode 100644
index 018c4fbffcd8..000000000000
--- a/dev-libs/glib/files/glib-2.86-MR-4934-CVE-2025-14087.patch
+++ /dev/null
@@ -1,459 +0,0 @@
-From 3e72fe0fbb32c18a66486c4da8bc851f656af287 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Tue, 25 Nov 2025 19:02:56 +0000
-Subject: [PATCH 1/3] gvariant-parser: Fix potential integer overflow parsing
- (byte)strings
-
-The termination condition for parsing string and bytestring literals in
-GVariant text format input was subject to an integer overflow for input
-string (or bytestring) literals longer than `INT_MAX`.
-
-Fix that by counting as a `size_t` rather than as an `int`. The counter
-can never correctly be negative.
-
-Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
-from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-Fixes: #3834
----
- glib/gvariant-parser.c | 10 +++++-----
- 1 file changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
-index 2f1d3db9f6..2d6e9856f8 100644
---- a/glib/gvariant-parser.c
-+++ b/glib/gvariant-parser.c
-@@ -609,7 +609,7 @@ ast_resolve (AST     *ast,
- {
-   GVariant *value;
-   gchar *pattern;
--  gint i, j = 0;
-+  size_t i, j = 0;
- 
-   pattern = ast_get_pattern (ast, error);
- 
-@@ -1637,9 +1637,9 @@ string_free (AST *ast)
-  */
- static gboolean
- unicode_unescape (const gchar  *src,
--                  gint         *src_ofs,
-+                  size_t       *src_ofs,
-                   gchar        *dest,
--                  gint         *dest_ofs,
-+                  size_t       *dest_ofs,
-                   gsize         length,
-                   SourceRef    *ref,
-                   GError      **error)
-@@ -1700,7 +1700,7 @@ string_parse (TokenStream  *stream,
-   gsize length;
-   gchar quote;
-   gchar *str;
--  gint i, j;
-+  size_t i, j;
- 
-   token_stream_start_ref (stream, &ref);
-   token = token_stream_get (stream);
-@@ -1833,7 +1833,7 @@ bytestring_parse (TokenStream  *stream,
-   gsize length;
-   gchar quote;
-   gchar *str;
--  gint i, j;
-+  size_t i, j;
- 
-   token_stream_start_ref (stream, &ref);
-   token = token_stream_get (stream);
--- 
-GitLab
-
-
-From 6fe481cec709ec65b5846113848723bc25a8782a Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Tue, 25 Nov 2025 19:19:16 +0000
-Subject: [PATCH 2/3] gvariant-parser: Use size_t to count numbers of child
- elements
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Rather than using `gint`, which could overflow for arrays (or dicts, or
-tuples) longer than `INT_MAX`. There may be other limits which prevent
-parsed containers becoming that long, but we might as well make the type
-system reflect the programmer’s intention as best it can anyway.
-
-For arrays and tuples this is straightforward. For dictionaries, it’s
-slightly complicated by the fact that the code used
-`dict->n_children == -1` to indicate that the `Dictionary` struct in
-question actually represented a single freestanding dict entry. In
-GVariant text format, that would be `{1, "one"}`.
-
-The implementation previously didn’t define the semantics of
-`dict->n_children < -1`.
-
-Now, instead, change `Dictionary.n_children` to `size_t`, and define a
-magic value `DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY` to indicate that
-the `Dictionary` represents a single freestanding dict entry.
-
-This magic value is `SIZE_MAX`, and given that a dictionary entry takes
-more than one byte to represent in GVariant text format, that means it’s
-not possible to have that many entries in a parsed dictionary, so this
-magic value won’t be hit by a normal dictionary. An assertion checks
-this anyway.
-
-Spotted while working on #3834.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
----
- glib/gvariant-parser.c | 58 ++++++++++++++++++++++++------------------
- 1 file changed, 33 insertions(+), 25 deletions(-)
-
-diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
-index 2d6e9856f8..519baa3f36 100644
---- a/glib/gvariant-parser.c
-+++ b/glib/gvariant-parser.c
-@@ -662,9 +662,9 @@ static AST *parse (TokenStream  *stream,
-                    GError      **error);
- 
- static void
--ast_array_append (AST  ***array,
--                  gint   *n_items,
--                  AST    *ast)
-+ast_array_append (AST    ***array,
-+                  size_t   *n_items,
-+                  AST      *ast)
- {
-   if ((*n_items & (*n_items - 1)) == 0)
-     *array = g_renew (AST *, *array, *n_items ? 2 ** n_items : 1);
-@@ -673,10 +673,10 @@ ast_array_append (AST  ***array,
- }
- 
- static void
--ast_array_free (AST  **array,
--                gint   n_items)
-+ast_array_free (AST    **array,
-+                size_t   n_items)
- {
--  gint i;
-+  size_t i;
- 
-   for (i = 0; i < n_items; i++)
-     ast_free (array[i]);
-@@ -685,11 +685,11 @@ ast_array_free (AST  **array,
- 
- static gchar *
- ast_array_get_pattern (AST    **array,
--                       gint     n_items,
-+                       size_t   n_items,
-                        GError **error)
- {
-   gchar *pattern;
--  gint i;
-+  size_t i;
- 
-   /* Find the pattern which applies to all children in the array, by l-folding a
-    * coalesce operation.
-@@ -721,7 +721,7 @@ ast_array_get_pattern (AST    **array,
-          * pair of values.
