Updating liguros repo

author: Palica <palica+gitlab@liguros.net> 2020-06-23 22:35:08 +0200
committer: Palica <palica+gitlab@liguros.net> 2020-06-23 22:35:08 +0200
commit: ecdac123787b96ce6649f0f91da12ea6458cc2b1 (patch)
tree: b89c74d9e6fe6e8aebc4c77bcbeb4ab73214127d /sys-auth
parent: 1be72aa41cf41dedadeecf59dca9f01de6381f5e (diff)
download: baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.tar.gz
baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.tar.xz
baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.zip
330 files changed, 15495 insertions, 0 deletions
diff --git a/sys-auth/AusweisApp2/AusweisApp2-1.20.0.ebuild b/sys-auth/AusweisApp2/AusweisApp2-1.20.0.ebuild
new file mode 100644
index 000000000000..4cc7a6c7a052
--- /dev/null
+++ b/sys-auth/AusweisApp2/AusweisApp2-1.20.0.ebuild
@@ -0,0 +1,40 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit cmake
+
+DESCRIPTION="Official authentication app for German ID cards and residence permits"
+HOMEPAGE="https://www.ausweisapp.bund.de/"
+SRC_URI="https://github.com/Governikus/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="EUPL-1.2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+
+BDEPEND="
+	dev-qt/linguist-tools:5
+	virtual/pkgconfig"
+
+RDEPEND="
+	dev-libs/openssl:0=
+	dev-qt/qtconcurrent:5
+	dev-qt/qtcore:5
+	dev-qt/qtdeclarative:5
+	dev-qt/qtgui:5
+	dev-qt/qtnetwork:5
+	dev-qt/qtquickcontrols2:5
+	dev-qt/qtsvg:5
+	dev-qt/qtwebsockets:5[qml]
+	dev-qt/qtwidgets:5
+	net-libs/http-parser:0=
+	sys-apps/pcsc-lite
+	virtual/udev"
+
+DEPEND="${RDEPEND}"
+
+src_configure() {
+	local mycmakeargs=( -DBUILD_SHARED_LIBS=OFF )
+	cmake_src_configure
+}
diff --git a/sys-auth/AusweisApp2/AusweisApp2-9999.ebuild b/sys-auth/AusweisApp2/AusweisApp2-9999.ebuild
new file mode 100644
index 000000000000..a4ae965bed85
--- /dev/null
+++ b/sys-auth/AusweisApp2/AusweisApp2-9999.ebuild
@@ -0,0 +1,39 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit cmake git-r3
+
+DESCRIPTION="Official authentication app for German ID cards and residence permits"
+HOMEPAGE="https://www.ausweisapp.bund.de/"
+EGIT_REPO_URI="https://github.com/Governikus/AusweisApp2.git"
+
+LICENSE="EUPL-1.2"
+SLOT="0"
+
+BDEPEND="
+	dev-qt/linguist-tools:5
+	virtual/pkgconfig"
+
+RDEPEND="
+	dev-libs/openssl:0=
+	dev-qt/qtconcurrent:5
+	dev-qt/qtcore:5
+	dev-qt/qtdeclarative:5
+	dev-qt/qtgui:5
+	dev-qt/qtnetwork:5
+	dev-qt/qtquickcontrols2:5
+	dev-qt/qtsvg:5
+	dev-qt/qtwebsockets:5[qml]
+	dev-qt/qtwidgets:5
+	net-libs/http-parser:0=
+	sys-apps/pcsc-lite
+	virtual/udev"
+
+DEPEND="${RDEPEND}"
+
+src_configure() {
+	local mycmakeargs=( -DBUILD_SHARED_LIBS=OFF )
+	cmake_src_configure
+}
diff --git a/sys-auth/AusweisApp2/Manifest b/sys-auth/AusweisApp2/Manifest
new file mode 100644
index 000000000000..6a730bf1ac79
--- /dev/null
+++ b/sys-auth/AusweisApp2/Manifest
@@ -0,0 +1 @@
+DIST AusweisApp2-1.20.0.tar.gz 9727544 BLAKE2B 23d31b5cff2756948d563052ff53fffb737c6895fddada036969350b0a65f404f8def70f8ac4409a34fe9f83160e15cd8d4b6441f901f8e53e791ca386140383 SHA512 9222bc59521aa3533c79206df14b079e618f6efbdd04c11b4cc754027dc155d2ad4a321cabdbb35b9308f5e9631ca05e828969633125fe0ac651156669a784d0
diff --git a/sys-auth/AusweisApp2/metadata.xml b/sys-auth/AusweisApp2/metadata.xml
new file mode 100644
index 000000000000..b9b7b39c4896
--- /dev/null
+++ b/sys-auth/AusweisApp2/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>gentoo@pogatzki.net</email>
+		<name>Volkmar W. Pogatzki</name>
+	</maintainer>
+	<maintainer type="project">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>conikost@gentoo.org</email>
+		<name>Conrad Kostecki</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">Governikus/AusweisApp2</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/authenticator/Manifest b/sys-auth/authenticator/Manifest
new file mode 100644
index 000000000000..c7653aef7117
--- /dev/null
+++ b/sys-auth/authenticator/Manifest
@@ -0,0 +1 @@
+DIST authenticator-0.2.4.tar.gz 142444 BLAKE2B 2df1462452d5aaead51af111359120c8a464058730129fd984dd568c709c58f6940a34b996d3b5435b78bd87b433a29735d3fd8e9629b512915720063b49b1a1 SHA512 16b942d24a1136350f78de92a287dcc6b52e9347cd0b73e8310b87c6c24b7075aebe909fe20d80532f7fa1b54d332b8b62fd2fc7d26ce15888fd47bb686520e2
diff --git a/sys-auth/authenticator/authenticator-0.2.4-r1.ebuild b/sys-auth/authenticator/authenticator-0.2.4-r1.ebuild
new file mode 100644
index 000000000000..8926a63fc2d8
--- /dev/null
+++ b/sys-auth/authenticator/authenticator-0.2.4-r1.ebuild
@@ -0,0 +1,73 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python3_{6,7} )
+inherit gnome2-utils meson python-single-r1 virtualx xdg-utils
+
+DESCRIPTION="Two-factor authentication code generator for GNOME"
+HOMEPAGE="https://gitlab.gnome.org/World/Authenticator"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SRC_URI=""
+	EGIT_REPO_URI="https://gitlab.gnome.org/World/Authenticator"
+else
+	SRC_URI="https://gitlab.gnome.org/World/Authenticator/-/archive/${PV}/Authenticator-${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/Authenticator-${PV}"
+	KEYWORDS="~amd64 ~x86"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+IUSE="test"
+RESTRICT="!test? ( test )"
+RDEPEND="
+	${PYTHON_DEPS}
+	app-crypt/libsecret
+	$(python_gen_cond_dep '
+		dev-python/pillow[${PYTHON_MULTI_USEDEP}]
+		dev-python/pygobject:3[${PYTHON_MULTI_USEDEP}]
+		dev-python/pyotp[${PYTHON_MULTI_USEDEP}]
+		dev-python/python-gnupg[${PYTHON_MULTI_USEDEP}]
+		dev-python/pyzbar[${PYTHON_MULTI_USEDEP}]
+	')
+	media-libs/gd
+	x11-libs/gtk+:3
+"
+DEPEND="${RDEPEND}
+	test? ( x11-apps/xhost )"
+PATCHES=(
+	"${FILESDIR}/${P}-disable-failing-tests.patch"
+	"${FILESDIR}/${P}-support-use-of-gdlib-from-system.patch"
+)
+
+src_prepare() {
+	default
+
+	sed -i -e "1s:#!/usr/bin/env python3:#!${PYTHON}:" "authenticator.py.in" || die "Could not fix shebang."
+
+	rm -r "subprojects/libgd" || die "Could not remove the subproject libgd folder."
+}
+
+pkg_preinst() {
+	gnome2_icon_savelist
+	gnome2_schemas_savelist
+}
+
+src_test() {
+	xdg_environment_reset
+	virtx meson_src_test
+}
+
+pkg_postinst() {
+	gnome2_icon_cache_update
+	gnome2_schemas_update
+}
+
+pkg_postrm() {
+	gnome2_icon_cache_update
+	gnome2_schemas_update
+}
diff --git a/sys-auth/authenticator/authenticator-9999.ebuild b/sys-auth/authenticator/authenticator-9999.ebuild
new file mode 100644
index 000000000000..2d9e3b62d7b4
--- /dev/null
+++ b/sys-auth/authenticator/authenticator-9999.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python3_{6,7} )
+inherit gnome2-utils meson python-single-r1 virtualx xdg-utils
+
+DESCRIPTION="Two-factor authentication code generator for GNOME"
+HOMEPAGE="https://gitlab.gnome.org/World/Authenticator"
+
+if [[ ${PV} == *9999 ]]; then
+	inherit git-r3
+	SRC_URI=""
+	EGIT_REPO_URI="https://gitlab.gnome.org/World/Authenticator"
+else
+	SRC_URI="https://gitlab.gnome.org/World/Authenticator/-/archive/${PV}/Authenticator-${PV}.tar.gz -> ${P}.tar.gz"
+	S="${WORKDIR}/Authenticator-${PV}"
+	KEYWORDS="~amd64 ~x86"
+fi
+
+LICENSE="GPL-2+"
+SLOT="0"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+IUSE="test"
+RESTRICT="!test? ( test )"
+RDEPEND="
+	${PYTHON_DEPS}
+	app-crypt/libsecret
+	$(python_gen_cond_dep '
+		dev-python/pillow[${PYTHON_MULTI_USEDEP}]
+		dev-python/pygobject:3[${PYTHON_MULTI_USEDEP}]
+		dev-python/pyotp[${PYTHON_MULTI_USEDEP}]
+		dev-python/python-gnupg[${PYTHON_MULTI_USEDEP}]
+		dev-python/pyzbar[${PYTHON_MULTI_USEDEP}]
+	')
+	media-libs/gd
+	x11-libs/gtk+:3
+"
+DEPEND="${RDEPEND}
+	test? ( x11-apps/xhost )"
+
+src_prepare() {
+	default
+
+	sed -i -e "1s:#!/usr/bin/env python3:#!${PYTHON}:" "authenticator.py.in" || die "Could not fix shebang."
+
+	rm -r "subprojects/libgd" || die "Could not remove the subproject libgd folder."
+}
+
+pkg_preinst() {
+	gnome2_icon_savelist
+	gnome2_schemas_savelist
+}
+
+src_test() {
+	xdg_environment_reset
+	virtx meson_src_test
+}
+
+pkg_postinst() {
+	gnome2_icon_cache_update
+	gnome2_schemas_update
+}
+
+pkg_postrm() {
+	gnome2_icon_cache_update
+	gnome2_schemas_update
+}
diff --git a/sys-auth/authenticator/files/authenticator-0.2.4-disable-failing-tests.patch b/sys-auth/authenticator/files/authenticator-0.2.4-disable-failing-tests.patch
new file mode 100644
index 000000000000..38b4b95464ad
--- /dev/null
+++ b/sys-auth/authenticator/files/authenticator-0.2.4-disable-failing-tests.patch
@@ -0,0 +1,16 @@
+diff --git a/data/meson.build b/data/meson.build
+index b646c11..884c5d0 100644
+--- a/data/meson.build
++++ b/data/meson.build
+@@ -50,10 +50,3 @@ endif
+ 
+ appstreamcli = find_program('appstream-util', required:false)
+ 
+-if appstreamcli.found()
+-  test (
+-    'Validate appdata file',
+-    appstreamcli,
+-    args: ['validate-relax', join_paths(meson.current_build_dir (), meson.project_name() + '.appdata.xml')]
+-  )
+-endif
+
diff --git a/sys-auth/authenticator/files/authenticator-0.2.4-support-use-of-gdlib-from-system.patch b/sys-auth/authenticator/files/authenticator-0.2.4-support-use-of-gdlib-from-system.patch
new file mode 100644
index 000000000000..ffbde3cf2f09
--- /dev/null
+++ b/sys-auth/authenticator/files/authenticator-0.2.4-support-use-of-gdlib-from-system.patch
@@ -0,0 +1,23 @@
+diff --git a/meson.build b/meson.build
+index ed9c48e..6b20bf0 100644
+--- a/meson.build
++++ b/meson.build
+@@ -35,16 +35,7 @@ SERVICES_DIR = join_paths(get_option('datadir'), 'dbus-1', 'services')
+ SEARCH_PROVIDER_DIR = join_paths(get_option('datadir'), 'gnome-shell', 'search-providers')
+ LIBEXEC_DIR = join_paths(get_option('prefix'), get_option('libexecdir'))
+ 
+-subproject('libgd',
+-  default_options: [
+-    'with-introspection=true',
+-    'with-notification=true',
+-    'static=false',
+-    'pkgdatadir=' + DATA_DIR,
+-    'pkglibdir=' + LIB_DIR
+-  ]
+-)
+-
++libgd_dep = dependency('gdlib', required : true)
+ 
+ 
+ # Configuration params
+
diff --git a/sys-auth/authenticator/metadata.xml b/sys-auth/authenticator/metadata.xml
new file mode 100644
index 000000000000..8bcd638e6df6
--- /dev/null
+++ b/sys-auth/authenticator/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<maintainer>
+			<name>Bilal Elmoussaoui</name>
+		</maintainer>
+		<bugs-to>https://gitlab.gnome.org/World/Authenticator/issues</bugs-to>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
+
diff --git a/sys-auth/consolekit/Manifest b/sys-auth/consolekit/Manifest
new file mode 100644
index 000000000000..06205e253cd9
--- /dev/null
+++ b/sys-auth/consolekit/Manifest
@@ -0,0 +1,6 @@
+DIST ConsoleKit-0.4.6.tar.xz 366572 BLAKE2B ab4c277fd47b8f99ce8c5a67de86e89b1bdd8d6a5a8682dd436feefec76f7902e71c05d9d22d52c297d3294a945f057d53f18c9c9b7d29c84aa7c26665b05fee SHA512 54955e3e83778a9216846104da8762fd50a37190e209127dd5d211e2227da617e14f6f5c1359905396d299656e526d14e1187b28eaff7d0ae1d7563dc8d9b46d
+DIST ConsoleKit2-1.1.0.tar.bz2 630178 BLAKE2B 20d1994a19fbe03d411ac5437f77b75571fbdc19478100676e51e2a1232c643f4b0c86125b5bf1d42aeb5cfb7c8b34601221d674ac27d9bf3112fcd8a83afacb SHA512 14ded07d4140e7a31132de21e84c2878475676b8c98f72b42340708972ed384abb9ba9380d74719718fc220c001387c788cf709cd15f8b19d598467dfe8a57df
+DIST ConsoleKit2-1.1.2.tar.bz2 1125567 BLAKE2B 1b7c60d224ea4197687c566d324a302aa2f5ed92ed0cfc563ba4d42f78af2999d1693e4587208e5412d042fb0cff99919dfa02ca5b5a43bda3310c17b39ca5d6 SHA512 fadca85e05c176b06ead40fba5c068d497bf69bcc322287363d0c27cdd6627b758295db1ef534b908c0e6240486430d8cb36660b4d71216a60d19a52d6d0db39
+DIST ConsoleKit2-1.2.0.tar.bz2 1125402 BLAKE2B c2119287ff173783c377a1353f8ce59432f8aa3e64f654716c895fadb5d07462069e457aae7925a6c44bc48bfd4147fc10e9f488a39714386fb6c14bced09f36 SHA512 c0f6e629b7229c2ffaafe8da899970b48c8372402447af18560fffd8804d9ab91a4ad2eb82c8f648a14807f8ccc5fb1ab4366de14faa8a2d5fb3767a6a4253f7
+DIST ConsoleKit2-1.2.1.tar.bz2 1182946 BLAKE2B f76f99008c78bd3a318c918776129072944e4c3ac18348960e3a725179d3ce4dc2cfb4d04ec5c143bb998f23f63cf36c0f88d8296dc3d0a382a138f3a0a2fecc SHA512 31befe89f7fa604138bfb0722fc6cf12f0934bac004f98fc331004eb5a7f466ed7bd0dc9adc9869da739974208f9a3bc125068ff8a60d4b2badb58ef70a3eb10
+DIST consolekit_0.4.6-4.debian.tar.gz 12192 BLAKE2B e88ed907ea3ceecb9ac399618614b1aa5d7eb2c46a706451d78e4ec1598dee5a02d6c5a1b0dd678f6bed4c25277884ec6969a23f8181ef3d8ede94452b6570db SHA512 f7fc5965b1f495d16a8ca167940431bc2569e9bde9e4a356b9c9ed00c2825db61da7b6db3d434d977fff72b3aaef30c455a365b9eba282a887a523753613b58f
diff --git a/sys-auth/consolekit/consolekit-0.4.6.ebuild b/sys-auth/consolekit/consolekit-0.4.6.ebuild
new file mode 100644
index 000000000000..e190382dadf5
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-0.4.6.ebuild
@@ -0,0 +1,125 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit autotools eutils linux-info ltprune pam systemd
+
+MY_PN=ConsoleKit
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/ConsoleKit"
+SRC_URI="https://www.freedesktop.org/software/${MY_PN}/dist/${MY_P}.tar.xz
+	https://launchpad.net/debian/+archive/primary/+files/${PN}_${PV}-4.debian.tar.gz" # for logrotate file
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="acl debug doc kernel_linux pam policykit selinux systemd-units test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/dbus-glib-0.100:=
+	>=dev-libs/glib-2.38.2-r1:2=
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )"
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+S=${WORKDIR}/${MY_P}
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	epatch \
+		"${FILESDIR}"/${PN}-cleanup_console_tags.patch \
+		"${FILESDIR}"/${PN}-shutdown-reboot-without-policies.patch \
+		"${FILESDIR}"/${PN}-udev-acl-install_to_usr.patch \
+		"${FILESDIR}"/${PN}-0.4.5-polkit-automagic.patch
+
+	if ! use systemd-units; then
+		sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+	fi
+
+	eautoreconf
+}
+
+src_configure() {
+	local myconf
+	if use systemd-units; then
+		myconf="$(systemd_with_unitdir)"
+	else
+		myconf="--with-systemdsystemunitdir=/tmp"
+	fi
+
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/${MY_PN} \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable acl udev-acl) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		${myconf}
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/${MY_PN} /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-0.2.rc consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	exeinto /usr/lib/ConsoleKit/run-session.d
+	doexe "${FILESDIR}"/pam-foreground-compat.ck
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	use systemd-units || rm -rf "${ED}"/tmp
+
+	rm -rf "${ED}"/var/run # let the init script create the directory
+
+	insinto /etc/logrotate.d
+	newins "${WORKDIR}"/debian/${PN}.logrotate ${PN} #374513
+}
diff --git a/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild b/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild
new file mode 100644
index 000000000000..6cfe969c7952
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild
@@ -0,0 +1,120 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit libtool linux-info ltprune pam
+
+MY_PN=ConsoleKit2
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
+SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="acl cgroups debug doc kernel_linux pam pm-utils policykit selinux test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
+	>=sys-devel/gettext-0.19
+	sys-apps/dbus
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	cgroups? (
+		app-admin/cgmanager
+		>=sys-libs/libnih-1.0.2[dbus]
+		)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )"
+# pm-utils: bug 557432
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	pm-utils? ( sys-power/pm-utils )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+S=${WORKDIR}/${MY_P}
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+PATCHES=( "${FILESDIR}/${P}-Remove-the-root-restriction-for-runtime-dirs.patch" )
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+
+	default
+	elibtoolize # bug 593314
+}
+
+src_configure() {
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable acl udev-acl) \
+		$(use_enable cgroups) \
+		$(use_enable test tests) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
+		--without-systemdsystemunitdir
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	if use kernel_linux; then
+		# bug 571524
+		exeinto /usr/lib/ConsoleKit/run-session.d
+		doexe "${FILESDIR}"/pam-foreground-compat.ck
+	fi
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	rm -rf "${ED}"/var/run || die # let the init script create the directory
+}
diff --git a/sys-auth/consolekit/consolekit-1.1.2.ebuild b/sys-auth/consolekit/consolekit-1.1.2.ebuild
new file mode 100644
index 000000000000..9eb051c9c376
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-1.1.2.ebuild
@@ -0,0 +1,131 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools libtool linux-info ltprune pam xdg-utils
+
+MY_PN=ConsoleKit2
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
+SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
+	>=sys-devel/gettext-0.19
+	sys-apps/dbus
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	cgroups? (
+		app-admin/cgmanager
+		>=sys-libs/libnih-1.0.2[dbus]
+		)
+	evdev? ( dev-libs/libevdev:= )
+	udev? (
+		virtual/libudev
+		x11-libs/libdrm:=
+	)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )
+	selinux? ( sys-libs/libselinux )"
+# pm-utils: bug 557432
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	pm-utils? ( sys-power/pm-utils )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+S=${WORKDIR}/${MY_P}
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	xdg_environment_reset
+
+	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+
+	default
+	# patch needs autoreconf, so dont need libtoolize
+	eautoreconf
+	#elibtoolize # bug 593314
+}
+
+src_configure() {
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable evdev libevdev) \
+		$(use_enable acl udev-acl) \
+		$(use_enable cgroups libcgmanager) \
+		$(use_enable selinux libselinux) \
+		$(use_enable udev libudev) \
+		$(use_enable test tests) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
+		--without-systemdsystemunitdir
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	if use kernel_linux; then
+		# bug 571524
+		exeinto /usr/lib/ConsoleKit/run-session.d
+		doexe "${FILESDIR}"/pam-foreground-compat.ck
+	fi
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	rm -rf "${ED}"/var/run || die # let the init script create the directory
+}
diff --git a/sys-auth/consolekit/consolekit-1.2.0.ebuild b/sys-auth/consolekit/consolekit-1.2.0.ebuild
new file mode 100644
index 000000000000..853ffde35398
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-1.2.0.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools libtool linux-info ltprune pam xdg-utils
+
+MY_PN=ConsoleKit2
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
+SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 s390 ~sparc x86 ~amd64-linux ~x86-linux"
+IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
+	>=sys-devel/gettext-0.19
+	sys-apps/dbus
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	cgroups? (
+		app-admin/cgmanager
+		>=sys-libs/libnih-1.0.2[dbus]
+		)
+	evdev? ( dev-libs/libevdev:= )
+	udev? (
+		virtual/libudev
+		x11-libs/libdrm:=
+	)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )
+	selinux? ( sys-libs/libselinux )"
+# pm-utils: bug 557432
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	pm-utils? ( sys-power/pm-utils )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+S=${WORKDIR}/${MY_P}
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	xdg_environment_reset
+
+	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+
+	default
+	# patch needs autoreconf, so dont need libtoolize
+	eautoreconf
+	#elibtoolize # bug 593314
+}
+
+src_configure() {
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable evdev libevdev) \
+		$(use_enable acl udev-acl) \
+		$(use_enable cgroups libcgmanager) \
+		$(use_enable selinux libselinux) \
+		$(use_enable udev libdrm) \
+		$(use_enable udev libudev) \
+		$(use_enable test tests) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
+		--without-systemdsystemunitdir
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	if use kernel_linux; then
+		# bug 571524
+		exeinto /usr/lib/ConsoleKit/run-session.d
+		doexe "${FILESDIR}"/pam-foreground-compat.ck
+	fi
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	rm -rf "${ED}"/var/run || die # let the init script create the directory
+}
diff --git a/sys-auth/consolekit/consolekit-1.2.1.ebuild b/sys-auth/consolekit/consolekit-1.2.1.ebuild
new file mode 100644
index 000000000000..cc3e4dc331d9
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-1.2.1.ebuild
@@ -0,0 +1,132 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools libtool linux-info ltprune pam xdg-utils
+
+MY_PN=ConsoleKit2
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
+SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
+	>=sys-devel/gettext-0.19
+	sys-apps/dbus
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	cgroups? (
+		app-admin/cgmanager
+		>=sys-libs/libnih-1.0.2[dbus]
+		)
+	evdev? ( dev-libs/libevdev:= )
+	udev? (
+		virtual/libudev
+		x11-libs/libdrm:=
+	)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )
+	selinux? ( sys-libs/libselinux )"
+# pm-utils: bug 557432
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	pm-utils? ( sys-power/pm-utils )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+S=${WORKDIR}/${MY_P}
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	xdg_environment_reset
+
+	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+
+	default
+	# patch needs autoreconf, so dont need libtoolize
+	eautoreconf
+	#elibtoolize # bug 593314
+}
+
+src_configure() {
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable evdev libevdev) \
+		$(use_enable acl udev-acl) \
+		$(use_enable cgroups libcgmanager) \
+		$(use_enable selinux libselinux) \
+		$(use_enable udev libdrm) \
+		$(use_enable udev libudev) \
+		$(use_enable test tests) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
+		--without-systemdsystemunitdir
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	if use kernel_linux; then
+		# bug 571524
+		exeinto /usr/lib/ConsoleKit/run-session.d
+		doexe "${FILESDIR}"/pam-foreground-compat.ck
+	fi
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	rm -rf "${ED}"/var/run || die # let the init script create the directory
+}
diff --git a/sys-auth/consolekit/consolekit-9999.ebuild b/sys-auth/consolekit/consolekit-9999.ebuild
new file mode 100644
index 000000000000..cec91280e66d
--- /dev/null
+++ b/sys-auth/consolekit/consolekit-9999.ebuild
@@ -0,0 +1,128 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools libtool git-r3 linux-info ltprune pam xdg-utils
+
+MY_PN=ConsoleKit2
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
+HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
+EGIT_REPO_URI="https://github.com/${MY_PN}/${MY_PN}.git"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS=""
+IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
+	>=sys-devel/gettext-0.19
+	sys-apps/dbus
+	sys-libs/zlib:=
+	x11-libs/libX11:=
+	acl? (
+		sys-apps/acl:=
+		>=virtual/udev-200
+		)
+	cgroups? (
+		app-admin/cgmanager
+		>=sys-libs/libnih-1.0.2[dbus]
+		)
+	evdev? ( dev-libs/libevdev:= )
+	udev? (
+		virtual/libudev
+		x11-libs/libdrm:=
+	)
+	pam? ( sys-libs/pam )
+	policykit? ( >=sys-auth/polkit-0.110 )
+	selinux? ( sys-libs/libselinux )"
+# pm-utils: bug 557432
+RDEPEND="${COMMON_DEPEND}
+	kernel_linux? ( sys-apps/coreutils[acl?] )
+	pm-utils? ( sys-power/pm-utils )
+	selinux? ( sec-policy/selinux-consolekit )"
+DEPEND="${COMMON_DEPEND}
+	dev-libs/libxslt
+	virtual/pkgconfig
+	doc? ( app-text/xmlto )
+	test? (
+		app-text/docbook-xml-dtd:4.1.2
+		app-text/xmlto
+		)"
+
+QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
+
+pkg_setup() {
+	if use kernel_linux; then
+		# This is from https://bugs.gentoo.org/376939
+		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
+		# This is required to get login-session-id string with pam_ck_connector.so
+		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
+		linux-info_pkg_setup
+	fi
+}
+
+src_prepare() {
+	xdg_environment_reset
+
+	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
+
+	default
+	eautoreconf
+	#elibtoolize # bug 593314
+}
+
+src_configure() {
+	econf \
+		XMLTO_FLAGS='--skip-validation' \
+		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
+		--localstatedir="${EPREFIX}"/var \
+		$(use_enable pam pam-module) \
+		$(use_enable doc docbook-docs) \
+		$(use_enable test docbook-docs) \
+		$(use_enable debug) \
+		$(use_enable policykit polkit) \
+		$(use_enable evdev libevdev) \
+		$(use_enable acl udev-acl) \
+		$(use_enable cgroups libcgmanager) \
+		$(use_enable selinux libselinux) \
+		$(use_enable udev libudev) \
+		$(use_enable test tests) \
+		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
+		--with-pam-module-dir="$(getpam_mod_dir)" \
+		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
+		--without-systemdsystemunitdir
+}
+
+src_install() {
+	emake \
+		DESTDIR="${D}" \
+		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
+		install
+
+	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
+
+	dodoc AUTHORS HACKING NEWS README TODO
+
+	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
+
+	keepdir /usr/lib/ConsoleKit/run-seat.d
+	keepdir /usr/lib/ConsoleKit/run-session.d
+	keepdir /etc/ConsoleKit/run-session.d
+	keepdir /var/log/ConsoleKit
+
+	exeinto /etc/X11/xinit/xinitrc.d
+	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
+
+	if use kernel_linux; then
+		# bug 571524
+		exeinto /usr/lib/ConsoleKit/run-session.d
+		doexe "${FILESDIR}"/pam-foreground-compat.ck
+	fi
+
+	prune_libtool_files --all # --all for pam_ck_connector.la
+
+	rm -rf "${ED}"/var/run || die # let the init script create the directory
+}
diff --git a/sys-auth/consolekit/files/90-consolekit-3 b/sys-auth/consolekit/files/90-consolekit-3
new file mode 100644
index 000000000000..358fc24f1a72
--- /dev/null
+++ b/sys-auth/consolekit/files/90-consolekit-3
@@ -0,0 +1,32 @@
+# -*- sh -*-
+# Xsession.d script for ck-launch-session.
+#
+#
+# This file is sourced by Xsession(5), not executed.
+
+CK_LAUNCH_SESSION=/usr/bin/ck-launch-session
+
+is_on_console() {
+	session=$(dbus-send --system --dest=org.freedesktop.ConsoleKit \
+		--type=method_call --print-reply --reply-timeout=2000 \
+		/org/freedesktop/ConsoleKit/Manager \
+		org.freedesktop.ConsoleKit.Manager.GetCurrentSession \
+		| grep path | awk '{print $3}' | sed s/\"//g)
+	x11_display=$(dbus-send --system --dest=org.freedesktop.ConsoleKit \
+		--type=method_call --print-reply --reply-timeout=2000 \
+		$session org.freedesktop.ConsoleKit.Session.GetX11Display \
+		| grep string | awk '{print $2}' | sed s/\"//g)
+
+	if [ -z "$x11_display" ] ; then
+		return 0
+	else
+		return 1
+	fi
+}
+
+# gdm already creates a CK session for us, so do not run the expensive D-Bus
+# calls if we have $GDMSESSION
+if [ -z "$GDMSESSION" ] && [ -x "$CK_LAUNCH_SESSION" ] && \
+ ( [ -z "$XDG_SESSION_COOKIE" ] || is_on_console ) ; then
+    command="$CK_LAUNCH_SESSION $command"
+fi
diff --git a/sys-auth/consolekit/files/consolekit-0.2.rc b/sys-auth/consolekit/files/consolekit-0.2.rc
new file mode 100644
index 000000000000..e2be0de6e1aa
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-0.2.rc
@@ -0,0 +1,25 @@
+#!/sbin/openrc-run
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License, v2 or later
+
+depend() {
+	need dbus
+	use logger
+}
+
+start() {
+	ebegin "Starting ConsoleKit daemon"
+
+	checkpath -q -d -m 0755 /var/run/ConsoleKit
+
+	start-stop-daemon --start -q \
+		--pidfile /var/run/ConsoleKit/pid \
+		--exec /usr/sbin/console-kit-daemon -- 
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping ConsoleKit daemon"
+	start-stop-daemon --stop -q --pidfile /var/run/ConsoleKit/pid 
+	eend $?
+}
diff --git a/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch b/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch
new file mode 100644
index 000000000000..b896089d4485
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch
@@ -0,0 +1,30 @@
+http://bugs.freedesktop.org/show_bug.cgi?id=47587
+
+--- configure.ac
++++ configure.ac
+@@ -56,10 +56,21 @@
+   gthread-2.0 >= $GLIB_REQUIRED_VERSION
+ )
+ 
+-PKG_CHECK_MODULES(POLKIT,
+-  polkit-gobject-1 >= $POLKIT_REQUIRED_VERSION,
+-  have_polkit=yes,
+-  have_polkit=no)
++AC_ARG_ENABLE([polkit],
++  AC_HELP_STRING([--enable-polkit], [Enable PolicyKit support (default auto)]),
++  enable_polkit=$enableval,
++  enable_polkit=auto)
++
++if test "x$enable_polkit" != "xno"; then
++  PKG_CHECK_MODULES(POLKIT,
++    polkit-gobject-1 >= $POLKIT_REQUIRED_VERSION,
++    have_polkit=yes,
++    have_polkit=no)
++  if test "x$enable_polkit"  = "xyes" -a "x$have_polkit" = "xno"; then
++    AC_MSG_ERROR([PolicyKit support explicitly requested but dependencies not found])
++  fi
++fi
++
+ if test "x$have_polkit" = "xyes" ; then
+        AC_DEFINE(HAVE_POLKIT, [], [Define if we have polkit])
+ fi
diff --git a/sys-auth/consolekit/files/consolekit-1.0.0.initd b/sys-auth/consolekit/files/consolekit-1.0.0.initd
new file mode 100644
index 000000000000..4fd1140fe209
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-1.0.0.initd
@@ -0,0 +1,16 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License, v2 or later
+
+description="consolekit - tracks login sessions and seats"
+pidfile="/run/ConsoleKit/pid"
+command="/usr/sbin/console-kit-daemon"
+
+depend() {
+	need dbus
+	use logger
+}
+
+start_pre() {
+	checkpath -q -d -m 0755 /run/ConsoleKit
+}
diff --git a/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch b/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch
new file mode 100644
index 000000000000..301c68f5d904
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch
@@ -0,0 +1,57 @@
+From 664d2fdbd966764836b1f4da2dbc5750c7f01f0f Mon Sep 17 00:00:00 2001
+From: Eric Koegel <eric.koegel@gmail.com>
+Date: Sun, 10 Apr 2016 11:20:24 +0300
+Subject: [PATCH] Remove the root restriction for runtime dirs
+
+---
+ src/ck-sysdeps-unix.c       |  5 -----
+ tools/ck-remove-directory.c | 10 ----------
+ 2 files changed, 15 deletions(-)
+
+diff --git a/src/ck-sysdeps-unix.c b/src/ck-sysdeps-unix.c
+index 67d8eac..ecd176a 100644
+--- a/src/ck-sysdeps-unix.c
++++ b/src/ck-sysdeps-unix.c
+@@ -409,11 +409,6 @@ ck_generate_runtime_dir_for_user (guint uid)
+ 
+         TRACE ();
+ 
+-        if (uid < 1) {
+-                g_debug ("We do not create runtime dirs for root");
+-                return NULL;
+-        }
+-
+         errno = 0;
+         pwent = getpwuid (uid);
+         if (pwent == NULL) {
+diff --git a/tools/ck-remove-directory.c b/tools/ck-remove-directory.c
+index cf44fd6..b1a5722 100644
+--- a/tools/ck-remove-directory.c
++++ b/tools/ck-remove-directory.c
+@@ -51,11 +51,6 @@ become_user (uid_t uid, const gchar* dest)
+         int            res;
+         struct passwd *pwent;
+ 
+-        if (uid < 1) {
+-                g_critical ("invalid UID");
+-                exit (1);
+-        }
+-
+         if (dest == NULL) {
+                 g_critical ("invalid dest");
+                 exit (1);
+@@ -148,11 +143,6 @@ main (int    argc,
+                 exit (1);
+         }
+ 
+-        if (user_id < 1) {
+-                g_warning ("Invalid UID");
+-                exit (1);
+-        }
+-
+         /* Ensure we have a dest and that it starts with the correct prefix
+          * so we don't remove something important.
+          */
+-- 
+2.7.3
+
diff --git a/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch b/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch
new file mode 100644
index 000000000000..c02411ebded5
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch
@@ -0,0 +1,67 @@
+http://bugs.gentoo.org/257761
+http://patches.ubuntu.com/by-release/extracted/ubuntu/c/consolekit/
+
+--- src/main.c
++++ src/main.c
+@@ -148,6 +148,43 @@
+         unlink (CONSOLE_KIT_PID_FILE);
+ }
+ 
++#define CONSOLE_TAGS_DIR "/var/run/console"
++
++static void
++delete_console_tags (void)
++{
++	GDir *dir;
++	GError *error = NULL;
++	const gchar *name;
++
++	g_debug ("Cleaning up %s", CONSOLE_TAGS_DIR);
++
++	dir = g_dir_open (CONSOLE_TAGS_DIR, 0, &error);
++	if (dir == NULL) {
++		g_debug ("Couldn't open directory %s: %s", CONSOLE_TAGS_DIR,
++		           error->message);
++		g_error_free (error);
++		return;
++	}
++	while ((name = g_dir_read_name (dir)) != NULL) {
++		gchar *file;
++		file = g_build_filename (CONSOLE_TAGS_DIR, name, NULL);
++
++		g_debug ("Removing tag file: %s", file);
++		if (unlink (file) == -1) {
++			g_warning ("Couldn't delete tag file: %s", file);
++		}
++		g_free (file);
++	}
++}
++
++static void
++cleanup (void)
++{
++	delete_console_tags ();
++	delete_pid ();
++}
++
+ /* copied from nautilus */
+ static int debug_log_pipes[2];
+ 
+@@ -228,7 +265,7 @@
+                 snprintf (pid, sizeof (pid), "%lu\n", (long unsigned) getpid ());
+                 written = write (pf, pid, strlen (pid));
+                 close (pf);
+-                g_atexit (delete_pid);
++                g_atexit (cleanup);
+         } else {
+                 g_warning ("Unable to write pid file %s: %s",
+                            CONSOLE_KIT_PID_FILE,
+@@ -317,6 +354,8 @@
+                 goto out;
+         }
+ 
++	delete_console_tags ();
++
+         create_pid_file ();
+ 
+         loop = g_main_loop_new (NULL, FALSE);
diff --git a/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch b/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch
new file mode 100644
index 000000000000..6a46649f7587
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch
@@ -0,0 +1,26 @@
+From: Romain Perier <mrpouet@gentoo.org>
+Date: Sat, 24 Oct 2009 18:43:43 +0200
+Subject: [PATCH] Be able to shutdown or reboot even without polkit or RBAC supports
+
+Ck does NOTHING at the origin if its built without polkit or RBAC supports, except
+display a warning using g_warning() (which does not make sense).
+The trick is to to call do_stop()/do_restart() in the #else directive :)
+
+--- src/ck-manager.c
++++ src/ck-manager.c
+@@ -1131,6 +1131,7 @@
+         check_rbac_permissions (manager, context, RBAC_SHUTDOWN_KEY, do_restart);
+ #else
+         g_warning ("Compiled without PolicyKit or RBAC support!");
++        do_restart(manager, context);
+ #endif
+ 
+         return TRUE;
+@@ -1207,6 +1208,7 @@
+         check_rbac_permissions (manager, context, RBAC_SHUTDOWN_KEY, do_stop);
+ #else
+         g_warning ("Compiled without PolicyKit or RBAC support!");
++        do_stop(manager, context);
+ #endif
+ 
+         return TRUE;
diff --git a/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch b/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch
new file mode 100644
index 000000000000..3ef39873dbd6
--- /dev/null
+++ b/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch
@@ -0,0 +1,28 @@
+http://bugs.gentoo.org/398049
+
+--- tools/Makefile.am
++++ tools/Makefile.am
+@@ -144,11 +144,10 @@
+ 	$(NULL)
+ 
+ if ENABLE_UDEV_ACL
+-udevdir = $(UDEVDIR)
+ udevrulesdir = $(UDEVDIR)/rules.d
+ 
+ dist_udevrules_DATA = 70-udev-acl.rules
+-udev_PROGRAMS = udev-acl
++libexec_PROGRAMS = udev-acl
+ 
+ udev_acl_SOURCES = udev-acl.c
+ udev_acl_LDADD = $(UDEV_ACL_LIBS)
+@@ -156,7 +155,9 @@
+ 
+ install-exec-hook:
+ 	mkdir -p $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d
+-	ln -sf $(UDEVDIR)/udev-acl $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d/udev-acl.ck
++	mkdir -p $(DESTDIR)$(UDEVDIR)
++	ln -sf $(libexecdir)/udev-acl $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d/udev-acl.ck
++	ln -sf $(libexecdir)/udev-acl $(DESTDIR)$(UDEVDIR)/udev-acl
+ endif
+ 
+ EXTRA_DIST =				\
diff --git a/sys-auth/consolekit/files/pam-foreground-compat.ck b/sys-auth/consolekit/files/pam-foreground-compat.ck
new file mode 100644
index 000000000000..0697ca81ba45
--- /dev/null
+++ b/sys-auth/consolekit/files/pam-foreground-compat.ck
@@ -0,0 +1,17 @@
+#!/bin/sh
+TAGDIR=/var/run/console
+
+[ -n "$CK_SESSION_USER_UID" ] || exit 1
+
+TAGFILE="$TAGDIR/`getent passwd $CK_SESSION_USER_UID | cut -f 1 -d:`"
+
+if [ "$1" = "session_added" ]; then
+	mkdir -p "$TAGDIR"
+	echo "$CK_SESSION_ID" >> "$TAGFILE"
+fi
+
+if [ "$1" = "session_removed" ] && [ -e "$TAGFILE" ]; then
+	sed -i "\%^$CK_SESSION_ID\$%d" "$TAGFILE"
+	[ -s "$TAGFILE" ] || rm -f "$TAGFILE"
+fi
+
diff --git a/sys-auth/consolekit/metadata.xml b/sys-auth/consolekit/metadata.xml
new file mode 100644
index 000000000000..effb0200e483
--- /dev/null
+++ b/sys-auth/consolekit/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>perfinion@gentoo.org</email>
+		<name>Jason Zaman</name>
+	</maintainer>
+	<maintainer type="project">
+		<email>freedesktop-bugs@gentoo.org</email>
+	</maintainer>
+	<use>
+		<flag name="cgroups">Use the kernel to track processes instead of the session cookie.</flag>
+		<flag name="evdev">For handling VT switching with a session controller.</flag>
+		<flag name="pm-utils">Adds support for suspend/resume using <pkg>sys-power/pm-utils</pkg></flag>
+		<flag name="policykit">Use the PolicyKit framework (<pkg>sys-auth/polkit</pkg>) to get authorization for suspend/shutdown.</flag>
+		<flag name="systemd-units">Install systemd unit files to replace the modern functionality of logind in <pkg>sys-apps/systemd</pkg>. Not recommended.</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">ConsoleKit2/ConsoleKit2</remote-id>
+		<remote-id type="launchpad">debian</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/docker_auth/Manifest b/sys-auth/docker_auth/Manifest
new file mode 100644
index 000000000000..80d2485ae756
--- /dev/null
+++ b/sys-auth/docker_auth/Manifest
@@ -0,0 +1,29 @@
+DIST docker_auth-1.3.1.tar.gz 49687 BLAKE2B 7c7c8235ad4eb139d1b964de3583a714040747b0823f33bd529469834c75539c583bdca56b0a6cbabeed4eb3435845f831f10a65ae2ef4a445b7b13d4a16695c SHA512 fe5a37a3975fe33c38db649be0560f87b8c179273bb3d2e044f2df3840e316f8a9f292a94ea601896cbe8c137560200be98628b873a0cd53b2d6b17c5164537d
+DIST docker_auth-1.4.0.tar.gz 54036 BLAKE2B ca7b8c229456bd878579ecf688484c80cc46b06beb95886d8652945742233f3a8214059da2363cf5c03462ee2b49f8c14dfc01a42496b6afed145a12687b9b1e SHA512 f20b3ee907c65053e1e873f96fd7ffdca09b43d625a1a429339d9bd20e7cbd662e5b5b1bdb44ca7e072f2b0097abefac4cf5682e71fca9a9ba92ca4ca567c33f
+DIST github.com-GoogleCloudPlatform-gcloud-golang-20d4028b8a750c2aca76bf9fefa8ed2d0109b573.tar.gz 873021 BLAKE2B f6bd3a08081b7ddd9c61884ba3157654139c70982ffa7245ed988bb1f0fd80af98ccac556168e90ea871ccc0909d03e7f1ee7bcf7cbf2160bbf764e412d123ad SHA512 e98f269d70927bb59fee31059e2d24a5ba71837adbf1f6619b1d9df0a3ec11ef58a2bdf46de6dc45f9ee0a3985c37bc05004beac34b94bc790093aa1550c939a
+DIST github.com-cesanta-glog-22eb27a0ae192b290b25537b8e876556fc25129c.tar.gz 20273 BLAKE2B 982093a19a04611d3e1e9c06dd499fd7eb4730c49057e2c86042acecbf7f1920b6dd83133eb0ae07938ab995cbf809aa7d2236c67a805e3f16ff2c2535e2f66b SHA512 3c4b757fc0d0e45382b1ef0180eea2f0429e8c7ecac0089fca79bc717f6c0a04918b91a144ca78331178cc914b808b40596c6a6e214157d2f812858be31c13d6
+DIST github.com-dchest-uniuri-8902c56451e9b58ff940bbe5fec35d5f9c04584a.tar.gz 2471 BLAKE2B 9cc560893309347a9f012cdb32009bc7201511fa337339c8ced7c671e4b43100e36370dc71c47001e33e411b7707c30787a36e953fa5d15990a1f0edf38accc2 SHA512 70421b526e3040a49e63be6c892de2953b4f9ecdb01b148eb2bab3814f610a8c39bd98aad858cbaf9dcf621b52ee9ef952f0cdcdc6eca77da8ebf80dbbf1c04c
+DIST github.com-deckarep-golang-set-fc8930a5e645572ee00bf66358ed3414f3c13b90.tar.gz 11814 BLAKE2B b97651cfdd0b1c3f8ab10acabf4e7fdebee1955b8661e006e07c612dc1fd8026aa66c9bdf6d6a955bb459eb3e8668d4990e322245daf83dbd5474a4d160ff9ee SHA512 4ac5a5a8985e7bda13d272854f68ad41feb435ab2fb835ca47a63db49211311f502273355f2d9e0c4bd264d8cd6438d077f0eae7b0c6aecadde93c766bd69513
+DIST github.com-docker-distribution-0700fa570d7bcc1b3e46ee127c4489fd25f4daa3.tar.gz 1609656 BLAKE2B e0f795b2fb98cabe1b66209631536a8ff4c0104102dd9adb345a77fa67a7176f8de751a392665233d26c68b16ccff8553b03c9ca02e6c826477f6f5e604a9d4a SHA512 b155225d711c5bdca3246ad2a5cfd41a3cee9144cd30d90dde0407d3cc8c1aa20e6957016959424bd55e21b2a9332629a62294d09799ccb2626eb5136455e1b8
+DIST github.com-docker-libtrust-aabc10ec26b754e797f9028f4589c5b7bd90dc20.tar.gz 39352 BLAKE2B 53b93dacca792288423eda450d1b8dc898722d51e68ebfe111f7faad7a756da33f306e1838b74e1f56c40d6b2070721904ae3d51d2890daa76fce48a1cce3e22 SHA512 31d5a613807764c03d3356ee134bf384eca7953d4113e35d8fcce322611c25b444dd07904eb34c86c7e951529040c33fa821a56a687260e9298f900c7907e83b
+DIST github.com-facebookgo-clock-600d898af40aa09a7a93ecb9265d87b0504b6f03.tar.gz 6382 BLAKE2B 82a2c25a8608ffffd0540808f67536ff34f50f47a88262da72b3a6491231b987e9310c881fa431dd94fdaa94ee13f92f5b9ecc552f53ed4a2b678beda53d1d79 SHA512 023741d93573d53471d1ec10a47c2a0034ecd0e0db35440b50bc7085ddd94e9cd5d0388586a25b060b50a1b9e442d4974a931b3f5d14aa1710629f19ad4acf8f
+DIST github.com-facebookgo-httpdown-a3b1354551a26449fbe05f5d855937f6e7acbd71.tar.gz 9729 BLAKE2B a7698605af2d09d1d0a5cbecc2aaca826c822bcf9d48708b41a158f34248075b0270b2b368b24f26a9807eaaa4f9e80355f4f84aab4bdc4982a128b0652badd9 SHA512 1958e337e1fd896227dd4a2eb551ffe92ffe12a25acdc422ad14c6234eb5e080a6f537f73175c2246768978803edf5fd9425925880546746e996e51a232bc7bd
+DIST github.com-facebookgo-stats-1b76add642e42c6ffba7211ad7b3939ce654526e.tar.gz 5658 BLAKE2B 9f908cdb40ae3bba46ab89d559063a74c7eae698374ed82d840674a40c5a0bd7592c3431597ae67f2e6b6af54ced4ab5d57dbe0c37b06791a2d23a7e2a62ad67 SHA512 12a0b172c956592c7ea1db3a8a0bda5ba80b215d938ecee1c0fa492bd04f3f896efeadeac192c5d1d57031e10d5c95578e441cbba0df080f4c4a1852de7d36fe
+DIST github.com-fsnotify-fsnotify-629574ca2a5df945712d3079857300b5e4da0236.tar.gz 29588 BLAKE2B 618d962d3703c8bc9f94cc11fe97e827b12222c220445797710799b230705df0a708303dcccc9e40a2d851417f29f202a5b80874325c4c69b3ae53e94ffd433b SHA512 eaadede8a6fe231ea1f66755899891e288b5a69c2f74c1f11854b5060f471591f291a5394490a80864fc8d24181ada8a454c9b91ad04988021b5029298dd411b
+DIST github.com-go-asn1-ber-asn1-ber-4e86f4367175e39f69d9358a5f17b4dda270378d.tar.gz 12329 BLAKE2B 2863e7dc689c46de8bedba9216ef9a9489b81d267475891e6113438e17e272b04278d1c8199281af6a9daa9e9eaecbe8cf26f2c8b130906c9c9e62c12eb4b2d4 SHA512 fbba36ee6fd0d33558d4f13b6327a1385bde914c1c40954da19039bb55dc10d0166a1dd7a8650cb9776f2aad6f03ad110fd550a49e9c934446d23cd8eb3279fb
+DIST github.com-go-ldap-ldap-13cedcf58a1ea124045dea529a66c849d3444c8e.tar.gz 36378 BLAKE2B 0c125c1306e2d184e398d853cf454f8723520c2f5da33709bc3317776f1defeb51fdf1064a5e2f9714256a047e36292924b03245c2d962dca05f40e8f8a3b3e1 SHA512 3d4265b36e77b77357dd4f3f757bcdcb2dd4fc677ec83a33ee125d48ca19431075b0ab8087a4cb7d0a5027b1c2ea6ca516003c81b4d7df55de9c54ec6dc248fa
+DIST github.com-go-mgo-mgo-3f83fa5005286a7fe593b055f0d7771a7dce4655.tar.gz 376880 BLAKE2B 800038e0870d8b943604bc5edf9ba566d20fed75f445834801955a19da6add891f96cbf5e19a93d520d90ccc4e9da911ab02cccb710fee67b3fe60e4409a717f SHA512 f0e7948d4672d29d3d0a741961ff8a75d30c556e157698118a32de10e2af8eb2ae6a61feea1c93aff313596d285a048a70dae7339c66760ebb91a1aecfb05845
+DIST github.com-go-yaml-yaml-a3f3340b5840cee44f372bddb5880fcbc419b46a.tar.gz 60814 BLAKE2B a77b7d72e2937af71a0734c21bee7a1d7770157c27f1ddfa164c66fd5461f86a2ef46e002087092ef011caae572838bcc9537a8290cd54dfafb7f54423e47c48 SHA512 184a0e658a4eac3b867533cd0e494bd84db94fbe10e8df0d0b755c7ffc95bc99e2f84c0157183ca74cdc79289a85dcf7f1dea8a4c89a253565baf473b3627eae
+DIST github.com-golang-crypto-e1a4589e7d3ea14a3352255d04b6f1a418845e5e.tar.gz 1336856 BLAKE2B 076239faa59c88b8eab873097dea87dd579a4bb65a6b3a9f19ddacc0a6c05dac2a17917547ef8fabb46fbc5b56262b81330fc1281fb42d72107bf6df69edfc2c SHA512 c22fc86fbc22d6ec8157f89c075f07db8b72bf63ff97e06c907f555bf865cb77414c4fa2b9974407e43fa4f74b77710d3be9d2646f929fcfd5269b0ffc379914
+DIST github.com-golang-net-859d1a86bb617c0c20d154590c3c5d3fcb670b07.tar.gz 920336 BLAKE2B 4a80a4cbf866ff64c699860bef3a971b6ba6bc002e85106e2268b494f40b8a87c61f923c70818e4dc59bf898986393a8c8e972c50152a3abc48545d780ee5474 SHA512 49ccb64c9b675460d12ea6d0456bb1124a92d56e70b04398d14b33dd5879c4e188dcc3e6c79c1aa6f491507f854911a9298fbc61aed60cbdab0205b6995bb4a3
+DIST github.com-golang-oauth2-13449ad91cb26cb47661c1b080790392170385fd.tar.gz 38610 BLAKE2B d966e904199bbaa5a566e1d042e6bcc29d91aa9ef812bff3d5f01dac69a51542d6a5cc8b68bdb7d7e986977a47b67d030014447d4b8a893a8ee07713db37abfd SHA512 9301e42d43ff421f85949b1fd7e60baa183842b0d128c0f4895708c30a91e4e614032a08dda03c2564b41251037c453f95aa21fe1876672e033c83890a96d660
+DIST github.com-golang-protobuf-11b8df160996e00fd4b55cbaafb3d84ec6d50fa8.tar.gz 267933 BLAKE2B be018eea3f65b35bea4f4d92c973370dfbdcb85151df40df7976ff6ea0186f90a62e42444f9e6e562a8615333f2798aafcaf40b9226861a5bb9f8844ee3dcd4e SHA512 7b6ac268d15fc5e2c07a22784565466abca6257deef90183bab45e1935c915dbebe5560e6583d76b2ba8b58fa22b0c07f5f512c188b6503ebbf47937f844afe9
+DIST github.com-golang-snappy-553a641470496b2327abcac10b36396bd98e45c9.tar.gz 62076 BLAKE2B 0c44cd5633864eb1aef91e83706c8d2e0469722603eea1969c4f38ad013dac411ce80ace29a89478f9027951a4e469fc442c60988a729f4efbf4caff2361c423 SHA512 a324c8a7687e820f6b322930a054d1e7fc4c37bb66a95d473ef2a67fed703de90e8cc3072273ad2f9c681b1cf7ec1acc0ee9dc735ab593e23eea5cde96eea8a6
+DIST github.com-golang-sys-493114f68206f85e7e333beccfabc11e98cba8dd.tar.gz 677040 BLAKE2B f5bee72793d743868e9b2f1ccad0470458e8506cd7090a8d9b69b5d8b510e32c6dc2f07e8a390bb118ab651a9366a6387a56f207b55111220d26a89b140c4984 SHA512 efebe04d03a37e06ddacc0bbb1c7c35ac6590dd1e2e4d8c3da38f36ecab53a2e488a8e042e7d39a14c1163bf033ebb42e72c4760a0d0acf3aae0ae3fb3355dbc
+DIST github.com-golang-text-ab5ac5f9a8deb4855a60fab02bc61a4ec770bd49.tar.gz 4618514 BLAKE2B 6fea366f035d493281c00c45bc795faa549e361dafe799c02bdbc1bcb3fe0d012d76c6699f43e79c013774576bc5c6b57eb30e14c0c86acaefdb89eb898a6142 SHA512 d3231ceb80f5bb379bd6e9a717c1f16451dfd58f32de221020df5a92d3a686ca85b56120db88a93ac49e9a93aff472658c251de91c5fa6b5fe8d1d4b614dd615
+DIST github.com-google-go-genproto-595979c8a7bf586b2d293fb42246bf91a0b893d9.tar.gz 988349 BLAKE2B aee32d0d4139172442699412756f6429944b8ef2389e539d1717c4962642e3b63e3d725c28cc4c15189b4b1f286c7c93aee3fe190054b757b2362dea1463b925 SHA512 1cfcc16d9eb8d6414e943d7a62ea6606527b34135e8baa905f92e1e4f438f245d9cc4db9711c9b191b979bab6eef404adb84c2c85fd2af2c91bc0d8e89a7b1cf
+DIST github.com-google-google-api-go-client-39c3dd417c5a443607650f18e829ad308da08dd2.tar.gz 6388385 BLAKE2B 32a0337f4d105742571f76919f15e1c99df19c5bd9999e70dbf02e85713905ff8daecd80d51cebeba76d1af0757868929c502529a97fc7a983983555258c4ee7 SHA512 5d5d66abff2bad1a758e0a9cd9b12b9d9d2f02df8b9eb6ff0b38ae505808c1a6e78eb46ee0516b92ab04e1241aac827287b2dc050adf84c867168e0b441864ba
+DIST github.com-googleapis-gax-go-8c160ca1523d8eea3932fbaa494c8964b7724aa8.tar.gz 10165 BLAKE2B f128871caa8c5994caefbaffc48d1043130f31caf7dd25b322545280e3358ecd0f3cce65024083f56274631b2f69ac1bdc17cb572a5d5631179a529298cea70c SHA512 94f00cef5d586dc6b1893bcd1f6ccee22c13888859e4e2e87c9a0dd30ace0011be4e172a5346d22165f1a4b6e637070ad1da808dcc89103a0323094c09d76aa3
+DIST github.com-grpc-grpc-go-35170916ff58e89ae03f52e778228e18207e0e02.tar.gz 315740 BLAKE2B ff727e8165582175c800653909312aa189f9f5a8eff531a07e0e1befc8428972f2c55c13a8df23859e94780a07e0c222fc8777bc0aa5a6b8569b8e0d17697201 SHA512 8c30f7641cb2cbbf274af90579b5e60370e85b1052b6206d02a395d69aa9a545d66fdb732e7636e3b326451be0f88bbf180c690835b39adb4c63d1dd67fc8c6a
+DIST github.com-schwarmco-go-cartesian-product-c2c0aca869a6cbf51e017ce148b949d9dee09bc3.tar.gz 2433 BLAKE2B 104d5f15bfa0b6166b8269e2647b39c5889fb2ff706d5c2d2ba6328ff2292cb2896a9b1d0298c7d00d962dc18a254885e3fb3d6a2e442bea7f92044e9b1a89e3 SHA512 a1767b2c5c6340cb2649d63beac11571ec3c9b2c98011234d5a51eb337d221ea411e517660ae966fd4f582ffef18b088d7125d29ba271bece8b51254dcac940b
+DIST github.com-syndtr-goleveldb-3c5717caf1475fd25964109a0fc640bd150fce43.tar.gz 137276 BLAKE2B 6f74b19157edb319c01fc2a8ed682904ec12a52cb3995dddf06396fcb127e2ec3e433d723fa848744b74d09161edd50973f008c3a6b1458625f709ddc9ada93e SHA512 bac364a68737f5faed9ec052d47db01dc4aa0eca4ef786a43766b844ff27d8d9f87a94159a17c58745dd4ba002a9a83cd091ab2561a61d01b0a672a82002c1d4
diff --git a/sys-auth/docker_auth/docker_auth-1.3.1.ebuild b/sys-auth/docker_auth/docker_auth-1.3.1.ebuild
new file mode 100644
index 000000000000..45b321b02a58
--- /dev/null
+++ b/sys-auth/docker_auth/docker_auth-1.3.1.ebuild
@@ -0,0 +1,88 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+EGO_PN="github.com/cesanta/docker_auth"
+
+EGO_VENDOR=(
+	"github.com/dchest/uniuri 8902c56451e9b58ff940bbe5fec35d5f9c04584a"
+	"github.com/deckarep/golang-set fc8930a5e645572ee00bf66358ed3414f3c13b90"
+	"github.com/docker/distribution 0700fa570d7bcc1b3e46ee127c4489fd25f4daa3"
+	"github.com/docker/libtrust aabc10ec26b754e797f9028f4589c5b7bd90dc20"
+	"github.com/facebookgo/httpdown a3b1354551a26449fbe05f5d855937f6e7acbd71"
+	"github.com/facebookgo/clock 600d898af40aa09a7a93ecb9265d87b0504b6f03"
+	"github.com/facebookgo/stats 1b76add642e42c6ffba7211ad7b3939ce654526e"
+	"github.com/go-ldap/ldap 13cedcf58a1ea124045dea529a66c849d3444c8e"
+	"github.com/cesanta/glog 22eb27a0ae192b290b25537b8e876556fc25129c"
+	"github.com/schwarmco/go-cartesian-product c2c0aca869a6cbf51e017ce148b949d9dee09bc3"
+	"github.com/syndtr/goleveldb 3c5717caf1475fd25964109a0fc640bd150fce43"
+	"github.com/golang/snappy 553a641470496b2327abcac10b36396bd98e45c9"
+	"gopkg.in/asn1-ber.v1 4e86f4367175e39f69d9358a5f17b4dda270378d github.com/go-asn1-ber/asn1-ber"
+	"gopkg.in/fsnotify.v1 629574ca2a5df945712d3079857300b5e4da0236 github.com/fsnotify/fsnotify"
+	"gopkg.in/mgo.v2 3f83fa5005286a7fe593b055f0d7771a7dce4655 github.com/go-mgo/mgo"
+	"gopkg.in/yaml.v2 a3f3340b5840cee44f372bddb5880fcbc419b46a github.com/go-yaml/yaml"
+	"golang.org/x/crypto e1a4589e7d3ea14a3352255d04b6f1a418845e5e github.com/golang/crypto"
+	"golang.org/x/sys 493114f68206f85e7e333beccfabc11e98cba8dd github.com/golang/sys"
+	"golang.org/x/net 859d1a86bb617c0c20d154590c3c5d3fcb670b07 github.com/golang/net"
+	"google.golang.org/api 39c3dd417c5a443607650f18e829ad308da08dd2 github.com/google/google-api-go-client"
+	"google.golang.org/grpc 35170916ff58e89ae03f52e778228e18207e0e02 github.com/grpc/grpc-go"
+	"github.com/golang/protobuf 11b8df160996e00fd4b55cbaafb3d84ec6d50fa8"
+	"golang.org/x/oauth2 13449ad91cb26cb47661c1b080790392170385fd github.com/golang/oauth2"
+	"cloud.google.com/go 20d4028b8a750c2aca76bf9fefa8ed2d0109b573 github.com/GoogleCloudPlatform/gcloud-golang"
+	"golang.org/x/text ab5ac5f9a8deb4855a60fab02bc61a4ec770bd49 github.com/golang/text"
+	"github.com/googleapis/gax-go 8c160ca1523d8eea3932fbaa494c8964b7724aa8"
+	"google.golang.org/genproto 595979c8a7bf586b2d293fb42246bf91a0b893d9 github.com/google/go-genproto"
+	)
+
+inherit user golang-build golang-vcs-snapshot
+EGIT_COMMIT="509a03a9622f460ded806a2c7b7b27717b3cb1f5"
+SHORT_COMMIT=${EGIT_COMMIT:0:7}
+SRC_URI="https://${EGO_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz
+	${EGO_VENDOR_URI}"
+KEYWORDS="~amd64"
+
+DESCRIPTION="Docker Registry 2 authentication server"
+HOMEPAGE="https://github.com/cesanta/docker_auth"
+
+LICENSE="Apache-2.0 BSD BSD-2 LGPL-3 MIT ZLIB"
+SLOT="0"
+IUSE=""
+
+RESTRICT="test"
+
+pkg_setup() {
+	enewgroup ${PN}
+	enewuser ${PN} -1 -1 /dev/null ${PN}
+}
+
+src_prepare() {
+	default
+	pushd src/${EGO_PN}
+	eapply "${FILESDIR}/${PN}-ldap-group-support-2.patch"
+	cp "${FILESDIR}/version.go" auth_server/version.go || die
+	sed -i -e "s/{version}/${PV}/" -e "s/{build_id}/${SHORT_COMMIT}/" auth_server/version.go || die
+	popd || die
+}
+
+src_compile() {
+	pushd src/${EGO_PN}/auth_server || die
+	GOPATH="${WORKDIR}/${P}" go build -o "bin/auth_server" || die
+	popd || die
+}
+
+src_install() {
+	pushd src/${EGO_PN} || die
+	dodoc README.md docs/Backend_MongoDB.md
+	insinto /usr/share/${PF}
+	doins -r examples
+	insinto /etc/docker_auth/
+	newins examples/reference.yml config.yml.example
+	dobin auth_server/bin/auth_server
+	popd || die
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/${PN}.logrotated ${PN}
+	keepdir /var/log/docker_auth
+	fowners ${PN}:${PN} /var/log/docker_auth
+}
diff --git a/sys-auth/docker_auth/docker_auth-1.4.0.ebuild b/sys-auth/docker_auth/docker_auth-1.4.0.ebuild
new file mode 100644
index 000000000000..a4d41f0d02b3
--- /dev/null
+++ b/sys-auth/docker_auth/docker_auth-1.4.0.ebuild
@@ -0,0 +1,91 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+EGO_PN="github.com/cesanta/docker_auth"
+
+EGO_VENDOR=(
+	"github.com/dchest/uniuri 8902c56451e9b58ff940bbe5fec35d5f9c04584a"
+	"github.com/deckarep/golang-set fc8930a5e645572ee00bf66358ed3414f3c13b90"
+	"github.com/docker/distribution 0700fa570d7bcc1b3e46ee127c4489fd25f4daa3"
+	"github.com/docker/libtrust aabc10ec26b754e797f9028f4589c5b7bd90dc20"
+	"github.com/facebookgo/httpdown a3b1354551a26449fbe05f5d855937f6e7acbd71"
+	"github.com/facebookgo/clock 600d898af40aa09a7a93ecb9265d87b0504b6f03"
+	"github.com/facebookgo/stats 1b76add642e42c6ffba7211ad7b3939ce654526e"
+	"github.com/go-ldap/ldap 13cedcf58a1ea124045dea529a66c849d3444c8e"
+	"github.com/cesanta/glog 22eb27a0ae192b290b25537b8e876556fc25129c"
+	"github.com/schwarmco/go-cartesian-product c2c0aca869a6cbf51e017ce148b949d9dee09bc3"
+	"github.com/syndtr/goleveldb 3c5717caf1475fd25964109a0fc640bd150fce43"
+	"github.com/golang/snappy 553a641470496b2327abcac10b36396bd98e45c9"
+	"gopkg.in/asn1-ber.v1 4e86f4367175e39f69d9358a5f17b4dda270378d github.com/go-asn1-ber/asn1-ber"
+	"gopkg.in/fsnotify.v1 629574ca2a5df945712d3079857300b5e4da0236 github.com/fsnotify/fsnotify"
+	"gopkg.in/mgo.v2 3f83fa5005286a7fe593b055f0d7771a7dce4655 github.com/go-mgo/mgo"
+	"gopkg.in/yaml.v2 a3f3340b5840cee44f372bddb5880fcbc419b46a github.com/go-yaml/yaml"
+	"golang.org/x/crypto e1a4589e7d3ea14a3352255d04b6f1a418845e5e github.com/golang/crypto"
+	"golang.org/x/sys 493114f68206f85e7e333beccfabc11e98cba8dd github.com/golang/sys"
+	"golang.org/x/net 859d1a86bb617c0c20d154590c3c5d3fcb670b07 github.com/golang/net"
+	"google.golang.org/api 39c3dd417c5a443607650f18e829ad308da08dd2 github.com/google/google-api-go-client"
+	"google.golang.org/grpc 35170916ff58e89ae03f52e778228e18207e0e02 github.com/grpc/grpc-go"
+	"github.com/golang/protobuf 11b8df160996e00fd4b55cbaafb3d84ec6d50fa8"
+	"golang.org/x/oauth2 13449ad91cb26cb47661c1b080790392170385fd github.com/golang/oauth2"
+	"cloud.google.com/go 20d4028b8a750c2aca76bf9fefa8ed2d0109b573 github.com/GoogleCloudPlatform/gcloud-golang"
+	"golang.org/x/text ab5ac5f9a8deb4855a60fab02bc61a4ec770bd49 github.com/golang/text"
+	"github.com/googleapis/gax-go 8c160ca1523d8eea3932fbaa494c8964b7724aa8"
+	"google.golang.org/genproto 595979c8a7bf586b2d293fb42246bf91a0b893d9 github.com/google/go-genproto"
+	)
+
+inherit user golang-build golang-vcs-snapshot
+EGIT_COMMIT="b89dec9a4f0098fb0f71d9b94e44d1710c1fe5cf"
+SHORT_COMMIT=${EGIT_COMMIT:0:7}
+SRC_URI="https://${EGO_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz
+	${EGO_VENDOR_URI}"
+KEYWORDS="~amd64"
+
+DESCRIPTION="Docker Registry 2 authentication server"
+HOMEPAGE="https://github.com/cesanta/docker_auth"
+
+LICENSE="Apache-2.0 BSD BSD-2 LGPL-3 MIT ZLIB"
+SLOT="0"
+IUSE=""
+
+DEPEND="dev-go/go-bindata"
+
+RESTRICT="test"
+
+pkg_setup() {
+	enewgroup ${PN}
+	enewuser ${PN} -1 -1 /dev/null ${PN}
+}
+
+src_prepare() {
+	default
+	pushd src/${EGO_PN}
+	cp "${FILESDIR}/version.go" auth_server/version.go || die
+	sed -i -e "s/{version}/${PV}/" -e "s/{build_id}/${SHORT_COMMIT}/" auth_server/version.go || die
+	sed -i -e "/.*gen_version.py*/d" auth_server/main.go || die
+	popd || die
+}
+
+src_compile() {
+	pushd src/${EGO_PN}/auth_server || die
+	GOPATH="${WORKDIR}/${P}" emake generate
+	GOPATH="${WORKDIR}/${P}" go build -v -o "bin/auth_server" || die
+	popd || die
+}
+
+src_install() {
+	pushd src/${EGO_PN} || die
+	dodoc README.md docs/*
+	insinto /usr/share/${PF}
+	doins -r examples
+	insinto /etc/docker_auth/
+	newins examples/reference.yml config.yml.example
+	dobin auth_server/bin/auth_server
+	popd || die
+	newinitd "${FILESDIR}"/${PN}.initd ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd ${PN}
+	insinto /etc/logrotate.d
+	newins "${FILESDIR}"/${PN}.logrotated ${PN}
+	keepdir /var/log/docker_auth
+	fowners ${PN}:${PN} /var/log/docker_auth
+}
diff --git a/sys-auth/docker_auth/files/docker_auth-ldap-group-support-2.patch b/sys-auth/docker_auth/files/docker_auth-ldap-group-support-2.patch
new file mode 100644
index 000000000000..7c8bba4a80b2
--- /dev/null
+++ b/sys-auth/docker_auth/files/docker_auth-ldap-group-support-2.patch
@@ -0,0 +1,427 @@
+From 2ee85ad8040bab72a929958b4c3c8037dbcd31ae Mon Sep 17 00:00:00 2001
+From: Kevin <kcd83@users.noreply.github.com>
+Date: Mon, 27 Feb 2017 19:09:52 +1300
+Subject: [PATCH 1/5] Initial proof of concept mapping memberOf CN to the label
+ groups #63
+
+(cherry picked from commit 4a33badac6b74617dfe3797a716a6907cf018b27)
+---
+ auth_server/authn/ldap_auth.go | 73 ++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 60 insertions(+), 13 deletions(-)
+
+diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
+index a3425ed..5769057 100644
+--- a/auth_server/authn/ldap_auth.go
++++ b/auth_server/authn/ldap_auth.go
+@@ -17,7 +17,6 @@
+ package authn
+ 
+ import (
+-	"bytes"
+ 	"crypto/tls"
+ 	"crypto/x509"
+ 	"fmt"
+@@ -73,10 +72,20 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
+ 	account = la.escapeAccountInput(account)
+ 
+ 	filter := la.getFilter(account)
+-	accountEntryDN, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &[]string{})
++
++	// dnAndGroupAttr := []string{"DN"} // example of no groups mapping attribute
++	groupAttribute := "memberOf"
++	dnAndGroupAttr := []string{"DN", groupAttribute}
++
++	entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &dnAndGroupAttr)
+ 	if uSearchErr != nil {
+ 		return false, nil, uSearchErr
+ 	}
++	if len(entryAttrMap) < 1 || entryAttrMap["DN"] == nil || len(entryAttrMap["DN"]) != 1 {
++		return false, nil, NoMatch // User does not exist
++	}
++
++	accountEntryDN := entryAttrMap["DN"][0]
+ 	if accountEntryDN == "" {
+ 		return false, nil, NoMatch // User does not exist
+ 	}
+@@ -95,6 +104,20 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
+ 		return false, nil, bindErr
+ 	}
+ 
++	// Extract group names from the attribute values
++	if entryAttrMap[groupAttribute] != nil {
++		rawGroups := entryAttrMap[groupAttribute]
++		labels := make(map[string][]string)
++		var groups []string
++		for _, value := range rawGroups {
++			cn := la.getCNFromDN(value)
++			groups = append(groups, cn)
++		}
++		labels["groups"] = groups
++
++		return true, labels, nil
++	}
++
+ 	return true, nil, nil
+ }
+ 
+@@ -185,9 +208,9 @@ func (la *LDAPAuth) getFilter(account string) string {
+ 
+ //ldap search and return required attributes' value from searched entries
+ //default return entry's DN value if you leave attrs array empty
+-func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (string, error) {
++func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (map[string][]string, error) {
+ 	if l == nil {
+-		return "", fmt.Errorf("No ldap connection!")
++		return nil, fmt.Errorf("No ldap connection!")
+ 	}
+ 	glog.V(2).Infof("Searching...basedDN:%s, filter:%s", *baseDN, *filter)
+ 	searchRequest := ldap.NewSearchRequest(
+@@ -198,30 +221,54 @@ func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, att
+ 		nil)
+ 	sr, err := l.Search(searchRequest)
+ 	if err != nil {
+-		return "", err
++		return nil, err
+ 	}
+ 
+ 	if len(sr.Entries) == 0 {
+-		return "", nil // User does not exist
++		return nil, nil // User does not exist
+ 	} else if len(sr.Entries) > 1 {
+-		return "", fmt.Errorf("Too many entries returned.")
++		return nil, fmt.Errorf("Too many entries returned.")
+ 	}
+ 
+-	var buffer bytes.Buffer
++	result := make(map[string][]string)
+ 	for _, entry := range sr.Entries {
++
+ 		if len(*attrs) == 0 {
+ 			glog.V(2).Infof("Entry DN = %s", entry.DN)
+-			buffer.WriteString(entry.DN)
++			result["DN"] = []string{entry.DN}
+ 		} else {
+ 			for _, attr := range *attrs {
+-				values := strings.Join(entry.GetAttributeValues(attr), " ")
+-				glog.V(2).Infof("Entry %s = %s", attr, values)
+-				buffer.WriteString(values)
++				var values []string
++				if attr == "DN" {
++					// DN is excluded from attributes
++					values = []string{entry.DN}
++				} else {
++					values = entry.GetAttributeValues(attr)
++				}
++				valuesString := strings.Join(values, "\n")
++				glog.V(2).Infof("Entry %s = %s", attr, valuesString)
++				result[attr] = values
++			}
++		}
++	}
++
++	return result, nil
++}
++
++func (la *LDAPAuth) getCNFromDN(dn string) string {
++	parsedDN, err := ldap.ParseDN(dn)
++	if err != nil || len(parsedDN.RDNs) > 0 {
++		for _, rdn := range parsedDN.RDNs {
++			for _, rdnAttr := range rdn.Attributes {
++				if rdnAttr.Type == "CN" {
++					return rdnAttr.Value
++				}
+ 			}
+ 		}
+ 	}
+ 
+-	return buffer.String(), nil
++	// else try using raw DN
++	return dn
+ }
+ 
+ func (la *LDAPAuth) Stop() {
+
+From 3f5e1b78519238ca65e6084f48cbdd56531e4c84 Mon Sep 17 00:00:00 2001
+From: Kevin <kcd83@users.noreply.github.com>
+Date: Tue, 28 Feb 2017 18:09:55 +1300
+Subject: [PATCH 2/5] Apply attribute mapping from configuration
+
+(cherry picked from commit ddde2fa779e746d7e74cd972a4c6795c72f17ee6)
+---
+ auth_server/authn/ldap_auth.go | 127 ++++++++++++++++++++++++-----------------
+ 1 file changed, 75 insertions(+), 52 deletions(-)
+
+diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
+index 5769057..99c9146 100644
+--- a/auth_server/authn/ldap_auth.go
++++ b/auth_server/authn/ldap_auth.go
+@@ -27,17 +27,23 @@ import (
+ 	"github.com/cesanta/glog"
+ )
+ 
++type LabelMap struct {
++	Attribute string `yaml:"attribute,omitempty"`
++	ParseCN   bool   `yaml:"parse_cn,omitempty"`
++}
++
+ type LDAPAuthConfig struct {
+-	Addr                  string `yaml:"addr,omitempty"`
+-	TLS                   string `yaml:"tls,omitempty"`
+-	InsecureTLSSkipVerify bool   `yaml:"insecure_tls_skip_verify,omitempty"`
+-	CACertificate         string `yaml:"ca_certificate,omitempty"`
+-	Base                  string `yaml:"base,omitempty"`
+-	Filter                string `yaml:"filter,omitempty"`
+-	BindDN                string `yaml:"bind_dn,omitempty"`
+-	BindPasswordFile      string `yaml:"bind_password_file,omitempty"`
+-	GroupBaseDN           string `yaml:"group_base_dn,omitempty"`
+-	GroupFilter           string `yaml:"group_filter,omitempty"`
++	Addr                  string              `yaml:"addr,omitempty"`
++	TLS                   string              `yaml:"tls,omitempty"`
++	InsecureTLSSkipVerify bool                `yaml:"insecure_tls_skip_verify,omitempty"`
++	CACertificate         string              `yaml:"ca_certificate,omitempty"`
++	Base                  string              `yaml:"base,omitempty"`
++	Filter                string              `yaml:"filter,omitempty"`
++	BindDN                string              `yaml:"bind_dn,omitempty"`
++	BindPasswordFile      string              `yaml:"bind_password_file,omitempty"`
++	LabelMaps             map[string]LabelMap `yaml:"labels,omitempty"`
++	GroupBaseDN           string              `yaml:"group_base_dn,omitempty"`
++	GroupFilter           string              `yaml:"group_filter,omitempty"`
+ }
+ 
+ type LDAPAuth struct {
+@@ -73,22 +79,19 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
+ 
+ 	filter := la.getFilter(account)
+ 
+-	// dnAndGroupAttr := []string{"DN"} // example of no groups mapping attribute
+-	groupAttribute := "memberOf"
+-	dnAndGroupAttr := []string{"DN", groupAttribute}
++	labelAttributes, labelsConfigErr := la.getLabelAttributes()
++	if labelsConfigErr != nil {
++		return false, nil, labelsConfigErr
++	}
+ 
+-	entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &dnAndGroupAttr)
++	accountEntryDN, entryAttrMap, uSearchErr := la.ldapSearch(l, &la.config.Base, &filter, &labelAttributes)
+ 	if uSearchErr != nil {
+ 		return false, nil, uSearchErr
+ 	}
+-	if len(entryAttrMap) < 1 || entryAttrMap["DN"] == nil || len(entryAttrMap["DN"]) != 1 {
+-		return false, nil, NoMatch // User does not exist
+-	}
+-
+-	accountEntryDN := entryAttrMap["DN"][0]
+ 	if accountEntryDN == "" {
+ 		return false, nil, NoMatch // User does not exist
+ 	}
++
+ 	// Bind as the user to verify their password
+ 	if len(accountEntryDN) > 0 {
+ 		err := l.Bind(accountEntryDN, string(password))
+@@ -104,21 +107,13 @@ func (la *LDAPAuth) Authenticate(account string, password PasswordString) (bool,
+ 		return false, nil, bindErr
+ 	}
+ 
+-	// Extract group names from the attribute values
+-	if entryAttrMap[groupAttribute] != nil {
+-		rawGroups := entryAttrMap[groupAttribute]
+-		labels := make(map[string][]string)
+-		var groups []string
+-		for _, value := range rawGroups {
+-			cn := la.getCNFromDN(value)
+-			groups = append(groups, cn)
+-		}
+-		labels["groups"] = groups
+-
+-		return true, labels, nil
++	// Extract labels from the attribute values
++	labels, labelsExtractErr := la.getLabelsFromMap(entryAttrMap)
++	if labelsExtractErr != nil {
++		return false, nil, labelsExtractErr
+ 	}
+ 
+-	return true, nil, nil
++	return true, labels, nil
+ }
+ 
+ func (la *LDAPAuth) bindReadOnlyUser(l *ldap.Conn) error {
+@@ -208,9 +203,9 @@ func (la *LDAPAuth) getFilter(account string) string {
+ 
+ //ldap search and return required attributes' value from searched entries
+ //default return entry's DN value if you leave attrs array empty
+-func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (map[string][]string, error) {
++func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, attrs *[]string) (string, map[string][]string, error) {
+ 	if l == nil {
+-		return nil, fmt.Errorf("No ldap connection!")
