Adding metadata

author: root <root@alpha.trunkmasters.com> 2026-06-20 14:54:46 -0500
committer: root <root@alpha.trunkmasters.com> 2026-06-20 14:54:46 -0500
commit: 1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0 (patch)
tree: 18e2e784f9fb0dbc3546537acc42ad51b366d90e /net-dialup
parent: 9f6a581d94412ab1cf4b35c33101f6be0ddc7777 (diff)
download: baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.gz
baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.xz
baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.zip
28 files changed, 1076 insertions, 325 deletions
diff --git a/net-dialup/freeradius/Manifest b/net-dialup/freeradius/Manifest
index 68b5c2da2a13..d80b11b3284d 100644
--- a/net-dialup/freeradius/Manifest
+++ b/net-dialup/freeradius/Manifest
@@ -1,2 +1,2 @@
-DIST freeradius-server-3.2.7.tar.bz2 3517595 BLAKE2B cd523fbc01e82d87f0944926612223ee2acafc008f0f50447c35263b5dcdd36c8f00c54dde1102a3987b45a7e67426c99a7aee692cf59983c80ead111a2188dd SHA512 c4a13471844ab4ce041db1567e2827370433725beadfbf425d2522b0bf9a4def8ebd41d3c4f45ad350dacdf86bc5bf3952d519d84672c7dde25a12005a009ae5
+DIST freeradius-server-3.2.6.tar.bz2 3500878 BLAKE2B 0af7cdf7fb784f2d5019f3bcb06d1d44dca046c9a4513d780ab032367001b6a67e9ea17a3a5b4609b9d7b936647e60c96e35188ba9644c4360071ac8d021bd58 SHA512 3fdd0c1bf82cf7ea2e9ee46cda1061ef06c97eddd70b75be17f05d9dc13771b339d01f140b4288632700d6315c1ac506d225d1e83a179b6f7e8338e2ae42d7e8
 DIST freeradius-server-3.2.8.tar.bz2 3671952 BLAKE2B 6266c00c68cbb02de65f88d976453fdcdda552d7554199030640f9bcd60f208afaf75aaac8fbf0a2eea0022eb23ad7b809cb910d48618261ea9f52100732c469 SHA512 31db199c3847bfdb80b726e16cece0d660bd741fae0fca8ba96aaaee30972c657438c4e1fdaa7ef070f84d8b7889a8da8db1defc542b0c0e18f247156f17e0ae
diff --git a/net-dialup/freeradius/files/cb.patch b/net-dialup/freeradius/files/cb.patch
deleted file mode 100644
index 81517944867c..000000000000
--- a/net-dialup/freeradius/files/cb.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Index: src/main/cb.c
---- src/main/cb.c.orig
-+++ src/main/cb.c
-@@ -64,7 +64,7 @@ void cbtls_info(SSL const *s, int where, int ret)
- 			/*
- 			 *	After a ClientHello, list all the proposed ciphers from the client
- 			 */
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 			if (SSL_get_state(s) == TLS_ST_SR_CLNT_HELLO) {
- 				int i;
- 				int num_ciphers;
-@@ -192,7 +192,7 @@ void cbtls_msg(int write_p, int msg_version, int conte
- 		state->info.alert_level = 0x00;
- 		state->info.alert_description = 0x00;
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- 	} else if (content_type == SSL3_RT_INNER_CONTENT_TYPE && buf[0] == SSL3_RT_APPLICATION_DATA) {
- 		/* let tls_ack_handler set application_data */
- 		state->info.content_type = SSL3_RT_HANDSHAKE;
diff --git a/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch b/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch
new file mode 100644
index 000000000000..04223657d5f5
--- /dev/null
+++ b/net-dialup/freeradius/files/freeradius-3.0.20-systemd-service.patch
@@ -0,0 +1,57 @@
+diff --git a/debian/freeradius.service b/debian/freeradius.service
+index 378702d184..ee33c2a294 100644
+--- a/debian/freeradius.service
++++ b/debian/freeradius.service
+@@ -7,7 +7,6 @@ Documentation=man:radiusd(8) man:radiusd.conf(5) http://wiki.freeradius.org/ htt
+ Type=notify
+ WatchdogSec=60
+ NotifyAccess=all
+-EnvironmentFile=-/etc/default/freeradius
+ 
+ # FreeRADIUS can do static evaluation of policy language rules based
+ # on environmental variables which is very useful for doing per-host
+@@ -25,16 +24,15 @@ MemoryLimit=2G
+ # Ensure the daemon can still write its pidfile after it drops
+ # privileges. Combination of options that work on a variety of
+ # systems. Test very carefully if you alter these lines.
+-RuntimeDirectory=freeradius
++RuntimeDirectory=radiusd
+ RuntimeDirectoryMode=0775
+ # This does not work on Debian Jessie:
+-User=freerad
+-Group=freerad
+-# This does not work on Ubuntu Bionic:
+-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
++User=radius
++Group=radius
+ 
+-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
+-ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS
++ExecStartPre=/usr/sbin/radiusd $RADIUSD_OPTIONS -Cx -lstdout
++ExecStart=/usr/sbin/radiusd -f $RADIUSD_OPTIONS
++ExecReload=/bin/kill -HUP $MAINPID
+ Restart=on-failure
+ RestartSec=5
+ 
+@@ -42,7 +40,7 @@ RestartSec=5
+ NoNewPrivileges=true
+ 
+ # Allow binding to secure ports, broadcast addresses, and raw interfaces.
+-#CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
++CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_CHOWN CAP_DAC_OVERRIDE
+ 
+ # Private /tmp that isn't shared by other processes
+ PrivateTmp=true
+@@ -60,10 +58,10 @@ ProtectKernelTunables=true
+ SystemCallArchitectures=native
+ 
+ # We shouldn't be writing to the configuration directory
+-ReadOnlyDirectories=/etc/freeradius/
++ReadOnlyDirectories=/etc/raddb/
+ 
+ # We can read and write to the log directory.
+-ReadWriteDirectories=/var/log/freeradius/
++ReadWriteDirectories=/var/log/radius/
+ 
+ [Install]
+ WantedBy=multi-user.target
diff --git a/net-dialup/freeradius/files/freeradius-3.2.1-tls.patch b/net-dialup/freeradius/files/freeradius-3.2.1-tls.patch
deleted file mode 100644
index 27bed5e956e6..000000000000
--- a/net-dialup/freeradius/files/freeradius-3.2.1-tls.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-Index: src/main/tls.c
---- src/main/tls.c.orig
-+++ src/main/tls.c
-@@ -688,7 +688,7 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls
- 				/*
- 				 * Swap empty store with the old one.
- 				 */
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
- 				conf->old_x509_store = SSL_CTX_get_cert_store(conf->ctx);
- 				/* Bump refcnt so the store is kept allocated till next store replacement */
- 				X509_STORE_up_ref(conf->old_x509_store);
-@@ -1427,7 +1427,7 @@ void tls_session_information(tls_session_t *tls_sessio
- 					if ((SSL_version(tls_session->ssl) > tls_session->conf->max_version) &&
- 					    (rad_debug_lvl > 0)) {
- 						WARN("TLS 1.3 has been negotiated even though it was disabled.  This is an OpenSSL Bug.");
--						WARN("Please set: cipher_list = \"DEFAULT@SECLEVEL=1\" in the tls {...} section.");
-+						WARN("Setting cipher_list in the tls {...} section might help.");
- 					}
- #endif
- 					break;
-@@ -2034,7 +2034,7 @@ done:
- 	return 0;
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- static SSL_SESSION *cbtls_get_session(SSL *ssl, unsigned char *data, int len, int *copy)
- #else
- static SSL_SESSION *cbtls_get_session(SSL *ssl, const unsigned char *data, int len, int *copy)
-@@ -2418,7 +2418,7 @@ static int cbtls_cache_refresh(SSL *ssl, SSL_SESSION *
- 	return 0;
- }
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- static SSL_SESSION *cbtls_cache_load(SSL *ssl, unsigned char *data, int len, int *copy)
- #else
- static SSL_SESSION *cbtls_cache_load(SSL *ssl, const unsigned char *data, int len, int *copy)
-@@ -2954,7 +2954,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
- 	char		cn_str[1024];
- 	char		buf[64];
- 	X509		*client_cert;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
- 	const STACK_OF(X509_EXTENSION) *ext_list;
- #else
- 	STACK_OF(X509_EXTENSION) *ext_list;
-@@ -3182,7 +3182,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
- 	}
- 
- 	if (lookup == 0) {
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
- 		ext_list = X509_get0_extensions(client_cert);
- #else
- 		X509_CINF	*client_inf;
-@@ -3235,7 +3235,7 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
- 				value[0] = '0';
- 				value[1] = 'x';
- 				const unsigned char *srcp;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
- 				const ASN1_STRING *srcasn1p;
- 				srcasn1p = X509_EXTENSION_get_data(ext);
- 				srcp = ASN1_STRING_get0_data(srcasn1p);
-@@ -4253,7 +4253,7 @@ post_ca:
- 		}
- 	}
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER) /* SSL_CTX_set1_sigalgs_list */
- 	if (conf->sigalgs_list) {
- 		char *list;
- 
-@@ -4272,6 +4272,7 @@ post_ca:
- 	 *	Because saying "use TLS 1.1" isn't enough.  We have to
- 	 *	send it flowers and cake.
- 	 */
-+#ifndef LIBRESSL_VERSION_NUMBER  /* No support for DEFAULT@SECLEVEL=n */
- 	if (min_version <= TLS1_1_VERSION) {
- #if OPENSSL_VERSION_NUMBER >= 0x10101000L
- 		int seclevel = SSL_CTX_get_security_level(ctx);
-@@ -4297,6 +4298,7 @@ post_ca:
- 		}
- #endif
- 	}
-+#endif
- 
- #if OPENSSL_VERSION_NUMBER >= 0x10100000L
- 	if (conf->disable_tlsv1) {
diff --git a/net-dialup/freeradius/files/freeradius-3.2.3-configure-c99.patch b/net-dialup/freeradius/files/freeradius-3.2.3-configure-c99.patch
new file mode 100644
index 000000000000..395e97d84851
--- /dev/null
+++ b/net-dialup/freeradius/files/freeradius-3.2.3-configure-c99.patch
@@ -0,0 +1,38 @@
+https://src.fedoraproject.org/rpms/freeradius/c/1793f410aa789704b5ac0be9cf7d0eaece906d1a?branch=rawhide
+https://github.com/FreeRADIUS/freeradius-server/pull/5246
+
+The backtrace_symbols function expects a pointer to an array of void *
+values, not a pointer to an array of a single element. Removing the
+address operator ensures that the right type is used.
+
+This avoids an unconditional failure of this probe with compilers that
+treat incompatible pointer types as a compilation error.
+
+Submitted upstream: <https://github.com/FreeRADIUS/freeradius-server/pull/5246>
+
+diff --git a/configure b/configure
+index ed01ee2bdd912f63..1e6d2284779cdd58 100755
+--- a/configure
++++ b/configure
+@@ -13390,7 +13390,7 @@ main (void)
+ {
+ 
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym))
++        backtrace_symbols(sym, sizeof(sym))
+   ;
+   return 0;
+ }
+diff --git a/configure.ac b/configure.ac
+index 76320213b51d7bb4..6a689711d6c90483 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -2168,7 +2168,7 @@ if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+         #include <execinfo.h>
+       ]], [[
+         void *sym[1];
+-        backtrace_symbols(&sym, sizeof(sym)) ]])],[
++        backtrace_symbols(sym, sizeof(sym)) ]])],[
+         AC_MSG_RESULT(yes)
+         ac_cv_lib_execinfo_backtrace_symbols="yes"
+       ],[
diff --git a/net-dialup/freeradius/files/freeradius-3.2.8-systemd-service.patch b/net-dialup/freeradius/files/freeradius-3.2.8-systemd-service.patch
new file mode 100644
index 000000000000..6197fe11c864
--- /dev/null
+++ b/net-dialup/freeradius/files/freeradius-3.2.8-systemd-service.patch
@@ -0,0 +1,48 @@
+--- a/debian/freeradius.service	2026-02-11 12:28:18.226315628 +0200
++++ b/debian/freeradius.service	2026-02-11 12:31:14.801509653 +0200
+@@ -7,7 +7,6 @@
+ Type=notify
+ WatchdogSec=60
+ NotifyAccess=all
+-EnvironmentFile=-/etc/default/freeradius
+ 
+ # FreeRADIUS can do static evaluation of policy language rules based
+ # on environmental variables which is very useful for doing per-host
+@@ -26,18 +25,17 @@
+ # privileges. Combination of options that work on a variety of
+ # systems. Test very carefully if you alter these lines.
+ RuntimeDirectory=freeradius freeradius/tmp
++RuntimeDirectory=radiusd radiusd/tmp
+ RuntimeDirectoryMode=0775
+ # This does not work on Debian Jessie:
+-User=freerad
+-Group=freerad
+-# This does not work on Ubuntu Bionic:
+-ExecStartPre=/bin/chown freerad:freerad /var/run/freeradius
++User=radius
++Group=radius
+ 
+-ExecStartPre=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cx -lstdout
+-ExecStart=/usr/sbin/freeradius -f $FREERADIUS_OPTIONS
++ExecStartPre=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cx -lstdout
++ExecStart=/usr/sbin/radiusd -f $FREERADIUS_OPTIONS
+ Restart=on-failure
+ RestartSec=5
+-ExecReload=/usr/sbin/freeradius $FREERADIUS_OPTIONS -Cxm -lstdout
++ExecReload=/usr/sbin/radiusd $FREERADIUS_OPTIONS -Cxm -lstdout
+ ExecReload=/bin/kill -HUP $MAINPID
+ 
+ #  Don't elevate privileges after starting
+@@ -67,10 +65,10 @@
+ SystemCallArchitectures=native
+ 
+ # We shouldn't be writing to the configuration directory
+-ReadOnlyDirectories=/etc/freeradius/
++ReadOnlyDirectories=/etc/raddb/
+ 
+ # We can read and write to the log directory.
+-ReadWriteDirectories=/var/log/freeradius/
++ReadWriteDirectories=/var/log/radius/
+ 
+ [Install]
+ WantedBy=multi-user.target
diff --git a/net-dialup/freeradius/files/mppe_keys_c.patch b/net-dialup/freeradius/files/mppe_keys_c.patch
deleted file mode 100644
index 47ceb3488081..000000000000
--- a/net-dialup/freeradius/files/mppe_keys_c.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -urN freeradius-server-3.2.4.orig/src/modules/rlm_eap/libeap/mppe_keys.c freeradius-server-3.2.4/src/modules/rlm_eap/libeap/mppe_keys.c
---- freeradius-server-3.2.4.orig/src/modules/rlm_eap/libeap/mppe_keys.c	2024-05-31 20:14:54.237017045 +0200
-+++ freeradius-server-3.2.4/src/modules/rlm_eap/libeap/mppe_keys.c	2024-05-31 20:17:14.077027116 +0200
-@@ -34,7 +34,7 @@
- #include <openssl/provider.h>
- #endif
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10101000L && !defined(LIBRESSL_VERSION_NUMBER)
- #include <openssl/kdf.h>
- 
- void TLS_PRF(SSL *ssl,
diff --git a/net-dialup/freeradius/files/patch-src_main_cb_c b/net-dialup/freeradius/files/patch-src_main_cb_c
deleted file mode 100644
index 2ee57c03c29c..000000000000
--- a/net-dialup/freeradius/files/patch-src_main_cb_c
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: src/main/cb.c
---- src/main/cb.c.orig
-+++ src/main/cb.c
-@@ -122,7 +122,7 @@ void cbtls_info(SSL const *s, int where, int ret)
- 				return;
- 			}
- 			RERROR("(TLS) %s - %s: Error in %s", conf->name, role, state);
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 			if (RDEBUG_ENABLED3 && (SSL_get_state(s) == TLS_ST_SR_CLNT_HELLO)) goto report_ciphers;
- #endif
- 		}
diff --git a/net-dialup/freeradius/files/radius.conf-r4 b/net-dialup/freeradius/files/radius.conf-r4
deleted file mode 100644
index a5760d29f7b9..000000000000
--- a/net-dialup/freeradius/files/radius.conf-r4
+++ /dev/null
@@ -1,16 +0,0 @@
-# Config file for /etc/init.d/radiusd
-
-# see man pages for radiusd run `radiusd -h`
-# for valid cmdline options
-#RADIUSD_OPTS=""
-
-# Change this value if you change it in /etc/raddb/radiusd.conf
-pidfile=/var/run/radiusd/radiusd.pid
-
-# Change these values if you change them in /etc/raddb/radiusd.conf
-RADIUSD_USER=radius
-RADIUSD_GROUP=radius
-
-# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want
-# to uncomment the following line.
-#rc_use="logger"
diff --git a/net-dialup/freeradius/files/radius.conf-r5 b/net-dialup/freeradius/files/radius.conf-r5
deleted file mode 100644
index 7114c32ef923..000000000000
--- a/net-dialup/freeradius/files/radius.conf-r5
+++ /dev/null
@@ -1,18 +0,0 @@
-# Config file for /etc/init.d/radiusd
-
-# see man pages for radiusd run `radiusd -h`
-# for valid cmdline options
-#RADIUSD_OPTS=""
-
-# Change this value if you change it in /etc/raddb/radiusd.conf
-pidfile=/var/run/radiusd/radiusd.pid
-
-# Change these values if you change them in /etc/raddb/radiusd.conf
-RADIUSD_USER=radius
-RADIUSD_GROUP=radius
-
-RADIUSD_LOGPATH=/var/log/radius
-
-# If you set up logging to syslog in /etc/raddb/radiusd.conf, you want
-# to uncomment the following line.
-#rc_use="logger"
diff --git a/net-dialup/freeradius/files/radius.init-r3 b/net-dialup/freeradius/files/radius.init-r3
deleted file mode 100644
index b4d7c380aeba..000000000000
--- a/net-dialup/freeradius/files/radius.init-r3
+++ /dev/null
@@ -1,31 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2021 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-command=/usr/sbin/radiusd
-command_args="${RADIUSD_OPTS}"
-pidfile="${pidfile:-/run/radiusd/radiusd.pid}"
-extra_started_commands="reload"
-
-depend() {
-	need localmount
-	use dns
-}
-
-start_pre() {
-	if [ ! -f /etc/raddb/radiusd.conf ] ; then
-		eerror "No /etc/raddb/radiusd.conf file exists!"
-		return 1
-	fi
-
-	checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
-		$(dirname ${pidfile}) /var/log/radius
-	checkpath -m0750 -o "${RADIUSD_USER:-root}:${RADIUSD_GROUP:-root}" -d \
-		$(dirname ${pidfile}) /run/radiusd
-}
-
-reload() {
-	ebegin "Reloading radiusd"
-	kill -HUP $(cat ${pidfile})
-	eend $?
-}
diff --git a/net-dialup/freeradius/files/rlm_eap_fast.patch b/net-dialup/freeradius/files/rlm_eap_fast.patch
deleted file mode 100644
index b6e6cebbc7e4..000000000000
--- a/net-dialup/freeradius/files/rlm_eap_fast.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Index: src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
---- src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c.orig
-+++ src/modules/rlm_eap/types/rlm_eap_fast/rlm_eap_fast.c
-@@ -200,7 +200,7 @@ static void eap_fast_session_ticket(tls_session_t *tls
- }
- 
- // hostap:src/crypto/tls_openssl.c:tls_sess_sec_cb()
--#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- static int _session_secret(SSL *s, void *secret, int *secret_len,
- 			   UNUSED STACK_OF(SSL_CIPHER) *peer_ciphers,
- 			   UNUSED SSL_CIPHER **cipher, void *arg)
-@@ -224,7 +224,7 @@ static int _session_secret(SSL *s, void *secret, int *
- 
- 	RDEBUG("processing PAC-Opaque");
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	eap_fast_session_ticket(tls_session, s->s3->client_random, s->s3->server_random, secret, secret_len);
- #else
- 	uint8_t client_random[SSL3_RANDOM_SIZE];
diff --git a/net-dialup/freeradius/freeradius-3.2.7.ebuild b/net-dialup/freeradius/freeradius-3.2.6-r1.ebuild
index 49372f077f3c..479d742282ba 100644
--- a/net-dialup/freeradius/freeradius-3.2.7.ebuild
+++ b/net-dialup/freeradius/freeradius-3.2.6-r1.ebuild
@@ -1,5 +1,6 @@
-# Copyright 2021-2025 Liguros Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 PYTHON_COMPAT=( python3_{13..14} )
@@ -11,19 +12,22 @@ MY_P=${MY_PN}-${PV}
 MY_PV=$(ver_rs 1- "_")
 