-          */
-         {
--          int j = 0;
-+          size_t j = 0;
- 
-           while (TRUE)
-             {
-@@ -969,7 +969,7 @@ typedef struct
-   AST ast;
- 
-   AST **children;
--  gint n_children;
-+  size_t n_children;
- } Array;
- 
- static gchar *
-@@ -1002,7 +1002,7 @@ array_get_value (AST                 *ast,
-   Array *array = (Array *) ast;
-   const GVariantType *childtype;
-   GVariantBuilder builder;
--  gint i;
-+  size_t i;
- 
-   if (!g_variant_type_is_array (type))
-     return ast_type_error (ast, type, error);
-@@ -1088,7 +1088,7 @@ typedef struct
-   AST ast;
- 
-   AST **children;
--  gint n_children;
-+  size_t n_children;
- } Tuple;
- 
- static gchar *
-@@ -1098,7 +1098,7 @@ tuple_get_pattern (AST     *ast,
-   Tuple *tuple = (Tuple *) ast;
-   gchar *result = NULL;
-   gchar **parts;
--  gint i;
-+  size_t i;
- 
-   parts = g_new (gchar *, tuple->n_children + 4);
-   parts[tuple->n_children + 1] = (gchar *) ")";
-@@ -1128,7 +1128,7 @@ tuple_get_value (AST                 *ast,
-   Tuple *tuple = (Tuple *) ast;
-   const GVariantType *childtype;
-   GVariantBuilder builder;
--  gint i;
-+  size_t i;
- 
-   if (!g_variant_type_is_tuple (type))
-     return ast_type_error (ast, type, error);
-@@ -1320,9 +1320,16 @@ typedef struct
- 
-   AST **keys;
-   AST **values;
--  gint n_children;
-+
-+  /* Iff this is DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY then this struct
-+   * represents a single freestanding dict entry (`{1, "one"}`) rather than a
-+   * full dict. In the freestanding case, @keys and @values have exactly one
-+   * member each. */
-+  size_t n_children;
- } Dictionary;
- 
-+#define DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY ((size_t) -1)
-+
- static gchar *
- dictionary_get_pattern (AST     *ast,
-                         GError **error)
-@@ -1337,7 +1344,7 @@ dictionary_get_pattern (AST     *ast,
-     return g_strdup ("Ma{**}");
- 
-   key_pattern = ast_array_get_pattern (dict->keys,
--                                       abs (dict->n_children),
-+                                       (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY) ? 1 : dict->n_children,
-                                        error);
- 
-   if (key_pattern == NULL)
-@@ -1368,7 +1375,7 @@ dictionary_get_pattern (AST     *ast,
-     return NULL;
- 
-   result = g_strdup_printf ("M%s{%c%s}",
--                            dict->n_children > 0 ? "a" : "",
-+                            (dict->n_children > 0 && dict->n_children != DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY) ? "a" : "",
-                             key_char, value_pattern);
-   g_free (value_pattern);
- 
-@@ -1382,7 +1389,7 @@ dictionary_get_value (AST                 *ast,
- {
-   Dictionary *dict = (Dictionary *) ast;
- 
--  if (dict->n_children == -1)
-+  if (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY)
-     {
-       const GVariantType *subtype;
-       GVariantBuilder builder;
-@@ -1415,7 +1422,7 @@ dictionary_get_value (AST                 *ast,
-     {
-       const GVariantType *entry, *key, *val;
-       GVariantBuilder builder;
--      gint i;
-+      size_t i;
- 
-       if (!g_variant_type_is_subtype_of (type, G_VARIANT_TYPE_DICTIONARY))
-         return ast_type_error (ast, type, error);
-@@ -1456,12 +1463,12 @@ static void
- dictionary_free (AST *ast)
- {
-   Dictionary *dict = (Dictionary *) ast;
--  gint n_children;
-+  size_t n_children;
- 
--  if (dict->n_children > -1)
--    n_children = dict->n_children;
--  else
-+  if (dict->n_children == DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY)
-     n_children = 1;
-+  else
-+    n_children = dict->n_children;
- 
-   ast_array_free (dict->keys, n_children);
-   ast_array_free (dict->values, n_children);
-@@ -1479,7 +1486,7 @@ dictionary_parse (TokenStream  *stream,
-     maybe_wrapper, dictionary_get_value,
-     dictionary_free
-   };
--  gint n_keys, n_values;
-+  size_t n_keys, n_values;
-   gboolean only_one;
-   Dictionary *dict;
-   AST *first;
-@@ -1522,7 +1529,7 @@ dictionary_parse (TokenStream  *stream,
-         goto error;
- 
-       g_assert (n_keys == 1 && n_values == 1);
--      dict->n_children = -1;
-+      dict->n_children = DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY;
- 
-       return (AST *) dict;
-     }
-@@ -1555,6 +1562,7 @@ dictionary_parse (TokenStream  *stream,
-     }
- 
-   g_assert (n_keys == n_values);
-+  g_assert (n_keys != DICTIONARY_N_CHILDREN_FREESTANDING_ENTRY);
-   dict->n_children = n_keys;
- 
-   return (AST *) dict;
--- 
-GitLab
-
-
-From dd333a40aa95819720a01caf6de564cd8a4a6310 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Tue, 25 Nov 2025 19:25:58 +0000
-Subject: [PATCH 3/3] gvariant-parser: Convert error handling code to use
- size_t
-
-The error handling code allows for printing out the range of input bytes
-related to a parsing error. This was previously done using `gint`, but
-the input could be longer than `INT_MAX`, so it should really be done
-using `size_t`.
-
-Spotted while working on #3834.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
----
- glib/gvariant-parser.c | 36 +++++++++++++++++++++++-------------
- 1 file changed, 23 insertions(+), 13 deletions(-)
-
-diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
-index 519baa3f36..1b1ddd654b 100644
---- a/glib/gvariant-parser.c
-+++ b/glib/gvariant-parser.c
-@@ -91,7 +91,9 @@ g_variant_parser_get_error_quark (void)
- 
- typedef struct
- {
--  gint start, end;
-+  /* Offsets from the start of the input, in bytes. Can be equal when referring
-+   * to a point rather than a range. The invariant `end >= start` always holds. */
-+  size_t start, end;
- } SourceRef;
- 
- G_GNUC_PRINTF(5, 0)
-@@ -106,14 +108,16 @@ parser_set_error_va (GError      **error,
-   GString *msg = g_string_new (NULL);
- 
-   if (location->start == location->end)
--    g_string_append_printf (msg, "%d", location->start);
-+    g_string_append_printf (msg, "%" G_GSIZE_FORMAT, location->start);
-   else
--    g_string_append_printf (msg, "%d-%d", location->start, location->end);
-+    g_string_append_printf (msg, "%" G_GSIZE_FORMAT "-%" G_GSIZE_FORMAT,
-+                            location->start, location->end);
- 
-   if (other != NULL)
-     {
-       g_assert (other->start != other->end);
--      g_string_append_printf (msg, ",%d-%d", other->start, other->end);
-+      g_string_append_printf (msg, ",%" G_GSIZE_FORMAT "-%" G_GSIZE_FORMAT,
-+                              other->start, other->end);
-     }
-   g_string_append_c (msg, ':');
- 
-@@ -140,11 +144,15 @@ parser_set_error (GError      **error,
- 
- typedef struct
- {
-+  /* We should always have the following ordering constraint:
-+   *   start <= this <= stream <= end
-+   * Additionally, unless in an error or EOF state, `this < stream`.