++		return "", nil, fmt.Errorf("No ldap connection!")
+ 	}
+ 	glog.V(2).Infof("Searching...basedDN:%s, filter:%s", *baseDN, *filter)
+ 	searchRequest := ldap.NewSearchRequest(
+@@ -221,38 +216,66 @@ func (la *LDAPAuth) ldapSearch(l *ldap.Conn, baseDN *string, filter *string, att
+ 		nil)
+ 	sr, err := l.Search(searchRequest)
+ 	if err != nil {
+-		return nil, err
++		return "", nil, err
+ 	}
+ 
+ 	if len(sr.Entries) == 0 {
+-		return nil, nil // User does not exist
++		return "", nil, nil // User does not exist
+ 	} else if len(sr.Entries) > 1 {
+-		return nil, fmt.Errorf("Too many entries returned.")
++		return "", nil, fmt.Errorf("Too many entries returned.")
+ 	}
+ 
+-	result := make(map[string][]string)
++	attributes := make(map[string][]string)
++	var entryDn string
+ 	for _, entry := range sr.Entries {
+-
++		entryDn = entry.DN
+ 		if len(*attrs) == 0 {
+-			glog.V(2).Infof("Entry DN = %s", entry.DN)
+-			result["DN"] = []string{entry.DN}
++			glog.V(2).Infof("Entry DN = %s", entryDn)
+ 		} else {
+ 			for _, attr := range *attrs {
+-				var values []string
+-				if attr == "DN" {
+-					// DN is excluded from attributes
+-					values = []string{entry.DN}
+-				} else {
+-					values = entry.GetAttributeValues(attr)
+-				}
+-				valuesString := strings.Join(values, "\n")
+-				glog.V(2).Infof("Entry %s = %s", attr, valuesString)
+-				result[attr] = values
++				values := entry.GetAttributeValues(attr)
++				glog.V(2).Infof("Entry %s = %s", attr, strings.Join(values, "\n"))
++				attributes[attr] = values
+ 			}
+ 		}
+ 	}
+ 
+-	return result, nil
++	return entryDn, attributes, nil
++}
++
++func (la *LDAPAuth) getLabelAttributes() ([]string, error) {
++	labelAttributes := make([]string, len(la.config.LabelMaps))
++	i := 0
++	for key, mapping := range la.config.LabelMaps {
++		if mapping.Attribute == "" {
++			return nil, fmt.Errorf("Label %s is missing 'attribute' to map from", key)
++		}
++		labelAttributes[i] = mapping.Attribute
++		i++
++	}
++	return labelAttributes, nil
++}
++
++func (la *LDAPAuth) getLabelsFromMap(attrMap map[string][]string) (map[string][]string, error) {
++	labels := make(map[string][]string)
++	for key, mapping := range la.config.LabelMaps {
++		if mapping.Attribute == "" {
++			return nil, fmt.Errorf("Label %s is missing 'attribute' to map from", key)
++		}
++
++		mappingValues := attrMap[mapping.Attribute]
++		if mappingValues != nil {
++			if mapping.ParseCN {
++				// shorten attribute to its common name
++				for i, value := range mappingValues {
++					cn := la.getCNFromDN(value)
++					mappingValues[i] = cn
++				}
++			}
++			labels[key] = mappingValues
++		}
++	}
++	return labels, nil
+ }
+ 
+ func (la *LDAPAuth) getCNFromDN(dn string) string {
+
+From 98c4191ee4eae3e3e823c91226179c740e77f3a9 Mon Sep 17 00:00:00 2001
+From: Kevin <kcd83@users.noreply.github.com>
+Date: Tue, 28 Feb 2017 18:27:16 +1300
+Subject: [PATCH 3/5] Remove unused configuration fields, never implemented?
+
+(cherry picked from commit cd37001980267a99a9faa19f1927891af63acb90)
+---
+ auth_server/authn/ldap_auth.go | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/auth_server/authn/ldap_auth.go b/auth_server/authn/ldap_auth.go
+index 99c9146..1135dad 100644
+--- a/auth_server/authn/ldap_auth.go
++++ b/auth_server/authn/ldap_auth.go
+@@ -42,8 +42,6 @@ type LDAPAuthConfig struct {
+ 	BindDN                string              `yaml:"bind_dn,omitempty"`
+ 	BindPasswordFile      string              `yaml:"bind_password_file,omitempty"`
+ 	LabelMaps             map[string]LabelMap `yaml:"labels,omitempty"`
+-	GroupBaseDN           string              `yaml:"group_base_dn,omitempty"`
+-	GroupFilter           string              `yaml:"group_filter,omitempty"`
+ }
+ 
+ type LDAPAuth struct {
+
+From 1b5d134966c8bd1cba9afaeca284476e66a495e5 Mon Sep 17 00:00:00 2001
+From: Kevin <kcd83@users.noreply.github.com>
+Date: Fri, 1 Sep 2017 22:50:19 +1200
+Subject: [PATCH 4/5] Add LDAP label map examples to the reference config
+
+(cherry picked from commit 2fd43be4e5c2cfe177d9e1d36bcd1b29f4d6f262)
+---
+ examples/reference.yml | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/examples/reference.yml b/examples/reference.yml
+index 6ab4ba2..26182fd 100644
+--- a/examples/reference.yml
++++ b/examples/reference.yml
+@@ -140,6 +140,16 @@ ldap_auth:
+   # User query settings. ${account} is expanded from auth request 
+   base: o=example.com
+   filter: (&(uid=${account})(objectClass=person))
++  # Labels can be mapped from LDAP attributes
++  labels:
++    # Add the user's title to a label called title
++    title:
++      attribute: title
++    # Add the user's memberOf values to a label called groups
++    groups:
++      attribute: memberOf
++      # Special handling to simplify the values to just the common name
++      parse_cn: true
+ 
+ mongo_auth:
+   # Essentially all options are described here: https://godoc.org/gopkg.in/mgo.v2#DialInfo
+
+From 1bc75974e70ff7a84bdf3323889b81e44ea3dc00 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Manuel=20R=C3=BCger?= <manuel@rueg.eu>
+Date: Thu, 12 Apr 2018 15:00:51 +0200
+Subject: [PATCH 5/5] reference.yml: Add example ACL
+
+---
+ examples/reference.yml | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/examples/reference.yml b/examples/reference.yml
+index 26182fd..4bdec24 100644
+--- a/examples/reference.yml
++++ b/examples/reference.yml
+@@ -263,6 +263,12 @@ acl:
+   - match: {name: "${labels:project}-{labels:tier}/*"}
+     actions: ["push", "pull"]
+     comment: "Users can push to a project-tier/* that they are assigned to"
++  - match: {labels: {"title": "Developer"}}
++    actions: ["*"]
++    comment: "If you call yourself a developer you can do anything (this ACL is an example for LDAP labels as defined above)"
++  - match: {labels: {"groups": "Admin"}}
++    actions: ["push"]
++    comment: "If you are part of the admin group you can push. (this ACL is an example for LDAP labels as defined above)"
+   # Access is denied by default.
+ 
+ # (optional) Define to query ACL from a MongoDB server.
diff --git a/sys-auth/docker_auth/files/docker_auth.confd b/sys-auth/docker_auth/files/docker_auth.confd
new file mode 100644
index 000000000000..096572cd8455
--- /dev/null
+++ b/sys-auth/docker_auth/files/docker_auth.confd
@@ -0,0 +1,2 @@
+# arguments for docker auth
+command_args="--log_dir /var/log/${RC_SVCNAME} /etc/docker_auth/config.yml"
diff --git a/sys-auth/docker_auth/files/docker_auth.initd b/sys-auth/docker_auth/files/docker_auth.initd
new file mode 100644
index 000000000000..52699100d8c1
--- /dev/null
+++ b/sys-auth/docker_auth/files/docker_auth.initd
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 2016-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+description="Docker Registry Authentication Server"
+pidfile=${pidfile:-"/run/${SVCNAME}.pid"}
+user=${user:-${SVCNAME}}
+group=${group:-${SVCNAME}}
+
+command="/usr/bin/auth_server"
+command_args="${command_args:--log_dir /var/log/${SVCNAME} /etc/docker_auth/config.yml}"
+command_background="true"
+start_stop_daemon_args="--user ${user} --group ${group} \
+	--stdout /var/log/${SVCNAME}/${SVCNAME}.log \
+	--stderr /var/log/${SVCNAME}/${SVCNAME}.log"
+
+depend() {
+	after net
+}
diff --git a/sys-auth/docker_auth/files/docker_auth.logrotated b/sys-auth/docker_auth/files/docker_auth.logrotated
new file mode 100644
index 000000000000..7bcd082c0719
--- /dev/null
+++ b/sys-auth/docker_auth/files/docker_auth.logrotated
@@ -0,0 +1,8 @@
+/var/log/docker_auth/* {
+	su docker_auth docker_auth
+	missingok
+	size 5M
+	rotate 3
+	compress
+	copytruncate
+}
diff --git a/sys-auth/docker_auth/files/version.go b/sys-auth/docker_auth/files/version.go
new file mode 100644
index 000000000000..9c014db7f1f2
--- /dev/null
+++ b/sys-auth/docker_auth/files/version.go
@@ -0,0 +1,6 @@
+package main
+
+const (
+	Version = "{version}"
+	BuildId = "{build_id}"
+)
diff --git a/sys-auth/docker_auth/metadata.xml b/sys-auth/docker_auth/metadata.xml
new file mode 100644
index 000000000000..99aea7264b0e
--- /dev/null
+++ b/sys-auth/docker_auth/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>williamh@gentoo.org</email>
+		<name>William Hubbs</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">cesanta/docker_auth</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/elogind/Manifest b/sys-auth/elogind/Manifest
new file mode 100644
index 000000000000..8bb9d4b5ee29
--- /dev/null
+++ b/sys-auth/elogind/Manifest
@@ -0,0 +1 @@
+DIST elogind-243.7.tar.gz 1338186 BLAKE2B f3efc2af50f56c2cda18d721c18f4d88ca608fb35b2c7e2ebb35c3f3f743124dcf17efcc9db47810a13093397b1c1bc82cb42e017b3db493af5d2bb70bcf0eff SHA512 fd17c5016d083d63805f9ed0326ee32597870f6c48c9c246712cb09a77db775036b0fd0f4258b6557e189a1eceb4b50f4ae2e9e7881f4d9759b87a0b49ce3472
diff --git a/sys-auth/elogind/elogind-243.7.ebuild b/sys-auth/elogind/elogind-243.7.ebuild
new file mode 100644
index 000000000000..3354180300c6
--- /dev/null
+++ b/sys-auth/elogind/elogind-243.7.ebuild
@@ -0,0 +1,136 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_BRANCH="v241-stable"
+	EGIT_REPO_URI="https://github.com/elogind/elogind.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86"
+fi
+
+inherit linux-info meson pam udev xdg-utils
+
+DESCRIPTION="The systemd project's logind, extracted to a standalone package"
+HOMEPAGE="https://github.com/elogind/elogind"
+
+LICENSE="CC0-1.0 LGPL-2.1+ public-domain"
+SLOT="0"
+IUSE="+acl debug doc +pam +policykit selinux"
+
+BDEPEND="
+	app-text/docbook-xml-dtd:4.2
+	app-text/docbook-xml-dtd:4.5
+	app-text/docbook-xsl-stylesheets
+	dev-util/gperf
+	dev-util/intltool
+	virtual/pkgconfig
+"
+DEPEND="
+	sys-apps/util-linux
+	sys-libs/libcap
+	virtual/libudev:=
+	acl? ( sys-apps/acl )
+	pam? ( sys-libs/pam )
+	selinux? ( sys-libs/libselinux )
+"
+RDEPEND="${DEPEND}
+	!sys-apps/systemd
+"
+PDEPEND="
+	sys-apps/dbus
+	policykit? ( sys-auth/polkit )
+"
+
+DOCS=( README.md src/libelogind/sd-bus/GVARIANT-SERIALIZATION )
+
+PATCHES=(
+	"${FILESDIR}/${P}-nodocs.patch"
+	"${FILESDIR}/${PN}-241.4-broken-test.patch" # bug 699116
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~CGROUPS ~EPOLL ~INOTIFY_USER ~SIGNALFD ~TIMERFD"
+
+	use kernel_linux && linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+	xdg_environment_reset
+}
+
+src_configure() {
+	local rccgroupmode="$(grep rc_cgroup_mode ${EPREFIX}/etc/rc.conf | cut -d '"' -f 2)"
+	local cgroupmode="legacy"
+
+	if [[ "xhybrid" = "x${rccgroupmode}" ]] ; then
+		cgroupmode="hybrid"
+	elif [[ "xunified" = "x${rccgroupmode}" ]] ; then
+		cgroupmode="unified"
+	fi
+
+	local emesonargs=(
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		-Dhtmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+		-Dpamlibdir=$(getpam_mod_dir)
+		-Dudevrulesdir="${EPREFIX}$(get_udevdir)"/rules.d
+		--libdir="${EPREFIX}"/usr/$(get_libdir)
+		-Drootlibdir="${EPREFIX}"/$(get_libdir)
+		-Drootlibexecdir="${EPREFIX}"/$(get_libdir)/elogind
+		-Drootprefix="${EPREFIX}/"
+		-Dbashcompletiondir="${EPREFIX}/usr/share/bash-completion/completions"
+		-Dman=auto
+		-Dsmack=true
+		-Dcgroup-controller=openrc
+		-Ddefault-hierarchy=${cgroupmode}
+		-Ddefault-kill-user-processes=false
+		-Dacl=$(usex acl true false)
+		--buildtype $(usex debug debug release)
+		-Dhtml=$(usex doc auto false)
+		-Dpam=$(usex pam true false)
+		-Dselinux=$(usex selinux true false)
+		-Dutmp=$(usex elibc_musl false true)
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	DOCS+=( src/libelogind/sd-bus/GVARIANT-SERIALIZATION )
+
+	meson_src_install
+
+	newinitd "${FILESDIR}"/${PN}.init ${PN}
+
+	sed -e "s/@libdir@/$(get_libdir)/" "${FILESDIR}"/${PN}.conf.in > ${PN}.conf || die
+	newconfd ${PN}.conf ${PN}
+}
+
+pkg_postinst() {
+	if [[ "$(rc-config list boot | grep elogind)" != "" ]]; then
+		elog "elogind is currently started from boot runlevel."
+	elif [[ "$(rc-config list default | grep elogind)" != "" ]]; then
+		ewarn "elogind is currently started from default runlevel."
+		ewarn "Please remove elogind from the default runlevel and"
+		ewarn "add it to the boot runlevel by:"
+		ewarn "# rc-update del elogind default"
+		ewarn "# rc-update add elogind boot"
+	else
+		elog "elogind is currently not started from any runlevel."
+		elog "You may add it to the boot runlevel by:"
+		elog "# rc-update add elogind boot"
+		elog
+		elog "Alternatively, you can leave elogind out of any"
+		elog "runlevel. It will then be started automatically"
+		if use pam; then
+			elog "when the first service calls it via dbus, or"
+			elog "the first user logs into the system."
+		else
+			elog "when the first service calls it via dbus."
+		fi
+	fi
+}
diff --git a/sys-auth/elogind/files/elogind-241.4-broken-test.patch b/sys-auth/elogind/files/elogind-241.4-broken-test.patch
new file mode 100644
index 000000000000..d2735825900e
--- /dev/null
+++ b/sys-auth/elogind/files/elogind-241.4-broken-test.patch
@@ -0,0 +1,15 @@
+--- a/src/test/meson.build	2019-11-15 08:59:47.000000000 +0100
++++ b/src/test/meson.build	2019-11-30 13:04:45.051316140 +0100
+@@ -1014,9 +1014,9 @@
+ #          '', 'timeout=120'],
+ #endif // 0
+ 
+-        [['src/libelogind/sd-login/test-login.c'],
+-         [],
+-         []],
++#         [['src/libelogind/sd-login/test-login.c'],
++#          [],
++#          []],
+ 
+         [['src/libelogind/sd-device/test-sd-device.c'],
+          [],
diff --git a/sys-auth/elogind/files/elogind-243.7-nodocs.patch b/sys-auth/elogind/files/elogind-243.7-nodocs.patch
new file mode 100644
index 000000000000..0ec0aa37308a
--- /dev/null
+++ b/sys-auth/elogind/files/elogind-243.7-nodocs.patch
@@ -0,0 +1,29 @@
+We don't want the build system to install to docdir for us.
+
+--- a/meson.build	2020-03-12 20:33:40.000000000 +0100
++++ b/meson.build	2020-03-12 22:46:08.020716935 +0100
+@@ -3352,15 +3352,11 @@
+ # install_data('modprobe.d/systemd.conf',
+ #              install_dir : modprobedir)
+ #endif // 0
+-install_data('LICENSE.GPL2',
+-             'LICENSE.LGPL2.1',
+ #if 0 /// elogind has upgraded to markdown, and the NEWS file is useless
+ #              'NEWS',
+ #              'README',
+ #else // 0
+-             'README.md',
+ #endif // 0
+-             'docs/CODING_STYLE.md',
+ #if 0 /// irrelevant for elogind
+ #              'docs/DISTRO_PORTING.md',
+ #              'docs/ENVIRONMENT.md',
+@@ -3369,8 +3365,6 @@
+ #              'docs/TRANSLATORS.md',
+ #              'docs/UIDS-GIDS.md',
+ #endif // 0
+-             'src/libelogind/sd-bus/GVARIANT-SERIALIZATION',
+-             install_dir : docdir)
+ 
+ #if 0 /// UNNEEDED by elogind
+ # meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
diff --git a/sys-auth/elogind/files/elogind.conf.in b/sys-auth/elogind/files/elogind.conf.in
new file mode 100644
index 000000000000..7b05b3502794
--- /dev/null
+++ b/sys-auth/elogind/files/elogind.conf.in
@@ -0,0 +1,7 @@
+# /etc/conf.d/elogind: config file for /etc/init.d/elogind
+
+# this is the elogind executable
+ELOGIND_EXEC="/@libdir@/elogind/elogind"
+
+# this is where elogind will store its pid file
+ELOGIND_PIDFILE="/run/elogind.pid"
diff --git a/sys-auth/elogind/files/elogind.init b/sys-auth/elogind/files/elogind.init
new file mode 100644
index 000000000000..019c3afbabc5
--- /dev/null
+++ b/sys-auth/elogind/files/elogind.init
@@ -0,0 +1,25 @@
+#!/sbin/openrc-run
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	need dbus
+
+	# Make sure elogind is up before xdm starts any dm
+	before xdm
+}
+
+start() {
+	ebegin "Starting elogind"
+
+	start-stop-daemon --start --quiet \
+		--pidfile "${ELOGIND_PIDFILE}" \
+		--exec "${ELOGIND_EXEC}" -- --daemon
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping elogind"
+	start-stop-daemon --stop --quiet --pidfile "${ELOGIND_PIDFILE}"
+	eend $?
+}
diff --git a/sys-auth/elogind/metadata.xml b/sys-auth/elogind/metadata.xml
new file mode 100644
index 000000000000..d5cfdb1a8e4f
--- /dev/null
+++ b/sys-auth/elogind/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>asturm@gentoo.org</email>
+	</maintainer>
+	<maintainer type="person">
+		<email>kensington@gentoo.org</email>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">elogind/elogind</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/fingerprint-gui/Manifest b/sys-auth/fingerprint-gui/Manifest
new file mode 100644
index 000000000000..4df985412c79
--- /dev/null
+++ b/sys-auth/fingerprint-gui/Manifest
@@ -0,0 +1 @@
+DIST fingerprint-gui-1.09.tar.gz 7037943 BLAKE2B b35b8a1c5f53752709da44903961527c01db20773298e4636d8c316946cd7d23022c9407081c55ba5f6ec55d9ed53b7f8ef858c44a623873834fa1cbd6aa941f SHA512 c4fb22368d82d72586f80009b5adb9db0a8e8777c3d1c1f23cf58a21f718a3e3d05bbc90fff295be969cf7f744f037fb886e975e626cf6d599f8f6b5f8323724
diff --git a/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r2.ebuild b/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r2.ebuild
new file mode 100644
index 000000000000..6a9a571c0d88
--- /dev/null
+++ b/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r2.ebuild
@@ -0,0 +1,111 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit qmake-utils readme.gentoo-r1 udev user gnome2-utils
+
+DESCRIPTION="Use Fingerprint Devices with Linux"
+HOMEPAGE="http://www.ullrich-online.cc/fingerprint/ https://github.com/maksbotan/fingerprint-gui"
+SRC_URI="https://github.com/maksbotan/fingerprint-gui/archive/v${PV}-qt5.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="+upekbsapi"
+
+DEPEND="
+	app-crypt/qca[qt5(+)]
+	dev-qt/qtcore:5
+	dev-qt/qtwidgets:5
+	dev-qt/qtxml:5
+	dev-qt/qtx11extras:5
+	sys-auth/libfprint
+	sys-auth/polkit-qt[qt5(+)]
+	sys-libs/pam
+	x11-libs/libX11
+	x11-libs/libfakekey
+	dev-libs/libusb
+	!sys-auth/thinkfinger
+"
+RDEPEND="${DEPEND}"
+
+QA_SONAME="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
+QA_PRESTRIPPED="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
+QA_FLAGS_IGNORED="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
+
+S="${WORKDIR}/${P}-qt5"
+
+HTML_DOCS=( doc/Hacking.html doc/Step-by-step-manual.html )
+
+src_prepare() {
+	eapply_user
+
+	sed -e '/Icon=/s:=.*:=Fingerprint:' \
+		-i bin/${PN}/${PN}.desktop || die
+	sed -e "s:/etc/udev/rules.d:\"$(get_udevdir)\"/rules.d:g" \
+		-i bin/${PN%-gui}-helper/${PN%-gui}-helper.pro || die
+	sed -e 's:GROUP="plugdev":GROUP="fingerprint":' \
+		-i bin/fingerprint-helper/92-fingerprint-gui-uinput.rules \
+		-i upek/91-fingerprint-gui-upek.rules || die
+	sed -e '/DOCDIR\s\+=/s:'${PN}':'${PF}/html':' \
+		-i bin/fingerprint-gui/fingerprint-gui.pro || die
+	sed -e '/#define DOCDIR/s:'${PN}':'${PF}/html':' \
+		-i include/Globals.h || die
+}
+
+src_configure() {
+	eqmake5 \
+		PREFIX="${EROOT}"usr \
+		LIB="$(get_libdir)" \
+		LIBEXEC=libexec \
+		LIBPOLKIT_QT=LIBPOLKIT_QT_1_1
+}
+
+src_install() {
+	export INSTALL_ROOT="${D}" #submakes need it as well, re-install fails otherwise.
+	emake -j1 install
+	if use upekbsapi ; then
+		use amd64 && dolib.so upek/lib64/libbsapi.so*
+		use x86 && dolib.so upek/lib/libbsapi.so*
+		udev_dorules upek/91-fingerprint-gui-upek.rules
+		insinto /etc
+		doins upek/upek.cfg
+		#dodir /var/upek_data
+		#fowners root:plugdev /var/upek_data
+		#fperms 0775 /var/upek_data
+	fi
+	doicon src/res/Fingerprint.png
+
+	einstalldocs
+
+	keepdir /var/lib/fingerprint-gui
+
+	readme.gentoo_create_doc
+}
+
+pkg_preinst() {
+	enewgroup fingerprint
+}
+
+pkg_postinst() {
+	einfo "Fixing permisisons of fingerprints..."
+	find "${EROOT}"/var/lib/fingerprint-gui -exec chown root:root {} + || die "chown root:root failed"
+	find "${EROOR}"/var/lib/fingerprint-gui -type d -exec chmod 755 {} + || die "chmod 755 failed"
+	find "${EROOT}"/var/lib/fingerprint-gui -type f -exec chmod 600 {} + || die "chmod 600 failed"
+
+	readme.gentoo_print_elog
+
+	gnome2_icon_cache_update
+}
+
+FORCE_PRINT_ELOG=1
+DISABLE_AUTOFORMATTING=1
+DOC_CONTENTS="Please take a thorough look a the Step-by-step-manual.html
+in /usr/share/doc/${PF}/html for integration with pam/polkit/...
+Hint: You may want
+auth sufficient  pam_fingerprint-gui.so
+in /etc/pam.d/system-auth
+
+There are udev rules to enforce group fingerprint on the reader device
+Please put yourself in that group and re-trigger the udev rules."
diff --git a/sys-auth/fingerprint-gui/metadata.xml b/sys-auth/fingerprint-gui/metadata.xml
new file mode 100644
index 000000000000..a26f529c928c
--- /dev/null
+++ b/sys-auth/fingerprint-gui/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<!-- maintainer-needed -->
+<use>
+	<flag name="upekbsapi">Add UPEK BSAPI drivers for identify functions on some readers</flag>
+</use>
+	<origin>calculatelinux-overlay</origin>
+</pkgmetadata>
diff --git a/sys-auth/fprintd/Manifest b/sys-auth/fprintd/Manifest
new file mode 100644
index 000000000000..c0a22b06a9dc
--- /dev/null
+++ b/sys-auth/fprintd/Manifest
@@ -0,0 +1 @@
+DIST fprintd-0.8.1.tar.bz2 75254 BLAKE2B bf59c47c3d0186677bfd180e472e13773afebd4c3438e0e8e8cce34156df1c64c142b73d541fa876b96d4881e6967745a8c29be310dd33a509cb1863c836634e SHA512 438098fb677b742fdb279f3df85a1f2c800fce7498130c09b7408f21656ff256323b3bce4c22a2499e52c2ca7cddbc7f26033be7869939d23f9b5c436aa1f252
diff --git a/sys-auth/fprintd/fprintd-0.8.1-r1.ebuild b/sys-auth/fprintd/fprintd-0.8.1-r1.ebuild
new file mode 100644
index 000000000000..9a371cd46221
--- /dev/null
+++ b/sys-auth/fprintd/fprintd-0.8.1-r1.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools pam systemd
+
+DESCRIPTION="D-Bus service to access fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/fprintd/"
+MY_PV="V_$(ver_rs 0- _)"
+SRC_URI="https://cgit.freedesktop.org/libfprint/${PN}/snapshot/${MY_PV}.tar.bz2 -> ${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="doc pam static-libs"
+
+RDEPEND="
+	dev-libs/dbus-glib
+	dev-libs/glib:2
+	sys-auth/libfprint
+	sys-auth/polkit
+	pam? ( sys-libs/pam )
+"
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc
+	dev-util/gtk-doc-am
+	dev-util/intltool
+	doc? ( dev-libs/libxml2 dev-libs/libxslt )
+"
+
+S=${WORKDIR}/${MY_PV}
+
+src_prepare() {
+	default
+
+	sed -i 's#@localstatedir@/lib/fprint#@localstatedir@/fprint#g' data/fprintd.service.in || die "sed failed"
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable pam) \
+		$(use_enable static-libs static) \
+		$(use_enable doc gtk-doc-html) \
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install \
+		pammoddir=$(getpam_mod_dir)
+
+	keepdir /var/lib/fprint
+
+	find "${D}" -name "*.la" -delete || die
+
+	dodoc AUTHORS NEWS README{,.transifex} TODO
+	newdoc pam/README README.pam_fprintd
+	if use doc ; then
+		insinto /usr/share/doc/${PF}/html
+		doins doc/{fprintd-docs,version}.xml
+		insinto /usr/share/doc/${PF}/html/dbus
+		doins doc/dbus/net.reactivated.Fprint.{Device,Manager}.ref.xml
+	fi
+}
+
+pkg_postinst() {
+	elog "Please take a look at README.pam_fprintd for integration docs."
+}
diff --git a/sys-auth/fprintd/fprintd-0.8.1.ebuild b/sys-auth/fprintd/fprintd-0.8.1.ebuild
new file mode 100644
index 000000000000..b2842119b4e4
--- /dev/null
+++ b/sys-auth/fprintd/fprintd-0.8.1.ebuild
@@ -0,0 +1,67 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools pam systemd
+
+DESCRIPTION="D-Bus service to access fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/fprintd/"
+MY_PV="V_$(ver_rs 0- _)"
+SRC_URI="https://cgit.freedesktop.org/libfprint/${PN}/snapshot/${MY_PV}.tar.bz2 -> ${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~ia64 ppc ppc64 sparc x86"
+IUSE="doc pam static-libs"
+
+RDEPEND="
+	dev-libs/dbus-glib
+	dev-libs/glib:2
+	sys-auth/libfprint
+	sys-auth/polkit
+	pam? ( sys-libs/pam )
+"
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc
+	dev-util/gtk-doc-am
+	dev-util/intltool
+	doc? ( dev-libs/libxml2 dev-libs/libxslt )
+"
+
+S=${WORKDIR}/${MY_PV}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable pam) \
+		$(use_enable static-libs static) \
+		$(use_enable doc gtk-doc-html) \
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install \
+		pammoddir=$(getpam_mod_dir)
+
+	keepdir /var/lib/fprint
+
+	find "${D}" -name "*.la" -delete || die
+
+	dodoc AUTHORS NEWS README{,.transifex} TODO
+	newdoc pam/README README.pam_fprintd
+	if use doc ; then
+		insinto /usr/share/doc/${PF}/html
+		doins doc/{fprintd-docs,version}.xml
+		insinto /usr/share/doc/${PF}/html/dbus
+		doins doc/dbus/net.reactivated.Fprint.{Device,Manager}.ref.xml
+	fi
+}
+
+pkg_postinst() {
+	elog "Please take a look at README.pam_fprintd for integration docs."
+}
diff --git a/sys-auth/fprintd/metadata.xml b/sys-auth/fprintd/metadata.xml
new file mode 100644
index 000000000000..d69628fa8c7c
--- /dev/null
+++ b/sys-auth/fprintd/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+	<email>maksbotan@gentoo.org</email>
+	<name>Maxim Koltsov</name>
+</maintainer>
+<upstream>
+	<bugs-to>https://gitlab.freedesktop.org/libfprint/fprintd/issues</bugs-to>
+</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/google-authenticator-libpam-hardened/google-authenticator-libpam-hardened-9999.ebuild b/sys-auth/google-authenticator-libpam-hardened/google-authenticator-libpam-hardened-9999.ebuild
new file mode 100644
index 000000000000..4858a2c5daa0
--- /dev/null
+++ b/sys-auth/google-authenticator-libpam-hardened/google-authenticator-libpam-hardened-9999.ebuild
@@ -0,0 +1,41 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+EGIT_REPO_URI="https://github.com/mgorny/google-authenticator-libpam-hardened.git"
+inherit autotools git-r3
+
+DESCRIPTION="PAM Module for two step verification via mobile platform"
+HOMEPAGE="https://github.com/mgorny/google-authenticator-libpam-hardened"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+qrcode"
+
+DEPEND="sys-auth/oath-toolkit:=
+	sys-libs/pam
+	qrcode? ( media-gfx/qrencode:= )"
+RDEPEND="${DEPEND}
+	!sys-auth/google-authenticator"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local myconf=(
+		# TODO: use getpam_mod_dir after fixing build system
+		--libdir="/$(get_libdir)"
+
+		$(use_enable qrcode qrencode)
+	)
+
+	econf "${myconf[@]}"
+}
+
+src_install() {
+	default
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/google-authenticator-libpam-hardened/metadata.xml b/sys-auth/google-authenticator-libpam-hardened/metadata.xml
new file mode 100644
index 000000000000..185e74375e53
--- /dev/null
+++ b/sys-auth/google-authenticator-libpam-hardened/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>mgorny@gentoo.org</email>
+		<name>Michał Górny</name>
+	</maintainer>
+	<use>
+		<flag name='qrcode'>Display QRcode after setup to accomodate
+			automatic setup of OTP client apps.</flag>
+	</use>
+	<upstream>
+		<remote-id type="github">mgorny/google-authenticator-libpam-hardened</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/google-authenticator-wrappers/Manifest b/sys-auth/google-authenticator-wrappers/Manifest
new file mode 100644
index 000000000000..f2260304bad9
--- /dev/null
+++ b/sys-auth/google-authenticator-wrappers/Manifest
@@ -0,0 +1,3 @@
+DIST google-authenticator-wrappers-1.tar.gz 1379 BLAKE2B b8566281ade004a6b8996b18138754bab0f8ad2c4c23f4481b8a4f511a779a661fa7f1d68d22f43d0a077b9cef6dc5979d6ec522736d66e969db25c38a89062c SHA512 28d85206486c7aef9c1aee6e97e99950dd152c2114ae72c96c0af53debb1108e3d021766349d175cc6e402948f0ecd51a289575ebaa86680010ac50316e0146b
+DIST google-authenticator-wrappers-2.tar.gz 1615 BLAKE2B 313283bf2672e36883aa21d1520595afab90120ea106ef79e1dd7f2561d4a13f9ccb767ff3496f54eb2943b4a8fb55edce21e9b7f4ba9acb2845a97afbbbabde SHA512 5edcd57a1494fb6750a45396c9c5746dc952a9c7935c15bbae5e9ffce9175c9e1db92ee136ffe9cf513828425ab3dca0d976d1cc82737375b139f646717519cb
+DIST google-authenticator-wrappers-3.tar.gz 6128 BLAKE2B a2c2b35a0c780213a6ba2940c05a205a8ccb043b6ff0808eb47a45c7d52da215293ca785c968f26ec99b7a97e770b127b391fb104b85db6c09efd6af31531786 SHA512 471beb9fdc0225d59efef5c24cbfe1beec5fc4916521c4205c8aec5c4b3dfb473e53fbc5ada337cf0118a715aee9f5e045411b6d43c301d94fc08cccdbc889da
diff --git a/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-1.ebuild b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-1.ebuild
new file mode 100644
index 000000000000..e9a92f0160c9
--- /dev/null
+++ b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-1.ebuild
@@ -0,0 +1,17 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit cmake
+
+DESCRIPTION="Set of scripts to manage google-auth setup on Gentoo Infra"
+HOMEPAGE="https://github.com/mgorny/google-authenticator-wrappers"
+SRC_URI="https://github.com/mgorny/google-authenticator-wrappers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+RDEPEND="sys-auth/google-authenticator"
diff --git a/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-2.ebuild b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-2.ebuild
new file mode 100644
index 000000000000..e9a92f0160c9
--- /dev/null
+++ b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-2.ebuild
@@ -0,0 +1,17 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit cmake
+
+DESCRIPTION="Set of scripts to manage google-auth setup on Gentoo Infra"
+HOMEPAGE="https://github.com/mgorny/google-authenticator-wrappers"
+SRC_URI="https://github.com/mgorny/google-authenticator-wrappers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+RDEPEND="sys-auth/google-authenticator"
diff --git a/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-3.ebuild b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-3.ebuild
new file mode 100644
index 000000000000..0c4516dc36a1
--- /dev/null
+++ b/sys-auth/google-authenticator-wrappers/google-authenticator-wrappers-3.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit cmake user
+
+DESCRIPTION="Set of scripts to manage google-auth setup on Gentoo Infra"
+HOMEPAGE="https://github.com/mgorny/google-authenticator-wrappers"
+SRC_URI="https://github.com/mgorny/google-authenticator-wrappers/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+RDEPEND="sys-auth/google-authenticator"
+
+pkg_pretend() {
+	if [[ ${MERGE_TYPE} != buildonly ]]; then
+		local v
+		for v in ${REPLACING_VERSIONS}; do
+			if ver_test "${v}" -lt 3; then
+				ewarn "google-authenticator-wrappers v3 switches the secret store mechanism"
+				ewarn "from user-owned files to /var/lib/gauth.  To migrate secrets, move"
+				ewarn "and chown, e.g.:"
+				ewarn
+				ewarn "  mv /home/myuser/.google_authenticator /var/lib/gauth/myuser"
+				ewarn "  chown gauth /var/lib/gauth/myuser"
+				ewarn
+				ewarn "If you do not migrate or reset secrets, second step authentication"
+				ewarn "will be disabled after the upgrade."
+				break
+			fi
+		done
+	fi
+}
+
+src_configure() {
+	local mycmakeargs=(
+		-DGAUTH_USERNAME=gauth
+	)
+
+	cmake_src_configure
+}
+
+pkg_preinst() {
+	enewgroup gauth
+	enewuser gauth -1 -1 -1 gauth
+	fowners gauth:gauth /var/lib/gauth /usr/bin/gauthctl /usr/bin/gauth-test
+	fperms ug+s /usr/bin/gauthctl /usr/bin/gauth-test
+}
diff --git a/sys-auth/google-authenticator-wrappers/metadata.xml b/sys-auth/google-authenticator-wrappers/metadata.xml
new file mode 100644
index 000000000000..d2c47b33aec8
--- /dev/null
+++ b/sys-auth/google-authenticator-wrappers/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>mgorny@gentoo.org</email>
+		<name>Michał Górny</name>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/google-authenticator/Manifest b/sys-auth/google-authenticator/Manifest
new file mode 100644
index 000000000000..dc3e70fca857
--- /dev/null
+++ b/sys-auth/google-authenticator/Manifest
@@ -0,0 +1,2 @@
+DIST google-authenticator-1.08.tar.gz 62767 BLAKE2B ae1f5b1feac40da9beec28c81f39edfcc5e46df4cad4575d76deda9a183e8324ded79af9b7831c0572682749bb209b5371747b98a114af404d3225b9b0ff15f8 SHA512 f53d2fc20b5fa0f4621566509a2ef746077e3345de289bd2c9565440eb972e3a80807bf50a2cce8e2cc520df72c2e236629a921e3fce90fd635aff0c0ef36f75
+DIST google-authenticator-1.09.tar.gz 62944 BLAKE2B 85ddb0a9eec3d49eba1f9e84ca1375783fd21d19bd969ab9ca4324fd956628aea7bb937a2441bdb300ab0e157891962c9d9c979de17cc542df425f3528f00d95 SHA512 c71cec3200214f7a6c7f7f33fdc0f00e812b378940be92017785bbba82236b90d443977a2af12465285316e3dade0313f4d6df1f3d85f37f830d9877c7c33754
diff --git a/sys-auth/google-authenticator/files/1.08-remove-failing-tests.patch b/sys-auth/google-authenticator/files/1.08-remove-failing-tests.patch
new file mode 100644
index 000000000000..9b207dc20df7
--- /dev/null
+++ b/sys-auth/google-authenticator/files/1.08-remove-failing-tests.patch
@@ -0,0 +1,301 @@
+From 9e26b1885250cb0b7a710d9ae65542e3fcae684f Mon Sep 17 00:00:00 2001
+From: Ronny Gutbrod <gentoo@tastytea.de>
+Date: Sat, 11 Apr 2020 21:08:37 +0200
+Subject: [PATCH] Remove calls to  pam_sm_authenticate().
+
+It tries to change the user id, which is prohibited by the sandbox. See #624588.
+---
+ tests/pam_google_authenticator_unittest.c | 271 ----------------------
+ 1 file changed, 271 deletions(-)
+
+diff --git a/tests/pam_google_authenticator_unittest.c b/tests/pam_google_authenticator_unittest.c
+index edade47..0661b8b 100644
+--- a/tests/pam_google_authenticator_unittest.c
++++ b/tests/pam_google_authenticator_unittest.c
+@@ -338,72 +338,6 @@ int main(int argc, char *argv[]) {
+     // Make sure num_prompts_shown is still 0.
+     verify_prompts_shown(0);
+
+-    // Set the timestamp that this test vector needs
+-    set_time(10000*30);
+-
+-    response = "123456";
+-
+-    // Check if we can log in when using an invalid verification code
+-    puts("Testing failed login attempt");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-
+-    // Check required number of digits
+-    if (conv_mode == TWO_PROMPTS) {
+-      puts("Testing required number of digits");
+-      response = "50548";
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-      verify_prompts_shown(expected_bad_prompts_shown);
+-      response = "0050548";
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-      verify_prompts_shown(expected_bad_prompts_shown);
+-      response = "00050548";
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-      verify_prompts_shown(expected_bad_prompts_shown);
+-    }
+-
+-    // Test a blank response
+-    puts("Testing a blank response");
+-    response = "";
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-
+-    // Set the response that we should send back to the authentication module
+-    response = "050548";
+-
+-    // Test handling of missing state files
+-    puts("Test handling of missing state files");
+-    const char *old_secret = targv[0];
+-    targv[0] = "secret=/NOSUCHFILE";
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(password_is_provided_from_external ? 0 : expected_bad_prompts_shown);
+-    targv[targc++] = "nullok";
+-    targv[targc] = NULL;
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_IGNORE);
+-    verify_prompts_shown(0);
+-    targv[--targc] = NULL;
+-    targv[0] = old_secret;
+-
+-    // Check if we can log in when using a valid verification code
+-    puts("Testing successful login");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-
+-    // Test the STEP_SIZE option
+-    puts("Testing STEP_SIZE option");
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0);
+-    assert(write(fd, "\n\" STEP_SIZE 60\n", 16) == 16);
+-    close(fd);
+-    for (int *tm  = (int []){ 9998, 9999, 10001, 10002, 10000, -1 },
+-             *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS,
+-                              PAM_AUTH_ERR, PAM_SUCCESS };
+-         *tm >= 0;) {
+-      set_time(*tm++ * 60);
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++);
+-      verify_prompts_shown(expected_good_prompts_shown);
+-    }
+-
+     // Reset secret file after step size testing.
+     assert(!chmod(fn, 0600));
+     assert((fd = open(fn, O_TRUNC | O_WRONLY)) >= 0);
+@@ -411,211 +345,6 @@ int main(int argc, char *argv[]) {
+     assert(write(fd, "\n\" TOTP_AUTH", 12) == 12);
+     close(fd);
+
+-    // Test the WINDOW_SIZE option
+-    puts("Testing WINDOW_SIZE option");
+-    for (int *tm  = (int []){ 9998, 9999, 10001, 10002, 10000, -1 },
+-             *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS,
+-                              PAM_AUTH_ERR, PAM_SUCCESS };
+-         *tm >= 0;) {
+-      set_time(*tm++ * 30);
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++);
+-      verify_prompts_shown(expected_good_prompts_shown);
+-    }
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0);
+-    assert(write(fd, "\n\" WINDOW_SIZE 6\n", 17) == 17);
+-    close(fd);
+-    for (int *tm  = (int []){ 9996, 9997, 10002, 10003, 10000, -1 },
+-             *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS,
+-                              PAM_AUTH_ERR, PAM_SUCCESS };
+-         *tm >= 0;) {
+-      set_time(*tm++ * 30);
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++);
+-      verify_prompts_shown(expected_good_prompts_shown);
+-    }
+-
+-    // Test the DISALLOW_REUSE option
+-    puts("Testing DISALLOW_REUSE option");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0);
+-    assert(write(fd, "\" DISALLOW_REUSE\n", 17) == 17);
+-    close(fd);
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-
+-    // Test that DISALLOW_REUSE expires old entries from the re-use list
+-    char *old_response = response;
+-    for (int i = 10001; i < 10008; ++i) {
+-      set_time(i * 30);
+-      char buf[7];
+-      response = buf;
+-      sprintf(response, "%06d", compute_code(binary_secret,
+-                                             binary_secret_len, i));
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-      verify_prompts_shown(expected_good_prompts_shown);
+-    }
+-    set_time(10000 * 30);
+-    response = old_response;
+-    assert((fd = open(fn, O_RDONLY)) >= 0);
+-    char state_file_buf[4096] = { 0 };
+-    assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0);
+-    close(fd);
+-    const char *disallow = strstr(state_file_buf, "\" DISALLOW_REUSE ");
+-    assert(disallow);
+-    assert(!memcmp(disallow + 17,
+-                   "10002 10003 10004 10005 10006 10007\n", 36));
+-
+-    // Test the RATE_LIMIT option
+-    puts("Testing RATE_LIMIT option");
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0);
+-    assert(write(fd, "\" RATE_LIMIT 4 120\n", 19) == 19);
+-    close(fd);
+-    for (int *tm  = (int []){ 20000, 20001, 20002, 20003, 20004, 20006, -1 },
+-             *res = (int []){ PAM_SUCCESS, PAM_SUCCESS, PAM_SUCCESS,
+-                              PAM_SUCCESS, PAM_AUTH_ERR, PAM_SUCCESS, -1 };
+-         *tm >= 0;) {
+-      set_time(*tm * 30);
+-      char buf[7];
+-      response = buf;
+-      sprintf(response, "%06d",
+-              compute_code(binary_secret, binary_secret_len, *tm++));
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res);
+-      verify_prompts_shown(
+-          *res != PAM_SUCCESS ? 0 : expected_good_prompts_shown);
+-      ++res;
+-    }
+-    set_time(10000 * 30);
+-    response = old_response;
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_RDWR)) >= 0);
+-    memset(state_file_buf, 0, sizeof(state_file_buf));
+-    assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0);
+-    const char *rate_limit = strstr(state_file_buf, "\" RATE_LIMIT ");
+-    assert(rate_limit);
+-    assert(!memcmp(rate_limit + 13,
+-                   "4 120 600060 600090 600120 600180\n", 35));
+-
+-    // Test trailing space in RATE_LIMIT. This is considered a file format
+-    // error.
+-    char *eol = strchr(rate_limit, '\n');
+-    *eol = ' ';
+-    assert(!lseek(fd, 0, SEEK_SET));
+-    assert(write(fd, state_file_buf, strlen(state_file_buf)) ==
+-           strlen(state_file_buf));
+-    close(fd);
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(0);
+-    assert(!strncmp(get_error_msg(),
+-                    "Invalid list of timestamps in RATE_LIMIT", 40));
+-    *eol = '\n';
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_WRONLY)) >= 0);
+-    assert(write(fd, state_file_buf, strlen(state_file_buf)) ==
+-           strlen(state_file_buf));
+-    close(fd);
+-
+-    // Test TIME_SKEW option
+-    puts("Testing TIME_SKEW");
+-    for (int i = 0; i < 4; ++i) {
+-      set_time((12000 + i)*30);
+-      char buf[7];
+-      response = buf;
+-      sprintf(response, "%06d",
+-              compute_code(binary_secret, binary_secret_len, 11000 + i));
+-      assert(pam_sm_authenticate(NULL, 0, targc, targv) ==
+-             (i >= 2 ? PAM_SUCCESS : PAM_AUTH_ERR));
+-      verify_prompts_shown(expected_good_prompts_shown);
+-    }
+-
+-    puts("Testing TIME_SKEW - noskewadj");
+-    set_time(12020 * 30);
+-    char buf[7];
+-    response = buf;
+-    sprintf(response, "%06d", compute_code(binary_secret,
+-                                           binary_secret_len, 11010));
+-    targv[targc] = "noskewadj";
+-    assert(pam_sm_authenticate(NULL, 0, targc+1, targv) == PAM_AUTH_ERR);
+-    targv[targc] = NULL;
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-    set_time(10000*30);
+-
+-    // Test scratch codes
+-    puts("Testing scratch codes");
+-    response = "12345678";
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0);
+-    assert(write(fd, "12345678\n", 9) == 9);
+-    close(fd);
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-
+-    // Set up secret file for counter-based codes.
+-    assert(!chmod(fn, 0600));
+-    assert((fd = open(fn, O_TRUNC | O_WRONLY)) >= 0);
+-    assert(write(fd, secret, sizeof(secret)-1) == sizeof(secret)-1);
+-    assert(write(fd, "\n\" HOTP_COUNTER 1\n", 18) == 18);
+-    close(fd);
+-
+-    response = "293240";
+-
+-    // Check if we can log in when using a valid verification code
+-    puts("Testing successful counter-based login");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-
+-    // Verify that the hotp counter incremented
+-    assert((fd = open(fn, O_RDONLY)) >= 0);
+-    memset(state_file_buf, 0, sizeof(state_file_buf));
+-    assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0);
+-    close(fd);
+-    const char *hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER ");
+-    assert(hotp_counter);
+-    assert(!memcmp(hotp_counter + 15, "2\n", 2));
+-
+-    // Check if we can log in when using an invalid verification code
+-    // (including the same code a second time)
+-    puts("Testing failed counter-based login attempt");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR);
+-    verify_prompts_shown(expected_bad_prompts_shown);
+-
+-    // Verify that the hotp counter incremented
+-    assert((fd = open(fn, O_RDONLY)) >= 0);
+-    memset(state_file_buf, 0, sizeof(state_file_buf));
+-    assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0);
+-    close(fd);
+-    hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER ");
+-    assert(hotp_counter);
+-    assert(!memcmp(hotp_counter + 15, "3\n", 2));
+-
+-    response = "932068";
+-
+-    // Check if we can log in using a future valid verification code (using
+-    // default window_size of 3)
+-    puts("Testing successful future counter-based login");
+-    assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS);
+-    verify_prompts_shown(expected_good_prompts_shown);
+-
+-    // Verify that the hotp counter incremented
+-    assert((fd = open(fn, O_RDONLY)) >= 0);
+-    memset(state_file_buf, 0, sizeof(state_file_buf));
+-    assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0);
+-    close(fd);
+-    hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER ");
+-    assert(hotp_counter);
+-    assert(!memcmp(hotp_counter + 15, "6\n", 2));
+-
+-    // Remove the temporarily created secret file
+-    unlink(fn);
+-
+     // Release memory for the test arguments
+     for (int i = 0; i < targc; ++i) {
+       free((void *)targv[i]);
+--
+2.24.1
diff --git a/sys-auth/google-authenticator/google-authenticator-1.08.ebuild b/sys-auth/google-authenticator/google-authenticator-1.08.ebuild
new file mode 100644
index 000000000000..27600a569c7e
--- /dev/null
+++ b/sys-auth/google-authenticator/google-authenticator-1.08.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/google/google-authenticator-libpam.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/google/google-authenticator-libpam/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+	S="${WORKDIR}/google-authenticator-libpam-${PV}"
+fi
+
+DESCRIPTION="PAM Module for two step verification via mobile platform"
+HOMEPAGE="https://github.com/google/google-authenticator-libpam"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE=""
+
+DEPEND="sys-libs/pam"
+RDEPEND="${DEPEND}"
+
+PATCHES=( "${FILESDIR}/1.08-remove-failing-tests.patch" )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# We might want to use getpam_mod_dir from pam eclass,
+	# but the build already appends "/security" for us.
+	econf --libdir="/$(get_libdir)"
+}
+
+src_install() {
+	default
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog "For further information see"
+		elog "https://wiki.gentoo.org/wiki/Google_Authenticator"
+		elog ""
+		elog "If you want support for QR-Codes, install media-gfx/qrencode."
+	fi
+}
diff --git a/sys-auth/google-authenticator/google-authenticator-1.09.ebuild b/sys-auth/google-authenticator/google-authenticator-1.09.ebuild
new file mode 100644
index 000000000000..27600a569c7e
--- /dev/null
+++ b/sys-auth/google-authenticator/google-authenticator-1.09.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/google/google-authenticator-libpam.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/google/google-authenticator-libpam/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+	S="${WORKDIR}/google-authenticator-libpam-${PV}"
+fi
+
+DESCRIPTION="PAM Module for two step verification via mobile platform"
+HOMEPAGE="https://github.com/google/google-authenticator-libpam"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE=""
+
+DEPEND="sys-libs/pam"
+RDEPEND="${DEPEND}"
+
+PATCHES=( "${FILESDIR}/1.08-remove-failing-tests.patch" )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# We might want to use getpam_mod_dir from pam eclass,
+	# but the build already appends "/security" for us.
+	econf --libdir="/$(get_libdir)"
+}
+
+src_install() {
+	default
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog "For further information see"
+		elog "https://wiki.gentoo.org/wiki/Google_Authenticator"
+		elog ""
+		elog "If you want support for QR-Codes, install media-gfx/qrencode."
+	fi
+}
diff --git a/sys-auth/google-authenticator/google-authenticator-9999.ebuild b/sys-auth/google-authenticator/google-authenticator-9999.ebuild
new file mode 100644
index 000000000000..27600a569c7e
--- /dev/null
+++ b/sys-auth/google-authenticator/google-authenticator-9999.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/google/google-authenticator-libpam.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/google/google-authenticator-libpam/archive/${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+	S="${WORKDIR}/google-authenticator-libpam-${PV}"
+fi
+
+DESCRIPTION="PAM Module for two step verification via mobile platform"
+HOMEPAGE="https://github.com/google/google-authenticator-libpam"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE=""
+
+DEPEND="sys-libs/pam"
+RDEPEND="${DEPEND}"
+
+PATCHES=( "${FILESDIR}/1.08-remove-failing-tests.patch" )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	# We might want to use getpam_mod_dir from pam eclass,
+	# but the build already appends "/security" for us.
+	econf --libdir="/$(get_libdir)"
+}
+
+src_install() {
+	default
+	find "${D}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog "For further information see"
+		elog "https://wiki.gentoo.org/wiki/Google_Authenticator"
+		elog ""
+		elog "If you want support for QR-Codes, install media-gfx/qrencode."
+	fi
+}
diff --git a/sys-auth/google-authenticator/metadata.xml b/sys-auth/google-authenticator/metadata.xml
new file mode 100644
index 000000000000..073812872c19
--- /dev/null
+++ b/sys-auth/google-authenticator/metadata.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>gentoo@tastytea.de</email>
+		<name>Ronny Gutbrod</name>
+	</maintainer>
+	<maintainer type="project">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>candrews@gentoo.org</email>
+		<name>Craig Andrews</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">google/google-authenticator-libpam</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/keystone/Manifest b/sys-auth/keystone/Manifest
new file mode 100644
index 000000000000..65903092617d
--- /dev/null
+++ b/sys-auth/keystone/Manifest
@@ -0,0 +1,6 @@
+DIST keystone-16.0.1.tar.gz 1683325 BLAKE2B 6f22773592a1c843e82bcded230d2606b7fe8e540d50ccdbd85f53d4e5fda81023e85d04c258bc3741ecd7e4f8855299ab1828c8864862715ffd32629b877245 SHA512 060725244a181a98a3011ef7ae648b67054e64216fc62870b4190fd8475c8c36de01ae6428d1d4fac4bbdb405097aab1a9fe11daa65d4624dc613821cfeee004
+DIST keystone-17.0.0.tar.gz 1607717 BLAKE2B d59ccc651fa5363442ad6c1f3b2f2c2f6393468502e41d3aca7a9f4bd1d27fb558101ed37d051dcf7cdd77edb04df5ec1a739346dd889a5c873a607383897d25 SHA512 9d52a49fdcf1e891ae936ca221815576985a0f9a252960628dfbed18ca80c3f2af5a6311d7cf7c3d868ff4b02187515702ec297db1b2d49314662c46edf5c080
+DIST keystone.conf.sample-16.0.1 104552 BLAKE2B 35ec8deb13239ba3d46c5ca78ea41372065a867e2715be3fb17cd43d65f1902f02d79d7bc6c6cb5c6aec19a3833d17e9dda12e8e0605919d3a28b6300d3f2cf3 SHA512 535c47e3ec39d454818c883599cf6fc304044208b71b822bdb67099728306235b2ad06ee60cfce9033375ae7b2338b03a0488267af65e900e80ed68e4fee8c5a
+DIST keystone.conf.sample-17.0.0 105293 BLAKE2B f0e685f99ca3b6cdfb9ccd0b41709bd6c51cb4aa79d20fa12773f96cd6ecad730691cf7fb2384b0ab44787d6e2825c5f147310ca19d82a2adb6cd2ab623b52f2 SHA512 fc7e7272b1a0f8703fe8ec8f93208573b84a2121b55de919beb05c7bb7dd3542c71983dfdc73b7cb618eb68167e6c6a51aa8384839ae3503c677e17ff030f383
+DIST keystone.conf.sample-2019.2.9999 104552 BLAKE2B 35ec8deb13239ba3d46c5ca78ea41372065a867e2715be3fb17cd43d65f1902f02d79d7bc6c6cb5c6aec19a3833d17e9dda12e8e0605919d3a28b6300d3f2cf3 SHA512 535c47e3ec39d454818c883599cf6fc304044208b71b822bdb67099728306235b2ad06ee60cfce9033375ae7b2338b03a0488267af65e900e80ed68e4fee8c5a
+DIST keystone.conf.sample-2020.1.9999 105293 BLAKE2B f0e685f99ca3b6cdfb9ccd0b41709bd6c51cb4aa79d20fa12773f96cd6ecad730691cf7fb2384b0ab44787d6e2825c5f147310ca19d82a2adb6cd2ab623b52f2 SHA512 fc7e7272b1a0f8703fe8ec8f93208573b84a2121b55de919beb05c7bb7dd3542c71983dfdc73b7cb618eb68167e6c6a51aa8384839ae3503c677e17ff030f383
diff --git a/sys-auth/keystone/keystone-16.0.1.ebuild b/sys-auth/keystone/keystone-16.0.1.ebuild
new file mode 100644
index 000000000000..2161ae06b67a
--- /dev/null
+++ b/sys-auth/keystone/keystone-16.0.1.ebuild
@@ -0,0 +1,160 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_{6,7} )
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/train/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/train"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/train/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm64 x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/Babel-2.3.4[${PYTHON_USEDEP}]
+	!~dev-python/Babel-2.4.0[${PYTHON_USEDEP}]
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.1[${PYTHON_USEDEP}]
+	>=dev-python/six-1.10.0[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.1.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.11.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-concurrency-3.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-4.27.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-2.3.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-4.5.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.6.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/keystone/keystone-17.0.0.ebuild b/sys-auth/keystone/keystone-17.0.0.ebuild
new file mode 100644
index 000000000000..e3914fff6d77
--- /dev/null
+++ b/sys-auth/keystone/keystone-17.0.0.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_7 )
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/ussuri/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/ussuri"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/ussuri/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="amd64 ~arm64 x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.1[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.1.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.11.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-4.27.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-3.0.2[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-4.5.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.6.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/keystone/keystone-2019.2.9999.ebuild b/sys-auth/keystone/keystone-2019.2.9999.ebuild
new file mode 100644
index 000000000000..f1cdd22c765a
--- /dev/null
+++ b/sys-auth/keystone/keystone-2019.2.9999.ebuild
@@ -0,0 +1,160 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_{6,7} )
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/train/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/train"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/train/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/Babel-2.3.4[${PYTHON_USEDEP}]
+	!~dev-python/Babel-2.4.0[${PYTHON_USEDEP}]
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.1[${PYTHON_USEDEP}]
+	>=dev-python/six-1.10.0[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.1.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.11.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-concurrency-3.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-4.27.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-2.3.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-4.5.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.6.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/keystone/keystone-2020.1.9999.ebuild b/sys-auth/keystone/keystone-2020.1.9999.ebuild
new file mode 100644
index 000000000000..a3c3e0796139
--- /dev/null
+++ b/sys-auth/keystone/keystone-2020.1.9999.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_7 )
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/ussuri/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/ussuri"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/ussuri/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.1[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.1.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.1.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.11.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-4.27.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-3.0.2[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-4.5.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-2.6.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/keystone/metadata.xml b/sys-auth/keystone/metadata.xml
new file mode 100644
index 000000000000..1c1d7eee6b94
--- /dev/null
+++ b/sys-auth/keystone/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <use>
+    <flag name="memcached">Installs dependencies needed for using memcached as a backend</flag>
+    <flag name="mongo">Installs dependencies needed for using mongo as a backend</flag>
+  </use>
+  <maintainer type="person">
+    <email>prometheanfire@gentoo.org</email>
+    <name>Matthew Thode</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>openstack@gentoo.org</email>
+    <name>Openstack</name>
+  </maintainer>
+  <longdescription lang="en">
+    Keystone is the Openstack authentication, authorization, and service
+  catalog written in Python.
+  </longdescription>
+  <upstream>
+    <remote-id type="launchpad">keystone</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libfprint/Manifest b/sys-auth/libfprint/Manifest
new file mode 100644
index 000000000000..192cfd223be2
--- /dev/null
+++ b/sys-auth/libfprint/Manifest
@@ -0,0 +1,5 @@
+DIST libfprint-0.99.0.tar.gz 473925 BLAKE2B 799e3600393e4b25f7b0685ff0456ca391e5fcaef36e5b4475371cd07c848e40820dbbdc5a241fe11c6ee08b818380967129f85e177b5d8714b9dbc4d7b68ea1 SHA512 eca1d45baa23b7db1fcc5d7a9a396fe504aadc6ec2e68da32b5415fb0fff1227566d579271e0b34895ce7f3baa55314a0ccd20bb8c4adba253063b7b61284748
+DIST libfprint-1.0.tar.gz 475347 BLAKE2B cb560898cec11861c4529c0c37c328f74eaf271c1932ca5126b7bd6c82fafee24aff393c0fe223fef018a34a409647065d5f98a999c00f0e7a879e33bdfcd3cb SHA512 2d7f569368035cce0a579ef3412a1961c28aab254ae6174ce9ad11ce97b3dce824d0c6123adac12718cb074439e4d5b93bf978e5341824f179231d1faa219a26
+DIST libfprint-1.90.0.tar.gz 1760869 BLAKE2B fd0692e5a4924101399684289501d607da2183acf7f7b7c7ce22b7ed301fe0da75cb0b88c0642e1b1b6f82fe7d8505616ead456b48c3b0449201fd91669ce782 SHA512 99d7a62b3a1c329a2c13f508c98b60c6311fd01cd165fca12de5873305980167dd79c7d75edc74f53fce5066047e814fa654c6ac4f3f12342b57afa5b2dbe6d3
+DIST libfprint-1.90.1.tar.gz 2348486 BLAKE2B d9f43253d8be874f3d78e19dbd148788d8abdc3cd0d6f5c931a4aad650acaf647f9c818c22a575f9ebe0a698a338693448f6f460c780adcd7140dedbdc4e025f SHA512 0548d29e55aaa59e73f0fd13cac6b85dd3a048358c365423e12884c3877c3e30422ee3fc4d18a3daba2f26383fb886f1d40a74dba5d947f7bdec6b8852995b4e
+DIST libfprint-1.90.2.tar.gz 4152489 BLAKE2B d8e8dde93acfc83dc253741517eb840b1a950b5626f2aabef4d4a44fcef2db95096e7d467ae3191c3478e93c0919acbf48010b0c4dd23a538466a25d8204ddf6 SHA512 58326714ce92514e2f95da84c94ca1286cadb0f0bb7de68f15aba0120a22e4a51d8bc6d3d7dc0a4e46e3620e2bd0b3247d07782a3308daf2edd44a4ddb60d226
diff --git a/sys-auth/libfprint/files/libfprint-0.8.2-fix-implicit-declaration.patch b/sys-auth/libfprint/files/libfprint-0.8.2-fix-implicit-declaration.patch
new file mode 100644
index 000000000000..15b49597238c
--- /dev/null
+++ b/sys-auth/libfprint/files/libfprint-0.8.2-fix-implicit-declaration.patch
@@ -0,0 +1,194 @@
+From 17cbe376872d8a0f579a0497942a5d2f19facaf5 Mon Sep 17 00:00:00 2001
+From: Mikle Kolyada <zlogene@gentoo.org>
+Date: Sun, 2 Sep 2018 17:20:03 +0300
+Subject: [PATCH] Fix implicit declaration warnings
+
+---
+ libfprint/drivers/aes1610.c    | 2 ++
+ libfprint/drivers/aes2501.c    | 2 ++
+ libfprint/drivers/aes2550.c    | 2 ++
+ libfprint/drivers/aesx660.c    | 2 ++
+ libfprint/drivers/etes603.c    | 2 ++
+ libfprint/drivers/upeksonly.c  | 2 ++
+ libfprint/drivers/upektc.c     | 2 ++
+ libfprint/drivers/upektc_img.c | 2 ++
+ libfprint/drivers/upekts.c     | 2 ++
+ libfprint/drivers/vfs0050.c    | 2 ++
+ libfprint/drivers/vfs101.c     | 3 +++
+ libfprint/drivers/vfs301.c     | 3 +++
+ libfprint/drivers/vfs5011.c    | 2 ++
+ 13 files changed, 28 insertions(+)
+
+diff --git a/libfprint/drivers/aes1610.c b/libfprint/drivers/aes1610.c
+index f307a3b..9dc3383 100644
+--- a/libfprint/drivers/aes1610.c
++++ b/libfprint/drivers/aes1610.c
+@@ -25,6 +25,8 @@
+ 
+ #define FP_COMPONENT "aes1610"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "aeslib.h"
+ 
+diff --git a/libfprint/drivers/aes2501.c b/libfprint/drivers/aes2501.c
+index 87879a4..caaf3ea 100644
+--- a/libfprint/drivers/aes2501.c
++++ b/libfprint/drivers/aes2501.c
+@@ -23,6 +23,8 @@
+ 
+ #define FP_COMPONENT "aes2501"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "aeslib.h"
+ #include "aes2501.h"
+diff --git a/libfprint/drivers/aes2550.c b/libfprint/drivers/aes2550.c
+index ab4acaa..c838e54 100644
+--- a/libfprint/drivers/aes2550.c
++++ b/libfprint/drivers/aes2550.c
+@@ -23,6 +23,8 @@
+ 
+ #define FP_COMPONENT "aes2550"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "aes2550.h"
+ #include "aeslib.h"
+diff --git a/libfprint/drivers/aesx660.c b/libfprint/drivers/aesx660.c
+index e443e21..17c0245 100644
+--- a/libfprint/drivers/aesx660.c
++++ b/libfprint/drivers/aesx660.c
+@@ -23,6 +23,8 @@
+ 
+ #define FP_COMPONENT "aesX660"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "aeslib.h"
+ #include "aesx660.h"
+diff --git a/libfprint/drivers/etes603.c b/libfprint/drivers/etes603.c
+index fdaf7f2..0782f9e 100644
+--- a/libfprint/drivers/etes603.c
++++ b/libfprint/drivers/etes603.c
+@@ -35,6 +35,8 @@
+ 
+ #define FP_COMPONENT "etes603"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "driver_ids.h"
+ 
+diff --git a/libfprint/drivers/upeksonly.c b/libfprint/drivers/upeksonly.c
+index 9cccb86..e035408 100644
+--- a/libfprint/drivers/upeksonly.c
++++ b/libfprint/drivers/upeksonly.c
+@@ -25,6 +25,8 @@
+ 
+ #define FP_COMPONENT "upeksonly"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "upeksonly.h"
+ 
+diff --git a/libfprint/drivers/upektc.c b/libfprint/drivers/upektc.c
+index ffa31f3..e4d7de5 100644
+--- a/libfprint/drivers/upektc.c
++++ b/libfprint/drivers/upektc.c
+@@ -20,6 +20,8 @@
+ 
+ #define FP_COMPONENT "upektc"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "upektc.h"
+ 
+diff --git a/libfprint/drivers/upektc_img.c b/libfprint/drivers/upektc_img.c
+index f0f2f18..a500623 100644
+--- a/libfprint/drivers/upektc_img.c
++++ b/libfprint/drivers/upektc_img.c
+@@ -19,6 +19,8 @@
+ 
+ #define FP_COMPONENT "upektc_img"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "aeslib.h"
+ #include "upektc_img.h"
+diff --git a/libfprint/drivers/upekts.c b/libfprint/drivers/upekts.c
+index b448e36..1094e66 100644
+--- a/libfprint/drivers/upekts.c
++++ b/libfprint/drivers/upekts.c
+@@ -27,6 +27,8 @@
+ 
+ #define FP_COMPONENT "upekts"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ 
+ #define EP_IN (1 | LIBUSB_ENDPOINT_IN)
+diff --git a/libfprint/drivers/vfs0050.c b/libfprint/drivers/vfs0050.c
+index dcf5d69..60a720e 100644
+--- a/libfprint/drivers/vfs0050.c
++++ b/libfprint/drivers/vfs0050.c
+@@ -19,6 +19,8 @@
+ 
+ #define FP_COMPONENT "vfs0050"
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "vfs0050.h"
+ 
+diff --git a/libfprint/drivers/vfs101.c b/libfprint/drivers/vfs101.c
+index 3304b1f..473adf2 100644
+--- a/libfprint/drivers/vfs101.c
++++ b/libfprint/drivers/vfs101.c
+@@ -19,6 +19,9 @@
+ 
+ #define FP_COMPONENT "vfs101"
+ 
++#include <stdlib.h>
++#include <string.h>
++
+ #include "drivers_api.h"
+ 
+ /* Input-Output usb endpoint */
+diff --git a/libfprint/drivers/vfs301.c b/libfprint/drivers/vfs301.c
+index a34ee31..6f52316 100644
+--- a/libfprint/drivers/vfs301.c
++++ b/libfprint/drivers/vfs301.c
+@@ -21,6 +21,9 @@
+ 
+ #define FP_COMPONENT "vfs301"
+ 
++#include <stdlib.h>
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "vfs301_proto.h"
+ 
+diff --git a/libfprint/drivers/vfs5011.c b/libfprint/drivers/vfs5011.c
+index 8b460ac..1355394 100644
+--- a/libfprint/drivers/vfs5011.c
++++ b/libfprint/drivers/vfs5011.c
+@@ -18,6 +18,8 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+  */
+ 
++#include <string.h>
++
+ #include "drivers_api.h"
+ #include "vfs5011_proto.h"
+ 
+-- 
+2.16.4
diff --git a/sys-auth/libfprint/libfprint-0.99.0.ebuild b/sys-auth/libfprint/libfprint-0.99.0.ebuild
new file mode 100644
index 000000000000..5ddac2ec6a44
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-0.99.0.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint"
+SRC_URI="https://github.com/freedesktop/libfprint/archive/V_$(ver_rs 0-3 '_').tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~ia64 ppc ppc64 sparc x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	 dev-libs/nss
+	 virtual/libusb:1=
+	 x11-libs/gtk+:3
+	 x11-libs/pixman
+	 x11-libs/libX11
+	 x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-V_$(ver_rs 0-3 '_')"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dx11-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/libfprint/libfprint-1.0.ebuild b/sys-auth/libfprint/libfprint-1.0.ebuild
new file mode 100644
index 000000000000..b3d49b6892ca
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-1.0.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint"
+SRC_URI="https://github.com/freedesktop/libfprint/archive/V_$(ver_rs 0-3 '_').tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	 dev-libs/nss
+	 virtual/libusb:1=
+	 x11-libs/gtk+:3
+	 x11-libs/pixman
+	 x11-libs/libX11
+	 x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-V_$(ver_rs 0-3 '_')"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dx11-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/libfprint/libfprint-1.90.0.ebuild b/sys-auth/libfprint/libfprint-1.90.0.ebuild
new file mode 100644
index 000000000000..67d5a6c7c811
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-1.90.0.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint"
+SRC_URI="https://github.com/freedesktop/libfprint/archive/V_$(ver_rs 0-3 "_").tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	dev-libs/nss
+	>=dev-libs/libgusb-0.3.1
+	virtual/libusb:1=
+	x11-libs/gtk+:3
+	x11-libs/pixman
+	x11-libs/libX11
+	x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-V_$(ver_rs 0-3 '_')"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dgtk-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/libfprint/libfprint-1.90.1.ebuild b/sys-auth/libfprint/libfprint-1.90.1.ebuild
new file mode 100644
index 000000000000..311455ba8c5a
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-1.90.1.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint https://gitlab.freedesktop.org/libfprint/libfprint"
+SRC_URI="https://gitlab.freedesktop.org/libfprint/libfprint/-/archive/v${PV}/${PN}-v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	dev-libs/nss
+	>=dev-libs/libgusb-0.3.1
+	virtual/libusb:1=
+	x11-libs/gtk+:3
+	x11-libs/pixman
+	x11-libs/libX11
+	x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-v${PV}"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dgtk-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/libfprint/libfprint-1.90.2.ebuild b/sys-auth/libfprint/libfprint-1.90.2.ebuild
new file mode 100644
index 000000000000..311455ba8c5a
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-1.90.2.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint https://gitlab.freedesktop.org/libfprint/libfprint"
+SRC_URI="https://gitlab.freedesktop.org/libfprint/libfprint/-/archive/v${PV}/${PN}-v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	dev-libs/nss
+	>=dev-libs/libgusb-0.3.1
+	virtual/libusb:1=
+	x11-libs/gtk+:3
+	x11-libs/pixman
+	x11-libs/libX11
+	x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-v${PV}"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dgtk-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/libfprint/metadata.xml b/sys-auth/libfprint/metadata.xml
new file mode 100644
index 000000000000..671dd524ae6f
--- /dev/null
+++ b/sys-auth/libfprint/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+	<email>zlogene@gentoo.org</email>
+	<name>Mikle Kolyada</name>
+</maintainer>
+<upstream>
+	<bugs-to>https://bugs.freedesktop.org/enter_bug.cgi?product=libfprint</bugs-to>
+</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libnss-cache/Manifest b/sys-auth/libnss-cache/Manifest
new file mode 100644
index 000000000000..be12312df58a
--- /dev/null
+++ b/sys-auth/libnss-cache/Manifest
@@ -0,0 +1 @@
+DIST libnss-cache-0.10.2.tar.gz 11967 BLAKE2B c0954d4382dba25d50fa5749acc11d4bf46175f686b2137539aa6fdb0ba4fabf5fe017e13abc518aaed8f315fac28ad4a85e9019b445595b137428bfee3f4623 SHA512 453624e85ff2692f0724f578ad72df76c96ecb2657eb3a701349025811af4e0c3ecf8e42c35a9a4eddabf4e731c361f4235d7cef34a61aec2e80e1b8728ea98f
diff --git a/sys-auth/libnss-cache/files/libnss-cache-0.10-fix-shadow-test.patch b/sys-auth/libnss-cache/files/libnss-cache-0.10-fix-shadow-test.patch
new file mode 100644
index 000000000000..e68546c603a2
--- /dev/null
+++ b/sys-auth/libnss-cache/files/libnss-cache-0.10-fix-shadow-test.patch
@@ -0,0 +1,12 @@
+diff -Nuar libnss-cache-0.10.orig//gen_getent.c libnss-cache-0.10//gen_getent.c
+--- libnss-cache-0.10.orig//gen_getent.c	2011-01-10 19:56:01.000000000 +0000
++++ libnss-cache-0.10//gen_getent.c	2011-01-13 06:43:05.475875153 +0000
+@@ -133,7 +133,7 @@
+   int errnop;
+   enum nss_status ret;
+   
+-  _nss_cache_setpwent_path(SHADOW_FILE);
++  _nss_cache_setspent_path(SHADOW_FILE);
+ 
+   buffer = malloc(buflen);
+   
diff --git a/sys-auth/libnss-cache/files/libnss-cache-0.10.1-make.patch b/sys-auth/libnss-cache/files/libnss-cache-0.10.1-make.patch
new file mode 100644
index 000000000000..b1ba149529c3
--- /dev/null
+++ b/sys-auth/libnss-cache/files/libnss-cache-0.10.1-make.patch
@@ -0,0 +1,49 @@
+diff --git a/Makefile b/Makefile
+index 1e34d3b..563e467 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,16 +1,16 @@
+-CC=gcc
++CC?=gcc
+ #CFLAGS=-Wall -Wstrict-prototypes -Werror -fPIC -DDEBUG -g -O0
+-CFLAGS=-Wall -Wstrict-prototypes -Werror -fPIC
++CFLAGS+=-Wall -Wstrict-prototypes -fPIC
+ LIBRARY=libnss_cache.so.2.0
+ LINKS=libnss_cache.so.2 libnss_cache.so
+-DESTDIR=/
+-PREFIX=$(DESTDIR)/usr
++DESTDIR?=
++PREFIX?=$(DESTDIR)/usr
+ BUILD=.libs
+ BUILD64=.libs64
+ BUILD32=.libs32
+-LIBDIR=$(PREFIX)/lib
+-LIBDIR64=$(PREFIX)/lib64
+-LIBDIR32=$(PREFIX)/lib32
++LIBDIR?=$(PREFIX)/lib
++LIBDIR64?=$(PREFIX)/lib64
++LIBDIR32?=$(PREFIX)/lib32
+ SONAME=libnss_cache.so.2
+ LD_SONAME=-Wl,-soname,$(SONAME)
+ TESTBIN=.testbin
+@@ -97,17 +97,17 @@ install_amd64: install32
+ nss_cache:
+ 	[ -d $(BUILD) ] || mkdir $(BUILD)
+ 	$(CC) $(CFLAGS) -c nss_cache.c -o $(BUILD)/nss_cache.o
+-	$(CC) -shared $(LD_SONAME) -o $(BUILD)/$(LIBRARY) $(BUILD)/nss_cache.o
++	$(CC) $(LDFLAGS) -shared $(LD_SONAME) -o $(BUILD)/$(LIBRARY) $(BUILD)/nss_cache.o
+ 
+ nss_cache64: nss_cache
+ 	[ -d $(BUILD64) ] || mkdir $(BUILD64)
+ 	$(CC) $(CFLAGS) -m64 -c nss_cache.c -o $(BUILD64)/nss_cache.o
+-	$(CC) -m64 -shared $(LD_SONAME) -o $(BUILD64)/$(LIBRARY) $(BUILD64)/nss_cache.o
++	$(CC) $(LDFLAGS) -m64 -shared $(LD_SONAME) -o $(BUILD64)/$(LIBRARY) $(BUILD64)/nss_cache.o
+ 
+ nss_cache32: nss_cache
+ 	[ -d $(BUILD32) ] || mkdir $(BUILD32)
+ 	$(CC) $(CFLAGS) -m32 -c nss_cache.c -o $(BUILD32)/nss_cache.o
+-	$(CC) -m32 -shared $(LD_SONAME) -o $(BUILD32)/$(LIBRARY) $(BUILD32)/nss_cache.o
++	$(CC) $(LDFLAGS) -m32 -shared $(LD_SONAME) -o $(BUILD32)/$(LIBRARY) $(BUILD32)/nss_cache.o
+ 
+ clean:
+ 	rm -rf $(BUILD)
diff --git a/sys-auth/libnss-cache/libnss-cache-0.10.2.ebuild b/sys-auth/libnss-cache/libnss-cache-0.10.2.ebuild
new file mode 100644
index 000000000000..0ad34429a489
--- /dev/null
+++ b/sys-auth/libnss-cache/libnss-cache-0.10.2.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit multilib-minimal toolchain-funcs
+
+DESCRIPTION="libnss-cache is a library that serves nss lookups"
+HOMEPAGE="https://github.com/google/nsscache"
+SRC_URI="https://nsscache.googlecode.com/files/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.10.1-make.patch
+	"${FILESDIR}"/${PN}-0.10-fix-shadow-test.patch
+)
+
+src_prepare() {
+	default
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	emake CC="$(tc-getCC)" nss_cache
+}
+
+multilib_src_install() {
+	emake DESTDIR="${ED}" LIBDIR="${ED%/}/usr/$(get_libdir)" install
+}
diff --git a/sys-auth/libnss-cache/metadata.xml b/sys-auth/libnss-cache/metadata.xml
new file mode 100644
index 000000000000..1aad40553ba3
--- /dev/null
+++ b/sys-auth/libnss-cache/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="google-code">nsscache</remote-id>
+		<remote-id type="github">google/nsscache</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libnss-compat/Manifest b/sys-auth/libnss-compat/Manifest
new file mode 100644
index 000000000000..d727f6fa84d0
--- /dev/null
+++ b/sys-auth/libnss-compat/Manifest
@@ -0,0 +1 @@
+DIST libnss_compat-1.2.tar.gz 201392 BLAKE2B d78cbd6df1437f95423c90fd9b0c82a974bb79cdb8e09b3bd2a3273aa417b2a0b9950e2ac76bf0e6a8fe384328f180a3182caab2e6b3ce40704c6cf49ea9a55e SHA512 e488c72d5d13f9749293a91f2bc86c06fcc184c2edb7d9335569bc77c7aea1d2874de1d83b13f394f3d0881ec368b5749cf9a5c60f362f7c4c428026c2fc0e53
diff --git a/sys-auth/libnss-compat/libnss-compat-1.2.ebuild b/sys-auth/libnss-compat/libnss-compat-1.2.ebuild
new file mode 100644
index 000000000000..ea92eb8bdf8d
--- /dev/null
+++ b/sys-auth/libnss-compat/libnss-compat-1.2.ebuild
@@ -0,0 +1,44 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools multilib-minimal
+
+DESCRIPTION="NSS module to provide compat entry support"
+HOMEPAGE="https://github.com/thkukuk/libnss_compat"
+SRC_URI="https://github.com/thkukuk/libnss_compat/archive/libnss_compat-${PV}.tar.gz"
+
+LICENSE="LGPL-2.1+ BSD ISC"
+SLOT="0"
+KEYWORDS="~amd64"
+
+RDEPEND="
+	>net-libs/libnsl-0:0=[${MULTILIB_USEDEP}]
+	net-libs/libtirpc:0=[${MULTILIB_USEDEP}]
+	!<sys-libs/glibc-2.26
+	!>=sys-libs/glibc-2.27
+"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+"
+
+S=${WORKDIR}/libnss_compat-libnss_compat-${PV}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-shared
+		--disable-static
+	)
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/libnss-compat/metadata.xml b/sys-auth/libnss-compat/metadata.xml
new file mode 100644
index 000000000000..023723620072
--- /dev/null
+++ b/sys-auth/libnss-compat/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>toolchain@gentoo.org</email>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libnss-mysql/Manifest b/sys-auth/libnss-mysql/Manifest
new file mode 100644
index 000000000000..78b307cdf182
--- /dev/null
+++ b/sys-auth/libnss-mysql/Manifest
@@ -0,0 +1 @@
+DIST libnss-mysql-20060915.tgz 689970 BLAKE2B 147b5bb6c2fb53ca18f6db87054fa6665829671e9abdd7aa439287e301fc2d5ed4c9e2e5968ce6dacb4f74d86debb0c26d5cda56c6fe8f64e92ff3c9eba26a85 SHA512 fc92438b413b175b9bcead222013eab3bf63088a33ece0c4b6cc69edbefb9cc9145138ce786059acf502c2378a2af45588a5a506e45928b9ac600fe05e62e0c7
diff --git a/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-mariadb10.2.patch b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-mariadb10.2.patch
new file mode 100644
index 000000000000..b669d01c79f3
--- /dev/null
+++ b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-mariadb10.2.patch
@@ -0,0 +1,35 @@
+--- a/src/mysql.c
++++ b/src/mysql.c
+@@ -196,6 +196,7 @@
+   int retval;
+   sql_server_t *server = &conf.sql.server;
+   unsigned int port;
++  my_bool reconnect = 1;
+ 
+   DENTER
+ 
+@@ -238,8 +239,9 @@
+           DSRETURN (NSS_UNAVAIL)
+         }
+       ci.valid = ntrue;
+-      ci.link.reconnect = 0; /* Safety: We can't let MySQL assume socket is
+-                                still valid; see _nss_mysql_validate_socket */
++      /* Safety: We can't let MySQL assume socket is still valid;
++         see _nss_mysql_validate_socket */
++      mysql_options(&ci.link, MYSQL_OPT_RECONNECT, &reconnect); 
+       DSRETURN (NSS_SUCCESS)
+     }
+   _nss_mysql_log (LOG_ALERT, "Connection to server '%s' failed: %s",
+--- a/src/nss_mysql.h
++++ b/src/nss_mysql.h
+@@ -72,6 +72,10 @@ typedef nss_status_t NSS_STATUS;
+ /* Default initializers */
+ #define DEF_TIMEOUT         3
+
++#if !defined(MARIADB_BASE_VERSION) && MYSQL_VERSION_ID >= 80001
++#define my_bool bool
++#endif
++
+ #ifdef DEBUG
+ void _nss_mysql_debug (char *fmt, ...);
+ #define DEBUG_FILE "/tmp/libnss-mysql-debug.log"
diff --git a/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-multiarch.patch b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-multiarch.patch
new file mode 100644
index 000000000000..3a85b601b7e6
--- /dev/null
+++ b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-multiarch.patch
@@ -0,0 +1,21 @@
+--- libnss-mysql-1.5/acinclude.m4
++++ libnss-mysql-1.5.sal/acinclude.m4
+@@ -80,6 +80,18 @@
+     fi
+ done
+ 
++dnl Test also $libdir path
++if test -f "$libdir/libmysqlclient.so"
++then
++    MYSQL_LIB_DIR="$libdir"
++    break
++fi
++if test -f "$libdir/mysql/libmysqlclient.so"
++then
++    MYSQL_LIB_DIR="$libdir/mysql"
++    break
++fi
++
+ if test -n "$MYSQL_LIB_DIR"
+ then
+     AC_MSG_RESULT([$MYSQL_LIB_DIR])
diff --git a/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-no-automagic-debug.diff b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-no-automagic-debug.diff
new file mode 100644
index 000000000000..292ae9e19476
--- /dev/null
+++ b/sys-auth/libnss-mysql/files/libnss-mysql-1.5_p20060915-no-automagic-debug.diff
@@ -0,0 +1,14 @@
+diff -NuarwPbB libnss-mysql.orig/configure.in libnss-mysql/configure.in
+--- libnss-mysql.orig/configure.in	2005-09-04 03:34:00.000000000 +0000
++++ libnss-mysql/configure.in	2010-09-08 18:12:24.577317098 +0000
+@@ -38,7 +38,9 @@
+ AC_ARG_WITH(mysql,
+             [  --with-mysql=DIR        Location of your MySQL installation])
+ AC_ARG_ENABLE(debug,
+-            [  --enable-debug          Enable debug (see DEBUGGING)],
++            [  --enable-debug          Enable debug (see DEBUGGING)])
++
++AS_IF([test "x$enable_debug" = "xyes"],
+             [AC_DEFINE([DEBUG], 1, [Enable debug])])
+ 
+ case "$target_os" in
diff --git a/sys-auth/libnss-mysql/libnss-mysql-1.5_p20060915-r5.ebuild b/sys-auth/libnss-mysql/libnss-mysql-1.5_p20060915-r5.ebuild
new file mode 100644
index 000000000000..090feab7685a
--- /dev/null
+++ b/sys-auth/libnss-mysql/libnss-mysql-1.5_p20060915-r5.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+KEYWORDS="amd64 ppc ~sparc x86"
+
+DESCRIPTION="NSS MySQL Library"
+HOMEPAGE="http://libnss-mysql.sourceforge.net/"
+SRC_URI="http://libnss-mysql.sourceforge.net/snapshot/${PN}-${PV/1.5_p/}.tgz"
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="debug"
+
+DEPEND="dev-db/mysql-connector-c:="
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}/${PN}"
+
+DOCS=( AUTHORS DEBUGGING FAQ INSTALL NEWS README THANKS
+	TODO UPGRADING ChangeLog
+)
+
+PATCHES=(
+	"${FILESDIR}"/${P}-no-automagic-debug.diff
+	"${FILESDIR}"/${PN}-1.5_p20060915-multiarch.patch
+	"${FILESDIR}"/${PN}-1.5_p20060915-mariadb10.2.patch
+)
+
+src_prepare() {
+	default
+
+	mv configure.{in,ac} || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# Usually, authentication libraries don't belong into usr.