 DESCRIPTION="Highly configurable free RADIUS server"
-HOMEPAGE="https://freeradius.org/"
+HOMEPAGE="https://www.freeradius.org/"
 SRC_URI="https://github.com/FreeRADIUS/freeradius-server/releases/download/release_${MY_PV}/${MY_P}.tar.bz2"
 S="${WORKDIR}"/${MY_P}
 
-KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
 LICENSE="GPL-2"
 SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
 
 IUSE="
-	debug firebird iodbc kerberos ldap  memcached mysql mongodb odbc oracle pam
-	postgres python readline redis samba sqlite ssl systemd
+	debug iodbc kerberos ldap memcached mysql mongodb odbc oracle pam
+	postgres python readline redis samba selinux sqlite ssl systemd
 "
-RESTRICT="test firebird? ( bindist )"
+
+# NOTE: Temporary freeradius doesn't support linking with mariadb client
+#       libs also if code is compliant, will be available in the next release.
+#       (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a
 
 # TODO: rlm_mschap works with both samba library or without. I need to avoid
 #       linking of samba library if -samba is used.
@@ -31,9 +35,9 @@ RESTRICT="test firebird? ( bindist )"
 # TODO: unconditional json-c for now as automagic dep despite efforts to stop it
 # ditto libpcap. Can restore USE=rest, USE=pcap if/when fixed.
 
-RDEPEND="acct-group/radius
+DEPEND="
+	acct-group/radius
 	acct-user/radius
-	!net-dialup/cistronradius
 	dev-libs/libltdl
 	dev-libs/libpcre
 	dev-libs/json-c:=
@@ -44,11 +48,15 @@ RDEPEND="acct-group/radius
 	sys-libs/libcap
 	sys-libs/talloc
 	virtual/libcrypt:=
-	firebird? ( dev-db/firebird )
 	iodbc? ( dev-db/libiodbc )
 	kerberos? ( virtual/krb5 )
 	ldap? ( net-nds/openldap:= )
-	memcached? ( dev-libs/libmemcached )
+	memcached? (
+		|| (
+			dev-libs/libmemcached-awesome
+			dev-libs/libmemcached
+		)
+	)
 	mysql? ( dev-db/mysql-connector-c:= )
 	mongodb? ( >=dev-libs/mongo-c-driver-1.13.0-r1 )
 	odbc? ( dev-db/unixODBC )
@@ -60,20 +68,28 @@ RDEPEND="acct-group/radius
 	redis? ( dev-libs/hiredis:= )
 	samba? ( net-fs/samba )
 	sqlite? ( dev-db/sqlite:3 )
-	ssl? (
-		>=dev-libs/openssl-1.0.2:=
-
-	)
-	systemd? ( sys-apps/systemd:= )"
-DEPEND="${RDEPEND}"
+	ssl? ( >=dev-libs/openssl-1.0.2:=[-bindist(-)] )
+	systemd? ( sys-apps/systemd:= )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-radius )
+"
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 # bug #721040
 QA_SONAME="usr/lib.*/libfreeradius-.*.so"
 
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# Not available on Linux (bug #900048)
+	htonll
+	htonlll
+)
+
 PATCHES=(
-	"${FILESDIR}"/mppe_keys_c.patch
+	"${FILESDIR}"/${PN}-3.0.20-systemd-service.patch
+	"${FILESDIR}"/${PN}-3.2.3-configure-c99.patch
 )
 
 pkg_setup() {
@@ -84,17 +100,16 @@ pkg_setup() {
 }
 
 src_prepare() {
+	default
+
 	# Most of the configuration options do not appear as ./configure
 	# switches. Instead it identifies the directories that are available
 	# and run through them. These might check for the presence of
 	# various libraries, in which case they are not built.  To avoid
 	# automagic dependencies, we just remove all the modules that we're
 	# not interested in using.
-
-
-	eapply_user
-	default
-
+	# TODO: shift more of these into configure args below as things
+	# are a bit better now.
 	use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; }
 	use ldap || { rm -r src/modules/rlm_ldap || die ; }
 	use kerberos || { rm -r src/modules/rlm_krb5 || die ; }
@@ -105,7 +120,7 @@ src_prepare() {
 	rm -r src/modules/rlm_python || die
 
 	use python || { rm -r src/modules/rlm_python3 || die ; }
-	use redis || { rm -r src/modules/rlm_redis{,who} || die ; }
+	#use rest || { rm -r src/modules/rlm_rest || die ; }
 	# Do not install ruby rlm module, bug #483108
 	rm -r src/modules/rlm_ruby || die
 
@@ -118,6 +133,8 @@ src_prepare() {
 	rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die
 	# Requires some membership.h
 	rm -r src/modules/rlm_opendirectory || die
+	# Requires firebird
+	rm -r ./src/modules/rlm_sql/drivers/rlm_sql_firebird || die
 	# ?
 	rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die
 
@@ -156,7 +173,6 @@ src_prepare() {
 
 	usesqldriver mysql
 	usesqldriver postgres postgresql
-	usesqldriver firebird
 	usesqldriver iodbc
 	usesqldriver odbc unixodbc
 	usesqldriver oracle
@@ -171,8 +187,11 @@ src_configure() {
 	# massacre of libtool best practices so you also have to make sure
 	# to --enable-shared explicitly.
 	local myeconfargs=(
+		# Revisit confcache when not needing to use ac_cv anymore
+		# for automagic deps.
+		#--cache-file="${S}"/config.cache
+
 		--enable-shared
-		--disable-static
 		--disable-ltdl-install
 		--disable-silent-rules
 		--with-system-libtool
@@ -183,6 +202,8 @@ src_configure() {
 		--without-rlm_securid
 		--without-rlm_unbound
 		--without-rlm_idn
+		#--without-rlm_json
+		#$(use_with rest libfreeradius-json)
 
 		# Our OpenSSL should be patched. Avoid false-positive failures.
 		--disable-openssl-version-check
@@ -194,6 +215,7 @@ src_configure() {
 		--with-experimental-modules
 		--with-docdir=/usr/share/doc/${PF}
 		--with-logdir=/var/log/radius
+
 		$(use_enable debug developer)
 		$(use_with ldap edir)
 		$(use_with redis rlm_cache_redis)
@@ -219,6 +241,11 @@ src_configure() {
 		export ac_cv_lib_readline=no
 	fi
 
+	#if ! use pcap ; then
+	#	export ac_cv_lib_pcap_pcap_open_live=no
+	#	export ac_cv_header_pcap_h=no
+	#fi
+
 	econf "${myeconfargs[@]}"
 }
 
@@ -231,10 +258,13 @@ src_compile() {
 
 src_install() {
 	dodir /etc
+
 	diropts -m0750 -o root -g radius
 	dodir /etc/raddb
+
 	diropts -m0750 -o radius -g radius
 	dodir /var/log/radius
+
 	keepdir /var/log/radius/radacct
 	diropts
 
@@ -268,6 +298,7 @@ src_install() {
 			-e 's:^WatchdogSec=.*::g' -e 's:^NotifyAccess=all.*::g' \
 			"${S}"/debian/freeradius.service
 	fi
+
 	systemd_dounit "${S}"/debian/freeradius.service
 
 	find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die
@@ -276,6 +307,7 @@ src_install() {
 pkg_config() {
 	if use ssl ; then
 		cd "${ROOT}"/etc/raddb/certs || die
+
 		./bootstrap || die "Error while running ./bootstrap script."
 		chown root:radius "${ROOT}"/etc/raddb/certs || die
 		chown root:radius "${ROOT}"/etc/raddb/certs/ca.pem || die
diff --git a/net-dialup/freeradius/freeradius-3.2.8.ebuild b/net-dialup/freeradius/freeradius-3.2.8-r1.ebuild
index 6b23bd216ff3..0349859729be 100644
--- a/net-dialup/freeradius/freeradius-3.2.8.ebuild
+++ b/net-dialup/freeradius/freeradius-3.2.8-r1.ebuild
@@ -1,5 +1,6 @@
-# Copyright 2021-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 PYTHON_COMPAT=( python3_{13..14} )
@@ -11,19 +12,22 @@ MY_P=${MY_PN}-${PV}
 MY_PV=$(ver_rs 1- "_")
 
 DESCRIPTION="Highly configurable free RADIUS server"
-HOMEPAGE="https://freeradius.org/"
+HOMEPAGE="https://www.freeradius.org/"
 SRC_URI="https://github.com/FreeRADIUS/freeradius-server/releases/download/release_${MY_PV}/${MY_P}.tar.bz2"
 S="${WORKDIR}"/${MY_P}
 
-KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
 LICENSE="GPL-2"
 SLOT="0"
+KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 ~sparc x86"
 
 IUSE="
-	debug firebird iodbc kafka kerberos ldap  memcached mysql mongodb odbc oracle pam
-	postgres python readline redis samba sqlite ssl systemd
+	debug iodbc kafka kerberos ldap memcached mysql mongodb odbc oracle pam
+	postgres python readline redis samba selinux sqlite ssl systemd yubikey
 "
-RESTRICT="test firebird? ( bindist )"
+
+# NOTE: Temporary freeradius doesn't support linking with mariadb client
+#       libs also if code is compliant, will be available in the next release.
+#       (http://lists.freeradius.org/pipermail/freeradius-devel/2018-October/013228.html)a
 
 # TODO: rlm_mschap works with both samba library or without. I need to avoid
 #       linking of samba library if -samba is used.
@@ -31,9 +35,9 @@ RESTRICT="test firebird? ( bindist )"
 # TODO: unconditional json-c for now as automagic dep despite efforts to stop it
 # ditto libpcap. Can restore USE=rest, USE=pcap if/when fixed.
 