-+   */
-   const gchar *start;
-   const gchar *stream;
-   const gchar *end;
- 
--  const gchar *this;
-+  const gchar *this;  /* (nullable) */
- } TokenStream;
- 
- 
-@@ -175,7 +183,7 @@ token_stream_set_error (TokenStream  *stream,
- static gboolean
- token_stream_prepare (TokenStream *stream)
- {
--  gint brackets = 0;
-+  gssize brackets = 0;
-   const gchar *end;
- 
-   if (stream->this != NULL)
-@@ -407,7 +415,7 @@ static void
- pattern_copy (gchar       **out,
-               const gchar **in)
- {
--  gint brackets = 0;
-+  gssize brackets = 0;
- 
-   while (**in == 'a' || **in == 'm' || **in == 'M')
-     *(*out)++ = *(*in)++;
-@@ -2765,7 +2773,7 @@ g_variant_builder_add_parsed (GVariantBuilder *builder,
- static gboolean
- parse_num (const gchar *num,
-            const gchar *limit,
--           guint       *result)
-+           size_t      *result)
- {
-   gchar *endptr;
-   gint64 bignum;
-@@ -2775,10 +2783,12 @@ parse_num (const gchar *num,
-   if (endptr != limit)
-     return FALSE;
- 
-+  /* The upper bound here is more restrictive than it technically needs to be,
-+   * but should be enough for any practical situation: */
-   if (bignum < 0 || bignum > G_MAXINT)
-     return FALSE;
- 
--  *result = (guint) bignum;
-+  *result = (size_t) bignum;
- 
-   return TRUE;
- }
-@@ -2789,7 +2799,7 @@ add_last_line (GString     *err,
- {
-   const gchar *last_nl;
-   gchar *chomped;
--  gint i;
-+  size_t i;
- 
-   /* This is an error at the end of input.  If we have a file
-    * with newlines, that's probably the empty string after the
-@@ -2934,7 +2944,7 @@ g_variant_parse_error_print_context (GError      *error,
- 
-   if (dash == NULL || colon < dash)
-     {
--      guint point;
-+      size_t point;
- 
-       /* we have a single point */
-       if (!parse_num (error->message, colon, &point))
-@@ -2952,7 +2962,7 @@ g_variant_parse_error_print_context (GError      *error,
-       /* We have one or two ranges... */
-       if (comma && comma < colon)
-         {
--          guint start1, end1, start2, end2;
-+          size_t start1, end1, start2, end2;
-           const gchar *dash2;
- 
-           /* Two ranges */
-@@ -2968,7 +2978,7 @@ g_variant_parse_error_print_context (GError      *error,
-         }
-       else
-         {
--          guint start, end;
-+          size_t start, end;
- 
-           /* One range */
-           if (!parse_num (error->message, dash, &start) || !parse_num (dash + 1, colon, &end))
--- 
-GitLab
-
diff --git a/dev-libs/glib/files/glib-2.86-MR-4936.patch b/dev-libs/glib/files/glib-2.86-MR-4936.patch
deleted file mode 100644
index ce1d9b1328f4..000000000000
--- a/dev-libs/glib/files/glib-2.86-MR-4936.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 4f0399c0aaf3ffc86b5625424580294bc7460404 Mon Sep 17 00:00:00 2001
-From: Philip Withnall <pwithnall@gnome.org>
-Date: Thu, 4 Dec 2025 16:37:19 +0000
-Subject: [PATCH] gfileattribute: Fix integer overflow calculating escaping for
- byte strings
-
-The number of invalid characters in the byte string (characters which
-would have to be percent-encoded) was only stored in an `int`, which
-gave the possibility of a long string largely full of invalid
-characters overflowing this and allowing an attacker-controlled buffer
-size to be allocated.
-
-This could be triggered by an attacker controlled file attribute (of
-type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
-`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
-being read by user code.
-
-Spotted by Codean Labs.
-
-Signed-off-by: Philip Withnall <pwithnall@gnome.org>
-
-Fixes: #3845
----
- gio/gfileattribute.c | 11 +++++++++--
- 1 file changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/gio/gfileattribute.c b/gio/gfileattribute.c
-index c6fde60fa9..d3083e5bd8 100644
---- a/gio/gfileattribute.c
-+++ b/gio/gfileattribute.c
-@@ -22,6 +22,7 @@
- 
- #include "config.h"
- 
-+#include <stdint.h>
- #include <string.h>
- 
- #include "gfileattribute.h"
-@@ -166,11 +167,12 @@ valid_char (char c)
-   return c >= 32 && c <= 126 && c != '\\';
- }
- 
-+/* Returns NULL on error */
- static char *
- escape_byte_string (const char *str)
- {
-   size_t i, len;
--  int num_invalid;
-+  size_t num_invalid;
-   char *escaped_val, *p;
-   unsigned char c;
-   const char hex_digits[] = "0123456789abcdef";
-@@ -188,7 +190,12 @@ escape_byte_string (const char *str)
-     return g_strdup (str);
-   else
-     {
--      escaped_val = g_malloc (len + num_invalid*3 + 1);
-+      /* Check for overflow. We want to check the inequality:
-+       * !(len + num_invalid * 3 + 1 > SIZE_MAX) */
-+      if (num_invalid >= (SIZE_MAX - len) / 3)
-+        return NULL;
-+
-+      escaped_val = g_malloc (len + num_invalid * 3 + 1);
- 
-       p = escaped_val;
-       for (i = 0; i < len; i++)
--- 
-GitLab
-
diff --git a/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch b/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch
deleted file mode 100644
index 5b73aea5c944..000000000000
--- a/dev-libs/jansson/files/jansson-2.14-default-symver-test.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-https://github.com/akheron/jansson/pull/666
-
-From https://github.com/akheron/jansson/pull/666/commits/1e2ac681e5f39fc7a7e8b8deb2162a93976d4622 Mon Sep 17 00:00:00 2001
-From: Violet Purcell <vimproved@inventati.org>
-Date: Wed, 11 Oct 2023 20:51:57 -0400
-Subject: [PATCH] Port check for --default-symver to autoconf
-
-This commit ports the configure check for -Wl,--default-symver that is
-present in CMake to autoconf. This fixes building Jansson via autoconf
-with non-bfd linkers on glibc systems.