+	# But here, it's required that the lib is in the same dir
+	# as libmysql, because else failures may occur on boot if
+	# udev tries to access a user / group that doesn't exist
+	# on the system before /usr is mounted.
+	econf --libdir="/usr/$(get_libdir)" \
+		$(use_enable debug)
+}
+
+src_install() {
+	default
+
+	find "${ED}" -name '*.la' -delete || die
+
+	newdoc sample/README README.sample
+
+	local subdir
+	for subdir in sample/{linux,freebsd,complex,minimal} ; do
+		docinto "${subdir}"
+		dodoc "${subdir}/"{*.sql,*.cfg}
+	done
+}
diff --git a/sys-auth/libnss-mysql/metadata.xml b/sys-auth/libnss-mysql/metadata.xml
new file mode 100644
index 000000000000..428c6522cc8f
--- /dev/null
+++ b/sys-auth/libnss-mysql/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>mysql-bugs@gentoo.org</email>
+		<name>MySQL</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="sourceforge">libnss-mysql</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libnss-nis/Manifest b/sys-auth/libnss-nis/Manifest
new file mode 100644
index 000000000000..0de62f2428ab
--- /dev/null
+++ b/sys-auth/libnss-nis/Manifest
@@ -0,0 +1,2 @@
+DIST libnss-nis-1.4.tar.gz 209887 BLAKE2B ca9c2d66080568cc7748b4df4b0318687cf9dac5717c84a8e84d033a3a0aa0d59b3159c55ad2e1513e161b40acea59c3df8cddaea1ff4897a0599777179bd7f2 SHA512 56338a1dd60b756fb40e7e08c0d7d49ce98b47f684e7278aaf1a521a74f02b23cc73908adbd6ff88057f2f0e42301f827f888fc7af82aa57ff9449a05de73b75
+DIST libnss-nis-3.1.tar.gz 225933 BLAKE2B 23b0c760f48f2f1bd2bcd6a1d3b2e7da0bc2f186b23f4ff961faf78b76bfbbaaa238a510979b086f279f4c4e25f98d9ae8631e5222dc7479e8c50b0f4572b0da SHA512 fab2d035ef9cea5fa6351c44085a96f9f90e50550b77aa3898e0d5a6ff296951b22b4ac58979d07ae3b3da2f97c7e47ab466e1a5868e7f218971028174159636
diff --git a/sys-auth/libnss-nis/files/libnss-nis-1.4-glibc-2.30.patch b/sys-auth/libnss-nis/files/libnss-nis-1.4-glibc-2.30.patch
new file mode 100644
index 000000000000..ac8d497ecb4c
--- /dev/null
+++ b/sys-auth/libnss-nis/files/libnss-nis-1.4-glibc-2.30.patch
@@ -0,0 +1,157 @@
+From e9f0f4286d5a923eca1a9c84ff125268d144822e Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Thu, 25 Jul 2019 12:10:56 -0700
+Subject: [PATCH] nis-hosts: Remove use of RES_USE_INET6
+
+Upstream glibc dropped it starting glibc 2.30
+see
+https://sourceware.org/git/?p=glibc.git;a=commit;h=3f8b44be0a658266adff5ece1e4bc3ce097a5dbe
+
+Fixes issue #6
+
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/nis-hosts.c | 55 ++++++++++++-------------------------------------
+ 1 file changed, 13 insertions(+), 42 deletions(-)
+
+diff --git a/src/nis-hosts.c b/src/nis-hosts.c
+index 307b46e..bd3c4ad 100644
+--- a/src/nis-hosts.c
++++ b/src/nis-hosts.c
+@@ -35,15 +35,12 @@
+ #include "libc-lock.h"
+ #include "nss-nis.h"
+ 
+-/* Get implementation for some internal functions. */
+-#include "mapv4v6addr.h"
+-
+ #define ENTNAME         hostent
+ #define DATABASE        "hosts"
+ #define NEED_H_ERRNO
+ 
+-#define EXTRA_ARGS      , af, flags
+-#define EXTRA_ARGS_DECL , int af, int flags
++#define EXTRA_ARGS      , af
++#define EXTRA_ARGS_DECL , int af
+ 
+ #define ENTDATA hostent_data
+ struct hostent_data
+@@ -67,19 +64,8 @@ LINE_PARSER
+    /* Parse address.  */
+    if (af != AF_INET6 && inet_pton (AF_INET, addr, entdata->host_addr) > 0)
+      {
+-       assert ((flags & AI_V4MAPPED) == 0 || af != AF_UNSPEC);
+-       if (flags & AI_V4MAPPED)
+-	 {
+-	   map_v4v6_address ((char *) entdata->host_addr,
+-			     (char *) entdata->host_addr);
+-	   result->h_addrtype = AF_INET6;
+-	   result->h_length = IN6ADDRSZ;
+-	 }
+-       else
+-	 {
+-	   result->h_addrtype = AF_INET;
+-	   result->h_length = INADDRSZ;
+-	 }
++       result->h_addrtype = AF_INET;
++       result->h_length = INADDRSZ;
+      }
+    else if (af != AF_INET
+ 	    && inet_pton (AF_INET6, addr, entdata->host_addr) > 0)
+@@ -134,7 +120,7 @@ strong_alias (_nss_nis_sethostent, _nss_nis_endhostent)
+ static enum nss_status
+ internal_nis_gethostent_r (struct hostent *host, char *buffer,
+ 			   size_t buflen, int *errnop, int *h_errnop,
+-			   int af, int flags)
++			   int af)
+ {
+   char *domain;
+   if (yp_get_default_domain (&domain))
+@@ -203,7 +189,7 @@ internal_nis_gethostent_r (struct hostent *host, char *buffer,
+ 	++p;
+       free (result);
+ 
+-      parse_res = parse_line (p, host, data, buflen, errnop, af, flags);
++      parse_res = parse_line (p, host, data, buflen, errnop, af);
+       if (parse_res == -1)
+ 	{
+ 	  free (outkey);
+@@ -232,8 +218,7 @@ _nss_nis_gethostent_r (struct hostent *host, char *buffer, size_t buflen,
+   __libc_lock_lock (lock);
+ 
+   status = internal_nis_gethostent_r (host, buffer, buflen, errnop, h_errnop,
+-			((_res.options & RES_USE_INET6) ? AF_INET6 : AF_INET),
+-			((_res.options & RES_USE_INET6) ? AI_V4MAPPED : 0 ));
++			AF_INET);
+ 
+   __libc_lock_unlock (lock);
+ 
+@@ -244,7 +229,7 @@ _nss_nis_gethostent_r (struct hostent *host, char *buffer, size_t buflen,
+ static enum nss_status
+ internal_gethostbyname2_r (const char *name, int af, struct hostent *host,
+ 			   char *buffer, size_t buflen, int *errnop,
+-			   int *h_errnop, int flags)
++			   int *h_errnop)
+ {
+   uintptr_t pad = -(uintptr_t) buffer % __alignof__ (struct parser_data);
+   buffer += pad;
+@@ -318,7 +303,7 @@ internal_gethostbyname2_r (const char *name, int af, struct hostent *host,
+     ++p;
+   free (result);
+ 
+-  int parse_res = parse_line (p, host, data, buflen, errnop, af, flags);
++  int parse_res = parse_line (p, host, data, buflen, errnop, af);
+ 
+   if (parse_res < 1 || host->h_addrtype != af)
+     {
+@@ -351,8 +336,7 @@ _nss_nis_gethostbyname2_r (const char *name, int af, struct hostent *host,
+     }
+ 
+   return internal_gethostbyname2_r (name, af, host, buffer, buflen, errnop,
+-				    h_errnop,
+-			((_res.options & RES_USE_INET6) ? AI_V4MAPPED : 0));
++				    h_errnop);
+ }
+ 
+ 
+@@ -360,18 +344,8 @@ enum nss_status
+ _nss_nis_gethostbyname_r (const char *name, struct hostent *host, char *buffer,
+ 			  size_t buflen, int *errnop, int *h_errnop)
+ {
+-  if (_res.options & RES_USE_INET6)
+-    {
+-      enum nss_status status;
+-
+-      status = internal_gethostbyname2_r (name, AF_INET6, host, buffer, buflen,
+-					  errnop, h_errnop, AI_V4MAPPED);
+-      if (status == NSS_STATUS_SUCCESS)
+-	return status;
+-    }
+-
+   return internal_gethostbyname2_r (name, AF_INET, host, buffer, buflen,
+-				    errnop, h_errnop, 0);
++				    errnop, h_errnop);
+ }
+ 
+ 
+@@ -433,9 +407,7 @@ _nss_nis_gethostbyaddr_r (const void *addr, socklen_t addrlen, int af,
+     ++p;
+   free (result);
+ 
+-  int parse_res = parse_line (p, host, data, buflen, errnop, af,
+-			      ((_res.options & RES_USE_INET6)
+-			       ? AI_V4MAPPED : 0));
++  int parse_res = parse_line (p, host, data, buflen, errnop, af);
+   if (parse_res < 1)
+     {
+       if (parse_res == -1)
+@@ -532,8 +504,7 @@ _nss_nis_gethostbyname4_r (const char *name, struct gaih_addrtuple **pat,
+   buflen -= pad;
+ 
+   struct hostent host;
+-  int parse_res = parse_line (result, &host, data, buflen, errnop, AF_UNSPEC,
+-			      0);
++  int parse_res = parse_line (result, &host, data, buflen, errnop, AF_UNSPEC);
+   if (parse_res < 1)
+     {
+       if (parse_res == -1)
diff --git a/sys-auth/libnss-nis/libnss-nis-1.4.ebuild b/sys-auth/libnss-nis/libnss-nis-1.4.ebuild
new file mode 100644
index 000000000000..d067904370e6
--- /dev/null
+++ b/sys-auth/libnss-nis/libnss-nis-1.4.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools multilib-minimal
+
+DESCRIPTION="NSS module to provide NIS support"
+HOMEPAGE="https://github.com/thkukuk/libnss_nis"
+SRC_URI="https://github.com/thkukuk/libnss_nis/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1+ BSD ISC"
+SLOT="0"
+KEYWORDS="~amd64 ~riscv"
+
+RDEPEND="
+	>net-libs/libnsl-0:0=[${MULTILIB_USEDEP}]
+	net-libs/libtirpc:0=[${MULTILIB_USEDEP}]
+	!<sys-libs/glibc-2.26
+"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+"
+
+S=${WORKDIR}/libnss_nis-${PV}
+
+PATCHES=( "${FILESDIR}/${P}-glibc-2.30.patch" )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-shared
+		--disable-static
+	)
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/libnss-nis/libnss-nis-3.1.ebuild b/sys-auth/libnss-nis/libnss-nis-3.1.ebuild
new file mode 100644
index 000000000000..ef828c2dd01f
--- /dev/null
+++ b/sys-auth/libnss-nis/libnss-nis-3.1.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools multilib-minimal
+
+DESCRIPTION="NSS module to provide NIS support"
+HOMEPAGE="https://github.com/thkukuk/libnss_nis"
+SRC_URI="https://github.com/thkukuk/libnss_nis/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1+ BSD ISC"
+SLOT="0"
+KEYWORDS="~amd64 ~riscv"
+
+RDEPEND="
+	>net-libs/libnsl-0:0=[${MULTILIB_USEDEP}]
+	net-libs/libtirpc:0=[${MULTILIB_USEDEP}]
+	!<sys-libs/glibc-2.26
+"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+"
+
+S=${WORKDIR}/libnss_nis-${PV}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-shared
+		--disable-static
+	)
+	ECONF_SOURCE=${S} econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/libnss-nis/metadata.xml b/sys-auth/libnss-nis/metadata.xml
new file mode 100644
index 000000000000..023723620072
--- /dev/null
+++ b/sys-auth/libnss-nis/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>toolchain@gentoo.org</email>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libnss-pgsql/Manifest b/sys-auth/libnss-pgsql/Manifest
new file mode 100644
index 000000000000..0dd14f29e4f7
--- /dev/null
+++ b/sys-auth/libnss-pgsql/Manifest
@@ -0,0 +1 @@
+DIST libnss-pgsql-1.5.0-beta.tgz 305543 BLAKE2B a902315ba17539ac64caaad31cae68859bab3fff2df77ae23f4486ea6ab25db14e5d5787f4d5fcfb1ddebf0d6c58acbf66052b6d5ad4017aff810ba1bcb9f98b SHA512 cabc09337841aadb27790fb66bb55f7da70b52d4e28c717d83ad63b440ac65d8e72505e602b1324d8091ace8b9fe90510492ce0dec17148b74288a2524726cc8
diff --git a/sys-auth/libnss-pgsql/files/libnss-pgsql-1.5.0_beta-gentoo.patch b/sys-auth/libnss-pgsql/files/libnss-pgsql-1.5.0_beta-gentoo.patch
new file mode 100644
index 000000000000..69aefa8c6064
--- /dev/null
+++ b/sys-auth/libnss-pgsql/files/libnss-pgsql-1.5.0_beta-gentoo.patch
@@ -0,0 +1,44 @@
+Index: libnss-pgsql-1.5.0-beta/src/backend.c
+===================================================================
+--- libnss-pgsql-1.5.0-beta.orig/src/backend.c
++++ libnss-pgsql-1.5.0-beta/src/backend.c
+@@ -11,7 +11,7 @@
+  */
+ 
+ #include "nss-pgsql.h"
+-#include <postgresql/libpq-fe.h>
++#include <libpq-fe.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <stdio.h>
+Index: libnss-pgsql-1.5.0-beta/doc/Makefile.am
+===================================================================
+--- libnss-pgsql-1.5.0-beta.orig/doc/Makefile.am
++++ libnss-pgsql-1.5.0-beta/doc/Makefile.am
+@@ -1,14 +1,6 @@
+ TARGETS	= nss-pgsql.html
+ 
+-all html: $(TARGETS)
+-
+-install-data-local: $(TARGETS)
+-	$(mkinstalldirs) $(DESTDIR)$(docdir)
+-	$(INSTALL_DATA) nss-pgsql.html $(DESTDIR)$(docdir)
+-	$(INSTALL_DATA) $(srcdir)/caution.png $(DESTDIR)$(docdir)
+-
+-clean-local:
+-	rm -f $(TARGETS)
++html_DATA = $(TARGETS) caution.png
+ 
+ nss-pgsql.html: config.xsl nss-pgsql.xml
+ 	xmlto xhtml-nochunks -m $(srcdir)/config.xsl $(srcdir)/nss-pgsql.xml
+Index: libnss-pgsql-1.5.0-beta/src/Makefile.am
+===================================================================
+--- libnss-pgsql-1.5.0-beta.orig/src/Makefile.am
++++ libnss-pgsql-1.5.0-beta/src/Makefile.am
+@@ -1,5 +1,5 @@
+ lib_LTLIBRARIES = libnss_pgsql.la
+ libnss_pgsql_la_SOURCES = interface.c config.c backend.c util.c
+-libnss_pgsql_la_LDFLAGS = -module -version-info 2
++libnss_pgsql_la_LDFLAGS = -module -version-info 2 -shared
+ EXTRA_DIST = nss-pgsql.h
+ 
diff --git a/sys-auth/libnss-pgsql/libnss-pgsql-1.5.0_beta-r1.ebuild b/sys-auth/libnss-pgsql/libnss-pgsql-1.5.0_beta-r1.ebuild
new file mode 100644
index 000000000000..cbf21a095fd5
--- /dev/null
+++ b/sys-auth/libnss-pgsql/libnss-pgsql-1.5.0_beta-r1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+KEYWORDS="~amd64 ~x86"
+
+DESCRIPTION="Name Service Switch module for use with PostgreSQL"
+HOMEPAGE="http://pgfoundry.org/projects/sysauth/"
+
+MY_P="${P/_/-}"
+SRC_URI="http://pgfoundry.org/frs/download.php/1878/${MY_P}.tgz"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE=""
+
+RDEPEND="dev-db/postgresql:*"
+DEPEND="${RDEPEND}
+		app-text/xmlto"
+
+src_prepare() {
+	eapply "${FILESDIR}/${P}-gentoo.patch"
+	eapply_user
+	eautoreconf
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	find "${D}" -name '*.la' -delete || die
+
+	dodoc AUTHORS ChangeLog NEWS README
+	docinto examples
+	dodoc conf/*
+}
+
+pkg_postinst() {
+	elog "Next steps:"
+	elog "1. Create the required tables in the database:"
+	elog "   $ psql a_database -f /usr/share/doc/${PF}/examples/dbschema.sql"
+	elog "2. Create the configuration file '/etc/nss-pgsql.conf'"
+	elog "   You can copy the example from /usr/share/doc/${PF}/examples/nss-pgsql.conf"
+	elog "3. Edit /etc/nsswitch.conf to use the NSS service 'pgsql'"
+	elog "   An example is available here: /usr/share/doc/${PF}/examples/nsswitch.conf"
+}
diff --git a/sys-auth/libnss-pgsql/metadata.xml b/sys-auth/libnss-pgsql/metadata.xml
new file mode 100644
index 000000000000..4d02b3f822e7
--- /dev/null
+++ b/sys-auth/libnss-pgsql/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>pgsql-bugs@gentoo.org</email>
+	<name>PostgreSQL and Related Package Development</name>
+</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/libyubikey/Manifest b/sys-auth/libyubikey/Manifest
new file mode 100644
index 000000000000..34a92ca92a31
--- /dev/null
+++ b/sys-auth/libyubikey/Manifest
@@ -0,0 +1 @@
+DIST libyubikey-1.13.tar.gz 347337 BLAKE2B 99bbcc16115d913ffd548625f3366405879b0537c4dbcb9f6cebc406a057de642ae621d5793f1828056bfac266eb56b9a409cde44eb26753f955c9da6bcf8c0e SHA512 28f45cb9817c30a70d168ae507d3f8014051058d730eed92b31d92e96784138dea291bda4275511c5f92a6427cb4249d76c802b8abb867cec50e62fb770950f2
diff --git a/sys-auth/libyubikey/libyubikey-1.13.ebuild b/sys-auth/libyubikey/libyubikey-1.13.ebuild
new file mode 100644
index 000000000000..39900d5ff3be
--- /dev/null
+++ b/sys-auth/libyubikey/libyubikey-1.13.ebuild
@@ -0,0 +1,18 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils autotools-utils
+
+DESCRIPTION="Yubico C low-level library"
+HOMEPAGE="https://github.com/Yubico/yubico-c"
+#http://opensource.yubico.com/yubico-c/releases.html
+SRC_URI="http://opensource.yubico.com/yubico-c/releases/${P}.tar.gz"
+
+SLOT="0"
+LICENSE="BSD-2"
+KEYWORDS="amd64 ~arm64 x86"
+IUSE="static-libs"
+
+DOCS=( AUTHORS ChangeLog NEWS README THANKS )
diff --git a/sys-auth/libyubikey/metadata.xml b/sys-auth/libyubikey/metadata.xml
new file mode 100644
index 000000000000..5339f2152ab6
--- /dev/null
+++ b/sys-auth/libyubikey/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>gokturk@gentoo.org</email>
+    <name>Göktürk Yüksek</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="google-code">yubico-c</remote-id>
+    <remote-id type="github">Yubico/yubico-c</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/metadata.xml b/sys-auth/metadata.xml
new file mode 100644
index 000000000000..4b8897c1fd72
--- /dev/null
+++ b/sys-auth/metadata.xml
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<catmetadata>
+	<longdescription lang="en">
+		The sys-auth category contains applications and libraries to support
+		authentication and authorization facilities.
+		Here belongs PAM modules, NSS modules and login apps.
+	</longdescription>
+	<longdescription lang="ja">
+		sys-authカテゴリには確認を採用するアプリケーションとライブラリが
+		含まれます。これはPAMとNSSモジュールとログインアプリケーションの場所です。
+	</longdescription>
+	<longdescription lang="vi">
+		Nhóm sys-auth chứa các ứng dụng và thư viện hỗ trợ xác thực và phân quyền.
+		Ở đây bao gồm các module PAM, NSS và các ứng dụng đăng nhập.
+	</longdescription>
+	<longdescription lang="de">
+		Die Kategorie sys-auth enthält Programme und Bibliotheken die Funktionen
+		zur Authentifizierung und Authorisierung zur Verfügung stellen. Module für PAM 
+		und NSS sowie Loginapplikationen finden sich hier.
+	</longdescription>
+	<longdescription lang="it">
+		La categoria sys-auth contiene applicazioni e librerie di supporto per
+		gli strumenti di autenticazione e autorizzazione. Appartengono a questa categoria
+		i moduli PAM, i moduli NSS e le applicazioni di login.
+	</longdescription>
+	<longdescription lang="pt">
+		A categoria sys-auth contém aplicações e bibliotecas para
+		suportar instrumentos de autenticação e autorização.
+		Nesta categoria pertencem módulos de PAM, módulos de NSS e
+		aplicações de login.
+	</longdescription>
+	<longdescription lang="pl">
+		Kategoria sys-auth zawiera biblioteki oraz programy związane z
+		autoryzacją i uwierzytelnianiem. Znajdują się tu moduły PAM, NSS oraz
+		aplikacje służące do logowania.
+	</longdescription>
+	<longdescription lang="es">
+		La categoría sys-auth contiene aplicaciones y librerías para dar
+		soporte a los servicios de autenticación y autorización.
+		A esta categoría pertenecen los módulos PAM, NSS y las aplicaciones
+		para ingresar en el sistema.
+	</longdescription>
+</catmetadata>
diff --git a/sys-auth/munge/Manifest b/sys-auth/munge/Manifest
new file mode 100644
index 000000000000..5a684b9ed3a1
--- /dev/null
+++ b/sys-auth/munge/Manifest
@@ -0,0 +1 @@
+DIST munge-0.5.13.tar.xz 389952 BLAKE2B 67887469dccf0f4e136a3fba12660dd8d0bfbd5d5024582c6be164b7e837959380ee9d09055ea95db2a307b1da75a8e7c643844fceb56b8a35f59ab7b1b811d8 SHA512 2e024c0438f9208379a037daabd1c31f206820ab74a410e2bb69870755e99f9c9fbf60c294c96941008bc43425fbb31dd2374e5f088b7978479e7c65816e9002
diff --git a/sys-auth/munge/files/munged.confd b/sys-auth/munge/files/munged.confd
new file mode 100644
index 000000000000..8ab2f69284a3
--- /dev/null
+++ b/sys-auth/munge/files/munged.confd
@@ -0,0 +1,13 @@
+# Specify secret key file.  If the keyfile does not already exist
+# it will be created on first startup using pseudorandom data via
+# dd if=/dev/urandom bs=1 count=1024 >/etc/munge/munge.key
+KEYFILE="/etc/munge/munge.key"
+
+# Specify whether to check "/etc/group" mtime
+GROUP_CHECK_MTIME=1
+
+# Specify seconds between group info updates
+GROUP_UPDATE_TIME=3600
+
+# Specify number of threads to spawn
+NUM_THREADS=2
diff --git a/sys-auth/munge/files/munged.initd b/sys-auth/munge/files/munged.initd
new file mode 100644
index 000000000000..0cbbe7213a93
--- /dev/null
+++ b/sys-auth/munge/files/munged.initd
@@ -0,0 +1,48 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	after localmount
+}
+
+check_key() {
+	[ -s "${KEYFILE}" ] && return 0
+	local old_umask=$(umask)
+	local ret
+	umask 037
+	dd if=/dev/urandom bs=1024 count=1 of="${KEYFILE}" 2>/dev/null; ret=$?
+	umask $old_umask
+	return $ret
+}
+
+start() {
+	ebegin "Starting munged"
+	if ! check_key; then
+		eerror "Failed to create munge key"
+		eend 1 && exit 1
+	fi
+	checkpath -d -m 755 -o munge:munge /run/munge
+	checkpath -d -m 711 -o munge:munge /var/lib/munge
+	checkpath -d -m 700 -o munge:munge /var/log/munge
+	checkpath -f -m 600 -o munge:munge "${KEYFILE}"
+	start-stop-daemon -S /usr/sbin/munged \
+		--user munge \
+		--group munge \
+		--pidfile /run/munge/munged.pid \
+		-- \
+		--log-file=/var/log/munge/munged.log \
+		--key-file="${KEYFILE}" \
+		--group-check-mtime="${GROUP_CHECK_MTIME}" \
+		--group-update-time="${GROUP_UPDATE_TIME}" \
+		--num-threads="${NUM_THREADS}"
+	eend ${?}
+}
+
+stop() {
+	ebegin "Stopping munged"
+	start-stop-daemon -K /usr/sbin/munged \
+		--pidfile /run/munge/munged.pid
+	eend ${?}
+}
+
diff --git a/sys-auth/munge/metadata.xml b/sys-auth/munge/metadata.xml
new file mode 100644
index 000000000000..9bdb38c2e691
--- /dev/null
+++ b/sys-auth/munge/metadata.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>cluster@gentoo.org</email>
+		<name>Gentoo Cluster Project</name>
+	</maintainer>
+	<use>
+		<flag name="gcrypt">Use libgcrypt instead of openssl</flag>
+	</use>
+	<longdescription>MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating
+	and validating credentials. It is designed to be highly scalable for use in
+	an HPC cluster environment. It allows a process to authenticate the UID and
+	GID of another local or remote process within a group of hosts having common
+	users and groups. These hosts form a security realm that is defined by a
+	shared cryptographic key. Clients within this security realm can create and
+	validate credentials without the use of root privileges, reserved ports, or
+	platform-specific methods.</longdescription>
+	<upstream>
+		<remote-id type="google-code">munge</remote-id>
+		<remote-id type="github">dun/munge</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/munge/munge-0.5.13-r1.ebuild b/sys-auth/munge/munge-0.5.13-r1.ebuild
new file mode 100644
index 000000000000..549abcb18236
--- /dev/null
+++ b/sys-auth/munge/munge-0.5.13-r1.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools user prefix
+
+DESCRIPTION="An authentication service for creating and validating credentials"
+HOMEPAGE="https://github.com/dun/munge"
+SRC_URI="https://github.com/dun/munge/releases/download/munge-${PV}/munge-${PV}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha amd64 hppa ~ia64 ~mips ppc ppc64 sparc x86"
+IUSE="debug gcrypt static-libs"
+
+DEPEND="
+	app-arch/bzip2
+	sys-libs/zlib
+	gcrypt? ( dev-libs/libgcrypt:0 )
+	!gcrypt? ( dev-libs/openssl:0= )"
+RDEPEND="${DEPEND}"
+
+pkg_setup() {
+	enewgroup munge
+	enewuser munge -1 -1 /var/lib/munge munge
+}
+
+src_prepare() {
+	default
+
+	hprefixify config/x_ac_path_openssl.m4
+
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--localstatedir="${EPREFIX}"/var \
+		--with-crypto-lib=$(usex gcrypt libgcrypt openssl) \
+		$(use_enable debug) \
+		$(use_enable static-libs static)
+}
+
+src_install() {
+	local d
+
+	default
+
+	# 450830
+	if [ -d "${ED}"/var/run ]; then
+		rm -rf "${ED}"/var/run || die
+	fi
+
+	dodir /etc/munge
+
+	for d in "init.d" "default" "sysconfig"; do
+		if [ -d "${ED}"/etc/${d} ]; then
+			rm -r "${ED}"/etc/${d} || die
+		fi
+	done
+
+	newconfd "$(prefixify_ro "${FILESDIR}"/${PN}d.confd)" ${PN}d
+	newinitd "$(prefixify_ro "${FILESDIR}"/${PN}d.initd)" ${PN}d
+
+	if ! use static-libs; then
+		find "${D}" -name '*.la' -delete || die
+	fi
+}
diff --git a/sys-auth/nss-mdns/Manifest b/sys-auth/nss-mdns/Manifest
new file mode 100644
index 000000000000..349b16521558
--- /dev/null
+++ b/sys-auth/nss-mdns/Manifest
@@ -0,0 +1 @@
+DIST nss-mdns-0.14.1.tar.gz 369978 BLAKE2B d1539ff5c1830a120d6ed4fafa36aa6effb9bb973b275317f5d8f4515aad7d2f69f095296a6b95ad8cc19d6eeb076b19b7987c5eabf29fd21f54cfe4a652ed3a SHA512 7c06b984443881a6c0a1f850ee33f14780562cc6168fe1cda176303eb799ece510d51d3830928616723bb95250ad6462978cd8b857f2b79d87116da2c1aeaa5e
diff --git a/sys-auth/nss-mdns/files/mdns.allow b/sys-auth/nss-mdns/files/mdns.allow
new file mode 100644
index 000000000000..80b49b097b03
--- /dev/null
+++ b/sys-auth/nss-mdns/files/mdns.allow
@@ -0,0 +1,3 @@
+# mdns.allow:
+.local.
+.local
diff --git a/sys-auth/nss-mdns/metadata.xml b/sys-auth/nss-mdns/metadata.xml
new file mode 100644
index 000000000000..52d7a6c46955
--- /dev/null
+++ b/sys-auth/nss-mdns/metadata.xml
@@ -0,0 +1,21 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>amynka@gentoo.org</email>
+	</maintainer>
+	<maintainer type="person">
+		<email>mgorny@gentoo.org</email>
+		<name>Michał Górny</name>
+	</maintainer>
+	<longdescription lang="en">
+		Name service switch module for multicast dns.
+	</longdescription>
+	<longdescription lang="ja">
+		マルチキャスト DNS 向けネーム・サービス・スイッチのモジュールです。
+	</longdescription>
+	<upstream>
+		<remote-id type="github">lathiat/nss-mdns</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/nss-mdns/nss-mdns-0.14.1.ebuild b/sys-auth/nss-mdns/nss-mdns-0.14.1.ebuild
new file mode 100644
index 000000000000..fcab1f1874b5
--- /dev/null
+++ b/sys-auth/nss-mdns/nss-mdns-0.14.1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit multilib-minimal
+
+DESCRIPTION="Name Service Switch module for Multicast DNS"
+HOMEPAGE="https://github.com/lathiat/nss-mdns"
+SRC_URI="https://github.com/lathiat/nss-mdns/releases/download/v${PV}/${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 ~arm ~hppa ~mips ppc x86"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=net-dns/avahi-0.6.31-r2[${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}
+	test? ( >=dev-libs/check-0.11[${MULTILIB_USEDEP}] )"
+
+multilib_src_configure() {
+	local myconf=(
+		# $(localstatedir)/run/... is used to locate avahi-daemon socket
+		--localstatedir=/var
+
+		$(use_enable test tests)
+	)
+
+	ECONF_SOURCE=${S} \
+	econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	dodoc *.md
+
+	insinto /etc
+	doins "${FILESDIR}"/mdns.allow
+}
+
+pkg_postinst() {
+	ewarn "You have to modify your name service switch look up file to enable"
+	ewarn "multicast DNS lookups.  If you wish to resolve only IPv6 addresses"
+	ewarn "use mdns6.  For IPv4 addresses only, use mdns4.  To resolve both"
+	ewarn "use mdns.  Keep in mind that mdns will be slower if there are no"
+	ewarn "IPv6 addresses published via mDNS on the network.  There are also"
+	ewarn "minimal (mdns?_minimal) libraries which only lookup .local hosts"
+	ewarn "and 169.254.x.x addresses."
+	ewarn
+	ewarn "Add the appropriate mdns into the hosts line in /etc/nsswitch.conf."
+	ewarn "An example line looks like:"
+	ewarn "hosts:	files mdns4_minimal [NOTFOUND=return] dns mdns4"
+	ewarn
+	ewarn "If you want to perform mDNS lookups for domains other than the ones"
+	ewarn "ending in .local, add them to /etc/mdns.allow."
+}
diff --git a/sys-auth/nss-mdns/nss-mdns-9999.ebuild b/sys-auth/nss-mdns/nss-mdns-9999.ebuild
new file mode 100644
index 000000000000..532c36ea0f69
--- /dev/null
+++ b/sys-auth/nss-mdns/nss-mdns-9999.ebuild
@@ -0,0 +1,62 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+EGIT_REPO_URI="https://github.com/lathiat/nss-mdns"
+inherit autotools git-r3 multilib-minimal
+
+DESCRIPTION="Name Service Switch module for Multicast DNS"
+HOMEPAGE="https://github.com/lathiat/nss-mdns"
+SRC_URI=""
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS=""
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=net-dns/avahi-0.6.31-r2[${MULTILIB_USEDEP}]"
+DEPEND="${RDEPEND}
+	test? ( >=dev-libs/check-0.11[${MULTILIB_USEDEP}] )"
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		# $(localstatedir)/run/... is used to locate avahi-daemon socket
+		--localstatedir=/var
+
+		$(use_enable test tests)
+	)
+
+	ECONF_SOURCE=${S} \
+	econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	dodoc *.md
+
+	insinto /etc
+	doins "${FILESDIR}"/mdns.allow
+}
+
+pkg_postinst() {
+	ewarn "You have to modify your name service switch look up file to enable"
+	ewarn "multicast DNS lookups.  If you wish to resolve only IPv6 addresses"
+	ewarn "use mdns6.  For IPv4 addresses only, use mdns4.  To resolve both"
+	ewarn "use mdns.  Keep in mind that mdns will be slower if there are no"
+	ewarn "IPv6 addresses published via mDNS on the network.  There are also"
+	ewarn "minimal (mdns?_minimal) libraries which only lookup .local hosts"
+	ewarn "and 169.254.x.x addresses."
+	ewarn
+	ewarn "Add the appropriate mdns into the hosts line in /etc/nsswitch.conf."
+	ewarn "An example line looks like:"
+	ewarn "hosts:	files mdns4_minimal [NOTFOUND=return] dns mdns4"
+	ewarn
+	ewarn "If you want to perform mDNS lookups for domains other than the ones"
+	ewarn "ending in .local, add them to /etc/mdns.allow."
+}
diff --git a/sys-auth/nss-myhostname/Manifest b/sys-auth/nss-myhostname/Manifest
new file mode 100644
index 000000000000..8672af193e5a
--- /dev/null
+++ b/sys-auth/nss-myhostname/Manifest
@@ -0,0 +1 @@
+DIST nss-myhostname-0.3.tar.gz 330031 BLAKE2B 99b9cc42c8dc5a73afe9dddfad6c05d175246ffb7985fb90b3f1bab96c8b5afde012e41f5770d2671eefd1f86be81b576637994bffb5e00adab7ac2c986c09b7 SHA512 8f14091f887991532bc3cedcdee607c89f403c7869063919c299cdd7ee8207a9759ab9105093bae151a79e08944053598104a59e9987949ee146d742a12e8c34
diff --git a/sys-auth/nss-myhostname/metadata.xml b/sys-auth/nss-myhostname/metadata.xml
new file mode 100644
index 000000000000..e61b3292823c
--- /dev/null
+++ b/sys-auth/nss-myhostname/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>freedesktop-bugs@gentoo.org</email>
+	<name>Gentoo Freedesktop Project</name>
+</maintainer>
+<longdescription lang="en">
+nss-myhostname is a plugin for the GNU Name Service Switch (NSS) functionality
+of the GNU C Library (glibc) providing host name resolution for the locally
+configured system hostname as returned by gethostname(2). Various software
+relies on an always resolvable local host name. When using dynamic hostnames
+this is usually achieved by patching /etc/hosts at the same time as changing
+the host name. This however is not ideal since it requires a writable /etc
+file system and is fragile because the file might be edited by the
+administrator at the same time. nss-myhostname simply returns all locally
+configure public IP addresses, or -- if none are configured -- the IPv4
+address 127.0.0.2 (wich is on the local loopback) and the IPv6 address ::1
+(which is the local host) for whatever system hostname is configured locally.
+Patching /etc/hosts is thus no longer necessary.
+</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/nss-myhostname/nss-myhostname-0.3.ebuild b/sys-auth/nss-myhostname/nss-myhostname-0.3.ebuild
new file mode 100644
index 000000000000..7bbf4b083e36
--- /dev/null
+++ b/sys-auth/nss-myhostname/nss-myhostname-0.3.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="4"
+
+DESCRIPTION="Name Service Switch module for resolving the local hostname"
+HOMEPAGE="http://0pointer.de/lennart/projects/nss-myhostname/"
+SRC_URI="http://0pointer.de/lennart/projects/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~ia64 ppc ppc64 sparc x86"
+IUSE=""
+
+COMMON_DEPEND=""
+RDEPEND="${COMMON_DEPEND}
+	!>=sys-apps/systemd-197"
+DEPEND="${COMMON_DEPEND}"
+
+src_prepare() {
+	# The documentation in doc/ is just the README file in other formats
+	sed -e 's:SUBDIRS *= *doc:SUBDIRS =:' -i Makefile.{am,in} ||
+		die "sed failed"
+}
+
+src_configure() {
+	econf --disable-lynx
+}
+
+pkg_postinst() {
+	elog "You must modify your name service switch lookup file to enable"
+	elog "nss-myhostname. To do so, add 'myhostname' to the hosts line in"
+	elog "/etc/nsswitch.conf"
+	elog
+	elog "An example hosts line looks like this:"
+	elog "hosts:      files dns myhostname"
+	elog
+}
diff --git a/sys-auth/nss-pam-ldapd/Manifest b/sys-auth/nss-pam-ldapd/Manifest
new file mode 100644
index 000000000000..50faf9e717fc
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/Manifest
@@ -0,0 +1 @@
+DIST nss-pam-ldapd-0.9.11.tar.gz 777878 BLAKE2B c2b442786dd788dcf4373939ed52b4585d1821a7168fdd342ded3c99ef9ac8f3e4af0ac360f842b61885c1f2bc2ef85a0ce9ce0c1027bc974d0ba5242505657f SHA512 2b307805667526b85c724e113fe38899eee397e5c8673e89090d4836ce6d0ffcf18dd022d6c20a5e11d4138e736451b841a0f16ba379d524de4faaaf02906645
diff --git a/sys-auth/nss-pam-ldapd/files/nslcd-tmpfiles.conf b/sys-auth/nss-pam-ldapd/files/nslcd-tmpfiles.conf
new file mode 100644
index 000000000000..ac4ee0ad8649
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nslcd-tmpfiles.conf
@@ -0,0 +1 @@
+d /run/nslcd 0755 nslcd nslcd -
diff --git a/sys-auth/nss-pam-ldapd/files/nslcd.init b/sys-auth/nss-pam-ldapd/files/nslcd.init
new file mode 100644
index 000000000000..959fb601f606
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nslcd.init
@@ -0,0 +1,28 @@
+#!/sbin/openrc-run
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+command=/usr/sbin/nslcd
+pidfile=/run/nslcd/nslcd.pid
+extra_commands="checkconfig"
+cfg="/etc/nslcd.conf"
+
+depend() {
+	need net	
+	use dns logger
+}
+
+checkconfig() {
+	if [ ! -f "$cfg" ] ; then
+		eerror "Please create $cfg"
+		eerror "Example config: /usr/share/nss-ldapd/nslcd.conf"
+		return 1
+	fi
+	return 0
+}
+
+start_pre() {
+	checkpath -q -d /run/nslcd -o nslcd:nslcd
+	checkconfig
+	return $?
+}
diff --git a/sys-auth/nss-pam-ldapd/files/nslcd.s6 b/sys-auth/nss-pam-ldapd/files/nslcd.s6
new file mode 100644
index 000000000000..264da009ba11
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nslcd.s6
@@ -0,0 +1,3 @@
+#!/bin/sh
+exec 2>&1
+exec /usr/sbin/nslcd -n
diff --git a/sys-auth/nss-pam-ldapd/files/nslcd.service b/sys-auth/nss-pam-ldapd/files/nslcd.service
new file mode 100644
index 000000000000..b6b167aaed92
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nslcd.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=NSS and PAM LDAP client daemon
+After=network-online.target
+Wants=network-online.target nss-lookup.target syslog.service
+Before=nss-user-lookup.target
+
+[Service]
+Type=forking
+PIDFile=/run/nslcd/nslcd.pid
+ExecStart=/usr/sbin/nslcd
+
+[Install]
+WantedBy=multi-user.target
+RequiredBy=nss-user-lookup.target
diff --git a/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.11-pynslcd-module-paths.patch b/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.11-pynslcd-module-paths.patch
new file mode 100644
index 000000000000..75ad1015afc1
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.11-pynslcd-module-paths.patch
@@ -0,0 +1,25 @@
+diff --git a/pynslcd/pynslcd.py b/pynslcd/pynslcd.py
+index 0691b61..df2ca4a 100755
+--- a/pynslcd/pynslcd.py
++++ b/pynslcd/pynslcd.py
+@@ -30,13 +30,13 @@ import threading
+ import daemon
+ import ldap
+ 
+-import cfg
+-import common
+-import constants
+-import invalidator
+-import mypidfile
+-import search
+-from tio import TIOStream
++import pynslcd.cfg
++import pynslcd.common
++import pynslcd.constants
++import pynslcd.invalidator
++import pynslcd.mypidfile
++import pynslcd.search
++from pynslcd.tio import TIOStream
+ 
+ 
+ # the name of the program
diff --git a/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.4-disable-py3-only-linters.patch b/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.4-disable-py3-only-linters.patch
new file mode 100644
index 000000000000..06dcc2513a39
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/nss-pam-ldapd-0.9.4-disable-py3-only-linters.patch
@@ -0,0 +1,13 @@
+diff --git a/tests/pylint.rc b/tests/pylint.rc
+index 7f0bc13..b66d018 100644
+--- a/tests/pylint.rc
++++ b/tests/pylint.rc
+@@ -19,7 +19,7 @@ enable=
+ # can either give multiple identifier separated by comma (,) or put this option
+ # multiple time (only on the command line, not in the configuration file where
+ # it should appear only once).
+-disable=E1101
++disable=E1101,E1608,E1606,E1601
+ 
+ 
+ [REPORTS]
diff --git a/sys-auth/nss-pam-ldapd/files/pynslcd.init b/sys-auth/nss-pam-ldapd/files/pynslcd.init
new file mode 100644
index 000000000000..3165b02843fc
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/files/pynslcd.init
@@ -0,0 +1,28 @@
+#!/sbin/openrc-run
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+command=/usr/sbin/pynslcd
+pidfile=/run/nslcd/nslcd.pid
+extra_commands="checkconfig"
+cfg="/etc/nslcd.conf"
+
+depend() {
+	need net	
+	use dns logger
+}
+
+checkconfig() {
+	if [ ! -f "$cfg" ] ; then
+		eerror "Please create $cfg"
+		eerror "Example config: /usr/share/nss-ldapd/nslcd.conf"
+		return 1
+	fi
+	return 0
+}
+
+start_pre() {
+	checkpath -q -d /run/nslcd -o nslcd:nslcd
+	checkconfig
+	return $?
+}
diff --git a/sys-auth/nss-pam-ldapd/metadata.xml b/sys-auth/nss-pam-ldapd/metadata.xml
new file mode 100644
index 000000000000..61ef36470855
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/metadata.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>prometheanfire@gentoo.org</email>
+    <name>Matthew Thode</name>
+  </maintainer>
+  <maintainer type="person">
+    <email>chutzpah@gentoo.org</email>
+    <name>Patrick McLean</name>
+  </maintainer>
+  <use>
+    <flag name="utils">Install the command-line utilities</flag>
+    <flag name="pynslcd">Install the python implementation along with the standard implementation</flag>
+  </use>
+  <longdescription lang="en">
+    Provides a Name Service Switch (NSS) module that allows your LDAP
+    server to provide user account, group, host name, alias, netgroup, and
+    basically any other information that you would normally get from /etc
+    flat files or NIS. It also provides a Pluggable Authentication Module
+    (PAM) to do authentication to an LDAP server.
+
+    This is implemented using thin NSS and PAM modules which delegate to a
+    dedicated service (nslcd) that queries the LDAP server with persistent
+    connections, authentication, attribute translation, etc.
+  </longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/nss-pam-ldapd/nss-pam-ldapd-0.9.11-r2.ebuild b/sys-auth/nss-pam-ldapd/nss-pam-ldapd-0.9.11-r2.ebuild
new file mode 100644
index 000000000000..9fb273d5f3cc
--- /dev/null
+++ b/sys-auth/nss-pam-ldapd/nss-pam-ldapd-0.9.11-r2.ebuild
@@ -0,0 +1,163 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=(python3_6 python3_7)
+inherit eutils prefix user python-r1 multilib multilib-minimal systemd s6
+
+DESCRIPTION="NSS module for name lookups using LDAP"
+HOMEPAGE="https://arthurdejong.org/nss-pam-ldapd/"
+SRC_URI="https://arthurdejong.org/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE="debug kerberos +pam pynslcd sasl test +utils"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	net-nds/openldap[${MULTILIB_USEDEP}]
+	sasl? ( dev-libs/cyrus-sasl[${MULTILIB_USEDEP}] )
+	kerberos? ( virtual/krb5[${MULTILIB_USEDEP}] )
+	sys-libs/pam[${MULTILIB_USEDEP}]
+	utils? ( ${PYTHON_DEPS} )
+	pynslcd? (
+		dev-python/python-ldap[${PYTHON_USEDEP}]
+		dev-python/python-daemon[${PYTHON_USEDEP}]
+	)
+	!sys-auth/nss_ldap
+	!sys-auth/pam_ldap"
+RDEPEND="${COMMON_DEP}"
+DEPEND="${COMMON_DEP}
+	test? (
+		${PYTHON_DEPS}
+		dev-python/pylint[${PYTHON_USEDEP}]
+	)
+	sys-devel/automake"
+
+REQUIRED_USE="
+	utils? ( ${PYTHON_REQUIRED_USE} )
+	test? ( ${PYTHON_REQUIRED_USE} pynslcd )"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.9.4-disable-py3-only-linters.patch
+	"${FILESDIR}"/${PN}-0.9.11-pynslcd-module-paths.patch
+)
+
+pkg_setup() {
+	enewgroup nslcd
+	enewuser nslcd -1 -1 -1 nslcd
+}
+
+src_prepare() {
+	cp pynslcd/pynslcd.py "${S}" || die "Copying pynslcd failed"
+
+	default
+	use utils && python_setup
+	touch pynslcd/__init__.py || die "Could not create __init__.py for pynslcd"
+}
+
+multilib_src_configure() {
+	local -a myconf
+
+	myconf=(
+		--disable-utils
+		--enable-warnings
+		--with-ldap-lib=openldap
+		--with-ldap-conf-file=/etc/nslcd.conf
+		--with-nslcd-pidfile=/run/nslcd/nslcd.pid
+		--with-nslcd-socket=/run/nslcd/socket
+		$(usex x86-fbsd '--with-nss-flavour=' '--with-nss-flavour=' 'freebsd' 'glibc')
+		$(use_enable pynslcd)
+		$(use_enable debug)
+		$(use_enable kerberos)
+		$(use_enable pam)
+		$(use_enable sasl)
+	)
+
+	# nss libraries always go in /lib on Gentoo
+	if multilib_is_native_abi ; then
+		myconf+=("--with-pam-seclib-dir=${EPREFIX}/$(get_libdir)/security")
+		myconf+=("--libdir=${EPREFIX}/$(get_libdir)")
+	else
+		myconf+=("--with-pam-seclib-dir=/$(get_libdir)/security")
+		myconf+=("--libdir=/$(get_libdir)")
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	local script
+
+	newinitd "${FILESDIR}"/nslcd.init nslcd
+	s6_install_service nslcd "${FILESDIR}"/nslcd.s6
+
+	insinto /usr/share/nss-pam-ldapd
+	doins "${WORKDIR}/${P}/nslcd.conf"
+
+	fperms o-r /etc/nslcd.conf
+
+	if use utils; then
+		python_moduleinto nslcd
+		python_foreach_impl python_domodule utils/*.py
+
+		for script in chsh getent; do
+			python_foreach_impl python_newscript utils/${script}.py ${script}.ldap
+		done
+	fi
+	if use pynslcd; then
+		rm -rf "${D}"/usr/share/pynslcd
+		python_moduleinto pynslcd
+		python_foreach_impl python_domodule pynslcd/*.py
+		python_scriptinto /usr/sbin
+		python_newscript pynslcd.py pynslcd
+		newinitd "${FILESDIR}"/pynslcd.init pynslcd
+	fi
+
+	systemd_newtmpfilesd "${FILESDIR}"/nslcd-tmpfiles.conf nslcd.conf
+	systemd_newunit "${FILESDIR}"/nslcd.service nslcd.service
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" install
+
+	if use pynslcd; then
+		python_moduleinto pynslcd
+		python_foreach_impl python_domodule pynslcd/*.py
+	fi
+}
+
+python_test() {
+	PYTHONPATH="${S}" emake check
+}
+
+multilib_src_test() {
+	pushd "${BUILD_DIR}"
+	ln -s ../pynslcd/constants.py utils/constants.py
+	python_foreach_impl python_test
+	popd
+}
+
+pkg_postinst() {
+	echo
+	elog "For this to work you must configure /etc/nslcd.conf"
+	elog "This configuration is similar to pam_ldap's /etc/ldap.conf"
+	echo
+	elog "In order to use nss-pam-ldapd, nslcd needs to be running. You can"
+	elog "start it like this:"
+	elog "  # /etc/init.d/nslcd start"
+	echo
+	elog "You can add it to the default runlevel like so:"
+	elog " # rc-update add nslcd default"
+	elog
+	elog "If you have >=sys-apps/openrc-0.16.3, you can also use s6"
+	elog "to supervise this service."
+	elog "To do this, emerge sys-apps/s6 then add nslcd-s6"
+	elog "default runlevel instead of nslcd."
+	elog
+	elog "If you are upgrading, keep in mind that /etc/nss-ldapd.conf"
+	elog " is now named /etc/nslcd.conf"
+	echo
+}
diff --git a/sys-auth/nss_ldap/Manifest b/sys-auth/nss_ldap/Manifest
new file mode 100644
index 000000000000..b0122d9234a3
--- /dev/null
+++ b/sys-auth/nss_ldap/Manifest
@@ -0,0 +1 @@
+DIST nss_ldap-265.tar.gz 280976 BLAKE2B 31b233ef7680204abfb62408141609b9489e133327c787c59afedd9ac41194189bde26d1f3b0a885622f57ec769ddee2bdf7d274b9584d4d5002d1c016c86892 SHA512 c4584682968861dd5880992fe7d11c6005d94f0c17252ab1cda04380fd7a81b419ba7e87d0efa44c24c5ce5bf76b9fd8331034dddb4f1400f132eb2192472077
diff --git a/sys-auth/nss_ldap/files/nss_ldap-249-sasl-compile.patch b/sys-auth/nss_ldap/files/nss_ldap-249-sasl-compile.patch
new file mode 100644
index 000000000000..1e92c9bb6fe5
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-249-sasl-compile.patch
@@ -0,0 +1,11 @@
+--- ldap-nss.c~	2006-02-25 02:43:33.503639826 -0800
++++ ldap-nss.c	2006-02-25 02:50:51.943806612 -0800
+@@ -72,6 +72,8 @@
+ #include <sasl/sasl.h>
+ #elif defined(HAVE_SASL_H)
+ #include <sasl.h>
++#elif defined(HAVE_SASL_SASL_H)
++#include <sasl/sasl.h>
+ #endif
+ 
+ #ifndef HAVE_SNPRINTF
diff --git a/sys-auth/nss_ldap/files/nss_ldap-254-soname.patch b/sys-auth/nss_ldap/files/nss_ldap-254-soname.patch
new file mode 100644
index 000000000000..e832c2f0d218
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-254-soname.patch
@@ -0,0 +1,12 @@
+Set the soname which glibc expects us to have.
+--- nss_ldap-254/configure.in	2007-02-26 16:40:53.000000000 -0500
++++ nss_ldap-254/configure.in	2007-02-26 16:40:47.000000000 -0500
+@@ -92,7 +92,7 @@
+   nss_ldap_so_LDFLAGS="-b -dynamic -G `cat exports.hpux`"
+   CPPFLAGS="$CPPFLAGS -I. -DHPUX"
+   TARGET_OS=HPUX ;;
+-linux*) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic -Wl,--version-script,\$(srcdir)/exports.linux" ;;
++linux*) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic -Wl,--version-script,\$(srcdir)/exports.linux -Wl,-soname=libnss_ldap.so.2" ;;
+ *) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic" ;;
+ esac
+ 
diff --git a/sys-auth/nss_ldap/files/nss_ldap-257-nss_max_group_depth.patch b/sys-auth/nss_ldap/files/nss_ldap-257-nss_max_group_depth.patch
new file mode 100644
index 000000000000..d2f8efeec751
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-257-nss_max_group_depth.patch
@@ -0,0 +1,92 @@
+Gentoo-Bug: 155492
+Original-Author: Heath Caldwell <hncaldwell@csupomona.edu>
+Rediffed-by: Robin H. Johnson <robbat2@gentoo.org>
+
+--- nss_ldap-257.orig/ChangeLog	2007-09-18 15:02:59.997686000 -0700
++++ nss_ldap-257/ChangeLog	2007-09-18 15:04:07.925113592 -0700
+@@ -3,2 +3,7 @@
+ 
++257.1	Heath Caldwell <hncaldwell@csupomona.edu>
++
++	* add configurable maximum group depth with new
++	  configuration file option called nss_max_group_depth
++
+ 257	Luke Howard <lukeh@padl.com>
+--- nss_ldap-257.orig/ldap-grp.c	2007-08-02 21:51:09.000000000 -0700
++++ nss_ldap-257/ldap-grp.c	2007-09-18 15:03:23.734619150 -0700
+@@ -308,7 +308,7 @@
+   uniquemember_attrs[0] = uniquemember_attr;
+   uniquemember_attrs[1] = NULL;
+ 
+-  if (*depth > LDAP_NSS_MAXGR_DEPTH)
++  if (*depth > _nss_ldap_max_group_depth)
+     {
+       return NSS_NOTFOUND;
+     }
+@@ -844,7 +844,7 @@
+   const char *gidnumber_attrs[2];
+   int erange;
+ 
+-  if (lia->depth > LDAP_NSS_MAXGR_DEPTH)
++  if (lia->depth > _nss_ldap_max_group_depth)
+     return NSS_NOTFOUND;
+ 
+   if (_nss_ldap_namelist_find (lia->known_groups, dn))
+@@ -890,7 +890,7 @@
+   size_t memberCount, i;
+   int erange;
+ 
+-  if (lia->depth > LDAP_NSS_MAXGR_DEPTH)
++  if (lia->depth > _nss_ldap_max_group_depth)
+     return NSS_NOTFOUND;
+ 
+   for (memberCount = 0; membersOf[memberCount] != NULL; memberCount++)
+--- nss_ldap-257.orig/ldap-nss.h	2007-09-18 15:02:59.997686000 -0700
++++ nss_ldap-257/ldap-nss.h	2007-09-18 15:03:23.734619150 -0700
+@@ -105,7 +105,8 @@
+ #define LDAP_NSS_MAXNETGR_DEPTH  16	/* maximum depth of netgroup nesting for innetgr() */
+ #endif /* HAVE_NSSWITCH_H */
+ 
+-#define LDAP_NSS_MAXGR_DEPTH     16     /* maximum depth of group nesting for getgrent()/initgroups() */
++#define LDAP_NSS_MAXGR_DEPTH     16	/* default maximum depth of group nesting for getgrent()/initgroups() */
++extern int _nss_ldap_max_group_depth;	/* global variable to hold maximum group depth */
+ 
+ #if LDAP_NSS_NGROUPS > 64
+ #define LDAP_NSS_BUFLEN_GROUP	(NSS_BUFSIZ + (LDAP_NSS_NGROUPS * (sizeof (char *) + LOGNAME_MAX))) 
+--- nss_ldap-257.orig/nss_ldap.5	2007-09-18 15:03:00.001020000 -0700
++++ nss_ldap-257/nss_ldap.5	2007-09-18 15:05:42.779508238 -0700
+@@ -453,6 +453,10 @@
+ verify no local applications rely on this information before
+ enabling this on a production system.
+ .TP
++.B nss_max_group_depth <value>
++Specifies the maximum depth to which nested groups are queried.
++A value of 0 effectively disables querying for nested groups.
++.TP
+ .B nss_srv_domain <domain>
+ This option determines the DNS domain used for performing SRV
+ lookups.
+--- nss_ldap-257.orig/util.c	2007-09-18 15:03:00.001020000 -0700
++++ nss_ldap-257/util.c	2007-09-18 15:04:35.032083555 -0700
+@@ -62,2 +62,5 @@
+ 
++/* Initialize global maximum group depth to default. */
++int _nss_ldap_max_group_depth = LDAP_NSS_MAXGR_DEPTH;
++
+ static NSS_STATUS do_getrdnvalue (const char *dn,
+@@ -805,2 +808,5 @@
+ 
++  /* Reset global maximum group depth to default. */
++  _nss_ldap_max_group_depth = LDAP_NSS_MAXGR_DEPTH;
++
+   while (fgets (b, sizeof (b), fp) != NULL)
+--- nss_ldap-257.orig/util.h	2007-09-18 15:03:00.001020000 -0700
++++ nss_ldap-257/util.h	2007-09-18 15:05:11.295822638 -0700
+@@ -84,6 +84,7 @@
+ #define NSS_LDAP_KEY_INITGROUPS		"nss_initgroups"
+ #define NSS_LDAP_KEY_INITGROUPS_IGNOREUSERS	"nss_initgroups_ignoreusers"
+ #define NSS_LDAP_KEY_GETGRENT_SKIPMEMBERS	"nss_getgrent_skipmembers"
++#define NSS_LDAP_KEY_MAX_GROUP_DEPTH	"nss_max_group_depth"
+ 
+ /* more reconnect policy fine-tuning */
+ #define NSS_LDAP_KEY_RECONNECT_TRIES		"nss_reconnect_tries"
diff --git a/sys-auth/nss_ldap/files/nss_ldap-257.2-gssapi-headers.patch b/sys-auth/nss_ldap/files/nss_ldap-257.2-gssapi-headers.patch
new file mode 100644
index 000000000000..cec5517e741c
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-257.2-gssapi-headers.patch
@@ -0,0 +1,65 @@
+http://bugs.gentoo.org/show_bug.cgi?id=165638
+http://bugzilla.padl.com/show_bug.cgi?id=308
+
+Make nss_ldap compile with gssapi/gssapi.h even if there is no
+gssapi/gssapi_krb5.h present. This seems to be needed to compile against
+heimdal. Extended header checks and modified preprocessor logic a bit.
+
+2007-02-07 Martin von Gagern <Martin.vGagern@gmx.net>
+
+diff -ruN nss_ldap-257.2.orig/config.h.in nss_ldap-257.2/config.h.in
+--- nss_ldap-257.2.orig/config.h.in	2007-10-24 14:22:55.000000000 +0200
++++ nss_ldap-257.2/config.h.in	2007-10-24 14:25:15.000000000 +0200
+@@ -87,6 +87,9 @@
+ /* Define to 1 if you have the <gssapi/gssapi_krb5.h> header file. */
+ #undef HAVE_GSSAPI_GSSAPI_KRB5_H
+ 
++/* Define to 1 if you have the <gssapi/gssapi.h> header file. */
++#undef HAVE_GSSAPI_GSSAPI_H
++
+ /* Define to 1 if you have the <gssapi.h> header file. */
+ #undef HAVE_GSSAPI_H
+ 
+diff -ruN nss_ldap-257.2.orig/configure nss_ldap-257.2/configure
+--- nss_ldap-257.2.orig/configure	2007-10-24 14:22:55.000000000 +0200
++++ nss_ldap-257.2/configure	2007-10-24 14:25:49.000000000 +0200
+@@ -8409,7 +8409,7 @@
+ 
+ 
+ 
+-for ac_header in gssapi/gssapi_krb5.h gssapi.h
++for ac_header in gssapi/gssapi_krb5.h gssapi/gssapi.h gssapi.h
+ do
+ as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
+ if eval "test \"\${$as_ac_Header+set}\" = set"; then
+diff -ruN nss_ldap-257.2.orig/configure.in nss_ldap-257.2/configure.in
+--- nss_ldap-257.2.orig/configure.in	2007-10-24 14:22:55.000000000 +0200
++++ nss_ldap-257.2/configure.in	2007-10-24 14:26:26.000000000 +0200
+@@ -182,7 +182,7 @@
+ AC_CHECK_HEADERS(strings.h)
+ AC_CHECK_HEADERS(gssldap.h)
+ AC_CHECK_HEADERS(gsssasl.h)
+-AC_CHECK_HEADERS(gssapi/gssapi_krb5.h gssapi.h)
++AC_CHECK_HEADERS(gssapi/gssapi_krb5.h gssapi/gssapi.h gssapi.h)
+ AC_CHECK_HEADERS(krb5.h)
+ 
+ AC_CHECK_LIB(resolv, main)
+diff -ruN nss_ldap-257.2.orig/ldap-nss.c nss_ldap-257.2/ldap-nss.c
+--- nss_ldap-257.2.orig/ldap-nss.c	2007-10-24 14:22:55.000000000 +0200
++++ nss_ldap-257.2/ldap-nss.c	2007-10-24 14:27:32.000000000 +0200
+@@ -82,10 +82,14 @@
+ #endif
+ #ifdef HAVE_GSSAPI_H
+ #include <gssapi.h>
+-#elif defined(HAVE_GSSAPI_GSSAPI_KRB5_H)
++#else
++#ifdef HAVE_GSSAPI_GSSAPI_H
+ #include <gssapi/gssapi.h>
++#endif
++#ifdef HAVE_GSSAPI_GSSAPI_KRB5_H
+ #include <gssapi/gssapi_krb5.h>
+ #endif
++#endif
+ #ifdef CONFIGURE_KRB5_CCNAME
+ #include <krb5.h>
+ #endif
diff --git a/sys-auth/nss_ldap/files/nss_ldap-264-disable-automagic.patch b/sys-auth/nss_ldap/files/nss_ldap-264-disable-automagic.patch
new file mode 100644
index 000000000000..7671574da4da
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-264-disable-automagic.patch
@@ -0,0 +1,109 @@
+Explicitly provide a way to disable Kerberos/SASL/SSL usage in nss_ldap, so
+that you can build non-kerberos versions on systems with Kerberos installed
+WITHOUT it linking due to presence.
+
+Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>
+
+diff -Nuar nss_ldap-264.orig/configure.in nss_ldap-264/configure.in
+--- nss_ldap-264.orig/configure.in	2009-07-28 10:35:27.599965878 -0700
++++ nss_ldap-264/configure.in	2009-07-28 10:36:00.620375469 -0700
+@@ -10,6 +10,21 @@
+ AC_PROG_INSTALL
+ 
+ dnl
++dnl Turn on/off SSL
++dnl
++AC_ARG_ENABLE(ssl, [  --enable-ssl        enable SSL code ], [AC_DEFINE([WANT_SSL], [1], [Define if SSL is wanted])])
++
++dnl
++dnl Turn on/off Kerberos
++dnl
++AC_ARG_ENABLE(krb, [  --enable-krb        enable Kerberos code ], [AC_DEFINE([WANT_KRB], [1], [Define if Kerberos is wanted])])
++
++dnl
++dnl Turn on/off SASL
++dnl
++AC_ARG_ENABLE(sasl, [  --enable-sasl        enable Kerberos code ], [AC_DEFINE([WANT_SASL], [1], [Define if SASL is wanted])])
++
++dnl
+ dnl --enable-rfc2307bis is now deprecated; if this option is set,
+ dnl then RFC2307bis support will be enabled by default. However
+ dnl it can now always be enabled at runtime with the nss_schema
+@@ -178,12 +193,18 @@
+ AC_CHECK_HEADERS(sys/un.h)
+ AC_CHECK_HEADERS(libc-lock.h)
+ AC_CHECK_HEADERS(bits/libc-lock.h)
+-AC_CHECK_HEADERS(sasl.h sasl/sasl.h)
++if test "$enable_sasl" \!= "no"; then
++  AC_CHECK_HEADERS(sasl.h sasl/sasl.h)
++fi
+ AC_CHECK_HEADERS(strings.h)
+-AC_CHECK_HEADERS(gssldap.h)
+-AC_CHECK_HEADERS(gsssasl.h)
+-AC_CHECK_HEADERS(gssapi/gssapi_krb5.h gssapi/gssapi.h gssapi.h)
+-AC_CHECK_HEADERS(krb5.h)
++if test "$enable_krb" \!= "no"; then
++  AC_CHECK_HEADERS(gssldap.h)
++  if test "$enable_sasl" \!= "no"; then
++    AC_CHECK_HEADERS(gsssasl.h)
++  fi
++  AC_CHECK_HEADERS(gssapi/gssapi_krb5.h gssapi/gssapi.h gssapi.h)
++  AC_CHECK_HEADERS(krb5.h)
++fi
+ 
+ AC_CHECK_LIB(resolv, main)
+ AC_CHECK_LIB(nsl, main)
+@@ -286,19 +307,25 @@
+ AC_CHECK_LIB(dl, dlopen,[LIBS="-ldl $LIBS"],,$LIBS)
+ dnl AC_CHECK_LIB(db, main,[LIBS="-ldb $LIBS"],,$LIBS)
+ 
+-AC_CHECK_LIB(gssapi, gss_krb5_ccache_name,[LIBS="-lgssapi $LIBS" found_gssapi_lib=yes],,$LIBS)
+-if test -z "$found_gssapi_lib"; then
+-  AC_CHECK_LIB(gssapi_krb5, gss_krb5_ccache_name,[LIBS="-lgssapi_krb5 $LIBS"],,$LIBS)
++if test "$enable_krb" \!= "no"; then
++  AC_CHECK_LIB(gssapi, gss_krb5_ccache_name,[LIBS="-lgssapi $LIBS" found_gssapi_lib=yes],,$LIBS)
++  if test -z "$found_gssapi_lib"; then
++    AC_CHECK_LIB(gssapi_krb5, gss_krb5_ccache_name,[LIBS="-lgssapi_krb5 $LIBS"],,$LIBS)
++  fi
+ fi
+ 
+ dnl Following checks probably not strictly necessary.
+ dnl AC_CHECK_LIB(crypto, main,[LIBS="-lcrypto $LIBS"],,$LIBS)
+ dnl AC_CHECK_LIB(ssl, main,[LIBS="-lssl $LIBS"],,$LIBS)
+ AC_CHECK_LIB(com_err, main,[LIBS="-lcom_err $LIBS"],,$LIBS)
+-dnl AC_CHECK_LIB(k5crypto, main,[LIBS="-lk5crypto $LIBS"],,$LIBS)
+-AC_CHECK_LIB(krb5, main,[LIBS="-lkrb5 $LIBS"],,$LIBS)
+-dnl AC_CHECK_LIB(krb4, main,[LIBS="-lkrb4 $LIBS"],,$LIBS)
+-AC_CHECK_LIB(sasl2, sasl_client_init)
++if test "$enable_krb" \!= "no"; then
++  dnl AC_CHECK_LIB(k5crypto, main,[LIBS="-lk5crypto $LIBS"],,$LIBS)
++  AC_CHECK_LIB(krb5, main,[LIBS="-lkrb5 $LIBS"],,$LIBS)
++  dnl AC_CHECK_LIB(krb4, main,[LIBS="-lkrb4 $LIBS"],,$LIBS)
++fi
++if test "$enable_sasl" \!= "no"; then
++  AC_CHECK_LIB(sasl2, sasl_client_init)
++fi
+ 
+ if test -z "$found_ldap_lib" -a \( $with_ldap_lib = auto -o $with_ldap_lib = umich -o $with_ldap_lib = openldap \); then
+   AC_CHECK_LIB(lber, main)
+@@ -331,13 +358,17 @@
+   AC_CHECK_LIB(pthread, main)
+ fi
+ 
+-AC_CHECK_LIB(gssldap, ldap_gss_bind,[LIBS="-lgssldap $LIBS"],,$LIBS)
++if test "$enable_krb" \!= "no"; then
++  AC_CHECK_LIB(gssldap, ldap_gss_bind,[LIBS="-lgssldap $LIBS"],,$LIBS)
++fi
+ 
+-AC_CHECK_FUNCS(sasl_auxprop_request)
+ AC_CHECK_FUNCS(ldap_init ldap_get_lderrno ldap_parse_result ldap_memfree ldap_controls_free)
+ AC_CHECK_FUNCS(ldap_ld_free ldap_explode_rdn ldap_set_option ldap_get_option)
+-AC_CHECK_FUNCS(ldap_sasl_interactive_bind_s ldap_initialize ldap_search_ext)
++AC_CHECK_FUNCS(ldap_initialize ldap_search_ext)
+ AC_CHECK_FUNCS(ldap_create_control ldap_create_page_control ldap_parse_page_control)
++if test "$enable_sasl" \!= "no"; then
++  AC_CHECK_FUNCS(sasl_auxprop_request ldap_sasl_interactive_bind_s)
++fi
+ if test "$enable_ssl" \!= "no"; then
+   AC_CHECK_FUNCS(ldapssl_client_init ldap_start_tls_s ldap_pvt_tls_set_option ldap_start_tls)
+ fi
diff --git a/sys-auth/nss_ldap/files/nss_ldap-265-fbsd.patch b/sys-auth/nss_ldap/files/nss_ldap-265-fbsd.patch
new file mode 100644
index 000000000000..1ae1171f88e5
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-265-fbsd.patch
@@ -0,0 +1,432 @@
+--- Makefile.am.orig	2009-11-06 05:28:08.000000000 -0500
++++ Makefile.am		2010-01-12 23:24:17.000000000 -0500
+@@ -9,8 +9,12 @@
+ if AIX
+ INST_GID=system
+ else
++if FreeBSD
++INST_GID=wheel
++else
+ INST_GID=root
+ endif
++endif
+ 
+ EXTRA_DIST = CVSVersionInfo.txt ChangeLog \
+ 	     AUTHORS ANNOUNCE NEWS INSTALL README LICENSE.OpenLDAP COPYING\
+@@ -23,7 +27,7 @@
+ 	ldap-alias.c ldap-service.c ldap-schema.c ldap-ethers.c \
+ 	ldap-bp.c ldap-automount.c util.c ltf.c snprintf.c resolve.c \
+ 	dnsconfig.c irs-nss.c pagectrl.c ldap-sldap.c ldap-init-krb5-cache.c \
+-	vers.c
++	vers.c bsdnss.c
+ 
+ nss_ldap_so_LDFLAGS = @nss_ldap_so_LDFLAGS@
+ 
+@@ -103,11 +107,10 @@
+ 		$(mkinstalldirs) $(DESTDIR)$(dir $(NSS_LDAP_PATH_CONF)); \
+ 		$(INSTALL_DATA) -o $(INST_UID) -g $(INST_GID) $(srcdir)/ldap.conf $(DESTDIR)$(NSS_LDAP_PATH_CONF); \
+ 	fi
+-	$(INSTALL_DATA) -o $(INST_UID) -g $(INST_GID) $(srcdir)/nsswitch.ldap $(DESTDIR)$(sysconfdir)/nsswitch.ldap; 
+ 
+ uninstall-local:
+ 	@$(NORMAL_UNINSTALL)
+ 
+ vers.c: $(top_srcdir)/CVSVersionInfo.txt
+-	CVSVERSIONDIR=$(top_srcdir) ./vers_string -v
++	$(top_srcdir)/vers_string -v
+ 
+
+--- configure.in.orig		   2007-10-29 06:30:12.000000000 -0700
++++ configure.in		   2008-09-26 20:38:20.000000000 -0700
+@@ -97,11 +97,15 @@
+ linux*) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic -Wl,--version-script,\$(srcdir)/exports.linux" ;;
+ *) nss_ldap_so_LDFLAGS="-shared -Wl,-Bdynamic" ;;
+ esac
++case "$target_os" in
++freebsd*) TARGET_OS=FreeBSD ;;
++esac
+ 
+ AM_CONDITIONAL(GCC, test "$GCC" = "yes")
+ AM_CONDITIONAL(GLIBC, test "$target_os" = "linux" -o "$target_os" = "linux-gnu")
+ AM_CONDITIONAL(AIX, test "$TARGET_OS" = AIX)
+ AM_CONDITIONAL(HPUX, test "$TARGET_OS" = HPUX)
++AM_CONDITIONAL(FreeBSD, test "$TARGET_OS" = FreeBSD)
+ 
+ AM_CONDITIONAL(USE_NATIVE_LINKER, test -n "$nss_ldap_so_LD")
+ 
+@@ -153,7 +157,6 @@
+   aix*) AC_CHECK_HEADERS(irs.h usersec.h) ;;
+   hpux*) AC_CHECK_HEADERS(nsswitch.h) ;;
+   *) AC_CHECK_HEADERS(nss.h)
+-     AC_CHECK_HEADERS(nsswitch.h)
+      AC_CHECK_HEADERS(irs.h) ;;
+ esac
+ AC_CHECK_HEADERS(thread.h)
+@@ -232,7 +235,6 @@
+ AC_CHECK_FUNCS(gethostbyname)
+ AC_CHECK_FUNCS(nsdispatch)
+ AC_CHECK_LIB(pthread_nonshared, main)
+-AC_CHECK_FUNCS(pthread_atfork)
+ AC_CHECK_FUNCS(pthread_once)
+ AC_CHECK_FUNCS(ether_aton)
+ AC_CHECK_FUNCS(ether_ntoa)
+
+--- ldap-ethers.c.orig	2009-11-06 10:28:08.000000000 +0000
++++ ldap-ethers.c	2009-12-23 17:01:14.000000000 +0000
+@@ -217,9 +217,9 @@
+     }
+ 
+   snprintf(fullmac, sizeof(fullmac), "%02x:%02x:%02x:%02x:%02x:%02x",
+-	   addr->ether_addr_octet[0], addr->ether_addr_octet[1],
+-	   addr->ether_addr_octet[2], addr->ether_addr_octet[3],
+-	   addr->ether_addr_octet[4], addr->ether_addr_octet[5]);
++	   addr->octet[0], addr->octet[1],
++	   addr->octet[2], addr->octet[3],
++	   addr->octet[4], addr->octet[5]);
+ 
+   LA_INIT(a);
+   LA_STRING(a) = ether_ntoa(addr);
+@@ -343,14 +343,14 @@
+ 	if (i != 6)
+ 		return NULL;
+ 	for (i = 0; i < 6; i++)
+-		ep.ether_addr_octet[i] = t[i];
++		ep.octet[i] = t[i];
+ 
+	return &ep;
+ }
+ #endif /* !HAVE_ETHER_ATON */
+ 
+ #ifndef HAVE_ETHER_NTOA
+-#define EI(i)	(unsigned int)(e->ether_addr_octet[(i)])
++#define EI(i)	(unsigned int)(e->octet[(i)])
+ static char *ether_ntoa (const struct ether_addr *e)
+ {
+ 	static char s[18];
+
+--- ldap-ethers.h.orig	2009-11-06 10:28:08.000000000 +0000
++++ ldap-ethers.h	2009-12-23 17:02:06.000000000 +0000
+@@ -32,7 +32,7 @@
+ 
+ #ifndef HAVE_STRUCT_ETHER_ADDR
+ struct ether_addr {
+-  u_char ether_addr_octet[6];
++  u_char octet[6];
+ };
+ #endif
+ 
+--- ldap-nss.c.orig	Sat May 27 16:23:40 2006
++++ ldap-nss.c		Sat May 27 16:23:52 2006
+@@ -69,7 +69,7 @@
+ #endif
+ 
+ /* Try to handle systems with both SASL libraries installed */
+-#if defined(HAVE_SASL_SASL_H) && defined(HAVE_SASL_AUXPROP_REQUEST)
++#if defined(HAVE_SASL_SASL_H) 
+ #include <sasl/sasl.h>
+ #elif defined(HAVE_SASL_H)
+ #include <sasl.h>
+
+--- ldap-pwd.c.orig	2008-10-30 21:50:15.000000000 +0100
++++ ldap-pwd.c		2008-12-06 00:37:30.216966282 +0100
+@@ -21,7 +21,10 @@
+ static char rcsId[] =
+   "$Id$";
+ 
++#include <sys/types.h>
++#include <unistd.h>
+ #include "config.h"
++ 
+ 
+ #ifdef HAVE_PORT_BEFORE_H
+ #include <port_before.h>
+@@ -90,9 +93,13 @@
+   size_t tmplen;
+   char *tmp;
+ 
+-  if (_nss_ldap_oc_check (e, "shadowAccount") == NSS_SUCCESS)
+-    {
++/*  if (_nss_ldap_oc_check (e, "shadowAccount") == NSS_SUCCESS)
++ *   {
++ */
+       /* don't include password for shadowAccount */
++  if (geteuid() != 0) 
++  {
++    /* don't include password for non-root users */
+       if (buflen < 3)
+ 	return NSS_TRYAGAIN;
+ 
+@@ -163,6 +170,15 @@
+     }
++
++#ifdef HAVE_LOGIN_CLASSES 
++  stat =
++    _nss_ldap_assign_attrval (e, AT (loginClass), &pw->pw_class, &buffer,
++    			                &buflen);
++  if (stat != NSS_SUCCESS)
++    (void) _nss_ldap_assign_emptystring (&pw->pw_class, &buffer, &buflen);
++#endif
++
+ 
+   stat =
+     _nss_ldap_assign_attrval (e, AT (homeDirectory), &pw->pw_dir, &buffer,
+ 			      &buflen);
+   if (stat != NSS_SUCCESS)
+
+--- ldap-schema.c	2009-08-29 09:21:43.000000000 -0400
++++ ldap-schema.c	2009-08-28 12:09:52.000000000 -0400
+@@ -334,6 +334,9 @@
+ #ifdef HAVE_PASSWD_PW_EXPIRE
+   (*pwd_attrs)[i++] = AT (shadowExpire);
+ #endif /* HAVE_PASSWD_PW_EXPIRE */
++#ifdef HAVE_LOGIN_CLASSES
++  (*pwd_attrs)[i++] = AT (loginClass);
++#endif
+   (*pwd_attrs)[i] = NULL;
+ }
+ 
+--- ldap-schema.h	2009-08-29 09:21:43.000000000 -0400
++++ ldap-schema.h	2009-08-29 06:37:18.000000000 -0400
+@@ -24,7 +24,7 @@
+ #define _LDAP_NSS_LDAP_LDAP_SCHEMA_H
+ 
+ /* max number of attributes per object class */
+-#define ATTRTAB_SIZE	15
++#define ATTRTAB_SIZE	16
+ 
+ /**
+  * function to initialize global lookup filters.