-RDEPEND="acct-group/radius
+DEPEND="
+	acct-group/radius
 	acct-user/radius
-	!net-dialup/cistronradius
 	dev-libs/libltdl
 	dev-libs/libpcre
 	dev-libs/json-c:=
@@ -44,12 +48,16 @@ RDEPEND="acct-group/radius
 	sys-libs/libcap
 	sys-libs/talloc
 	virtual/libcrypt:=
-	firebird? ( dev-db/firebird )
 	iodbc? ( dev-db/libiodbc )
 	kafka? ( dev-libs/librdkafka:= )
 	kerberos? ( virtual/krb5 )
 	ldap? ( net-nds/openldap:= )
-	memcached? ( dev-libs/libmemcached )
+	memcached? (
+		|| (
+			dev-libs/libmemcached-awesome
+			dev-libs/libmemcached
+		)
+	)
 	mysql? ( dev-db/mysql-connector-c:= )
 	mongodb? ( >=dev-libs/mongo-c-driver-1.13.0-r1 )
 	odbc? ( dev-db/unixODBC )
@@ -61,20 +69,29 @@ RDEPEND="acct-group/radius
 	redis? ( dev-libs/hiredis:= )
 	samba? ( net-fs/samba )
 	sqlite? ( dev-db/sqlite:3 )
-	ssl? (
-		>=dev-libs/openssl-1.0.2:=
-
-	)
-	systemd? ( sys-apps/systemd:= )"
-DEPEND="${RDEPEND}"
+	ssl? ( >=dev-libs/openssl-1.0.2:=[-bindist(-)] )
+	systemd? ( sys-apps/systemd:= )
+	yubikey? ( sys-auth/libyubikey )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-radius )
+"
 
 REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 # bug #721040
 QA_SONAME="usr/lib.*/libfreeradius-.*.so"
 
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# Not available on Linux (bug #900048)
+	htonll
+	htonlll
+)
+
 PATCHES=(
-	"${FILESDIR}"/mppe_keys_c.patch
+	"${FILESDIR}/${PN}-3.2.8-systemd-service.patch"
+	"${FILESDIR}/${PN}-3.2.3-configure-c99.patch"
 )
 
 pkg_setup() {
@@ -85,17 +102,16 @@ pkg_setup() {
 }
 
 src_prepare() {
+	default
+
 	# Most of the configuration options do not appear as ./configure
 	# switches. Instead it identifies the directories that are available
 	# and run through them. These might check for the presence of
 	# various libraries, in which case they are not built.  To avoid
 	# automagic dependencies, we just remove all the modules that we're
 	# not interested in using.
-
-
-	eapply_user
-	default
-
+	# TODO: shift more of these into configure args below as things
+	# are a bit better now.
 	use ssl || { rm -r src/modules/rlm_eap/types/rlm_eap_{tls,ttls,peap} || die ; }
 	use ldap || { rm -r src/modules/rlm_ldap || die ; }
 	use kerberos || { rm -r src/modules/rlm_krb5 || die ; }
@@ -106,7 +122,7 @@ src_prepare() {
 	rm -r src/modules/rlm_python || die
 
 	use python || { rm -r src/modules/rlm_python3 || die ; }
-	use redis || { rm -r src/modules/rlm_redis{,who} || die ; }
+	#use rest || { rm -r src/modules/rlm_rest || die ; }
 	# Do not install ruby rlm module, bug #483108
 	rm -r src/modules/rlm_ruby || die
 
@@ -119,6 +135,8 @@ src_prepare() {
 	rm -r src/modules/rlm_eap/types/rlm_eap_ikev2 || die
 	# Requires some membership.h
 	rm -r src/modules/rlm_opendirectory || die
+	# Requires firebird
+	rm -r ./src/modules/rlm_sql/drivers/rlm_sql_firebird || die
 	# ?
 	rm -r src/modules/rlm_sql/drivers/rlm_sql_{db2,freetds} || die
 
@@ -157,7 +175,6 @@ src_prepare() {
 
 	usesqldriver mysql
 	usesqldriver postgres postgresql
-	usesqldriver firebird
 	usesqldriver iodbc
 	usesqldriver odbc unixodbc
 	usesqldriver oracle
@@ -172,8 +189,11 @@ src_configure() {
 	# massacre of libtool best practices so you also have to make sure
 	# to --enable-shared explicitly.
 	local myeconfargs=(
+		# Revisit confcache when not needing to use ac_cv anymore
+		# for automagic deps.
+		#--cache-file="${S}"/config.cache
+
 		--enable-shared
-		--disable-static
 		--disable-ltdl-install
 		--disable-silent-rules
 		--with-system-libtool
@@ -184,6 +204,8 @@ src_configure() {
 		--without-rlm_securid
 		--without-rlm_unbound
 		--without-rlm_idn
+		#--without-rlm_json
+		#$(use_with rest libfreeradius-json)
 
 		# Our OpenSSL should be patched. Avoid false-positive failures.
 		--disable-openssl-version-check
@@ -195,6 +217,7 @@ src_configure() {
 		--with-experimental-modules
 		--with-docdir=/usr/share/doc/${PF}
 		--with-logdir=/var/log/radius
+
 		$(use_enable debug developer)
 		$(use_with kafka rlm_kafka)
 		$(use_with ldap edir)
@@ -203,6 +226,7 @@ src_configure() {
 		$(use_with redis rlm_rediswho)
 		$(use_with ssl openssl)
 		$(use_with systemd systemd)
+		$(use_with yubikey rlm_yubikey)
 	)
 
 	# bug #77613
@@ -221,6 +245,11 @@ src_configure() {
 		export ac_cv_lib_readline=no
 	fi
 
+	#if ! use pcap ; then
+	#	export ac_cv_lib_pcap_pcap_open_live=no
+	#	export ac_cv_header_pcap_h=no
+	#fi
+
 	econf "${myeconfargs[@]}"
 }
 
@@ -233,10 +262,13 @@ src_compile() {
 
 src_install() {
 	dodir /etc
+
 	diropts -m0750 -o root -g radius
 	dodir /etc/raddb
+
 	diropts -m0750 -o radius -g radius
 	dodir /var/log/radius
+
 	keepdir /var/log/radius/radacct
 	diropts
 
@@ -270,6 +302,7 @@ src_install() {
 			-e 's:^WatchdogSec=.*::g' -e 's:^NotifyAccess=all.*::g' \
 			"${S}"/debian/freeradius.service
 	fi
+
 	systemd_dounit "${S}"/debian/freeradius.service
 