-
-Signed-off-by: Violet Purcell <vimproved@inventati.org>
---- a/configure.ac
-+++ b/configure.ac
-@@ -25,6 +25,9 @@ AC_TYPE_UINT16_T
- AC_TYPE_UINT8_T
- AC_TYPE_LONG_LONG_INT
- 
-+jansson_soversion="4"
-+AC_SUBST([jansson_soversion])
-+
- AC_C_INLINE
- case $ac_cv_c_inline in
-     yes) json_inline=inline;;
-@@ -138,8 +141,12 @@ AS_IF([test "x$with_Bsymbolic" = "xyes"], [JSON_BSYMBOLIC_LDFLAGS=-Wl[,]-Bsymbol
- AC_SUBST(JSON_BSYMBOLIC_LDFLAGS)
- 
- # Enable symbol versioning on GNU libc
-+m4_pattern_forbid([^AX_CHECK_LINK_FLAG$])
- JSON_SYMVER_LDFLAGS=
--AC_CHECK_DECL([__GLIBC__], [JSON_SYMVER_LDFLAGS=-Wl,--default-symver])
-+AC_CHECK_DECL([__GLIBC__],
-+  [AX_CHECK_LINK_FLAG([-Wl,--default-symver],
-+    [JSON_SYMVER_LDFLAGS=-Wl,--default-symver],
-+    [JSON_SYMVER_LDFLAGS=-Wl,--version-script,$ac_abs_confdir/jansson.sym])])
- AC_SUBST([JSON_SYMVER_LDFLAGS])
- 
- AC_ARG_ENABLE([ossfuzzers],
-@@ -168,6 +175,7 @@ AC_SUBST([AM_CFLAGS])
- 
- AC_CONFIG_FILES([
-         jansson.pc
-+	jansson.sym
-         Makefile
-         doc/Makefile
-         src/Makefile
---- /dev/null
-+++ b/jansson.sym.in
-@@ -0,0 +1,5 @@
-+JANSSON_@jansson_soversion@ {
-+	global:
-+	*;
-+};
-+
--- 
-2.42.0
-
diff --git a/dev-libs/jansson/files/jansson-2.14-test-symbols.patch b/dev-libs/jansson/files/jansson-2.14-test-symbols.patch
deleted file mode 100644
index a5bf53347218..000000000000
--- a/dev-libs/jansson/files/jansson-2.14-test-symbols.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-https://bugs.gentoo.org/814944
-https://github.com/akheron/jansson/commit/0677666f65b988b2dd44d02966a08fea490d5883
-
-From 0677666f65b988b2dd44d02966a08fea490d5883 Mon Sep 17 00:00:00 2001
-From: Petri Lehtinen <petri@digip.org>
-Date: Thu, 9 Sep 2021 21:53:11 +0300
-Subject: [PATCH] Fix the check-exports tests for versioned symbols
-
----
- test/suites/api/check-exports | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test/suites/api/check-exports b/test/suites/api/check-exports
-index 2b6b3c79..5c82064c 100755
---- a/test/suites/api/check-exports
-+++ b/test/suites/api/check-exports
-@@ -15,7 +15,7 @@ grep 'json_\|jansson_' $top_srcdir/src/jansson.def \
- nm -D $SOFILE >/dev/null >$test_log/symbols 2>/dev/null \
-     || exit 77  # Skip if "nm -D" doesn't seem to work
- 
--grep ' [DT] ' $test_log/symbols | cut -d' ' -f3 | grep -v '^_' | sort >$test_log/output
-+grep ' [DT] ' $test_log/symbols | cut -d' ' -f3 | grep -v '^_' | sed 's/@@libjansson.*//' | sort >$test_log/output
- 
- if ! cmp -s $test_log/exports $test_log/output; then
-     diff -u $test_log/exports $test_log/output >&2
diff --git a/dev-libs/libburn/files/libburn-1.5.6-c23.patch b/dev-libs/libburn/files/libburn-1.5.6-c23.patch
deleted file mode 100644
index c324e25ed6ef..000000000000
--- a/dev-libs/libburn/files/libburn-1.5.6-c23.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-https://bugs.gentoo.org/943701
-https://dev.lovelyhq.com/libburnia/libburn/commit/d537f9dd35282df834a311ead5f113af67d223b3
-
-From d537f9dd35282df834a311ead5f113af67d223b3 Mon Sep 17 00:00:00 2001
-From: Thomas Schmitt <scdbackup@gmx.net>
-Date: Tue, 26 Nov 2024 23:02:03 +0100
-Subject: [PATCH] Bug fix: Faulty signal handler prototype spoiled compilation
- under C23
-
----
- test/poll.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/test/poll.c b/test/poll.c
-index 660f384..cd5ff90 100644
---- a/test/poll.c
-+++ b/test/poll.c
-@@ -14,7 +14,7 @@ static struct burn_drive_info *drives;
- static unsigned int n_drives;
- int NEXT;
-
--static void catch_int ()
-+static void catch_int (int signum)
- {
-	NEXT = 1;
- }
diff --git a/dev-libs/libburn/files/libburn-1.5.6_slibtool.patch b/dev-libs/libburn/files/libburn-1.5.6_slibtool.patch
deleted file mode 100644
index d4c8df2cf262..000000000000
--- a/dev-libs/libburn/files/libburn-1.5.6_slibtool.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 10814feab217da4bcfaea45ff9cd48252e26b3e1 Mon Sep 17 00:00:00 2001
-From: Thomas Schmitt <scdbackup@gmx.net>
-Date: Mon, 24 Mar 2025 08:49:31 +0100
-Subject: [PATCH] Added to configure.ac explicit checks for stdint.h,
- inttypes.h, stdlib.h because slibtool does not put them into ./configure by
- default
-
----
- configure.ac | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 2681362..9fec1ce 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -197,7 +197,9 @@ AC_SUBST(LIBTOOL_DEPS)
- 
- AC_PROG_INSTALL
- 
--AC_CHECK_HEADERS()
-+dnl GNU libtool checks them by default/unconditionally, but slibtool does not.
-+dnl So accept the ugly double check and -DHAVE_*_H arguments with GNU libtool.
-+AC_CHECK_HEADERS(stdint.h inttypes.h stdlib.h)
- 
- THREAD_LIBS=-lpthread
- AC_SUBST(THREAD_LIBS)
diff --git a/dev-libs/libisoburn/files/libisoburn-1.5.6_slibtool.patch b/dev-libs/libisoburn/files/libisoburn-1.5.6_slibtool.patch
deleted file mode 100644
index 9acef74c0c49..000000000000
--- a/dev-libs/libisoburn/files/libisoburn-1.5.6_slibtool.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 1098709bf4a5177bb9953d5eebeb5fc4f0191676 Mon Sep 17 00:00:00 2001
-From: Thomas Schmitt <scdbackup@gmx.net>
-Date: Mon, 24 Mar 2025 08:54:42 +0100
-Subject: [PATCH] Added to configure.ac explicit checks for stdint.h,
- inttypes.h, stdlib.h because slibtool does not put them into ./configure by
- default
-
----
- configure.ac             | 4 +++-
- xorriso/configure_ac.txt | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 8828c183..ac3b5fc7 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -97,7 +97,9 @@ AC_SUBST(LIBTOOL_DEPS)
- 
- AC_PROG_INSTALL
- 
--AC_CHECK_HEADERS()
-+dnl GNU libtool checks them by default/unconditionally, but slibtool does not.
-+dnl So accept the ugly double check and -DHAVE_*_H arguments with GNU libtool.
-+AC_CHECK_HEADERS(stdint.h inttypes.h stdlib.h)
- 
- dnl Check for tm_gmtoff field in struct tm
- AC_CHECK_MEMBER([struct tm.tm_gmtoff],
diff --git a/dev-libs/libisofs/files/libisofs-1.5.6_slibtool.patch b/dev-libs/libisofs/files/libisofs-1.5.6_slibtool.patch
deleted file mode 100644
index 3146e3db6ad0..000000000000
--- a/dev-libs/libisofs/files/libisofs-1.5.6_slibtool.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 30fcd2d84ba3dd569f5c55dfeeca3bccf2b58e65 Mon Sep 17 00:00:00 2001
-From: Thomas Schmitt <scdbackup@gmx.net>
-Date: Mon, 24 Mar 2025 08:51:23 +0100
-Subject: [PATCH] Added to configure.ac explicit checks for stdint.h,
- inttypes.h, stdlib.h because slibtool does not put them into ./configure by
- default
-
----
- configure.ac | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 1de58d6..7e86463 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -96,7 +96,9 @@ AC_SUBST(LIBTOOL_DEPS)
- 
- AC_PROG_INSTALL
- 
--AC_CHECK_HEADERS()
-+dnl GNU libtool checks them by default/unconditionally, but slibtool does not.