+@@ -153,6 +153,10 @@
+ #define AT_gecos                  "gecos"
+ #define AT_homeDirectory          "homeDirectory"
+
++#ifdef HAVE_LOGIN_CLASSES
++/* FreeBSD extension -Jacob Myers <jacob@whotokspaz.org> */
++#define AT_loginClass           "loginClass"
++#endif
+ /*
+  * ( nisSchema.2.1 NAME 'shadowAccount' SUP top AUXILIARY
+  *   DESC 'Additional attributes for shadow passwords'            
+
+--- /dev/null	       2013-04-13 01:27:01.290932001 +0200
++++ bsdnss.c	       2013-04-14 03:17:47.794195349 +0200
+@@ -0,0 +1,219 @@
++#include <errno.h>
++#include <stdlib.h>
++#include <sys/param.h>
++#include <netinet/in.h>
++#include <pwd.h>
++#include <grp.h>
++#include <nss.h>
++#include <nsswitch.h>
++#include <netdb.h>
++
++extern enum nss_status _nss_ldap_getgrent_r(struct group *, char *, size_t,
++    int *);
++extern enum nss_status _nss_ldap_getgrnam_r(const char *, struct group *,
++    char *, size_t, int *);
++extern enum nss_status _nss_ldap_getgrgid_r(gid_t gid, struct group *, char *,
++    size_t, int *);
++extern enum nss_status _nss_ldap_setgrent(void);
++extern enum nss_status _nss_ldap_endgrent(void);
++extern enum nss_status _nss_ldap_initgroups_dyn(const char *, gid_t, long int *,
++	     		   long int *, gid_t **, long int, int *);
++
++extern enum nss_status _nss_ldap_getpwent_r(struct passwd *, char *, size_t,
++    int *);
++extern enum nss_status _nss_ldap_getpwnam_r(const char *, struct passwd *,
++    char *, size_t, int *);
++extern enum nss_status _nss_ldap_getpwuid_r(gid_t gid, struct passwd *, char *,
++    size_t, int *);
++extern enum nss_status _nss_ldap_setpwent(void);
++extern enum nss_status _nss_ldap_endpwent(void);
++
++extern enum nss_status _nss_ldap_gethostbyname_r (const char *name, struct hostent * result,
++	     		   char *buffer, size_t buflen, int *errnop,
++			   		    int *h_errnop);
++
++extern enum nss_status _nss_ldap_gethostbyname2_r (const char *name, int af, struct hostent * result,
++	     		    char *buffer, size_t buflen, int *errnop,
++			    	 	      int *h_errnop);
++extern enum nss_status _nss_ldap_gethostbyaddr_r (struct in_addr * addr, int len, int type,
++	     		   struct hostent * result, char *buffer,
++			   	  	     size_t buflen, int *errnop, int *h_errnop);
++
++NSS_METHOD_PROTOTYPE(__nss_compat_getgrnam_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_getgrgid_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_getgrent_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_setgrent);
++NSS_METHOD_PROTOTYPE(__nss_compat_endgrent);
++static NSS_METHOD_PROTOTYPE(__freebsd_getgroupmembership);
++
++NSS_METHOD_PROTOTYPE(__nss_compat_getpwnam_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_getpwuid_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_getpwent_r);
++NSS_METHOD_PROTOTYPE(__nss_compat_setpwent);
++NSS_METHOD_PROTOTYPE(__nss_compat_endpwent);
++
++NSS_METHOD_PROTOTYPE(__nss_compat_gethostbyname);
++NSS_METHOD_PROTOTYPE(__nss_compat_gethostbyname2);
++NSS_METHOD_PROTOTYPE(__nss_compat_gethostbyaddr);
++
++static ns_mtab methods[] = {
++{ NSDB_GROUP, "getgrnam_r", __nss_compat_getgrnam_r, _nss_ldap_getgrnam_r },
++{ NSDB_GROUP, "getgrgid_r", __nss_compat_getgrgid_r, _nss_ldap_getgrgid_r },
++{ NSDB_GROUP, "getgrent_r", __nss_compat_getgrent_r, _nss_ldap_getgrent_r },
++{ NSDB_GROUP, "setgrent",   __nss_compat_setgrent,   _nss_ldap_setgrent },
++{ NSDB_GROUP, "endgrent",   __nss_compat_endgrent,   _nss_ldap_endgrent },
++{ NSDB_GROUP, "getgroupmembership",  __freebsd_getgroupmembership, NULL },
++
++{ NSDB_PASSWD, "getpwnam_r", __nss_compat_getpwnam_r, _nss_ldap_getpwnam_r },
++{ NSDB_PASSWD, "getpwuid_r", __nss_compat_getpwuid_r, _nss_ldap_getpwuid_r },
++{ NSDB_PASSWD, "getpwent_r", __nss_compat_getpwent_r, _nss_ldap_getpwent_r },
++{ NSDB_PASSWD, "setpwent",   __nss_compat_setpwent,   _nss_ldap_setpwent },
++{ NSDB_PASSWD, "endpwent",   __nss_compat_endpwent,   _nss_ldap_endpwent },
++
++{ NSDB_HOSTS, "gethostbyname", __nss_compat_gethostbyname, _nss_ldap_gethostbyname_r },
++{ NSDB_HOSTS, "gethostbyaddr", __nss_compat_gethostbyaddr, _nss_ldap_gethostbyaddr_r },
++{ NSDB_HOSTS, "gethostbyname2", __nss_compat_gethostbyname2, _nss_ldap_gethostbyname2_r },
++
++{ NSDB_GROUP_COMPAT, "getgrnam_r", __nss_compat_getgrnam_r, _nss_ldap_getgrnam_r },
++{ NSDB_GROUP_COMPAT, "getgrgid_r", __nss_compat_getgrgid_r, _nss_ldap_getgrgid_r },
++{ NSDB_GROUP_COMPAT, "getgrent_r", __nss_compat_getgrent_r, _nss_ldap_getgrent_r },
++{ NSDB_GROUP_COMPAT, "setgrent",   __nss_compat_setgrent,   _nss_ldap_setgrent },
++{ NSDB_GROUP_COMPAT, "endgrent",   __nss_compat_endgrent,   _nss_ldap_endgrent },
++
++{ NSDB_PASSWD_COMPAT, "getpwnam_r", __nss_compat_getpwnam_r, _nss_ldap_getpwnam_r },
++{ NSDB_PASSWD_COMPAT, "getpwuid_r", __nss_compat_getpwuid_r, _nss_ldap_getpwuid_r },
++{ NSDB_PASSWD_COMPAT, "getpwent_r", __nss_compat_getpwent_r, _nss_ldap_getpwent_r },
++{ NSDB_PASSWD_COMPAT, "setpwent",   __nss_compat_setpwent,   _nss_ldap_setpwent },
++{ NSDB_PASSWD_COMPAT, "endpwent",   __nss_compat_endpwent,   _nss_ldap_endpwent },
++
++};
++
++
++ns_mtab *
++nss_module_register(const char *source, unsigned int *mtabsize,
++    nss_module_unregister_fn *unreg)
++{
++	*mtabsize = sizeof(methods)/sizeof(methods[0]);
++	*unreg = NULL;
++	return (methods);
++}
++
++int __nss_compat_gethostbyname(void *retval, void *mdata, va_list ap)
++{
++	enum nss_status		(*fn)(const char *, struct hostent *, char *, size_t, int *, int *);
++	const char 		*name;
++	struct hostent 		*result;
++	char   			buffer[1024];
++	size_t				buflen = 1024;
++	int 				       errnop;
++	int					h_errnop;
++	int						af;
++	enum nss_status					status;
++	fn = mdata;
++	name = va_arg(ap, const char*);
++	af = va_arg(ap,int);
++	result = va_arg(ap,struct hostent *);
++	status = fn(name, result, buffer, buflen, &errnop, &h_errnop);
++	status = __nss_compat_result(status,errnop);
++	h_errno = h_errnop;
++	return (status);
++}
++
++int __nss_compat_gethostbyname2(void *retval, void *mdata, va_list ap)
++{
++	enum nss_status		(*fn)(const char *, struct hostent *, char *, size_t, int *, int *);
++	const char 		*name;
++	struct hostent 		*result;
++	char   			buffer[1024];
++	size_t				buflen = 1024;
++	int 				       errnop;
++	int					h_errnop;
++	int						af;
++	enum nss_status					status;
++	fn = mdata;
++	name = va_arg(ap, const char*);
++	af = va_arg(ap,int);
++	result = va_arg(ap,struct hostent *);
++	status = fn(name, result, buffer, buflen, &errnop, &h_errnop);
++	status = __nss_compat_result(status,errnop);
++	h_errno = h_errnop;
++	return (status);
++}
++
++int __nss_compat_gethostbyaddr(void *retval, void *mdata, va_list ap)
++{
++	struct in_addr	*addr;
++	int    		len;
++	int			type;
++	struct hostent		*result;
++	char   			buffer[1024];
++	size_t				buflen = 1024;
++	int				       errnop;
++	int					h_errnop;
++	enum nss_status (*fn)(struct in_addr *, int, int, struct hostent *, char *, size_t, int *, int *);
++	enum nss_status status;
++	fn = mdata;
++	addr = va_arg(ap, struct in_addr*);
++	len = va_arg(ap,int);
++	type = va_arg(ap,int);
++	result = va_arg(ap, struct hostent*);
++	status = fn(addr, len, type, result, buffer, buflen, &errnop, &h_errnop);
++	status = __nss_compat_result(status,errnop);
++	h_errno = h_errnop;
++	return (status);
++}
++
++static int
++__gr_addgid(gid_t gid, gid_t *groups, int maxgrp, int *groupc)
++{
++	int	ret, dupc;
++
++	/* skip duplicates */
++	for (dupc = 0; dupc < MIN(maxgrp, *groupc); dupc++) {
++	    if (groups[dupc] == gid)
++	       		     return 1;
++			     }
++
++	ret = 1;
++	if (*groupc < maxgrp)			/* add this gid */
++	   groups[*groupc] = gid;
++	   else
++		ret = 0;
++		(*groupc)++;
++		return ret;
++}
++
++static int __freebsd_getgroupmembership(void *retval, void *mdata, va_list ap)
++{
++	int err;
++	enum nss_status s;
++	const char *user	= va_arg(ap, const char *);
++	gid_t group 		  = va_arg(ap, gid_t);
++	gid_t *groups 		    = va_arg(ap, gid_t *);
++	int limit 		      = va_arg(ap, int);
++	int *size 		      	= va_arg(ap, int*);
++	gid_t *tmpgroups;
++	long int lstart, lsize;
++	int i;
++
++	tmpgroups = malloc(limit * sizeof(gid_t));
++	if (tmpgroups == NULL)
++	   return NS_TRYAGAIN;
++
++	/* insert primary membership */
++	__gr_addgid(group, groups, limit, size);
++
++	lstart = 0;
++	lsize = limit;
++	s = _nss_ldap_initgroups_dyn(user, group, &lstart, &lsize,
++	  &tmpgroups, 0, &err);
++	  if (s == NSS_STATUS_SUCCESS) {
++	     for (i = 0; i < lstart; i++)
++	     	     __gr_addgid(tmpgroups[i], groups, limit, size);
++		     			       s = NSS_STATUS_NOTFOUND;
++					       }
++
++	free(tmpgroups);
++
++	return __nss_compat_result(s, err);
++}
diff --git a/sys-auth/nss_ldap/files/nss_ldap-265-installdir.patch b/sys-auth/nss_ldap/files/nss_ldap-265-installdir.patch
new file mode 100644
index 000000000000..daf507ad594a
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-265-installdir.patch
@@ -0,0 +1,35 @@
+Index: nss_ldap-265/Makefile.am
+===================================================================
+--- nss_ldap-265.orig/Makefile.am
++++ nss_ldap-265/Makefile.am
+@@ -38,17 +38,13 @@ NSS_LDAP_LDFLAGS = @NSS_LDAP_LDFLAGS@
+ DEFS = @DEFS@
+ #INCLUDES = -I$(top_builddir) -I$(srcdir)
+ 
+-if GCC
+-MULTI_OS_DIRECTORY=$(shell $(CC) $(CFLAGS) -print-multi-os-directory)
+-else
+ MULTI_OS_DIRECTORY=.
+-endif
+ 
+ if GLIBC
+-LIBC_VERS = $(shell ls /lib/$(MULTI_OS_DIRECTORY)/libc-*.so | tail -n 1 | sed -e 's|.*libc-\(.*\)\.so|\1|')
++LIBC_VERS = $(shell ls @GENTOO_PORTAGE_EPREFIX@/lib/$(MULTI_OS_DIRECTORY)/libc-*.so | tail -n 1 | sed -e 's|.*libc-\(.*\)\.so|\1|')
+ NSS_LDAP_LIBC_VERSIONED = libnss_ldap-$(LIBC_VERS).so
+ 
+-NSS_VERS = $(shell ls /lib/$(MULTI_OS_DIRECTORY)/libnss_files.so.? | tail -n 1 | sed -e 's|.*libnss_files\.so\.\(.*\)|\1|')
++NSS_VERS = $(shell ls @GENTOO_PORTAGE_EPREFIX@/lib/$(MULTI_OS_DIRECTORY)/libnss_files.so.? | tail -n 1 | sed -e 's|.*libnss_files\.so\.\(.*\)|\1|')
+ NSS_LDAP_NSS_VERSIONED = libnss_ldap.so.$(NSS_VERS)
+ endif
+ 
+@@ -83,8 +79,8 @@ if GLIBC
+ 	$(mkinstalldirs) $(DESTDIR)$(libdir)
+ 	$(INSTALL_PROGRAM) -o $(INST_UID) -g $(INST_GID) nss_ldap.so $(DESTDIR)$(libdir)/$(NSS_LDAP_LIBC_VERSIONED)
+ 	(cd $(DESTDIR)$(libdir); ln -sf $(NSS_LDAP_LIBC_VERSIONED) $(NSS_LDAP_NSS_VERSIONED))
+-	$(mkinstalldirs) $(DESTDIR)/usr$(libdir)
+-	(cd $(DESTDIR)/usr$(libdir); ln -sf ../..$(libdir)/$(NSS_LDAP_NSS_VERSIONED) .)
++	$(mkinstalldirs) $(DESTDIR)$(libdir:/lib=/usr/lib)
++	(cd $(DESTDIR)/$(libdir:/lib=/usr/lib); ln -sf ../../lib/$(NSS_LDAP_NSS_VERSIONED) .)
+ else
+ 	$(mkinstalldirs) $(DESTDIR)$(libdir)
+ if HPUX
diff --git a/sys-auth/nss_ldap/files/nss_ldap-265-missing-entries-oneshot.patch b/sys-auth/nss_ldap/files/nss_ldap-265-missing-entries-oneshot.patch
new file mode 100644
index 000000000000..6730dc986dd1
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-265-missing-entries-oneshot.patch
@@ -0,0 +1,101 @@
+Distinguish between contexts that are somewhat persistent and one-offs
+which are used to fulfill part of a larger request.
+
+diff -up nss_ldap-253/ldap-grp.c nss_ldap-253/ldap-grp.c
+--- nss_ldap-253/ldap-grp.c	2009-05-08 13:30:43.000000000 -0400
++++ nss_ldap-253/ldap-grp.c	2009-05-08 13:34:41.000000000 -0400
+@@ -857,7 +857,7 @@ ng_chase (const char *dn, ldap_initgroup
+   LA_STRING (a) = dn;
+   LA_TYPE (a) = LA_TYPE_STRING;
+ 
+-  if (_nss_ldap_ent_context_init_locked (&ctx) == NULL)
++  if (_nss_ldap_ent_context_init_internal_locked (&ctx) == NULL)
+     {
+       return NSS_UNAVAIL;
+     }
+@@ -930,7 +930,7 @@ ng_chase_backlink (const char ** members
+   LA_STRING_LIST (a) = filteredMembersOf;
+   LA_TYPE (a) = LA_TYPE_STRING_LIST_OR;
+ 
+-  if (_nss_ldap_ent_context_init_locked (&ctx) == NULL)
++  if (_nss_ldap_ent_context_init_internal_locked (&ctx) == NULL)
+     {
+       free (filteredMembersOf);
+       return NSS_UNAVAIL;
+diff -up nss_ldap-253/ldap-netgrp.c nss_ldap-253/ldap-netgrp.c
+--- nss_ldap-253/ldap-netgrp.c	2009-05-08 13:31:35.000000000 -0400
++++ nss_ldap-253/ldap-netgrp.c	2009-05-08 13:33:14.000000000 -0400
+@@ -691,7 +691,7 @@ do_innetgr_nested (ldap_innetgr_args_t *
+   LA_TYPE (a) = LA_TYPE_STRING;
+   LA_STRING (a) = nested;	/* memberNisNetgroup */
+ 
+-  if (_nss_ldap_ent_context_init_locked (&ctx) == NULL)
++  if (_nss_ldap_ent_context_init_internal_locked (&ctx) == NULL)
+     {
+       debug ("<== do_innetgr_nested: failed to initialize context");
+       return NSS_UNAVAIL;
+diff -up nss_ldap-253/ldap-nss.c nss_ldap-253/ldap-nss.c
+--- nss_ldap-253/ldap-nss.c	2009-05-08 13:27:17.000000000 -0400
++++ nss_ldap-253/ldap-nss.c	2009-05-08 14:05:51.000000000 -0400
+@@ -1961,6 +1961,7 @@ _nss_ldap_ent_context_init_locked (ent_c
+ 	  debug ("<== _nss_ldap_ent_context_init_locked");
+ 	  return NULL;
+ 	}
++      ctx->ec_internal = 0;
+       *pctx = ctx;
+     }
+   else
+@@ -1990,6 +1991,15 @@ _nss_ldap_ent_context_init_locked (ent_c
+ 
+   return ctx;
+ }
++ent_context_t *
++_nss_ldap_ent_context_init_internal_locked (ent_context_t ** pctx)
++{
++  ent_context_t *ctx;
++  ctx = _nss_ldap_ent_context_init_locked (pctx);
++  if (ctx != NULL)
++    ctx->ec_internal = 1;
++  return ctx;
++}
+ 
+ /*
+  * Clears a given context; we require the caller
+@@ -2031,7 +2041,8 @@ _nss_ldap_ent_context_release (ent_conte
+ 
+   LS_INIT (ctx->ec_state);
+ 
+-  if (_nss_ldap_test_config_flag (NSS_LDAP_FLAGS_CONNECT_POLICY_ONESHOT))
++  if (!ctx->ec_internal &&
++      _nss_ldap_test_config_flag (NSS_LDAP_FLAGS_CONNECT_POLICY_ONESHOT))
+     {
+       do_close ();
+     }
+diff -up nss_ldap-253/ldap-nss.h nss_ldap-253/ldap-nss.h
+--- nss_ldap-253/ldap-nss.h	2009-05-08 13:35:47.000000000 -0400
++++ nss_ldap-253/ldap-nss.h	2009-05-08 13:52:25.000000000 -0400
+@@ -560,6 +560,8 @@ struct ent_context
+   ldap_state_t ec_state;	/* eg. for services */
+   int ec_msgid;			/* message ID */
+   LDAPMessage *ec_res;		/* result chain */
++  int ec_internal;		/* this context is just a part of a larger
++				 * query for information */
+   ldap_service_search_descriptor_t *ec_sd;	/* current sd */
+   struct berval *ec_cookie;     /* cookie for paged searches */
+ };
+@@ -744,6 +746,15 @@ ent_context_t *_nss_ldap_ent_context_ini
+ ent_context_t *_nss_ldap_ent_context_init_locked (ent_context_t **);
+ 
+ /*
++ * _nss_ldap_ent_context_init_internal_locked() has the same
++ * behaviour, except it marks the context as one that's being
++ * used to fetch additional data used in answering a request, i.e.
++ * that this isn't the "main" context
++ */
++
++ent_context_t *_nss_ldap_ent_context_init_internal_locked (ent_context_t **);
++
++/*
+  * _nss_ldap_ent_context_release() is used to manually free a context 
+  */
+ void _nss_ldap_ent_context_release (ent_context_t *);
diff --git a/sys-auth/nss_ldap/files/nss_ldap-265-pthread.patch b/sys-auth/nss_ldap/files/nss_ldap-265-pthread.patch
new file mode 100644
index 000000000000..622ee5845e44
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-265-pthread.patch
@@ -0,0 +1,481 @@
+Index: ldap-nss.c
+===================================================================
+--- ldap-nss.c.orig
++++ ldap-nss.c
+@@ -142,7 +142,7 @@ static void (*__sigpipe_handler) (int) =
+  */
+ static ldap_session_t __session = { NULL, NULL, 0, LS_UNINITIALIZED };
+ 
+-#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE___LIBC_ONCE)
+ static pthread_once_t __once = PTHREAD_ONCE_INIT;
+ #endif
+ 
+@@ -150,7 +150,7 @@ static pthread_once_t __once = PTHREAD_O
+ static FILE *__debugfile;
+ #endif /* LBER_OPT_LOG_PRINT_FILE */
+ 
+-#ifndef HAVE_PTHREAD_ATFORK
++#if !defined(HAVE_PTHREAD_ATFORK) || !defined(HAVE___LIBC_ONCE)
+ /* 
+  * Process ID that opened the session.
+  */
+@@ -162,7 +162,7 @@ static uid_t __euid = -1;
+ static int __ssl_initialized = 0;
+ #endif /* HAVE_LDAPSSL_CLIENT_INIT */
+ 
+-#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE___LIBC_ONCE)
+ /*
+  * Prepare for fork(); lock mutex.
+  */
+@@ -513,7 +513,7 @@ _nss_ldap_default_constr (nss_ldap_backe
+ }
+ #endif /* HAVE_NSSWITCH_H */
+ 
+-#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#if defined(HAVE_PTHREAD_ATFORK) || defined(HAVE___LIBC_ONCE)
+ static void
+ do_atfork_prepare (void)
+ {
+@@ -547,7 +547,7 @@ do_atfork_setup (void)
+ #ifdef HAVE_PTHREAD_ATFORK
+   (void) pthread_atfork (do_atfork_prepare, do_atfork_parent,
+ 			 do_atfork_child);
+-#elif defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#elif defined(HAVE___LIBC_ATFORK)
+   (void) __libc_atfork (do_atfork_prepare, do_atfork_parent, do_atfork_child);
+ #endif
+ 
+@@ -1096,7 +1096,7 @@ static NSS_STATUS
+ do_init (void)
+ {
+   ldap_config_t *cfg;
+-#ifndef HAVE_PTHREAD_ATFORK
++#if !defined(HAVE_PTHREAD_ATFORK) || !defined(HAVE___LIBC_ONCE)
+   pid_t pid;
+ #endif
+   uid_t euid;
+@@ -1113,7 +1113,7 @@ do_init (void)
+     }
+ 
+ #ifndef HAVE_PTHREAD_ATFORK
+-#if defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#if defined(HAVE___LIBC_ONCE)
+   /*
+    * This bogosity is necessary because Linux uses different
+    * PIDs for different threads (like IRIX, which we don't
+@@ -1145,7 +1145,7 @@ do_init (void)
+     pid = -1;			/* linked against libpthreads, don't care */
+ #else
+   pid = getpid ();
+-#endif /* HAVE_LIBC_LOCK_H || HAVE_BITS_LIBC_LOCK_H */
++#endif /* HAVE___LIBC_ONCE */
+ #endif /* HAVE_PTHREAD_ATFORK */
+ 
+   euid = geteuid ();
+@@ -1155,7 +1155,7 @@ do_init (void)
+   syslog (LOG_DEBUG,
+ 	  "nss_ldap: __session.ls_state=%d, __session.ls_conn=%p, __euid=%i, euid=%i",
+ 	  __session.ls_state, __session.ls_conn, __euid, euid);
+-#elif defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#elif defined(HAVE___LIBC_ONCE)
+   syslog (LOG_DEBUG,
+ 	  "nss_ldap: libpthreads=%s, __session.ls_state=%d, __session.ls_conn=%p, __pid=%i, pid=%i, __euid=%i, euid=%i",
+  	  ((__pthread_once == NULL || __pthread_atfork == NULL) ? "FALSE" : "TRUE"),
+@@ -1179,11 +1179,11 @@ do_init (void)
+     }
+   else
+ #ifndef HAVE_PTHREAD_ATFORK
+-#if defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#if defined(HAVE___LIBC_ONCE)
+   if ((__pthread_once == NULL || __pthread_atfork == NULL) && __pid != pid)
+ #else
+   if (__pid != pid)
+-#endif /* HAVE_LIBC_LOCK_H || HAVE_BITS_LIBC_LOCK_H */
++#endif /* HAVE___LIBC_ONCE */
+     {
+       do_close_no_unbind ();
+     }
+@@ -1244,9 +1244,9 @@ do_init (void)
+       debug ("<== do_init (pthread_once failed)");
+       return NSS_UNAVAIL;
+     }
+-#elif defined(HAVE_PTHREAD_ATFORK) && ( defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H) )
++#elif defined(HAVE_PTHREAD_ATFORK) && defined(HAVE___LIBC_ONCE)
+   __libc_once (__once, do_atfork_setup);
+-#elif defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#elif defined(HAVE___LIBC_ONCE)
+   /*
+    * Only install the pthread_atfork() handlers i
+    * we are linked against libpthreads. Otherwise,
+Index: ldap-nss.h
+===================================================================
+--- ldap-nss.h.orig
++++ ldap-nss.h
+@@ -670,7 +670,7 @@ extern int __multi_threaded;
+ #define NSS_LDAP_LOCK(m)		mutex_lock(&m)
+ #define NSS_LDAP_UNLOCK(m)		mutex_unlock(&m)
+ #define NSS_LDAP_DEFINE_LOCK(m)		static mutex_t m = DEFAULTMUTEX
+-#elif defined(HAVE_LIBC_LOCK_H) || defined(HAVE_BITS_LIBC_LOCK_H)
++#elif defined(HAVE___LIBC_LOCK_LOCK) && defined(HAVE___LIBC_LOCK_UNLOCK)
+ #define NSS_LDAP_LOCK(m)		__libc_lock_lock(m)
+ #define NSS_LDAP_UNLOCK(m)		__libc_lock_unlock(m)
+ #define NSS_LDAP_DEFINE_LOCK(m)		static pthread_mutex_t m = PTHREAD_MUTEX_INITIALIZER
+Index: configure.in
+===================================================================
+--- configure.in.orig
++++ configure.in
+@@ -1,6 +1,7 @@
+ AC_INIT(ldap-nss.c)
+ AC_CANONICAL_SYSTEM
+ AC_PREFIX_DEFAULT()
++AC_CONFIG_MACRO_DIR([m4])
+ 
+ AM_INIT_AUTOMAKE(nss_ldap, 265)
+ AM_CONFIG_HEADER(config.h)
+@@ -229,11 +230,18 @@ fi
+ AC_CHECK_FUNCS(snprintf)
+ AC_CHECK_FUNCS(gethostbyname)
+ AC_CHECK_FUNCS(nsdispatch)
++AC_CHECK_FUNCS(ether_aton)
++AC_CHECK_FUNCS(ether_ntoa)
++
++AX_PTHREAD
++LIBS="$PTHREAD_LIBS $LIBS"
++CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
++CC="$PTHREAD_CC"
++
+ AC_CHECK_LIB(pthread_nonshared, main)
+ AC_CHECK_FUNCS(pthread_atfork)
+ AC_CHECK_FUNCS(pthread_once)
+-AC_CHECK_FUNCS(ether_aton)
+-AC_CHECK_FUNCS(ether_ntoa)
++AC_CHECK_FUNCS(__libc_once __libc_atfork __libc_lock_lock __libc_lock_unlock)
+ 
+ AC_MSG_CHECKING(for struct ether_addr)
+ AC_TRY_COMPILE([#include <sys/types.h>
+Index: m4/ax_pthread.m4
+===================================================================
+--- /dev/null
++++ m4/ax_pthread.m4
+@@ -0,0 +1,309 @@
++# ===========================================================================
++#        http://www.gnu.org/software/autoconf-archive/ax_pthread.html
++# ===========================================================================
++#
++# SYNOPSIS
++#
++#   AX_PTHREAD([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]])
++#
++# DESCRIPTION
++#
++#   This macro figures out how to build C programs using POSIX threads. It
++#   sets the PTHREAD_LIBS output variable to the threads library and linker
++#   flags, and the PTHREAD_CFLAGS output variable to any special C compiler
++#   flags that are needed. (The user can also force certain compiler
++#   flags/libs to be tested by setting these environment variables.)
++#
++#   Also sets PTHREAD_CC to any special C compiler that is needed for
++#   multi-threaded programs (defaults to the value of CC otherwise). (This
++#   is necessary on AIX to use the special cc_r compiler alias.)
++#
++#   NOTE: You are assumed to not only compile your program with these flags,
++#   but also link it with them as well. e.g. you should link with
++#   $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS
++#
++#   If you are only building threads programs, you may wish to use these
++#   variables in your default LIBS, CFLAGS, and CC:
++#
++#     LIBS="$PTHREAD_LIBS $LIBS"
++#     CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
++#     CC="$PTHREAD_CC"
++#
++#   In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant
++#   has a nonstandard name, defines PTHREAD_CREATE_JOINABLE to that name
++#   (e.g. PTHREAD_CREATE_UNDETACHED on AIX).
++#
++#   Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the
++#   PTHREAD_PRIO_INHERIT symbol is defined when compiling with
++#   PTHREAD_CFLAGS.
++#
++#   ACTION-IF-FOUND is a list of shell commands to run if a threads library
++#   is found, and ACTION-IF-NOT-FOUND is a list of commands to run it if it
++#   is not found. If ACTION-IF-FOUND is not specified, the default action
++#   will define HAVE_PTHREAD.
++#
++#   Please let the authors know if this macro fails on any platform, or if
++#   you have any other suggestions or comments. This macro was based on work
++#   by SGJ on autoconf scripts for FFTW (http://www.fftw.org/) (with help
++#   from M. Frigo), as well as ac_pthread and hb_pthread macros posted by
++#   Alejandro Forero Cuervo to the autoconf macro repository. We are also
++#   grateful for the helpful feedback of numerous users.
++#
++#   Updated for Autoconf 2.68 by Daniel Richard G.
++#
++# LICENSE
++#
++#   Copyright (c) 2008 Steven G. Johnson <stevenj@alum.mit.edu>
++#   Copyright (c) 2011 Daniel Richard G. <skunk@iSKUNK.ORG>
++#
++#   This program is free software: you can redistribute it and/or modify it
++#   under the terms of the GNU General Public License as published by the
++#   Free Software Foundation, either version 3 of the License, or (at your
++#   option) any later version.
++#
++#   This program is distributed in the hope that it will be useful, but
++#   WITHOUT ANY WARRANTY; without even the implied warranty of
++#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General
++#   Public License for more details.
++#
++#   You should have received a copy of the GNU General Public License along
++#   with this program. If not, see <http://www.gnu.org/licenses/>.
++#
++#   As a special exception, the respective Autoconf Macro's copyright owner
++#   gives unlimited permission to copy, distribute and modify the configure
++#   scripts that are the output of Autoconf when processing the Macro. You
++#   need not follow the terms of the GNU General Public License when using
++#   or distributing such scripts, even though portions of the text of the
++#   Macro appear in them. The GNU General Public License (GPL) does govern
++#   all other use of the material that constitutes the Autoconf Macro.
++#
++#   This special exception to the GPL applies to versions of the Autoconf
++#   Macro released by the Autoconf Archive. When you make and distribute a
++#   modified version of the Autoconf Macro, you may extend this special
++#   exception to the GPL to apply to your modified version as well.
++
++#serial 18
++
++AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD])
++AC_DEFUN([AX_PTHREAD], [
++AC_REQUIRE([AC_CANONICAL_HOST])
++AC_LANG_PUSH([C])
++ax_pthread_ok=no
++
++# We used to check for pthread.h first, but this fails if pthread.h
++# requires special compiler flags (e.g. on True64 or Sequent).
++# It gets checked for in the link test anyway.
++
++# First of all, check if the user has set any of the PTHREAD_LIBS,
++# etcetera environment variables, and if threads linking works using
++# them:
++if test x"$PTHREAD_LIBS$PTHREAD_CFLAGS" != x; then
++        save_CFLAGS="$CFLAGS"
++        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
++        save_LIBS="$LIBS"
++        LIBS="$PTHREAD_LIBS $LIBS"
++        AC_MSG_CHECKING([for pthread_join in LIBS=$PTHREAD_LIBS with CFLAGS=$PTHREAD_CFLAGS])
++        AC_TRY_LINK_FUNC(pthread_join, ax_pthread_ok=yes)
++        AC_MSG_RESULT($ax_pthread_ok)
++        if test x"$ax_pthread_ok" = xno; then
++                PTHREAD_LIBS=""
++                PTHREAD_CFLAGS=""
++        fi
++        LIBS="$save_LIBS"
++        CFLAGS="$save_CFLAGS"
++fi
++
++# We must check for the threads library under a number of different
++# names; the ordering is very important because some systems
++# (e.g. DEC) have both -lpthread and -lpthreads, where one of the
++# libraries is broken (non-POSIX).
++
++# Create a list of thread flags to try.  Items starting with a "-" are
++# C compiler flags, and other items are library names, except for "none"
++# which indicates that we try without any flags at all, and "pthread-config"
++# which is a program returning the flags for the Pth emulation library.
++
++ax_pthread_flags="pthreads none -Kthread -kthread lthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config"
++
++# The ordering *is* (sometimes) important.  Some notes on the
++# individual items follow:
++
++# pthreads: AIX (must check this before -lpthread)
++# none: in case threads are in libc; should be tried before -Kthread and
++#       other compiler flags to prevent continual compiler warnings
++# -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h)
++# -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able)
++# lthread: LinuxThreads port on FreeBSD (also preferred to -pthread)
++# -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads)
++# -pthreads: Solaris/gcc
++# -mthreads: Mingw32/gcc, Lynx/gcc
++# -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it
++#      doesn't hurt to check since this sometimes defines pthreads too;
++#      also defines -D_REENTRANT)
++#      ... -mt is also the pthreads flag for HP/aCC
++# pthread: Linux, etcetera
++# --thread-safe: KAI C++
++# pthread-config: use pthread-config program (for GNU Pth library)
++
++case ${host_os} in
++        solaris*)
++
++        # On Solaris (at least, for some versions), libc contains stubbed
++        # (non-functional) versions of the pthreads routines, so link-based
++        # tests will erroneously succeed.  (We need to link with -pthreads/-mt/
++        # -lpthread.)  (The stubs are missing pthread_cleanup_push, or rather
++        # a function called by this macro, so we could check for that, but
++        # who knows whether they'll stub that too in a future libc.)  So,
++        # we'll just look for -pthreads and -lpthread first:
++
++        ax_pthread_flags="-pthreads pthread -mt -pthread $ax_pthread_flags"
++        ;;
++
++        darwin*)
++        ax_pthread_flags="-pthread $ax_pthread_flags"
++        ;;
++esac
++
++if test x"$ax_pthread_ok" = xno; then
++for flag in $ax_pthread_flags; do
++
++        case $flag in
++                none)
++                AC_MSG_CHECKING([whether pthreads work without any flags])
++                ;;
++
++                -*)
++                AC_MSG_CHECKING([whether pthreads work with $flag])
++                PTHREAD_CFLAGS="$flag"
++                ;;
++
++                pthread-config)
++                AC_CHECK_PROG(ax_pthread_config, pthread-config, yes, no)
++                if test x"$ax_pthread_config" = xno; then continue; fi
++                PTHREAD_CFLAGS="`pthread-config --cflags`"
++                PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`"
++                ;;
++
++                *)
++                AC_MSG_CHECKING([for the pthreads library -l$flag])
++                PTHREAD_LIBS="-l$flag"
++                ;;
++        esac
++
++        save_LIBS="$LIBS"
++        save_CFLAGS="$CFLAGS"
++        LIBS="$PTHREAD_LIBS $LIBS"
++        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
++
++        # Check for various functions.  We must include pthread.h,
++        # since some functions may be macros.  (On the Sequent, we
++        # need a special flag -Kthread to make this header compile.)
++        # We check for pthread_join because it is in -lpthread on IRIX
++        # while pthread_create is in libc.  We check for pthread_attr_init
++        # due to DEC craziness with -lpthreads.  We check for
++        # pthread_cleanup_push because it is one of the few pthread
++        # functions on Solaris that doesn't have a non-functional libc stub.
++        # We try pthread_create on general principles.
++        AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>
++                        static void routine(void *a) { a = 0; }
++                        static void *start_routine(void *a) { return a; }],
++                       [pthread_t th; pthread_attr_t attr;
++                        pthread_create(&th, 0, start_routine, 0);
++                        pthread_join(th, 0);
++                        pthread_attr_init(&attr);
++                        pthread_cleanup_push(routine, 0);
++                        pthread_cleanup_pop(0) /* ; */])],
++                [ax_pthread_ok=yes],
++                [])
++
++        LIBS="$save_LIBS"
++        CFLAGS="$save_CFLAGS"
++
++        AC_MSG_RESULT($ax_pthread_ok)
++        if test "x$ax_pthread_ok" = xyes; then
++                break;
++        fi
++
++        PTHREAD_LIBS=""
++        PTHREAD_CFLAGS=""
++done
++fi
++
++# Various other checks:
++if test "x$ax_pthread_ok" = xyes; then
++        save_LIBS="$LIBS"
++        LIBS="$PTHREAD_LIBS $LIBS"
++        save_CFLAGS="$CFLAGS"
++        CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
++
++        # Detect AIX lossage: JOINABLE attribute is called UNDETACHED.
++        AC_MSG_CHECKING([for joinable pthread attribute])
++        attr_name=unknown
++        for attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do
++            AC_LINK_IFELSE([AC_LANG_PROGRAM([#include <pthread.h>],
++                           [int attr = $attr; return attr /* ; */])],
++                [attr_name=$attr; break],
++                [])
++        done
++        AC_MSG_RESULT($attr_name)
++        if test "$attr_name" != PTHREAD_CREATE_JOINABLE; then
++            AC_DEFINE_UNQUOTED(PTHREAD_CREATE_JOINABLE, $attr_name,
++                               [Define to necessary symbol if this constant
++                                uses a non-standard name on your system.])
++        fi
++
++        AC_MSG_CHECKING([if more special flags are required for pthreads])
++        flag=no
++        case ${host_os} in
++            aix* | freebsd* | darwin*) flag="-D_THREAD_SAFE";;
++            osf* | hpux*) flag="-D_REENTRANT";;
++            solaris*)
++            if test "$GCC" = "yes"; then
++                flag="-D_REENTRANT"
++            else
++                flag="-mt -D_REENTRANT"
++            fi
++            ;;
++        esac
++        AC_MSG_RESULT(${flag})
++        if test "x$flag" != xno; then
++            PTHREAD_CFLAGS="$flag $PTHREAD_CFLAGS"
++        fi
++
++        AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT],
++            ax_cv_PTHREAD_PRIO_INHERIT, [
++                AC_LINK_IFELSE([
++                    AC_LANG_PROGRAM([[#include <pthread.h>]], [[int i = PTHREAD_PRIO_INHERIT;]])],
++                    [ax_cv_PTHREAD_PRIO_INHERIT=yes],
++                    [ax_cv_PTHREAD_PRIO_INHERIT=no])
++            ])
++        AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes"],
++            AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], 1, [Have PTHREAD_PRIO_INHERIT.]))
++
++        LIBS="$save_LIBS"
++        CFLAGS="$save_CFLAGS"
++
++        # More AIX lossage: must compile with xlc_r or cc_r
++        if test x"$GCC" != xyes; then
++          AC_CHECK_PROGS(PTHREAD_CC, xlc_r cc_r, ${CC})
++        else
++          PTHREAD_CC=$CC
++        fi
++else
++        PTHREAD_CC="$CC"
++fi
++
++AC_SUBST(PTHREAD_LIBS)
++AC_SUBST(PTHREAD_CFLAGS)
++AC_SUBST(PTHREAD_CC)
++
++# Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND:
++if test x"$ax_pthread_ok" = xyes; then
++        ifelse([$1],,AC_DEFINE(HAVE_PTHREAD,1,[Define if you have POSIX threads libraries and header files.]),[$1])
++        :
++else
++        ax_pthread_ok=no
++        $2
++fi
++AC_LANG_POP
++])dnl AX_PTHREAD
+Index: Makefile.am
+===================================================================
+--- Makefile.am.orig
++++ Makefile.am
+@@ -1,3 +1,5 @@
++ACLOCAL_AMFLAGS = -I m4
++
+ if AIX
+ authmod = NSS_LDAP
+ else
diff --git a/sys-auth/nss_ldap/files/nss_ldap-265-reconnect-timeouts.patch b/sys-auth/nss_ldap/files/nss_ldap-265-reconnect-timeouts.patch
new file mode 100644
index 000000000000..b377ad7bb326
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nss_ldap-265-reconnect-timeouts.patch
@@ -0,0 +1,57 @@
+diff -Nuar --exclude '*.orig' nss_ldap-265.orig/ldap.conf nss_ldap-265/ldap.conf
+--- nss_ldap-265.orig/ldap.conf	2009-11-06 10:28:08.000000000 +0000
++++ nss_ldap-265/ldap.conf	2010-02-19 18:36:58.272236290 +0000
+@@ -279,7 +279,8 @@
+ # OpenLDAP SSL mechanism
+ # start_tls mechanism uses the normal LDAP port, LDAPS typically 636
+ #ssl start_tls
+-#ssl on
++###ssl on
++# Gentoo note: Don't use 'ssl on' in 249/250. They are broken in some cases! Use start_tls instead.
+ 
+ # OpenLDAP SSL options
+ # Require and verify server certificate (yes/no)
+@@ -311,3 +312,27 @@
+ # Override the default Kerberos ticket cache location.
+ #krb5_ccname FILE:/etc/.ldapcache
+ 
++# Timeout behavior
++# Upstream nss_ldap hard-codes these values:
++#nss_reconnect_tries 5			# number of times to double the sleep time
++#nss_reconnect_sleeptime 4		# initial sleep value
++#nss_reconnect_maxsleeptime 64	# max sleep value to cap at
++#nss_reconnect_maxconntries 2	# how many tries before sleeping
++# This leads to a delay of 124 seconds (4+8+16+32+64=124) per lookup if the
++# server is not available.
++
++# For Gentoo's distribution of nss_ldap, as of 250-r1, we use these values
++# (The hardwired constants in the code are changed to them as well):
++nss_reconnect_tries 4			# number of times to double the sleep time
++nss_reconnect_sleeptime 1		# initial sleep value
++nss_reconnect_maxsleeptime 16	# max sleep value to cap at
++nss_reconnect_maxconntries 2	# how many tries before sleeping
++# This leads to a delay of 15 seconds (1+2+4+8=15)
++
++# If you are impatient, and know your LDAP server is reliable, fast or local,
++# you may wish to use these values instead:
++#nss_reconnect_tries 1			# number of times to double the sleep time
++#nss_reconnect_sleeptime 1		# initial sleep value
++#nss_reconnect_maxsleeptime 1	# max sleep value to cap at
++#nss_reconnect_maxconntries 3	# how many tries before sleeping
++# This leads to a delay of 1 second.
+diff -Nuar --exclude '*.orig' nss_ldap-265.orig/ldap-nss.h nss_ldap-265/ldap-nss.h
+--- nss_ldap-265.orig/ldap-nss.h	2009-11-06 10:28:08.000000000 +0000
++++ nss_ldap-265/ldap-nss.h	2010-02-19 18:37:49.278474888 +0000
+@@ -96,9 +96,9 @@
+  * unacceptable, in which case you may wish to adjust
+  * the constants below.
+  */
+-#define LDAP_NSS_TRIES	   5	/* number of sleeping reconnect attempts */
+-#define LDAP_NSS_SLEEPTIME       4	/* seconds to sleep; doubled until max */
+-#define LDAP_NSS_MAXSLEEPTIME    64	/* maximum seconds to sleep */
++#define LDAP_NSS_TRIES	   4	/* number of sleeping reconnect attempts */
++#define LDAP_NSS_SLEEPTIME       1	/* seconds to sleep; doubled until max */
++#define LDAP_NSS_MAXSLEEPTIME    16	/* maximum seconds to sleep */
+ #define LDAP_NSS_MAXCONNTRIES    2	/* reconnect attempts before sleeping */
+ 
+ #if defined(HAVE_NSSWITCH_H) || defined(HAVE_IRS_H)
diff --git a/sys-auth/nss_ldap/files/nsswitch.ldap.diff b/sys-auth/nss_ldap/files/nsswitch.ldap.diff
new file mode 100644
index 000000000000..a8e96e05e8d8
--- /dev/null
+++ b/sys-auth/nss_ldap/files/nsswitch.ldap.diff
@@ -0,0 +1,15 @@
+--- nsswitch.ldap	2004-06-08 00:34:09.895330016 -0500
++++ nsswitch.ldap-modified	2004-06-08 00:35:21.518441648 -0500
+@@ -10,10 +10,10 @@
+ passwd:		files ldap
+ group:		files ldap
+ 
+-# consult DNS first, we will need it to resolve the LDAP host. (If we
++# consult files/dns first, we will need it to resolve the LDAP host. (If we
+ # can't resolve it, we're in infinite recursion, because libldap calls
+ # gethostbyname(). Careful!)
+-hosts:		dns ldap
++hosts:		files dns ldap
+ 
+ # LDAP is nominally authoritative for the following maps.
+ services:   ldap [NOTFOUND=return] files
diff --git a/sys-auth/nss_ldap/metadata.xml b/sys-auth/nss_ldap/metadata.xml
new file mode 100644
index 000000000000..ea53bf9a737a
--- /dev/null
+++ b/sys-auth/nss_ldap/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>ldap-bugs@gentoo.org</email>
+		<name>Please assign bugs to this mail alias.</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>robbat2@gentoo.org</email>
+		<name>Robin H. Johnson</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>prometheanfire@gentoo.org</email>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/nss_ldap/nss_ldap-265-r5.ebuild b/sys-auth/nss_ldap/nss_ldap-265-r5.ebuild
new file mode 100644
index 000000000000..e2535af0767b
--- /dev/null
+++ b/sys-auth/nss_ldap/nss_ldap-265-r5.ebuild
@@ -0,0 +1,144 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit fixheadtails eutils multilib multilib-minimal autotools prefix
+
+IUSE="debug ssl sasl kerberos"
+
+DESCRIPTION="NSS LDAP Module"
+HOMEPAGE="http://www.padl.com/OSS/nss_ldap.html"
+SRC_URI="http://www.padl.com/download/${P}.tar.gz"
+
+SLOT="0"
+LICENSE="LGPL-2"
+KEYWORDS="~alpha amd64 arm hppa ~ia64 ~mips ppc ppc64 sparc x86 ~amd64-linux"
+
+DEPEND=">=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}]
+		sasl? ( >=dev-libs/cyrus-sasl-2.1.26-r3[${MULTILIB_USEDEP}] )
+		kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+		ssl? ( >=dev-libs/openssl-1.0.1h-r2:0[${MULTILIB_USEDEP}] )"
+RDEPEND="${DEPEND}
+		!<net-fs/autofs-4.1.3"
+
+src_prepare() {
+	if use prefix; then
+		epatch "${FILESDIR}"/${P}-installdir.patch
+		eprefixify Makefile.am
+	fi
+
+	# bug 438692
+	epatch "${FILESDIR}"/${P}-pthread.patch
+
+	epatch "${FILESDIR}"/nsswitch.ldap.diff
+
+	# Applied by upstream
+	#epatch "${FILESDIR}"/${PN}-239-tls-security-bug.patch
+
+	epatch "${FILESDIR}"/${PN}-249-sasl-compile.patch
+
+	EPATCH_OPTS="-p1 -d ${S}" epatch "${FILESDIR}"/${PN}-265-reconnect-timeouts.patch
+
+	# Applied by upstream
+	#EPATCH_OPTS="-p1 -d ${S}" epatch "${FILESDIR}"/${PN}-254-nss_getgrent_skipmembers.patch
+
+	EPATCH_OPTS="-p1 -d ${S}" epatch "${FILESDIR}"/${PN}-257-nss_max_group_depth.patch
+
+	sed -i.orig \
+		-e '/^ @(#)\$Id: ldap.conf,v/s,^,#,' \
+		"${S}"/ldap.conf
+
+	# fix head/tail stuff
+	ht_fix_file "${S}"/Makefile.am "${S}"/Makefile.in "${S}"/depcomp
+
+	# fix build borkage
+	for i in Makefile.{in,am}; do
+	  sed -i.orig \
+	    -e '/^install-exec-local: nss_ldap.so/s,nss_ldap.so,,g' \
+	    "${S}"/$i
+	done
+
+	epatch "${FILESDIR}"/${PN}-257.2-gssapi-headers.patch
+
+	# Bug #214750, no automagic deps
+	epatch "${FILESDIR}"/${PN}-264-disable-automagic.patch
+
+	# Upstream forgets the version number sometimes
+	#sed -i \
+	#	-e "/^AM_INIT_AUTOMAKE/s~2..~$PV~" \
+	#	"${S}"/configure.in
+
+	# Include an SONAME
+	epatch "${FILESDIR}"/${PN}-254-soname.patch
+
+	#fix broken oneshot connections
+	epatch "${FILESDIR}/nss_ldap-265-missing-entries-oneshot.patch"
+
+	sed -i \
+		-e 's, vers_string , PERL5LIB="@top_srcdir@" @top_srcdir@/vers_string ,g' \
+		"${S}"/Makefile.am
+
+	if use kernel_FreeBSD; then
+		#fix broken fbsd support
+		EPATCH_OPTS="-p0 -d ${S}" epatch "${FILESDIR}/nss_ldap-265-fbsd.patch"
+	fi
+
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=()
+	use debug && myconf+=( --enable-debugging )
+	use kerberos && myconf+=( --enable-configurable-krb5-ccname-gssapi )
+	multilib_is_native_abi && myconf+=( --libdir="${EPREFIX}/$(get_libdir)" )
+	# --enable-schema-mapping \
+	ECONF_SOURCE=${S} \
+	econf \
+		--with-ldap-lib=openldap \
+		--with-ldap-conf-file="${EPREFIX}/etc/ldap.conf" \
+		--enable-paged-results \
+		--enable-rfc2307bis \
+		$(use_enable ssl) \
+		$(use_enable sasl) \
+		$(use_enable kerberos krb) \
+		"${myconf[@]}"
+
+	if use kernel_FreeBSD; then
+		# configure.in does not properly handle include dependencies
+		echo "#define HAVE_NETINET_IF_ETHER_H 1" >> ${S}/config.h
+		echo "#define HAVE_NET_ROUTE_H 1" >> ${S}/config.h
+		echo "#define HAVE_RESOLV_H 1" >> ${S}/config.h
+	fi
+}
+
+multilib_src_install() {
+	if use kernel_FreeBSD; then
+		emake -j1 DESTDIR="${D}" install
+	else
+		emake -j1 DESTDIR="${D}" install \
+			INST_UID=${PORTAGE_USER:-root} INST_GID=${PORTAGE_GROUP:-root}
+	fi
+}
+
+multilib_src_install_all() {
+	# dumb /usr/lib* -> /lib* symlinks gone wrong
+	rm -rf "${ED}"/usr/usr
+
+	insinto /etc
+	doins ldap.conf
+
+	# Append two blank lines and some skip entries
+	echo >>"${ED}"/etc/ldap.conf
+	echo >>"${ED}"/etc/ldap.conf
+	sed -i "${ED}"/etc/ldap.conf \
+		-e '$inss_initgroups_ignoreusers ldap,openldap,mysql,syslog,root,postgres'
+
+	dodoc ldap.conf ANNOUNCE NEWS ChangeLog AUTHORS \
+		CVSVersionInfo.txt README nsswitch.ldap certutil
+	docinto docs; dodoc doc/*
+}
+
+pkg_postinst() {
+	elog "If you use a ldaps:// string in the 'uri' setting of"
+	elog "your /etc/ldap.conf, you must set 'ssl on'!"
+}
diff --git a/sys-auth/oath-toolkit/Manifest b/sys-auth/oath-toolkit/Manifest
new file mode 100644
index 000000000000..e1ffec90d893
--- /dev/null
+++ b/sys-auth/oath-toolkit/Manifest
@@ -0,0 +1,2 @@
+DIST oath-toolkit-2.6.1.tar.gz 4238966 BLAKE2B 7af4f4997b18278aa1903470c79e5a7734e9e97e62a2de4685eee58ead59e3294cef0d6da0147746932a2891f59648b5473f02b5edd6c4fd81b4a9c80d9bde60 SHA512 59feadbc06d11a52bf5879493227c40358fc1f4f17ec3ff92e3a313e47b92f3154396fa3ff38ef163852b32c8bfcef1f59753b614d0138478b8f7e7971f55e62
+DIST oath-toolkit-2.6.2.tar.gz 4295786 BLAKE2B 2b97ab73339647b560b46373922095f18655a167b613b15d4ee2fd507d430025628d20eb111ff1d8025e78646b1d61d9680a7082caba1c75d247bb1d8b9b99dd SHA512 201a702a05a2e9fb3a66d04750e1a34e293342126caf02c344954a0d9fd0daafe73ca7f1fe273be129ae555a29b82b72fa2b4770ea2ad10711924e1926ec2cfb
diff --git a/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-gcc7.patch b/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-gcc7.patch
new file mode 100644
index 000000000000..18a0a2779408
--- /dev/null
+++ b/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-gcc7.patch
@@ -0,0 +1,80 @@
+Bug: https://bugs.gentoo.org/618100
+Cherry-picked from upstream commits: https://github.com/coreutils/gnulib/commit/175b4e22f99e00996b72f822f5ae54dca8243d19
+                                     https://github.com/coreutils/gnulib/commit/abae112b34572cd3869ce4fc81dddb5c2a7394c4
+
+--- a/oathtool/gl/intprops.h
++++ b/oathtool/gl/intprops.h
+@@ -23,6 +23,10 @@
+ #include <limits.h>
+ #include <verify.h>
+ 
++#ifndef __has_builtin
++# define __has_builtin(x) 0
++#endif
++
+ /* Return a value with the common real type of E and V and the value of V.  */
+ #define _GL_INT_CONVERT(e, v) (0 * (e) + (v))
+ 
+@@ -222,20 +226,24 @@
+    ? (a) < (min) >> (b)                                 \
+    : (max) >> (b) < (a))
+ 
+-/* True if __builtin_add_overflow (A, B, P) works when P is null.  */
+-#define _GL_HAS_BUILTIN_OVERFLOW_WITH_NULL (7 <= __GNUC__)
++/* True if __builtin_add_overflow (A, B, P) works when P is non-null.  */
++#define _GL_HAS_BUILTIN_OVERFLOW \
++  (5 <= __GNUC__ || __has_builtin (__builtin_add_overflow))
++
++#define _GL_HAS_BUILTIN_OVERFLOW_P \
++  (7 <= __GNUC__ || __has_builtin (__builtin_add_overflow_p))
+ 
+ /* The _GL*_OVERFLOW macros have the same restrictions as the
+    *_RANGE_OVERFLOW macros, except that they do not assume that operands
+    (e.g., A and B) have the same type as MIN and MAX.  Instead, they assume
+    that the result (e.g., A + B) has that type.  */
+-#if _GL_HAS_BUILTIN_OVERFLOW_WITH_NULL
+-# define _GL_ADD_OVERFLOW(a, b, min, max)
+-   __builtin_add_overflow (a, b, (__typeof__ ((a) + (b)) *) 0)
+-# define _GL_SUBTRACT_OVERFLOW(a, b, min, max)
+-   __builtin_sub_overflow (a, b, (__typeof__ ((a) - (b)) *) 0)
+-# define _GL_MULTIPLY_OVERFLOW(a, b, min, max)
+-   __builtin_mul_overflow (a, b, (__typeof__ ((a) * (b)) *) 0)
++#if _GL_HAS_BUILTIN_OVERFLOW_P
++# define _GL_ADD_OVERFLOW(a, b, min, max)                               \
++   __builtin_add_overflow_p (a, b, (a) + (b))
++# define _GL_SUBTRACT_OVERFLOW(a, b, min, max)                          \
++   __builtin_sub_overflow_p (a, b, (a) - (b))
++# define _GL_MULTIPLY_OVERFLOW(a, b, min, max)                          \
++   __builtin_mul_overflow_p (a, b, (a) * (b))
+ #else
+ # define _GL_ADD_OVERFLOW(a, b, min, max)                                \
+    ((min) < 0 ? INT_ADD_RANGE_OVERFLOW (a, b, min, max)                  \
+@@ -315,7 +323,7 @@
+   _GL_BINARY_OP_OVERFLOW (a, b, _GL_ADD_OVERFLOW)
+ #define INT_SUBTRACT_OVERFLOW(a, b) \
+   _GL_BINARY_OP_OVERFLOW (a, b, _GL_SUBTRACT_OVERFLOW)
+-#if _GL_HAS_BUILTIN_OVERFLOW_WITH_NULL
++#if _GL_HAS_BUILTIN_OVERFLOW || _GL_HAS_BUILTIN_OVERFLOW_P
+ # define INT_NEGATE_OVERFLOW(a) INT_SUBTRACT_OVERFLOW (0, a)
+ #else
+ # define INT_NEGATE_OVERFLOW(a) \
+@@ -349,10 +357,6 @@
+ #define INT_MULTIPLY_WRAPV(a, b, r) \
+   _GL_INT_OP_WRAPV (a, b, r, *, __builtin_mul_overflow, INT_MULTIPLY_OVERFLOW)
+ 
+-#ifndef __has_builtin
+-# define __has_builtin(x) 0
+-#endif
+-
+ /* Nonzero if this compiler has GCC bug 68193 or Clang bug 25390.  See:
+    https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68193
+    https://llvm.org/bugs/show_bug.cgi?id=25390
+@@ -369,7 +373,7 @@
+    the operation.  BUILTIN is the builtin operation, and OVERFLOW the
+    overflow predicate.  Return 1 if the result overflows.  See above
+    for restrictions.  */
+-#if 5 <= __GNUC__ || __has_builtin (__builtin_add_overflow)
++#if _GL_HAS_BUILTIN_OVERFLOW
+ # define _GL_INT_OP_WRAPV(a, b, r, op, builtin, overflow) builtin (a, b, r)
+ #elif 201112 <= __STDC_VERSION__ && !_GL__GENERIC_BOGUS
+ # define _GL_INT_OP_WRAPV(a, b, r, op, builtin, overflow) \
diff --git a/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-glibc228.patch b/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-glibc228.patch
new file mode 100644
index 000000000000..c43f7aee0fe7
--- /dev/null
+++ b/sys-auth/oath-toolkit/files/oath-toolkit-2.6.2-glibc228.patch
@@ -0,0 +1,100 @@
+diff -ruN oath-toolkit-2.6.2.orig/liboath/gl/fseeko.c oath-toolkit-2.6.2/liboath/gl/fseeko.c
+--- oath-toolkit-2.6.2.orig/liboath/gl/fseeko.c	2016-08-27 13:15:06.000000000 +0200
++++ oath-toolkit-2.6.2/liboath/gl/fseeko.c	2018-10-27 22:07:53.836832404 +0200
+@@ -1,18 +1,18 @@
+ /* An fseeko() function that, together with fflush(), is POSIX compliant.
+-   Copyright (C) 2007-2016 Free Software Foundation, Inc.
++   Copyright (C) 2007-2018 Free Software Foundation, Inc.
+ 
+    This program is free software; you can redistribute it and/or modify
+-   it under the terms of the GNU Lesser General Public License as published by
+-   the Free Software Foundation; either version 2.1, or (at your option)
++   it under the terms of the GNU General Public License as published by
++   the Free Software Foundation; either version 2, or (at your option)
+    any later version.
+ 
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-   GNU Lesser General Public License for more details.
++   GNU General Public License for more details.
+ 
+-   You should have received a copy of the GNU Lesser General Public License along
+-   with this program; if not, see <http://www.gnu.org/licenses/>.  */
++   You should have received a copy of the GNU General Public License along
++   with this program; if not, see <https://www.gnu.org/licenses/>.  */
+ 
+ #include <config.h>
+ 
+@@ -33,9 +33,9 @@
+ #endif
+ #if _GL_WINDOWS_64_BIT_OFF_T
+ # undef fseeko
+-# if HAVE__FSEEKI64 /* msvc, mingw64 */
++# if HAVE__FSEEKI64 && HAVE_DECL__FSEEKI64 /* msvc, mingw since msvcrt8.0, mingw64 */
+ #  define fseeko _fseeki64
+-# else /* mingw */
++# else /* mingw before msvcrt8.0 */
+ #  define fseeko fseeko64
+ # endif
+ #endif
+@@ -47,12 +47,13 @@
+ #endif
+ 
+   /* These tests are based on fpurge.c.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1
++  /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_read_end == fp->_IO_read_ptr
+       && fp->_IO_write_ptr == fp->_IO_write_base
+       && fp->_IO_save_base == NULL)
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+-  /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Android */
++  /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
+ # if defined __SL64 && defined __SCLE /* Cygwin */
+   if ((fp->_flags & __SL64) == 0)
+     {
+@@ -80,7 +81,7 @@
+ #elif defined __minix               /* Minix */
+   if (fp_->_ptr == fp_->_buf
+       && (fp_->_ptr == NULL || fp_->_count == 0))
+-#elif defined _IOERR                /* AIX, HP-UX, IRIX, OSF/1, Solaris, OpenServer, mingw, NonStop Kernel */
++#elif defined _IOERR                /* AIX, HP-UX, IRIX, OSF/1, Solaris, OpenServer, mingw, MSVC, NonStop Kernel, OpenVMS */
+   if (fp_->_ptr == fp_->_base
+       && (fp_->_ptr == NULL || fp_->_cnt == 0))
+ #elif defined __UCLIBC__            /* uClibc */
+@@ -117,18 +118,19 @@
+       if (pos == -1)
+         {
+ #if defined __sferror || defined __DragonFly__ || defined __ANDROID__
+-          /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Android */
++          /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
+           fp_->_flags &= ~__SOFF;
+ #endif
+           return -1;
+         }
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_EOF_SEEN || defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1
++      /* GNU libc, BeOS, Haiku, Linux libc5 */
+       fp->_flags &= ~_IO_EOF_SEEN;
+       fp->_offset = pos;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+-      /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Android */
+-# if defined __CYGWIN__ || (defined __NetBSD__ && __NetBSD_Version__ >= 600000000)
++      /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
++# if defined __CYGWIN__ || (defined __NetBSD__ && __NetBSD_Version__ >= 600000000) || defined __minix
+       /* fp_->_offset is typed as an integer.  */
+       fp_->_offset = pos;
+ # else
+@@ -150,8 +152,8 @@
+       fp_->_flags &= ~__SEOF;
+ #elif defined __EMX__               /* emx+gcc */
+       fp->_flags &= ~_IOEOF;
+-#elif defined _IOERR                /* AIX, HP-UX, IRIX, OSF/1, Solaris, OpenServer, mingw, NonStop Kernel */
+-      fp->_flag &= ~_IOEOF;
++#elif defined _IOERR                /* AIX, HP-UX, IRIX, OSF/1, Solaris, OpenServer, mingw, MSVC, NonStop Kernel, OpenVMS */
++      fp_->_flag &= ~_IOEOF;
+ #elif defined __MINT__              /* Atari FreeMiNT */
+       fp->__offset = pos;
+       fp->__eof = 0;
diff --git a/sys-auth/oath-toolkit/metadata.xml b/sys-auth/oath-toolkit/metadata.xml
new file mode 100644
index 000000000000..f19bfe89d30a
--- /dev/null
+++ b/sys-auth/oath-toolkit/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>robbat2@gentoo.org</email>
+	</maintainer>
+	<maintainer type="project">
+		<email>sysadmin@gentoo.org</email>
+		<name>Gentoo Sysadmin Project</name>
+	</maintainer>
+	<use>
+		<flag name="pskc">Build tools &amp; library for the Portable Symmetric Key Container (PSKC) format per RFC6030</flag>
+		<flag name="pam">Build PAM module for pluggable login authentication for OATH</flag>
+	</use>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/oath-toolkit/oath-toolkit-2.6.1.ebuild b/sys-auth/oath-toolkit/oath-toolkit-2.6.1.ebuild
new file mode 100644
index 000000000000..12e5caf3e61b
--- /dev/null
+++ b/sys-auth/oath-toolkit/oath-toolkit-2.6.1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit pam eutils autotools
+DESCRIPTION="Toolkit for using one-time password authentication with HOTP/TOTP algorithms"
+HOMEPAGE="http://www.nongnu.org/oath-toolkit/"
+SRC_URI="http://download.savannah.gnu.org/releases/${PN}/${P}.tar.gz"
+LICENSE="GPL-3 LGPL-2.1"
+
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="pam pskc test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	pam? ( sys-libs/pam )
+	pskc? ( dev-libs/xmlsec )"
+DEPEND="${RDEPEND}
+	test? ( dev-libs/libxml2 )
+	dev-util/gtk-doc-am"
+
+src_prepare() {
+	# These tests need git/cvs and don't reflect anything in the final app
+	sed -i -r \
+		-e '/TESTS/s,test-vc-list-files-(git|cvs).sh,,g' \
+		gl/tests/Makefile.am
+	# disable portability warnings, caused by gtk-doc.make
+	sed -i \
+		-e '/AM_INIT_AUTOMAKE/ s:-Wall:\0 -Wno-portability:' \
+		{liboath,libpskc}/configure.ac
+	eautoreconf
+	default
+}
+
+src_configure() {
+	econf \
+		$(use_enable test xmltest ) \
+		$(use_enable pam) \
+		$(use_with pam pam-dir $(getpam_mod_dir)) \
+		$(use_enable pskc)
+}
+
+src_install() {
+	default
+	if use pam; then
+		newdoc pam_oath/README README.pam
+	fi
+	if use pskc; then
+		doman pskctool/pskctool.1
+	fi
+}
+
+src_test() {
+	# without keep-going, it will bail out after the first testsuite failure,
+	# skipping the other testsuites. as they are mostly independant, this sucks.
+	emake --keep-going check
+	[ $? -ne 0 ] && die "At least one testsuite failed"
+}
diff --git a/sys-auth/oath-toolkit/oath-toolkit-2.6.2.ebuild b/sys-auth/oath-toolkit/oath-toolkit-2.6.2.ebuild
new file mode 100644
index 000000000000..f92309af492c
--- /dev/null
+++ b/sys-auth/oath-toolkit/oath-toolkit-2.6.2.ebuild
@@ -0,0 +1,74 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit pam eutils autotools
+DESCRIPTION="Toolkit for using one-time password authentication with HOTP/TOTP algorithms"
+HOMEPAGE="http://www.nongnu.org/oath-toolkit/"
+SRC_URI="http://download.savannah.gnu.org/releases/${PN}/${P}.tar.gz"
+LICENSE="GPL-3 LGPL-2.1"
+
+SLOT="0"
+KEYWORDS="amd64 arm arm64 ppc64 x86"
+IUSE="pam pskc test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	pam? ( sys-libs/pam )
+	pskc? ( dev-libs/xmlsec )"
+DEPEND="${RDEPEND}
+	test? ( dev-libs/libxml2 )
+	dev-util/gtk-doc-am"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-gcc7.patch
+	"${FILESDIR}"/${P}-glibc228.patch
+)
+
+src_prepare() {
+	default
+
+	# Below files are verbatim copy. Effectively apply ${P}-gcc7.patch
+	# to all of them.
+	local s='oathtool/gl/intprops.h' d
+	for d in {liboath/gl/tests,libpskc/gl,pskctool/gl}/intprops.h; do
+		echo "Copy '${s}' to '${d}'"
+		cp "${s}" "${d}" || die
+	done
+
+	# These tests need git/cvs and don't reflect anything in the final app
+	sed -i -r \
+		-e '/TESTS/s,test-vc-list-files-(git|cvs).sh,,g' \
+		gl/tests/Makefile.am
+	# disable portability warnings, caused by gtk-doc.make
+	sed -i \
+		-e '/AM_INIT_AUTOMAKE/ s:-Wall:\0 -Wno-portability:' \
+		{liboath,libpskc}/configure.ac
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable test xmltest ) \
+		$(use_enable pam) \
+		$(use_with pam pam-dir $(getpam_mod_dir)) \
+		$(use_enable pskc)
+}
+
+src_install() {
+	default
+	if use pam; then
+		newdoc pam_oath/README README.pam
+	fi
+	if use pskc; then
+		doman pskctool/pskctool.1
+	fi
+}
+
+src_test() {
+	# without keep-going, it will bail out after the first testsuite failure,
+	# skipping the other testsuites. as they are mostly independant, this sucks.
+	emake --keep-going check
+	[ $? -ne 0 ] && die "At least one testsuite failed"
+}
diff --git a/sys-auth/otpcalc/Manifest b/sys-auth/otpcalc/Manifest
new file mode 100644
index 000000000000..0962c93e2d5d
--- /dev/null
+++ b/sys-auth/otpcalc/Manifest
@@ -0,0 +1,2 @@
+DIST otpCalc-0.97.tar.gz 123704 BLAKE2B 197dd2dafa634a2049ec7355e89bfe3a7fb2792560c133509477d073b73d754f9a1dc5c634010db48118c486dedc4933114a5e93671fbb27f3fa4a4a3140fad1 SHA512 5d22bd01fe90b32801d6f1c5ac3105036c14ac8197dda3c8454974ec72830a5f8cd693bd0520a51defdb0a7c7703483770410ba560436168826f8b6133a2524f
+DIST otpcalc-0.97-patches-1.tar.xz 4384 BLAKE2B 3bdf043c6b0101f4c28bd90a2c7da997e64e9a794d517484e08809d47f46feacfb764ec76f58c205e71dfaef6c25868bcaa4e5fe54bd45c0d7d5958c83ab488e SHA512 950b2df68acf377750710b0b9578b431b4aa745414a494b87062fffa559485cc4117bb08e68f22a79781047cfd2682082e30b1db81cddc5a3448bc285c5553bf
diff --git a/sys-auth/otpcalc/files/otpcalc.desktop b/sys-auth/otpcalc/files/otpcalc.desktop
new file mode 100644
index 000000000000..25c84065238f
--- /dev/null
+++ b/sys-auth/otpcalc/files/otpcalc.desktop
@@ -0,0 +1,8 @@
+[Desktop Entry]
+Type=Application
+Version=1.0
+Name=otpCalc
+Comment=One Time Password and S/Key calculator
+Icon=dialog-password
+Exec=otpCalc
+Categories=Utility;GTK;System;Security;
diff --git a/sys-auth/otpcalc/metadata.xml b/sys-auth/otpcalc/metadata.xml
new file mode 100644
index 000000000000..28f050a29794
--- /dev/null
+++ b/sys-auth/otpcalc/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+  <email>ulm@gentoo.org</email>
+</maintainer>
+<longdescription lang="en">
+  otpCalc is an RFC2289 and RFC1760 compliant one time password calculator,
+  written to use the GTK+ library for screen I/O.
+</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/otpcalc/otpcalc-0.97-r8.ebuild b/sys-auth/otpcalc/otpcalc-0.97-r8.ebuild
new file mode 100644
index 000000000000..f418eb8944ef
--- /dev/null
+++ b/sys-auth/otpcalc/otpcalc-0.97-r8.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs
+
+DESCRIPTION="A One Time Password and S/Key calculator for X"
+HOMEPAGE="http://killa.net/infosec/otpCalc/"
+SRC_URI="http://killa.net/infosec/otpCalc/otpCalc-${PV}.tar.gz
+	https://dev.gentoo.org/~ulm/distfiles/${P}-patches-1.tar.xz"
+
+LICENSE="GPL-2+" # bundled crypto functions are not used
+SLOT="0"
+KEYWORDS="~alpha amd64 ppc sparc x86"
+
+RDEPEND="x11-libs/gtk+:2
+	dev-libs/openssl:0="
+DEPEND="${RDEPEND}
+	virtual/pkgconfig"
+
+S="${WORKDIR}/otpCalc-${PV}"
+
+src_prepare() {
+	eapply ../patch
+	eapply_user
+
+	# override hardcoded FLAGS
+	sed -i \
+		-e 's:$(CC) $(CFLAGS) $^:$(CC) $(LDFLAGS) $(CFLAGS) $^:' \
+		-e "s#-s -O3#${CFLAGS}#g" \
+		Makefile.in || die
+
+	tc-export CC
+}
+
+src_compile() {
+	emake otpCalc otpCalc.1
+}
+
+src_install() {
+	dobin otpCalc
+	dosym otpCalc /usr/bin/otpcalc
+	doman otpCalc.1
+	newman - otpcalc.1 <<< ".so man1/otpCalc.1"
+	insinto /usr/share/applications
+	doins "${FILESDIR}/${PN}.desktop"
+	dodoc BUGS ChangeLog TODO
+}
diff --git a/sys-auth/pam-pgsql/Manifest b/sys-auth/pam-pgsql/Manifest
new file mode 100644
index 000000000000..9a78f96d75fa
--- /dev/null
+++ b/sys-auth/pam-pgsql/Manifest
@@ -0,0 +1 @@
+DIST pam-pgsql-0.7.3.2.tar.gz 712533 BLAKE2B 6841505963310f5192aff3dce4d7d0ed8dce18bac629bd9338390794bdb6a0a2dd96b96a55660b5fcb6a34ebeeb8ef4024ce1203321508e027284fc8e94df3c5 SHA512 d5766e56a13b0b4762fba10d624d12f130f2675f1f1772eaaf275b599f44adcf98287c2636462ba3faf46af139eb1bd157918c0c783040796562f37dec17a6d9
diff --git a/sys-auth/pam-pgsql/metadata.xml b/sys-auth/pam-pgsql/metadata.xml
new file mode 100644
index 000000000000..be2c0f7c4b15
--- /dev/null
+++ b/sys-auth/pam-pgsql/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="sourceforge">pam-pgsql</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam-pgsql/pam-pgsql-0.7.3.2.ebuild b/sys-auth/pam-pgsql/pam-pgsql-0.7.3.2.ebuild
new file mode 100644
index 000000000000..cf69a6bf4c9d
--- /dev/null
+++ b/sys-auth/pam-pgsql/pam-pgsql-0.7.3.2.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils pam
+
+DESCRIPTION="pam module to authenticate users via PostgreSQL"
+HOMEPAGE="https://sourceforge.net/projects/pam-pgsql/"
+
+if [[ ${PV} == *_p* ]]; then
+	SRC_URI="http://www.flameeyes.eu/gentoo-distfiles/${P}.tar.gz"
+else
+	SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+fi
+
+RDEPEND="sys-libs/pam
+	>=dev-db/postgresql-8.0:=
+	>=dev-libs/libgcrypt-1.2.0:0="
+DEPEND="${RDEPEND}"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+src_configure() {
+	econf \
+		--sysconfdir=/etc/security \
+		--libdir=/$(get_libdir) \
+		--docdir=/usr/share/doc/${PF}
+}
+
+src_compile() {
+	emake pammoddir="$(getpam_mod_dir)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" pammoddir="$(getpam_mod_dir)" install
+	find "${ED}" -name '*.la' -delete
+}
+
+pkg_postinst() {
+	if [[ -z ${REPLACING_VERSIONS} ]] ; then
+		elog "Please see the documentation and configuration examples in the"
+		elog "documentation directory at /usr/share/doc/${PF}."
+		elog ""
+		elog "Please note that the default configuration file in Gentoo has been"
+		elog "moved to /etc/security/pam-pgsql.conf to follow the other PAM modules."