 	find "${ED}" \( -name "*.a" -o -name "*.la" \) -delete || die
@@ -278,6 +311,7 @@ src_install() {
 pkg_config() {
 	if use ssl ; then
 		cd "${ROOT}"/etc/raddb/certs || die
+
 		./bootstrap || die "Error while running ./bootstrap script."
 		chown root:radius "${ROOT}"/etc/raddb/certs || die
 		chown root:radius "${ROOT}"/etc/raddb/certs/ca.pem || die
diff --git a/net-dialup/freeradius/metadata.xml b/net-dialup/freeradius/metadata.xml
index c83ce7fd48a4..940d58a9b0b4 100644
--- a/net-dialup/freeradius/metadata.xml
+++ b/net-dialup/freeradius/metadata.xml
@@ -1,27 +1,26 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
-  </maintainer>
   <maintainer type="person">
-    <email>geaaru@gmail.com</email>
-    <name>Daniele Rondina</name>
-  </maintainer>
-  <maintainer type="project">
-    <email>proxy-maint@gentoo.org</email>
-    <name>Proxy Maintainers</name>
+    <email>jkroon@gentoo.org</email>
+    <name>Jaco Kroon</name>
   </maintainer>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:freeradius:freeradius</remote-id>
-  </upstream>
   <use>
-    <flag name="memcached">Include <pkg>dev-libs/libmemcached</pkg> in caching drivers</flag>
-    <flag name="pcap">Build the RADIUS sniffer which requires <pkg>net-libs/libpcap</pkg>.</flag>
-    <flag name="rest">Include support for sending and receiving HTTP requests</flag>
-    <flag name="redis">Include support for Redis database</flag>
-    <flag name="mongodb">Include support for MongoDB database</flag>
+    <flag name="memcached">
+			Include <pkg>dev-libs/libmemcached</pkg> in caching drivers
+		</flag>
+    <flag name="kafka">
+			Include support for kafka
+		</flag>
+    <flag name="redis">
+			Include support for Redis database
+		</flag>
+    <flag name="mongodb">
+			Include support for MongoDB database
+		</flag>
+    <flag name="yubikey">
+			Include support for ubikey
+		</flag>
   </use>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-dialup/ppp/Manifest b/net-dialup/ppp/Manifest
index 69f84f609ba2..ca8090050c91 100644
--- a/net-dialup/ppp/Manifest
+++ b/net-dialup/ppp/Manifest
@@ -1,2 +1,5 @@
+DIST ppp-2.5.0.tar.gz 1170057 BLAKE2B 6a0e9efcbff3cb499705071cc7d0e3411cf4871fd53b2bfedbb1f2cf3ad80728eb436050cf33b78e36d473be64f15907a21da17f283337455f0af379bc18272d SHA512 094368ea2aa6c6e8dfba4443509857a7c1c7ff839bb6d6657743802477208c01e87db31593cef0932d3725c640e9c103179da6b742825034cda82bd31ddcc2ed
+DIST ppp-2.5.1.tar.gz 991639 BLAKE2B e3ece873ea25bde5ddffd0da168ffe6ba890693f20fb9f1d6a48f365331abdb4cf517fd0b3004d26a0c778ad4d750e39e38486544e2771b23223469db13c239c SHA512 57b3bbf918c302dbc621f56b706efa1b35b2fc45b71c3a309c1cfee22c28fcf98d7f8965fbeba9260c124f2afb9e297885007256ee05469adca73fad032902b9
 DIST ppp-2.5.2.tar.gz 973132 BLAKE2B 5a79bfaf23c2f1cba7b2c4e8f27e6033aa7ee6e119b4d96dfd2870f91524052fe9ed16149e5f76cf93370159f491af828b4103eb04bd4f5dbbecca4a08af9d0d SHA512 2c49d411818632a750f52b187c0ee421e9fcc1530c717abacce61e76aa8b296ce09fb142bc202696c0e0ac5570dd12ee649267921b756b6572ae514ce961d1e6
 DIST ppp-2.5.3.tar.gz 995939 BLAKE2B fe915978f1332c18dc370b5d79d07c55afd006d576168c16034ac368afe138d3e0a41d7a9a05fdc2868b1e30bbd0510aadbf7e9a595c77cacaeb739c9289051c SHA512 4de2af44d56d8629db37a7aa71ea1973020bacd4fe6b8e56b69b4b825445437cf9d5e2caee13e0af09d26b89954a8e08560581f3c5611edb119ea63fc10d2255
+DIST pppgetpass.8 450 BLAKE2B 4e9805cfecb4d07c302682c1ced42cc5d247d18fae904b909e126874af962cf48bb703cd75b0cefce4e19404f2e757602d3b57f187567fc23d4b93d9598d1486 SHA512 21f6dda908cf73ee27bfa39d2b50e7f76b371e50bd7d5a0586174b30129c119accbd260d7f9e0e6aa6aabfa5ba11a13ba560588a99672c9dd4e9f33254f88836
diff --git a/net-dialup/ppp/files/README.mpls b/net-dialup/ppp/files/README.mpls
deleted file mode 100644
index 1ae7ae46057a..000000000000
--- a/net-dialup/ppp/files/README.mpls
+++ /dev/null
@@ -1,15 +0,0 @@
-MPLS consists of 3 components:
-1. MPLS forwarding
-2. MPLS signalling
-3. Mapping layer 3 traffic onto MPLS LSPs
-
-The document mpls-forwarding basics explains item 1.
-
-Examples of MPLS signalling protocols are: RSVP-TE LDP and CR-LDP.
-The package ldp-portable is an implementation of LDP and contains more
-information about LDP based MPLS signalling.
-
-Mapping of layer 3 traffic to MPLS LSPs is accomplised in a couple of
-different ways.
--Per FEC where FEC is an entry in the routing table
--Virtual interface that represents an LSP
diff --git a/net-dialup/ppp/files/ppp-2.5.0-openssl-pkgconfig.patch b/net-dialup/ppp/files/ppp-2.5.0-openssl-pkgconfig.patch
new file mode 100644
index 000000000000..893b623a4ea5
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-openssl-pkgconfig.patch
@@ -0,0 +1,79 @@
+https://bugs.gentoo.org/905442
+https://github.com/ppp-project/ppp/pull/438
+
+From 9b4bdca70081abbad26277b009ef9c4ab7e276d0 Mon Sep 17 00:00:00 2001
+From: Brahmajit Das <brahmajit.xyz@gmail.com>
+Date: Thu, 2 Nov 2023 11:26:18 +0530
+Subject: [PATCH] Fix linking error with lld linkers (#438)
+
+When using lld linker, build fails with
+
+ld.lld: error: /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../lib64/Scrt1.o is incompatible with elf32-i386
+ld.lld: error: /usr/lib/gcc/x86_64-pc-linux-gnu/12/../../../../lib64/crti.o is incompatible with elf32-i386
+ld.lld: error: /usr/lib/llvm/16/bin/../../../../lib/clang/16/lib/linux
+
+The fix is to check pkg-config first, and not force manual -L /usr/lib.
+If pkg-config succeeded, then we don't bother with -L /usr/lib
+
+Our guess is this what the actual intention was based upon the coments
+
+if pkg-config is installed and openssl has installed a .pc file,
+then use that information and don't search ssldirs
+
+First found on gentoo linux with llvm profile, please check out Bug:
+section of the commit for more info and a complete build log.
+
+Bug: https://bugs.gentoo.org/905442
+
+Signed-off-by: Brahmajit Das <brahmajit.xyz@gmail.com>
+Co-authored-by: Sam James <sam@gentoo.org>
+---
+ m4/ax_check_openssl.m4 | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/m4/ax_check_openssl.m4 b/m4/ax_check_openssl.m4
+index 8ae39cae6..39154c856 100644
+--- a/m4/ax_check_openssl.m4
++++ b/m4/ax_check_openssl.m4
+@@ -55,6 +55,20 @@ AC_DEFUN([AX_CHECK_OPENSSL], [
+         ])
+ 
+     AS_IF([test "${with_openssl}" != "no"], [
++        # if pkg-config is installed and openssl has installed a .pc file,
++        # then use that information and don't search ssldirs
++        AC_PATH_PROG([PKG_CONFIG], [pkg-config])
++        if test x"$PKG_CONFIG" != x""; then
++            OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null`
++            if test $? = 0; then
++                OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
++                OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
++                found=true
++            fi
++        fi
++    ])
++
++    AS_IF([test "${with_openssl}" != "no" && test ! ${found}], [
+         OPENSSL_INCLUDES=
+         for ssldir in $ssldirs; do
+             AC_MSG_CHECKING([for openssl/ssl.h in $ssldir])
+@@ -69,20 +83,6 @@ AC_DEFUN([AX_CHECK_OPENSSL], [
+                 AC_MSG_RESULT([no])
+             ])
+         done])
+-     
+-    AS_IF([test "${with_openssl}" != "no" && test ! ${found}], [ 
+-        # if pkg-config is installed and openssl has installed a .pc file,
+-        # then use that information and don't search ssldirs
+-        AC_PATH_PROG([PKG_CONFIG], [pkg-config])
+-        if test x"$PKG_CONFIG" != x""; then
+-            OPENSSL_LDFLAGS=`$PKG_CONFIG openssl --libs-only-L 2>/dev/null`
+-            if test $? = 0; then
+-                OPENSSL_LIBS=`$PKG_CONFIG openssl --libs-only-l 2>/dev/null`
+-                OPENSSL_INCLUDES=`$PKG_CONFIG openssl --cflags-only-I 2>/dev/null`
+-                found=true
+-            fi
+-        fi
+-    ])
+ 
+     AS_IF([test "${with_openssl}" != "no" && test ${found}], [
+ 
diff --git a/net-dialup/ppp/files/ppp-2.5.0-pam-pkgconfig.patch b/net-dialup/ppp/files/ppp-2.5.0-pam-pkgconfig.patch
new file mode 100644
index 000000000000..40488fee96b7
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-pam-pkgconfig.patch
@@ -0,0 +1,81 @@
+https://github.com/ppp-project/ppp/pull/479
+
+From c73498fad415d99aa566b11256938272e62b22dd Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Tue, 5 Mar 2024 14:41:10 -0500