-+dnl So accept the ugly double check and -DHAVE_*_H arguments with GNU libtool.
-+AC_CHECK_HEADERS(stdint.h inttypes.h stdlib.h)
- 
- dnl Use GNU extensions if available
- AC_DEFINE(_GNU_SOURCE, 1)
diff --git a/dev-libs/opensc/files/opensc-0.26.1-c23-tests.patch b/dev-libs/opensc/files/opensc-0.26.1-c23-tests.patch
deleted file mode 100644
index c97726892be9..000000000000
--- a/dev-libs/opensc/files/opensc-0.26.1-c23-tests.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-https://github.com/OpenSC/OpenSC/commit/2fee97b35fa8f1b51394540b259768b61e126a15
-
-From 2fee97b35fa8f1b51394540b259768b61e126a15 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Veronika=20Hanul=C3=ADkov=C3=A1?= <vhanulik@redhat.com>
-Date: Thu, 16 Jan 2025 10:39:57 +0100
-Subject: [PATCH] p11test: Fix compiler warning about setting 'true' variable
-
----
- src/tests/p11test/p11test_case_wrap.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/tests/p11test/p11test_case_wrap.c b/src/tests/p11test/p11test_case_wrap.c
-index ecb257b565..e9c503d7e8 100644
---- a/src/tests/p11test/p11test_case_wrap.c
-+++ b/src/tests/p11test/p11test_case_wrap.c
-@@ -390,15 +390,15 @@ test_unwrap_aes(test_cert_t *o, token_info_t *info, test_mech_t *mech)
- 	CK_ULONG key_padded_len = sizeof(key);
- 	CK_OBJECT_CLASS keyClass = CKO_SECRET_KEY;
- 	CK_KEY_TYPE keyType = CKK_AES;
--	CK_BBOOL true = CK_TRUE;
-+	CK_BBOOL _true = CK_TRUE;
- 	CK_BYTE new_id[] = {0x00, 0xff, 0x42};
- 	CK_BYTE new_label[] = "Unwrapped key";
- 	CK_ATTRIBUTE template[] = {
- 			{CKA_CLASS, &keyClass, sizeof(keyClass)},
- 			{CKA_KEY_TYPE, &keyType, sizeof(keyType)},
--			{CKA_ENCRYPT, &true, sizeof(true)},
--			{CKA_DECRYPT, &true, sizeof(true)},
--			{CKA_TOKEN, &true, sizeof(true)},
-+			{CKA_ENCRYPT, &_true, sizeof(_true)},
-+			{CKA_DECRYPT, &_true, sizeof(_true)},
-+			{CKA_TOKEN, &_true, sizeof(_true)},
- 			{CKA_ID, &new_id, sizeof(new_id)},
- 			{CKA_LABEL, &new_label, sizeof(new_label)},
- 			{CKA_VALUE_LEN, &key_len, sizeof(key_len)}, /* keep this one last! */
-
diff --git a/dev-libs/openssl-compat/Manifest b/dev-libs/openssl-compat/Manifest
index f78b04b7c6fe..8b9bdba0986c 100644
--- a/dev-libs/openssl-compat/Manifest
+++ b/dev-libs/openssl-compat/Manifest
@@ -4,4 +4,6 @@ DIST openssl-1.0.2u.tar.gz 5355412 BLAKE2B b2ff2a10e5851af5aca4093422a9a072c794e
 DIST openssl-1.1.1u.tar.gz 9892176 BLAKE2B 5de9cb856e497596ecba008bad6515eefd093849b9c66dd7447031723996f3ba66ac37a323a5f7d01b1d42df4daaceb523372f5897d5c53b935ffab91c566594 SHA512 d00aeb0b4c4676deff06ff95af7ac33dd683b92f972b4a8ae55cf384bb37c7ec30ab83c6c0745daf87cf1743a745fced6a347fd11fed4c548aa0953610ed4919
 DIST openssl-3.6.2.tar.gz 54913556 BLAKE2B 21a23c53d16e9fbfb4c6d606d6056e7bb72e15c964c43a7f02837d805584bc34917fb2527cbc7fa75de63f3b5f840c693e7b43ac95e4bf9c10dce27f130bf69f SHA512 46549ed4d6b0160adfa3e1406bc16f3083a7f3c85bdda289c1dbebd0db91433c39855dae765787ec68157faffba4cdb05a0600af4652e3e35da939e0bad8ef1e
 DIST openssl-3.6.2.tar.gz.asc 833 BLAKE2B 089164a42cdbb22d688ab314fae83d3fa16fb8d0c206ce8d0fe82a670b6e5fb0859e8842d0c0f75184d8e7022086aa05feeb5193e720ef58c18c7d303a6ec157 SHA512 bc1710380b80e0b9d35fe706604357c1f801d0b6ab1481b53061e21d6f55904fe8961ec10ead5c454dc637c88586f3093df71d2210b960d65c112466422d51ff
+DIST openssl-3.6.4.tar.gz 55003802 BLAKE2B 93d5fcd284a52963b476f98e9915359a1025a9487cb2d15d7437e9b9a8058050ae249f0b76b5627f589036cecda62c69aebfab6c8be2ddcf82ae7e3a6ff87804 SHA512 9e7f4039082880357969c0857f33b20a6a4306d1b5e4f8fcbd7ec8dc41edc96e87c526a1db0b8259f5000c4ced84149b03547562ce4f9df35194634a7576dac0
+DIST openssl-3.6.4.tar.gz.asc 931 BLAKE2B 59cc358251ee36f6fbbe849978b91fcb034d116f42ded469380766882d1597a94f6bd17a8fbd206071c347ee2f58eae406c2a2fff9a54fd4c58bb77f78318675 SHA512 8628b7e8559a593d635e5c73be03044f86aa6c62f83745a4cf9bba07aede486b4681900b0d770cd4086128a1543bda55f510f87656fddb09427de8fb30bcd5c4
 DIST openssl-compat-1.0.2u-versioned-symbols.patch.gz 24633 BLAKE2B 6bfad4ad27dbca0bd85bfd9521ffc844c3e93e6a1cca7c814edd49affc60ece1c706dd3aa7be2ce80857532531eac6f0f03f43c0be22a769d00d9241686eff71 SHA512 3d85aa34f2491e0e36eedc45829709e0fb552f6d558c2726b59dafa98c3e679b88497f3f7399d7565d88e727591e7d9b12f5b1e27116ba19b9a661d7f75b07a9
diff --git a/dev-libs/openssl-compat/openssl-compat-3.6.4.ebuild b/dev-libs/openssl-compat/openssl-compat-3.6.4.ebuild
new file mode 100644
index 000000000000..db3a6805ac26
--- /dev/null
+++ b/dev-libs/openssl-compat/openssl-compat-3.6.4.ebuild
@@ -0,0 +1,184 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+
+inherit edo flag-o-matic toolchain-funcs multilib-minimal multiprocessing
+inherit verify-sig
+
+MY_P=openssl-${PV/_/-}
+
+DESCRIPTION="Full-strength general purpose cryptography library (including SSL and TLS)"
+HOMEPAGE="https://openssl-library.org/"
+SRC_URI="
+	https://github.com/openssl/openssl/releases/download/${MY_P}/${MY_P}.tar.gz
+	verify-sig? (
+		https://github.com/openssl/openssl/releases/download/${MY_P}/${MY_P}.tar.gz.asc
+	)
+"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="Apache-2.0"
+SLOT="$(ver_cut 1)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="+asm cpu_flags_x86_sse2 +quic rfc3779 sctp test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	!=dev-libs/openssl-$(ver_cut 1)*:0
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )
+"
+
+# Do not install any docs
+DOCS=()
+
+pkg_setup() {