+	fi
+}
diff --git a/sys-auth/pam-script/Manifest b/sys-auth/pam-script/Manifest
new file mode 100644
index 000000000000..56ab8b2cc102
--- /dev/null
+++ b/sys-auth/pam-script/Manifest
@@ -0,0 +1,2 @@
+DIST pam-script-1.1.8.tar.gz 36442 BLAKE2B 29ea87d694deb5483d34dd60fd4192d8d2050f6c5291fe5d2e7fa90408e7d8ce07b5b987a58142e43893d352d13d002604958b70565827d720e0ee89c6d8eb48 SHA512 c4b99c69a759b6422189707c52439a6afe59e32fca6238acf00116ed104b625920fb36b3e1f0aaf5edc77325b1f7b10d52ac2530d85cec53d941ae906e077543
+DIST pam-script-1.1.9.tar.gz 34890 BLAKE2B 0cb1c978cf335039185d34ea9d9a6a5363d73c86e05b24735d3a13d88c2eb03734831ee1fe80a87ca9d89c5b793cdc498b7fb2890a2e09209adfdd43784c2fd8 SHA512 319dff52923f7f895ff123bd6258bc83668b41da1172961e1747cb12fbdd260c6907b73f9881f5c3a50d4e2c4074b66747d7d6bbe1e0d7ab0411251705b59537
diff --git a/sys-auth/pam-script/metadata.xml b/sys-auth/pam-script/metadata.xml
new file mode 100644
index 000000000000..73fa215ed80c
--- /dev/null
+++ b/sys-auth/pam-script/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>chutzpah@gentoo.org</email>
+		<name>Patrick McLean</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">jeroennijhof/pam_script</remote-id>
+		<remote-id type="sourceforge">pam-script</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam-script/pam-script-1.1.8.ebuild b/sys-auth/pam-script/pam-script-1.1.8.ebuild
new file mode 100644
index 000000000000..18558310dab8
--- /dev/null
+++ b/sys-auth/pam-script/pam-script-1.1.8.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools
+
+MY_PN=${PN/-/_}
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="PAM module for running scripts during authorization, password change and session"
+HOMEPAGE="https://github.com/jeroennijhof/pam_script/"
+SRC_URI="https://github.com/jeroennijhof/${MY_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="examples"
+
+RDEPEND="sys-libs/pam"
+DEPEND="${RDEPEND}"
+
+S=${WORKDIR}/${MY_P}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--libdir=/$(get_libdir)/security \
+		--sysconfdir=/etc/security/${PN}
+}
+
+src_install() {
+	default
+
+	if use examples ; then
+		docinto examples
+		dodoc etc/README.examples
+		exeinto /usr/share/doc/${PF}/examples
+		doexe etc/{logscript,tally}
+		docompress -x /usr/share/doc/${PF}/examples/{logscript,tally}
+	fi
+}
diff --git a/sys-auth/pam-script/pam-script-1.1.9.ebuild b/sys-auth/pam-script/pam-script-1.1.9.ebuild
new file mode 100644
index 000000000000..c42c11ae0461
--- /dev/null
+++ b/sys-auth/pam-script/pam-script-1.1.9.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools
+
+MY_PN=${PN/-/_}
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="PAM module for running scripts during authorization, password change and session"
+HOMEPAGE="https://github.com/jeroennijhof/pam_script/"
+SRC_URI="https://github.com/jeroennijhof/${MY_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="examples"
+
+RDEPEND="sys-libs/pam"
+DEPEND="${RDEPEND}"
+
+S=${WORKDIR}/${MY_P}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		--libdir=/$(get_libdir)/security \
+		--sysconfdir=/etc/security/${PN}
+}
+
+src_install() {
+	default
+
+	if use examples ; then
+		docinto examples
+		dodoc etc/README.examples
+		exeinto /usr/share/doc/${PF}/examples
+		doexe etc/{logscript,tally}
+		docompress -x /usr/share/doc/${PF}/examples/{logscript,tally}
+	fi
+}
diff --git a/sys-auth/pam_abl/Manifest b/sys-auth/pam_abl/Manifest
new file mode 100644
index 000000000000..c9ad307408e3
--- /dev/null
+++ b/sys-auth/pam_abl/Manifest
@@ -0,0 +1 @@
+DIST pam-abl-0.6.0.tar.gz 48882 BLAKE2B 6b84901dab29a59e6a9944d2b0870cba940f2fa8fa4930ecf0821ce63db70bbea77d607efc3fa2cc425f2d992c59734c4710d4e45f632f790de6e14118376a6d SHA512 fd4fca672800683f87eba4c9804925d0f1c0e5991a32af7d045787cf571d5d98996d2303460fada4796432916c713973c82c3a70da06d686194e97bfb0e8198e
diff --git a/sys-auth/pam_abl/metadata.xml b/sys-auth/pam_abl/metadata.xml
new file mode 100644
index 000000000000..d56fbeedec7e
--- /dev/null
+++ b/sys-auth/pam_abl/metadata.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <!-- maintainer-needed -->
+  <longdescription lang="en">
+PAM module that provides auto blacklisting of hosts and users responsible for repeated failed authentication attempts.
+Once a host is blacklisted it is guaranteed to fail authentication even if the correct credentials are provided.
+Hosts which stop attempting to authenticate will, after a period of time, be un-blacklisted. 
+</longdescription>
+  <longdescription lang="it">
+Modulo Pam che permette di mantenere automaticamente una blacklist di host ed utenti responsabili di ripetuti tentativi di autenticazione falliti.
+Gli host soggetti a blacklist vedranno fallire i tentativi di login anche qualora le corrette credenziali vengano fornite.
+Una volta cessati i tentativi di autenticazione, dopo un certo periodo di tempo, gli host verranno riabilitati.
+</longdescription>
+  <upstream>
+    <remote-id type="sourceforge">pam-abl</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_abl/pam_abl-0.6.0.ebuild b/sys-auth/pam_abl/pam_abl-0.6.0.ebuild
new file mode 100644
index 000000000000..450c5c2e55b7
--- /dev/null
+++ b/sys-auth/pam_abl/pam_abl-0.6.0.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+MY_PN="${PN/_/-}"
+MY_P="${MY_PN}-${PV}"
+
+inherit flag-o-matic pam cmake-utils db-use multilib
+
+DESCRIPTION="PAM module for blacklisting hosts and users repeatedly failed authentication"
+HOMEPAGE="http://pam-abl.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${MY_PN}/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+
+DEPEND=">=sys-libs/pam-0.78-r2
+	>=sys-libs/db-4.2.52_p2:="
+RDEPEND="${DEPEND}"
+
+S=${WORKDIR}
+
+src_configure() {
+	pammod_hide_symbols
+
+	local mycmakeargs=(
+		-DDB_INCLUDE_DIR=$(db_includedir)
+		-DDB_LINK_DIR=/usr/$(get_libdir)
+		-DDB_LIBRARY=$(db_libname)
+	)
+	cmake-utils_src_configure
+}
+
+src_install() {
+	cmake-utils_src_install
+	dodir $(getpam_mod_dir)
+	mv "${D}"/usr/lib/security/*.so "${D}"/"$(getpam_mod_dir)" || die
+
+	dodoc doc/*.txt README
+}
+
+pkg_preinst() {
+	if has_version "~${CATEGORY}/${PN}-0.5.0" ; then
+		ewarn "Note: the 0.5.0 release named the module 'pam-abl.so' by accident; this version"
+		ewarn "fixes that and uses 'pam_abl.so' again.  Please update your config files."
+	fi
+}
diff --git a/sys-auth/pam_blue/Manifest b/sys-auth/pam_blue/Manifest
new file mode 100644
index 000000000000..640e704e726a
--- /dev/null
+++ b/sys-auth/pam_blue/Manifest
@@ -0,0 +1 @@
+DIST pam_blue-0.9.0.tar.bz2 251688 BLAKE2B ab8b56daab325ce837fc93a223067227679609413ef9389a1d6f91fb0695ed27925d2ce12a5a9a1f2bd5c0cf945646239a59a66d7e34230835b330d0cc59e149 SHA512 f611b6e3b509d2b917dd15a82f6fa3219ce554cdbf3bd224981c740bb3161dea67db9275b9bc13cd54644e0cb546eb2bb32dbff7e510170a0911b40d81f2d620
diff --git a/sys-auth/pam_blue/files/pam_blue-0.9.0-bad-log.patch b/sys-auth/pam_blue/files/pam_blue-0.9.0-bad-log.patch
new file mode 100644
index 000000000000..5f2a2628e4b0
--- /dev/null
+++ b/sys-auth/pam_blue/files/pam_blue-0.9.0-bad-log.patch
@@ -0,0 +1,11 @@
+--- a/src/bluepmain.c
++++ b/src/bluepmain.c
+@@ -88,7 +88,7 @@
+ 
+   if ( (lst = parse_rc()) == NULL) { /* something goes wrong (no config file, ...) */
+     user = NULL;
+-    syslog (LOG_ERR, "Can't parse configuration file [%s]!" CONFIG_FILE);
++    syslog (LOG_ERR, "Can't parse configuration file [%s]!", CONFIG_FILE);
+     return PAM_AUTH_ERR;
+   }
+     
diff --git a/sys-auth/pam_blue/files/pam_blue-0.9.0-char-locales.patch b/sys-auth/pam_blue/files/pam_blue-0.9.0-char-locales.patch
new file mode 100644
index 000000000000..40d2810f486c
--- /dev/null
+++ b/sys-auth/pam_blue/files/pam_blue-0.9.0-char-locales.patch
@@ -0,0 +1,17 @@
+https://bugs.gentoo.org/412941
+
+fix matching in various locales
+
+patch by Leho Kraav <leho@kraav.com>
+
+--- a/src/lexer.l
++++ b/src/lexer.l
+@@ -28,7 +28,7 @@
+ bluemac                   { return BLUEMAC; }
+ @                         { return AT;}
+ ;                         { return SEMICOLON; }
+-[a-zA-Z][a-zA-Z0-9_]*     { yylval.word  = (char *) strdup(yytext); return WORD; }
++[[:alpha:]][[:alnum:]_-]* { yylval.word  = (char *) strdup(yytext); return WORD; }
+ {HXDIGD}{HXDIGD}{HXDIG}   { yylval.word  = (char *) strdup(yytext); return MAC; }
+ [0-9][0-9]*               { yylval.value = atoi(yytext);   return DIGIT; }
+ =                         { return EQUAL; }
diff --git a/sys-auth/pam_blue/metadata.xml b/sys-auth/pam_blue/metadata.xml
new file mode 100644
index 000000000000..1ea86e8aac9c
--- /dev/null
+++ b/sys-auth/pam_blue/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <!-- maintainer-needed -->
+  <longdescription lang="en">
+    Bluepam is an extension for the common pam modules, give the user the
+    ability for authenticaten via a bluetooth compatible device like a cell
+    phone or various other bluetooth dongles (e.g. epox-presenter). Due to the
+    fact that a whole part of the bluetooth stack is implemented in hardware it
+    is relatively difficult to change the bluetoth hardware mac address which
+    makes this module more secure.
+  </longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_blue/pam_blue-0.9.0-r1.ebuild b/sys-auth/pam_blue/pam_blue-0.9.0-r1.ebuild
new file mode 100644
index 000000000000..29f0d900b410
--- /dev/null
+++ b/sys-auth/pam_blue/pam_blue-0.9.0-r1.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit pam autotools multilib
+
+DESCRIPTION="PAM module providing ability to authenticate via a bluetooth compatible device"
+HOMEPAGE="http://pam.0xdef.net/"
+SRC_URI="http://pam.0xdef.net/source/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND="sys-libs/pam
+	net-wireless/bluez"
+RDEPEND="${DEPEND}"
+
+S=${WORKDIR}/${PN}
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-char-locales.patch #412941
+	epatch "${FILESDIR}"/${P}-bad-log.patch
+	mv configure.{in,ac} || die
+	eautoreconf
+}
+
+src_configure() {
+	econf --libdir="$(getpam_mod_dir)"
+}
+
+src_install() {
+	# manual install to avoid sandbox violation and installing useless .la file
+	dopammod src/.libs/pam_blue.so
+	newpamsecurity . data/sample.conf bluesscan.conf.sample
+
+	dodoc AUTHORS NEWS README ChangeLog
+	doman doc/${PN}.7
+}
+
+pkg_postinst() {
+	elog "For configuration info, see /etc/security/bluesscan.conf.sample"
+	elog "http://pam.0xdef.net/doc.html and http://pam.0xdef.net/faq.html"
+	elog "Edit the file as required and copy/rename to bluesscan.conf when done."
+}
diff --git a/sys-auth/pam_client/ChangeLog b/sys-auth/pam_client/ChangeLog
new file mode 100644
index 000000000000..8d000523fbb6
--- /dev/null
+++ b/sys-auth/pam_client/ChangeLog
@@ -0,0 +1,8 @@
+# ChangeLog for sys-auth/pam_keystore
+# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
+# $Header: $
+
+  01 Jun 2010; Mike Hiretsky (mhiretskiy) <mh@calculate.ru>
+  pam_keystore-0.1.3.ebuild:
+  Change home page.
+
diff --git a/sys-auth/pam_client/Manifest b/sys-auth/pam_client/Manifest
new file mode 100644
index 000000000000..c65c13a976ea
--- /dev/null
+++ b/sys-auth/pam_client/Manifest
@@ -0,0 +1 @@
+DIST pam_client-0.2.1.tar.bz2 6897 BLAKE2B 04f09803bad9809184111c087ee6fff70aff60d62e7fe4ccd66af6434e5383b2e6cd42327fceb8976c8b77e2a751cb7ac59cd9729d524fdde67876cece874314 SHA512 86d5e2f5140b1543c7baaff471736af443a46644feb28e99a86acb650c8aa212e584c780b3be02a7a087e54cd5edf117ebb1d2eb6ba8a2d936ad00cedba56d4d
diff --git a/sys-auth/pam_client/pam_client-0.2.1-r1.ebuild b/sys-auth/pam_client/pam_client-0.2.1-r1.ebuild
new file mode 100644
index 000000000000..ae790cef6bb2
--- /dev/null
+++ b/sys-auth/pam_client/pam_client-0.2.1-r1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+inherit pam
+
+DESCRIPTION="Module of the waiting client daemon"
+HOMEPAGE="http://www.calculate-linux.org/main/en/calculate2"
+SRC_URI="ftp://ftp.calculate-linux.org/calculate/source/${PN}/${P}.tar.bz2
+	http://mirror.yandex.ru/calculate/source/${PN}/${P}.tar.bz2"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+DEPEND="net-nds/openldap"
+RDEPEND="${DEPEND}"
+
+src_compile() {
+	make CFLAGS="-Wall ${CFLAGS}" || die
+}
+
+src_install() {
+	dopammod pam_client.so
+}
diff --git a/sys-auth/pam_dotfile/Manifest b/sys-auth/pam_dotfile/Manifest
new file mode 100644
index 000000000000..ecae1388b34a
--- /dev/null
+++ b/sys-auth/pam_dotfile/Manifest
@@ -0,0 +1 @@
+DIST pam_dotfile-0.7.tar.gz 229009 BLAKE2B 99cec03f963735806f89ec6d099450993277877cc25562b4eb0c98dd61dbd8a8c5fcbb2c23ab24883c0fe4f44632fdbf0c6d8eeed646e3af28744b9a5aabba11 SHA512 544160068af2c6a488271d36cfae43340d4d7801702aef629ba781dff12b99334bc76ec14396783d0a9823d0f976c847335fe8b1b07cbbb6e43d0bd658ff7500
diff --git a/sys-auth/pam_dotfile/files/pam_dotfile-0.7-gentoo.patch b/sys-auth/pam_dotfile/files/pam_dotfile-0.7-gentoo.patch
new file mode 100644
index 000000000000..023f86553c39
--- /dev/null
+++ b/sys-auth/pam_dotfile/files/pam_dotfile-0.7-gentoo.patch
@@ -0,0 +1,157 @@
+diff --git a/configure.ac b/configure.ac
+index 4730bdf..b8d8747 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -44,16 +44,26 @@ CFLAGS="$CFLAGS -L/lib"
+ # Checks for libraries.
+ AC_CHECK_HEADER([security/pam_modules.h],, [AC_MSG_ERROR([*** Sorry, you have to install the PAM development files ***])])
+ 
+-LIBS="$LIBS -ldl -lpam -lpam_misc"
+-
+-case "$host" in
+-  *-*-linux*)
+-    PAM_MODDIR="/lib/security"
+-    ;;
+-  *)
+-    PAM_MODDIR="/usr/lib"
+-    ;;
+-esac
++AC_CHECK_HEADERS([security/_pam_macros.h security/pam_misc.h security/openpam.h])
++
++AC_CHECK_LIB([pam], [pam_start])
++AC_CHECK_LIB([pam_misc], [misc_conv])
++
++AC_ARG_WITH([pammoddir],
++	AC_HELP_STRING([--with-pammoddir], [Install module in specified directory]),
++	[
++		PAM_MODDIR=$withval
++	], [
++		case "$host" in
++			*-*-linux*)
++				PAM_MODDIR="/lib/security"
++				;;
++			*)
++				PAM_MODDIR="/usr/lib"
++				;;
++		esac
++	])
++
+ AC_SUBST(PAM_MODDIR)
+ 
+ # Checks for header files.
+@@ -64,7 +74,7 @@ AC_FUNC_LSTAT
+ AC_FUNC_LSTAT_FOLLOWS_SLASHED_SYMLINK
+ AC_FUNC_VPRINTF
+ 
+-AC_CHECK_HEADERS([fcntl.h limits.h syslog.h termios.h])
++AC_CHECK_HEADERS([fcntl.h limits.h syslog.h termios.h sys/types.h])
+ AC_HEADER_STDC
+ AC_HEADER_SYS_WAIT
+ 
+diff --git a/src/Makefile.am b/src/Makefile.am
+index 2905b7c..e7e47d2 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -22,7 +22,7 @@ moduledir = @PAM_MODDIR@
+ module_LTLIBRARIES = pam_dotfile.la
+ 
+ pam_dotfile_la_SOURCES = pam_dotfile.c md5.c md5util.c md5.h md5util.h log.c log.h common.c common.h
+-pam_dotfile_la_LDFLAGS = -module -avoid-version
++pam_dotfile_la_LDFLAGS = -module -avoid-version -export-symbols-regex '^pam_'
+ pam_dotfile_la_CFLAGS = $(AM_CFLAGS)
+ 
+ sbin_PROGRAMS = pam-dotfile-helper
+diff --git a/src/common.h b/src/common.h
+index ef34cf3..6a57116 100644
+--- a/src/common.h
++++ b/src/common.h
+@@ -21,7 +21,10 @@
+ ***/
+ 
+ #include <security/pam_modules.h>
+-#include <security/_pam_macros.h>
++#include <security/pam_appl.h>
++#ifdef HAVE_SECURITY__PAM_MACROS_H
++#  include <security/_pam_macros.h>
++#endif
+ 
+ typedef struct context {
+     int opt_debug;
+diff --git a/src/pam-dotfile-helper.c b/src/pam-dotfile-helper.c
+index 04c73de..1c09b18 100644
+--- a/src/pam-dotfile-helper.c
++++ b/src/pam-dotfile-helper.c
+@@ -23,6 +23,14 @@
+ #include <signal.h>
+ #include <pwd.h>
+ 
++#ifdef HAVE_CONFIG_H
++#  include <config.h>
++#endif
++
++#ifdef HAVE_SYS_TYPES_H
++#  include <sys/types.h>
++#endif
++
+ #include "common.h"
+ #include "log.h"
+ 
+diff --git a/src/pam_dotfile.c b/src/pam_dotfile.c
+index 405f494..183aafd 100644
+--- a/src/pam_dotfile.c
++++ b/src/pam_dotfile.c
+@@ -29,11 +29,19 @@
+ #include <sys/types.h>
+ #include <sys/wait.h>
+ #include <fcntl.h>
++#include <stdlib.h>
+ 
+ #define PAM_SM_AUTH
+ 
+ #include <security/pam_modules.h>
+-#include <security/_pam_macros.h>
++#include <security/pam_appl.h>
++#ifdef HAVE_SECURITY__PAM_MACROS_H
++#  include <security/_pam_macros.h>
++#endif
++
++#ifndef x_strdup
++#  define x_strdup(s)  ( (s) ? strdup(s):NULL )
++#endif
+ 
+ #include "md5.h"
+ #include "md5util.h"
+diff --git a/src/pamtest.c b/src/pamtest.c
+index 171e601..6583de1 100644
+--- a/src/pamtest.c
++++ b/src/pamtest.c
+@@ -19,11 +19,28 @@
+ 
+ #include <stdio.h>
+ 
++#ifdef HAVE_CONFIG_H
++#  include <config.h>
++#endif
++
+ #include <security/pam_appl.h>
+-#include <security/pam_misc.h>
++
++#ifdef HAVE_SECURITY_PAM_MISC_H
++#  include <security/pam_misc.h>
++#endif
++
++#ifdef HAVE_SECURITY_OPENPAM_H
++#  include <security/openpam.h>
++#endif
+ 
+ int main(int argc, char*argv[]) {
++#ifdef HAVE_LIBPAM_MISC
+     static struct pam_conv pc = { misc_conv, NULL };
++#elif defined(_OPENPAM)
++    static struct pam_conv pc = { openpam_nullconv, NULL };
++#else
++    static struct pam_conv pc = { NULL };
++#endif
+     pam_handle_t *ph = NULL;
+     int r, ret;
+     char *username, *procname, *service;
diff --git a/sys-auth/pam_dotfile/metadata.xml b/sys-auth/pam_dotfile/metadata.xml
new file mode 100644
index 000000000000..9bfbeb6e6aa9
--- /dev/null
+++ b/sys-auth/pam_dotfile/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="github">gentoo/pam_dotfile</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_dotfile/pam_dotfile-0.7-r2.ebuild b/sys-auth/pam_dotfile/pam_dotfile-0.7-r2.ebuild
new file mode 100644
index 000000000000..5ec0eed67259
--- /dev/null
+++ b/sys-auth/pam_dotfile/pam_dotfile-0.7-r2.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils pam autotools autotools-utils
+
+MY_P="${P/_beta/beta}"
+S="${WORKDIR}/${MY_P}"
+
+DESCRIPTION="pam module to allow password-storing in \$HOME/dotfiles"
+HOMEPAGE="http://0pointer.de/lennart/projects/pam_dotfile/
+	https://github.com/gentoo/pam_dotfile/"
+SRC_URI="http://0pointer.de/lennart/projects/pam_dotfile/${MY_P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+IUSE="doc"
+
+RDEPEND="sys-libs/pam"
+DEPEND="${RDEPEND}
+	doc? ( www-client/lynx )"
+
+HTML_DOCS="doc"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-gentoo.patch
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable doc lynx)
+		--with-pammoddir=$(getpam_mod_dir)
+	)
+	autotools-utils_src_configure
+}
+
+src_install() {
+	autotools-utils_src_install
+
+	# kill the libtool archives
+	rm -rf "${D}"/$(getpam_mod_dir)/*.la
+}
diff --git a/sys-auth/pam_fprint/Manifest b/sys-auth/pam_fprint/Manifest
new file mode 100644
index 000000000000..975139d4b57b
--- /dev/null
+++ b/sys-auth/pam_fprint/Manifest
@@ -0,0 +1 @@
+DIST pam_fprint-0.2.tar.bz2 72781 BLAKE2B 196bfd6a714da2d0fa8fe616a63e31008024a02b785aa393a62acd2267c1cc87382aef1d7af8d9f626c406534dd1e952dec520e6fc5dc0bc52d157246762c15c SHA512 c860488efabfd6301b4e19596e15545bbcb1a15f79bfd7c61a357ef47cf0a621ec0d15328d5be30f7ef045813e18333bd0aea7fb8fcb06681007dcacca6396fd
diff --git a/sys-auth/pam_fprint/files/pam_fprint-0.2-headers.patch b/sys-auth/pam_fprint/files/pam_fprint-0.2-headers.patch
new file mode 100644
index 000000000000..9ff6e551ee87
--- /dev/null
+++ b/sys-auth/pam_fprint/files/pam_fprint-0.2-headers.patch
@@ -0,0 +1,12 @@
+Add definition of free and setenv, Michael Weber <xmw@gentoo.org> Oct 18th, 2010
+
+--- pam_fprint-0.2/src/pam_fprint.c
++++ pam_fprint-0.2/src/pam_fprint.c
+@@ -22,6 +22,7 @@
+ #include <sys/types.h>
+ #include <pwd.h>
+ #include <string.h>
++#include <stdlib.h>
+ 
+ #include <fprint.h>
+ 
diff --git a/sys-auth/pam_fprint/metadata.xml b/sys-auth/pam_fprint/metadata.xml
new file mode 100644
index 000000000000..7635d2b6bbbb
--- /dev/null
+++ b/sys-auth/pam_fprint/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="sourceforge">fprint</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_fprint/pam_fprint-0.2-r1.ebuild b/sys-auth/pam_fprint/pam_fprint-0.2-r1.ebuild
new file mode 100644
index 000000000000..8b4f0890a9a9
--- /dev/null
+++ b/sys-auth/pam_fprint/pam_fprint-0.2-r1.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit pam
+
+DESCRIPTION="a simple PAM module which uses libfprint's functionality for authentication"
+HOMEPAGE="http://www.reactivated.net/fprint/wiki/Pam_fprint"
+SRC_URI="mirror://sourceforge/fprint/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 ~ia64 ppc ppc64 sparc x86"
+IUSE=""
+
+RDEPEND="
+	sys-auth/libfprint
+	sys-libs/pam"
+DEPEND="${RDEPEND}"
+
+PATCHES=( "${FILESDIR}"/${P}-headers.patch )
+
+src_install() {
+	dopammod src/${PN}.so
+	newbin src/pamtest pamtest.fprint
+	dobin src/pam_fprint_enroll
+	einstalldocs
+}
diff --git a/sys-auth/pam_keystore/ChangeLog b/sys-auth/pam_keystore/ChangeLog
new file mode 100644
index 000000000000..8d000523fbb6
--- /dev/null
+++ b/sys-auth/pam_keystore/ChangeLog
@@ -0,0 +1,8 @@
+# ChangeLog for sys-auth/pam_keystore
+# Copyright 1999-2010 Gentoo Foundation; Distributed under the GPL v2
+# $Header: $
+
+  01 Jun 2010; Mike Hiretsky (mhiretskiy) <mh@calculate.ru>
+  pam_keystore-0.1.3.ebuild:
+  Change home page.
+
diff --git a/sys-auth/pam_keystore/Manifest b/sys-auth/pam_keystore/Manifest
new file mode 100644
index 000000000000..b500318920c8
--- /dev/null
+++ b/sys-auth/pam_keystore/Manifest
@@ -0,0 +1 @@
+DIST pam_keystore-0.1.3.tar.bz2 5894 BLAKE2B 44fd0912846b2412dc4392bc5b666c5d295d1fdd8325655281427505c0ab193d4a0bb4da3e7f6a82c43ded00caf130140fcc4ff26e08a213f295ac011367aa42 SHA512 5336bccab706921b13146592d634489bd6d6b7f0fdc17fa3f2dccb163d886792bc873aa09009c65bd15b44e9f7dd8a7ee0d67480da80d7b3f73400bf33834444
diff --git a/sys-auth/pam_keystore/pam_keystore-0.1.3-r1.ebuild b/sys-auth/pam_keystore/pam_keystore-0.1.3-r1.ebuild
new file mode 100644
index 000000000000..04996c4f2857
--- /dev/null
+++ b/sys-auth/pam_keystore/pam_keystore-0.1.3-r1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+inherit pam
+
+DESCRIPTION="Keeps a login and the password the user in the kernel"
+HOMEPAGE="http://www.calculate-linux.org/main/en/pam_keystore"
+SRC_URI="ftp://ftp.calculate-linux.org/calculate/source/${PN}/${P}.tar.bz2
+	http://mirror.yandex.ru/calculate/source/${PN}/${P}.tar.bz2"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+DEPEND=">=sys-apps/keyutils-1.1"
+RDEPEND="${DEPEND}"
+
+src_compile() {
+	make CFLAGS="-Wall ${CFLAGS}" || die
+}
+
+src_install() {
+	dopammod pam_keystore.so
+}
diff --git a/sys-auth/pam_krb5/Manifest b/sys-auth/pam_krb5/Manifest
new file mode 100644
index 000000000000..7524a5cccc01
--- /dev/null
+++ b/sys-auth/pam_krb5/Manifest
@@ -0,0 +1 @@
+DIST pam-krb5-4.9.tar.gz 630425 BLAKE2B dc4a539c25c72c50c07ca3359d1dcdcb58b36ec48fc8fa40600c2fece2de8f3cc6af583fce2640ef2d515c342487f9398ed9153abb734ee2dd73b3d440bd00ab SHA512 0e93fbfacf56f9935902ead000dc46732c8a11cc2689c00b68cbaaf6519108a4ce53bb943479d01e439fb92bcc5c1a219d2b816a5ade2af54ea093bb78907201
diff --git a/sys-auth/pam_krb5/metadata.xml b/sys-auth/pam_krb5/metadata.xml
new file mode 100644
index 000000000000..fc190afc52cf
--- /dev/null
+++ b/sys-auth/pam_krb5/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>eras@gentoo.org</email>
+    <name>Eray Aslan</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>kerberos@gentoo.org</email>
+    <name>Kerberos</name>
+  </maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_krb5/pam_krb5-4.9.ebuild b/sys-auth/pam_krb5/pam_krb5-4.9.ebuild
new file mode 100644
index 000000000000..dcf926d45e69
--- /dev/null
+++ b/sys-auth/pam_krb5/pam_krb5-4.9.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit multilib
+
+DESCRIPTION="Kerberos V PAM Authentication Module"
+HOMEPAGE="https://www.eyrie.org/~eagle/software/pam-krb5/"
+SRC_URI="https://archives.eyrie.org/software/kerberos/pam-krb5-${PV}.tar.gz"
+
+LICENSE="|| ( BSD-2 GPL-2 )"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ppc ppc64 ~s390 sparc x86"
+IUSE=""
+# tests fail without a /etc/krb5.conf
+RESTRICT="test"
+
+DEPEND="
+	virtual/krb5
+	sys-libs/pam"
+
+RDEPEND="${DEPEND}"
+
+S="${WORKDIR}/${P/_/-}"
+
+src_configure() {
+	econf \
+		--libdir=/$(get_libdir)
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+	dodoc NEWS README TODO
+
+	rm "${D}/$(get_libdir)/security/pam_krb5.la"
+}
diff --git a/sys-auth/pam_ldap/Manifest b/sys-auth/pam_ldap/Manifest
new file mode 100644
index 000000000000..8811e02b4ed1
--- /dev/null
+++ b/sys-auth/pam_ldap/Manifest
@@ -0,0 +1 @@
+DIST pam_ldap-186.tar.gz 163437 BLAKE2B 4e917985b78349283c891daca94935792f2316afc08cd694edb7256c89a7ed612a62ba4b53111fc2022f6e11f754103bf58ac0a53a4298b011a5379625c51cdc SHA512 aaa6fbc48150db53bf92dcf600bcb8f0526baa2e6124f46468f59958c8a91495eb003d16a45b659c8cbb2d3481c4732a0d1f5945a2c98c09549ef8a51ed18a3d
diff --git a/sys-auth/pam_ldap/metadata.xml b/sys-auth/pam_ldap/metadata.xml
new file mode 100644
index 000000000000..d85b4252fc33
--- /dev/null
+++ b/sys-auth/pam_ldap/metadata.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<!-- maintainer-needed -->
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_ldap/pam_ldap-186-r1.ebuild b/sys-auth/pam_ldap/pam_ldap-186-r1.ebuild
new file mode 100644
index 000000000000..0cd43d581f46
--- /dev/null
+++ b/sys-auth/pam_ldap/pam_ldap-186-r1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+inherit eutils multilib-minimal pam
+
+DESCRIPTION="PAM LDAP Module"
+HOMEPAGE="http://www.padl.com/OSS/pam_ldap.html"
+SRC_URI="http://www.padl.com/download/${P}.tar.gz"
+
+LICENSE="|| ( GPL-2 LGPL-2 )"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm hppa ~ia64 ~mips ppc ppc64 sparc x86"
+IUSE="ssl sasl"
+
+DEPEND=">=sys-libs/glibc-2.1.3
+	sys-libs/pam[${MULTILIB_USEDEP}]
+	>=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}]
+	sasl? ( >=dev-libs/cyrus-sasl-2.1.26-r3[${MULTILIB_USEDEP}] )"
+RDEPEND="${DEPEND}"
+
+multilib_src_configure() {
+	local myconf=(
+		--with-ldap-lib=openldap
+		$(use_enable ssl)
+	)
+	use sasl || myconf+=( ac_cv_header_sasl_sasl_h=no )
+
+	ECONF_SOURCE=${S} \
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	PERL5LIB=${S} \
+	emake
+}
+
+multilib_src_install() {
+	dopammod pam_ldap.so
+}
+
+multilib_src_install_all() {
+	dodoc pam.conf ldap.conf ldapns.schema chsh chfn certutil
+	dodoc ChangeLog CVSVersionInfo.txt README AUTHORS ns-pwd-policy.schema
+	doman pam_ldap.5
+
+	docinto pam.d
+	dodoc pam.d/*
+}
diff --git a/sys-auth/pam_mktemp/Manifest b/sys-auth/pam_mktemp/Manifest
new file mode 100644
index 000000000000..9515eb598f98
--- /dev/null
+++ b/sys-auth/pam_mktemp/Manifest
@@ -0,0 +1 @@
+DIST pam_mktemp-1.1.1.tar.gz 6754 BLAKE2B 5fc3cdf56c7bca9d46c339cc14eb13c74eb590ff4e19824dd2b6e313c2825ae18248873f0aca19a1c7ca8a4dfa5d6944ca9d07ea8355a4c0f7b57567a79b0e3c SHA512 e2e42115a1fe70c128397d842dc69f96863d721dfa886ebc21b5e8249333adc671d74213ecf1222d65417cd4747eb6114f515271fd7eac4376a2b7e28925996d
diff --git a/sys-auth/pam_mktemp/files/pam_mktemp-1.1.1-e2fsprogs-libs.patch b/sys-auth/pam_mktemp/files/pam_mktemp-1.1.1-e2fsprogs-libs.patch
new file mode 100644
index 000000000000..17c038a832e2
--- /dev/null
+++ b/sys-auth/pam_mktemp/files/pam_mktemp-1.1.1-e2fsprogs-libs.patch
@@ -0,0 +1,49 @@
+Index: pam_mktemp-1.1.1/pam_mktemp.c
+===================================================================
+--- pam_mktemp-1.1.1/pam_mktemp.c
++++ pam_mktemp-1.1.1/pam_mktemp.c
+@@ -55,7 +55,7 @@
+  */
+ # include <fcntl.h>
+ # include <sys/ioctl.h>
+-# include <ext2fs/ext2_fs.h>
++# include <linux/fs.h>
+ #else
+ # undef USE_APPEND_FL
+ #endif /* HAVE_APPEND_FL */
+@@ -88,7 +88,7 @@ static int ext2fs_chflags(const char *na
+ 	if ((fd = open(name, O_RDONLY)) < 0)
+ 		return -1;
+ 
+-	if (ioctl(fd, EXT2_IOC_GETFLAGS, &old_flags)) {
++	if (ioctl(fd, FS_IOC_GETFLAGS, &old_flags)) {
+ 		if ((errno == ENOTTY) /* Inappropriate ioctl for device */
+ 		    || (errno == ENOSYS)) /* Function not implemented */
+ 			errno = EOPNOTSUPP;
+@@ -98,7 +98,7 @@ static int ext2fs_chflags(const char *na
+ 
+ 	new_flags = (old_flags | set) & ~clear;
+ 	if (new_flags != old_flags)
+-		retval = ioctl(fd, EXT2_IOC_SETFLAGS, &new_flags);
++		retval = ioctl(fd, FS_IOC_SETFLAGS, &new_flags);
+ 
+ 	if (close(fd))
+ 		retval = -1;
+@@ -233,7 +233,7 @@ PAM_EXTERN int pam_sm_open_session(pam_h
+  */
+ 
+ #ifdef USE_APPEND_FL
+-	ext2fs_chflags(PRIVATE_PREFIX, EXT2_APPEND_FL, 0);
++	ext2fs_chflags(PRIVATE_PREFIX, FS_APPEND_FL, 0);
+ #endif /* USE_APPEND_FL */
+ 
+ 	userdir = malloc(strlen(PRIVATE_PREFIX) + strlen(user) + 2);
+@@ -260,7 +260,7 @@ PAM_EXTERN int pam_sm_open_session(pam_h
+ 	} else {
+ 		/* Don't let the append-only flag get inherited
+ 		 * from the parent directory. */
+-		if (ext2fs_chflags(userdir, 0, EXT2_APPEND_FL) &&
++		if (ext2fs_chflags(userdir, 0, FS_APPEND_FL) &&
+ 		    errno != EOPNOTSUPP)
+ 			goto out;
+ #endif /* HAVE_APPEND_FL */
diff --git a/sys-auth/pam_mktemp/metadata.xml b/sys-auth/pam_mktemp/metadata.xml
new file mode 100644
index 000000000000..6f880ce8f4ed
--- /dev/null
+++ b/sys-auth/pam_mktemp/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+<email>swegener@gentoo.org</email>
+</maintainer>
+<use>
+<flag name="prevent-removal">If supported, set EXT2_APPEND_FL on /tmp/.private to prevent temporary directories from being removed</flag>
+</use>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_mktemp/pam_mktemp-1.1.1.ebuild b/sys-auth/pam_mktemp/pam_mktemp-1.1.1.ebuild
new file mode 100644
index 000000000000..ce7ec276c563
--- /dev/null
+++ b/sys-auth/pam_mktemp/pam_mktemp-1.1.1.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit toolchain-funcs pam
+
+DESCRIPTION="Create per-user private temporary directories during login"
+HOMEPAGE="http://www.openwall.com/pam/"
+SRC_URI="http://www.openwall.com/pam/modules/${PN}/${P}.tar.gz"
+
+LICENSE="BSD-2" # LICENSE file says "heavily cut-down 'BSD license'"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="selinux +prevent-removal"
+
+RDEPEND="sys-libs/pam
+	selinux? ( sys-libs/libselinux )"
+
+DEPEND="${RDEPEND}
+	prevent-removal? ( sys-kernel/linux-headers )"
+
+src_prepare() {
+	default
+	eapply "${FILESDIR}"/${P}-e2fsprogs-libs.patch
+}
+
+src_compile() {
+	emake \
+		CC="$(tc-getCC)" \
+		CFLAGS="${CFLAGS} -fPIC" \
+		LDFLAGS="${LDFLAGS} --shared -Wl,--version-script,\$(MAP)" \
+		USE_SELINUX="$(use selinux && echo 1 || echo 0)" \
+		USE_APPEND_FL="$(use prevent-removal && echo 1 || echo 0)"
+}
+
+src_install() {
+	dopammod pam_mktemp.so
+	dodoc README
+}
diff --git a/sys-auth/pam_mount/Manifest b/sys-auth/pam_mount/Manifest
new file mode 100644
index 000000000000..9ceb07e294c3
--- /dev/null
+++ b/sys-auth/pam_mount/Manifest
@@ -0,0 +1 @@
+DIST pam_mount-2.16.tar.xz 312316 BLAKE2B 5954af8f8bf8b9cb47e1c07dc0d5fc5c4db099eeca5de90a3a53dc65aac0a2a6fba3f99c4d91d12f53b13abb5d3bae262b42536434553872a36ec108dc8d2c0c SHA512 3a579d7287cfcaef831d3e54d3e912407b65a966303e81c47f445d601f38f866ce04326e3d37a061f74f97b9cfb201e56109f57e55699d15d8f947ae2b91c8e3
diff --git a/sys-auth/pam_mount/files/pam_mount-2.16-crypto-Add-support-for-LUKS2.patch b/sys-auth/pam_mount/files/pam_mount-2.16-crypto-Add-support-for-LUKS2.patch
new file mode 100644
index 000000000000..437f359277d5
--- /dev/null
+++ b/sys-auth/pam_mount/files/pam_mount-2.16-crypto-Add-support-for-LUKS2.patch
@@ -0,0 +1,52 @@
+From d4434c05e7c0cf05d87089404cfa2deedc60811a Mon Sep 17 00:00:00 2001
+From: Ingo Franzki <ifranzki@linux.ibm.com>
+Date: Mon, 29 Oct 2018 16:47:40 +0100
+Subject: [PATCH] crypto: Add support for LUKS2
+
+Cryptsetup version 2.0 added support for LUKS2.
+This patch adds support for mounting LUKS2 volumes with
+pam_mount.
+
+Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+---
+ src/crypto-dmc.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/crypto-dmc.c b/src/crypto-dmc.c
+index d0ab6ca..abd0358 100644
+--- a/src/crypto-dmc.c
++++ b/src/crypto-dmc.c
+@@ -21,6 +21,12 @@
+ #include "libcryptmount.h"
+ #include "pam_mount.h"
+ 
++#ifndef CRYPT_LUKS
++	#define CRYPT_LUKS	NULL /* Passing NULL to crypt_load will
++					default to LUKS(1) on older
++					libcryptsetup versions. */
++#endif
++
+ /**
+  * dmc_is_luks - check if @path points to a LUKS volume (cf. normal dm-crypt)
+  * @path:	path to the crypto container
+@@ -48,7 +54,7 @@ EXPORT_SYMBOL int ehd_is_luks(const char *path, bool blkdev)
+ 
+ 	ret = crypt_init(&cd, device);
+ 	if (ret == 0) {
+-		ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++		ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 		if (ret == -EINVAL)
+ 			ret = false;
+ 		else if (ret == 0)
+@@ -106,7 +112,7 @@ static bool dmc_run(const struct ehd_mount_request *req,
+ #endif
+ 	}
+ 
+-	ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++	ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 	if (ret == 0) {
+ 		ret = crypt_activate_by_passphrase(cd, mt->crypto_name,
+ 		      CRYPT_ANY_SLOT, req->key_data, req->key_size, flags);
+-- 
+2.21.0
+
diff --git a/sys-auth/pam_mount/metadata.xml b/sys-auth/pam_mount/metadata.xml
new file mode 100644
index 000000000000..7a4c23f3e8e5
--- /dev/null
+++ b/sys-auth/pam_mount/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>hanno@gentoo.org</email>
+	</maintainer>
+	<maintainer type="person">
+		<email>mattst88@gentoo.org</email>
+		<name>Matt Turner</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="sourceforge">pam-mount</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild b/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild
new file mode 100644
index 000000000000..4aa9be59ce6a
--- /dev/null
+++ b/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="A PAM module that can mount volumes for a user session"
+HOMEPAGE="http://pam-mount.sourceforge.net"
+SRC_URI="mirror://sourceforge/pam-mount/${P}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+
+IUSE="crypt ssl selinux"
+
+COMMON_DEPEND=">=sys-libs/pam-0.99
+	>=sys-libs/libhx-3.12.1
+	>=dev-libs/libxml2-2.6
+	crypt? ( >=sys-fs/cryptsetup-1.1.0:= )
+	ssl? ( dev-libs/openssl:0= )
+	selinux? ( sys-libs/libselinux )"
+DEPEND="${COMMON_DEPEND}
+	virtual/pkgconfig"
+RDEPEND="${COMMON_DEPEND}
+	>=sys-apps/util-linux-2.20"
+
+PATCHES=(
+		"${FILESDIR}"/pam_mount-2.16-crypto-Add-support-for-LUKS2.patch
+)
+
+src_configure() {
+	econf --with-slibdir="/$(get_libdir)" \
+			$(use_with crypt cryptsetup) \
+			$(use_with ssl crypto) \
+			$(use_with selinux)
+}
+
+src_install() {
+	default
+	use selinux || rm -r "${D}"/etc/selinux
+	dodoc doc/*.txt
+}
diff --git a/sys-auth/pam_mount/pam_mount-2.16.ebuild b/sys-auth/pam_mount/pam_mount-2.16.ebuild
new file mode 100644
index 000000000000..95e94fc71b07
--- /dev/null
+++ b/sys-auth/pam_mount/pam_mount-2.16.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="A PAM module that can mount volumes for a user session"
+HOMEPAGE="http://pam-mount.sourceforge.net"
+SRC_URI="mirror://sourceforge/pam-mount/${P}.tar.xz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+
+IUSE="crypt ssl selinux"
+
+COMMON_DEPEND=">=sys-libs/pam-0.99
+	>=sys-libs/libhx-3.12.1
+	>=dev-libs/libxml2-2.6
+	crypt? ( >=sys-fs/cryptsetup-1.1.0:= )
+	ssl? ( dev-libs/openssl:0= )
+	selinux? ( sys-libs/libselinux )"
+DEPEND="${COMMON_DEPEND}
+	virtual/pkgconfig"
+RDEPEND="${COMMON_DEPEND}
+	>=sys-apps/util-linux-2.20"
+
+src_configure() {
+	econf --with-slibdir="/$(get_libdir)" \
+			$(use_with crypt cryptsetup) \
+			$(use_with ssl crypto) \
+			$(use_with selinux)
+}
+
+src_install() {
+	default
+	use selinux || rm -r "${D}"/etc/selinux
+	dodoc doc/*.txt
+}
diff --git a/sys-auth/pam_mysql/Manifest b/sys-auth/pam_mysql/Manifest
new file mode 100644
index 000000000000..6f2c805ba2c6
--- /dev/null
+++ b/sys-auth/pam_mysql/Manifest
@@ -0,0 +1 @@
+DIST pam_mysql-0.8.1.tar.gz 49613 BLAKE2B 1e3f6b0c8a11c8d328300fc820ddbbcd1601735de611e9317aab8f26ab2fbcf0f704e7a2c26de347fe9c4088c8171f0c278cd92e1668671871e5cd79db981241 SHA512 68aecc83c026c7616211a46b80f96fe822c8bd069a5ab6e9b170607bddac0dabe20410f78a1ac61ca1c1b2724ed0f0d99694d34bf28763270da3771c9ef05faf
diff --git a/sys-auth/pam_mysql/metadata.xml b/sys-auth/pam_mysql/metadata.xml
new file mode 100644
index 000000000000..4311429547a7
--- /dev/null
+++ b/sys-auth/pam_mysql/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>mysql-bugs@gentoo.org</email>
+		<name>MySQL</name>
+	</maintainer>
+	<use>
+		<flag name="openssl">Use OpenSSL for md5 and sha1 support</flag>
+	</use>
+	<upstream>
+		<remote-id type="sourceforge">pam-mysql</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_mysql/pam_mysql-0.8.1-r1.ebuild b/sys-auth/pam_mysql/pam_mysql-0.8.1-r1.ebuild
new file mode 100644
index 000000000000..a804c80bb49f
--- /dev/null
+++ b/sys-auth/pam_mysql/pam_mysql-0.8.1-r1.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+inherit autotools pam
+
+DESCRIPTION="pam_mysql is a module for pam to authenticate users with mysql"
+HOMEPAGE="https://github.com/NigelCunningham/pam-MySQL"
+
+SRC_URI="https://github.com/NigelCunningham/pam-MySQL/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+DEPEND="
+	>=sys-libs/pam-0.72:0=
+	dev-db/mysql-connector-c:0=
+	openssl? ( dev-libs/openssl:0= )
+"
+RDEPEND="${DEPEND}"
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 ppc ~sparc x86"
+IUSE="openssl"
+S="${WORKDIR}/pam-MySQL-${PV}"
+
+DOCS=( AUTHORS ChangeLog NEWS README )
+
+src_prepare() {
+	default
+
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--with-pam-mods-dir="$(getpam_mod_dir)"
+		$(use_with openssl)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	rm "${ED%/}$(getpam_mod_dir)/pam_mysql.la" || die
+}
diff --git a/sys-auth/pam_p11/Manifest b/sys-auth/pam_p11/Manifest
new file mode 100644
index 000000000000..36d88fcb2816
--- /dev/null
+++ b/sys-auth/pam_p11/Manifest
@@ -0,0 +1 @@
+DIST pam_p11-0.3.1.tar.gz 422940 BLAKE2B b4c6d60a7ee31d808b9e928339f6e8aba3b56655b9f408ff7cd15ff4a397c89c00d00b0bbe70fc0b7bd6c6a246acd9c313c8f5b21a88e1474355c3407ff694f0 SHA512 caaa6882d4c007dfaba5974dc420bc45aa225f705679d170fdc9576aa49cbd24bba6985f14eb2bca97d4fe37aaf6088641add912dfbb93740b7d634f448addcf
diff --git a/sys-auth/pam_p11/metadata.xml b/sys-auth/pam_p11/metadata.xml
new file mode 100644
index 000000000000..a9086a736580
--- /dev/null
+++ b/sys-auth/pam_p11/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<name>Lars Wendler</name>
+		<email>polynomial-c@gentoo.org</email>
+	</maintainer>
+	<upstream>
+		<remote-id type="sourceforge">opensc</remote-id>
+		<remote-id type="github">opensc/pam_p11</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_p11/pam_p11-0.3.1.ebuild b/sys-auth/pam_p11/pam_p11-0.3.1.ebuild
new file mode 100644
index 000000000000..b812b0b6f4e0
--- /dev/null
+++ b/sys-auth/pam_p11/pam_p11-0.3.1.ebuild
@@ -0,0 +1,30 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools pam
+
+DESCRIPTION="PAM module for authenticating against PKCS#11 tokens"
+HOMEPAGE="https://github.com/opensc/pam_p11/wiki"
+SRC_URI="https://github.com/OpenSC/${PN}/releases/download/${P}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha amd64 ~hppa ~ia64 ppc ppc64 ~sparc x86"
+
+RDEPEND="sys-libs/pam
+	dev-libs/libp11:=
+	dev-libs/openssl:0="
+
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+src_configure() {
+	econf --with-pamdir="$(getpam_mod_dir)"
+}
+
+src_install() {
+	default
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/pam_passwdqc/metadata.xml b/sys-auth/pam_passwdqc/metadata.xml
new file mode 100644
index 000000000000..16e0ddf55e71
--- /dev/null
+++ b/sys-auth/pam_passwdqc/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<longdescription>
+		Password strength checking for PAM aware password changing programs. This is an alternative to the default cracklib.
+	</longdescription>
+	<longdescription lang="ja">
+		パスワード変更プログラムに反応する PAM のパスワード強度検査機能です。これはデフォルトの cracklib の代替です。
+	</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild b/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild
new file mode 100644
index 000000000000..5414ea267e68
--- /dev/null
+++ b/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild
@@ -0,0 +1,14 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+DESCRIPTION="Stub ebuild to help migrate to newer package name"
+HOMEPAGE="http://www.openwall.com/passwdqc/"
+
+LICENSE="Openwall BSD public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
+
+DEPEND="sys-auth/passwdqc[pam(+)]"
+RDEPEND="${DEPEND}"
diff --git a/sys-auth/pam_pkcs11/Manifest b/sys-auth/pam_pkcs11/Manifest
new file mode 100644
index 000000000000..33305cb70bfc
--- /dev/null
+++ b/sys-auth/pam_pkcs11/Manifest
@@ -0,0 +1 @@
+DIST pam_pkcs11-0.6.9.tar.gz 1358280 SHA256 b27e8ba40ffc5b847abf95d2e636ed58640f068398a233f27e211363c20eba91 SHA512 954c37b9aa93d007ca3c0c49790bf6840d3b902b5dacda485c9020f4362db4a5a41670ad95f672757f3a7e60fe430765023f1a57e9a79260c052c45854d5ba51 WHIRLPOOL fcca466565978701e128396f69de6ce1e9b8a3c0771865a71e22f0e23c1641c1ffe7d6e36435bbf93b11fb4e34ecab71e580685e1d481f7df0bfd5b5b52c37b6
diff --git a/sys-auth/pam_pkcs11/pam_pkcs11-0.6.9.ebuild b/sys-auth/pam_pkcs11/pam_pkcs11-0.6.9.ebuild
new file mode 100644
index 000000000000..cfd1dd2348e7
--- /dev/null
+++ b/sys-auth/pam_pkcs11/pam_pkcs11-0.6.9.ebuild
@@ -0,0 +1,109 @@
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit ltprune pam
+
+DESCRIPTION="PKCS#11 PAM library"
+HOMEPAGE="https://github.com/opensc/pam_pkcs11/wiki"
+SRC_URI="mirror://funtoo/${P}.tar.gz"
+RESTRICT="mirror"
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="curl doc ldap nss +pcsc-lite"
+#S="${WORKDIR}/${PN}-${P}"
+
+RDEPEND="sys-libs/pam
+	curl? ( net-misc/curl )
+	ldap? ( net-nds/openldap )
+	nss? (
+		dev-libs/nss
+		curl? ( || ( net-misc/curl[-ssl] net-misc/curl[ssl,curl_ssl_nss] ) )
+	)
+	!nss? (
+		dev-libs/openssl:=
+		curl? ( || ( net-misc/curl[-ssl] net-misc/curl[ssl,-curl_ssl_nss] ) )
+	)
+	pcsc-lite? ( sys-apps/pcsc-lite )"
+DEPEND="${RDEPEND}
+	virtual/pkgconfig
+	doc? ( dev-libs/libxslt )"
+
+DOCS=(
+	AUTHORS ChangeLog NEWS README TODO
+)
+
+src_prepare() {
+	default
+	# Fix the example files to be somewhat decent, and usable as
+	# default configuration
+	sed -i \
+		-e '/try_first_pass/s:false:true:' \
+		-e '/debug =/s:true:false:' \
+		-e 's:\(/usr\|\${exec_prefix}\)/lib/:/usr/'$(get_libdir)/':g' \
+		etc/pam_pkcs11.conf.example.in \
+		etc/pkcs11_eventmgr.conf.example || die "sed failed"
+}
+
+src_configure() {
+	econf \
+		$(use_with curl) \
+		$(use_with doc docbook) \
+		$(use_with pcsc-lite pcsclite) \
+		$(use_with ldap) \
+		$(use_with nss)
+}
+
+src_install() {
+	emake DESTDIR="${ED}" pamdir="$(getpam_mod_dir)" install
+	einstalldocs
+	prune_libtool_files --modules
+
+	dodoc doc/README.*
+	use doc && dodoc doc/api/*
+
+	# Provide some basic configuration
+	keepdir /etc/pam_pkcs11{,/{cacerts,crl}}
+
+	insinto /etc/pam_pkcs11
+	newins etc/pam_pkcs11.conf.example pam_pkcs11.conf
+	newins etc/pkcs11_eventmgr.conf.example pkcs11_eventmgr.conf
+}
+
+pkg_config() {
+	local dir
+	for dir in "${EROOT}"etc/${PN}/{cacerts,crl}; do
+		pushd "${dir}" > /dev/null
+		ebegin "Creating hash links in '${dir}'"
+		"${EROOT}usr/bin/pkcs11_make_hash_link" || die
+		eend $?
+		popd > /dev/null
+	done
+}
+
+pkg_postinst() {
+	elog "For ${PN} to work you need a PKCS#11 provider, such as one of:"
+	elog "  - dev-libs/opensc"
+	elog "  - dev-libs/opencryptoki"
+	elog ""
+	elog "You probably want to configure the '${EROOT}etc/${PN}/${PN}.conf' file with"
+	elog "the settings for your pkcs11 provider."
+	elog ""
+	elog "You might also want to set up '${EROOT}etc/${PN}/pkcs11_eventmgr.conf' with"
+	elog "the settings for the event manager, and start it up at user login."
+}
+
+# TODO list!
+#
+# - we need to find a way allow the user to choose whether to start the
+#   event manager at _all_ the logins, and if that's the case, lock all
+#   kind of sessions (terminal _and_ X);
+# - upstream should probably migrate the configuration of the event
+#   manager on a per-user basis, since it makes little sense to be _all_
+#   system-level configuration;
+# - we should probably provide some better config support that ensures
+#   the configuration to be valid, as well as creating the symlinks;
+# - we should probably add support for nss;
+# - we should move the configuration in /etc/security as for the rest
+#   of PAM-related configuration.
diff --git a/sys-auth/pam_radius/Manifest b/sys-auth/pam_radius/Manifest
new file mode 100644
index 000000000000..7e5992d4550d
--- /dev/null
+++ b/sys-auth/pam_radius/Manifest
@@ -0,0 +1 @@
+DIST pam_radius-1.3.17.tar.gz 31341 BLAKE2B 7f6dfbee555979585a60a266066db00e114f9bad7d2f42eb7eb1b0c11572f6463dd8727cb4676306b5e517e42d55e55636703564367748b4d12b27b161b07fad SHA512 82fc1431e8fc18c389880da4f93490363af8acd605283a5923c531fede77f449324f1ac4850783355cc7d610b3ee73bd172c94d8b73800c3deaa649af4c41060
diff --git a/sys-auth/pam_radius/files/pam_radius-1.3.17-gentoo.patch b/sys-auth/pam_radius/files/pam_radius-1.3.17-gentoo.patch
new file mode 100644
index 000000000000..3e0b02f7020d
--- /dev/null
+++ b/sys-auth/pam_radius/files/pam_radius-1.3.17-gentoo.patch
@@ -0,0 +1,27 @@
+diff -Nru pam_radius-1.3.17.orig/pam_radius_auth.c pam_radius-1.3.17/pam_radius_auth.c
+--- pam_radius-1.3.17.orig/pam_radius_auth.c	2007-03-26 11:36:13.000000000 +0200
++++ pam_radius-1.3.17/pam_radius_auth.c	2008-06-28 08:43:24.000000000 +0200
+@@ -1062,7 +1062,7 @@
+ pam_sm_authenticate(pam_handle_t *pamh,int flags,int argc,CONST char **argv)
+ {
+   CONST char *user;
+-  CONST char **userinfo;
++  CONST char *userinfo;
+   char *password = NULL;
+   CONST char *rhost;
+   char *resp2challenge = NULL;
+diff -Nru pam_radius-1.3.17.orig/USAGE pam_radius-1.3.17/USAGE
+--- pam_radius-1.3.17.orig/USAGE	2008-06-28 08:43:43.000000000 +0200
++++ pam_radius-1.3.17/USAGE	2008-06-28 08:42:57.000000000 +0200
+@@ -3,9 +3,9 @@
+ 
+   The pam configuration can be:
+ ...
+-auth       sufficient   /lib/security/pam_radius_auth.so [options]
++auth       sufficient   pam_radius_auth.so [options]
+ ...
+-account    sufficient   /lib/security/pam_radius_auth.so
++account    sufficient   pam_radius_auth.so
+ 
+ ---------------------------------------------------------------------------
+ 
diff --git a/sys-auth/pam_radius/files/server b/sys-auth/pam_radius/files/server
new file mode 100644
index 000000000000..4c31e60ae856
--- /dev/null
+++ b/sys-auth/pam_radius/files/server
@@ -0,0 +1,23 @@
+#  This is pam_radius_auth configuration file.
+#
+#  There are 3 fields per line in this file.  There may be multiple
+#  lines.  Blank lines or lines beginning with '#' are treated as
+#  comments, and are ignored.  The fields are:
+#
+#  server[:port] secret [timeout]
+#
+#  the port name or number is optional.  The default port name is
+#  "radius", and is looked up from /etc/services The timeout field is
+#  optional.  The default timeout is 3 seconds.
+#
+#  If multiple RADIUS server lines exist, they are tried in order.  The
+#  first server to return success or failure causes the module to return
+#  success or failure.  Only if a server fails to response is it skipped,
+#  and the next server in turn is used.
+#
+#  The timeout field controls how many seconds the module waits before
+#  deciding that the server has failed to respond.
+#
+# server[:port]	shared_secret      timeout (s)
+# 127.0.0.1	secret             1
+# other-server	other-secret       3
diff --git a/sys-auth/pam_radius/metadata.xml b/sys-auth/pam_radius/metadata.xml
new file mode 100644
index 000000000000..062ac49f27d9
--- /dev/null
+++ b/sys-auth/pam_radius/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <!-- maintainer-needed -->
+  <longdescription>
+    This is the PAM to RADIUS authentication module. It allows any
+    PAM-capable machine to become a RADIUS client for authentication
+    and accounting requests.
+  </longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_radius/pam_radius-1.3.17-r1.ebuild b/sys-auth/pam_radius/pam_radius-1.3.17-r1.ebuild
new file mode 100644
index 000000000000..fd2021bec593
--- /dev/null
+++ b/sys-auth/pam_radius/pam_radius-1.3.17-r1.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils pam toolchain-funcs
+
+DESCRIPTION="PAM RADIUS authentication module"
+HOMEPAGE="http://www.freeradius.org/pam_radius_auth/"
+SRC_URI="ftp://ftp.freeradius.org/pub/radius/${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND="sys-libs/pam"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${P}-gentoo.patch
+}
+
+doecho() {
+	echo "$@"
+	"$@" || die
+}
+
+src_compile() {
+	# using the Makefile would require patching it to work properly, so
+	# rather simply re-create it here.
+
+	pammod_hide_symbols
+	doecho $(tc-getCC) ${CFLAGS} -shared -fPIC ${LDFLAGS} *.c -lpam -o pam_radius_auth.so
+}
+
+src_install() {
+	dopammod pam_radius_auth.so
+
+	insopts -m600
+	insinto /etc/raddb
+	doins "${FILESDIR}"/server
+
+	dodoc README Changelog USAGE
+}
+
+pkg_postinst() {
+	elog "Before you can use this you'll have to add RADIUS servers to /etc/raddb/server."
+	elog "The usage of pam_radius_auth module is explained in /usr/share/doc/${PF}/USAGE."
+}
diff --git a/sys-auth/pam_require/Manifest b/sys-auth/pam_require/Manifest
new file mode 100644
index 000000000000..1f38a4708e8b
--- /dev/null
+++ b/sys-auth/pam_require/Manifest
@@ -0,0 +1 @@
+DIST pam_require-0.7.tgz 84299 BLAKE2B c258cbda6c7b803e1cfdac1bc5f20ebb932ed20983b7974c0e24c9509cc130e3e7868cfbd44fd8d35e0f045b3cb585b14cfb3618c179aa3038f8c59c85f9c094 SHA512 aba95c823bfcf35bca26881d79c904e9e77b86c2bf664ea63f16fa78304834a0e1e24a0392ce86cfd00309a35ad5d597f6d20a4d46139546b310daec86512198
diff --git a/sys-auth/pam_require/metadata.xml b/sys-auth/pam_require/metadata.xml
new file mode 100644
index 000000000000..ee0920051a6a
--- /dev/null
+++ b/sys-auth/pam_require/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>joakim.tjernlund@infinera.com</email>
+    <name>Joakim Tjernlund</name>
+  </maintainer>
+  <maintainer type="project">
+    <email>proxy-maint@gentoo.org</email>
+    <name>Proxy Maintainers</name>
+  </maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_require/pam_require-0.7-r1.ebuild b/sys-auth/pam_require/pam_require-0.7-r1.ebuild
new file mode 100644
index 000000000000..748b7bd53af2
--- /dev/null
+++ b/sys-auth/pam_require/pam_require-0.7-r1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit pam
+
+DESCRIPTION="Allows you to require a special group or user to access a service"
+HOMEPAGE="https://www.splitbrain.org/projects/pam_require"
+SRC_URI="https://www.splitbrain.org/_media/projects/pamrequire/${P}.tgz"
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~ia64 ~ppc ~x86"
+IUSE=""
+
+DEPEND="sys-libs/pam"
+RDEPEND="${DEPEND}"
+
+S=${WORKDIR}/${P/_/-}
+
+src_install() {
+	dopammod pam_require.so
+
+	einstalldocs
+}
diff --git a/sys-auth/pam_skey/Manifest b/sys-auth/pam_skey/Manifest
new file mode 100644
index 000000000000..7d861c6ebfcd
--- /dev/null
+++ b/sys-auth/pam_skey/Manifest
@@ -0,0 +1,2 @@
+DIST pam_skey-1.1.5-patches-6.tar.xz 9264 BLAKE2B aa3a1f66b5511489ad542af2802ff0aab99d79fdc5bff0cf661b55f1c118cfda2644006ce3d494e6f6fafd85ad2832449fbdaec73ee8edf99a20a3cb2616e9b5 SHA512 c777ed094efe9cbfb275cfb30d036e3a1bd9477b08297815f07156b432a2724f8c08e9e841ef6bf7ba62ccf7df361f541e59024b42164bd35d7eef16da1f75ec
+DIST pam_skey-1.1.5.tar.gz 76963 BLAKE2B ded4a4e43b174338cd1beefce65314cc906db928593dd5eba2ba1be9cab33844d8fd38cb7d3b952a29da632b671c468e0dfe7f0f1e0d167397320cd9ca6d35e1 SHA512 12817cedf15a3b2287982e4beab5d3b388239cc0a1e141e66e41759ddb2da7fb9dd0df12202dcc8140db0868c8df1a8d19d5859224179e2419ffefd691cb9834
diff --git a/sys-auth/pam_skey/metadata.xml b/sys-auth/pam_skey/metadata.xml
new file mode 100644
index 000000000000..e6b66ef1c422
--- /dev/null
+++ b/sys-auth/pam_skey/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>ulm@gentoo.org</email>
+  </maintainer>
+  <upstream>
+    <remote-id type="freshmeat">pam_skey</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_skey/pam_skey-1.1.5-r6.ebuild b/sys-auth/pam_skey/pam_skey-1.1.5-r6.ebuild
new file mode 100644
index 000000000000..bf556e0b6380
--- /dev/null
+++ b/sys-auth/pam_skey/pam_skey-1.1.5-r6.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit eutils pam autotools multilib readme.gentoo-r1
+
+DESCRIPTION="PAM interface for the S/Key authentication system"
+HOMEPAGE="http://freshmeat.net/projects/pam_skey/"
+SRC_URI="http://dkorunic.net/tarballs/${P}.tar.gz
+	https://dev.gentoo.org/~ulm/distfiles/${P}-patches-6.tar.xz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="amd64 x86"
+
+RDEPEND="net-libs/libnsl:0=
+	>=sys-libs/pam-0.78-r3
+	>=sys-auth/skey-1.1.5-r4"
+DEPEND="${RDEPEND}"
+
+PATCHES="${WORKDIR}/patch"
+DOCS="README INSTALL"
+
+src_prepare() {
+	default
+
+	cd autoconf || die
+	mv configure.{in,ac} || die
+	eautoconf
+	eautoheader
+	mv configure defs.h.in .. || die
+}
+
+src_configure() {
+	econf --libdir="/$(get_libdir)" CFLAGS="${CFLAGS} -fPIC"
+}
+
+src_install() {
+	default
+
+	DOC_CONTENTS="To use the pam_skey module, you need to configure PAM
+	by adding a line like:
+	\n\nauth [success=done ignore=ignore auth_err=die default=bad] pam_skey.so\n
+	\nto an appropriate place in the /etc/pam.d/system-login file.
+	Consult the README and INSTALL files in /usr/share/doc/${PF}
+	for detailed instructions.
+	\n\nPlease note that calling this module from unprivileged
+	applications, e.g. screensavers, is not supported.
+	\n\nError checking has become stricter in pam_skey-1.1.5-r4;
+	errors returned from the underlying skey library when accessing
+	the S/Key data base will no longer be ignored.
+	Make sure that your PAM configuration is correct."
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/sys-auth/pam_smb/Manifest b/sys-auth/pam_smb/Manifest
new file mode 100644
index 000000000000..8ccf3df639e0
--- /dev/null
+++ b/sys-auth/pam_smb/Manifest
@@ -0,0 +1 @@
+DIST pam_smb-2.0.0-rc6.tar.gz 115069 BLAKE2B 095e2e7e356391ef5b6152ad6855df895afaae7ed78e5b287fa97879e5e2a531f6fbcf7e72bf030fa9b7d525636ffb21708d7e99f75d5206b6e6024a01c2f95e SHA512 c41519ae2b657dd7cbbbeb6d097ec82fd2d0d5c0f51f658eecea98e7aaf4eb87975fc1bc6592d19dbef0a650e428ec69829270a3c119fdab9443cddd6facbe6a
diff --git a/sys-auth/pam_smb/files/10-pam_smb-bash-3.1.patch b/sys-auth/pam_smb/files/10-pam_smb-bash-3.1.patch
new file mode 100644
index 000000000000..570655d82462
--- /dev/null
+++ b/sys-auth/pam_smb/files/10-pam_smb-bash-3.1.patch
@@ -0,0 +1,12 @@
+diff -Nurp pam_smb-2.0.0_rc6.orig/configure pam_smb-2.0.0_rc6/configure
+--- configure	2006-03-17 15:02:01.000000000 +0000
++++ configure	2006-03-17 15:02:01.000000000 +0000
+@@ -1486,7 +1486,7 @@ else
+         # results, and the version is kept in special file).
+ 
+         if test -r /etc/.relid -a "X`uname -n`" = "X`uname -s`" ; then
+-            system=MP-RAS-`awk '{print $3}' /etc/.relid'`
++            system=MP-RAS-`awk '{print $3}' /etc/.relid`
+         fi
+         if test "`uname -s`" = "AIX" ; then
+             system=AIX-`uname -v`.`uname -r`    
diff --git a/sys-auth/pam_smb/files/pamsmbd-init b/sys-auth/pam_smb/files/pamsmbd-init
new file mode 100644
index 000000000000..ba11ef6cdfe0
--- /dev/null
+++ b/sys-auth/pam_smb/files/pamsmbd-init
@@ -0,0 +1,19 @@
+#!/sbin/openrc-run
+# Copyright 1999-2004 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+depend() {
+	need net
+}
+
+start() {
+	ebegin "Starting pamsmbd"
+	start-stop-daemon --start --quiet --exec /usr/sbin/pamsmbd
+	eend $?
+}
+
+stop() {
+	ebegin "Stopping pamsmbd"
+	start-stop-daemon --stop --quiet --name pamsmbd
+	eend $?
+}
diff --git a/sys-auth/pam_smb/metadata.xml b/sys-auth/pam_smb/metadata.xml
new file mode 100644
index 000000000000..f7659462be00
--- /dev/null
+++ b/sys-auth/pam_smb/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+	<email>samba@gentoo.org</email>
+	<name>Samba Team</name>
+</maintainer>
+<longdescription>
+The PAM SMB module, which allows authentication against a SMB (such as the Win_x families) server.
+</longdescription>
+<longdescription lang="ja">
+	PAM の SMB モジュールは SMB サーバ( Win_x ファミリの類)の認証を許します。
+</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_smb/pam_smb-2.0.0_rc6-r2.ebuild b/sys-auth/pam_smb/pam_smb-2.0.0_rc6-r2.ebuild
new file mode 100644
index 000000000000..16b55f2637ef
--- /dev/null
+++ b/sys-auth/pam_smb/pam_smb-2.0.0_rc6-r2.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils pam
+
+MY_P=${P/_rc/-rc}
+
+DESCRIPTION="PAM module for authenticating against an SMB (such as the Win_x families) server"
+HOMEPAGE="http://www.csn.ul.ie/~airlied/pam_smb/"
+SRC_URI="
+	mirror://samba/pam_smb/v2/${MY_P}.tar.gz
+	http://www.csn.ul.ie/~airlied/pam_smb/v2/${MY_P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~ppc x86"
+IUSE=""
+
+DEPEND=">=sys-libs/pam-0.75"
+RDEPEND="${DEPEND}"
+
+S=${WORKDIR}/${MY_P}
+
+src_prepare() {
+	epatch "${FILESDIR}/10-pam_smb-bash-3.1.patch"
+}
+
+src_configure() {
+	econf --disable-root-only
+}
+
+src_install() {
+	dopammod pamsmbm/pam_smb_auth.so
+	dosbin pamsmbd/pamsmbd
+
+	dodoc BUGS CHANGES README TODO faq/{pam_smb_faq.sgml,additions.txt}
+	docinto pam.d
+	dodoc pam_smb.conf*
+
+	newinitd "${FILESDIR}/pamsmbd-init" pamsmbd
+}
+
+pkg_postinst() {
+	echo
+	elog "You must create /etc/pam_smb.conf yourself, containing"
+	elog "your domainname, PDC and BDC.  See example files in docdir."
+	echo
+}
diff --git a/sys-auth/pam_ssh/Manifest b/sys-auth/pam_ssh/Manifest
new file mode 100644
index 000000000000..6bfa6ad84183
--- /dev/null
+++ b/sys-auth/pam_ssh/Manifest
@@ -0,0 +1 @@
+DIST pam_ssh-2.3.tar.xz 380396 BLAKE2B e228e30c6f353f631c0a1c41e82e31e7a8c573b04ab1cad4038a245b500666b42c0efa9f686d28f2386688596de761085afb1318b94fef5541f8c0ffc1e18b25 SHA512 e3ddcf851ffd8f6fb831e2dee7269c1b89283ae2f8f6aa3487bf7b1bc71d26ac9bcbd2a01c5a67a983b980bbb5151e991402940f4752741286d057843c817895
diff --git a/sys-auth/pam_ssh/files/pam_ssh-2.1-dot-ssh-check.patch b/sys-auth/pam_ssh/files/pam_ssh-2.1-dot-ssh-check.patch
new file mode 100644
index 000000000000..a0737b377bea
--- /dev/null
+++ b/sys-auth/pam_ssh/files/pam_ssh-2.1-dot-ssh-check.patch
@@ -0,0 +1,22 @@
+https://bugs.gentoo.org/503424#c5
+https://sourceforge.net/p/pam-ssh/bugs/16/
+
+--- a/pam_ssh.c
++++ b/pam_ssh.c
+@@ -867,6 +867,7 @@
+ 	int attempt;      /* No. of attempt to contact agent */
+ 	const char *user;               /* username */
+ 	struct options options;         /* PAM options */
++	struct stat sb;			/* to check for existing .ssh */
+ 
+ #if HAVE_PAM_STRUCT_OPTIONS || !HAVE_PAM_STD_OPTION
+ 	memset(&options, 0, sizeof options);
+@@ -916,7 +917,7 @@
+ 		openpam_restore_cred(pamh);
+ 		return PAM_SERVICE_ERR;
+ 	}
+-	if ((access(dotdir,F_OK)) == -1) {
++	if (stat(dotdir, &sb) == -1) {
+ 		pam_ssh_log(LOG_DEBUG, "inexistent configuration directory");
+ 		free(dotdir);
+ 		openpam_restore_cred(pamh);
diff --git a/sys-auth/pam_ssh/files/pam_ssh-gcc10-fix.patch b/sys-auth/pam_ssh/files/pam_ssh-gcc10-fix.patch
new file mode 100644
index 000000000000..9871b4297c7b
--- /dev/null
+++ b/sys-auth/pam_ssh/files/pam_ssh-gcc10-fix.patch
@@ -0,0 +1,11 @@
+--- a/ge25519.h
++++ b/ge25519.h
+@@ -28,7 +28,7 @@
+   fe25519 t;
+ } ge25519;
+ 
+-const ge25519 ge25519_base;
++extern const ge25519 ge25519_base;
+ 
+ int ge25519_unpackneg_vartime(ge25519 *r, const unsigned char p[32]);
+ 
diff --git a/sys-auth/pam_ssh/files/pam_symbols.ver b/sys-auth/pam_ssh/files/pam_symbols.ver
new file mode 100644
index 000000000000..dbc677b77a2d
--- /dev/null
+++ b/sys-auth/pam_ssh/files/pam_symbols.ver
@@ -0,0 +1,4 @@
+{
+	global: pam_sm_*;
+	local: *;
+};
diff --git a/sys-auth/pam_ssh/metadata.xml b/sys-auth/pam_ssh/metadata.xml
new file mode 100644
index 000000000000..a5b025ea125f
--- /dev/null
+++ b/sys-auth/pam_ssh/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>zlogene@gentoo.org</email>
+		<name>Mikle Kolyada</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="sourceforge">pam-ssh</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_ssh/pam_ssh-2.3.ebuild b/sys-auth/pam_ssh/pam_ssh-2.3.ebuild
new file mode 100644
index 000000000000..23e4dd080959
--- /dev/null
+++ b/sys-auth/pam_ssh/pam_ssh-2.3.ebuild
@@ -0,0 +1,75 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit pam flag-o-matic readme.gentoo-r1
+
+DESCRIPTION="Uses ssh-agent to provide single sign-on"
+HOMEPAGE="http://pam-ssh.sourceforge.net/"
+SRC_URI="mirror://sourceforge/pam-ssh/${P}.tar.xz"
+
+LICENSE="BSD-2 BSD ISC"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
+
+# Only supports OpenSSH via `ssh-agent` #282993
+DEPEND="sys-libs/pam
+	dev-libs/openssl:0="
+
+RDEPEND="${DEPEND}
+	net-misc/openssh"
+
+PATCHES=(
+	# 503424#c5
+	"${FILESDIR}"/${PN}-2.1-dot-ssh-check.patch
+	"${FILESDIR}"/${PN}-gcc10-fix.patch
+)
+
+src_configure() {
+	# hide all the otherwise-exported symbols that may clash with
+	# other software loading the PAM modules (see bug #274924 as an
+	# example).
+	append-ldflags -Wl,--version-script="${FILESDIR}"/pam_symbols.ver
+
+	# Set the cache var so the configure script doesn't go probing hardcoded
+	# file system paths and picking up the wrong thing.
+	export ac_cv_openssldir=''
+
+	# not needed now
+	export ac_cv_exeext=no
+
+	# Avoid cross-compiling funkiness and requiring openssh at build time.
+	export PATH_SSH_AGENT="${EPREFIX}/usr/bin/ssh-agent"
+
+	econf \
+		"--with-pam-dir=$(getpam_mod_dir)"
+}
+
+src_install() {
+	default
+
+	# pam_ssh only builds plugins
+	find "${D}" -name '*.la' -delete || die
+
+	local DOC_CONTENTS="
+		You can enable pam_ssh for system authentication by enabling
+		the pam_ssh USE flag on sys-auth/pambase.
+	"
+	readme.gentoo_create_doc
+}
+
+pkg_preinst() {
+	local i
+	for i in "${REPLACING_VERSIONS}"; do
+		if [[ ${i} == 1.* ]]; then #554150
+			ewarn "Upstream pam_ssh has changed where ssh keys live. Only keys in your"
+			ewarn "~/.ssh/login-keys.d/ will be accepted for authentication."
+			return
+		fi
+	done
+}
+
+pkg_postinst() {
+	readme.gentoo_print_elog
+}
diff --git a/sys-auth/pam_ssh_agent_auth/Manifest b/sys-auth/pam_ssh_agent_auth/Manifest
new file mode 100644
index 000000000000..1c43b8634e49
--- /dev/null
+++ b/sys-auth/pam_ssh_agent_auth/Manifest
@@ -0,0 +1 @@
+DIST pam_ssh_agent_auth-0.10.3.tar.bz2 1066393 BLAKE2B 07b113d05e09f770d63dbea813ea644199d2b103f9c6d7e5960bfad37cb181ce5a5f111f72e0274c0335e4c217ccd19bd53d61af23f8bc6aff14c1995fc4edc9 SHA512 d75062c4e46b0b011f46aed9704a99049995fea8b5115ff7ee26dad7e93cbcf54a8af7efc6b521109d77dc03c6f5284574d2e1b84c6829cec25610f24fb4bd66
diff --git a/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch b/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch
new file mode 100644
index 000000000000..a422cd5e479f
--- /dev/null
+++ b/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch
@@ -0,0 +1,1244 @@
+From eef90424a0545b7b0125dfaf5e3cef3c5248ada0 Mon Sep 17 00:00:00 2001
+From: Guido Falsi <mad@madpilot.net>
+Date: Sat, 20 Oct 2018 14:29:43 +0200
+Subject: [PATCH 1/2] Adapt to OpenSSL 1.1.1.
+
+The FreeBSD operating system is migrating to OpenSSL 1.1.1 and I have created this set of patches to make pam_ssh_agent_auth compile with it.
+
+The patch comments out some parts of include files which are not actually used and reference now opaque OpenSSL internals.
+
+I also have migrated the source files to use accessors to use the OpenSSL objects.
+
+The patch works on FreeBSD head (will be 12.0) but the --without-openssl-header-check argument is required in configure there.