+Subject: [PATCH] Use pkg-config to detect PAM when possible
+
+Signed-off-by: Mike Gilbert <floppym@gentoo.org>
+---
+ m4/ax_check_pam.m4 | 50 ++++++++++++++++++++--------------------------
+ 1 file changed, 22 insertions(+), 28 deletions(-)
+
+diff --git a/m4/ax_check_pam.m4 b/m4/ax_check_pam.m4
+index b17a7573c..7ebd79b61 100644
+--- a/m4/ax_check_pam.m4
++++ b/m4/ax_check_pam.m4
+@@ -26,34 +26,28 @@
+ AC_DEFUN([AX_CHECK_PAM], [
+     AC_ARG_WITH([pam],
+         [AS_HELP_STRING([--with-pam=DIR],
+-            [With libpam support, see ftp.redhat.com:/pub/pam])],
+-        [
+-            case "$withval" in
+-            "" | y | ye | yes)
+-                pamdirs="/usr/local /usr/lib /usr"  
+-              ;;
+-            n | no)
+-                with_pam="no"
+-              ;;
+-            *)
+-                pamdirs="$withval"
+-              ;;
+-            esac
+-        ])
++            [With libpam support, see ftp.redhat.com:/pub/pam])])
+     
+-    if [ test "x${with_pam}" != "xno" ] ; then
+-        PAM_LIBS="-lpam"
+-        for pamdir in $pamdirs; do
+-            AC_MSG_CHECKING([for pam_appl.h in $pamdir])
+-            if test -f "$pamdir/include/security/pam_appl.h"; then
+-                PAM_CFLAGS="-I$pamdir/include"
+-                PAM_LDFLAGS="-L$pamdir/lib"
+-                AC_MSG_RESULT([yes])
+-                break
+-            else
+-                AC_MSG_RESULT([no])
+-            fi
+-        done
++    AS_IF([test "$with_pam" != "no"], [
++        AS_CASE(["$with_pam"],
++            [""|yes], [PKG_CHECK_MODULES([PAM], [pam], [pamdirs=],
++                        [pamdirs="/usr/local /usr/lib /usr"])],
++            [pamdirs="$with_pam"])
++
++        AS_IF([test -n "$pamdirs"], [
++            PAM_LIBS="-lpam"
++            for pamdir in $pamdirs; do
++                AC_MSG_CHECKING([for pam_appl.h in $pamdir])
++                if test -f "$pamdir/include/security/pam_appl.h"; then
++                    PAM_CFLAGS="-I$pamdir/include"
++                    PAM_LDFLAGS="-L$pamdir/lib"
++                    AC_MSG_RESULT([yes])
++                    break
++                else
++                    AC_MSG_RESULT([no])
++                fi
++            done
++        ])
+ 
+         # try the preprocessor and linker with our new flags,
+         # being careful not to pollute the global LIBS, LDFLAGS, and CPPFLAGS
+@@ -87,7 +81,7 @@ AC_DEFUN([AX_CHECK_PAM], [
+         AC_SUBST([PAM_CFLAGS])
+         AC_SUBST([PAM_LIBS])
+         AC_SUBST([PAM_LDFLAGS])
+-    fi
++    ])
+     AM_CONDITIONAL(WITH_LIBPAM, test "x${with_pam}" != "xno")
+ ])
+ 
diff --git a/net-dialup/ppp/files/ppp-2.5.0-passwordfd-read-early.patch b/net-dialup/ppp/files/ppp-2.5.0-passwordfd-read-early.patch
new file mode 100644
index 000000000000..5c7067c5307b
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-passwordfd-read-early.patch
@@ -0,0 +1,101 @@
+https://github.com/ppp-project/ppp/pull/420
+
+From df35ecb4ab63e8f89f57aa5d593441765a96ed62 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Alin=20N=C4=83stac?= <mrness@gentoo.org>
+Date: Fri, 20 Jun 2008 18:34:06 +0000
+Subject: [PATCH] passwordfd: read password early
+
+Bug: https://bugs.gentoo.org/209294
+Bug: https://bugs.gentoo.org/905112
+---
+ pppd/plugins/passwordfd.c | 54 ++++++++++++++++++---------------------
+ 1 file changed, 25 insertions(+), 29 deletions(-)
+
+diff --git a/pppd/plugins/passwordfd.c b/pppd/plugins/passwordfd.c
+index c1f782e..13aec56 100644
+--- a/pppd/plugins/passwordfd.c
++++ b/pppd/plugins/passwordfd.c
+@@ -24,11 +24,11 @@
+ 
+ char pppd_version[] = PPPD_VERSION;
+ 
+-static int passwdfd = -1;
+ static char save_passwd[MAXSECRETLEN];
+ 
++static int readpassword (char **);
+ static struct option options[] = {
+-    { "passwordfd", o_int, &passwdfd,
++    { "passwordfd", o_special, (void *)readpassword,
+       "Receive password on this file descriptor" },
+     { NULL }
+ };
+@@ -38,43 +38,39 @@ static int pwfd_check (void)
+     return 1;
+ }
+ 
+-static int pwfd_passwd (char *user, char *passwd)
++static int readpassword(char **argv)
+ {
+-    int readgood, red;
+-
+-    if (passwdfd == -1)
+-	return -1;
++    char *arg = *argv;
++    int passwdfd = -1;
++    int chunk, len;
+ 
+-    if (passwd == NULL)
+-	return 1;
+-
+-    if (passwdfd == -2) {
+-	strcpy (passwd, save_passwd);
+-	return 1;
++    if (sscanf(arg, "%d", &passwdfd) != 1 || passwdfd < 0)
++    {
++	error ("\"%s\" is not a valid file descriptor number", arg);
++	return 0;
+     }
+ 
+-    readgood = 0;
++    len = 0;
+     do {
+-	red = read (passwdfd, passwd + readgood, MAXSECRETLEN - 1 - readgood);
+-	if (red == 0)
+-	    break;
+-	if (red < 0) {
+-	    error ("Can't read secret from fd\n");
+-	    readgood = -1;
++	chunk = read (passwdfd, save_passwd + len, MAXSECRETLEN - 1 - len);
++	if (chunk == 0)
+ 	    break;
++	if (chunk < 0) {
++	    error ("Can't read secret from fd %d", passwdfd);
++	    return 0;
+ 	}
+-	readgood += red;
+-    } while (readgood < MAXSECRETLEN - 1);
+-
++	len += chunk;
++    } while (len < MAXSECRETLEN - 1);
++    save_passwd[len] = 0;
+     close (passwdfd);
+ 
+-    if (readgood < 0)
+-	return 0;
+-
+-    passwd[readgood] = 0;
+-    strcpy (save_passwd, passwd);
+-    passwdfd = -2;
++    return 1;
++}
+ 
++static int pwfd_passwd (char *user, char *passwd)
++{
++    if (passwd != NULL)
++	strcpy (passwd, save_passwd);
+     return 1;
+ }
+ 
+-- 
+2.40.1
+
diff --git a/net-dialup/ppp/files/ppp-2.5.0-pidfile.patch b/net-dialup/ppp/files/ppp-2.5.0-pidfile.patch
new file mode 100644
index 000000000000..538ddfb0a2c1
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-pidfile.patch
@@ -0,0 +1,39 @@
+https://github.com/ppp-project/ppp/pull/427
+
+From 0c9f2cb93f56d2a14ffcc97f53f4665b7728d8e4 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Sun, 28 May 2023 17:01:12 -0400
+Subject: [PATCH] Ensure there is a '/' between PPP_PATH_VARRUN and the PID
+ filename
+
+Bug: https://bugs.gentoo.org/907311
+Signed-off-by: Mike Gilbert <floppym@gentoo.org>
+---
+ pppd/main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/main.c b/pppd/main.c
+index 4455199..c207d10 100644
+--- a/pppd/main.c
++++ b/pppd/main.c
+@@ -888,7 +888,7 @@ create_pidfile(int pid)
+ {
+     FILE *pidfile;
+ 
+-    slprintf(pidfilename, sizeof(pidfilename), "%s%s.pid",
++    slprintf(pidfilename, sizeof(pidfilename), "%s/%s.pid",
+ 	     PPP_PATH_VARRUN, ifname);
+     if ((pidfile = fopen(pidfilename, "w")) != NULL) {
+ 	fprintf(pidfile, "%d\n", pid);
+@@ -907,7 +907,7 @@ create_linkpidfile(int pid)
+     if (linkname[0] == 0)
+ 	return;
+     ppp_script_setenv("LINKNAME", linkname, 1);
+-    slprintf(linkpidfile, sizeof(linkpidfile), "%sppp-%s.pid",
++    slprintf(linkpidfile, sizeof(linkpidfile), "%s/ppp-%s.pid",
+ 	     PPP_PATH_VARRUN, linkname);
+     if ((pidfile = fopen(linkpidfile, "w")) != NULL) {
+ 	fprintf(pidfile, "%d\n", pid);
+-- 
+2.40.1
+
diff --git a/net-dialup/ppp/files/ppp-2.5.0-radius-mppe.patch b/net-dialup/ppp/files/ppp-2.5.0-radius-mppe.patch
new file mode 100644
index 000000000000..7bb63c964605
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-radius-mppe.patch
@@ -0,0 +1,167 @@
+https://github.com/ppp-project/ppp/pull/463
+https://bugs.gentoo.org/915686
+
+From 77693b89fed6d4110184789f8e7dfd31710f3190 Mon Sep 17 00:00:00 2001
+From: Jaco Kroon <jaco@uls.co.za>
+Date: Thu, 23 Nov 2023 14:54:42 +0200
+Subject: [PATCH] radius: fix the MPPE key decryption for the second-half of
+ the key block.
+
+During he refactor in commit 4cb90c1 the key material used to decrypt
+the second-half of the encrypted block was accidentally updated from:
+
+MD5(radius_secret + crypt[0..15]); to:
+
+MD5(radius_secret + crypt[0..15] + salt)
+
+Which would obviously mismatch.
+
+This also refactors back into what I believe to be a more readable block
+with lower nesting and more comprehensive error reporting.
+
+Closes: #453
+Signed-off-by: Jaco Kroon <jaco@uls.co.za>
+---
+ pppd/plugins/radius/radius.c | 115 +++++++++++++++++------------------
+ 1 file changed, 55 insertions(+), 60 deletions(-)
+
+diff --git a/pppd/plugins/radius/radius.c b/pppd/plugins/radius/radius.c
+index c73ca0b53..e99bc7511 100644
+--- a/pppd/plugins/radius/radius.c
++++ b/pppd/plugins/radius/radius.c