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		no-docs
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use_ssl asm)
+		$(use quic && echo "enable-quic")
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}/usr"
+		--openssldir="${EPREFIX}${SSL_CNF_DIR}"
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl Configure "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	dolib.so lib{crypto,ssl}.so.$(ver_cut 1)
+}
diff --git a/dev-libs/openssl/Manifest b/dev-libs/openssl/Manifest
index c84c55f2932a..7490cdabbef9 100644
--- a/dev-libs/openssl/Manifest
+++ b/dev-libs/openssl/Manifest
@@ -1,10 +1,20 @@
 DIST openssl-3.0.21.tar.gz 15309723 BLAKE2B 170cff38638c51c6f6d3fff517a49286796639197cc6b57952d19f2149385b5f71e6a6f30dae7e6a0e3c138e9a5b2d2c0cdfa2be2e5f7a402eac8f93674e83b0 SHA512 9be1c8c11a2d55417bb177804d1b5369aa54a9dcd2e136929509457d549697407ae9611079e94c61b58a95be598ce35b94edb336e050d1019e7269f4d2f52cda
 DIST openssl-3.0.21.tar.gz.asc 833 BLAKE2B d300bfdb02fb72aefa909bdc5c79dfaa51d775bf322e4711e18f8cbdb3e8e8d4efca6ae923c94e10fad4c575451168137dc29990003535092ddc58732e3edfcb SHA512 58a051099f4660cb244715c0b09cdf283247b13f03be6eb67993678db7e50169348e6d2d11e70f999e36dbb72f9432c6e10d4fdaba360e5f05a708e6c81acf30
+DIST openssl-3.0.22.tar.gz 15330396 BLAKE2B 4a7cfe40d9cfb6aaf5e84dcc02b64ffb98e7a99fd14df886bccfa97b4e960cf786cbafdea7daeeb6e3cb1e6a0bea0313b01031b83875fe19715a05defb425593 SHA512 88f5cffd8949b9e236f989f414eefcd4e924145b9e8cb303a969534908e055a9ff2a4b29bd1619425c84240d9ae40aab0d84dbee0f338d20fac81cf7b2f20492
+DIST openssl-3.0.22.tar.gz.asc 931 BLAKE2B 5a3dd2726a852da5594d96e24802aca2a5aed84f84ef78cb01078dcbeca7eb273b05a4b7c2e4ceaf1a68caf7ee15f7718a4c981ae689d83addf540507834e1d9 SHA512 cdfc8454cfebd34848e49d70e7cad8c2096e5cadb1b4725eb9fbf9949cba994788c2016e44240e1fb6e503609092e15c72bc1eecfe93b6ea30eb7c6b4447a324
 DIST openssl-3.4.6.tar.gz 18319647 BLAKE2B dd688583a38191097f1b8f4d5de25d271eac424aafcb4a417c3bdd826a83b4028540d0d9764b3861782d728bc07c07668b4365e15a37a367ce99abb43fb6ea96 SHA512 f119e8e06a4bdcb577db6b21fa9e1a4fbbb29177585331e754b8cee6c003e7c64e0e41b988597fceae70604bcfe2ce2eaf921af914188d57ded808c72f8274b2
 DIST openssl-3.4.6.tar.gz.asc 833 BLAKE2B e32d5164014835c6316028104298fd5e1c078a8aa62418974954bfbd5401a617a4f8d4c20893496f2e4db61d75e1ef6e451e0f199f18e019b8f7f53f271cc08b SHA512 4a4e97e68f9bbb50ee330d9ba24da8af4b840694352dc9e292d828f454f40555cb5e497f132add0d074d0f4397142519f687324f57e038e70d27c8e3590320d8
+DIST openssl-3.4.7.tar.gz 18360265 BLAKE2B 8eb07df2f918de856427a2b5c9c2f5a513edce7403b99dbeb88f144682ccbb1cab8fa835c52a4571a86c76e4d2a846f31dbc5237dbd4839f9d1b53057fc54998 SHA512 07c3112895f14dd08cd8306a63603acfc35b5aa129a60d493ac79d611764c94d8f193bb8baaa590886c149bfbb14273527b4bd1ceb874efdf698dfd56dd604e6
+DIST openssl-3.4.7.tar.gz.asc 931 BLAKE2B afbdc024a510c029a40f09879a6efd746cdc8df76557632ae7306976dc8286eeba40517e890764afb466b64c2e8f8c42028a6938f9afb264ec9e789c9d2d41f1 SHA512 32bd2a2ef24fc21d173b6d3611e7e850e32cfe94989cb7b29a3c420f7f50a58e08fb0d71068f1c7b31057b2b6e6719c583e6e007db56b2cd652179c07458d1af
 DIST openssl-3.5.7.tar.gz 53153930 BLAKE2B e19d7e40e9aaed0e4b4a405866ac56f37a03dc5c57cf1a2452ca547a5a9cab7771254d6ab8ce7df36b20d8145ba435aa5158c80be97d3887b3ef51db3cdd7428 SHA512 de5351d2d532e1a3908a738f7d8aae448d32bc60bdb24808c556a24bc37a3f53daedf12b5d432eeb8c235e16939d842f908332ede8a447ca103ad1c493c820d7
 DIST openssl-3.5.7.tar.gz.asc 833 BLAKE2B 3e6926602fbb473f3bbe64a33c721510bd2a48905efb273f79b6770eecf0d30d43888716c6fa582459df2aae8c57f8528fe5df6bd713381eda56982666d7c8d3 SHA512 294e29a2c3a54e5882b0bedb25fd6692f5fcf85a07da818ccebbf3e3704d596193591215df3bb8506d2d434a56b9f01cbc3c71152ae32c5e1a11a545bd239a0b
+DIST openssl-3.5.8.tar.gz 53213818 BLAKE2B dc96fd5959f9719f1a36fe25a955cad414b0552f92e34ec3c41ec2a722282e71a47aa513267ee0aff60599b51ca63f4344b3327e4c158679699bf524d5f3af8a SHA512 62a1dbed0fad75245b332e41b85a1f7c2379189525e7628a7cf68947d115e90a47f179e3f87d27641e5b2d357c357292179fc0e64eccecdebc81c083f7a8ebe4
+DIST openssl-3.5.8.tar.gz.asc 931 BLAKE2B f866d6fa4fc3fc7ba432a74fa197103c1afc602a88b90964d65a2e5da4b5a135f11bda222e644b978e1ce165c26ad7fcda25397cfd640786338f22eb0b4fc1d4 SHA512 36439518d0b81343c5e7dc3564092d936f91eca83b0a2b6a61d569ac2c7e238f595c3b96418e63a98c905e15938fff313ad756cef83dfb22279aa434d7bc5ec7
 DIST openssl-3.6.3.tar.gz 54953005 BLAKE2B 12dcbd977c3ccbeefd0310c23a8398d91395896b0d23e3e630d1318e96d650ee7dadd91c8ea1876458076b2d19d1fa72c70ae76669ce97d315aa813a0b826745 SHA512 4179ad56f285fd27a1c7b294472afdca588e915d4f8a9610e461f34f0678004aebe32e88434ae536a63a7c9aff6607702a3b341e2faacb7899c27d6def4cc92d
 DIST openssl-3.6.3.tar.gz.asc 833 BLAKE2B c7f00b3fcfe52b29a0a734179b1440b91ebabe1a293494b377399c5681ee95f11fcc9beb43615b98995cec7459def88a51a62f7aa782e1fe69fa972f30a1d88d SHA512 a7ad2a5da941b8a5ab0bb6d22848aa0573604f115510c758b7dd127decf3c2473974e12bda1887a70fbff478a43375d567252492452eb57adea5e659d730bded
+DIST openssl-3.6.4.tar.gz 55003802 BLAKE2B 93d5fcd284a52963b476f98e9915359a1025a9487cb2d15d7437e9b9a8058050ae249f0b76b5627f589036cecda62c69aebfab6c8be2ddcf82ae7e3a6ff87804 SHA512 9e7f4039082880357969c0857f33b20a6a4306d1b5e4f8fcbd7ec8dc41edc96e87c526a1db0b8259f5000c4ced84149b03547562ce4f9df35194634a7576dac0