+---
+ authfd.c    |  50 ++++++++++++++++++++
+ bufbn.c     |   4 ++
+ cipher.h    |   6 ++-
+ kex.h       |   9 +++-
+ key.c       | 133 ++++++++++++++++++++++++++++++++++++++++++++++++++--
+ ssh-dss.c   |  51 ++++++++++++++++----
+ ssh-ecdsa.c |  40 ++++++++++++----
+ ssh-rsa.c   |  22 +++++++--
+ 8 files changed, 287 insertions(+), 28 deletions(-)
+
+diff --git a/authfd.c b/authfd.c
+index 7b96921..35f8de1 100644
+--- a/authfd.c
++++ b/authfd.c
+@@ -372,6 +372,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
+ 	case 1:
+ 		key = pamsshagentauth_key_new(KEY_RSA1);
+ 		bits = pamsshagentauth_buffer_get_int(&auth->identities);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->e);
+ 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->n);
+ 		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
+@@ -379,6 +380,15 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
+ 		if (keybits < 0 || bits != (u_int)keybits)
+ 			pamsshagentauth_logit("Warning: identity keysize mismatch: actual %d, announced %u",
+ 			    BN_num_bits(key->rsa->n), bits);
++#else
++		pamsshagentauth_buffer_get_bignum(&auth->identities, RSA_get0_e(key->rsa));
++		pamsshagentauth_buffer_get_bignum(&auth->identities, RSA_get0_n(key->rsa));
++		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
++		keybits = BN_num_bits(RSA_get0_n(key->rsa));
++		if (keybits < 0 || bits != (u_int)keybits)
++			pamsshagentauth_logit("Warning: identity keysize mismatch: actual %d, announced %u",
++			    BN_num_bits(RSA_get0_n(key->rsa)), bits);
++#endif
+ 		break;
+ 	case 2:
+ 		blob = pamsshagentauth_buffer_get_string(&auth->identities, &blen);
+@@ -422,9 +432,15 @@ ssh_decrypt_challenge(AuthenticationConnection *auth,
+ 	}
+ 	pamsshagentauth_buffer_init(&buffer);
+ 	pamsshagentauth_buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
+ 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->e);
+ 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->n);
++#else
++	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(RSA_get0_n(key->rsa)));
++	pamsshagentauth_buffer_put_bignum(&buffer, RSA_get0_e(key->rsa));
++	pamsshagentauth_buffer_put_bignum(&buffer, RSA_get0_n(key->rsa));
++#endif
+ 	pamsshagentauth_buffer_put_bignum(&buffer, challenge);
+ 	pamsshagentauth_buffer_append(&buffer, session_id, 16);
+ 	pamsshagentauth_buffer_put_int(&buffer, response_type);
+@@ -501,6 +517,7 @@ ssh_agent_sign(AuthenticationConnection *auth,
+ static void
+ ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
+ {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	pamsshagentauth_buffer_put_int(b, BN_num_bits(key->n));
+ 	pamsshagentauth_buffer_put_bignum(b, key->n);
+ 	pamsshagentauth_buffer_put_bignum(b, key->e);
+@@ -509,6 +526,16 @@ ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
+ 	pamsshagentauth_buffer_put_bignum(b, key->iqmp);	/* ssh key->u */
+ 	pamsshagentauth_buffer_put_bignum(b, key->q);	/* ssh key->p, SSL key->q */
+ 	pamsshagentauth_buffer_put_bignum(b, key->p);	/* ssh key->q, SSL key->p */
++#else
++	pamsshagentauth_buffer_put_int(b, BN_num_bits(RSA_get0_n(key)));
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_n(key));
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_e(key));
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_d(key));
++	/* To keep within the protocol: p < q for ssh. in SSL p > q */
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_iqmp(key));	/* ssh key->u */
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_q(key));	/* ssh key->p, SSL key->q */
++	pamsshagentauth_buffer_put_bignum(b, RSA_get0_p(key));	/* ssh key->q, SSL key->p */
++#endif
+ 	pamsshagentauth_buffer_put_cstring(b, comment);
+ }
+ 
+@@ -518,19 +545,36 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
+ 	pamsshagentauth_buffer_put_cstring(b, key_ssh_name(key));
+ 	switch (key->type) {
+ 	case KEY_RSA:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->n);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->e);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->d);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->iqmp);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->p);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->q);
++#else
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_n(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_e(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_d(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_iqmp(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_p(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_q(key->rsa));
++#endif
+ 		break;
+ 	case KEY_DSA:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->p);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->q);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->g);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->pub_key);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->priv_key);
++#else
++		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_p(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_q(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_g(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_pub_key(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_priv_key(key->dsa));
++#endif
+ 		break;
+ 	}
+ 	pamsshagentauth_buffer_put_cstring(b, comment);
+@@ -610,9 +654,15 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
+ 
+ 	if (key->type == KEY_RSA1) {
+ 		pamsshagentauth_buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(key->rsa->n));
+ 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->e);
+ 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->n);
++#else
++		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(RSA_get0_n(key->rsa)));
++		pamsshagentauth_buffer_put_bignum(&msg, RSA_get0_e(key->rsa));
++		pamsshagentauth_buffer_put_bignum(&msg, RSA_get0_n(key->rsa));
++#endif
+ 	} else if (key->type == KEY_DSA || key->type == KEY_RSA) {
+ 		pamsshagentauth_key_to_blob(key, &blob, &blen);
+ 		pamsshagentauth_buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
+diff --git a/bufbn.c b/bufbn.c
+index 6a49c73..4ecedc1 100644
+--- a/bufbn.c
++++ b/bufbn.c
+@@ -151,7 +151,11 @@ pamsshagentauth_buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
+ 		pamsshagentauth_buffer_put_int(buffer, 0);
+ 		return 0;
+ 	}
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	if (value->neg) {
++#else
++	if (BN_is_negative(value)) {
++#endif
+ 		pamsshagentauth_logerror("buffer_put_bignum2_ret: negative numbers not supported");
+ 		return (-1);
+ 	}
+diff --git a/cipher.h b/cipher.h
+index 49bbc16..64f59ca 100644
+--- a/cipher.h
++++ b/cipher.h
+@@ -59,15 +59,18 @@
+ #define CIPHER_DECRYPT		0
+ 
+ typedef struct Cipher Cipher;
+-typedef struct CipherContext CipherContext;
++// typedef struct CipherContext CipherContext;
+ 
+ struct Cipher;
++/*
+ struct CipherContext {
+ 	int	plaintext;
+ 	EVP_CIPHER_CTX evp;
+ 	Cipher *cipher;
+ };
++*/
+ 
++/*
+ u_int	 cipher_mask_ssh1(int);
+ Cipher	*cipher_by_name(const char *);
+ Cipher	*cipher_by_number(int);
+@@ -88,4 +91,5 @@ void	 cipher_set_keyiv(CipherContext *, u_char *);
+ int	 cipher_get_keyiv_len(const CipherContext *);
+ int	 cipher_get_keycontext(const CipherContext *, u_char *);
+ void	 cipher_set_keycontext(CipherContext *, u_char *);
++*/
+ #endif				/* CIPHER_H */
+diff --git a/kex.h b/kex.h
+index 8e29c90..81ca57d 100644
+--- a/kex.h
++++ b/kex.h
+@@ -70,7 +70,7 @@ enum kex_exchange {
+ #define KEX_INIT_SENT	0x0001
+ 
+ typedef struct Kex Kex;
+-typedef struct Mac Mac;
++// typedef struct Mac Mac;
+ typedef struct Comp Comp;
+ typedef struct Enc Enc;
+ typedef struct Newkeys Newkeys;
+@@ -84,6 +84,7 @@ struct Enc {
+ 	u_char	*key;
+ 	u_char	*iv;
+ };
++/*
+ struct Mac {
+ 	char	*name;
+ 	int	enabled;
+@@ -95,11 +96,13 @@ struct Mac {
+ 	HMAC_CTX	evp_ctx;
+ 	struct umac_ctx *umac_ctx;
+ };
++*/
+ struct Comp {
+ 	int	type;
+ 	int	enabled;
+ 	char	*name;
+ };
++/*
+ struct Newkeys {
+ 	Enc	enc;
+ 	Mac	mac;
+@@ -126,7 +129,9 @@ struct Kex {
+ 	int	(*host_key_index)(Key *);
+ 	void	(*kex[KEX_MAX])(Kex *);
+ };
++*/
+ 
++/*
+ Kex	*kex_setup(char *[PROPOSAL_MAX]);
+ void	 kex_finish(Kex *);
+ 
+@@ -152,6 +157,8 @@ kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *,
+ void
+ derive_ssh1_session_id(BIGNUM *, BIGNUM *, u_int8_t[8], u_int8_t[16]);
+ 
++*/
++
+ #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
+ void	dump_digest(char *, u_char *, int);
+ #endif
+diff --git a/key.c b/key.c
+index 107a442..aedbbb5 100644
+--- a/key.c
++++ b/key.c
+@@ -77,15 +77,21 @@ pamsshagentauth_key_new(int type)
+ 	case KEY_RSA:
+ 		if ((rsa = RSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: RSA_new failed");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((rsa->n = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
+ 		if ((rsa->e = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
++#else
++		if (RSA_set0_key(rsa, BN_new(), BN_new(), NULL) != 1)
++			pamsshagentauth_fatal("key_new: RSA_set0_key failed");
++#endif
+ 		k->rsa = rsa;
+ 		break;
+ 	case KEY_DSA:
+ 		if ((dsa = DSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: DSA_new failed");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((dsa->p = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
+ 		if ((dsa->q = BN_new()) == NULL)
+@@ -94,6 +100,12 @@ pamsshagentauth_key_new(int type)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
+ 		if ((dsa->pub_key = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
++#else
++		if (DSA_set0_pqg(dsa, BN_new(), BN_new(), BN_new()) != 1)
++			pamsshagentauth_fatal("key_new: DSA_set0_pqg failed");
++		if (DSA_set0_key(dsa, BN_new(), NULL) != 1)
++			pamsshagentauth_fatal("key_new: DSA_set0_key failed");
++#endif
+ 		k->dsa = dsa;
+ 		break;
+ 	case KEY_ECDSA:
+@@ -118,6 +130,7 @@ pamsshagentauth_key_new_private(int type)
+ 	switch (k->type) {
+ 	case KEY_RSA1:
+ 	case KEY_RSA:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((k->rsa->d = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
+ 		if ((k->rsa->iqmp = BN_new()) == NULL)
+@@ -130,14 +143,30 @@ pamsshagentauth_key_new_private(int type)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
+ 		if ((k->rsa->dmp1 = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
++#else
++		if (RSA_set0_key(k->rsa, NULL, NULL, BN_new()) != 1)
++			pamsshagentauth_fatal("key_new: RSA_set0_key failed");
++		if (RSA_set0_crt_params(k->rsa, BN_new(), BN_new(), BN_new()) != 1)
++			pamsshagentauth_fatal("key_new: RSA_set0_crt_params failed");
++		if (RSA_set0_factors(k->rsa, BN_new(), BN_new()) != 1)
++			pamsshagentauth_fatal("key_new: RSA_set0_factors failed");
++#endif
+ 		break;
+ 	case KEY_DSA:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((k->dsa->priv_key = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
++#else
++		if (DSA_set0_key(k->dsa, NULL, BN_new()) != 1)
++			pamsshagentauth_fatal("key_new_private: DSA_set0_key failed");
++#endif
+ 		break;
+ 	case KEY_ECDSA:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if (EC_KEY_set_private_key(k->ecdsa, BN_new()) != 1)
+ 			pamsshagentauth_fatal("key_new_private: EC_KEY_set_private_key failed");
++#else
++#endif
+ 		break;
+ 	case KEY_ED25519:
+ 		RAND_bytes(k->ed25519->sk, sizeof(k->ed25519->sk));
+@@ -195,14 +224,26 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
+ 	case KEY_RSA1:
+ 	case KEY_RSA:
+ 		return a->rsa != NULL && b->rsa != NULL &&
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
+ 		    BN_cmp(a->rsa->n, b->rsa->n) == 0;
++#else
++		    BN_cmp(RSA_get0_e(a->rsa), RSA_get0_e(b->rsa)) == 0 &&
++		    BN_cmp(RSA_get0_n(a->rsa), RSA_get0_n(b->rsa)) == 0;
++#endif
+ 	case KEY_DSA:
+ 		return a->dsa != NULL && b->dsa != NULL &&
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
+ 		    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
+ 		    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
+ 		    BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
++#else
++		    BN_cmp(DSA_get0_p(a->dsa), DSA_get0_p(b->dsa)) == 0 &&
++		    BN_cmp(DSA_get0_q(a->dsa), DSA_get0_q(b->dsa)) == 0 &&
++		    BN_cmp(DSA_get0_g(a->dsa), DSA_get0_g(b->dsa)) == 0 &&
++		    BN_cmp(DSA_get0_pub_key(a->dsa), DSA_get0_pub_key(b->dsa)) == 0;
++#endif
+ 	case KEY_ECDSA:
+ 		return a->ecdsa != NULL && b->ecdsa != NULL &&
+ 			EC_KEY_check_key(a->ecdsa) == 1 &&
+@@ -231,7 +272,7 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+     u_int *dgst_raw_length)
+ {
+ 	const EVP_MD *md = NULL;
+-	EVP_MD_CTX ctx;
++	EVP_MD_CTX *ctx;
+ 	u_char *blob = NULL;
+ 	u_char *retval = NULL;
+ 	u_int len = 0;
+@@ -252,12 +293,21 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+ 	}
+ 	switch (k->type) {
+ 	case KEY_RSA1:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		nlen = BN_num_bytes(k->rsa->n);
+ 		elen = BN_num_bytes(k->rsa->e);
+ 		len = nlen + elen;
+ 		blob = pamsshagentauth_xmalloc(len);
+ 		BN_bn2bin(k->rsa->n, blob);
+ 		BN_bn2bin(k->rsa->e, blob + nlen);
++#else
++		nlen = BN_num_bytes(RSA_get0_n(k->rsa));
++		elen = BN_num_bytes(RSA_get0_e(k->rsa));
++		len = nlen + elen;
++		blob = pamsshagentauth_xmalloc(len);
++		BN_bn2bin(RSA_get0_n(k->rsa), blob);
++		BN_bn2bin(RSA_get0_e(k->rsa), blob + nlen);
++#endif
+ 		break;
+ 	case KEY_DSA:
+ 	case KEY_ECDSA:
+@@ -273,11 +323,14 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+ 	}
+ 	if (blob != NULL) {
+ 		retval = pamsshagentauth_xmalloc(EVP_MAX_MD_SIZE);
+-		EVP_DigestInit(&ctx, md);
+-		EVP_DigestUpdate(&ctx, blob, len);
+-		EVP_DigestFinal(&ctx, retval, dgst_raw_length);
++		/* XXX Errors from EVP_* functions are not hadled */
++		ctx = EVP_MD_CTX_create();
++		EVP_DigestInit(ctx, md);
++		EVP_DigestUpdate(ctx, blob, len);
++		EVP_DigestFinal(ctx, retval, dgst_raw_length);
+ 		memset(blob, 0, len);
+ 		pamsshagentauth_xfree(blob);
++		EVP_MD_CTX_destroy(ctx);
+ 	} else {
+ 		pamsshagentauth_fatal("key_fingerprint_raw: blob is null");
+ 	}
+@@ -457,10 +510,17 @@ pamsshagentauth_key_read(Key *ret, char **cpp)
+ 			return -1;
+ 		*cpp = cp;
+ 		/* Get public exponent, public modulus. */
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if (!read_bignum(cpp, ret->rsa->e))
+ 			return -1;
+ 		if (!read_bignum(cpp, ret->rsa->n))
+ 			return -1;
++#else
++		if (!read_bignum(cpp, RSA_get0_e(ret->rsa)))
++			return -1;
++		if (!read_bignum(cpp, RSA_get0_n(ret->rsa)))
++			return -1;
++#endif
+ 		success = 1;
+ 		break;
+ 	case KEY_UNSPEC:
+@@ -583,10 +643,17 @@ pamsshagentauth_key_write(const Key *key, FILE *f)
+ 
+ 	if (key->type == KEY_RSA1 && key->rsa != NULL) {
+ 		/* size of modulus 'n' */
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		bits = BN_num_bits(key->rsa->n);
+ 		fprintf(f, "%u", bits);
+ 		if (write_bignum(f, key->rsa->e) &&
+ 		    write_bignum(f, key->rsa->n)) {
++#else
++		bits = BN_num_bits(RSA_get0_n(key->rsa));
++		fprintf(f, "%u", bits);
++		if (write_bignum(f, RSA_get0_e(key->rsa)) &&
++		    write_bignum(f, RSA_get0_n(key->rsa))) {
++#endif
+ 			success = 1;
+ 		} else {
+ 			pamsshagentauth_logerror("key_write: failed for RSA key");
+@@ -675,10 +742,17 @@ pamsshagentauth_key_size(const Key *k)
+ {
+ 	switch (k->type) {
+ 	case KEY_RSA1:
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	case KEY_RSA:
+ 		return BN_num_bits(k->rsa->n);
+ 	case KEY_DSA:
+ 		return BN_num_bits(k->dsa->p);
++#else
++	case KEY_RSA:
++		return BN_num_bits(RSA_get0_n(k->rsa));
++	case KEY_DSA:
++		return BN_num_bits(DSA_get0_p(k->dsa));
++#endif
+ 	case KEY_ECDSA:
+ 	{
+ 		int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(k->ecdsa));
+@@ -769,17 +843,29 @@ pamsshagentauth_key_from_private(const Key *k)
+ 	switch (k->type) {
+ 	case KEY_DSA:
+ 		n = pamsshagentauth_key_new(k->type);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
+ 		    (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
+ 		    (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
+ 		    (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL))
++#else
++		if ((BN_copy(DSA_get0_p(n->dsa), DSA_get0_p(k->dsa)) == NULL) ||
++		    (BN_copy(DSA_get0_q(n->dsa), DSA_get0_q(k->dsa)) == NULL) ||
++		    (BN_copy(DSA_get0_g(n->dsa), DSA_get0_g(k->dsa)) == NULL) ||
++		    (BN_copy(DSA_get0_pub_key(n->dsa), DSA_get0_pub_key(k->dsa)) == NULL))
++#endif
+ 			pamsshagentauth_fatal("key_from_private: BN_copy failed");
+ 		break;
+ 	case KEY_RSA:
+ 	case KEY_RSA1:
+ 		n = pamsshagentauth_key_new(k->type);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
+ 		    (BN_copy(n->rsa->e, k->rsa->e) == NULL))
++#else
++		if ((BN_copy(RSA_get0_n(n->rsa), RSA_get0_n(k->rsa)) == NULL) ||
++		    (BN_copy(RSA_get0_e(n->rsa), RSA_get0_e(k->rsa)) == NULL))
++#endif
+ 			pamsshagentauth_fatal("key_from_private: BN_copy failed");
+ 		break;
+ 	case KEY_ECDSA:
+@@ -881,8 +967,13 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
+ 	switch (type) {
+ 	case KEY_RSA:
+ 		key = pamsshagentauth_key_new(type);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->e) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->n) == -1) {
++#else
++		if (pamsshagentauth_buffer_get_bignum2_ret(&b, RSA_get0_e(key->rsa)) == -1 ||
++		    pamsshagentauth_buffer_get_bignum2_ret(&b, RSA_get0_n(key->rsa)) == -1) {
++#endif
+ 			pamsshagentauth_logerror("key_from_blob: can't read rsa key");
+ 			pamsshagentauth_key_free(key);
+ 			key = NULL;
+@@ -894,10 +985,17 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
+ 		break;
+ 	case KEY_DSA:
+ 		key = pamsshagentauth_key_new(type);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->p) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->q) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->g) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->pub_key) == -1) {
++#else
++		if (pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_p(key->dsa)) == -1 ||
++		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_q(key->dsa)) == -1 ||
++		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_g(key->dsa)) == -1 ||
++		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_pub_key(key->dsa)) == -1) {
++#endif
+ 			pamsshagentauth_logerror("key_from_blob: can't read dsa key");
+ 			pamsshagentauth_key_free(key);
+ 			key = NULL;
+@@ -1015,6 +1113,7 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+ 	}
+ 	pamsshagentauth_buffer_init(&b);
+ 	switch (key->type) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	case KEY_DSA:
+ 		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
+ 		pamsshagentauth_buffer_put_bignum2(&b, key->dsa->p);
+@@ -1027,6 +1126,20 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+ 		pamsshagentauth_buffer_put_bignum2(&b, key->rsa->e);
+ 		pamsshagentauth_buffer_put_bignum2(&b, key->rsa->n);
+ 		break;
++#else
++	case KEY_DSA:
++		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
++		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_p(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_q(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_g(key->dsa));
++		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_pub_key(key->dsa));
++		break;
++	case KEY_RSA:
++		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
++		pamsshagentauth_buffer_put_bignum2(&b, RSA_get0_e(key->rsa));
++		pamsshagentauth_buffer_put_bignum2(&b, RSA_get0_n(key->rsa));
++		break;
++#endif
+ 	case KEY_ECDSA:
+ 	{
+ 		size_t l = 0;
+@@ -1138,14 +1251,20 @@ pamsshagentauth_key_demote(const Key *k)
+ 	case KEY_RSA:
+ 		if ((pk->rsa = RSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_demote: RSA_new failed");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
+ 		if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
++#else
++		if (RSA_set0_key(pk->rsa, BN_dup(RSA_get0_n(k->rsa)), BN_dup(RSA_get0_e(k->rsa)), NULL) != 1)
++			pamsshagentauth_fatal("key_demote: RSA_set0_key failed");
++#endif
+ 		break;
+ 	case KEY_DSA:
+ 		if ((pk->dsa = DSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_demote: DSA_new failed");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
+ 		if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
+@@ -1154,6 +1273,12 @@ pamsshagentauth_key_demote(const Key *k)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
+ 		if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
++#else
++		if (DSA_set0_pqg(pk->dsa, BN_dup(DSA_get0_p(k->dsa)), BN_dup(DSA_get0_q(k->dsa)), BN_dup(DSA_get0_g(k->dsa))) != 1)
++			pamsshagentauth_fatal("key_demote: DSA_set0_pqg failed");
++		if (DSA_set0_key(pk->dsa, BN_dup(DSA_get0_pub_key(k->dsa)), NULL) != 1)
++			pamsshagentauth_fatal("key_demote: DSA_set0_key failed");
++#endif
+ 		break;
+ 	case KEY_ECDSA:
+ 		pamsshagentauth_fatal("key_demote: implement me");
+diff --git a/ssh-dss.c b/ssh-dss.c
+index 9fdaa5d..1051ae2 100644
+--- a/ssh-dss.c
++++ b/ssh-dss.c
+@@ -48,37 +48,53 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
+ {
+ 	DSA_SIG *sig;
+ 	const EVP_MD *evp_md = EVP_sha1();
+-	EVP_MD_CTX md;
++	EVP_MD_CTX *md;
+ 	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
+ 	u_int rlen, slen, len, dlen;
+ 	Buffer b;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	const BIGNUM *r, *s;
++#endif
+ 
+ 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
+ 		pamsshagentauth_logerror("ssh_dss_sign: no DSA key");
+ 		return -1;
+ 	}
+-	EVP_DigestInit(&md, evp_md);
+-	EVP_DigestUpdate(&md, data, datalen);
+-	EVP_DigestFinal(&md, digest, &dlen);
++	md = EVP_MD_CTX_create();
++	EVP_DigestInit(md, evp_md);
++	EVP_DigestUpdate(md, data, datalen);
++	EVP_DigestFinal(md, digest, &dlen);
+ 
+ 	sig = DSA_do_sign(digest, dlen, key->dsa);
+ 	memset(digest, 'd', sizeof(digest));
++	EVP_MD_CTX_destroy(md);
+ 
+ 	if (sig == NULL) {
+ 		pamsshagentauth_logerror("ssh_dss_sign: sign failed");
+ 		return -1;
+ 	}
+ 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	rlen = BN_num_bytes(sig->r);
+ 	slen = BN_num_bytes(sig->s);
++#else
++	DSA_SIG_get0((const DSA_SIG *)sig, (const BIGNUM **)r, (const BIGNUM **)s);
++	rlen = BN_num_bytes(r);
++	slen = BN_num_bytes(s);
++#endif
+ 	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
+ 		pamsshagentauth_logerror("bad sig size %u %u", rlen, slen);
+ 		DSA_SIG_free(sig);
+ 		return -1;
+ 	}
+ 	memset(sigblob, 0, SIGBLOB_LEN);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
+ 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
++#else
++	BN_bn2bin(r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
++	BN_bn2bin(s, sigblob+ SIGBLOB_LEN - slen);
++#endif
+ 	DSA_SIG_free(sig);
+ 
+ 	if (datafellows & SSH_BUG_SIGBLOB) {
+@@ -110,11 +126,14 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ {
+ 	DSA_SIG *sig;
+ 	const EVP_MD *evp_md = EVP_sha1();
+-	EVP_MD_CTX md;
++	EVP_MD_CTX *md;
+ 	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
+ 	u_int len, dlen;
+ 	int rlen, ret;
+ 	Buffer b;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	BIGNUM *r, *s;
++#endif
+ 
+ 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
+ 		pamsshagentauth_logerror("ssh_dss_verify: no DSA key");
+@@ -157,6 +176,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 	/* parse signature */
+ 	if ((sig = DSA_SIG_new()) == NULL)
+ 		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_new failed");
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	if ((sig->r = BN_new()) == NULL)
+ 		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
+ 	if ((sig->s = BN_new()) == NULL)
+@@ -164,18 +184,33 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 	if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig->r) == NULL) ||
+ 	    (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s) == NULL))
+ 		pamsshagentauth_fatal("ssh_dss_verify: BN_bin2bn failed");
++#else
++	if ((r = BN_new()) == NULL)
++		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
++	if ((s = BN_new()) == NULL)
++		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
++	if (DSA_SIG_set0(sig, r, s) != 1)
++		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_set0 failed");
++	if ((BN_bin2bn(sigblob, INTBLOB_LEN, r) == NULL) ||
++	    (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, s) == NULL))
++		pamsshagentauth_fatal("ssh_dss_verify: BN_bin2bn failed");
++	if (DSA_SIG_set0(sig, r, s) != 1)
++		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_set0 failed");
++#endif
+ 
+ 	/* clean up */
+ 	memset(sigblob, 0, len);
+ 	pamsshagentauth_xfree(sigblob);
+ 
+ 	/* sha1 the data */
+-	EVP_DigestInit(&md, evp_md);
+-	EVP_DigestUpdate(&md, data, datalen);
+-	EVP_DigestFinal(&md, digest, &dlen);
++	md = EVP_MD_CTX_create();
++	EVP_DigestInit(md, evp_md);
++	EVP_DigestUpdate(md, data, datalen);
++	EVP_DigestFinal(md, digest, &dlen);
+ 
+ 	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
+ 	memset(digest, 'd', sizeof(digest));
++	EVP_MD_CTX_destroy(md);
+ 
+ 	DSA_SIG_free(sig);
+ 
+diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
+index efa0f3d..c213959 100644
+--- a/ssh-ecdsa.c
++++ b/ssh-ecdsa.c
+@@ -41,22 +41,27 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+ {
+     ECDSA_SIG *sig;
+     const EVP_MD *evp_md = evp_from_key(key);
+-    EVP_MD_CTX md;
++    EVP_MD_CTX *md;
+     u_char digest[EVP_MAX_MD_SIZE];
+     u_int len, dlen;
+     Buffer b, bb;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	BIGNUM *r, *s;
++#endif
+ 
+     if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
+         pamsshagentauth_logerror("ssh_ecdsa_sign: no ECDSA key");
+         return -1;
+     }
+ 
+-    EVP_DigestInit(&md, evp_md);
+-    EVP_DigestUpdate(&md, data, datalen);
+-    EVP_DigestFinal(&md, digest, &dlen);
++    md = EVP_MD_CTX_create();
++    EVP_DigestInit(md, evp_md);
++    EVP_DigestUpdate(md, data, datalen);
++    EVP_DigestFinal(md, digest, &dlen);
+ 
+     sig = ECDSA_do_sign(digest, dlen, key->ecdsa);
+     memset(digest, 'd', sizeof(digest));
++    EVP_MD_CTX_destroy(md);
+ 
+     if (sig == NULL) {
+         pamsshagentauth_logerror("ssh_ecdsa_sign: sign failed");
+@@ -64,8 +69,14 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+     }
+ 
+     pamsshagentauth_buffer_init(&bb);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+     if (pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->r) == -1 ||
+         pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->s) == -1) {
++#else
++    DSA_SIG_get0(sig, &r, &s);
++    if (pamsshagentauth_buffer_get_bignum2_ret(&bb, r) == -1 ||
++        pamsshagentauth_buffer_get_bignum2_ret(&bb, s) == -1) {
++#endif
+         pamsshagentauth_logerror("couldn't serialize signature");
+         ECDSA_SIG_free(sig);
+         return -1;
+@@ -94,11 +105,14 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ {
+     ECDSA_SIG *sig;
+     const EVP_MD *evp_md = evp_from_key(key);
+-    EVP_MD_CTX md;
++    EVP_MD_CTX *md;
+     u_char digest[EVP_MAX_MD_SIZE], *sigblob;
+     u_int len, dlen;
+     int rlen, ret;
+     Buffer b;
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++	BIGNUM *r, *s;
++#endif
+ 
+     if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
+         pamsshagentauth_logerror("ssh_ecdsa_sign: no ECDSA key");
+@@ -127,8 +141,14 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 
+     pamsshagentauth_buffer_init(&b);
+     pamsshagentauth_buffer_append(&b, sigblob, len);
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+     if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
+         (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
++#else
++    DSA_SIG_get0(sig, &r, &s);
++    if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) ||
++        (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1))
++#endif
+         pamsshagentauth_fatal("ssh_ecdsa_verify:"
+             "pamsshagentauth_buffer_get_bignum2_ret failed");
+ 
+@@ -137,16 +157,18 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+     pamsshagentauth_xfree(sigblob);
+ 
+     /* sha256 the data */
+-    EVP_DigestInit(&md, evp_md);
+-    EVP_DigestUpdate(&md, data, datalen);
+-    EVP_DigestFinal(&md, digest, &dlen);
++    md = EVP_MD_CTX_create();
++    EVP_DigestInit(md, evp_md);
++    EVP_DigestUpdate(md, data, datalen);
++    EVP_DigestFinal(md, digest, &dlen);
+ 
+     ret = ECDSA_do_verify(digest, dlen, sig, key->ecdsa);
+     memset(digest, 'd', sizeof(digest));
++    EVP_MD_CTX_destroy(md);
+ 
+     ECDSA_SIG_free(sig);
+ 
+     pamsshagentauth_verbose("ssh_ecdsa_verify: signature %s",
+         ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
+     return ret;
+-}
+\ No newline at end of file
++}
+diff --git a/ssh-rsa.c b/ssh-rsa.c
+index d05844b..9d74eb6 100644
+--- a/ssh-rsa.c
++++ b/ssh-rsa.c
+@@ -40,7 +40,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+     const u_char *data, u_int datalen)
+ {
+ 	const EVP_MD *evp_md;
+-	EVP_MD_CTX md;
++	EVP_MD_CTX *md;
+ 	u_char digest[EVP_MAX_MD_SIZE], *sig;
+ 	u_int slen, dlen, len;
+ 	int ok, nid;
+@@ -55,6 +55,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+ 		pamsshagentauth_logerror("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid);
+ 		return -1;
+ 	}
++	md = EVP_MD_CTX_create();
+ 	EVP_DigestInit(&md, evp_md);
+ 	EVP_DigestUpdate(&md, data, datalen);
+ 	EVP_DigestFinal(&md, digest, &dlen);
+@@ -64,6 +65,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+ 
+ 	ok = RSA_sign(nid, digest, dlen, sig, &len, key->rsa);
+ 	memset(digest, 'd', sizeof(digest));
++	EVP_MD_CTX_destroy(md);
+ 
+ 	if (ok != 1) {
+ 		int ecode = ERR_get_error();
+@@ -107,7 +109,7 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ {
+ 	Buffer b;
+ 	const EVP_MD *evp_md;
+-	EVP_MD_CTX md;
++	EVP_MD_CTX *md;
+ 	char *ktype;
+ 	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
+ 	u_int len, dlen, modlen;
+@@ -117,9 +119,17 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 		pamsshagentauth_logerror("ssh_rsa_verify: no RSA key");
+ 		return -1;
+ 	}
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
++#else
++	if (BN_num_bits(RSA_get0_n(key->rsa)) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
++#endif
+ 		pamsshagentauth_logerror("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits",
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ 		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
++#else
++		    BN_num_bits(RSA_get0_n(key->rsa)), SSH_RSA_MINIMUM_MODULUS_SIZE);
++#endif
+ 		return -1;
+ 	}
+ 	pamsshagentauth_buffer_init(&b);
+@@ -161,12 +171,14 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 		pamsshagentauth_xfree(sigblob);
+ 		return -1;
+ 	}
+-	EVP_DigestInit(&md, evp_md);
+-	EVP_DigestUpdate(&md, data, datalen);
+-	EVP_DigestFinal(&md, digest, &dlen);
++	md = EVP_MD_CTX_create();
++	EVP_DigestInit(md, evp_md);
++	EVP_DigestUpdate(md, data, datalen);
++	EVP_DigestFinal(md, digest, &dlen);
+ 
+ 	ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa);
+ 	memset(digest, 'd', sizeof(digest));
++	EVP_MD_CTX_destroy(md);
+ 	memset(sigblob, 's', len);
+ 	pamsshagentauth_xfree(sigblob);
+ 	pamsshagentauth_verbose("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : "");
+
+From 4dc87369134f215378042ec4d971a4fe48d1a02b Mon Sep 17 00:00:00 2001
+From: Guido Falsi <mad@madpilot.net>
+Date: Wed, 24 Oct 2018 20:36:15 +0200
+Subject: [PATCH 2/2] Check against the correct OPENSSL_VERSION_NUMBER
+
+Alexey Dokuchaev (a fellow FreeBSD developer) pointed out to me the opaque structures were introduced in 1.1.0-pre
+5, so the correct OPENSSL_VERSION_NUMBER to discriminate is 0x10100005L.
+---
+ authfd.c    | 12 ++++++------
+ bufbn.c     |  2 +-
+ key.c       | 36 ++++++++++++++++++------------------
+ ssh-dss.c   | 10 +++++-----
+ ssh-ecdsa.c |  8 ++++----
+ ssh-rsa.c   |  4 ++--
+ 6 files changed, 36 insertions(+), 36 deletions(-)
+
+diff --git a/authfd.c b/authfd.c
+index 35f8de1..01d1d89 100644
+--- a/authfd.c
++++ b/authfd.c
+@@ -372,7 +372,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
+ 	case 1:
+ 		key = pamsshagentauth_key_new(KEY_RSA1);
+ 		bits = pamsshagentauth_buffer_get_int(&auth->identities);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->e);
+ 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->n);
+ 		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
+@@ -432,7 +432,7 @@ ssh_decrypt_challenge(AuthenticationConnection *auth,
+ 	}
+ 	pamsshagentauth_buffer_init(&buffer);
+ 	pamsshagentauth_buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
+ 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->e);
+ 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->n);
+@@ -517,7 +517,7 @@ ssh_agent_sign(AuthenticationConnection *auth,
+ static void
+ ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
+ {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	pamsshagentauth_buffer_put_int(b, BN_num_bits(key->n));
+ 	pamsshagentauth_buffer_put_bignum(b, key->n);
+ 	pamsshagentauth_buffer_put_bignum(b, key->e);
+@@ -545,7 +545,7 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
+ 	pamsshagentauth_buffer_put_cstring(b, key_ssh_name(key));
+ 	switch (key->type) {
+ 	case KEY_RSA:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->n);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->e);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->d);
+@@ -562,7 +562,7 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
+ #endif
+ 		break;
+ 	case KEY_DSA:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->p);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->q);
+ 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->g);
+@@ -654,7 +654,7 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
+ 
+ 	if (key->type == KEY_RSA1) {
+ 		pamsshagentauth_buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(key->rsa->n));
+ 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->e);
+ 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->n);
+diff --git a/bufbn.c b/bufbn.c
+index 4ecedc1..b4754cc 100644
+--- a/bufbn.c
++++ b/bufbn.c
+@@ -151,7 +151,7 @@ pamsshagentauth_buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
+ 		pamsshagentauth_buffer_put_int(buffer, 0);
+ 		return 0;
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	if (value->neg) {
+ #else
+ 	if (BN_is_negative(value)) {
+diff --git a/key.c b/key.c
+index aedbbb5..dcc5fc8 100644
+--- a/key.c
++++ b/key.c
+@@ -77,7 +77,7 @@ pamsshagentauth_key_new(int type)
+ 	case KEY_RSA:
+ 		if ((rsa = RSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: RSA_new failed");
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((rsa->n = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
+ 		if ((rsa->e = BN_new()) == NULL)
+@@ -91,7 +91,7 @@ pamsshagentauth_key_new(int type)
+ 	case KEY_DSA:
+ 		if ((dsa = DSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: DSA_new failed");
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((dsa->p = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new: BN_new failed");
+ 		if ((dsa->q = BN_new()) == NULL)
+@@ -130,7 +130,7 @@ pamsshagentauth_key_new_private(int type)
+ 	switch (k->type) {
+ 	case KEY_RSA1:
+ 	case KEY_RSA:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((k->rsa->d = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
+ 		if ((k->rsa->iqmp = BN_new()) == NULL)
+@@ -153,7 +153,7 @@ pamsshagentauth_key_new_private(int type)
+ #endif
+ 		break;
+ 	case KEY_DSA:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((k->dsa->priv_key = BN_new()) == NULL)
+ 			pamsshagentauth_fatal("key_new_private: BN_new failed");
+ #else
+@@ -162,7 +162,7 @@ pamsshagentauth_key_new_private(int type)
+ #endif
+ 		break;
+ 	case KEY_ECDSA:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if (EC_KEY_set_private_key(k->ecdsa, BN_new()) != 1)
+ 			pamsshagentauth_fatal("key_new_private: EC_KEY_set_private_key failed");
+ #else
+@@ -224,7 +224,7 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
+ 	case KEY_RSA1:
+ 	case KEY_RSA:
+ 		return a->rsa != NULL && b->rsa != NULL &&
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
+ 		    BN_cmp(a->rsa->n, b->rsa->n) == 0;
+ #else
+@@ -233,7 +233,7 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
+ #endif
+ 	case KEY_DSA:
+ 		return a->dsa != NULL && b->dsa != NULL &&
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
+ 		    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
+ 		    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
+@@ -293,7 +293,7 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
+ 	}
+ 	switch (k->type) {
+ 	case KEY_RSA1:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		nlen = BN_num_bytes(k->rsa->n);
+ 		elen = BN_num_bytes(k->rsa->e);
+ 		len = nlen + elen;
+@@ -510,7 +510,7 @@ pamsshagentauth_key_read(Key *ret, char **cpp)
+ 			return -1;
+ 		*cpp = cp;
+ 		/* Get public exponent, public modulus. */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if (!read_bignum(cpp, ret->rsa->e))
+ 			return -1;
+ 		if (!read_bignum(cpp, ret->rsa->n))
+@@ -643,7 +643,7 @@ pamsshagentauth_key_write(const Key *key, FILE *f)
+ 
+ 	if (key->type == KEY_RSA1 && key->rsa != NULL) {
+ 		/* size of modulus 'n' */
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		bits = BN_num_bits(key->rsa->n);
+ 		fprintf(f, "%u", bits);
+ 		if (write_bignum(f, key->rsa->e) &&
+@@ -742,7 +742,7 @@ pamsshagentauth_key_size(const Key *k)
+ {
+ 	switch (k->type) {
+ 	case KEY_RSA1:
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	case KEY_RSA:
+ 		return BN_num_bits(k->rsa->n);
+ 	case KEY_DSA:
+@@ -843,7 +843,7 @@ pamsshagentauth_key_from_private(const Key *k)
+ 	switch (k->type) {
+ 	case KEY_DSA:
+ 		n = pamsshagentauth_key_new(k->type);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
+ 		    (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
+ 		    (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
+@@ -859,7 +859,7 @@ pamsshagentauth_key_from_private(const Key *k)
+ 	case KEY_RSA:
+ 	case KEY_RSA1:
+ 		n = pamsshagentauth_key_new(k->type);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
+ 		    (BN_copy(n->rsa->e, k->rsa->e) == NULL))
+ #else
+@@ -967,7 +967,7 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
+ 	switch (type) {
+ 	case KEY_RSA:
+ 		key = pamsshagentauth_key_new(type);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->e) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->n) == -1) {
+ #else
+@@ -985,7 +985,7 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
+ 		break;
+ 	case KEY_DSA:
+ 		key = pamsshagentauth_key_new(type);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->p) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->q) == -1 ||
+ 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->g) == -1 ||
+@@ -1113,7 +1113,7 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
+ 	}
+ 	pamsshagentauth_buffer_init(&b);
+ 	switch (key->type) {
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	case KEY_DSA:
+ 		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
+ 		pamsshagentauth_buffer_put_bignum2(&b, key->dsa->p);
+@@ -1251,7 +1251,7 @@ pamsshagentauth_key_demote(const Key *k)
+ 	case KEY_RSA:
+ 		if ((pk->rsa = RSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_demote: RSA_new failed");
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
+ 		if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
+@@ -1264,7 +1264,7 @@ pamsshagentauth_key_demote(const Key *k)
+ 	case KEY_DSA:
+ 		if ((pk->dsa = DSA_new()) == NULL)
+ 			pamsshagentauth_fatal("key_demote: DSA_new failed");
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
+ 			pamsshagentauth_fatal("key_demote: BN_dup failed");
+ 		if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
+diff --git a/ssh-dss.c b/ssh-dss.c
+index 1051ae2..9b96274 100644
+--- a/ssh-dss.c
++++ b/ssh-dss.c
+@@ -52,7 +52,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
+ 	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
+ 	u_int rlen, slen, len, dlen;
+ 	Buffer b;
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+ 	const BIGNUM *r, *s;
+ #endif
+ 
+@@ -74,7 +74,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
+ 		return -1;
+ 	}
+ 
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	rlen = BN_num_bytes(sig->r);
+ 	slen = BN_num_bytes(sig->s);
+ #else
+@@ -88,7 +88,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
+ 		return -1;
+ 	}
+ 	memset(sigblob, 0, SIGBLOB_LEN);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
+ 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
+ #else
+@@ -131,7 +131,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 	u_int len, dlen;
+ 	int rlen, ret;
+ 	Buffer b;
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+ 	BIGNUM *r, *s;
+ #endif
+ 
+@@ -176,7 +176,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 	/* parse signature */
+ 	if ((sig = DSA_SIG_new()) == NULL)
+ 		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_new failed");
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	if ((sig->r = BN_new()) == NULL)
+ 		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
+ 	if ((sig->s = BN_new()) == NULL)
+diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
+index c213959..5b13b30 100644
+--- a/ssh-ecdsa.c
++++ b/ssh-ecdsa.c
+@@ -45,7 +45,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+     u_char digest[EVP_MAX_MD_SIZE];
+     u_int len, dlen;
+     Buffer b, bb;
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+ 	BIGNUM *r, *s;
+ #endif
+ 
+@@ -69,7 +69,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
+     }
+ 
+     pamsshagentauth_buffer_init(&bb);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+     if (pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->r) == -1 ||
+         pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->s) == -1) {
+ #else
+@@ -110,7 +110,7 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+     u_int len, dlen;
+     int rlen, ret;
+     Buffer b;
+-#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++#if OPENSSL_VERSION_NUMBER >= 0x10100005L
+ 	BIGNUM *r, *s;
+ #endif
+ 
+@@ -141,7 +141,7 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 
+     pamsshagentauth_buffer_init(&b);
+     pamsshagentauth_buffer_append(&b, sigblob, len);
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+     if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
+         (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
+ #else
+diff --git a/ssh-rsa.c b/ssh-rsa.c
+index 9d74eb6..35f2e36 100644
+--- a/ssh-rsa.c
++++ b/ssh-rsa.c
+@@ -119,13 +119,13 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
+ 		pamsshagentauth_logerror("ssh_rsa_verify: no RSA key");
+ 		return -1;
+ 	}
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
+ #else
+ 	if (BN_num_bits(RSA_get0_n(key->rsa)) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
+ #endif
+ 		pamsshagentauth_logerror("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits",
+-#if OPENSSL_VERSION_NUMBER < 0x10100000L
++#if OPENSSL_VERSION_NUMBER < 0x10100005L
+ 		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
+ #else
+ 		    BN_num_bits(RSA_get0_n(key->rsa)), SSH_RSA_MINIMUM_MODULUS_SIZE);
diff --git a/sys-auth/pam_ssh_agent_auth/metadata.xml b/sys-auth/pam_ssh_agent_auth/metadata.xml
new file mode 100644
index 000000000000..f76e973f6983
--- /dev/null
+++ b/sys-auth/pam_ssh_agent_auth/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="sourceforge">pamsshagentauth</remote-id>
+		<remote-id type="github">jbeverly/pam_ssh_agent_auth</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild
new file mode 100644
index 000000000000..37eb86d8b47a
--- /dev/null
+++ b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit pam
+
+DESCRIPTION="Simple module to authenticate users against their ssh-agent keys"
+HOMEPAGE="http://pamsshagentauth.sourceforge.net"
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/jbeverly/${PN}.git"
+	inherit git-r3
+else
+	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE=""
+
+PATCHES=(
+	"${FILESDIR}/${P}-openssl-1.1.1.patch"
+)
+DEPEND="sys-libs/pam
+	dev-libs/openssl:0="
+
+RDEPEND="${DEPEND}
+	virtual/ssh"
+
+# needed for pod2man
+DEPEND="${DEPEND}
+	dev-lang/perl"
+
+src_configure() {
+	pammod_hide_symbols
+
+	econf \
+		--without-openssl-header-check \
+		--libexecdir="$(getpam_mod_dir)"
+}
+
+src_install() {
+	# Don't use emake install as it makes it harder to have proper
+	# install paths.
+	dopammod pam_ssh_agent_auth.so
+	doman pam_ssh_agent_auth.8
+
+	dodoc CONTRIBUTORS
+}
diff --git a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild
new file mode 100644
index 000000000000..12b2fba91df3
--- /dev/null
+++ b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit pam
+
+DESCRIPTION="Simple module to authenticate users against their ssh-agent keys"
+HOMEPAGE="http://pamsshagentauth.sourceforge.net"
+
+if [[ ${PV} == *9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/jbeverly/${PN}.git"
+	inherit git-r3
+else
+	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE=""
+
+DEPEND="sys-libs/pam
+	dev-libs/openssl:0="
+
+RDEPEND="${DEPEND}
+	virtual/ssh"
+
+# needed for pod2man
+DEPEND="${DEPEND}
+	dev-lang/perl"
+
+src_configure() {
+	pammod_hide_symbols
+
+	econf \
+		--without-openssl-header-check \
+		--libexecdir="$(getpam_mod_dir)"
+}
+
+src_install() {
+	# Don't use emake install as it makes it harder to have proper
+	# install paths.
+	dopammod pam_ssh_agent_auth.so
+	doman pam_ssh_agent_auth.8
+
+	dodoc CONTRIBUTORS
+}
diff --git a/sys-auth/pam_u2f/Manifest b/sys-auth/pam_u2f/Manifest
new file mode 100644
index 000000000000..25d09bf1c3cc
--- /dev/null
+++ b/sys-auth/pam_u2f/Manifest
@@ -0,0 +1 @@
+DIST pam_u2f-1.0.8.tar.gz 384163 BLAKE2B 99767601027db25e6f8d2e59aad5f72b078cf7344ca10fa310a990d512c5e5a4c9ff7c24acb5b21b88b82aa47b4052b9164a422426d1f0889c8f6776526e5c80 SHA512 0bdbea6307428bbed2af69129af207304f7951418ad7df339563f47d678a2cfe6b80321552382e15771cfc06306fae746521850056376f533c430556d051ad36
diff --git a/sys-auth/pam_u2f/files/pam_u2f-1.0.2-fix-Makefile.patch b/sys-auth/pam_u2f/files/pam_u2f-1.0.2-fix-Makefile.patch
new file mode 100644
index 000000000000..a83597602d45
--- /dev/null
+++ b/sys-auth/pam_u2f/files/pam_u2f-1.0.2-fix-Makefile.patch
@@ -0,0 +1,13 @@
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -34,8 +34,8 @@
+ # Release
+ 
+ install-exec-hook:
+-	rm -f $(PAMDIR)/pam_u2f.la
+-	chmod -f 644 $(PAMDIR)/pam_u2f.so || true
++	rm -f $(DESTDIR)/$(PAMDIR)/pam_u2f.la
++	chmod -f 644 $(DESTDIR)/$(PAMDIR)/pam_u2f.so || true
+ 
+ indent:
+ 	indent -kr -nut -i2 *.c *.h pamu2fcfg/*.c pamu2fcfg/*.h
diff --git a/sys-auth/pam_u2f/metadata.xml b/sys-auth/pam_u2f/metadata.xml
new file mode 100644
index 000000000000..b528dafc87e8
--- /dev/null
+++ b/sys-auth/pam_u2f/metadata.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>gokturk@gentoo.org</email>
+    <name>Göktürk Yüksek</name>
+  </maintainer>
+  <use>
+    <flag name="debug" restrict="&lt;sys-auth/pam_u2f-1.0.6">
+      Enable debug messages using the pam logging macros.
+      (Note: these will be visible on stdout for terminal logins).
+    </flag>
+    <flag name="debug">
+      Enable debug messages using the pam logging macros.
+    </flag>
+  </use>
+  <upstream>
+    <remote-id type="github">Yubico/pam-u2f</remote-id>
+    <bugs-to>https://github.com/Yubico/pam-u2f/issues</bugs-to>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_u2f/pam_u2f-1.0.8.ebuild b/sys-auth/pam_u2f/pam_u2f-1.0.8.ebuild
new file mode 100644
index 000000000000..7dd18f7b38f8
--- /dev/null
+++ b/sys-auth/pam_u2f/pam_u2f-1.0.8.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools flag-o-matic pam
+
+DESCRIPTION="Library for authenticating against PAM with a Yubikey"
+HOMEPAGE="https://github.com/Yubico/pam-u2f"
+SRC_URI="https://developers.yubico.com/${PN/_/-}/Releases/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE="debug"
+
+RDEPEND="
+	app-crypt/libu2f-host
+	app-crypt/libu2f-server:=
+	sys-libs/pam"
+
+DEPEND="${RDEPEND}
+	virtual/pkgconfig"
+
+PATCHES=( "${FILESDIR}/${PN}-1.0.2-fix-Makefile.patch" )
+
+src_prepare() {
+	default
+	use debug || append-cppflags -UDEBUG_PAM -UPAM_DEBUG
+	eautoreconf
+}
+
+src_configure() {
+	econf --with-pam-dir=$(getpam_mod_dir)
+}
diff --git a/sys-auth/pam_update/ChangeLog b/sys-auth/pam_update/ChangeLog
new file mode 100644
index 000000000000..567c7e1772a4
--- /dev/null
+++ b/sys-auth/pam_update/ChangeLog
@@ -0,0 +1,10 @@
+# ChangeLog for sys-auth/pam_update
+# Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
+# $Header: $
+
+*pam_update-0.1.0 (16 Jun 2014)
+
+  16 Jun 2014; Mike Hiretsky (mhiretskiy) <mh@calculate.ru>
+  +pam_update-0.1.0.ebuild:
+  Bump version
+
diff --git a/sys-auth/pam_update/Manifest b/sys-auth/pam_update/Manifest
new file mode 100644
index 000000000000..fad0b9487091
--- /dev/null
+++ b/sys-auth/pam_update/Manifest
@@ -0,0 +1 @@
+DIST pam_update-0.1.3.tar.bz2 5636 BLAKE2B cca0907cf5dfc9265f121a61788c3f523c4804a1ca07890a8cbd8db496ddcc2a8aacffbe1a49ed91d938211cdb5d69ef2ac151e527adb1af4a4a6711e7a1a64d SHA512 5edc40b40cea09da5911155fa2fc2b2639abd7b596583fd38fb844f606a4b75ca204c51952dc5d55b6e9f2abfcedcc57458f9a277488af29997767e747a25111
diff --git a/sys-auth/pam_update/pam_update-0.1.3-r1.ebuild b/sys-auth/pam_update/pam_update-0.1.3-r1.ebuild
new file mode 100644
index 000000000000..5579805c5698
--- /dev/null
+++ b/sys-auth/pam_update/pam_update-0.1.3-r1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: $
+
+inherit pam
+
+DESCRIPTION="System authentification update checkup tool"
+HOMEPAGE="http://www.calculate-linux.org/main/en/calculate2"
+SRC_URI="ftp://ftp.calculate-linux.org/calculate/source/${PN}/${P}.tar.bz2
+	http://mirror.yandex.ru/calculate/source/${PN}/${P}.tar.bz2"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+DEPEND=""
+RDEPEND="${DEPEND} !<sys-apps/calculate-utils-3.5.0_alpha38"
+
+src_compile() {
+	make CFLAGS="-Wall ${CFLAGS}" || die
+}
+
+src_install() {
+	dopammod pam_update.so
+}
diff --git a/sys-auth/pam_yubico/Manifest b/sys-auth/pam_yubico/Manifest
new file mode 100644
index 000000000000..78ec916feb35
--- /dev/null
+++ b/sys-auth/pam_yubico/Manifest
@@ -0,0 +1 @@
+DIST pam_yubico-2.26.tar.gz 423451 BLAKE2B be65b9726d3b5d353577014c78163d9e092d3d98baf9c22c2a43bbbb5362589c18713712d218fd154cf493211cefd2924158b326db45c2b7dd0aee9aa9080de5 SHA512 4adba37f07e1fe1a2c4b534246ef0e862be76e3b1ce0ed6f11f15436f537cd5963f00abf48f6faa7e65b025ff6924dbaf918db1675b1e2cb89a802d2f2d6a4ec
diff --git a/sys-auth/pam_yubico/metadata.xml b/sys-auth/pam_yubico/metadata.xml
new file mode 100644
index 000000000000..634bb706bba7
--- /dev/null
+++ b/sys-auth/pam_yubico/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>zerochaos@gentoo.org</email>
+    <name>Rick Farina</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="github">Yubico/yubico-pam</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/pam_yubico/pam_yubico-2.26.ebuild b/sys-auth/pam_yubico/pam_yubico-2.26.ebuild
new file mode 100644
index 000000000000..d02d30e11751
--- /dev/null
+++ b/sys-auth/pam_yubico/pam_yubico-2.26.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit pam
+
+DESCRIPTION="Library for authenticating against PAM with a Yubikey"
+HOMEPAGE="https://github.com/Yubico/yubico-pam"
+SRC_URI="http://opensource.yubico.com/yubico-pam/releases/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="ldap test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/pam
+	sys-auth/libyubikey
+	>=sys-auth/ykclient-2.15
+	>=sys-auth/ykpers-1.6
+	ldap? ( net-nds/openldap )"
+DEPEND="${RDEPEND}
+	app-text/asciidoc
+	test? ( dev-perl/Net-LDAP-Server )"
+
+src_configure() {
+	#challenge response could be optional but that seems horribly dangerous to me
+	local myeconfargs=(
+		--with-cr
+		--with-pam-dir="$(getpam_mod_dir)"
+		$(use_with ldap)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+	dodoc doc/*
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/pambase/Manifest b/sys-auth/pambase/Manifest
new file mode 100644
index 000000000000..8e35b3e7c0d2
--- /dev/null
+++ b/sys-auth/pambase/Manifest
@@ -0,0 +1,3 @@
+DIST pambase-20190402.tar.gz 3679 BLAKE2B 992d7bf6b6f74ef22a8808b57dd6faffb6c351eaa8be4172f320031334ca6def698b2cb17005b58ac3c18e89a94012e279b0f27cc2bea5040ae8ddc3233cba2d SHA512 565d64653e9898b9bd231c1461ec0988a19dbc9500ff1417a7197ac75804abeb13ca543121ae4afb29017c1e99073a16137e5c876f43dcc01e2641218760f4ae
+DIST pambase-20191128.tar.gz 3472 BLAKE2B 1028239c14eed3d06239f98667ffe136dc3c9cdb9c74d8f49e0c819d9ea308285cdd234538418357030dd39693040592b00f193cac4e37e15b9f277386096860 SHA512 09100457cacbe309eac8545818de3e4bff4f0c4a29b4c1758217dd80206c664f497570ef67207866aaf70be60ec963677b385adaf2c4a0cd931a50404098051b
+DIST pambase-20200304.tar.gz 3466 BLAKE2B e4d406460d435403ed7a46d517f9006cacc54a94f5019a573c81b331731c88679ed6d388354b5946894bdfada556b4c73735c3f4de88fc7678cd831c68ab46c3 SHA512 c2a7f3fd143637fbdf5c0a3c58ba5a3c23c5e8adb1f057d02b4b9d64660435fc529031a0f710a9e5fc7091710f78dcb2f3e1ff48f033fb491ddd0399ef05b189
diff --git a/sys-auth/pambase/files/config-util.pamd b/sys-auth/pambase/files/config-util.pamd
new file mode 100644
index 000000000000..8e70d9aba1da
--- /dev/null
+++ b/sys-auth/pambase/files/config-util.pamd
@@ -0,0 +1,8 @@
+#%PAM-1.0
+auth		sufficient	pam_rootok.so
+auth		sufficient	pam_timestamp.so
+auth		include		system-auth
+account		required	pam_permit.so
+session		required	pam_permit.so
+session		optional	pam_xauth.so
+session		optional	pam_timestamp.so
diff --git a/sys-auth/pambase/files/fingerprint-auth.pamd b/sys-auth/pambase/files/fingerprint-auth.pamd
new file mode 100644
index 000000000000..7db692606ffe
--- /dev/null
+++ b/sys-auth/pambase/files/fingerprint-auth.pamd
@@ -0,0 +1,17 @@
+#%PAM-1.0
+auth        required      pam_env.so
+auth        sufficient    pam_fprintd.so
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 500 quiet
+account     required      pam_permit.so
+
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session     optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
diff --git a/sys-auth/pambase/files/other.pamd b/sys-auth/pambase/files/other.pamd
new file mode 100644
index 000000000000..c286c823c3f3
--- /dev/null
+++ b/sys-auth/pambase/files/other.pamd
@@ -0,0 +1,5 @@
+#%PAM-1.0
+auth     required       pam_deny.so
+account  required       pam_deny.so
+password required       pam_deny.so
+session  required       pam_deny.so
diff --git a/sys-auth/pambase/files/pambase-20200304-faillock.patch b/sys-auth/pambase/files/pambase-20200304-faillock.patch
new file mode 100644
index 000000000000..82b9e54123c9
--- /dev/null
+++ b/sys-auth/pambase/files/pambase-20200304-faillock.patch
@@ -0,0 +1,41 @@
+diff -u pambase-pambase-20200304/system-auth.in pambase-pambase-20200304-fix/system-auth.in
+--- pambase-pambase-20200304/system-auth.in	2020-03-04 18:32:01.000000000 +0100
++++ pambase-pambase-20200304-fix/system-auth.in	2020-03-07 18:31:18.706878578 +0100
+@@ -7,13 +7,16 @@
+ #if HAVE_KRB5
+ auth		KRB5_CONTROL	pam_krb5.so KRB5_PARAMS
+ #endif
+-auth		required	pam_unix.so try_first_pass LIKEAUTH NULLOK DEBUG
++auth        required       pam_faillock.so preauth silent audit deny=3 unlock_time=600
++auth        sufficient     pam_unix.so NULLOK DEBUG try_first_pass
++auth        [default=die]  pam_faillock.so authfail audit deny=3 unlock_time=600
+ /* This is needed to make sure that the Kerberos skip-on-success won't cause a bad jump. */
+ auth		optional	pam_permit.so
+ 
+ #if HAVE_KRB5
+ account		KRB5_CONTROL	pam_krb5.so KRB5_PARAMS
+ #endif
++account     required    pam_faillock.so
+ account		required	pam_unix.so DEBUG
+ /* This is needed to make sure that the Kerberos skip-on-success won't cause a bad jump. */
+ account		optional	pam_permit.so
+diff -u pambase-pambase-20200304/system-login.in pambase-pambase-20200304-fix/system-login.in
+--- pambase-pambase-20200304/system-login.in	2020-03-04 18:32:01.000000000 +0100
++++ pambase-pambase-20200304-fix/system-login.in	2020-03-07 20:17:23.254989413 +0100
+@@ -1,6 +1,3 @@
+-#if defined(TALLY_MODULE)
+-auth		required	TALLY_MODULE onerr=succeed
+-#endif
+ #if HAVE_SHELLS
+ auth		required	pam_shells.so DEBUG
+ #endif
+@@ -19,9 +16,6 @@
+ account		required	pam_nologin.so DEBUG_NOLOGIN
+ #endif
+ account		include		system-auth
+-#if defined(TALLY_MODULE)
+-account		required	TALLY_MODULE onerr=succeed DEBUG
+-#endif
+ 
+ password	include		system-auth
+ 
diff --git a/sys-auth/pambase/files/postlogin.pamd b/sys-auth/pambase/files/postlogin.pamd
new file mode 100644
index 000000000000..eaebbfaef1c9
--- /dev/null
+++ b/sys-auth/pambase/files/postlogin.pamd
@@ -0,0 +1,5 @@
+#%PAM-1.0
+session     optional      pam_umask.so silent
+session     [success=1 default=ignore] pam_succeed_if.so service !~ gdm* service !~ su* quiet
+session     [default=1]   pam_lastlog.so nowtmp showfailed
+session     optional      pam_lastlog.so silent noupdate showfailed
diff --git a/sys-auth/pambase/files/smartcard-auth.pamd b/sys-auth/pambase/files/smartcard-auth.pamd
new file mode 100644
index 000000000000..e8dc3c88a6b9
--- /dev/null
+++ b/sys-auth/pambase/files/smartcard-auth.pamd
@@ -0,0 +1,17 @@
+#%PAM-1.0
+auth        required      pam_env.so
+auth        [success=done ignore=ignore default=die] pam_pkcs11.so wait_for_card
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+account     sufficient    pam_localuser.so
+account     sufficient    pam_succeed_if.so uid < 500 quiet
+account     required      pam_permit.so
+
+password    optional      pam_pkcs11.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+-session     optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
diff --git a/sys-auth/pambase/files/system-auth.pamd b/sys-auth/pambase/files/system-auth.pamd
new file mode 100644
index 000000000000..2b5a333d7add
--- /dev/null
+++ b/sys-auth/pambase/files/system-auth.pamd
@@ -0,0 +1,19 @@
+#%PAM-1.0
+auth        required      pam_env.so
+auth        sufficient    pam_unix.so try_first_pass likeauth nullok
+auth        required      pam_deny.so
+
+account     required      pam_unix.so
+
+# Make sure you use use_authtok below if and only if you
+# want to stack a password checking tool like pam_pwquality
+password    sufficient    pam_unix.so try_first_pass nullok sha512 shadow
+password    required      pam_deny.so
+
+session     optional      pam_keyinit.so revoke
+session     required      pam_limits.so
+session     optional      pam_env.so
+session     optional      pam_umask.so
+session     optional      pam_systemd.so
+session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
+session     required      pam_unix.so
diff --git a/sys-auth/pambase/metadata.xml b/sys-auth/pambase/metadata.xml
new file mode 100644
index 000000000000..b234a91845ce
--- /dev/null
+++ b/sys-auth/pambase/metadata.xml
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>dev@liguros.net</email>
+		<name>Development</name>
+	</maintainer>
+	<use>
+		<flag name="cracklib">
+			Enable pam_cracklib module on system authentication stack. This
+			produces warnings when changing password to something easily
+			crackable. It requires the same USE flag to be enabled on
+			<pkg>sys-libs/pam</pkg> or system login might be impossible.
+		</flag>
+		<flag name="consolekit">
+			Enable pam_ck_connector module on local system logins. This
+			allows for console logins to make use of ConsoleKit
+			authorization.
+		</flag>
+		<flag name="elogind">
+			Use pam_elogind module to register user sessions with elogind.
+		</flag>
+		<flag name="systemd">
+			Use pam_systemd module to register user sessions in the systemd
+			control group hierarchy.
+		</flag>
+		<flag name="debug">
+			Enable debug information logging on syslog(3) for all the
+			modules supporting this in the system authentication and system
+			login stacks.
+		</flag>
+		<flag name="passwdqc">
+			Enable pam_passwdqc module on system auth stack for password
+			quality validation. This is an alternative to pam_cracklib
+			producing warnings, rejecting or providing example passwords
+			when changing your system password. It is used by default by
+			OpenWall GNU/*/Linux and by FreeBSD.
+		</flag>
+		<flag name="mktemp">
+			Enable pam_mktemp module on system auth stack for session
+			handling. This module creates a private temporary directory for
+			the user, and sets TMP and TMPDIR accordingly.
+		</flag>
+		<flag name="pam_ssh">
+			Enable pam_ssh module on system auth stack for authentication
+			and session handling. This module will accept as password the
+			passphrase of a private SSH key (one of ~/.ssh/id_rsa,
+			~/.ssh/id_dsa or ~/.ssh/identity), and will spawn an ssh-agent
+			instance to cache the open key.
+		</flag>
+		<flag name="sha512">
+			Switch Linux-PAM's pam_unix module to use sha512 for passwords
+			hashes rather than MD5. This option requires
+			<pkg>sys-libs/pam</pkg> version 1.0.1 built against
+			<pkg>sys-libs/glibc</pkg> version 2.7, if it's built against an
+			earlier version, it will silently be ignored, and MD5 hashes
+			will be used. All the passwords changed after this USE flag is
+			enabled will be saved to the shadow file hashed using SHA512
+			function. The password previously saved will be left
+			untouched. Please note that while SHA512-hashed passwords will
+			still be recognised if the USE flag is removed, the shadow file
+			will not be compatible with systems using an earlier glibc
+			version.
+		</flag>
+		<flag name="pam_krb5">
+			Enable pam_krb5 module on system auth stack, as an alternative
+			to pam_unix. If Kerberos authentication succeed, only pam_unix
+			will be ignore, and all the other modules will proceed as usual,
+			including Gnome Keyring and other session modules. It requires
+			<pkg>sys-libs/pam</pkg> as PAM implementation.
+		</flag>
+		<flag name="minimal">
+			Disables the standard PAM modules that provide extra information
+			to users on login; this includes pam_tally (and pam_tally2 for
+			Linux PAM 1.1 and later), pam_lastlog, pam_motd and other
+			similar modules. This might not be a good idea on a multi-user
+			system but could reduce slightly the overhead on single-user
+			non-networked systems.
+		</flag>
+		<flag name="nullok">
+			Enable the nullok option with the pam_unix module. This allows
+			people to login with blank passwords.
+		</flag>
+		<flag name="securetty">
+			Enable pam_securetty module in the login stack. Not generally
+			relevant anymore as the login stack only refers to local logins
+			and local terminals imply secure access in the first place.
+		</flag>
+	</use>
+	<origin>kit-fixups</origin>
+</pkgmetadata>
diff --git a/sys-auth/pambase/pambase-20190402.ebuild b/sys-auth/pambase/pambase-20190402.ebuild
new file mode 100644
index 000000000000..c68735d9d428
--- /dev/null
+++ b/sys-auth/pambase/pambase-20190402.ebuild
@@ -0,0 +1,87 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="PAM base configuration files"
+HOMEPAGE="https://github.com/gentoo/pambase"
+SRC_URI="https://github.com/gentoo/pambase/archive/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 ~riscv s390 sh sparc x86 ~amd64-linux ~x86-linux"
+IUSE="consolekit +cracklib debug elogind minimal mktemp +nullok pam_krb5 pam_ssh passwdqc securetty selinux +sha512 systemd"
+
+RESTRICT="binchecks"
+
+REQUIRED_USE="?? ( consolekit elogind systemd )"
+
+MIN_PAM_REQ=1.1.3
+
+RDEPEND="
+	>=sys-libs/pam-${MIN_PAM_REQ}
+	consolekit? ( sys-auth/consolekit[pam] )
+	cracklib? ( sys-libs/pam[cracklib] )
+	elogind? ( sys-auth/elogind[pam] )
+	mktemp? ( sys-auth/pam_mktemp )
+	pam_krb5? (
+		>=sys-libs/pam-${MIN_PAM_REQ}
+		sys-auth/pam_krb5
+	)
+	pam_ssh? ( sys-auth/pam_ssh )
+	passwdqc? ( sys-auth/pam_passwdqc )
+	selinux? ( sys-libs/pam[selinux] )
+	sha512? ( >=sys-libs/pam-${MIN_PAM_REQ} )
+	systemd? ( sys-apps/systemd[pam] )
+"
+DEPEND="
+	app-arch/xz-utils
+	app-portage/portage-utils
+"
+
+S="${WORKDIR}/${PN}-${P}"
+
+src_compile() {
+	local implementation linux_pam_version
+	if has_version sys-libs/pam; then
+		implementation=linux-pam
+		local ver_str=$(qatom $(best_version sys-libs/pam) | cut -d ' ' -f 3)
+		linux_pam_version=$(printf "0x%02x%02x%02x" ${ver_str//\./ })
+	elif has_version sys-auth/openpam; then
+		implementation=openpam
+	else
+		die "PAM implementation not identified"
+	fi
+
+	use_var() {
+		local varname=$(echo "$1" | tr '[:lower:]' '[:upper:]')
+		local usename=${2-$(echo "$1" | tr '[:upper:]' '[:lower:]')}
+		local varvalue=$(usex ${usename})
+		echo "${varname}=${varvalue}"
+	}
+
+	emake \
+		GIT=true \
+		$(use_var debug) \
+		$(use_var cracklib) \
+		$(use_var passwdqc) \
+		$(use_var consolekit) \
+		$(use_var elogind) \
+		$(use_var systemd) \
+		$(use_var selinux) \
+		$(use_var nullok) \
+		$(use_var mktemp) \
+		$(use_var pam_ssh) \
+		$(use_var securetty) \
+		$(use_var sha512) \
+		$(use_var KRB5 pam_krb5) \
+		$(use_var minimal) \
+		IMPLEMENTATION=${implementation} \
+		LINUX_PAM_VERSION=${linux_pam_version}
+}
+
+src_test() { :; }
+
+src_install() {
+	emake GIT=true DESTDIR="${ED}" install
+}
diff --git a/sys-auth/pambase/pambase-20191128.ebuild b/sys-auth/pambase/pambase-20191128.ebuild
new file mode 100644
index 000000000000..89fd6353aecc
--- /dev/null
+++ b/sys-auth/pambase/pambase-20191128.ebuild
@@ -0,0 +1,83 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="PAM base configuration files"
+HOMEPAGE="https://github.com/gentoo/pambase"
+SRC_URI="https://github.com/gentoo/pambase/archive/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="caps consolekit +cracklib debug elogind minimal mktemp +nullok pam_krb5 pam_ssh passwdqc securetty selinux +sha512 systemd"
+
+RESTRICT="binchecks"
+
+REQUIRED_USE="?? ( consolekit elogind systemd )"
+
+MIN_PAM_REQ=1.1.3
+
+RDEPEND="
+	>=sys-libs/pam-${MIN_PAM_REQ}
+	consolekit? ( sys-auth/consolekit[pam] )
+	cracklib? ( sys-libs/pam[cracklib] )
+	elogind? ( sys-auth/elogind[pam] )
+	mktemp? ( sys-auth/pam_mktemp )
+	pam_krb5? (
+		>=sys-libs/pam-${MIN_PAM_REQ}
+		sys-auth/pam_krb5
+	)
+	caps? ( sys-libs/libcap[pam] )
+	pam_ssh? ( sys-auth/pam_ssh )
+	passwdqc? ( sys-auth/pam_passwdqc )
+	selinux? ( sys-libs/pam[selinux] )
+	sha512? ( >=sys-libs/pam-${MIN_PAM_REQ} )
+	systemd? ( sys-apps/systemd[pam] )
+"
+DEPEND="
+	app-arch/xz-utils
+	app-portage/portage-utils
+"
+
+S="${WORKDIR}/${PN}-${P}"
+
+src_compile() {
+	local linux_pam_version
+	if has_version sys-libs/pam; then
+		local ver_str=$(qatom $(best_version sys-libs/pam) | cut -d ' ' -f 3)
+		linux_pam_version=$(printf "0x%02x%02x%02x" ${ver_str//\./ })
+	fi
+
+	use_var() {
+		local varname=$(echo "$1" | tr '[:lower:]' '[:upper:]')
+		local usename=${2-$(echo "$1" | tr '[:upper:]' '[:lower:]')}
+		local varvalue=$(usex ${usename})
+		echo "${varname}=${varvalue}"
+	}
+
+	emake \
+		GIT=true \
+		$(use_var debug) \
+		$(use_var LIBCAP caps) \
+		$(use_var cracklib) \
+		$(use_var passwdqc) \
+		$(use_var consolekit) \
+		$(use_var elogind) \
+		$(use_var systemd) \
+		$(use_var selinux) \
+		$(use_var nullok) \
+		$(use_var mktemp) \
+		$(use_var pam_ssh) \
+		$(use_var securetty) \
+		$(use_var sha512) \
+		$(use_var KRB5 pam_krb5) \
+		$(use_var minimal) \
+		LINUX_PAM_VERSION=${linux_pam_version}
+}
+
+src_test() { :; }
+
+src_install() {
+	emake GIT=true DESTDIR="${ED}" install
+}
diff --git a/sys-auth/pambase/pambase-20200304.ebuild b/sys-auth/pambase/pambase-20200304.ebuild
new file mode 100644
index 000000000000..53291445e684
--- /dev/null
+++ b/sys-auth/pambase/pambase-20200304.ebuild
@@ -0,0 +1,89 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+DESCRIPTION="PAM base configuration files"
+HOMEPAGE="https://github.com/gentoo/pambase"
+SRC_URI="https://github.com/gentoo/pambase/archive/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux"
+IUSE="caps consolekit +cracklib debug elogind minimal mktemp +nullok pam_krb5 pam_ssh passwdqc securetty selinux +sha512 systemd"
+
+RESTRICT="binchecks"
+
+REQUIRED_USE="?? ( consolekit elogind systemd )"
+
+MIN_PAM_REQ=1.1.3
+
+RDEPEND="
+	>=sys-libs/pam-${MIN_PAM_REQ}
+	consolekit? ( sys-auth/consolekit[pam] )
+	cracklib? ( sys-libs/pam[cracklib] )
+	elogind? ( sys-auth/elogind[pam] )
+	mktemp? ( sys-auth/pam_mktemp )
+	pam_krb5? (
+		>=sys-libs/pam-${MIN_PAM_REQ}
+		sys-auth/pam_krb5
+	)
+	caps? ( sys-libs/libcap[pam] )
+	pam_ssh? ( sys-auth/pam_ssh )
+	passwdqc? ( sys-auth/pam_passwdqc )
+	selinux? ( sys-libs/pam[selinux] )
+	sha512? ( >=sys-libs/pam-${MIN_PAM_REQ} )
+	systemd? ( sys-apps/systemd[pam] )
+"
+DEPEND="
+	app-arch/xz-utils
+	app-portage/portage-utils
+"
+
+S="${WORKDIR}/${PN}-${P}"
+
+PATCHES=( "${FILESDIR}"/${P}-faillock.patch )
+
+src_prepare() {
+	default
+}
+
+src_compile() {
+	local linux_pam_version
+	if has_version sys-libs/pam; then
+		local ver_str=$(qatom $(best_version sys-libs/pam) | cut -d ' ' -f 3)
+		linux_pam_version=$(printf "0x%02x%02x%02x" ${ver_str//\./ })
+	fi
+
+	use_var() {
+		local varname=$(echo "$1" | tr '[:lower:]' '[:upper:]')
+		local usename=${2-$(echo "$1" | tr '[:upper:]' '[:lower:]')}
+		local varvalue=$(usex ${usename})
+		echo "${varname}=${varvalue}"
+	}
+
+	emake \
+		GIT=true \
+		$(use_var debug) \
+		$(use_var LIBCAP caps) \
+		$(use_var cracklib) \
+		$(use_var passwdqc) \
+		$(use_var consolekit) \
+		$(use_var elogind) \
+		$(use_var systemd) \
+		$(use_var selinux) \
+		$(use_var nullok) \
+		$(use_var mktemp) \
+		$(use_var pam_ssh) \
+		$(use_var securetty) \
+		$(use_var sha512) \
+		$(use_var KRB5 pam_krb5) \
+		$(use_var minimal) \
+		LINUX_PAM_VERSION=${linux_pam_version}
+}
+
+src_test() { :; }
+
+src_install() {
+	emake GIT=true DESTDIR="${ED}" install
+}
diff --git a/sys-auth/passwdqc/Manifest b/sys-auth/passwdqc/Manifest
new file mode 100644
index 000000000000..01a58c4f18a9
--- /dev/null
+++ b/sys-auth/passwdqc/Manifest
@@ -0,0 +1,2 @@
+DIST passwdqc-1.3.0.tar.gz 48833 BLAKE2B bf6353749376ca8b52a8aac89b05561d4a0dde54133361b77228dd4d35f2e1e75f0b53a0f9c4fc2f6be5717110c1d762e2aa76f6461281b60fa3bdc9b19f2f7d SHA512 d9c2fd075ed4ff1f1dfa63fe40010d446abf8db306cacc77fd1e429fbd2dd1a6d2e4e91df46beb4c30bc30ff0cdd183ba85cefd362455ead9629d3a1c4eefece
+DIST passwdqc-1.4.0.tar.gz 55219 BLAKE2B 3f96a2d219ee23f11db2ad8ba433eaa56b97a263ad1a49159e0356b779cb4486ec9aa74cd7002fdd6d273e5a7bae4fe1b94e02f60256d331e5afc30d63e81360 SHA512 b9be6632688a1d7d929ec546679a366a67d44e7841e106c7f739a8e0656842866125160c87b04c8e0b3189a3e85eb182aa789196f68925b2f8ec71cd6a479800
diff --git a/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch b/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch
new file mode 100644
index 000000000000..c8adeb89b4ab
--- /dev/null
+++ b/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch
@@ -0,0 +1,58 @@
+--- a/Makefile
++++ b/Makefile
+@@ -20,10 +20,11 @@
+ BINMODE = 755
+ CONFDIR = /etc
+ CONFMODE = 644
+-SHARED_LIBDIR = /lib
++LIBDIR = lib
++SHARED_LIBDIR = /$(LIBDIR)
+ SHARED_LIBDIR_SUN = /usr/lib
+ SHARED_LIBDIR_REL = ../..$(SHARED_LIBDIR)
+-DEVEL_LIBDIR = /usr/lib
++DEVEL_LIBDIR = /usr/$(LIBDIR)
+-SECUREDIR = /lib/security
++SECUREDIR = /$(LIBDIR)/security
+ SECUREDIR_SUN = /usr/lib/security
+ SECUREDIR_DARWIN = /usr/lib/pam
+@@ -48,7 +49,7 @@
+ INSTALL_SUN = /usr/ucb/install -c
+ CFLAGS = -Wall -W -O2
+ CFLAGS_lib = $(CFLAGS) -fPIC
+-CFLAGS_bin = $(CFLAGS) -fomit-frame-pointer
++CFLAGS_bin = $(CFLAGS)
+ 
+ LDFLAGS =
+ LDFLAGS_shared = --shared
+@@ -93,7 +94,7 @@
+ 
+ default: all
+ 
+-all pam utils install install_lib install_pam install_utils uninstall remove remove_lib remove_pam remove_utils:
++all lib pam utils install install_lib install_pam install_utils uninstall remove remove_lib remove_pam remove_utils:
+ 	case "`uname -s`" in \
+ 	Linux)	$(MAKE) CFLAGS_lib="$(CFLAGS_lib) -DHAVE_SHADOW" \
+ 			LDFLAGS_lib="$(LDFLAGS_lib_LINUX)" \
+@@ -126,18 +127,20 @@
+ 
+ all_wrapped: pam_wrapped utils_wrapped
+ 
++lib_wrapped: $(SHARED_LIB) $(DEVEL_LIB)
++
+ pam_wrapped: $(SHARED_PAM)
+ 
+ utils_wrapped: $(BINS)
+ 
+ $(SHARED_LIB): $(OBJS_LIB) $(MAP_LIB)
+-	$(LD_lib) $(LDFLAGS_lib) $(OBJS_LIB) $(LDLIBS_lib) -o $(SHARED_LIB)
++	$(LD_lib) $(LDFLAGS) $(LDFLAGS_lib) $(OBJS_LIB) $(LDLIBS_lib) -o $(SHARED_LIB)
+ 
+ $(DEVEL_LIB): $(SHARED_LIB)
+ 	$(LN_s) $(SHARED_LIB) $(DEVEL_LIB)
+ 
+ $(SHARED_PAM): $(OBJS_PAM) $(MAP_PAM) $(DEVEL_LIB)
+-	$(LD_lib) $(LDFLAGS_pam) $(OBJS_PAM) $(LDLIBS_pam) -L. -lpasswdqc -o $(SHARED_PAM)
++	$(LD_lib) $(LDFLAGS) $(LDFLAGS_pam) $(OBJS_PAM) $(LDLIBS_pam) -L. -lpasswdqc -o $(SHARED_PAM)
+ 
+ pwqgen: $(OBJS_GEN) $(DEVEL_LIB)
+ 	$(LD) $(LDFLAGS) $(OBJS_GEN) -L. -lpasswdqc -o $@
diff --git a/sys-auth/passwdqc/metadata.xml b/sys-auth/passwdqc/metadata.xml
new file mode 100644
index 000000000000..5f1467701542
--- /dev/null
+++ b/sys-auth/passwdqc/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+	<email>zlogene@gentoo.org</email>
+	<name>Mikle Kolyada</name>
+</maintainer>
+<use>
+	<flag name="utils">Install pwqcheck and pwqgen helper utilities</flag>
+</use>
+<longdescription>
+	Password strength checking for PAM aware password changing programs.