+@@ -897,80 +897,75 @@ radius_setmppekeys2(VALUE_PAIR *vp, REQUEST_INFO *req_info)
+     memcpy(plain, crypt, 32);
+ 
+     ctx = PPP_MD_CTX_new();
+-    if (ctx) {
+-
+-        if (PPP_DigestInit(ctx, PPP_md5())) {
+-
+-            if (PPP_DigestUpdate(ctx, req_info->secret, strlen(req_info->secret))) {
+-
+-                if (PPP_DigestUpdate(ctx, req_info->request_vector, AUTH_VECTOR_LEN)) {
+-
+-                    if (PPP_DigestUpdate(ctx, salt, 2)) {
+-
+-                        buflen = sizeof(buf);
+-                        if (PPP_DigestFinal(ctx, buf, &buflen)) {
+-
+-                            status = 1;
+-                        }
+-                    }
+-                }
+-            }
+-        }
+-
+-        PPP_MD_CTX_free(ctx);
++    if (!ctx) {
++	error("RADIUS: Error creating PPP_MD_CTX for MS-MPPE-%s-Key attribute", type);
++	return -1;
+     }
+ 
+-    if (status) {
+-
+-        for (i = 0; i < 16; i++) {
+-            plain[i] ^= buf[i];
+-        }
++    buflen = sizeof(buf);
++    if (!PPP_DigestInit(ctx, PPP_md5())) {
++	error("RADIUS: Error setting hash algorithm to MD5 for MS-MPPE-%s-Key attribute", type);
++    } else if (!PPP_DigestUpdate(ctx, req_info->secret, strlen(req_info->secret))) {
++	error("RADIUS: Error mixing in radius secret for MS-MPPE-%s-Key attribute", type);
++    } else if (!PPP_DigestUpdate(ctx, req_info->request_vector, AUTH_VECTOR_LEN)) {
++	error("RADIUS: Error mixing in request vector for MS-MPPE-%s-Key attribute", type);
++    } else if (!PPP_DigestUpdate(ctx, salt, 2)) {
++	error("RADIUS: Error mixing in salt for MS-MPPE-%s-Key attribute", type);
++    } else if (!PPP_DigestFinal(ctx, buf, &buflen)) {
++	error("RADIUS: Error finalizing key buffer for MS-MPPE-%s-Key attribute", type);
++    } else {
++	status = 1;
++    }
+ 
+-        if (plain[0] != 16) {
+-            error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute",
+-                  (int) plain[0], type);
+-            return -1;
+-        }
++    PPP_MD_CTX_free(ctx);
+ 
+-        status = 0;
+-        ctx = PPP_MD_CTX_new();
+-        if (ctx) {
+-
+-            if (PPP_DigestInit(ctx, PPP_md5())) {
++    if (!status)
++	return -1;
+ 
+-                if (PPP_DigestUpdate(ctx, req_info->secret, strlen(req_info->secret))) {
++    for (i = 0; i < 16; i++) {
++	plain[i] ^= buf[i];
++    }
+ 
+-                    if (PPP_DigestUpdate(ctx, crypt, 16)) {
++    if (plain[0] != 16) {
++	error("RADIUS: Incorrect key length (%d) for MS-MPPE-%s-Key attribute",
++		(int) plain[0], type);
++	return -1;
++    }
+ 
+-                        if (PPP_DigestUpdate(ctx, salt, 2)) {
++    status = 0;
++    ctx = PPP_MD_CTX_new();
++    if (!ctx) {
++	error("RADIUS: Error creating PPP_MD_CTX for MS-MPPE-%s-Key(2) attribute", type);
++	return -1;
++    }
+ 
+-                            buflen = sizeof(buf);
+-                            if (PPP_DigestFinal(ctx, buf, &buflen)) {
++    buflen = sizeof(buf);
+ 
+-                                status = 1;
+-                            }
+-                        }
+-                    }
+-                }
+-            }
++    if (!PPP_DigestInit(ctx, PPP_md5())) {
++	error("RADIUS: Error setting hash algorithm to MD5 for MS-MPPE-%s-Key(2) attribute", type);
++    } else if (!PPP_DigestUpdate(ctx, req_info->secret, strlen(req_info->secret))) {
++	error("RADIUS: Error mixing in radius secret for MS-MPPE-%s-Key(2) attribute", type);
++    } else if (!PPP_DigestUpdate(ctx, crypt, 16)) {
++	error("RADIUS: Error mixing in crypt vector for MS-MPPE-%s-Key(2) attribute", type);
++    } else if (!PPP_DigestFinal(ctx, buf, &buflen)) {
++	error("RADIUS: Error finalizing key buffer for MS-MPPE-%s-Key(2) attribute", type);
++    } else {
++	status = 1;
++    }
+ 
+-            PPP_MD_CTX_free(ctx);
+-        }
++    PPP_MD_CTX_free(ctx);
+ 
+-        if (status) {
++    if (!status)
++	return -1;
+ 
+-            plain[16] ^= buf[0]; /* only need the first byte */
++    plain[16] ^= buf[0]; /* only need the first byte */
+ 
+-            if (vp->attribute == PW_MS_MPPE_SEND_KEY) {
+-                mppe_set_keys(plain + 1, NULL, 16);
+-            } else {
+-                mppe_set_keys(NULL, plain + 1, 16);
+-            }
+-            return 0;
+-        }
++    if (vp->attribute == PW_MS_MPPE_SEND_KEY) {
++	mppe_set_keys(plain + 1, NULL, 16);
++    } else {
++	mppe_set_keys(NULL, plain + 1, 16);
+     }
+-
+-    return -1;
++    return 0;
+ }
+ #endif /* PPP_WITH_MPPE */
+ 
diff --git a/net-dialup/ppp/files/ppp-2.5.0-radiusclient.conf-parsing.patch b/net-dialup/ppp/files/ppp-2.5.0-radiusclient.conf-parsing.patch
new file mode 100644
index 000000000000..9916f766c7af
--- /dev/null
+++ b/net-dialup/ppp/files/ppp-2.5.0-radiusclient.conf-parsing.patch
@@ -0,0 +1,48 @@
+https://github.com/ppp-project/ppp/issues/411
+https://github.com/ppp-project/ppp/commit/7f89208b860ea0c41636410bfdb6a609b2772f47
+https://bugs.gentoo.org/908396
+
+From 7f89208b860ea0c41636410bfdb6a609b2772f47 Mon Sep 17 00:00:00 2001
+From: Eivind Naess <eivnaes@yahoo.com>
+Date: Sun, 23 Apr 2023 11:37:01 -0700
+Subject: [PATCH] Closes #411, Fixing up parsing in radiusclient.conf
+
+Adding curly braces to fix the code.
+
+Signed-off-by: Eivind Naess <eivnaes@yahoo.com>
+--- a/pppd/plugins/radius/config.c
++++ b/pppd/plugins/radius/config.c
+@@ -235,24 +235,28 @@ int rc_read_config(char *filename)
+ 
+ 		switch (option->type) {
+ 			case OT_STR:
+-				 if (set_option_str(filename, line, option, p) < 0)
++				if (set_option_str(filename, line, option, p) < 0) {
+ 					fclose(configfd);
+ 					return (-1);
++				}
+ 				break;
+ 			case OT_INT:
+-				 if (set_option_int(filename, line, option, p) < 0)
++				if (set_option_int(filename, line, option, p) < 0) {
+ 					fclose(configfd);
+ 					return (-1);
++				}
+ 				break;
+ 			case OT_SRV:
+-				 if (set_option_srv(filename, line, option, p) < 0)
++				if (set_option_srv(filename, line, option, p) < 0) {
+ 					fclose(configfd);
+ 					return (-1);
++				}
+ 				break;
+ 			case OT_AUO:
+-				 if (set_option_auo(filename, line, option, p) < 0)
++				if (set_option_auo(filename, line, option, p) < 0) {
+ 					fclose(configfd);
+ 					return (-1);
++				}
+ 				break;
+ 			default:
+ 				fatal("rc_read_config: impossible case branch!");
+
diff --git a/net-dialup/ppp/metadata.xml b/net-dialup/ppp/metadata.xml
index 2097546df67a..56b784b9a30d 100644
--- a/net-dialup/ppp/metadata.xml
+++ b/net-dialup/ppp/metadata.xml
@@ -1,28 +1,22 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE pkgmetadata SYSTEM "https://docs.baldeagleos.com/dtd/metadata.dtd">
 <pkgmetadata>
-  <maintainer type="project">
-    <email>dev@liguros.net</email>
-    <name>Development</name>
+  <maintainer type="person">
+    <email>jkroon@gentoo.org</email>
+    <name>Jaco Kroon</name>
   </maintainer>
   <maintainer type="project">
     <email>base-system@gentoo.org</email>
     <name>Gentoo Base System</name>
   </maintainer>
-  <upstream>
-    <remote-id type="cpe">cpe:/a:samba:ppp</remote-id>
-  </upstream>
   <use>
     <flag name="activefilter">Enables active filter support</flag>
-    <flag name="dhcp">Installs PPP DHCP client plugin for IP address allocation
-		by a DHCP server (see http://www.netservers.co.uk/gpl/)</flag>
-    <flag name="eap-tls">Enables support for Extensible Authentication
-		Protocol and Transport Level Security (see
-		http://www.nikhef.nl/~janjust/ppp/index.html)</flag>
     <flag name="gtk">Installs GTK+ password prompting program that can be used
 		by passprompt.so PPP plugin for reading the password from a X11 input
 		terminal</flag>
-    <flag name="radius">Enables RADIUS support</flag>
   </use>
+  <upstream>
+    <remote-id type="cpe">cpe:/a:samba:ppp</remote-id>
+  </upstream>
   <origin>baldeagleos-repo</origin>
 </pkgmetadata>
diff --git a/net-dialup/ppp/ppp-2.5.0-r7.ebuild b/net-dialup/ppp/ppp-2.5.0-r7.ebuild
new file mode 100644
index 000000000000..3bdf1eda3c85
--- /dev/null
+++ b/net-dialup/ppp/ppp-2.5.0-r7.ebuild
@@ -0,0 +1,141 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools linux-info pam tmpfiles
+
+DESCRIPTION="Point-to-Point Protocol (PPP)"
+HOMEPAGE="https://ppp.samba.org/"
+SRC_URI="
+	https://download.samba.org/pub/ppp/${P}.tar.gz
+	https://raw.githubusercontent.com/ppp-project/ppp/${P}/contrib/pppgetpass/pppgetpass.8