+DIST openssl-3.6.4.tar.gz.asc 931 BLAKE2B 59cc358251ee36f6fbbe849978b91fcb034d116f42ded469380766882d1597a94f6bd17a8fbd206071c347ee2f58eae406c2a2fff9a54fd4c58bb77f78318675 SHA512 8628b7e8559a593d635e5c73be03044f86aa6c62f83745a4cf9bba07aede486b4681900b0d770cd4086128a1543bda55f510f87656fddb09427de8fb30bcd5c4
 DIST openssl-4.0.1.tar.gz 55079428 BLAKE2B 8c5e1d97165d8e74f6ab41adf75c8f1a60a38b511163d0cdd054b27280538681d308385ce9a6fe2230aed7e412436419f864876e57538738e13eed77d520d5cd SHA512 84104cbd928a3fbcb9a90c567fa37f927b974d4744b8cd774641e0d07db065d1564fa4c3df4c26818f3c6e726ca71b3aae72109d10482bba3396949886fc8892
 DIST openssl-4.0.1.tar.gz.asc 833 BLAKE2B 8d4d3bc5ccd92c6374daf6a52b9b2c70414785c627c9853f8282e44800fcf2e955166e825843ab16a511f6606b57aea4caef8b88767c0e1cf0f76282af4a6529 SHA512 1f6f35c4c9219cf11f81f0eb7bf1558778cd38ef5eb0121e6806ca069efe0b21824e85cbc630331e1979ddde18af5630a05e8bc0340e87100f0062650cebbc59
+DIST openssl-4.0.2.tar.gz 55153883 BLAKE2B f73b12c5779518ddc45bd232f3f80def2fe0f8655ef2a8de1d9647255ce3cc1fd1c843dee444e9d11a4dc80c4048e274cd4793f5ab60180598ef2a57609fd931 SHA512 4da808b64fca832b80752c4dc0248ea602c78ecc35fb7455439dccfae3fb74213d3689f455a40533d89e6180d2c81ea5871f2763fa64740c2810af9fdb4104be
+DIST openssl-4.0.2.tar.gz.asc 931 BLAKE2B 34e209999d6071309431db712e0db4f4353b92dd7d8b90672f5c99012b66b3d3c28e09fe450fdd566ba0e02824a6a2a79bef51d5f62a457ff4263aae5005f4f0 SHA512 59e3c112cc7f01dfb442258ea9c883c3033728459d2f211375f32ed7080c76fab30af7dcf9082e4d10b2021e9eb54abae222af50c1e25cb78a658d8d9c8e80c1
diff --git a/dev-libs/openssl/openssl-3.0.22.ebuild b/dev-libs/openssl/openssl-3.0.22.ebuild
new file mode 100644
index 000000000000..0366220a6120
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.0.22.ebuild
@@ -0,0 +1,289 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/3" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308
+	append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/openssl/openssl-3.4.7.ebuild b/dev-libs/openssl/openssl-3.4.7.ebuild
new file mode 100644
index 000000000000..a3e03ca5b66d
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.4.7.ebuild
@@ -0,0 +1,297 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(multilib_is_native_abi || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/openssl/openssl-3.5.8.ebuild b/dev-libs/openssl/openssl-3.5.8.ebuild
new file mode 100644
index 000000000000..d88181b93e95
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.5.8.ebuild
@@ -0,0 +1,336 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multibuild multilib multilib-build multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+_openssl_variant() {
+	local OPENSSL_VARIANT=${MULTIBUILD_VARIANT}
+	mkdir -p "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	"$@"
+	popd >/dev/null || die
+}
+
+openssl_foreach_variant() {
+	local MULTIBUILD_VARIANTS=( "${OPENSSL_VARIANTS[@]}" )
+	multibuild_foreach_variant _openssl_variant "$@"
+}
+
+openssl_run_phase() {
+	multilib_foreach_abi openssl_foreach_variant "$@"
+}
+
+openssl_is_default_variant() {
+	[[ ${OPENSSL_VARIANT} == shared ]] && multilib_is_native_abi
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	OPENSSL_VARIANTS=( shared )
+	use static-libs && OPENSSL_VARIANTS+=( static )
+
+	openssl_run_phase openssl_src_configure
+}
+
+openssl_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(openssl_is_default_variant || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		threads
+	)
+
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		myeconfargs+=( no-module no-shared )
+	fi
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+src_compile() {
+	openssl_run_phase openssl_src_compile
+}
+
+openssl_src_compile() {
+	emake build_sw
+	if openssl_is_default_variant; then
+		emake build_docs
+	fi
+}
+
+src_test() {
+	openssl_run_phase openssl_src_test
+}
+
+openssl_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+openssl_src_install() {
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		dolib.a libcrypto.a libssl.a
+		return
+	fi
+
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if openssl_is_default_variant; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	multilib_prepare_wrappers
+	multilib_check_headers
+}
+
+src_install() {
+	openssl_run_phase openssl_src_install
+	multilib_install_wrappers
+
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/openssl/openssl-3.6.4.ebuild b/dev-libs/openssl/openssl-3.6.4.ebuild
new file mode 100644
index 000000000000..d88181b93e95
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.6.4.ebuild
@@ -0,0 +1,336 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multibuild multilib multilib-build multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${P}/${P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+_openssl_variant() {
+	local OPENSSL_VARIANT=${MULTIBUILD_VARIANT}
+	mkdir -p "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	"$@"
+	popd >/dev/null || die
+}
+
+openssl_foreach_variant() {
+	local MULTIBUILD_VARIANTS=( "${OPENSSL_VARIANTS[@]}" )
+	multibuild_foreach_variant _openssl_variant "$@"
+}
+
+openssl_run_phase() {
+	multilib_foreach_abi openssl_foreach_variant "$@"
+}
+
+openssl_is_default_variant() {
+	[[ ${OPENSSL_VARIANT} == shared ]] && multilib_is_native_abi
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	OPENSSL_VARIANTS=( shared )
+	use static-libs && OPENSSL_VARIANTS+=( static )
+
+	openssl_run_phase openssl_src_configure
+}
+
+openssl_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(openssl_is_default_variant || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		threads