+</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/passwdqc/passwdqc-1.3.0.ebuild b/sys-auth/passwdqc/passwdqc-1.3.0.ebuild
new file mode 100644
index 000000000000..61f8e548190d
--- /dev/null
+++ b/sys-auth/passwdqc/passwdqc-1.3.0.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit pam eutils toolchain-funcs multilib
+
+DESCRIPTION="Password strength checking library (and PAM module)"
+HOMEPAGE="http://www.openwall.com/passwdqc/"
+SRC_URI="http://www.openwall.com/${PN}/${P}.tar.gz"
+
+LICENSE="Openwall BSD public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
+IUSE="pam utils"
+
+RDEPEND="
+	pam? (
+		sys-libs/pam
+		!<sys-auth/pam_passwdqc-1.3.0
+	)"
+DEPEND="${RDEPEND}"
+
+src_prepare() {
+	epatch "${FILESDIR}"/${PN}-1.3.0-build.patch
+	sed -i \
+		-e 's:`uname -s`:Linux:' \
+		Makefile || die
+	# See if the system has a shadow.h. #554504
+	echo '#include <shadow.h>' > "${T}"/test.c
+	if ! $(tc-getCPP) ${CPPFLAGS} "${T}"/test.c >& /dev/null ; then
+		sed -i -e 's:-DHAVE_SHADOW::' Makefile || die
+	fi
+}
+
+_emake() {
+	emake \
+		LIBDIR="$(get_libdir)" \
+		CFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		LDFLAGS="${LDFLAGS}" \
+		CC="$(tc-getCC)" \
+		LD="$(tc-getCC)" \
+		"$@"
+}
+
+src_compile() {
+	# The use of wrapped targets defeats the Makefile dep tracking.
+	# Build all the targets explicitly after the library.
+	_emake lib
+	if use pam || use utils ; then
+		_emake $(usev pam) $(usev utils)
+	fi
+}
+
+src_install() {
+	_emake \
+		DESTDIR="${ED}" \
+		install_lib $(usex pam install_pam '') $(usex utils install_utils '')
+	dodoc README PLATFORMS INTERNALS
+}
+
+pkg_postinst() {
+	if use pam ; then
+		elog "To activate pam_passwdqc use pam_passwdqc.so instead"
+		elog "of pam_cracklib.so in /etc/pam.d/system-auth."
+		elog "Also, if you want to change the parameters, read up"
+		elog "on the pam_passwdqc(8) man page."
+	fi
+}
diff --git a/sys-auth/passwdqc/passwdqc-1.4.0.ebuild b/sys-auth/passwdqc/passwdqc-1.4.0.ebuild
new file mode 100644
index 000000000000..5460ff583ae4
--- /dev/null
+++ b/sys-auth/passwdqc/passwdqc-1.4.0.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit pam toolchain-funcs
+
+DESCRIPTION="Password strength checking library (and PAM module)"
+HOMEPAGE="http://www.openwall.com/passwdqc/"
+SRC_URI="http://www.openwall.com/${PN}/${P}.tar.gz"
+
+LICENSE="Openwall BSD public-domain"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+
+RDEPEND="sys-libs/pam"
+DEPEND="${RDEPEND}"
+
+pkg_setup() {
+	QA_FLAGS_IGNORED="/$(get_libdir)/security/pam_passwdqc.so
+		 /usr/$(get_libdir)/libpasswdqc.so.0"
+}
+
+src_prepare() {
+	default
+	sed -i -e 's:`uname -s`:Linux:' Makefile || die
+}
+
+_emake() {
+	emake -j1 \
+		SHARED_LIBDIR="/usr/$(get_libdir)" \
+		SECUREDIR="$(getpam_mod_dir)" \
+		CFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		LDFLAGS="${LDFLAGS}" \
+		CC="$(tc-getCC)" \
+		LD="$(tc-getCC)" \
+		"$@"
+}
+
+src_compile() {
+	_emake pam utils
+}
+
+src_install() {
+	_emake DESTDIR="${ED}" install_lib install_pam install_utils
+	dodoc README PLATFORMS INTERNALS
+}
diff --git a/sys-auth/polkit-pkla-compat/Manifest b/sys-auth/polkit-pkla-compat/Manifest
new file mode 100644
index 000000000000..53f898392985
--- /dev/null
+++ b/sys-auth/polkit-pkla-compat/Manifest
@@ -0,0 +1 @@
+DIST polkit-pkla-compat-0.1.tar.xz 291148 BLAKE2B b993a17dc9f16e622f59ed5e716f36857a3196567a426f81fac75f1a0a774c9d6e608d36433e2b39a4d50dbd1699b5b686835fde7cbae6260c5a226c90ebe7b3 SHA512 968cf547db977731a6c6bb292fa86ef46a2ce8f74d008da62f219c20da8cdde94f6309dccba3be33d0111bfa34609799bdeee4d2464395c8837370d022d425c5
diff --git a/sys-auth/polkit-pkla-compat/metadata.xml b/sys-auth/polkit-pkla-compat/metadata.xml
new file mode 100644
index 000000000000..70597be8bdad
--- /dev/null
+++ b/sys-auth/polkit-pkla-compat/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>freedesktop-bugs@gentoo.org</email>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/polkit-pkla-compat/polkit-pkla-compat-0.1.ebuild b/sys-auth/polkit-pkla-compat/polkit-pkla-compat-0.1.ebuild
new file mode 100644
index 000000000000..ff1865e975e8
--- /dev/null
+++ b/sys-auth/polkit-pkla-compat/polkit-pkla-compat-0.1.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+DESCRIPTION="Rules for polkit to add compatibility with pklocalauthority"
+HOMEPAGE="https://pagure.io/polkit-pkla-compat"
+SRC_URI="https://releases.pagure.org/${PN}/${P}.tar.xz"
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~arm ~ppc x86"
+IUSE=""
+
+RDEPEND=">=dev-libs/glib-2.30
+	>=sys-auth/polkit-0.110"
+DEPEND="${RDEPEND}
+	app-text/docbook-xsl-stylesheets
+	dev-libs/libxslt
+	virtual/pkgconfig"
+
+DOCS="AUTHORS NEWS README"
+
+src_install() {
+	default
+	fowners -R root:polkitd /etc/polkit-1/localauthority
+}
+
+pkg_postinst() {
+	chown -R root:polkitd "${EROOT}"/etc/polkit-1/localauthority
+}
diff --git a/sys-auth/polkit-qt/Manifest b/sys-auth/polkit-qt/Manifest
new file mode 100644
index 000000000000..8b9fe5d7c40b
--- /dev/null
+++ b/sys-auth/polkit-qt/Manifest
@@ -0,0 +1 @@
+DIST polkit-qt-1-0.113.0.tar.xz 64652 BLAKE2B 52d8c5c8009e2595c70db5b6a6349e4524d6d9cbec12c5a535f25d737da1d16e77fadf3572eebbede7a5ed583c818e878119b416d69a076e03bb37d2f7da7b41 SHA512 deea5d75f547eaa0279c664ec9608b65f464db97fd5fdea27437f8ed4ec033de2b9f91d967deacb28bf0a1e54f131f997acb862cc3e1f8dfcb1f6c337e719b38
diff --git a/sys-auth/polkit-qt/metadata.xml b/sys-auth/polkit-qt/metadata.xml
new file mode 100644
index 000000000000..9c604ba4a6dc
--- /dev/null
+++ b/sys-auth/polkit-qt/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>kde@gentoo.org</email>
+		<name>Gentoo KDE Project</name>
+	</maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/polkit-qt/polkit-qt-0.113.0.ebuild b/sys-auth/polkit-qt/polkit-qt-0.113.0.ebuild
new file mode 100644
index 000000000000..7e85ce613a86
--- /dev/null
+++ b/sys-auth/polkit-qt/polkit-qt-0.113.0.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+KDE_ORG_NAME="polkit-qt-1"
+inherit cmake kde.org
+
+DESCRIPTION="Qt wrapper around polkit-1 client libraries"
+HOMEPAGE="https://api.kde.org/kdesupport-api/polkit-qt-1-apidocs/"
+
+if [[ ${KDE_BUILD_TYPE} = release ]]; then
+	SRC_URI="mirror://kde/stable/${KDE_ORG_NAME}/${KDE_ORG_NAME}-${PV}.tar.xz"
+	KEYWORDS="amd64 ~arm arm64 ~ppc ~ppc64 x86"
+	S="${WORKDIR}/${KDE_ORG_NAME}-${PV}"
+fi
+
+LICENSE="LGPL-2"
+SLOT="0"
+IUSE="debug"
+
+RDEPEND="
+	dev-libs/glib:2
+	dev-qt/qtcore:5
+	dev-qt/qtdbus:5
+	dev-qt/qtgui:5
+	dev-qt/qtwidgets:5
+	>=sys-auth/polkit-0.103
+"
+DEPEND="${RDEPEND}"
+
+DOCS=( AUTHORS README README.porting TODO )
+
+src_configure() {
+	local mycmakeargs=(
+		-DBUILD_EXAMPLES=OFF
+	)
+
+	cmake_src_configure
+}
diff --git a/sys-auth/polkit/Manifest b/sys-auth/polkit/Manifest
new file mode 100644
index 000000000000..50ce9f1294ab
--- /dev/null
+++ b/sys-auth/polkit/Manifest
@@ -0,0 +1,10 @@
+AUX CVE-2018-19788.patch 12204 BLAKE2B d139c3e9e9814af9bbc3d605e4d25e354c860359b095d12a0269f6d44d83471cf08d96190ae8dbea173bf298512670bd36168fa1aad20592de9f27cb6dca7581 SHA512 b9be88d53521626914ba9c65c00d145b6e377835452defb1951f6fb40502e09325fe217de20469ac64d838b19f0a2c24a2e22d816e83c38c20dc3dab90ea86f1
+AUX polkit-0.115-elogind.patch 1069 BLAKE2B 6c5a3d7d3e716a994b951181808f64d864e6ca58b3a018a5354022f08c6e7c1d8987366c9777f47cc970916ad9fe39f288a1b1643113fc99745f333e02dab56f SHA512 06432fa56788699762c6978484640554f91728a1cb40679eb47b8514b3c7aa23aac5b9c26586eb4d7043a0af1b319bbe7f869d24844d9151317299b74a8e8f7f
+AUX polkit-0.115-spidermonkey-60.patch 5562 BLAKE2B 8f262d682ea413f83bc555bacbeb4306cdee156cc1ee1a98ab76de20f1aeaef405e772536190eaf3a842ef365514f7b68760200e9ddb9342498b01f40f0f9662 SHA512 41d6a9e63dfbd788267b7de231161d57988b4bf90fd52fb49ac7c139a4621476e76b891ae510786611a0c3cf9914a62aa105e2a1a202d29c47a2091fe6e7e9b9
+DIST polkit-0.115-duktape.patch.gz 10461 BLAKE2B e2d20b003fe1d277b032c335f7b09734310d8b565b9198869a9c850cd9d53947a7e50f7d77d63f2d4b7de5a361c3c5a5122e79a143a83e28624b59a4586cff3e SHA512 f7cdde467fa5b4c81b8b0d997e601cd5292f6c08dd6d13ca52b32563dee16c1d20bd8adb1ae7b47f2a65de1b3cb09a20783aacbc19ffa75448feae8afe840f5d
+DIST polkit-0.115.tar.gz 1550932 BLAKE2B 3185ebed46209f88a9ffccbbcaf1bf180d1ae6d5ec53cf3c66d867ad43910b47a1123a3db190991ebb382a0d28fc5a119ea4bab942db324e9af5663056cf6ee1 SHA512 1153011fa93145b2c184e6b3446d3ca21b38918641aeccd8fac3985ac3e30ec6bc75be6973985fde90f2a24236592f1595be259155061c2d33358dd17c4ee4fc
+DIST polkit-0.116-duktape.patch.gz 10461 BLAKE2B d8606103c2a7d4c11da3cf0a8d0e278abf3a2b5a2d8ac910b4d6db46fdfd9c97643dbfeaedb37367cacda6bddfa6e5a54faabb5dba979eb96edd699623f78198 SHA512 3f5b889f0f661d12e45b121b91691ac60eba7911019128d60b65a973bf1344c20cbc71e651c80ef14cd5e49d5438102cd1ce67ddc6ab2f96f3bc32395db40bda
+DIST polkit-0.116.tar.gz 1548311 BLAKE2B e9761a2934136d453a47b81dd1f132f9fc96c45b731d5fceb2aa7706f5325b6499f6acbb68032befc1b21878b1b54754685607c916ca8e02a8accca3ca014b31 SHA512 b66b01cc2bb4349de70147f41f161f0f6f41e7230b581dfb054058b48969ec57041ab05b51787c749ccfc36aa5f317952d7e7ba337b4f6f6c0a923ed5866c2d5
+EBUILD polkit-0.115-r4.ebuild 4045 BLAKE2B e8c5d0b27fdcc14168c9789e9a37f271d8571fdd54ac8f080fbbacaa6ebde4718b8633c562fec4fc47dd2cba1f9ef9a6fa4c93a5149a6858f38bfbc499a54005 SHA512 00b3cce0afcc02b0ab00d65bf538620348abbdd64eb1496db69e1e5509439645bb553ce4d293e2c5159adc0e83690acd0587ec368bdfd3806b70763c860d295d
+EBUILD polkit-0.116-r1.ebuild 3763 BLAKE2B 1b9f672778ec1378a7805cb45f7d6d4f2f06091216e95359e4fcf714355d0889201cc940c2d5125dcc57f508123238bcc1ebb5f64f3a21523d9302d5188ba65e SHA512 a43b94806a5146f8d25a23c421047fb9504e11314e61ad6a202b02451be782879395f4154f6c632f7f5a5d0eb1166c6a65cd58b507947d225d72029aad4ae543
+MISC metadata.xml 498 BLAKE2B 8bbfe2ee11b53b77dc26215776a87acd7cade59a5a139ada605f2ad293c569005d2bd517aaee1c6f4ea45251a0cc67f10082c96c2224d47fd84b5e1d87dcb724 SHA512 16ab1ff82daad858eb9adf7396b0e3d5845914eb7d7f1590cdea44fe1a2214043f011cd65cdde2e2195b959bae6581845bc6b4981fd400b3d8719f400f85b6dc
diff --git a/sys-auth/polkit/files/CVE-2018-19788.patch b/sys-auth/polkit/files/CVE-2018-19788.patch
new file mode 100644
index 000000000000..97e3608a12ba
--- /dev/null
+++ b/sys-auth/polkit/files/CVE-2018-19788.patch
@@ -0,0 +1,339 @@
+From 2cb40c4d5feeaa09325522bd7d97910f1b59e379 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Mon, 3 Dec 2018 10:28:58 +0100
+Subject: [PATCH 1/2] Allow negative uids/gids in PolkitUnixUser and Group
+ objects
+
+(uid_t) -1 is still used as placeholder to mean "unset". This is OK, since
+there should be no users with such number, see
+https://systemd.io/UIDS-GIDS#special-linux-uids.
+
+(uid_t) -1 is used as the default value in class initialization.
+
+When a user or group above INT32_MAX is created, the numeric uid or
+gid wraps around to negative when the value is assigned to gint, and
+polkit gets confused. Let's accept such gids, except for -1.
+
+A nicer fix would be to change the underlying type to e.g. uint32 to
+not have negative values. But this cannot be done without breaking the
+API, so likely new functions will have to be added (a
+polkit_unix_user_new variant that takes a unsigned, and the same for
+_group_new, _set_uid, _get_uid, _set_gid, _get_gid, etc.). This will
+require a bigger patch.
+
+Fixes https://gitlab.freedesktop.org/polkit/polkit/issues/74.
+---
+ src/polkit/polkitunixgroup.c   | 15 +++++++++++----
+ src/polkit/polkitunixprocess.c | 12 ++++++++----
+ src/polkit/polkitunixuser.c    | 13 ++++++++++---
+ 3 files changed, 29 insertions(+), 11 deletions(-)
+
+diff --git a/src/polkit/polkitunixgroup.c b/src/polkit/polkitunixgroup.c
+index c57a1aa..309f689 100644
+--- a/src/polkit/polkitunixgroup.c
++++ b/src/polkit/polkitunixgroup.c
+@@ -71,6 +71,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixGroup, polkit_unix_group, G_TYPE_OBJECT,
+ static void
+ polkit_unix_group_init (PolkitUnixGroup *unix_group)
+ {
++  unix_group->gid = -1; /* (git_t) -1 is not a valid GID under Linux */
+ }
+ 
+ static void
+@@ -100,11 +101,14 @@ polkit_unix_group_set_property (GObject      *object,
+                                GParamSpec   *pspec)
+ {
+   PolkitUnixGroup *unix_group = POLKIT_UNIX_GROUP (object);
++  gint val;
+ 
+   switch (prop_id)
+     {
+     case PROP_GID:
+-      unix_group->gid = g_value_get_int (value);
++      val = g_value_get_int (value);
++      g_return_if_fail (val != -1);
++      unix_group->gid = val;
+       break;
+ 
+     default:
+@@ -131,9 +135,9 @@ polkit_unix_group_class_init (PolkitUnixGroupClass *klass)
+                                    g_param_spec_int ("gid",
+                                                      "Group ID",
+                                                      "The UNIX group ID",
+-                                                     0,
++                                                     G_MININT,
+                                                      G_MAXINT,
+-                                                     0,
++                                                     -1,
+                                                      G_PARAM_CONSTRUCT |
+                                                      G_PARAM_READWRITE |
+                                                      G_PARAM_STATIC_NAME |
+@@ -166,9 +170,10 @@ polkit_unix_group_get_gid (PolkitUnixGroup *group)
+  */
+ void
+ polkit_unix_group_set_gid (PolkitUnixGroup *group,
+-                          gint gid)
++                           gint gid)
+ {
+   g_return_if_fail (POLKIT_IS_UNIX_GROUP (group));
++  g_return_if_fail (gid != -1);
+   group->gid = gid;
+ }
+ 
+@@ -183,6 +188,8 @@ polkit_unix_group_set_gid (PolkitUnixGroup *group,
+ PolkitIdentity *
+ polkit_unix_group_new (gint gid)
+ {
++  g_return_val_if_fail (gid != -1, NULL);
++
+   return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_GROUP,
+                                        "gid", gid,
+                                        NULL));
+diff --git a/src/polkit/polkitunixprocess.c b/src/polkit/polkitunixprocess.c
+index 972b777..b02b258 100644
+--- a/src/polkit/polkitunixprocess.c
++++ b/src/polkit/polkitunixprocess.c
+@@ -159,9 +159,14 @@ polkit_unix_process_set_property (GObject      *object,
+       polkit_unix_process_set_pid (unix_process, g_value_get_int (value));
+       break;
+ 
+-    case PROP_UID:
+-      polkit_unix_process_set_uid (unix_process, g_value_get_int (value));
++    case PROP_UID: {
++      gint val;
++
++      val = g_value_get_int (value);
++      g_return_if_fail (val != -1);
++      polkit_unix_process_set_uid (unix_process, val);
+       break;
++    }
+ 
+     case PROP_START_TIME:
+       polkit_unix_process_set_start_time (unix_process, g_value_get_uint64 (value));
+@@ -239,7 +244,7 @@ polkit_unix_process_class_init (PolkitUnixProcessClass *klass)
+                                    g_param_spec_int ("uid",
+                                                      "User ID",
+                                                      "The UNIX user ID",
+-                                                     -1,
++                                                     G_MININT,
+                                                      G_MAXINT,
+                                                      -1,
+                                                      G_PARAM_CONSTRUCT |
+@@ -303,7 +308,6 @@ polkit_unix_process_set_uid (PolkitUnixProcess *process,
+                              gint               uid)
+ {
+   g_return_if_fail (POLKIT_IS_UNIX_PROCESS (process));
+-  g_return_if_fail (uid >= -1);
+   process->uid = uid;
+ }
+ 
+diff --git a/src/polkit/polkitunixuser.c b/src/polkit/polkitunixuser.c
+index 8bfd3a1..234a697 100644
+--- a/src/polkit/polkitunixuser.c
++++ b/src/polkit/polkitunixuser.c
+@@ -72,6 +72,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixUser, polkit_unix_user, G_TYPE_OBJECT,
+ static void
+ polkit_unix_user_init (PolkitUnixUser *unix_user)
+ {
++  unix_user->uid = -1;  /* (uid_t) -1 is not a valid UID under Linux */
+   unix_user->name = NULL;
+ }
+ 
+@@ -112,11 +113,14 @@ polkit_unix_user_set_property (GObject      *object,
+                                GParamSpec   *pspec)
+ {
+   PolkitUnixUser *unix_user = POLKIT_UNIX_USER (object);
++  gint val;
+ 
+   switch (prop_id)
+     {
+     case PROP_UID:
+-      unix_user->uid = g_value_get_int (value);
++      val = g_value_get_int (value);
++      g_return_if_fail (val != -1);
++      unix_user->uid = val;
+       break;
+ 
+     default:
+@@ -144,9 +148,9 @@ polkit_unix_user_class_init (PolkitUnixUserClass *klass)
+                                    g_param_spec_int ("uid",
+                                                      "User ID",
+                                                      "The UNIX user ID",
+-                                                     0,
++                                                     G_MININT,
+                                                      G_MAXINT,
+-                                                     0,
++                                                     -1,
+                                                      G_PARAM_CONSTRUCT |
+                                                      G_PARAM_READWRITE |
+                                                      G_PARAM_STATIC_NAME |
+@@ -182,6 +186,7 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
+                           gint uid)
+ {
+   g_return_if_fail (POLKIT_IS_UNIX_USER (user));
++  g_return_if_fail (uid != -1);
+   user->uid = uid;
+ }
+ 
+@@ -196,6 +201,8 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
+ PolkitIdentity *
+ polkit_unix_user_new (gint uid)
+ {
++  g_return_val_if_fail (uid != -1, NULL);
++
+   return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_USER,
+                                         "uid", uid,
+                                         NULL));
+-- 
+2.18.1
+
+
+From b534a10727455409acd54018a9c91000e7626126 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Mon, 3 Dec 2018 11:20:34 +0100
+Subject: [PATCH 2/2] tests: add tests for high uids
+
+---
+ test/data/etc/group                           |  1 +
+ test/data/etc/passwd                          |  2 +
+ .../etc/polkit-1/rules.d/10-testing.rules     | 21 ++++++
+ .../test-polkitbackendjsauthority.c           | 72 +++++++++++++++++++
+ 4 files changed, 96 insertions(+)
+
+diff --git a/test/data/etc/group b/test/data/etc/group
+index 12ef328..b9acab9 100644
+--- a/test/data/etc/group
++++ b/test/data/etc/group
+@@ -5,3 +5,4 @@ john:x:500:
+ jane:x:501:
+ sally:x:502:
+ henry:x:503:
++highuid2:x:4000000000:
+diff --git a/test/data/etc/passwd b/test/data/etc/passwd
+index 8544feb..5cf14a5 100644
+--- a/test/data/etc/passwd
++++ b/test/data/etc/passwd
+@@ -3,3 +3,5 @@ john:x:500:500:John Done:/home/john:/bin/bash
+ jane:x:501:501:Jane Smith:/home/jane:/bin/bash
+ sally:x:502:502:Sally Derp:/home/sally:/bin/bash
+ henry:x:503:503:Henry Herp:/home/henry:/bin/bash
++highuid1:x:2147483648:2147483648:The first high uid:/home/highuid1:/sbin/nologin
++highuid2:x:4000000000:4000000000:An example high uid:/home/example:/sbin/nologin
+diff --git a/test/data/etc/polkit-1/rules.d/10-testing.rules b/test/data/etc/polkit-1/rules.d/10-testing.rules
+index 446e622..98bf062 100644
+--- a/test/data/etc/polkit-1/rules.d/10-testing.rules
++++ b/test/data/etc/polkit-1/rules.d/10-testing.rules
+@@ -53,6 +53,27 @@ polkit.addRule(function(action, subject) {
+     }
+ });
+ 
++polkit.addRule(function(action, subject) {
++    if (action.id == "net.company.john_action") {
++        if (subject.user == "john") {
++            return polkit.Result.YES;
++        } else {
++            return polkit.Result.NO;
++        }
++    }
++});
++
++polkit.addRule(function(action, subject) {
++    if (action.id == "net.company.highuid2_action") {
++        if (subject.user == "highuid2") {
++            return polkit.Result.YES;
++        } else {
++            return polkit.Result.NO;
++        }
++    }
++});
++
++
+ // ---------------------------------------------------------------------
+ // variables
+ 
+diff --git a/test/polkitbackend/test-polkitbackendjsauthority.c b/test/polkitbackend/test-polkitbackendjsauthority.c
+index b484a26..71aad23 100644
+--- a/test/polkitbackend/test-polkitbackendjsauthority.c
++++ b/test/polkitbackend/test-polkitbackendjsauthority.c
+@@ -330,6 +330,78 @@ static const RulesTestCase rules_test_cases[] = {
+     NULL,
+     POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
+   },
++
++  {
++    /* highuid1 is not a member of group 'users', see test/data/etc/group */
++    "group_membership_with_non_member(highuid22)",
++    "net.company.group.only_group_users",
++    "unix-user:highuid2",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
++
++  {
++    /* highuid2 is not a member of group 'users', see test/data/etc/group */
++    "group_membership_with_non_member(highuid21)",
++    "net.company.group.only_group_users",
++    "unix-user:highuid2",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
++
++  {
++    /* highuid1 is not a member of group 'users', see test/data/etc/group */
++    "group_membership_with_non_member(highuid24)",
++    "net.company.group.only_group_users",
++    "unix-user:2147483648",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
++
++  {
++    /* highuid2 is not a member of group 'users', see test/data/etc/group */
++    "group_membership_with_non_member(highuid23)",
++    "net.company.group.only_group_users",
++    "unix-user:4000000000",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
++
++  {
++    /* john is authorized to do this, see 10-testing.rules */
++    "john_action",
++    "net.company.john_action",
++    "unix-user:john",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
++  },
++
++  {
++    /* only john is authorized to do this, see 10-testing.rules */
++    "jane_action",
++    "net.company.john_action",
++    "unix-user:jane",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
++
++  {
++    /* highuid2 is authorized to do this, see 10-testing.rules */
++    "highuid2_action",
++    "net.company.highuid2_action",
++    "unix-user:highuid2",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
++  },
++
++  {
++    /* only highuid2 is authorized to do this, see 10-testing.rules */
++    "highuid1_action",
++    "net.company.highuid2_action",
++    "unix-user:highuid1",
++    NULL,
++    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
++  },
+ };
+ 
+ /* ---------------------------------------------------------------------------------------------------- */
+-- 
+2.18.1
+
diff --git a/sys-auth/polkit/files/polkit-0.115-elogind.patch b/sys-auth/polkit/files/polkit-0.115-elogind.patch
new file mode 100644
index 000000000000..93d672015db4
--- /dev/null
+++ b/sys-auth/polkit/files/polkit-0.115-elogind.patch
@@ -0,0 +1,28 @@
+From 08bb656496cd3d6213bbe9473f63f2d4a110da6e Mon Sep 17 00:00:00 2001
+From: Rasmus Thomsen <cogitri@exherbo.org>
+Date: Wed, 11 Apr 2018 13:14:14 +0200
+Subject: [PATCH] configure: fix elogind support
+
+HAVE_LIBSYSTEMD is used to determine which source files to use.
+We have to check if either have_libsystemd or have_libelogind is
+true, as both of these need the source files which are used when
+HAVE_LIBSYSTEMD is true.
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 36df239..da47ecb 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -221,7 +221,7 @@ AS_IF([test "x$cross_compiling" != "xyes" ], [
+ 
+ AC_SUBST(LIBSYSTEMD_CFLAGS)
+ AC_SUBST(LIBSYSTEMD_LIBS)
+-AM_CONDITIONAL(HAVE_LIBSYSTEMD, [test "$have_libsystemd" = "yes"], [Using libsystemd])
++AM_CONDITIONAL(HAVE_LIBSYSTEMD, [test "$have_libsystemd" = "yes" || test "$have_libelogind" = "yes" ], [Using libsystemd])
+ 
+ dnl ---------------------------------------------------------------------------
+ dnl - systemd unit / service files
+-- 
+2.17.0
diff --git a/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch b/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch
new file mode 100644
index 000000000000..8a4510ad2051
--- /dev/null
+++ b/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch
@@ -0,0 +1,180 @@
+From c9cd7024140b837b5693d7c1bbaad1b0cd31cce6 Mon Sep 17 00:00:00 2001
+From: Emmanuele Bassi <ebassi@gnome.org>
+Date: Fri, 31 Aug 2018 13:32:16 +0100
+Subject: [PATCH] Depend on mozjs-60
+
+This is the new ESR version of the Mozilla JS engine, superceding
+mozjs-52.
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 5c37e48..5cedb4e 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -79,7 +79,7 @@ PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 >= 2.30.0])
+ AC_SUBST(GLIB_CFLAGS)
+ AC_SUBST(GLIB_LIBS)
+ 
+-PKG_CHECK_MODULES(LIBJS, [mozjs-52])
++PKG_CHECK_MODULES(LIBJS, [mozjs-60])
+ 
+ AC_SUBST(LIBJS_CFLAGS)
+ AC_SUBST(LIBJS_CXXFLAGS)
+
+
+From dd00683e8781d230a45781d509d86ad676138564 Mon Sep 17 00:00:00 2001
+From: Emmanuele Bassi <ebassi@gnome.org>
+Date: Fri, 31 Aug 2018 13:33:20 +0100
+Subject: [PATCH] Port the JS authority to mozjs-60
+
+API changes in mozjs that need to be reflected in the JS authority:
+
+ - the JS::CompileOptions constructor and the JS::CompartmentOptions
+   do not allow setting a JS version any more
+
+ - do not use NULL comparisons for C++ objects
+
+ - the resize() method for a vector has a return value that needs
+   to be handled
+
+ - JSClassOps has different fields
+---
+ .../polkitbackendjsauthority.cpp              | 65 +++++++++----------
+ 1 file changed, 32 insertions(+), 33 deletions(-)
+
+diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
+index 7602714..984a0f0 100644
+--- a/src/polkitbackend/polkitbackendjsauthority.cpp
++++ b/src/polkitbackend/polkitbackendjsauthority.cpp
+@@ -150,18 +150,17 @@ G_DEFINE_TYPE (PolkitBackendJsAuthority, polkit_backend_js_authority, POLKIT_BAC
+ /* ---------------------------------------------------------------------------------------------------- */
+ 
+ static const struct JSClassOps js_global_class_ops = {
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL
++  nullptr,  // addProperty
++  nullptr,  // deleteProperty
++  nullptr,  // enumerate
++  nullptr,  // newEnumerate
++  nullptr,  // resolve
++  nullptr,  // mayResolve
++  nullptr,  // finalize
++  nullptr,  // call
++  nullptr,  // hasInstance
++  nullptr,  // construct
++  JS_GlobalObjectTraceHook
+ };
+ 
+ static JSClass js_global_class = {
+@@ -172,18 +171,17 @@ static JSClass js_global_class = {
+ 
+ /* ---------------------------------------------------------------------------------------------------- */
+ static const struct JSClassOps js_polkit_class_ops = {
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL,
+-  NULL
++  nullptr,  // addProperty
++  nullptr,  // deleteProperty
++  nullptr,  // enumerate
++  nullptr,  // newEnumerate
++  nullptr,  // resolve
++  nullptr,  // mayResolve
++  nullptr,  // finalize
++  nullptr,  // call
++  nullptr,  // hasInstance
++  nullptr,  // construct
++  nullptr   // trace
+ };
+ 
+ static JSClass js_polkit_class = {
+@@ -469,19 +467,18 @@ polkit_backend_js_authority_constructed (GObject *object)
+ 
+   {
+     JS::CompartmentOptions compart_opts;
+-    compart_opts.behaviors().setVersion(JSVERSION_LATEST);
++
+     JS::RootedObject global(authority->priv->cx);
+ 
+     authority->priv->js_global = new JS::Heap<JSObject*> (JS_NewGlobalObject (authority->priv->cx, &js_global_class, NULL, JS::FireOnNewGlobalHook, compart_opts));
+ 
+     global = authority->priv->js_global->get ();
+-
+-    if (global == NULL)
++    if (!global)
+       goto fail;
+ 
+     authority->priv->ac = new JSAutoCompartment(authority->priv->cx,  global);
+ 
+-    if (authority->priv->ac == NULL)
++    if (!authority->priv->ac)
+       goto fail;
+ 
+     if (!JS_InitStandardClasses (authority->priv->cx, global))
+@@ -493,7 +490,7 @@ polkit_backend_js_authority_constructed (GObject *object)
+ 
+     polkit = authority->priv->js_polkit->get ();
+ 
+-    if (polkit == NULL)
++    if (!polkit)
+       goto fail;
+ 
+     if (!JS_DefineProperty(authority->priv->cx, global, "polkit", polkit, JSPROP_ENUMERATE))
+@@ -504,7 +501,7 @@ polkit_backend_js_authority_constructed (GObject *object)
+                              js_polkit_functions))
+       goto fail;
+ 
+-    JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
++    JS::CompileOptions options(authority->priv->cx);
+     JS::RootedValue rval(authority->priv->cx);
+     if (!JS::Evaluate (authority->priv->cx,
+                        options,
+@@ -684,7 +681,9 @@ set_property_strv (PolkitBackendJsAuthority  *authority,
+   JS::AutoValueVector elems(authority->priv->cx);
+   guint n;
+ 
+-  elems.resize(value->len);
++  if (!elems.resize(value->len))
++    g_error ("Unable to resize vector");
++
+   for (n = 0; n < value->len; n++)
+     {
+       const char *c_string = (const char *) g_ptr_array_index(value, n);
+@@ -741,7 +740,7 @@ subject_to_jsval (PolkitBackendJsAuthority  *authority,
+                   GError                   **error)
+ {
+   gboolean ret = FALSE;
+-  JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
++  JS::CompileOptions options(authority->priv->cx);
+   const char *src;
+   JS::RootedObject obj(authority->priv->cx);
+   pid_t pid;
+@@ -868,7 +867,7 @@ action_and_details_to_jsval (PolkitBackendJsAuthority  *authority,
+                              GError                   **error)
+ {
+   gboolean ret = FALSE;
+-  JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
++  JS::CompileOptions options(authority->priv->cx);
+   const char *src;
+   JS::RootedObject obj(authority->priv->cx);
+   gchar **keys;
diff --git a/sys-auth/polkit/metadata.xml b/sys-auth/polkit/metadata.xml
new file mode 100644
index 000000000000..b409e973d8f1
--- /dev/null
+++ b/sys-auth/polkit/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>freedesktop-bugs@gentoo.org</email>
+	</maintainer>
+	<use>
+		<flag name="consolekit">Use <pkg>sys-auth/consolekit</pkg> for session tracking</flag>
+		<flag name="elogind">Use <pkg>sys-auth/elogind</pkg> for session tracking</flag>
+		<flag name="systemd">Use <pkg>sys-apps/systemd</pkg> for session tracking</flag>
+	</use>
+	<origin>xor-overlay</origin>
+</pkgmetadata>
diff --git a/sys-auth/polkit/polkit-0.115-r4.ebuild b/sys-auth/polkit/polkit-0.115-r4.ebuild
new file mode 100644
index 000000000000..2cc2fb177881
--- /dev/null
+++ b/sys-auth/polkit/polkit-0.115-r4.ebuild
@@ -0,0 +1,162 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools pam pax-utils systemd user xdg-utils
+
+DESCRIPTION="Policy framework for controlling privileges for system-wide services"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://gitlab.freedesktop.org/polkit/polkit"
+SRC_URI="
+	https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz
+	https://github.com/ferion11/danrepo/releases/download/polkit_patchs/polkit-0.115-duktape.patch.gz
+"
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 s390 sparc x86"
+IUSE="consolekit duktape elogind examples gtk +introspection jit kde nls pam selinux systemd test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="^^ ( consolekit elogind systemd )"
+
+BDEPEND="
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	dev-libs/gobject-introspection-common
+	dev-libs/libxslt
+	dev-util/glib-utils
+	dev-util/gtk-doc-am
+	dev-util/intltool
+	sys-devel/gettext
+	virtual/pkgconfig
+	introspection? ( dev-libs/gobject-introspection )
+"
+DEPEND="
+	!duktape? ( dev-lang/spidermonkey:60[-debug] )
+	duktape? ( dev-lang/duktape )
+	dev-libs/glib:2
+	dev-libs/expat
+	elogind? ( sys-auth/elogind )
+	pam? (
+		sys-auth/pambase
+		sys-libs/pam
+	)
+	systemd? ( sys-apps/systemd:0=[policykit] )
+"
+RDEPEND="${DEPEND}
+	selinux? ( sec-policy/selinux-policykit )
+"
+PDEPEND="
+	consolekit? ( sys-auth/consolekit[policykit] )
+	gtk? ( || (
+		>=gnome-extra/polkit-gnome-0.105
+		>=lxde-base/lxsession-0.5.2
+	) )
+	kde? ( kde-plasma/polkit-kde-agent )
+"
+
+DOCS=( docs/TODO HACKING NEWS README )
+
+PATCHES=(
+	# bug 660880
+	"${FILESDIR}"/polkit-0.115-elogind.patch
+	"${FILESDIR}"/CVE-2018-19788.patch
+)
+
+QA_MULTILIB_PATHS="
+	usr/lib/polkit-1/polkit-agent-helper-1
+	usr/lib/polkit-1/polkitd"
+
+pkg_setup() {
+	local u=polkitd
+	local g=polkitd
+	local h=/var/lib/polkit-1
+
+	enewgroup ${g}
+	enewuser ${u} -1 -1 ${h} ${g}
+	esethome ${u} ${h}
+}
+
+src_prepare() {
+	if use duktape ; then
+		PATCHES+=(
+			#from https://gitlab.freedesktop.org/polkit/polkit/merge_requests/35
+			"${WORKDIR}"/polkit-0.115-duktape.patch
+		)
+	else
+		PATCHES+=(
+			"${FILESDIR}"/polkit-0.115-spidermonkey-60.patch
+		)
+	fi
+	default
+
+	sed -i -e 's|unix-group:wheel|unix-user:0|' src/polkitbackend/*-default.rules || die #401513
+
+	# Workaround upstream hack around standard gtk-doc behavior, bug #552170
+	sed -i -e 's/@ENABLE_GTK_DOC_TRUE@\(TARGET_DIR\)/\1/' \
+		-e '/install-data-local:/,/uninstall-local:/ s/@ENABLE_GTK_DOC_TRUE@//' \
+		-e 's/@ENABLE_GTK_DOC_FALSE@install-data-local://' \
+		docs/polkit/Makefile.in || die
+
+	# disable broken test - bug #624022
+	sed -i -e "/^SUBDIRS/s/polkitbackend//" test/Makefile.am || die
+
+	# Fix cross-building, bug #590764, elogind patch, bug #598615
+	eautoreconf
+}
+
+src_configure() {
+	xdg_environment_reset
+
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}"/var
+		--disable-static
+		--enable-man-pages
+		--disable-gtk-doc
+		--disable-examples
+		$(use_enable elogind libelogind)
+		$(use_enable introspection)
+		$(use_enable nls)
+		$(usex pam "--with-pam-module-dir=$(getpam_mod_dir)" '')
+		--with-authfw=$(usex pam pam shadow)
+		$(use_enable systemd libsystemd-login)
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+		$(use_enable test)
+		--with-os-type=gentoo
+	)
+	if use duktape ; then
+		myeconfargs+=(
+			--with-duktape
+		)
+	fi
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
+	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
+}
+
+src_install() {
+	default
+
+	fowners -R polkitd:root /{etc,usr/share}/polkit-1/rules.d
+
+	diropts -m0700 -o polkitd -g polkitd
+	keepdir /var/lib/polkit-1
+
+	if use examples; then
+		insinto /usr/share/doc/${PF}/examples
+		doins src/examples/{*.c,*.policy*}
+	fi
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	chown -R polkitd:root "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+	chown -R polkitd:polkitd "${EROOT}"/var/lib/polkit-1
+}
diff --git a/sys-auth/polkit/polkit-0.116-r1.ebuild b/sys-auth/polkit/polkit-0.116-r1.ebuild
new file mode 100644
index 000000000000..d80b98968a44
--- /dev/null
+++ b/sys-auth/polkit/polkit-0.116-r1.ebuild
@@ -0,0 +1,147 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools pam pax-utils systemd xdg-utils
+
+DESCRIPTION="Policy framework for controlling privileges for system-wide services"
+HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://gitlab.freedesktop.org/polkit/polkit"
+SRC_URI="
+	https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz
+	https://github.com/ferion11/danrepo/releases/download/polkit_patchs/polkit-0.116-duktape.patch.gz
+"
+
+LICENSE="LGPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+IUSE="consolekit duktape elogind examples gtk +introspection jit kde nls pam selinux systemd test"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="^^ ( consolekit elogind systemd )"
+
+BDEPEND="
+	acct-user/polkitd
+	app-text/docbook-xml-dtd:4.1.2
+	app-text/docbook-xsl-stylesheets
+	dev-libs/gobject-introspection-common
+	dev-libs/libxslt
+	dev-util/glib-utils
+	dev-util/gtk-doc-am
+	dev-util/intltool
+	sys-devel/gettext
+	virtual/pkgconfig
+	introspection? ( dev-libs/gobject-introspection )
+"
+DEPEND="
+	!duktape? ( dev-lang/spidermonkey:60[-debug] )
+	duktape? ( dev-lang/duktape )
+	dev-libs/glib:2
+	dev-libs/expat
+	elogind? ( sys-auth/elogind )
+	pam? (
+		sys-auth/pambase
+		sys-libs/pam
+	)
+	systemd? ( sys-apps/systemd:0=[policykit] )
+"
+RDEPEND="${DEPEND}
+	acct-user/polkitd
+	selinux? ( sec-policy/selinux-policykit )
+"
+PDEPEND="
+	consolekit? ( sys-auth/consolekit[policykit] )
+	gtk? ( || (
+		>=gnome-extra/polkit-gnome-0.105
+		>=lxde-base/lxsession-0.5.2
+	) )
+	kde? ( kde-plasma/polkit-kde-agent )
+"
+
+DOCS=( docs/TODO HACKING NEWS README )
+
+PATCHES=(
+	# bug 660880
+	"${FILESDIR}"/polkit-0.115-elogind.patch
+)
+
+QA_MULTILIB_PATHS="
+	usr/lib/polkit-1/polkit-agent-helper-1
+	usr/lib/polkit-1/polkitd"
+
+src_prepare() {
+	if use duktape ; then
+		PATCHES+=(
+			#from https://gitlab.freedesktop.org/polkit/polkit/merge_requests/35
+			"${WORKDIR}"/polkit-0.116-duktape.patch
+		)
+	fi
+	default
+
+	sed -i -e 's|unix-group:wheel|unix-user:0|' src/polkitbackend/*-default.rules || die #401513
+
+	# Workaround upstream hack around standard gtk-doc behavior, bug #552170
+	sed -i -e 's/@ENABLE_GTK_DOC_TRUE@\(TARGET_DIR\)/\1/' \
+		-e '/install-data-local:/,/uninstall-local:/ s/@ENABLE_GTK_DOC_TRUE@//' \
+		-e 's/@ENABLE_GTK_DOC_FALSE@install-data-local://' \
+		docs/polkit/Makefile.in || die
+
+	# disable broken test - bug #624022
+	sed -i -e "/^SUBDIRS/s/polkitbackend//" test/Makefile.am || die
+
+	# Fix cross-building, bug #590764, elogind patch, bug #598615
+	eautoreconf
+}
+
+src_configure() {
+	xdg_environment_reset
+
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}"/var
+		--disable-static
+		--enable-man-pages
+		--disable-gtk-doc
+		--disable-examples
+		$(use_enable elogind libelogind)
+		$(use_enable introspection)
+		$(use_enable nls)
+		$(usex pam "--with-pam-module-dir=$(getpam_mod_dir)" '')
+		--with-authfw=$(usex pam pam shadow)
+		$(use_enable systemd libsystemd-login)
+		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
+		$(use_enable test)
+		--with-os-type=gentoo
+	)
+	if use duktape ; then
+		myeconfargs+=(
+			--with-duktape
+		)
+	fi
+	econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+	default
+
+	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
+	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
+}
+
+src_install() {
+	default
+
+	if use examples; then
+		insinto /usr/share/doc/${PF}/examples
+		doins src/examples/{*.c,*.policy*}
+	fi
+
+	diropts -m 0700 -o polkitd
+	keepdir /usr/share/polkit-1/rules.d
+
+	find "${ED}" -name '*.la' -delete || die
+}
+
+pkg_postinst() {
+	chmod 0700 "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+	chown polkitd "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
+}
diff --git a/sys-auth/realtime-base/metadata.xml b/sys-auth/realtime-base/metadata.xml
new file mode 100644
index 000000000000..dc9dc8af83ad
--- /dev/null
+++ b/sys-auth/realtime-base/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="project">
+    <email>proaudio@gentoo.org</email>
+    <name>Gentoo ProAudio Project</name>
+  </maintainer>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/realtime-base/realtime-base-0.1.ebuild b/sys-auth/realtime-base/realtime-base-0.1.ebuild
new file mode 100644
index 000000000000..170da001fd52
--- /dev/null
+++ b/sys-auth/realtime-base/realtime-base-0.1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user
+
+DESCRIPTION="Sets up realtime scheduling"
+HOMEPAGE="https://jackaudio.org/faq/linux_rt_config.html"
+SRC_URI=""
+
+LICENSE="public-domain"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ppc ppc64 s390 sparc x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="sys-libs/pam"
+
+S=${WORKDIR}
+
+limitsdfile=40-${PN}.conf
+rtgroup=realtime
+
+pkg_setup() {
+	enewgroup ${rtgroup}
+}
+
+src_compile() {
+	einfo "Generating ${limitsdfile}"
+	cat > ${limitsdfile} <<- EOF || die
+		# Start of ${limitsdfile} from ${P}
+
+		@${rtgroup}	-	rtprio	99
+		@${rtgroup}	-	memlock	unlimited
+
+		# End of ${limitsdfile} from ${P}
+	EOF
+}
+
+src_install() {
+	insinto /etc/security/limits.d/
+	doins ${limitsdfile}
+}
+
+pkg_postinst() {
+	elog "We have added realtime scheduling privileges for users in the ${rtgroup} group."
+	elog "Please make sure users needing such privileges are in that group."
+}
diff --git a/sys-auth/rtkit/Manifest b/sys-auth/rtkit/Manifest
new file mode 100644
index 000000000000..83ba86e04a2b
--- /dev/null
+++ b/sys-auth/rtkit/Manifest
@@ -0,0 +1,2 @@
+DIST rtkit-0.12.tar.xz 127504 BLAKE2B c2132098b98f24c1f1662df08c9940772cdad9a326c0c4b9180aac2e0878b0c71e5917ab2535628aab12ff29546faef1c68f455625c77bc2bac25864dddfa4b6 SHA512 cee48058367b5b8a705203865538d0ab4bda9d2f1d06d155360922cb095b5d6a5b0311fdda6c45d9f33227324394ca5fd3b5a399fc71e11ea4c609eab18a7b04
+DIST rtkit-0.13.tar.xz 130796 BLAKE2B 842d04556a47c199bed9fc6bc9281c0d88f83e183f01ef57ecbd80ce72949a301d6682a3aab96e996e71b82d8e8c7a85e1d44524f2ed6fbdffc6bf236cdcadaa SHA512 c058d770a4ccfdf4e2e3a713748b6a705b6d3e148a903b9dbba4bba9d3ded2b819d7dfbfa37b9fad78e57c0a5f10f2f94226f8738f666e692a085ab297a36b36
diff --git a/sys-auth/rtkit/files/rtkit-0.12_introspection_no_asm.patch b/sys-auth/rtkit/files/rtkit-0.12_introspection_no_asm.patch
new file mode 100644
index 000000000000..5f634da85208
--- /dev/null
+++ b/sys-auth/rtkit/files/rtkit-0.12_introspection_no_asm.patch
@@ -0,0 +1,245 @@
+Backport of the upstream commit 7f24c26b6e6b5be0f50b42f86bbc7c43630687c9
+to 0.12 + include pre-generated C file for this release.
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -51,7 +51,6 @@
+ AC_PROG_GCC_TRADITIONAL
+ AC_USE_SYSTEM_EXTENSIONS
+ AC_SYS_LARGEFILE
+-AM_PROG_AS
+ 
+ # GCC flags
+ 
+@@ -125,6 +124,11 @@
+ AC_SUBST([systemdsystemunitdir], [$with_systemdsystemunitdir])
+ AM_CONDITIONAL(HAVE_SYSTEMD, [test -n "$with_systemdsystemunitdir"])
+ 
++AC_PATH_PROG([XXD], [xxd], [xxd])
++if test "$XXD" = xxd; then
++        AC_MSG_WARN([xxd not found, cannot compile introspection XML])
++fi
++
+ ###################################
+ #            Output               #
+ ###################################
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -63,7 +63,7 @@
+ rtkit_daemon_SOURCES = \
+ 	rtkit-daemon.c \
+ 	rtkit.h \
+-	xml-introspection.S
++	xml-introspection.c
+ rtkit_daemon_LDADD = \
+ 	$(DBUS_LIBS) \
+ 	$(LIBSYSTEMD_LIBS)
+@@ -94,7 +94,10 @@
+ rtkit-daemon.service: rtkit-daemon.service.in
+ 	$(AM_V_GEN)sed -e 's,@LIBEXECDIR\@,$(libexecdir),g' < $< > $@
+ 
+-xml-introspection.o: org.freedesktop.RealtimeKit1.xml
++xml-introspection.c: org.freedesktop.RealtimeKit1.xml
++	@echo 'const char introspect_xml[] = {' > $@
++	$(AM_V_GEN)$(XXD) -i < $< >> $@
++	@echo '};' >> $@
+ 
+ man8_MANS = rtkitctl.8
+ 
+--- /dev/null
++++ b/xml-introspection.c
+@@ -0,0 +1,184 @@
++const char introspect_xml[] = {
++  0x3c, 0x21, 0x44, 0x4f, 0x43, 0x54, 0x59, 0x50, 0x45, 0x20, 0x6e, 0x6f,
++  0x64, 0x65, 0x20, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x20, 0x22, 0x2d,
++  0x2f, 0x2f, 0x66, 0x72, 0x65, 0x65, 0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f,
++  0x70, 0x2f, 0x2f, 0x44, 0x54, 0x44, 0x20, 0x44, 0x2d, 0x42, 0x55, 0x53,
++  0x20, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x20, 0x49, 0x6e, 0x74, 0x72,
++  0x6f, 0x73, 0x70, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x31, 0x2e,
++  0x30, 0x2f, 0x2f, 0x45, 0x4e, 0x22, 0x0a, 0x22, 0x68, 0x74, 0x74, 0x70,
++  0x3a, 0x2f, 0x2f, 0x77, 0x77, 0x77, 0x2e, 0x66, 0x72, 0x65, 0x65, 0x64,
++  0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x2e, 0x6f, 0x72, 0x67, 0x2f, 0x73,
++  0x74, 0x61, 0x6e, 0x64, 0x61, 0x72, 0x64, 0x73, 0x2f, 0x64, 0x62, 0x75,
++  0x73, 0x2f, 0x31, 0x2e, 0x30, 0x2f, 0x69, 0x6e, 0x74, 0x72, 0x6f, 0x73,
++  0x70, 0x65, 0x63, 0x74, 0x2e, 0x64, 0x74, 0x64, 0x22, 0x3e, 0x0a, 0x3c,
++  0x6e, 0x6f, 0x64, 0x65, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65,
++  0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x6f, 0x72, 0x67, 0x2e, 0x66,
++  0x72, 0x65, 0x65, 0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x2e, 0x52,
++  0x65, 0x61, 0x6c, 0x74, 0x69, 0x6d, 0x65, 0x4b, 0x69, 0x74, 0x31, 0x22,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f,
++  0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x4d, 0x61, 0x6b, 0x65,
++  0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x52, 0x65, 0x61, 0x6c, 0x74, 0x69,
++  0x6d, 0x65, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61,
++  0x6d, 0x65, 0x3d, 0x22, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x22, 0x20,
++  0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x74, 0x22, 0x20, 0x64, 0x69, 0x72,
++  0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d,
++  0x22, 0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x20, 0x74,
++  0x79, 0x70, 0x65, 0x3d, 0x22, 0x75, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65,
++  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e,
++  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x6d, 0x65, 0x74, 0x68, 0x6f,
++  0x64, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68,
++  0x6f, 0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x4d, 0x61, 0x6b,
++  0x65, 0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x52, 0x65, 0x61, 0x6c, 0x74,
++  0x69, 0x6d, 0x65, 0x57, 0x69, 0x74, 0x68, 0x50, 0x49, 0x44, 0x22, 0x3e,
++  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22,
++  0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x22, 0x20, 0x74, 0x79, 0x70,
++  0x65, 0x3d, 0x22, 0x74, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
++  0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c,
++  0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x74, 0x68,
++  0x72, 0x65, 0x61, 0x64, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22,
++  0x74, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
++  0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67,
++  0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x70, 0x72, 0x69, 0x6f, 0x72,
++  0x69, 0x74, 0x79, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x75,
++  0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d,
++  0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c,
++  0x2f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x3e, 0x0a, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x20, 0x6e, 0x61, 0x6d,
++  0x65, 0x3d, 0x22, 0x4d, 0x61, 0x6b, 0x65, 0x54, 0x68, 0x72, 0x65, 0x61,
++  0x64, 0x48, 0x69, 0x67, 0x68, 0x50, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74,
++  0x79, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d,
++  0x65, 0x3d, 0x22, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x22, 0x20, 0x74,
++  0x79, 0x70, 0x65, 0x3d, 0x22, 0x74, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65,
++  0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e,
++  0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22,
++  0x70, 0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x20, 0x74, 0x79,
++  0x70, 0x65, 0x3d, 0x22, 0x69, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63,
++  0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f,
++  0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x4d, 0x61, 0x6b, 0x65,
++  0x54, 0x68, 0x72, 0x65, 0x61, 0x64, 0x48, 0x69, 0x67, 0x68, 0x50, 0x72,
++  0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x57, 0x69, 0x74, 0x68, 0x50, 0x49,
++  0x44, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d,
++  0x65, 0x3d, 0x22, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x22, 0x20,
++  0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x74, 0x22, 0x20, 0x64, 0x69, 0x72,
++  0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d,
++  0x22, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x22, 0x20, 0x74, 0x79, 0x70,
++  0x65, 0x3d, 0x22, 0x74, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
++  0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c,
++  0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x70, 0x72,
++  0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65,
++  0x3d, 0x22, 0x69, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69,
++  0x6f, 0x6e, 0x3d, 0x22, 0x69, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x2f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x3e, 0x0a,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x20,
++  0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x52, 0x65, 0x73, 0x65, 0x74, 0x4b,
++  0x6e, 0x6f, 0x77, 0x6e, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65,
++  0x3d, 0x22, 0x52, 0x65, 0x73, 0x65, 0x74, 0x41, 0x6c, 0x6c, 0x22, 0x2f,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f,
++  0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x45, 0x78, 0x69, 0x74,
++  0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x70, 0x72, 0x6f,
++  0x70, 0x65, 0x72, 0x74, 0x79, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22,
++  0x52, 0x54, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x53, 0x65, 0x63, 0x4d, 0x61,
++  0x78, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x78, 0x22, 0x20,
++  0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x3d, 0x22, 0x72, 0x65, 0x61, 0x64,
++  0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x70, 0x72, 0x6f,
++  0x70, 0x65, 0x72, 0x74, 0x79, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22,
++  0x4d, 0x61, 0x78, 0x52, 0x65, 0x61, 0x6c, 0x74, 0x69, 0x6d, 0x65, 0x50,
++  0x72, 0x69, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x22, 0x20, 0x74, 0x79, 0x70,
++  0x65, 0x3d, 0x22, 0x69, 0x22, 0x20, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
++  0x3d, 0x22, 0x72, 0x65, 0x61, 0x64, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x70, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x20,
++  0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x4d, 0x69, 0x6e, 0x4e, 0x69, 0x63,
++  0x65, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65,
++  0x3d, 0x22, 0x69, 0x22, 0x20, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x3d,
++  0x22, 0x72, 0x65, 0x61, 0x64, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72,
++  0x66, 0x61, 0x63, 0x65, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65,
++  0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x6f, 0x72, 0x67, 0x2e, 0x66,
++  0x72, 0x65, 0x65, 0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f, 0x70, 0x2e, 0x44,
++  0x42, 0x75, 0x73, 0x2e, 0x50, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x69,
++  0x65, 0x73, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65,
++  0x74, 0x68, 0x6f, 0x64, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x47,
++  0x65, 0x74, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d,
++  0x65, 0x3d, 0x22, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65,
++  0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d,
++  0x22, 0x69, 0x6e, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x73,
++  0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65,
++  0x3d, 0x22, 0x70, 0x72, 0x6f, 0x70, 0x65, 0x72, 0x74, 0x79, 0x22, 0x20,
++  0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x69,
++  0x6e, 0x22, 0x20, 0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x73, 0x22, 0x2f,
++  0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x3c, 0x61, 0x72, 0x67, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22,
++  0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x20, 0x64, 0x69, 0x72, 0x65, 0x63,
++  0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x6f, 0x75, 0x74, 0x22, 0x20, 0x74,
++  0x79, 0x70, 0x65, 0x3d, 0x22, 0x76, 0x22, 0x2f, 0x3e, 0x0a, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x3c, 0x2f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x3e, 0x0a,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x69, 0x6e,
++  0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x3e, 0x0a, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66,
++  0x61, 0x63, 0x65, 0x20, 0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x6f, 0x72,
++  0x67, 0x2e, 0x66, 0x72, 0x65, 0x65, 0x64, 0x65, 0x73, 0x6b, 0x74, 0x6f,
++  0x70, 0x2e, 0x44, 0x42, 0x75, 0x73, 0x2e, 0x49, 0x6e, 0x74, 0x72, 0x6f,
++  0x73, 0x70, 0x65, 0x63, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x22, 0x3e, 0x0a,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x3c, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x20,
++  0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x49, 0x6e, 0x74, 0x72, 0x6f, 0x73,
++  0x70, 0x65, 0x63, 0x74, 0x22, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x61, 0x72, 0x67, 0x20,
++  0x6e, 0x61, 0x6d, 0x65, 0x3d, 0x22, 0x64, 0x61, 0x74, 0x61, 0x22, 0x20,
++  0x74, 0x79, 0x70, 0x65, 0x3d, 0x22, 0x73, 0x22, 0x20, 0x64, 0x69, 0x72,
++  0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3d, 0x22, 0x6f, 0x75, 0x74, 0x22,
++  0x2f, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x3c, 0x2f, 0x6d, 0x65, 0x74,
++  0x68, 0x6f, 0x64, 0x3e, 0x0a, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
++  0x20, 0x3c, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65,
++  0x3e, 0x0a, 0x3c, 0x2f, 0x6e, 0x6f, 0x64, 0x65, 0x3e, 0x0a
++};
+--- a/xml-introspection.S
++++ /dev/null
+@@ -1,7 +0,0 @@
+-.section .rodata
+-.global introspect_xml
+-.type introspect_xml, @object
+-
+-introspect_xml:
+-.incbin "org.freedesktop.RealtimeKit1.xml"
+-.byte 0
diff --git a/sys-auth/rtkit/files/rtkit-0.12_libsystemd_optional.patch b/sys-auth/rtkit/files/rtkit-0.12_libsystemd_optional.patch
new file mode 100644
index 000000000000..9d61f4e5685c
--- /dev/null
+++ b/sys-auth/rtkit/files/rtkit-0.12_libsystemd_optional.patch
@@ -0,0 +1,63 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -116,7 +116,15 @@
+ AC_SEARCH_LIBS([cap_init], [cap])
+ 
+ PKG_CHECK_MODULES(DBUS, dbus-1)
+-PKG_CHECK_MODULES(LIBSYSTEMD, libsystemd)
++
++AC_ARG_ENABLE(systemd-integration,
++	      AS_HELP_STRING([--enable-systemd-integration], [use the sd-daemon API to communicate with systemd]),
++	      [enable_libsystemd=$enableval],
++	      [enable_libsystemd=yes])
++if test "x${enable_libsystemd}" != "xno"; then
++	PKG_CHECK_MODULES(LIBSYSTEMD, libsystemd)
++	AC_DEFINE([HAVE_LIBSYSTEMD], [1], [Define to 1 if you have libsystemd and its header files])
++fi
+ 
+ AC_ARG_WITH([systemdsystemunitdir],
+         AS_HELP_STRING([--with-systemdsystemunitdir=DIR], [Directory for systemd service files]),
+@@ -142,5 +150,6 @@
+     localstatedir:          ${localstatedir}
+     Compiler:               ${CC}
+     CFLAGS:                 ${CFLAGS}
++    systemd integration:    ${enable_libsystemd}
+     systemd unit directory: ${systemdsystemunitdir}
+ "
+--- a/rtkit-daemon.c
++++ b/rtkit-daemon.c
+@@ -50,7 +50,10 @@
+ #include <dirent.h>
+ #include <syslog.h>
+ #include <grp.h>
++
++#ifdef HAVE_LIBSYSTEMD
+ #include <systemd/sd-daemon.h>
++#endif
+ 
+ #include "rtkit.h"
+ 
+@@ -1432,11 +1435,13 @@
+                 n_total_processes,
+                 n_users);
+ 
++#ifdef HAVE_LIBSYSTEMD
+         sd_notifyf(0,
+                    "STATUS=Supervising %u threads of %u processes of %u users.",
+                    n_total_threads,
+                    n_total_processes,
+                    n_users);
++#endif
+ 
+ finish:
+         if (r) {
+@@ -2304,7 +2309,9 @@
+ 
+         syslog(LOG_DEBUG, "Running.\n");
+ 
++#ifdef HAVE_LIBSYSTEMD
+         sd_notify(0, "STATUS=Running.");
++#endif
+ 
+         dbus_connection_set_exit_on_disconnect(bus, FALSE);
+ 
diff --git a/sys-auth/rtkit/files/rtkit-0.13_meson_rtkitctl_dir.patch b/sys-auth/rtkit/files/rtkit-0.13_meson_rtkitctl_dir.patch
new file mode 100644
index 000000000000..6d48004e6dc1
--- /dev/null
+++ b/sys-auth/rtkit/files/rtkit-0.13_meson_rtkitctl_dir.patch
@@ -0,0 +1,25 @@
+From c295fa849f52b487be6433e69e08b46251950399 Mon Sep 17 00:00:00 2001
+From: Felipe Sateler <fsateler@users.noreply.github.com>
+Date: Sun, 5 Apr 2020 12:16:01 -0400
+Subject: [PATCH 1/2] meson: Install rtkitctl to sbin
+
+That is the path previously used in the autotools system
+---
+ meson.build | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/meson.build b/meson.build
+index 50e137c..02e6c73 100644
+--- a/meson.build
++++ b/meson.build
+@@ -115,6 +115,7 @@ executable(
+         'rtkitctl',
+         'rtkitctl.c', 'rtkit.h', config_h,
+         install: true,
++        install_dir: get_option('sbindir'),
+         dependencies: [dbus_dep],
+ )
+ 
+-- 
+2.24.1
+
diff --git a/sys-auth/rtkit/files/rtkit-0.13_meson_xxd_optional.patch b/sys-auth/rtkit/files/rtkit-0.13_meson_xxd_optional.patch
new file mode 100644
index 000000000000..17320543b9ee
--- /dev/null
+++ b/sys-auth/rtkit/files/rtkit-0.13_meson_xxd_optional.patch
@@ -0,0 +1,59 @@
+From ac157ef9c7b90d995436d999f15f41f04bff6052 Mon Sep 17 00:00:00 2001
+From: Marek Szuba <Marek.Szuba@cern.ch>
+Date: Fri, 10 Apr 2020 22:08:00 +0100
+Subject: [PATCH 2/2] Actually let meson use pre-generated introspection file
+
+Unlike autoconf, meson scripts actually aborted if the program 'xxd' was
+absent regardless of whether the pre-generated introspection file was
+found or not. Make xxd optional, and if it is not found print a warning
+and make the dependency object xml_introspection_h point at the relevant
+file in the source directory instead of generating a new one in the build
+directory. If that file does not exist either, abort.
+---
+ meson.build | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 02e6c73..68fa23c 100644
+--- a/meson.build
++++ b/meson.build
+@@ -13,7 +13,7 @@ add_project_arguments(
+ 
+ cc = meson.get_compiler('c')
+ sh = find_program('sh')
+-xxd = find_program('xxd')
++xxd = find_program('xxd', required: false)
+ 
+ dbus_dep = dependency('dbus-1')
+ libcap_dep = dependency('libcap')
+@@ -80,14 +80,19 @@ config_h = configure_file(
+         configuration: config,
+ )
+ 
+-xml_introspection_h = configure_file(
+-        input: 'org.freedesktop.RealtimeKit1.xml',
+-        output: 'xml-introspection.h',
+-        command: [
+-                sh, '-c', '"$1" -i < "$2" > "$3"', sh,
+-                xxd, '@INPUT@', '@OUTPUT@'
+-        ],
+-)
++if xxd.found()
++        xml_introspection_h = configure_file(
++                input: 'org.freedesktop.RealtimeKit1.xml',
++                output: 'xml-introspection.h',
++                command: [
++                        sh, '-c', '"$1" -i < "$2" > "$3"', sh,
++                        xxd, '@INPUT@', '@OUTPUT@'
++                ],
++        )
++else
++        warning('xxd not found, cannot compile introspection XML. Looking for existing one...')
++        xml_introspection_h = files('xml-introspection.h')
++endif
+ 
+ executable(
+         'rtkit-daemon',
+-- 
+2.24.1
+
diff --git a/sys-auth/rtkit/metadata.xml b/sys-auth/rtkit/metadata.xml
new file mode 100644
index 000000000000..c58253b91b96
--- /dev/null
+++ b/sys-auth/rtkit/metadata.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>marecki@gentoo.org</email>
+		<name>Marek Szuba</name>
+	</maintainer>
+	<longdescription lang="en">
+	RealtimeKit is a DBus service that provides applications with an interface
+	to escalate their priority to realtime, without any special setup in
+	rlimits, etc.
+	</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/rtkit/rtkit-0.12-r1.ebuild b/sys-auth/rtkit/rtkit-0.12-r1.ebuild
new file mode 100644
index 000000000000..f882e95fc82f
--- /dev/null
+++ b/sys-auth/rtkit/rtkit-0.12-r1.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools linux-info
+
+DESCRIPTION="Realtime Policy and Watchdog Daemon"
+HOMEPAGE="https://github.com/heftig/rtkit"
+SRC_URI="https://github.com/heftig/${PN}/releases/download/v${PV}/${P}.tar.xz"
+
+LICENSE="GPL-3 BSD"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ppc ppc64 sparc x86"
+IUSE="systemd"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="acct-group/rtkit
+	acct-user/rtkit
+	sys-apps/dbus
+	sys-auth/polkit
+	sys-libs/libcap
+	systemd? ( sys-apps/systemd )"
+RDEPEND="${DEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.12_introspection_no_asm.patch
+	"${FILESDIR}"/${PN}-0.12_libsystemd_optional.patch
+)
+
+pkg_pretend() {
+	if use kernel_linux; then
+		CONFIG_CHECK="~!RT_GROUP_SCHED"
+		ERROR_RT_GROUP_SCHED="CONFIG_RT_GROUP_SCHED is enabled. rtkit-daemon (or any other "
+		ERROR_RT_GROUP_SCHED+="real-time task) will not work unless run as root. Please consider "
+		ERROR_RT_GROUP_SCHED+="unsetting this option."
+		check_extra_config
+	fi
+}
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	econf \
+		$(use_enable systemd systemd-integration)
+}
diff --git a/sys-auth/rtkit/rtkit-0.13-r1.ebuild b/sys-auth/rtkit/rtkit-0.13-r1.ebuild
new file mode 100644
index 000000000000..feb00a847531
--- /dev/null
+++ b/sys-auth/rtkit/rtkit-0.13-r1.ebuild
@@ -0,0 +1,47 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit linux-info meson
+
+DESCRIPTION="Realtime Policy and Watchdog Daemon"
+HOMEPAGE="https://github.com/heftig/rtkit"
+SRC_URI="https://github.com/heftig/${PN}/releases/download/v${PV}/${P}.tar.xz"
+
+LICENSE="GPL-3 BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="systemd"
+
+BDEPEND="virtual/pkgconfig"
+DEPEND="acct-group/rtkit
+	acct-user/rtkit
+	sys-apps/dbus
+	sys-auth/polkit
+	sys-libs/libcap
+	systemd? ( sys-apps/systemd )"
+RDEPEND="${DEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.13_meson_rtkitctl_dir.patch
+	"${FILESDIR}"/${PN}-0.13_meson_xxd_optional.patch
+)
+
+pkg_pretend() {
+	if use kernel_linux; then
+		CONFIG_CHECK="~!RT_GROUP_SCHED"
+		ERROR_RT_GROUP_SCHED="CONFIG_RT_GROUP_SCHED is enabled. rtkit-daemon (or any other "
+		ERROR_RT_GROUP_SCHED+="real-time task) will not work unless run as root. Please consider "
+		ERROR_RT_GROUP_SCHED+="unsetting this option."
+		check_extra_config
+	fi
+}
+
+src_configure() {
+	local emesonargs=(
+		-Dinstalled_tests=false
+		$(meson_feature systemd libsystemd)
+	)
+	meson_src_configure
+}
diff --git a/sys-auth/skey/Manifest b/sys-auth/skey/Manifest
new file mode 100644
index 000000000000..4c3e9cb73c37
--- /dev/null
+++ b/sys-auth/skey/Manifest
@@ -0,0 +1,2 @@
+DIST skey-1.1.5-patches-6.tar.xz 34108 BLAKE2B 410dbe673e0a32a4c3fd0610f898057e7b3afcc0d0fd124683033790f9c518bf89486f13e8d87825c0959ff34e91eae82df6ba3b79c1dcb99a34d5657036d5a6 SHA512 2c807675cdd6b800f03427d79d616f59ac9d4d438221913328ec92e5dd13af185f74a24e17d36af8d49a51c4ecc5b24ef198489acce416d829e8aacf5d3c208a
+DIST skey-1.1.5.tar.bz2 61911 BLAKE2B 6226a91f4018bee5796bf60339dc8554324a044eef18a69ea176d060cb4af90779cafaee58f42ad7a6e433b94da8de6e5e4d1ee9362904966fd0872d5ac3ccce SHA512 4cbddc7e31134d5e23801a9b07de0d05c8357aaa8dddfb8426fceead3f54e539f77204f78a08b2a93890ef2f4f807a2208080f58f80818afa1b8cd4884b1fb37
diff --git a/sys-auth/skey/metadata.xml b/sys-auth/skey/metadata.xml
new file mode 100644
index 000000000000..083ce1e62c43
--- /dev/null
+++ b/sys-auth/skey/metadata.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+  <email>ulm@gentoo.org</email>
+</maintainer>
+<longdescription lang="en">
+  From RFC2289:
+  One form of attack on networked computing systems is eavesdropping on
+  network connections to obtain authentication information such as the
+  login IDs and passwords of legitimate users. Once this information is
+  captured, it can be used at a later time to gain access to the system.
+  One-time password systems are designed to counter this type of attack,
+  called a "replay attack."
+
+  The authentication system described in this document uses a secret
+  pass-phrase to generate a sequence of one-time (single use) passwords.
+  With this system, the user's secret pass-phrase never needs to cross the
+  network at any time such as during authentication or during pass-phrase
+  changes. Thus, it is not vulnerable to replay attacks. Added security
+  is provided by the property that no secret information need be stored on
+  any system, including the server being protected.
+
+  The OTP system protects against external passive attacks against the
+  authentication subsystem. It does not prevent a network eavesdropper from
+  gaining access to private information and does not provide protection
+  against either "social engineering" or active attacks.
+</longdescription>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/skey/skey-1.1.5-r11.ebuild b/sys-auth/skey/skey-1.1.5-r11.ebuild
new file mode 100644
index 000000000000..7ac90385b5a0
--- /dev/null
+++ b/sys-auth/skey/skey-1.1.5-r11.ebuild
@@ -0,0 +1,82 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs readme.gentoo-r1 usr-ldscript
+
+DESCRIPTION="Linux Port of OpenBSD Single-key Password System"
+HOMEPAGE="http://www.openbsd.org/faq/faq8.html#SKey"
+SRC_URI="mirror://gentoo/${P}.tar.bz2
+	https://dev.gentoo.org/~ulm/distfiles/${P}-patches-6.tar.xz"
+
+LICENSE="BSD MIT RSA BEER-WARE"
+SLOT="0"
+KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86"
+IUSE="static-libs"
+
+DEPEND="dev-lang/perl
+	app-arch/xz-utils"
+RDEPEND="dev-lang/perl
+	virtual/perl-Time-Local
+	sys-libs/cracklib"
+
+PATCHES="../patch"
+
+src_configure() {
+	tc-export CC
+	econf --sysconfdir=/etc/skey
+}
+
+src_install() {
+	into /
+	dolib.so libskey.so{.${PV},.${PV%.*},.${PV%%.*},}
+
+	into /usr
+	dobin skey skeyinit skeyinfo
+	newbin skeyaudit.sh skeyaudit
+	newsbin skeyprune.pl skeyprune
+
+	dosym skey /usr/bin/otp-md4
+	dosym skey /usr/bin/otp-md5
+	dosym skey /usr/bin/otp-sha1
+
+	if use static-libs; then
+		dolib.a libskey.a
+		gen_usr_ldscript libskey.so
+	fi
+
+	doman skey.1 skeyaudit.1 skeyinfo.1 skeyinit.1 skey.3 skeyprune.8
+
+	insinto /usr/include
+	doins skey.h
+
+	keepdir /etc/skey
+
+	# only root needs to have access to these files.
+	fperms go-rx /etc/skey
+
+	# skeyinit and skeyinfo must be suid root so users
+	# can generate their passwords.
+	fperms u+s,go-r /usr/bin/skeyinit /usr/bin/skeyinfo
+
+	dodoc README CHANGES
+
+	DOC_CONTENTS="For an introduction into using s/key authentication,
+		take a look at the EXAMPLES section from the skey(1) manpage."
+	readme.gentoo_create_doc
+}
+
+pkg_postinst() {
+	# do not include /etc/skey/skeykeys in the package, as quickpkg
+	# may package sensitive information.
+	# This also fixes the etc-update issue with #64974.
+
+	# skeyinit will not function if this file is not present.
+	touch /etc/skey/skeykeys
+
+	# these permissions are applied by the skey system if missing.