+"
+
+LICENSE="BSD GPL-2"
+SLOT="0/${PV}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="activefilter atm gtk pam selinux systemd"
+
+DEPEND="
+	dev-libs/openssl:0=
+	virtual/libcrypt:=
+	activefilter? ( net-libs/libpcap )
+	atm? ( net-dialup/linux-atm )
+	gtk? ( x11-libs/gtk+:2 )
+	pam? ( sys-libs/pam )
+	systemd? ( sys-apps/systemd )
+"
+RDEPEND="
+	${DEPEND}
+	!<net-misc/netifrc-0.7.1-r2
+	selinux? ( sec-policy/selinux-ppp )
+"
+BDEPEND="virtual/pkgconfig"
+PDEPEND="net-dialup/ppp-scripts"
+
+PATCHES=(
+	"${FILESDIR}"/ppp-2.5.0-passwordfd-read-early.patch
+	"${FILESDIR}"/ppp-2.5.0-pidfile.patch
+	"${FILESDIR}"/ppp-2.5.0-radiusclient.conf-parsing.patch
+	"${FILESDIR}"/ppp-2.5.0-openssl-pkgconfig.patch
+	"${FILESDIR}"/ppp-2.5.0-pam-pkgconfig.patch
+	"${FILESDIR}"/ppp-2.5.0-radius-mppe.patch
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~PPP ~PPP_ASYNC ~PPP_SYNC_TTY"
+	local ERROR_PPP="CONFIG_PPP:\t missing PPP support (REQUIRED)"
+	local ERROR_PPP_ASYNC="CONFIG_PPP_ASYNC:\t missing asynchronous serial line discipline"
+	ERROR_PPP_ASYNC+=" (optional, but highly recommended)"
+	local WARNING_PPP_SYNC_TTY="CONFIG_PPP_SYNC_TTY:\t missing synchronous serial line discipline"
+	WARNING_PPP_SYNC_TTY+=" (optional; used by 'sync' pppd option)"
+	if use activefilter ; then
+		CONFIG_CHECK+=" ~PPP_FILTER"
+		local ERROR_PPP_FILTER="CONFIG_PPP_FILTER:\t missing PPP filtering support (REQUIRED)"
+	fi
+	CONFIG_CHECK+=" ~PPP_DEFLATE ~PPP_BSDCOMP ~PPP_MPPE"
+	local ERROR_PPP_DEFLATE="CONFIG_PPP_DEFLATE:\t missing Deflate compression (optional, but highly recommended)"
+	local ERROR_PPP_BSDCOMP="CONFIG_PPP_BSDCOMP:\t missing BSD-Compress compression (optional, but highly recommended)"
+	local WARNING_PPP_MPPE="CONFIG_PPP_MPPE:\t missing MPPE encryption (optional, mostly used by PPTP links)"
+	CONFIG_CHECK+=" ~PPPOE ~PACKET"
+	local WARNING_PPPOE="CONFIG_PPPOE:\t missing PPPoE support (optional, needed by pppoe plugin)"
+	local WARNING_PACKET="CONFIG_PACKET:\t missing AF_PACKET support (optional, used by pppoe plugin)"
+	if use atm ; then
+		CONFIG_CHECK+=" ~PPPOATM"
+		local WARNING_PPPOATM="CONFIG_PPPOATM:\t missing PPPoA support (optional, needed by pppoatm plugin)"
+	fi
+
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+	eautoreconf
+
+	# Set the right paths in radiusclient.conf
+	sed -e "s:/usr/local/etc:/etc:" \
+		-e "s:/usr/local/sbin:/usr/sbin:" \
+		-i pppd/plugins/radius/etc/radiusclient.conf || die
+	# Set config dir to /etc/ppp/radius
+	sed -i -e "s:/etc/radiusclient:/etc/ppp/radius:g" \
+		pppd/plugins/radius/{*.8,*.c,*.h} \
+		pppd/plugins/radius/etc/* || die
+}
+
+src_configure() {
+	local args=(
+		--localstatedir="${EPREFIX}"/var
+		--runstatedir="${EPREFIX}"/run
+		$(use_enable systemd)
+		$(use_with atm)
+		$(use_with pam)
+		$(use_with activefilter pcap)
+		$(use_with gtk)
+		--enable-cbcp
+		--enable-multilink
+	)
+	econf "${args[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -type f -delete || die
+
+	if use pam; then
+		pamd_mimic_system ppp auth account session
+	fi
+
+	insinto /etc/modprobe.d
+	newins "${FILESDIR}/modules.ppp" ppp.conf
+
+	dosbin scripts/p{on,off,log}
+	doman scripts/pon.1
+	dosym pon.1 /usr/share/man/man1/poff.1
+	dosym pon.1 /usr/share/man/man1/plog.1
+
+	# Adding misc. specialized scripts to doc dir
+	dodoc -r scripts
+
+	if use gtk ; then
+		dosbin contrib/pppgetpass/pppgetpass.{gtk,vt}
+		newsbin contrib/pppgetpass/pppgetpass.sh pppgetpass
+	else
+		newsbin contrib/pppgetpass/pppgetpass.vt pppgetpass
+	fi
+
+	newtmpfiles "${FILESDIR}/pppd.tmpfiles" pppd.conf
+
+	# Missing from upstream tarball
+	# https://github.com/ppp-project/ppp/pull/412
+	#doman contrib/pppgetpass/pppgetpass.8
+	doman "${DISTDIR}/pppgetpass.8"
+
+	insinto /etc/ppp/radius
+	doins pppd/plugins/radius/etc/{dictionary*,issue,port-id-map,radiusclient.conf,realms,servers}
+}
+
+pkg_postinst() {
+	tmpfiles_process pppd.conf
+}
diff --git a/net-dialup/ppp/ppp-2.5.1-r1.ebuild b/net-dialup/ppp/ppp-2.5.1-r1.ebuild
new file mode 100644
index 000000000000..c73dc2c82e81
--- /dev/null
+++ b/net-dialup/ppp/ppp-2.5.1-r1.ebuild
@@ -0,0 +1,127 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic linux-info pam tmpfiles
+
+DESCRIPTION="Point-to-Point Protocol (PPP)"
+HOMEPAGE="https://ppp.samba.org/"
+SRC_URI="https://download.samba.org/pub/ppp/${P}.tar.gz"
+
+LICENSE="BSD GPL-2"
+SLOT="0/${PV}"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
+IUSE="activefilter atm gtk pam selinux systemd"
+
+DEPEND="
+	dev-libs/openssl:0=
+	virtual/libcrypt:=
+	activefilter? ( net-libs/libpcap )
+	atm? ( net-dialup/linux-atm )
+	gtk? ( x11-libs/gtk+:2 )
+	pam? ( sys-libs/pam )
+	systemd? ( sys-apps/systemd )
+"
+RDEPEND="
+	${DEPEND}
+	selinux? ( sec-policy/selinux-ppp )
+"
+BDEPEND="virtual/pkgconfig"
+PDEPEND="net-dialup/ppp-scripts"
+
+pkg_setup() {
+	local CONFIG_CHECK="~PPP ~PPP_ASYNC ~PPP_SYNC_TTY"
+	local ERROR_PPP="CONFIG_PPP:\t missing PPP support (REQUIRED)"
+	local ERROR_PPP_ASYNC="CONFIG_PPP_ASYNC:\t missing asynchronous serial line discipline"
+	ERROR_PPP_ASYNC+=" (optional, but highly recommended)"
+	local WARNING_PPP_SYNC_TTY="CONFIG_PPP_SYNC_TTY:\t missing synchronous serial line discipline"
+	WARNING_PPP_SYNC_TTY+=" (optional; used by 'sync' pppd option)"
+	if use activefilter ; then
+		CONFIG_CHECK+=" ~PPP_FILTER"
+		local ERROR_PPP_FILTER="CONFIG_PPP_FILTER:\t missing PPP filtering support (REQUIRED)"
+	fi
+	CONFIG_CHECK+=" ~PPP_DEFLATE ~PPP_BSDCOMP ~PPP_MPPE"
+	local ERROR_PPP_DEFLATE="CONFIG_PPP_DEFLATE:\t missing Deflate compression (optional, but highly recommended)"
+	local ERROR_PPP_BSDCOMP="CONFIG_PPP_BSDCOMP:\t missing BSD-Compress compression (optional, but highly recommended)"
+	local WARNING_PPP_MPPE="CONFIG_PPP_MPPE:\t missing MPPE encryption (optional, mostly used by PPTP links)"
+	CONFIG_CHECK+=" ~PPPOE ~PACKET"
+	local WARNING_PPPOE="CONFIG_PPPOE:\t missing PPPoE support (optional, needed by pppoe plugin)"
+	local WARNING_PACKET="CONFIG_PACKET:\t missing AF_PACKET support (optional, used by pppoe plugin)"
+	if use atm ; then
+		CONFIG_CHECK+=" ~PPPOATM"
+		local WARNING_PPPOATM="CONFIG_PPPOATM:\t missing PPPoA support (optional, needed by pppoatm plugin)"
+	fi
+
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+
+	# Set the right paths in radiusclient.conf
+	sed -e "s:/usr/local/etc:/etc:" \
+		-e "s:/usr/local/sbin:/usr/sbin:" \
+		-i pppd/plugins/radius/etc/radiusclient.conf || die
+	# Set config dir to /etc/ppp/radius
+	sed -i -e "s:/etc/radiusclient:/etc/ppp/radius:g" \
+		pppd/plugins/radius/{*.8,*.c,*.h} \
+		pppd/plugins/radius/etc/* || die
+}
+
+src_configure() {
+	# https://bugs.gentoo.org/943931
+	append-cflags -std=gnu17
+
+	local args=(
+		--localstatedir="${EPREFIX}"/var
+		--runstatedir="${EPREFIX}"/run
+		$(use_enable systemd)
+		$(use_with atm)
+		$(use_with pam)
+		$(use_with activefilter pcap)
+		$(use_with gtk)
+		--enable-cbcp
+		--enable-multilink
+	)
+	econf "${args[@]}"
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -type f -delete || die
+
+	if use pam; then
+		pamd_mimic_system ppp auth account session
+	fi
+
+	insinto /etc/modprobe.d
+	newins "${FILESDIR}/modules.ppp" ppp.conf
+
+	dosbin scripts/p{on,off,log}
+	doman scripts/pon.1
+	dosym pon.1 /usr/share/man/man1/poff.1
+	dosym pon.1 /usr/share/man/man1/plog.1
+
+	# Adding misc. specialized scripts to doc dir
+	dodoc -r scripts
+
+	if use gtk ; then
+		dosbin contrib/pppgetpass/pppgetpass.{gtk,vt}
+		newsbin contrib/pppgetpass/pppgetpass.sh pppgetpass
+	else
+		newsbin contrib/pppgetpass/pppgetpass.vt pppgetpass
+	fi
+
+	doman contrib/pppgetpass/pppgetpass.8
+
+	newtmpfiles "${FILESDIR}/pppd.tmpfiles-r1" pppd.conf
+
+	insinto /etc/ppp/radius
+	doins pppd/plugins/radius/etc/{dictionary*,issue,port-id-map,radiusclient.conf,realms,servers}
+}
+
+pkg_postinst() {
+	tmpfiles_process pppd.conf
+}
diff --git a/net-dialup/ppp/ppp-2.5.2.ebuild b/net-dialup/ppp/ppp-2.5.2.ebuild
index e268033ccf88..4c2efbb1c352 100644
--- a/net-dialup/ppp/ppp-2.5.2.ebuild
+++ b/net-dialup/ppp/ppp-2.5.2.ebuild
@@ -1,5 +1,6 @@
-# Copyright 2024-2025 Liguros Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 inherit flag-o-matic linux-info pam tmpfiles
@@ -10,12 +11,11 @@ SRC_URI="https://download.samba.org/pub/ppp/${P}.tar.gz"
 