+	)
+
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		myeconfargs+=( no-module no-shared )
+	fi
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+src_compile() {
+	openssl_run_phase openssl_src_compile
+}
+
+openssl_src_compile() {
+	emake build_sw
+	if openssl_is_default_variant; then
+		emake build_docs
+	fi
+}
+
+src_test() {
+	openssl_run_phase openssl_src_test
+}
+
+openssl_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+openssl_src_install() {
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		dolib.a libcrypto.a libssl.a
+		return
+	fi
+
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if openssl_is_default_variant; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	multilib_prepare_wrappers
+	multilib_check_headers
+}
+
+src_install() {
+	openssl_run_phase openssl_src_install
+	multilib_install_wrappers
+
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/openssl/openssl-4.0.2.ebuild b/dev-libs/openssl/openssl-4.0.2.ebuild
new file mode 100644
index 000000000000..7d8e06730ef7
--- /dev/null
+++ b/dev-libs/openssl/openssl-4.0.2.ebuild
@@ -0,0 +1,333 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info sysroot toolchain-funcs
+inherit multibuild multilib multilib-build multiprocessing preserve-libs
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://openssl-library.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == *9999 ]] ; then
+	[[ ${PV} == *.*.9999 ]] && EGIT_BRANCH="openssl-${PV%%.9999}"
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	inherit verify-sig
+	SRC_URI="
+		https://github.com/openssl/openssl/releases/download/${MY_P}/${MY_P}.tar.gz
+		verify-sig? (
+			https://github.com/openssl/openssl/releases/download/${MY_P}/${MY_P}.tar.gz.asc
+		)
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-openssl-20260415 )"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls +quic rfc3779 sctp static-libs test tls-compression vanilla weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=virtual/zlib-1.2.8-r1:=[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND+="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-4.0.1-x86-avx2.patch
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile || die
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+}
+
+_openssl_variant() {
+	local OPENSSL_VARIANT=${MULTIBUILD_VARIANT}
+	mkdir -p "${BUILD_DIR}" || die
+	pushd "${BUILD_DIR}" >/dev/null || die
+	"$@"
+	popd >/dev/null || die
+}
+
+openssl_foreach_variant() {
+	local MULTIBUILD_VARIANTS=( "${OPENSSL_VARIANTS[@]}" )
+	multibuild_foreach_variant _openssl_variant "$@"
+}
+
+openssl_run_phase() {
+	multilib_foreach_abi openssl_foreach_variant "$@"
+}
+
+openssl_is_default_variant() {
+	[[ ${OPENSSL_VARIANT} == shared ]] && multilib_is_native_abi
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308 -- check inserts GNU ld-compatible arguments
+	[[ ${CHOST} == *-darwin* ]] || append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	OPENSSL_VARIANTS=( shared )
+	use static-libs && OPENSSL_VARIANTS+=( static )
+
+	openssl_run_phase openssl_src_configure
+}
+
+openssl_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(openssl_is_default_variant || echo "no-docs")
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use quic && echo "enable-quic")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		threads
+	)
+
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		myeconfargs+=( no-module no-shared )
+	fi
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+src_compile() {
+	openssl_run_phase openssl_src_compile
+}
+
+openssl_src_compile() {
+	emake build_sw
+	if openssl_is_default_variant; then
+		emake build_docs
+	fi
+}
+
+src_test() {
+	openssl_run_phase openssl_src_test
+}
+
+openssl_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+openssl_src_install() {
+	if [[ ${OPENSSL_VARIANT} == static ]]; then
+		dolib.a libcrypto.a libssl.a
+		return
+	fi
+
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if openssl_is_default_variant; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	multilib_prepare_wrappers
+	multilib_check_headers
+}
+
+src_install() {
+	openssl_run_phase openssl_src_install
+	multilib_install_wrappers
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		einfo "Running openssl fipsinstall"
+		LD_LIBRARY_PATH="${ED}/usr/$(get_libdir)" \
+			sysroot_run_prefixed "${ED}/usr/bin/openssl" fipsinstall \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so" \
+			|| die "fipsinstall failed"
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/zycore-c/zycore-c-1.5.2.ebuild b/dev-libs/zycore-c/zycore-c-1.5.2.ebuild
index 69643f30094b..4c15ed3d33dc 100644
--- a/dev-libs/zycore-c/zycore-c-1.5.2.ebuild
+++ b/dev-libs/zycore-c/zycore-c-1.5.2.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/zyantific/zycore-c.git"
 else
-	KEYWORDS="~amd64 ~arm64"
+	KEYWORDS="~amd64 ~arm64 ~x86"
 fi
 
 LICENSE="MIT"
diff --git a/dev-libs/zydis/zydis-4.1.1.ebuild b/dev-libs/zydis/zydis-4.1.1.ebuild
index e9bf06bff77c..d75c4a8879ed 100644
--- a/dev-libs/zydis/zydis-4.1.1.ebuild
+++ b/dev-libs/zydis/zydis-4.1.1.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/zyantific/zydis.git"
 else
 	SRC_URI="https://github.com/zyantific/zydis/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 ~arm64"
+	KEYWORDS="~amd64 ~arm64 ~x86"
 fi
 
 LICENSE="MIT"