+	chmod 0600 /etc/skey/skeykeys
+
+	readme.gentoo_print_elog
+}
diff --git a/sys-auth/ssh-ldap-pubkey/Manifest b/sys-auth/ssh-ldap-pubkey/Manifest
new file mode 100644
index 000000000000..efaac702b496
--- /dev/null
+++ b/sys-auth/ssh-ldap-pubkey/Manifest
@@ -0,0 +1,5 @@
+DIST ssh-ldap-pubkey-1.3.0.tar.gz 14530 BLAKE2B 1de6913e4abb25d441731b3c36b64361f5fa8900c289b1f4ef58776ab0018414d20b4b24716833e1e27e5dc18079ec77c283bab88879e3fb719fc9ad054267ea SHA512 0c675b0bf68ccecdabda5f4f559772fd0d34151794c2a3855e063befffe9777ceb79e99b5649f15e5bd0c4ea40c22f734d1748a8053d49bffea58077b72efe16
+DIST ssh-ldap-pubkey-1.3.1.tar.gz 15263 BLAKE2B e073093ff5c2e5ebb560d00b4973a0d26c708d647974a1e2a3298d5be656a2a8f9099c9fa805eda9c0e69b615dccbf43c6eaec5a7284d612e8d7d71784c3d673 SHA512 fe17ad5515e044052350d68222ae1f2ba2b8dde796c3665a1e41094c0311609d37e27f95bf6f048ba881bd722717cb80b127d48c083c2c7ae9c53661ad4039e4
+DIST ssh-ldap-pubkey-1.3.2.tar.gz 15311 BLAKE2B a8119b9808de556184c7f88c86b657d5d342e476b27cf53d92f37b8e9d3db69182b55c62a636bec6624c5d1aa2a90e3a04a22ce5ee8020ada27582b1ac6eefa3 SHA512 8475715151f331017850c094a50bd285574533fa6266341effc83f758ca30af9b9c24b54fce8c3eac5441c5cf18b0d7aa91bb04829b71efc4b8dcacba3642415
+DIST ssh-ldap-pubkey-130478a7532a8d3dfb0c8e3fbeac494908b8ec55.patch 1494 BLAKE2B 3fb89340d8177db79396b13615437aa921ecc2d21b8ca5c918587bb07f9fb53bc8f356c50c57269b1ffe04995033815d7632ff060485d4c29d34dc7805227533 SHA512 dfc137b6fb2bc0aea698b23ea462de2bd00503b9b21f022b77b28d51020758730ea4017b890e298616beb198816489862830d4dda7cae5114572523ad6289472
+DIST ssh-ldap-pubkey-8d718357dfa5a62f919e61cf620a862cae87e833.patch 2215 BLAKE2B abeaa5a364cd98050fd8abb1019cc203b72e96baa4c3704c7aac6cadc07d999defa2333f6ca4f6793dd0e758b08ab198135c65d100f5f91eba6273c07dd20250 SHA512 85136608352fb35ede70eff8522e09167e48eed5c99a87756ea8b3f641de0dc169bf066d0c21a28fc35c41337372803d97bd37ca8bad1dbafb92464086fe3a63
diff --git a/sys-auth/ssh-ldap-pubkey/metadata.xml b/sys-auth/ssh-ldap-pubkey/metadata.xml
new file mode 100644
index 000000000000..0132982fc8b0
--- /dev/null
+++ b/sys-auth/ssh-ldap-pubkey/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>base-system@gentoo.org</email>
+		<name>Gentoo Base System</name>
+	</maintainer>
+	<upstream>
+		<bugs-to>https://github.com/jirutka/ssh-ldap-pubkey/issues</bugs-to>
+		<remote-id type="github">jirutka/ssh-ldap-pubkey</remote-id>
+	</upstream>
+	<use>
+		<flag name="schema">Install a copy of the LPK schema, only needed on LDAP servers.</flag>
+	</use>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.0-r2.ebuild b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.0-r2.ebuild
new file mode 100644
index 000000000000..d4129f617cbd
--- /dev/null
+++ b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.0-r2.ebuild
@@ -0,0 +1,85 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="6"
+
+PYTHON_COMPAT=( python3_6 )
+inherit distutils-r1
+
+DESCRIPTION="Utility to manage SSH public keys stored in LDAP"
+HOMEPAGE="https://github.com/jirutka/ssh-ldap-pubkey"
+
+if [[ ${PV} == "9999" ]]; then
+	EGIT_REPO_URI="https://github.com/jirutka/${PN}/${PN}.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/jirutka/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~x86"
+fi
+PATCHES=( )
+PATCH_COMMITS=(
+	# https://github.com/jirutka/ssh-ldap-pubkey/pull/33/
+	# config.parse_config: fix parsing of non-word characters
+	130478a7532a8d3dfb0c8e3fbeac494908b8ec55
+	# https://github.com/jirutka/ssh-ldap-pubkey/pull/33/
+	# find_dn_by_login: handle complex filters
+	8d718357dfa5a62f919e61cf620a862cae87e833
+)
+for c in "${PATCH_COMMITS[@]}" ; do
+	d="${PN}-${c}.patch"
+	PATCHES+=( "${DISTDIR}/${d}" )
+	SRC_URI="${SRC_URI} https://github.com/jirutka/${PN}/commit/${c}.patch -> ${d}"
+done
+
+LICENSE="MIT"
+SLOT="0"
+IUSE="schema test"
+RESTRICT="!test? ( test )"
+
+MY_CDEPEND="
+	dev-python/docopt[${PYTHON_USEDEP}]
+	>=dev-python/python-ldap-3.0[${PYTHON_USEDEP}]
+	virtual/logger"
+
+DEPEND="
+	${MY_CDEPEND}
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/pytest-describe[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)"
+
+# We need to block previous net-misc/openssh packages
+# to avoid file collision on "/etc/openldap/schema/openssh-lpk.schema"
+RDEPEND="${MY_CDEPEND}
+	schema? ( !net-misc/openssh[ldap] )"
+
+DOCS=( README.md CHANGELOG.adoc )
+
+src_prepare() {
+	sed -i -e 's/pyldap/python-ldap >= 3.0/' setup.py || die
+	distutils-r1_src_prepare
+}
+
+python_test() {
+	pytest -vv || die "Tests failed under ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	if use schema; then
+		insinto /etc/openldap/schema
+		doins etc/openssh-lpk.schema
+	fi
+
+	local MY_DOCDIR="/usr/share/doc/${PF}/examples"
+	insinto "${MY_DOCDIR}"
+	doins etc/ldap.conf
+
+	# We don't want to compress this small file to allow user
+	# to diff configuration against upstream's default
+	docompress -x "${MY_DOCDIR}"
+}
diff --git a/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.1.ebuild b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.1.ebuild
new file mode 100644
index 000000000000..f9b87b29b318
--- /dev/null
+++ b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.1.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+PYTHON_COMPAT=( python3_6 )
+inherit distutils-r1
+
+DESCRIPTION="Utility to manage SSH public keys stored in LDAP"
+HOMEPAGE="https://github.com/jirutka/ssh-ldap-pubkey"
+
+if [[ ${PV} == "9999" ]]; then
+	EGIT_REPO_URI="https://github.com/jirutka/${PN}/${PN}.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/jirutka/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE="schema test"
+RESTRICT="!test? ( test )"
+
+MY_CDEPEND="
+	dev-python/docopt[${PYTHON_USEDEP}]
+	>=dev-python/python-ldap-3.0[${PYTHON_USEDEP}]
+	virtual/logger"
+
+DEPEND="
+	${MY_CDEPEND}
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/pytest-describe[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)"
+
+# We need to block previous net-misc/openssh packages
+# to avoid file collision on "/etc/openldap/schema/openssh-lpk.schema"
+RDEPEND="${MY_CDEPEND}
+	schema? ( !net-misc/openssh[ldap] )"
+
+DOCS=( README.md CHANGELOG.adoc )
+
+src_prepare() {
+	sed -i -e 's/pyldap/python-ldap >= 3.0/' setup.py || die
+	distutils-r1_src_prepare
+}
+
+python_test() {
+	pytest -vv || die "Tests failed under ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	if use schema; then
+		insinto /etc/openldap/schema
+		doins etc/openssh-lpk.schema
+	fi
+
+	local MY_DOCDIR="/usr/share/doc/${PF}/examples"
+	insinto "${MY_DOCDIR}"
+	doins etc/ldap.conf
+
+	# We don't want to compress this small file to allow user
+	# to diff configuration against upstream's default
+	docompress -x "${MY_DOCDIR}"
+}
diff --git a/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.2.ebuild b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.2.ebuild
new file mode 100644
index 000000000000..15c6338cb358
--- /dev/null
+++ b/sys-auth/ssh-ldap-pubkey/ssh-ldap-pubkey-1.3.2.ebuild
@@ -0,0 +1,71 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+PYTHON_COMPAT=( python3_{6,7} )
+inherit distutils-r1
+
+DESCRIPTION="Utility to manage SSH public keys stored in LDAP"
+HOMEPAGE="https://github.com/jirutka/ssh-ldap-pubkey"
+
+if [[ ${PV} == "9999" ]]; then
+	EGIT_REPO_URI="https://github.com/jirutka/${PN}/${PN}.git"
+
+	inherit git-r3
+else
+	SRC_URI="https://github.com/jirutka/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~x86"
+fi
+
+LICENSE="MIT"
+SLOT="0"
+IUSE="schema test"
+RESTRICT="!test? ( test )"
+
+MY_CDEPEND="
+	dev-python/docopt[${PYTHON_USEDEP}]
+	>=dev-python/python-ldap-3.0[${PYTHON_USEDEP}]
+	virtual/logger"
+
+DEPEND="
+	${MY_CDEPEND}
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/pytest-describe[${PYTHON_USEDEP}]
+		dev-python/pytest-mock[${PYTHON_USEDEP}]
+	)"
+
+# We need to block previous net-misc/openssh packages
+# to avoid file collision on "/etc/openldap/schema/openssh-lpk.schema"
+RDEPEND="${MY_CDEPEND}
+	schema? ( !net-misc/openssh[ldap] )"
+
+DOCS=( README.md CHANGELOG.adoc )
+
+src_prepare() {
+	sed -i -e 's/pyldap/python-ldap >= 3.0/' setup.py || die
+	distutils-r1_src_prepare
+}
+
+python_test() {
+	pytest -vv || die "Tests failed under ${EPYTHON}"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	if use schema; then
+		insinto /etc/openldap/schema
+		doins etc/openssh-lpk.schema
+	fi
+
+	local MY_DOCDIR="/usr/share/doc/${PF}/examples"
+	insinto "${MY_DOCDIR}"
+	doins etc/ldap.conf
+
+	# We don't want to compress this small file to allow user
+	# to diff configuration against upstream's default
+	docompress -x "${MY_DOCDIR}"
+}
diff --git a/sys-auth/sssd/Manifest b/sys-auth/sssd/Manifest
new file mode 100644
index 000000000000..f45db817a653
--- /dev/null
+++ b/sys-auth/sssd/Manifest
@@ -0,0 +1,5 @@
+DIST sssd-1.16.3.tar.gz 6217114 BLAKE2B eefaf8de466d0d76e9a4b60aefef6eb63c17a55b9a1f2e07e973a61d71cbe5432e92357656a1eb353d45bbc2fa92290cef45898d0b315d4a4c4074652ff25a23 SHA512 6165923f652f624bbe3ddc625ae682c4867eb7a20652d0cf74bbb8dda2307c917d3189ede26fd21a4fb5fd5926149271a65fa09f3affe928029ed99e6422b728
+DIST sssd-2.1.0.tar.gz 6463331 BLAKE2B 9226370dc384c58841d944bdf9b067d953bf138ee7a289f01a4b8bb5d09beee3b9f21609989123d8f4f9fc13237670d61e32dcb194555ddc6785c598ce78d08c SHA512 12a7e5b89d462350af3c43e15b24a437dd985ac4a2e419d5e52cc0d05c6eacb9319d39b23681595ef860120cd1ae6e5fb265054afeddcb05d3d5f5de5d6ffa63
+DIST sssd-2.2.0.tar.gz 6642715 BLAKE2B e6c16ca69effe59769fc166c02203faee445ebe2bf551c6a1460bdee2474ccbce1a38b3aa59b1ae4a79bb170696a784b800a9299025bf6a58bc9aeb94b946338 SHA512 9ebd8784e1f0c72cb808bbc153c0b0aa9bf507938f78336a260073a89b49350dc2c6172653509738ea7a50bb9da596725e1d6c92f99c7a03308aa42f6378dbbb
+DIST sssd-2.2.2.tar.gz 6767578 BLAKE2B e0eedaf1da1de953903730c96479af0709ee14dd83eca82a11316dc96c29573b5f3de5965f386d5c12a69e7d98b6168c9d197bbd46ac51f0122feababe52dfe1 SHA512 4cce8fdbcc05d1469dad5ba987cb0f9bc33702b37f85e8e248975461bb50b0740fec92ff213bdb640b506405be7ead936ff253ab02d4a27205ddf20cc0e54801
+DIST sssd-2.2.3.tar.gz 6894302 BLAKE2B b72443ebd4f50581a0d9d2b7cf691fdda0dfe3cfb2ed82c383595aeca8d6198c7f44f1c49e56bdfeac23f9151897ac2df70d1afbbeceb2231daee71492884420 SHA512 b61d52a53e26e8efa9cb799fc6efc2314bf9d174d3cacfe591a4ca77530637591eacc0dc70c0555252e04a9617e8b134b1ab2d9b0f7351b4228e7b61499e6a10
diff --git a/sys-auth/sssd/files/sssd b/sys-auth/sssd/files/sssd
new file mode 100644
index 000000000000..c79b79ac1e18
--- /dev/null
+++ b/sys-auth/sssd/files/sssd
@@ -0,0 +1,21 @@
+#!/sbin/openrc-run
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+
+command="/usr/sbin/sssd"
+command_args="${SSSD_OPTIONS} -D"
+start_stop_daemon_args="--quiet"
+description="System Security Services Daemon"
+
+depend(){
+    need localmount clock
+    use syslog xdm
+}
+
+if [ "${RC_VERSION:-0}" = "0" ]; then
+        start() {
+                eerror "This script cannot be used for baselayout-1."
+                return 1
+        }
+fi
diff --git a/sys-auth/sssd/files/sssd-curl-macros.patch b/sys-auth/sssd/files/sssd-curl-macros.patch
new file mode 100644
index 000000000000..91e71e837875
--- /dev/null
+++ b/sys-auth/sssd/files/sssd-curl-macros.patch
@@ -0,0 +1,34 @@
+From d3cdf9cbfbace4874c6e5c96f1e5ef5b342c813e Mon Sep 17 00:00:00 2001
+From: Mikle Kolyada <zlogene@gentoo.org>
+Date: Sun, 16 Dec 2018 20:42:39 +0300
+Subject: [PATCH] tev_curl.c: remove case duplication
+
+CURLE_SSL_CACERT and CURLE_PEER_FAILED_VERIFICATION macros are provided
+by net-misc/curl-7.62.0 and older
+---
+ tev_curl.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/tev_curl.c b/tev_curl.c
+index 6a7a580..ce6fdba 100644
+--- a/src/util/tev_curl.c
++++ b/src/util/tev_curl.c
+@@ -97,7 +97,6 @@ static errno_t curl_code2errno(CURLcode crv)
+         return ETIMEDOUT;
+     case CURLE_SSL_ISSUER_ERROR:
+     case CURLE_SSL_CACERT_BADFILE:
+-    case CURLE_SSL_CACERT:
+     case CURLE_SSL_CERTPROBLEM:
+         return ERR_INVALID_CERT;
+ 
+@@ -110,8 +109,6 @@ static errno_t curl_code2errno(CURLcode crv)
+     case CURLE_SSL_ENGINE_NOTFOUND:
+     case CURLE_SSL_CONNECT_ERROR:
+         return ERR_SSL_FAILURE;
+-    case CURLE_PEER_FAILED_VERIFICATION:
+-        return ERR_UNABLE_TO_VERIFY_PEER;
+     case CURLE_COULDNT_RESOLVE_HOST:
+         return ERR_UNABLE_TO_RESOLVE_HOST;
+     default:
+-- 
+2.19.2
+\ No newline at end of file
diff --git a/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch b/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
new file mode 100644
index 000000000000..87db45fd24bb
--- /dev/null
+++ b/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
@@ -0,0 +1,96 @@
+From 28792523a01a7d21bcc8931794164f253e691a68 Mon Sep 17 00:00:00 2001
+From: Tomas Halman <thalman@redhat.com>
+Date: Mon, 3 Dec 2018 14:11:31 +0100
+Subject: [PATCH] nss: sssd returns '/' for emtpy home directories
+
+For empty home directory in passwd file sssd returns "/". Sssd
+should respect system behaviour and return the same as nsswitch
+"files" module - return empty string.
+
+Resolves:
+https://pagure.io/SSSD/sssd/issue/3901
+
+Reviewed-by: Simo Sorce <simo@redhat.com>
+Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
+(cherry picked from commit 90f32399b4100ce39cf665649fde82d215e5eb49)
+---
+ src/confdb/confdb.c                      |  9 +++++++++
+ src/man/include/ad_modified_defaults.xml | 19 +++++++++++++++++++
+ src/responder/nss/nss_protocol_pwent.c   |  2 +-
+ src/tests/intg/test_files_provider.py    |  2 +-
+ 4 files changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
+index a3eb9c66d9..17bb4f8274 100644
+--- a/src/confdb/confdb.c
++++ b/src/confdb/confdb.c
+@@ -1301,6 +1301,15 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
+             ret = ENOMEM;
+             goto done;
+         }
++    } else {
++        if (strcasecmp(domain->provider, "ad") == 0) {
++            /* ad provider default */
++            domain->fallback_homedir = talloc_strdup(domain, "/home/%d/%u");
++            if (!domain->fallback_homedir) {
++                ret = ENOMEM;
++                goto done;
++            }
++        }
+     }
+ 
+     tmp = ldb_msg_find_attr_as_string(res->msgs[0],
+diff --git a/src/man/include/ad_modified_defaults.xml b/src/man/include/ad_modified_defaults.xml
+index 818a2bf787..425b7e8ee0 100644
+--- a/src/man/include/ad_modified_defaults.xml
++++ b/src/man/include/ad_modified_defaults.xml
+@@ -76,4 +76,23 @@
+             </listitem>
+         </itemizedlist>
+     </refsect2>
++    <refsect2 id='nss_modifications'>
++        <title>NSS configuration</title>
++        <itemizedlist>
++            <listitem>
++                <para>
++                    fallback_homedir = /home/%d/%u
++                </para>
++                <para>
++                    The AD provider automatically sets
++                    "fallback_homedir = /home/%d/%u" to provide personal
++                    home directories for users without the homeDirectory
++                    attribute. If your AD Domain is properly
++                    populated with Posix attributes, and you want to avoid
++                    this fallback behavior, you can explicitly
++                    set "fallback_homedir = %o".
++                </para>
++            </listitem>
++        </itemizedlist>
++    </refsect2>
+ </refsect1>
+diff --git a/src/responder/nss/nss_protocol_pwent.c b/src/responder/nss/nss_protocol_pwent.c
+index af9e74fc86..86fa4ec465 100644
+--- a/src/responder/nss/nss_protocol_pwent.c
++++ b/src/responder/nss/nss_protocol_pwent.c
+@@ -118,7 +118,7 @@ nss_get_homedir(TALLOC_CTX *mem_ctx,
+ 
+     homedir = nss_get_homedir_override(mem_ctx, msg, nss_ctx, domain, &hd_ctx);
+     if (homedir == NULL) {
+-        return "/";
++        return "";
+     }
+ 
+     return homedir;
+diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py
+index ead1cc4c34..4761f1bd15 100644
+--- a/src/tests/intg/test_files_provider.py
++++ b/src/tests/intg/test_files_provider.py
+@@ -678,7 +678,7 @@ def test_user_no_dir(setup_pw_with_canary, files_domain_only):
+     Test that resolving a user without a homedir defined works and returns
+     a fallback value
+     """
+-    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', '/'))
++    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', ''))
+ 
+ 
+ def test_user_no_gecos(setup_pw_with_canary, files_domain_only):
diff --git a/sys-auth/sssd/files/sssd.conf b/sys-auth/sssd/files/sssd.conf
new file mode 100644
index 000000000000..33dab3ddcd5d
--- /dev/null
+++ b/sys-auth/sssd/files/sssd.conf
@@ -0,0 +1,4 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+SSSD_OPTIONS=""
diff --git a/sys-auth/sssd/files/sssd.service b/sys-auth/sssd/files/sssd.service
new file mode 100644
index 000000000000..1821089a6094
--- /dev/null
+++ b/sys-auth/sssd/files/sssd.service
@@ -0,0 +1,15 @@
+[Unit]
+Description=System Security Services Daemon
+# SSSD will not be started until syslog is
+After=syslog.target
+
+[Service]
+ExecStart=/usr/sbin/sssd -D -f
+# These two should be used with traditional UNIX forking daemons
+# consult systemd.service(5) for more details
+Type=forking
+PIDFile=/run/sssd.pid
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/sys-auth/sssd/metadata.xml b/sys-auth/sssd/metadata.xml
new file mode 100644
index 000000000000..55239636ff8c
--- /dev/null
+++ b/sys-auth/sssd/metadata.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>alexxy@gentoo.org</email>
+		<name>Alexey Shvetsov</name>
+	</maintainer>
+	<use>
+		<flag name="acl"> Build and use the cifsidmap plugin</flag>
+		<flag name="locator">Install sssd's Kerberos plugin</flag>
+		<flag name="netlink">Add support for netlink protocol via <pkg>dev-libs/libnl</pkg></flag>
+		<flag name="nfsv4">Add support for the nfsv4 idmapd plugin provided by <pkg>net-libs/libnfsidmap</pkg></flag>
+		<flag name="manpages">Build man pages with <pkg>dev-libs/libxslt</pkg></flag>
+		<flag name="autofs">Build helper to let <pkg>net-fs/autofs</pkg> use sssd provided information</flag>
+		<flag name="ssh">Build helper to let <pkg>net-misc/openssh</pkg> use sssd provided information</flag>
+		<flag name="sudo">Build helper to let <pkg>app-admin/sudo</pkg> use sssd provided information</flag>
+	</use>
+	<upstream>
+		<remote-id type="cpe">cpe:/a:fedorahosted:sssd</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/sssd/sssd-1.16.3-r3.ebuild b/sys-auth/sssd/sssd-1.16.3-r3.ebuild
new file mode 100644
index 000000000000..a887a0cb720e
--- /dev/null
+++ b/sys-auth/sssd/sssd-1.16.3-r3.ebuild
@@ -0,0 +1,233 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+
+DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
+HOMEPAGE="https://pagure.io/SSSD/sssd"
+SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/popt-1.16
+	dev-libs/glib:2
+	>=dev-libs/ding-libs-0.2
+	>=sys-libs/talloc-2.0.7
+	>=sys-libs/tdb-1.2.9
+	>=sys-libs/tevent-0.9.16
+	>=sys-libs/ldb-1.1.17-r1:=
+	>=net-nds/openldap-2.4.30[sasl]
+	net-libs/http-parser
+	>=dev-libs/libpcre-8.30
+	>=app-crypt/mit-krb5-1.10.3
+	dev-libs/jansson
+	net-misc/curl
+	locator? (
+		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
+		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-apps/keyutils-1.5:=
+	>=net-dns/c-ares-1.7.4
+	>=dev-libs/nss-3.12.9
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=sys-apps/dbus-1.6
+	acl? ( net-fs/cifs-utils[acl] )
+	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
+	nls? ( >=sys-devel/gettext-0.18 )
+	virtual/libintl
+	netlink? ( dev-libs/libnl:3 )
+	samba? ( >=net-fs/samba-4.5 )
+	"
+
+RDEPEND="${COMMON_DEP}
+	>=sys-libs/glibc-2.17[nscd]
+	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
+	"
+DEPEND="${COMMON_DEP}
+	test? ( dev-libs/check )
+	manpages? (
+		>=dev-libs/libxslt-1.1.26
+		app-text/docbook-xml-dtd:4.4
+		)"
+
+CONFIG_CHECK="~KEYS"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ipa_hbac.h
+	/usr/include/sss_idmap.h
+	/usr/include/sss_nss_idmap.h
+	/usr/include/wbclient_sssd.h
+	# --with-ifp
+	/usr/include/sss_sifp.h
+	/usr/include/sss_sifp_dbus.h
+	# from 1.15.3
+	/usr/include/sss_certmap.h
+)
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
+		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+
+	eapply "${FILESDIR}"/${PN}-curl-macros.patch
+	eapply "${FILESDIR}"/${PN}-fix-CVE-2019-3811.patch
+
+	default
+	eautoreconf
+	multilib_copy_sources
+}
+
+src_configure() {
+	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# set initscript to sysv because the systemd option needs systemd to
+	# be installed. We provide our own systemd file anyway.
+	local myconf=()
+	#Work around linker dependency problem.
+	append-ldflags "-Wl,--allow-shlib-undefined"
+
+	myconf+=(
+		--localstatedir="${EPREFIX}"/var
+		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
+		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-os=gentoo
+		--with-nscd
+		--with-unicode-lib="glib2"
+		--disable-rpath
+		--sbindir=/usr/sbin
+		--without-kcm
+		$(use_with samba libwbclient)
+		--with-secrets
+		$(multilib_native_use_with samba)
+		$(multilib_native_use_enable acl cifs-idmap-plugin)
+		$(multilib_native_use_with selinux)
+		$(multilib_native_use_with selinux semanage)
+		$(use_enable locator krb5-locator-plugin)
+		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
+		$(use_enable nls )
+		$(multilib_native_use_with netlink libnl)
+		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with sudo)
+		$(multilib_native_use_with autofs)
+		$(multilib_native_use_with ssh)
+		--with-crypto="nss"
+		--with-initscript="sysv"
+		--without-python2-bindings
+		--without-python3-bindings
+
+		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+	)
+
+	if ! multilib_is_native_abi; then
+		# work-around all the libraries that are used for CLI and server
+		myconf+=(
+			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
+			# ldb headers are fine since native needs it
+			# ldb lib fails... but it does not seem to bother
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+
+			# use native include path for dbus (needed for build)
+			DBUS_CFLAGS="${native_dbus_cflags}"
+
+			# non-pkgconfig checks
+			ac_cv_lib_ldap_ldap_search=yes
+			--without-secrets
+			--without-libwbclient
+			--without-kcm
+			--with-crypto=""
+		)
+
+		use locator || myconf+=(
+				KRB5_CONFIG=/bin/true
+		)
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+	else
+		emake libnss_sss.la pam_sss.la
+		use locator && emake sssd_krb5_locator_plugin.la
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+	else
+		# easier than playing with automake...
+		dopammod .libs/pam_sss.so
+
+		into /
+		dolib.so .libs/libnss_sss.so*
+
+		if use locator; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
+			doexe .libs/sssd_krb5_locator_plugin.so
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	insinto /etc/sssd
+	insopts -m600
+	doins "${S}"/src/examples/sssd-example.conf
+
+	insinto /etc/logrotate.d
+	insopts -m644
+	newins "${S}"/src/examples/logrotate sssd
+
+	newconfd "${FILESDIR}"/sssd.conf sssd
+	newinitd "${FILESDIR}"/sssd sssd
+
+	keepdir /var/lib/sss/db
+	keepdir /var/lib/sss/deskprofile
+	keepdir /var/lib/sss/gpo_cache
+	keepdir /var/lib/sss/keytabs
+	keepdir /var/lib/sss/mc
+	keepdir /var/lib/sss/pipes/private
+	keepdir /var/lib/sss/pubconf/krb5.include.d
+	keepdir /var/lib/sss/secrets
+	keepdir /var/log/sssd
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+multilib_src_test() {
+	default
+}
+
+pkg_postinst() {
+	elog "You must set up sssd.conf (default installed into /etc/sssd)"
+	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/index.html#implemented-in-1-16-x"
+}
diff --git a/sys-auth/sssd/sssd-2.1.0-r1.ebuild b/sys-auth/sssd/sssd-2.1.0-r1.ebuild
new file mode 100644
index 000000000000..98af8535a88f
--- /dev/null
+++ b/sys-auth/sssd/sssd-2.1.0-r1.ebuild
@@ -0,0 +1,230 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+
+DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
+HOMEPAGE="https://pagure.io/SSSD/sssd"
+SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/popt-1.16
+	dev-libs/glib:2
+	>=dev-libs/ding-libs-0.2
+	>=sys-libs/talloc-2.0.7
+	>=sys-libs/tdb-1.2.9
+	>=sys-libs/tevent-0.9.16
+	>=sys-libs/ldb-1.1.17-r1:=
+	>=net-nds/openldap-2.4.30[sasl]
+	net-libs/http-parser
+	>=dev-libs/libpcre-8.30
+	>=app-crypt/mit-krb5-1.10.3
+	dev-libs/jansson
+	net-misc/curl
+	locator? (
+		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
+		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-apps/keyutils-1.5:=
+	>=net-dns/c-ares-1.7.4
+	>=dev-libs/nss-3.12.9
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=sys-apps/dbus-1.6
+	acl? ( net-fs/cifs-utils[acl] )
+	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
+	nls? ( >=sys-devel/gettext-0.18 )
+	virtual/libintl
+	netlink? ( dev-libs/libnl:3 )
+	samba? ( >=net-fs/samba-4.10.2[winbind] )
+	"
+
+RDEPEND="${COMMON_DEP}
+	>=sys-libs/glibc-2.17[nscd]
+	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
+	"
+DEPEND="${COMMON_DEP}
+	test? ( dev-libs/check )
+	manpages? (
+		>=dev-libs/libxslt-1.1.26
+		app-text/docbook-xml-dtd:4.4
+		)"
+
+CONFIG_CHECK="~KEYS"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ipa_hbac.h
+	/usr/include/sss_idmap.h
+	/usr/include/sss_nss_idmap.h
+	/usr/include/wbclient_sssd.h
+	# --with-ifp
+	/usr/include/sss_sifp.h
+	/usr/include/sss_sifp_dbus.h
+	# from 1.15.3
+	/usr/include/sss_certmap.h
+)
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
+		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+
+	default
+	eautoreconf
+	multilib_copy_sources
+}
+
+src_configure() {
+	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# set initscript to sysv because the systemd option needs systemd to
+	# be installed. We provide our own systemd file anyway.
+	local myconf=()
+	#Work around linker dependency problem.
+	append-ldflags "-Wl,--allow-shlib-undefined"
+
+	myconf+=(
+		--localstatedir="${EPREFIX}"/var
+		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
+		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-os=gentoo
+		--with-nscd
+		--with-unicode-lib="glib2"
+		--disable-rpath
+		--sbindir=/usr/sbin
+		--without-kcm
+		$(use_with samba libwbclient)
+		--with-secrets
+		$(multilib_native_use_with samba)
+		$(multilib_native_use_enable acl cifs-idmap-plugin)
+		$(multilib_native_use_with selinux)
+		$(multilib_native_use_with selinux semanage)
+		$(use_enable locator krb5-locator-plugin)
+		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
+		$(use_enable nls )
+		$(multilib_native_use_with netlink libnl)
+		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with sudo)
+		$(multilib_native_use_with autofs)
+		$(multilib_native_use_with ssh)
+		--with-crypto="nss"
+		--with-initscript="sysv"
+		--without-python2-bindings
+		--without-python3-bindings
+
+		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+	)
+
+	if ! multilib_is_native_abi; then
+		# work-around all the libraries that are used for CLI and server
+		myconf+=(
+			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
+			# ldb headers are fine since native needs it
+			# ldb lib fails... but it does not seem to bother
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+
+			# use native include path for dbus (needed for build)
+			DBUS_CFLAGS="${native_dbus_cflags}"
+
+			# non-pkgconfig checks
+			ac_cv_lib_ldap_ldap_search=yes
+			--without-secrets
+			--without-libwbclient
+			--without-kcm
+			--with-crypto=""
+		)
+
+		use locator || myconf+=(
+				KRB5_CONFIG=/bin/true
+		)
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+	else
+		emake libnss_sss.la pam_sss.la
+		use locator && emake sssd_krb5_locator_plugin.la
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+	else
+		# easier than playing with automake...
+		dopammod .libs/pam_sss.so
+
+		into /
+		dolib.so .libs/libnss_sss.so*
+
+		if use locator; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
+			doexe .libs/sssd_krb5_locator_plugin.so
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	insinto /etc/sssd
+	insopts -m600
+	doins "${S}"/src/examples/sssd-example.conf
+
+	insinto /etc/logrotate.d
+	insopts -m644
+	newins "${S}"/src/examples/logrotate sssd
+
+	newconfd "${FILESDIR}"/sssd.conf sssd
+	newinitd "${FILESDIR}"/sssd sssd
+
+	keepdir /var/lib/sss/db
+	keepdir /var/lib/sss/deskprofile
+	keepdir /var/lib/sss/gpo_cache
+	keepdir /var/lib/sss/keytabs
+	keepdir /var/lib/sss/mc
+	keepdir /var/lib/sss/pipes/private
+	keepdir /var/lib/sss/pubconf/krb5.include.d
+	keepdir /var/lib/sss/secrets
+	keepdir /var/log/sssd
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+multilib_src_test() {
+	default
+}
+
+pkg_postinst() {
+	elog "You must set up sssd.conf (default installed into /etc/sssd)"
+	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
+}
diff --git a/sys-auth/sssd/sssd-2.2.0-r1.ebuild b/sys-auth/sssd/sssd-2.2.0-r1.ebuild
new file mode 100644
index 000000000000..98af8535a88f
--- /dev/null
+++ b/sys-auth/sssd/sssd-2.2.0-r1.ebuild
@@ -0,0 +1,230 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+
+DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
+HOMEPAGE="https://pagure.io/SSSD/sssd"
+SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/popt-1.16
+	dev-libs/glib:2
+	>=dev-libs/ding-libs-0.2
+	>=sys-libs/talloc-2.0.7
+	>=sys-libs/tdb-1.2.9
+	>=sys-libs/tevent-0.9.16
+	>=sys-libs/ldb-1.1.17-r1:=
+	>=net-nds/openldap-2.4.30[sasl]
+	net-libs/http-parser
+	>=dev-libs/libpcre-8.30
+	>=app-crypt/mit-krb5-1.10.3
+	dev-libs/jansson
+	net-misc/curl
+	locator? (
+		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
+		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-apps/keyutils-1.5:=
+	>=net-dns/c-ares-1.7.4
+	>=dev-libs/nss-3.12.9
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=sys-apps/dbus-1.6
+	acl? ( net-fs/cifs-utils[acl] )
+	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
+	nls? ( >=sys-devel/gettext-0.18 )
+	virtual/libintl
+	netlink? ( dev-libs/libnl:3 )
+	samba? ( >=net-fs/samba-4.10.2[winbind] )
+	"
+
+RDEPEND="${COMMON_DEP}
+	>=sys-libs/glibc-2.17[nscd]
+	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
+	"
+DEPEND="${COMMON_DEP}
+	test? ( dev-libs/check )
+	manpages? (
+		>=dev-libs/libxslt-1.1.26
+		app-text/docbook-xml-dtd:4.4
+		)"
+
+CONFIG_CHECK="~KEYS"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ipa_hbac.h
+	/usr/include/sss_idmap.h
+	/usr/include/sss_nss_idmap.h
+	/usr/include/wbclient_sssd.h
+	# --with-ifp
+	/usr/include/sss_sifp.h
+	/usr/include/sss_sifp_dbus.h
+	# from 1.15.3
+	/usr/include/sss_certmap.h
+)
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
+		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+
+	default
+	eautoreconf
+	multilib_copy_sources
+}
+
+src_configure() {
+	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# set initscript to sysv because the systemd option needs systemd to
+	# be installed. We provide our own systemd file anyway.
+	local myconf=()
+	#Work around linker dependency problem.
+	append-ldflags "-Wl,--allow-shlib-undefined"
+
+	myconf+=(
+		--localstatedir="${EPREFIX}"/var
+		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
+		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-os=gentoo
+		--with-nscd
+		--with-unicode-lib="glib2"
+		--disable-rpath
+		--sbindir=/usr/sbin
+		--without-kcm
+		$(use_with samba libwbclient)
+		--with-secrets
+		$(multilib_native_use_with samba)
+		$(multilib_native_use_enable acl cifs-idmap-plugin)
+		$(multilib_native_use_with selinux)
+		$(multilib_native_use_with selinux semanage)
+		$(use_enable locator krb5-locator-plugin)
+		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
+		$(use_enable nls )
+		$(multilib_native_use_with netlink libnl)
+		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with sudo)
+		$(multilib_native_use_with autofs)
+		$(multilib_native_use_with ssh)
+		--with-crypto="nss"
+		--with-initscript="sysv"
+		--without-python2-bindings
+		--without-python3-bindings
+
+		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+	)
+
+	if ! multilib_is_native_abi; then
+		# work-around all the libraries that are used for CLI and server
+		myconf+=(
+			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
+			# ldb headers are fine since native needs it
+			# ldb lib fails... but it does not seem to bother
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+
+			# use native include path for dbus (needed for build)
+			DBUS_CFLAGS="${native_dbus_cflags}"
+
+			# non-pkgconfig checks
+			ac_cv_lib_ldap_ldap_search=yes
+			--without-secrets
+			--without-libwbclient
+			--without-kcm
+			--with-crypto=""
+		)
+
+		use locator || myconf+=(
+				KRB5_CONFIG=/bin/true
+		)
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+	else
+		emake libnss_sss.la pam_sss.la
+		use locator && emake sssd_krb5_locator_plugin.la
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+	else
+		# easier than playing with automake...
+		dopammod .libs/pam_sss.so
+
+		into /
+		dolib.so .libs/libnss_sss.so*
+
+		if use locator; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
+			doexe .libs/sssd_krb5_locator_plugin.so
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	insinto /etc/sssd
+	insopts -m600
+	doins "${S}"/src/examples/sssd-example.conf
+
+	insinto /etc/logrotate.d
+	insopts -m644
+	newins "${S}"/src/examples/logrotate sssd
+
+	newconfd "${FILESDIR}"/sssd.conf sssd
+	newinitd "${FILESDIR}"/sssd sssd
+
+	keepdir /var/lib/sss/db
+	keepdir /var/lib/sss/deskprofile
+	keepdir /var/lib/sss/gpo_cache
+	keepdir /var/lib/sss/keytabs
+	keepdir /var/lib/sss/mc
+	keepdir /var/lib/sss/pipes/private
+	keepdir /var/lib/sss/pubconf/krb5.include.d
+	keepdir /var/lib/sss/secrets
+	keepdir /var/log/sssd
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+multilib_src_test() {
+	default
+}
+
+pkg_postinst() {
+	elog "You must set up sssd.conf (default installed into /etc/sssd)"
+	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
+}
diff --git a/sys-auth/sssd/sssd-2.2.2.ebuild b/sys-auth/sssd/sssd-2.2.2.ebuild
new file mode 100644
index 000000000000..98af8535a88f
--- /dev/null
+++ b/sys-auth/sssd/sssd-2.2.2.ebuild
@@ -0,0 +1,230 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+
+DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
+HOMEPAGE="https://pagure.io/SSSD/sssd"
+SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/popt-1.16
+	dev-libs/glib:2
+	>=dev-libs/ding-libs-0.2
+	>=sys-libs/talloc-2.0.7
+	>=sys-libs/tdb-1.2.9
+	>=sys-libs/tevent-0.9.16
+	>=sys-libs/ldb-1.1.17-r1:=
+	>=net-nds/openldap-2.4.30[sasl]
+	net-libs/http-parser
+	>=dev-libs/libpcre-8.30
+	>=app-crypt/mit-krb5-1.10.3
+	dev-libs/jansson
+	net-misc/curl
+	locator? (
+		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
+		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-apps/keyutils-1.5:=
+	>=net-dns/c-ares-1.7.4
+	>=dev-libs/nss-3.12.9
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=sys-apps/dbus-1.6
+	acl? ( net-fs/cifs-utils[acl] )
+	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
+	nls? ( >=sys-devel/gettext-0.18 )
+	virtual/libintl
+	netlink? ( dev-libs/libnl:3 )
+	samba? ( >=net-fs/samba-4.10.2[winbind] )
+	"
+
+RDEPEND="${COMMON_DEP}
+	>=sys-libs/glibc-2.17[nscd]
+	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
+	"
+DEPEND="${COMMON_DEP}
+	test? ( dev-libs/check )
+	manpages? (
+		>=dev-libs/libxslt-1.1.26
+		app-text/docbook-xml-dtd:4.4
+		)"
+
+CONFIG_CHECK="~KEYS"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ipa_hbac.h
+	/usr/include/sss_idmap.h
+	/usr/include/sss_nss_idmap.h
+	/usr/include/wbclient_sssd.h
+	# --with-ifp
+	/usr/include/sss_sifp.h
+	/usr/include/sss_sifp_dbus.h
+	# from 1.15.3
+	/usr/include/sss_certmap.h
+)
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
+		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+
+	default
+	eautoreconf
+	multilib_copy_sources
+}
+
+src_configure() {
+	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# set initscript to sysv because the systemd option needs systemd to
+	# be installed. We provide our own systemd file anyway.
+	local myconf=()
+	#Work around linker dependency problem.
+	append-ldflags "-Wl,--allow-shlib-undefined"
+
+	myconf+=(
+		--localstatedir="${EPREFIX}"/var
+		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
+		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-os=gentoo
+		--with-nscd
+		--with-unicode-lib="glib2"
+		--disable-rpath
+		--sbindir=/usr/sbin
+		--without-kcm
+		$(use_with samba libwbclient)
+		--with-secrets
+		$(multilib_native_use_with samba)
+		$(multilib_native_use_enable acl cifs-idmap-plugin)
+		$(multilib_native_use_with selinux)
+		$(multilib_native_use_with selinux semanage)
+		$(use_enable locator krb5-locator-plugin)
+		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
+		$(use_enable nls )
+		$(multilib_native_use_with netlink libnl)
+		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with sudo)
+		$(multilib_native_use_with autofs)
+		$(multilib_native_use_with ssh)
+		--with-crypto="nss"
+		--with-initscript="sysv"
+		--without-python2-bindings
+		--without-python3-bindings
+
+		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+	)
+
+	if ! multilib_is_native_abi; then
+		# work-around all the libraries that are used for CLI and server
+		myconf+=(
+			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
+			# ldb headers are fine since native needs it
+			# ldb lib fails... but it does not seem to bother
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+
+			# use native include path for dbus (needed for build)
+			DBUS_CFLAGS="${native_dbus_cflags}"
+
+			# non-pkgconfig checks
+			ac_cv_lib_ldap_ldap_search=yes
+			--without-secrets
+			--without-libwbclient
+			--without-kcm
+			--with-crypto=""
+		)
+
+		use locator || myconf+=(
+				KRB5_CONFIG=/bin/true
+		)
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+	else
+		emake libnss_sss.la pam_sss.la
+		use locator && emake sssd_krb5_locator_plugin.la
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+	else
+		# easier than playing with automake...
+		dopammod .libs/pam_sss.so
+
+		into /
+		dolib.so .libs/libnss_sss.so*
+
+		if use locator; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
+			doexe .libs/sssd_krb5_locator_plugin.so
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	insinto /etc/sssd
+	insopts -m600
+	doins "${S}"/src/examples/sssd-example.conf
+
+	insinto /etc/logrotate.d
+	insopts -m644
+	newins "${S}"/src/examples/logrotate sssd
+
+	newconfd "${FILESDIR}"/sssd.conf sssd
+	newinitd "${FILESDIR}"/sssd sssd
+
+	keepdir /var/lib/sss/db
+	keepdir /var/lib/sss/deskprofile
+	keepdir /var/lib/sss/gpo_cache
+	keepdir /var/lib/sss/keytabs
+	keepdir /var/lib/sss/mc
+	keepdir /var/lib/sss/pipes/private
+	keepdir /var/lib/sss/pubconf/krb5.include.d
+	keepdir /var/lib/sss/secrets
+	keepdir /var/log/sssd
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+multilib_src_test() {
+	default
+}
+
+pkg_postinst() {
+	elog "You must set up sssd.conf (default installed into /etc/sssd)"
+	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
+}
diff --git a/sys-auth/sssd/sssd-2.2.3.ebuild b/sys-auth/sssd/sssd-2.2.3.ebuild
new file mode 100644
index 000000000000..98af8535a88f
--- /dev/null
+++ b/sys-auth/sssd/sssd-2.2.3.ebuild
@@ -0,0 +1,230 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+
+DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
+HOMEPAGE="https://pagure.io/SSSD/sssd"
+SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+RESTRICT="!test? ( test )"
+
+COMMON_DEP="
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
+	>=dev-libs/popt-1.16
+	dev-libs/glib:2
+	>=dev-libs/ding-libs-0.2
+	>=sys-libs/talloc-2.0.7
+	>=sys-libs/tdb-1.2.9
+	>=sys-libs/tevent-0.9.16
+	>=sys-libs/ldb-1.1.17-r1:=
+	>=net-nds/openldap-2.4.30[sasl]
+	net-libs/http-parser
+	>=dev-libs/libpcre-8.30
+	>=app-crypt/mit-krb5-1.10.3
+	dev-libs/jansson
+	net-misc/curl
+	locator? (
+		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
+		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
+	)
+	>=sys-apps/keyutils-1.5:=
+	>=net-dns/c-ares-1.7.4
+	>=dev-libs/nss-3.12.9
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=sys-apps/dbus-1.6
+	acl? ( net-fs/cifs-utils[acl] )
+	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
+	nls? ( >=sys-devel/gettext-0.18 )
+	virtual/libintl
+	netlink? ( dev-libs/libnl:3 )
+	samba? ( >=net-fs/samba-4.10.2[winbind] )
+	"
+
+RDEPEND="${COMMON_DEP}
+	>=sys-libs/glibc-2.17[nscd]
+	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
+	"
+DEPEND="${COMMON_DEP}
+	test? ( dev-libs/check )
+	manpages? (
+		>=dev-libs/libxslt-1.1.26
+		app-text/docbook-xml-dtd:4.4
+		)"
+
+CONFIG_CHECK="~KEYS"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/ipa_hbac.h
+	/usr/include/sss_idmap.h
+	/usr/include/sss_nss_idmap.h
+	/usr/include/wbclient_sssd.h
+	# --with-ifp
+	/usr/include/sss_sifp.h
+	/usr/include/sss_sifp_dbus.h
+	# from 1.15.3
+	/usr/include/sss_certmap.h
+)
+
+pkg_setup() {
+	linux-info_pkg_setup
+}
+
+src_prepare() {
+	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
+		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+
+	default
+	eautoreconf
+	multilib_copy_sources
+}
+
+src_configure() {
+	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	# set initscript to sysv because the systemd option needs systemd to
+	# be installed. We provide our own systemd file anyway.
+	local myconf=()
+	#Work around linker dependency problem.
+	append-ldflags "-Wl,--allow-shlib-undefined"
+
+	myconf+=(
+		--localstatedir="${EPREFIX}"/var
+		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
+		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
+		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-os=gentoo
+		--with-nscd
+		--with-unicode-lib="glib2"
+		--disable-rpath
+		--sbindir=/usr/sbin
+		--without-kcm
+		$(use_with samba libwbclient)
+		--with-secrets
+		$(multilib_native_use_with samba)
+		$(multilib_native_use_enable acl cifs-idmap-plugin)
+		$(multilib_native_use_with selinux)
+		$(multilib_native_use_with selinux semanage)
+		$(use_enable locator krb5-locator-plugin)
+		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
+		$(use_enable nls )
+		$(multilib_native_use_with netlink libnl)
+		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with sudo)
+		$(multilib_native_use_with autofs)
+		$(multilib_native_use_with ssh)
+		--with-crypto="nss"
+		--with-initscript="sysv"
+		--without-python2-bindings
+		--without-python3-bindings
+
+		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+	)
+
+	if ! multilib_is_native_abi; then
+		# work-around all the libraries that are used for CLI and server
+		myconf+=(
+			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
+			# ldb headers are fine since native needs it
+			# ldb lib fails... but it does not seem to bother
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+
+			# use native include path for dbus (needed for build)
+			DBUS_CFLAGS="${native_dbus_cflags}"
+
+			# non-pkgconfig checks
+			ac_cv_lib_ldap_ldap_search=yes
+			--without-secrets
+			--without-libwbclient
+			--without-kcm
+			--with-crypto=""
+		)
+
+		use locator || myconf+=(
+				KRB5_CONFIG=/bin/true
+		)
+	fi
+
+	econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi; then
+		default
+	else
+		emake libnss_sss.la pam_sss.la
+		use locator && emake sssd_krb5_locator_plugin.la
+	fi
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi; then
+		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+	else
+		# easier than playing with automake...
+		dopammod .libs/pam_sss.so
+
+		into /
+		dolib.so .libs/libnss_sss.so*
+
+		if use locator; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
+			doexe .libs/sssd_krb5_locator_plugin.so
+		fi
+	fi
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	insinto /etc/sssd
+	insopts -m600
+	doins "${S}"/src/examples/sssd-example.conf
+
+	insinto /etc/logrotate.d
+	insopts -m644
+	newins "${S}"/src/examples/logrotate sssd
+
+	newconfd "${FILESDIR}"/sssd.conf sssd
+	newinitd "${FILESDIR}"/sssd sssd
+
+	keepdir /var/lib/sss/db
+	keepdir /var/lib/sss/deskprofile
+	keepdir /var/lib/sss/gpo_cache
+	keepdir /var/lib/sss/keytabs
+	keepdir /var/lib/sss/mc
+	keepdir /var/lib/sss/pipes/private
+	keepdir /var/lib/sss/pubconf/krb5.include.d
+	keepdir /var/lib/sss/secrets
+	keepdir /var/log/sssd
+
+	systemd_dounit "${FILESDIR}/${PN}.service"
+}
+
+multilib_src_test() {
+	default
+}
+
+pkg_postinst() {
+	elog "You must set up sssd.conf (default installed into /etc/sssd)"
+	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
+	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
+}
diff --git a/sys-auth/thinkfinger/Manifest b/sys-auth/thinkfinger/Manifest
new file mode 100644
index 000000000000..fb1c0ff02d63
--- /dev/null
+++ b/sys-auth/thinkfinger/Manifest
@@ -0,0 +1 @@
+DIST thinkfinger-0.3.tar.gz 372053 BLAKE2B f9fc18cfa268f89d9e6d12245c80fead3238210f568df9e26be73525efc721a422701c96cfc5c2898c29541f1f48d9fe8be2b97e183f61d0cbf64d6a04f6e38e SHA512 08bbefd906047dd128c9a3d5eef4b14332e51383d9c0667974ffe7f85ccab2561310f58adfa0cfe8a65154e621a607542f6e99df9be3f21ced394bc7993db4ff
diff --git a/sys-auth/thinkfinger/files/0.3-carriagereturn.patch b/sys-auth/thinkfinger/files/0.3-carriagereturn.patch
new file mode 100644
index 000000000000..731f1531947b
--- /dev/null
+++ b/sys-auth/thinkfinger/files/0.3-carriagereturn.patch
@@ -0,0 +1,10 @@
+--- pam/pam_thinkfinger-uinput.c	2007-02-27 17:52:50.000000000 +0100
++++ pam/pam_thinkfinger-uinput.c	2009-02-17 13:56:02.013033249 +0100
+@@ -95,6 +95,7 @@
+ 	/* our single key keyboard */
+ 	i  = ioctl (*fd, UI_SET_EVBIT, EV_KEY) < 0;
+ 	i |= ioctl (*fd, UI_SET_KEYBIT, KEY_ENTER) < 0;
++	i |= ioctl (*fd, UI_SET_KEYBIT, KEY_A) < 0;
+ 
+ 	if (write (*fd, &device, device_size) != device_size) {
+ 		retval = errno;
diff --git a/sys-auth/thinkfinger/files/0.3-direct_set_config_usb_hello.patch b/sys-auth/thinkfinger/files/0.3-direct_set_config_usb_hello.patch
new file mode 100644
index 000000000000..06723ad1306c
--- /dev/null
+++ b/sys-auth/thinkfinger/files/0.3-direct_set_config_usb_hello.patch
@@ -0,0 +1,31 @@
+Index: libthinkfinger/libthinkfinger.c
+===================================================================
+--- libthinkfinger/libthinkfinger.c	(revision 118)
++++ libthinkfinger/libthinkfinger.c	(working copy)
+@@ -265,18 +265,7 @@
+ 	int retval = -1;
+ 	char dummy[] = "\x10";
+ 
+-	/* SET_CONFIGURATION 1 -- should not be relevant */
+ 	retval = usb_control_msg (handle,	 // usb_dev_handle *dev
+-				   0x00000000,	 // int requesttype
+-				   0x00000009,	 // int request
+-				   0x001,	 // int value
+-				   0x000,	 // int index
+-				   dummy,	 // char *bytes
+-				   0x00000000,	 // int size
+-				   USB_TIMEOUT); // int timeout
+-	if (retval < 0)
+-		goto out;
+-	retval = usb_control_msg (handle,	 // usb_dev_handle *dev
+ 				   0x00000040,	 // int requesttype
+ 				   0x0000000c,	 // int request
+ 				   0x100,	 // int value
+@@ -285,7 +274,6 @@
+ 				   0x00000001,	 // int size
+ 				   USB_TIMEOUT); // int timeout
+ 
+-out:
+ 	return retval;
+ }
+ 
diff --git a/sys-auth/thinkfinger/files/0.3-send-sync-event.patch b/sys-auth/thinkfinger/files/0.3-send-sync-event.patch
new file mode 100644
index 000000000000..39e0edb27ba1
--- /dev/null
+++ b/sys-auth/thinkfinger/files/0.3-send-sync-event.patch
@@ -0,0 +1,50 @@
+--- pam/pam_thinkfinger-uinput.c	2009-12-27 18:42:26.000000000 +0100
++++ pam/pam_thinkfinger-uinput.c	2009-12-27 18:41:55.000000000 +0100
+@@ -34,27 +34,40 @@
+ int uinput_cr (int *fd)
+ {
+ 	int retval = 0, ev_size = 0;
+-	struct input_event ev = {
++	struct input_event key_ev = {
+ 		.type = EV_KEY,
+ 		.code = KEY_ENTER,
+ 		.time = {0, }
+ 	};
+ 
+-	ev_size = sizeof (ev);
++	ev_size = sizeof (key_ev);
+ 
+ 	/* key press */
+-	ev.value = 1;
+-	if (write (*fd, &ev, ev_size) != ev_size) {
++	key_ev.value = 1;
++	if (write (*fd, &key_ev, ev_size) != ev_size) {
+ 		retval = errno;
+ 		goto out;
+ 	}
+ 	/* key release */
+-	ev.value = 0;
+-	if (write (*fd, &ev, ev_size) != ev_size) {
++	key_ev.value = 0;
++	if (write (*fd, &key_ev, ev_size) != ev_size) {
+ 		retval = errno;
+ 		goto out;
+ 	}
+-
++	
++	/* syn event */
++	struct input_event syn_ev = {
++	  .time = {0, },
++	  .type = EV_SYN,
++	  .code = SYN_REPORT,
++	  .value = 0
++	};
++	
++	if (write (*fd, &syn_ev, ev_size) != ev_size) {
++		retval = errno;
++		goto out;
++	}
++    
+ out:
+ 	return retval;
+ }
diff --git a/sys-auth/thinkfinger/files/0.3-strip-strip.patch b/sys-auth/thinkfinger/files/0.3-strip-strip.patch
new file mode 100644
index 000000000000..1339baf63a00
--- /dev/null
+++ b/sys-auth/thinkfinger/files/0.3-strip-strip.patch
@@ -0,0 +1,24 @@
+Strip is handled by the package manager.
+
+--- a/pam/Makefile.am
++++ b/pam/Makefile.am
+@@ -8,7 +8,7 @@ pam_thinkfinger_so_SOURCES = pam_thinkfinger-compat.c pam_thinkfinger-compat.h p
+ else
+ pam_thinkfinger_so_SOURCES = pam_thinkfinger-uinput.c pam_thinkfinger-uinput.h pam_thinkfinger.c
+ endif
+-pam_thinkfinger_so_LDFLAGS = -shared --strip-all -Wl,-soname,pam_thinkfinger.so -Wl,--as-needed
++pam_thinkfinger_so_LDFLAGS = -shared -Wl,-soname,pam_thinkfinger.so -Wl,--as-needed
+ pam_thinkfinger_so_CFLAGS = $(CFLAGS)
+ pam_thinkfinger_so_LDADD = $(top_builddir)/libthinkfinger/libthinkfinger.la $(PAM_LIBS) $(PTHREAD_LIBS)
+ 
+--- a/pam/Makefile.in
++++ b/pam/Makefile.in
+@@ -201,7 +201,7 @@ pamdir = $(SECUREDIR)
+ INCLUDES = -I$(top_srcdir)/libthinkfinger
+ @HAVE_OLD_PAM_FALSE@pam_thinkfinger_so_SOURCES = pam_thinkfinger-uinput.c pam_thinkfinger-uinput.h pam_thinkfinger.c
+ @HAVE_OLD_PAM_TRUE@pam_thinkfinger_so_SOURCES = pam_thinkfinger-compat.c pam_thinkfinger-compat.h pam_thinkfinger-uinput.c pam_thinkfinger-uinput.h pam_thinkfinger.c
+-pam_thinkfinger_so_LDFLAGS = -shared --strip-all -Wl,-soname,pam_thinkfinger.so -Wl,--as-needed
++pam_thinkfinger_so_LDFLAGS = -shared -Wl,-soname,pam_thinkfinger.so -Wl,--as-needed
+ pam_thinkfinger_so_CFLAGS = $(CFLAGS)
+ pam_thinkfinger_so_LDADD = $(top_builddir)/libthinkfinger/libthinkfinger.la $(PAM_LIBS) $(PTHREAD_LIBS)
+ all: all-am
diff --git a/sys-auth/thinkfinger/files/0.3-tftoolgroup.patch b/sys-auth/thinkfinger/files/0.3-tftoolgroup.patch
new file mode 100644
index 000000000000..169b7cefe286
--- /dev/null
+++ b/sys-auth/thinkfinger/files/0.3-tftoolgroup.patch
@@ -0,0 +1,64 @@
+--- tf-tool/tf-tool.c	2007-03-30 11:00:45.000000000 +0200
++++ tf-tool/tf-tool.c	2009-02-18 14:57:24.316197097 +0100
+@@ -26,6 +26,9 @@
+ #include <errno.h>
+ #include <libgen.h>
+ #include <pwd.h>
++#include <grp.h>
++#include <sys/stat.h>
++#include <unistd.h>
+ 
+ #include <config.h>
+ #include <libthinkfinger.h>
+@@ -54,6 +57,21 @@
+ 	int swipe_failed;
+ } s_tfdata;
+ 
++int changegroup(const char *groupname,const char *filename)
++{
++	struct group *g;
++	g = getgrnam(groupname);
++	if(g == NULL) {
++		perror("getgrnam:");
++		return 1;
++	}
++	if( chown(filename,-1,g->gr_gid) == -1) {
++		perror("chown: ");
++		return 1;	
++	}
++	return 0;
++}
++
+ static void print_status (int swipe_success, int swiped_required, int swipe_failed)
+ {
+ 	printf ("\rPlease swipe your finger (successful swipes %i/%i, failed swipes: %i)...",
+@@ -64,6 +82,8 @@
+ static void callback (libthinkfinger_state state, void *data)
+ {
+ 	char *str;
++	int err;
++	gid_t gfp;
+ 	s_tfdata *tfdata = (s_tfdata *) data;
+ 
+ 	if (tfdata->verbose == true) {
+@@ -108,8 +128,18 @@
+ 			case TF_STATE_ENROLL_SUCCESS:
+ 				print_status (tfdata->swipe_success, 3, tfdata->swipe_failed);
+ 				printf (" done.\nStoring data (%s)...", tfdata->bir);
+-				fflush (stdout);
+-				break;
++				/*small hack to change group and chmod 640 on created bir file*/
++				err = chmod(tfdata->bir, S_IRUSR | S_IWUSR | S_IRGRP);
++				if(err == -1) { 
++					printf("Couldn't change perms on file %s\n",tfdata->bir);
++					perror("chmod:");
++					fflush(stdout);
++					break;
++				}
++				changegroup("fingerprint",tfdata->bir);
++				fflush(stdout);
++				break;	
++				/*done*/
+ 			case TF_STATE_SWIPE_FAILED:
+ 				print_status (tfdata->swipe_success, 3, ++tfdata->swipe_failed);
+ 				break;
diff --git a/sys-auth/thinkfinger/files/60-thinkfinger.rules b/sys-auth/thinkfinger/files/60-thinkfinger.rules
new file mode 100644
index 000000000000..1ccc394d49ff
--- /dev/null
+++ b/sys-auth/thinkfinger/files/60-thinkfinger.rules
@@ -0,0 +1,5 @@
+# SGS Thomson Microelectronics Fingerprint Reader
+ATTRS{idVendor}=="0483", ATTRS{idProduct}=="2016", SYMLINK+="input/thinkfinger-%k", MODE="0660", GROUP="fingerprint"
+
+# the also-needed uinput device
+KERNEL=="uinput", MODE="0660", GROUP="fingerprint"
diff --git a/sys-auth/thinkfinger/metadata.xml b/sys-auth/thinkfinger/metadata.xml
new file mode 100644
index 000000000000..f3c589d02492
--- /dev/null
+++ b/sys-auth/thinkfinger/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<!-- maintainer-needed -->
+<upstream>
+	<remote-id type="sourceforge">ThinkFinger</remote-id>
+</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/thinkfinger/thinkfinger-0.3-r3.ebuild b/sys-auth/thinkfinger/thinkfinger-0.3-r3.ebuild
new file mode 100644
index 000000000000..730d8745e2c1
--- /dev/null
+++ b/sys-auth/thinkfinger/thinkfinger-0.3-r3.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="4"
+
+inherit autotools-utils user linux-info pam
+
+DESCRIPTION="Support for the UPEK/SGS Thomson fingerprint reader, common in Thinkpads"
+HOMEPAGE="http://thinkfinger.sourceforge.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug pam static-libs"
+
+RDEPEND="virtual/libusb:0
+	pam? ( sys-libs/pam )"
+DEPEND="${RDEPEND}
+	sys-devel/libtool
+	virtual/pkgconfig"
+
+PATCHES=(
+	"${FILESDIR}"/${PV}-direct_set_config_usb_hello.patch
+	"${FILESDIR}"/${PV}-carriagereturn.patch
+	"${FILESDIR}"/${PV}-send-sync-event.patch
+	"${FILESDIR}"/${PV}-tftoolgroup.patch
+	"${FILESDIR}"/${PV}-strip-strip.patch
+)
+
+pkg_setup() {
+	if use pam ; then
+		CONFIG_CHECK="~INPUT_UINPUT"
+		ERROR_CFG="Your kernel needs uinput for the pam module to work"
+		check_extra_config
+	fi
+}
+
+src_configure() {
+	local myeconfargs=(
+		$(use_enable pam) \
+		$(use_enable debug usb-debug) \
+		"--with-securedir=$(getpam_mod_dir)"
+	)
+	autotools-utils_src_configure
+}
+
+src_install() {
+	DOCS=( AUTHORS ChangeLog NEWS README )
+	autotools-utils_src_install
+
+	keepdir /etc/pam_thinkfinger
+	insinto /lib/udev/rules.d
+	doins "${FILESDIR}"/60-thinkfinger.rules
+}
+
+pkg_preinst() {
+	enewgroup fingerprint
+}
+
+pkg_postinst() {
+	fowners root:fingerprint /etc/pam_thinkfinger
+	fperms 710 /etc/pam_thinkfinger
+	elog "Use tf-tool --acquire to take a finger print"
+	elog "tf-tool will write the finger print file to /tmp/test.bir"
+	elog ""
+	if use pam ; then
+		elog "To add a fingerprint to PAM, use tf-tool --add-user USERNAME"
+		elog ""
+		elog "Add the following to /etc/pam.d/system-auth after pam_env.so"
+		elog "auth     sufficient     pam_thinkfinger.so"
+		elog ""
+		elog "Your system-auth should look similar to:"
+		elog "auth     required     pam_env.so"
+		elog "auth     sufficient   pam_thinkfinger.so"
+		elog "auth     sufficient   pam_unix.so try_first_pass likeauth nullok"
+		elog ""
+	fi
+}
diff --git a/sys-auth/ykclient/Manifest b/sys-auth/ykclient/Manifest
new file mode 100644
index 000000000000..e08f204b5de6
--- /dev/null
+++ b/sys-auth/ykclient/Manifest
@@ -0,0 +1 @@
+DIST ykclient-2.15.tar.gz 388738 BLAKE2B 10f56d97c337de5ae8fe15fb526f89208e8e69563cd7b2f1494e5a972da0a218c1c89e608ed490b7f17efc619bfeacfb51d1615b6eff36d4bfa5351cf80e4061 SHA512 a6e00309330225c681702616aa9f5d7e042f33a22ebe7719c2d71276f1a660ed0dc180d7f50c24b1c65d7bba6e2f2285d03037d504e926ac75506c24e6826279
diff --git a/sys-auth/ykclient/metadata.xml b/sys-auth/ykclient/metadata.xml
new file mode 100644
index 000000000000..12ad9dffc7d3
--- /dev/null
+++ b/sys-auth/ykclient/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<!-- maintainer-needed -->  
+  <upstream>
+    <remote-id type="google-code">yubico-c-client</remote-id>
+    <remote-id type="github">Yubico/yubico-c-client</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/ykclient/ykclient-2.15.ebuild b/sys-auth/ykclient/ykclient-2.15.ebuild
new file mode 100644
index 000000000000..cec75e52208d
--- /dev/null
+++ b/sys-auth/ykclient/ykclient-2.15.ebuild
@@ -0,0 +1,19 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="Yubico C client library"
+SRC_URI="http://opensource.yubico.com/yubico-c-client/releases/${P}.tar.gz"
+HOMEPAGE="https://github.com/Yubico/yubico-c-client"
+
+KEYWORDS="~amd64 ~x86"
+SLOT="0"
+LICENSE="BSD-2"
+IUSE="static-libs"
+
+RDEPEND=">=net-misc/curl-7.21.1"
+DEPEND="${RDEPEND}"
+
+# Tests require an active network connection, we don't want to run them
+RESTRICT="test"
diff --git a/sys-auth/ykneo-ccid-tools/Manifest b/sys-auth/ykneo-ccid-tools/Manifest
new file mode 100644
index 000000000000..2747cdfabf62
--- /dev/null
+++ b/sys-auth/ykneo-ccid-tools/Manifest
@@ -0,0 +1 @@
+DIST ykneo-ccid-tools-0.0.0.tar.gz 298831 BLAKE2B abe3cf35eab7afae56e16665735f8ce5aa436e8d1a7b98c7ac5f88a129ad2cb4331e40839c017b5384f442b0e365f7c0f414abe8dbcbbea5af08f13d8b3f5a54 SHA512 735fbdee9e307b8fa1304b5ebc1fc490807e3b4cd67b62c4faa100fe9ac2915b8c1c979820078e0035ddb9d304460c7bae601ad89f358101faae2f13d066d864
diff --git a/sys-auth/ykneo-ccid-tools/files/ykneo-ccid-tools-0.0.0-string.patch b/sys-auth/ykneo-ccid-tools/files/ykneo-ccid-tools-0.0.0-string.patch
new file mode 100644
index 000000000000..7a4b70b82f82
--- /dev/null
+++ b/sys-auth/ykneo-ccid-tools/files/ykneo-ccid-tools-0.0.0-string.patch
@@ -0,0 +1,11 @@
+diff -urN ykneo-ccid-tools-0.0.0.orig/NEO_Config.c ykneo-ccid-tools-0.0.0/NEO_Config.c
+--- ykneo-ccid-tools-0.0.0.orig/NEO_Config.c	2012-12-20 21:30:44.000000000 +0100
++++ ykneo-ccid-tools-0.0.0/NEO_Config.c	2013-08-12 16:40:18.109041000 +0200
+@@ -9,6 +9,7 @@
+ 
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <string.h>
+ #include <neo_if.h>
+ 
+ #pragma pack(push, 1)
diff --git a/sys-auth/ykneo-ccid-tools/metadata.xml b/sys-auth/ykneo-ccid-tools/metadata.xml
new file mode 100644
index 000000000000..70b84a1fe547
--- /dev/null
+++ b/sys-auth/ykneo-ccid-tools/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <!-- maintainer-needed -->
+  <upstream>
+    <remote-id type="github">Yubico/ykneo-ccid-tools</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
+
diff --git a/sys-auth/ykneo-ccid-tools/ykneo-ccid-tools-0.0.0.ebuild b/sys-auth/ykneo-ccid-tools/ykneo-ccid-tools-0.0.0.ebuild
new file mode 100644
index 000000000000..08d2001b65e5
--- /dev/null
+++ b/sys-auth/ykneo-ccid-tools/ykneo-ccid-tools-0.0.0.ebuild
@@ -0,0 +1,26 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils udev
+
+DESCRIPTION="Tools for Yubico's YubiKey NEO in CCID mode"
+SRC_URI="http://yubico.github.io/ykneo-ccid-tools/releases/${P}.tar.gz"
+HOMEPAGE="https://github.com/Yubico/ykneo-ccid-tools"
+
+KEYWORDS="~amd64 ~x86"
+SLOT="0"
+LICENSE="BSD-2"
+IUSE=""
+
+RDEPEND="sys-apps/pcsc-lite"
+DEPEND="${RDEPEND}
+	sys-apps/help2man
+	dev-util/gengetopt"
+
+DOCS=( AUTHORS NEWS README )
+
+src_prepare() {
+	epatch "${FILESDIR}/${P}-string.patch"
+}
diff --git a/sys-auth/ykpers/Manifest b/sys-auth/ykpers/Manifest
new file mode 100644
index 000000000000..75bb2f3628a0
--- /dev/null
+++ b/sys-auth/ykpers/Manifest
@@ -0,0 +1,2 @@
+DIST ykpers-1.19.3.tar.gz 127789 BLAKE2B 8dfc2751be92e69fcf98f5dc75d87eb170a4f70ff13faa321a85d4a04e27818823acbf02284ba23cb78ea758111513457ced4cdaa6961621a91f68b059eff378 SHA512 436c9807e488f7b324b892da7bfc7ea93e2b746cc3ae075822e9e8bfe478ef8e61c194127e5d4f50f6c1d9512292640d033464cceb6b8a18069411ff7993cc52
+DIST ykpers-1.20.0.tar.gz 127975 BLAKE2B 8753332be4df3eeb6ef0489782037fca12883a263d5697cfaee901763e4698ca5415953da1c2f8b3512de041c1e78735c03a5e6ea2101c71ada36d4e6d5d3d2d SHA512 a38b26700793f0a801e5f5889bbbce4a3f728d22aaecf8d0890f1b5135e67bed16a78b7a36dbc323c5d296901f6dd420fa658a982492a0cd9f0bbf95a5fbc823
diff --git a/sys-auth/ykpers/files/ykpers-1.20.0-fix-gcc10-fno-common.patch b/sys-auth/ykpers/files/ykpers-1.20.0-fix-gcc10-fno-common.patch
new file mode 100644
index 000000000000..dcff56ad0863
--- /dev/null
+++ b/sys-auth/ykpers/files/ykpers-1.20.0-fix-gcc10-fno-common.patch
@@ -0,0 +1,13 @@
+--- a/ykpers-args.h
++++ b/ykpers-args.h
+@@ -33,8 +33,8 @@
+ 
+ #include "ykpers.h"
+ 
+-const char *usage;
+-const char *optstring;
++extern const char *usage;
++extern const char *optstring;
+ 
+ int args_to_config(int argc, char **argv, YKP_CONFIG *cfg, char *oathid,
+ 		   size_t oathid_len, const char **infname,
diff --git a/sys-auth/ykpers/files/ykpers-1.20.0-json-boolean.patch b/sys-auth/ykpers/files/ykpers-1.20.0-json-boolean.patch
new file mode 100644
index 000000000000..ca5a918d21f1
--- /dev/null
+++ b/sys-auth/ykpers/files/ykpers-1.20.0-json-boolean.patch
@@ -0,0 +1,83 @@
+From 0aa2e2cae2e1777863993a10c809bb50f4cde7f8 Mon Sep 17 00:00:00 2001
+From: Christian Hesse <mail@eworm.de>
+Date: Sat, 25 Apr 2020 20:55:28 +0200
+Subject: [PATCH] fix boolean value with json-c 0.14
+
+Upstream removed the TRUE and FALSE defines in commit
+0992aac61f8b087efd7094e9ac2b84fa9c040fcd.
+---
+ ykpers-json.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/ykpers-json.c b/ykpers-json.c
+index a62e907..15ad380 100644
+--- a/ykpers-json.c
++++ b/ykpers-json.c
+@@ -40,7 +40,7 @@
+ #define yk_json_object_object_get(obj, key, value) json_object_object_get_ex(obj, key, &value)
+ #else
+ typedef int json_bool;
+-#define yk_json_object_object_get(obj, key, value) (value = json_object_object_get(obj, key)) == NULL ? (json_bool)FALSE : (json_bool)TRUE
++#define yk_json_object_object_get(obj, key, value) (value = json_object_object_get(obj, key)) == NULL ? 0 : 1
+ #endif
+ 
+ static void set_json_value(struct map_st *p, int mode, json_object *options, YKP_CONFIG *cfg) {
+@@ -50,7 +50,7 @@ static void set_json_value(struct map_st *p, int mode, json_object *options, YKP
+ 	if(p->mode && (mode & p->mode) == mode) {
+ 		json_object *joption;
+ 		json_bool ret = yk_json_object_object_get(options, p->json_text, joption);
+-		if(ret == TRUE && json_object_get_type(joption) == json_type_boolean) {
++		if(ret == 1 && json_object_get_type(joption) == json_type_boolean) {
+ 			int value = json_object_get_boolean(joption);
+ 			if(value == 1) {
+ 				p->setter(cfg, true);
+@@ -230,20 +230,20 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) {
+ 			ykp_errno = YKP_EINVAL;
+ 			goto out;
+ 		}
+-		if(yk_json_object_object_get(jobj, "yubiProdConfig", yprod_json) == FALSE) {
++		if(yk_json_object_object_get(jobj, "yubiProdConfig", yprod_json) == 0) {
+ 			ykp_errno = YKP_EINVAL;
+ 			goto out;
+ 		}
+-		if(yk_json_object_object_get(yprod_json, "mode", jmode) == FALSE) {
++		if(yk_json_object_object_get(yprod_json, "mode", jmode) == 0) {
+ 			ykp_errno = YKP_EINVAL;
+ 			goto out;
+ 		}
+-		if(yk_json_object_object_get(yprod_json, "options", options) == FALSE) {
++		if(yk_json_object_object_get(yprod_json, "options", options) == 0) {
+ 			ykp_errno = YKP_EINVAL;
+ 			goto out;
+ 		}
+ 
+-		if(yk_json_object_object_get(yprod_json, "targetConfig", jtarget) == TRUE) {
++		if(yk_json_object_object_get(yprod_json, "targetConfig", jtarget) == 1) {
+ 			int target_config = json_object_get_int(jtarget);
+ 			int command;
+ 			if(target_config == 1) {
+@@ -275,13 +275,13 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) {
+ 		if(mode == MODE_OATH_HOTP) {
+ 			json_object *jdigits, *jrandom;
+ 			ykp_set_tktflag_OATH_HOTP(cfg, true);
+-			if(yk_json_object_object_get(options, "oathDigits", jdigits) == TRUE) {
++			if(yk_json_object_object_get(options, "oathDigits", jdigits) == 1) {
+ 				int digits = json_object_get_int(jdigits);
+ 				if(digits == 8) {
+ 					ykp_set_cfgflag_OATH_HOTP8(cfg, true);
+ 				}
+ 			}
+-			if(yk_json_object_object_get(options, "randomSeed", jrandom) == TRUE) {
++			if(yk_json_object_object_get(options, "randomSeed", jrandom) == 1) {
+ 				int random = json_object_get_boolean(jrandom);
+ 				int seed = 0;
+ 				if(random == 1) {
+@@ -290,7 +290,7 @@ int _ykp_json_import_cfg(YKP_CONFIG *cfg, const char *json, size_t len) {
+ 					goto out;
+ 				} else {
+ 					json_object *jseed;
+-					if(yk_json_object_object_get(options, "fixedSeedvalue", jseed) == TRUE) {
++					if(yk_json_object_object_get(options, "fixedSeedvalue", jseed) == 1) {
+ 						seed = json_object_get_int(jseed);
+ 					}
+ 				}
diff --git a/sys-auth/ykpers/metadata.xml b/sys-auth/ykpers/metadata.xml
new file mode 100644
index 000000000000..385feb41a6d1
--- /dev/null
+++ b/sys-auth/ykpers/metadata.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <maintainer type="person">
+    <email>gokturk@gentoo.org</email>
+    <name>Göktürk Yüksek</name>
+  </maintainer>
+  <upstream>
+    <remote-id type="github">Yubico/yubikey-personalization</remote-id>
+    <bugs-to>https://github.com/Yubico/yubikey-personalization/issues</bugs-to>
+  </upstream>
+  <use>
+    <flag name="consolekit">
+      Use <pkg>sys-auth/consolekit</pkg> and <pkg>virtual/udev</pkg>
+      to allow access to the YubiKey HID device to the console user.
+    </flag>
+  </use>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild b/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild
new file mode 100644
index 000000000000..fbbae20cc15f
--- /dev/null
+++ b/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools udev
+
+DESCRIPTION="Library and tool for personalization of Yubico's YubiKey"
+SRC_URI="https://github.com/Yubico/yubikey-personalization/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+HOMEPAGE="https://github.com/Yubico/yubikey-personalization"
+
+KEYWORDS="amd64 x86"
+SLOT="0"
+LICENSE="BSD-2"
+IUSE="consolekit static-libs"
+
+DEPEND="
+	dev-libs/json-c:=
+	>=sys-auth/libyubikey-1.6
+	virtual/libusb:1"
+BDEPEND="
+	app-text/asciidoc
+	virtual/pkgconfig"
+RDEPEND="${DEPEND}
+	consolekit? ( sys-auth/consolekit[acl] )
+"
+
+S="${WORKDIR}/yubikey-personalization-${PV}"
+
+DOCS=( doc/. AUTHORS NEWS README )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--libdir=/usr/$(get_libdir)
+		--localstatedir=/var
+		$(use_enable static-libs static)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	udev_dorules 69-yubikey.rules
+	if use consolekit ; then
+		udev_dorules 70-yubikey.rules
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/ykpers/ykpers-1.20.0.ebuild b/sys-auth/ykpers/ykpers-1.20.0.ebuild
new file mode 100644
index 000000000000..f787df6a2140
--- /dev/null
+++ b/sys-auth/ykpers/ykpers-1.20.0.ebuild
@@ -0,0 +1,59 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools udev
+
+DESCRIPTION="Library and tool for personalization of Yubico's YubiKey"
+SRC_URI="https://github.com/Yubico/yubikey-personalization/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+HOMEPAGE="https://github.com/Yubico/yubikey-personalization"
+
+KEYWORDS="amd64 ~arm64 x86"
+SLOT="0"
+LICENSE="BSD-2"
+IUSE="consolekit static-libs"
+
+DEPEND="
+	dev-libs/json-c:=
+	>=sys-auth/libyubikey-1.6
+	virtual/libusb:1"
+BDEPEND="
+	app-text/asciidoc
+	virtual/pkgconfig"
+RDEPEND="${DEPEND}
+	consolekit? ( sys-auth/consolekit[acl] )
+"
+
+S="${WORKDIR}/yubikey-personalization-${PV}"
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.20.0-fix-gcc10-fno-common.patch
+	"${FILESDIR}"/${PN}-1.20.0-json-boolean.patch
+)
+
+DOCS=( doc/. AUTHORS NEWS README )
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	local myeconfargs=(
+		--libdir=/usr/$(get_libdir)
+		--localstatedir=/var
+		$(use_enable static-libs static)
+	)
+	econf "${myeconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	udev_dorules 69-yubikey.rules
+	if use consolekit ; then
+		udev_dorules 70-yubikey.rules
+	fi
+
+	find "${D}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/yubico-piv-tool/Manifest b/sys-auth/yubico-piv-tool/Manifest
new file mode 100644
index 000000000000..4b8764da7677
--- /dev/null
+++ b/sys-auth/yubico-piv-tool/Manifest
@@ -0,0 +1 @@
+DIST yubico-piv-tool-1.6.2.tar.gz 182957 BLAKE2B 0ca9bdcda68f7ee100078604854caccc5141ab01e40f894ae36c3175afa3989c1d0074ef0994e1e369d67499a9778e22f0c5a3cf930d1ba162b0ee0ddbc05f91 SHA512 fc72b9d381f10b63c8958b6c90c1ee97e3ef6b5fb283a9513e6f2ace972710c2872903f38350d9e4a3576b16cb0890b067dd55f5c125f443d353df3f628a9f96
diff --git a/sys-auth/yubico-piv-tool/metadata.xml b/sys-auth/yubico-piv-tool/metadata.xml
new file mode 100644
index 000000000000..9004ea09b7cd
--- /dev/null
+++ b/sys-auth/yubico-piv-tool/metadata.xml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<!-- maintainer-needed -->
+	<upstream>
+		<remote-id type="github">Yubico/yubico-piv-tool</remote-id>
+	</upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
diff --git a/sys-auth/yubico-piv-tool/yubico-piv-tool-1.6.2.ebuild b/sys-auth/yubico-piv-tool/yubico-piv-tool-1.6.2.ebuild
new file mode 100644
index 000000000000..64ebd5a99bb2
--- /dev/null
+++ b/sys-auth/yubico-piv-tool/yubico-piv-tool-1.6.2.ebuild
@@ -0,0 +1,49 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools
+
+DESCRIPTION="Command line tool for the YubiKey PIV application"
+SRC_URI="https://github.com/Yubico/yubico-piv-tool/archive/yubico-piv-tool-${PV}.tar.gz"
+HOMEPAGE="https://developers.yubico.com/yubico-piv-tool/ https://github.com/Yubico/yubico-piv-tool"
+
+LICENSE="BSD-2"
+SLOT="0/1"
+KEYWORDS="~amd64"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	dev-libs/openssl:0=[-bindist]
+	sys-apps/pcsc-lite
+"
+DEPEND="${RDEPEND}
+	dev-util/gengetopt
+	sys-apps/help2man
+	virtual/pkgconfig
+	test? ( dev-libs/check )
+"
+
+S=${WORKDIR}/${PN}-${P}
+
+src_prepare() {
+	default
+
+	if ! use test; then
+		sed -i -e "/PKG_CHECK_MODULES(\[CHECK/d" configure.ac || die
+		sed -i -e "s/@CHECK_CFLAGS@//" -e "s/@CHECK_LIBS@//" */*/Makefile.am || die
+	fi
+
+	eautoreconf
+}
+
+src_configure() {
+	econf --disable-static
+}
+
+src_install() {
+	default
+	rm "${D}"/usr/$(get_libdir)/*.la || die
+}
diff --git a/sys-auth/yubikey-personalization-gui/Manifest b/sys-auth/yubikey-personalization-gui/Manifest
new file mode 100644
index 000000000000..cecb9a1e3a11
--- /dev/null
+++ b/sys-auth/yubikey-personalization-gui/Manifest
@@ -0,0 +1 @@
+DIST yubikey-personalization-gui-3.1.25.tar.gz 942121 BLAKE2B edc581824f917b50664dd758a0447fa9a61c85844cd220d82661c9e1f1bbabc1bda77545c1eda2e56a43b8176479c1b161f8e9ad5feb3d61cdc37d301ebde9fc SHA512 6d45c2a9e9c452a44fba5ff3830150ce65e968899215c59fd7b412317143015c466ac706dcfa49def2c4304a01866a3674ba7cc37e47dff4e8c6acb8166fcf45
diff --git a/sys-auth/yubikey-personalization-gui/metadata.xml b/sys-auth/yubikey-personalization-gui/metadata.xml
new file mode 100644
index 000000000000..6120c58449d5
--- /dev/null
+++ b/sys-auth/yubikey-personalization-gui/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+  <!-- maintainer-needed -->
+  <upstream>
+    <remote-id type="github">Yubico/yubikey-personalization</remote-id>
+  </upstream>
+	<origin>gentoo-staging</origin>
+</pkgmetadata>
+
diff --git a/sys-auth/yubikey-personalization-gui/yubikey-personalization-gui-3.1.25.ebuild b/sys-auth/yubikey-personalization-gui/yubikey-personalization-gui-3.1.25.ebuild
new file mode 100644
index 000000000000..da1f5b25b331
--- /dev/null
+++ b/sys-auth/yubikey-personalization-gui/yubikey-personalization-gui-3.1.25.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit desktop flag-o-matic qmake-utils
+
+DESCRIPTION="GUI for personalization of Yubico's YubiKey"
+HOMEPAGE="https://github.com/Yubico/yubikey-personalization-gui"
+SRC_URI="https://github.com/Yubico/yubikey-personalization-gui/archive/${P}.tar.gz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE="debug test"
+
+RESTRICT="!test? ( test )"
+
+BDEPEND="
+	virtual/pkgconfig"
+RDEPEND="
+	dev-libs/glib:2
+	dev-qt/qtcore:5
+	dev-qt/qtgui:5
+	dev-qt/qtwidgets:5
+	>=sys-auth/libyubikey-1.6
+	>=sys-auth/ykpers-1.14.0
+	virtual/libusb:1"
+DEPEND="${RDEPEND}
+	test? ( dev-qt/qttest:5 )"
+
+S="${WORKDIR}/${PN}-${P}"
+
+src_prepare() {
+	default
+	if ! use test ; then
+		sed -i YKPersonalization.pro \
+			-e 's/src \\/src/' \
+			-e '/tests/d' || die
+	fi
+}
+
+src_configure() {
+	append-cxxflags -std=c++11
+
+	eqmake5 "CONFIG+=nosilent" YKPersonalization.pro
+}
+
+src_install() {
+	dobin build/release/yubikey-personalization-gui
+	doman resources/lin/yubikey-personalization-gui.1
+	domenu resources/lin/yubikey-personalization-gui.desktop
+	doicon resources/lin/yubikey-personalization-gui.xpm
+	doicon -s 128 resources/lin/yubikey-personalization-gui.png
+}
author	Palica <palica+gitlab@liguros.net>	2020-06-23 22:35:08 +0200
committer	Palica <palica+gitlab@liguros.net>	2020-06-23 22:35:08 +0200
commit	ecdac123787b96ce6649f0f91da12ea6458cc2b1 (patch)
tree	b89c74d9e6fe6e8aebc4c77bcbeb4ab73214127d /sys-auth
parent	1be72aa41cf41dedadeecf59dca9f01de6381f5e (diff)
download	baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.tar.gz baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.tar.xz baldeagleos-repo-ecdac123787b96ce6649f0f91da12ea6458cc2b1.zip