 LICENSE="BSD GPL-2"
 SLOT="0/${PV}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="activefilter atm pam selinux systemd"
 
 DEPEND="
 	dev-libs/openssl:0=
-
 	virtual/libcrypt:=
 	activefilter? ( net-libs/libpcap )
 	atm? ( net-dialup/linux-atm )
@@ -69,7 +69,7 @@ src_prepare() {
 }
 
 src_configure() {
-	# bug #944065
+	# https://bugs.gentoo.org/943931
 	append-cflags -std=gnu17
 
 	local args=(
diff --git a/net-dialup/ppp/ppp-2.5.3.ebuild b/net-dialup/ppp/ppp-2.5.3.ebuild
index 80ca0591eb48..90e216b61b5c 100644
--- a/net-dialup/ppp/ppp-2.5.3.ebuild
+++ b/net-dialup/ppp/ppp-2.5.3.ebuild
@@ -1,5 +1,6 @@
-# Copyright 2024-2026 Liguros Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+
 EAPI=8
 
 inherit flag-o-matic linux-info pam tmpfiles
@@ -15,7 +16,6 @@ IUSE="activefilter atm pam selinux systemd"
 
 DEPEND="
 	dev-libs/openssl:0=
-
 	virtual/libcrypt:=
 	activefilter? ( net-libs/libpcap )
 	atm? ( net-dialup/linux-atm )
@@ -69,7 +69,7 @@ src_prepare() {
 }
 
 src_configure() {
-	# bug #944065
+	# https://bugs.gentoo.org/943931
 	append-cflags -std=gnu17
 
 	local args=(
author	root <root@alpha.trunkmasters.com>	2026-06-20 14:54:46 -0500
committer	root <root@alpha.trunkmasters.com>	2026-06-20 14:54:46 -0500
commit	1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0 (patch)
tree	18e2e784f9fb0dbc3546537acc42ad51b366d90e /net-dialup
parent	9f6a581d94412ab1cf4b35c33101f6be0ddc7777 (diff)
download	baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.gz baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.tar.xz baldeagleos-repo-1a4479b4e0368c8d5ff241ebad17b2541a7e3ba0.zip