gentoo auto-resync : 22:11:2023 - 05:13:16

6 files changed, 368 insertions, 4 deletions

diff --git a/app-office/Manifest.gz b/app-office/Manifest.gz
index f53c58d65224..a5b72998d596 100644
--- a/app-office/Manifest.gz
+++ b/app-office/Manifest.gz
diff --git a/app-office/libreoffice/Manifest b/app-office/libreoffice/Manifest
index eab2c61b3771..ba5874bdebfb 100644
--- a/app-office/libreoffice/Manifest
+++ b/app-office/libreoffice/Manifest
@@ -2,7 +2,9 @@ AUX libreoffice-5.3.4.2-kioclient5.patch 605 BLAKE2B 30961066c080c4d06ca978b7c0a
 AUX libreoffice-6.1-nomancompress.patch 967 BLAKE2B e60afbfd7007a5fab7291ffba34369137336327f4d1ee27789c5f6229b9a82f4aeab0eaeaf494e60b992c66fcdb276b6423b87713febb14e9eeaffa388369ca8 SHA512 f82e23f15cefd947af20a50e1e4168c9023d5f8b9e19da7f76b141a60be4fa3516ad16400ce26e4d0ff293c570031ac87bbbf6766444e1b31e7bc3ee8ef58083
 AUX libreoffice-7.2.0.4-qt5detect.patch 536 BLAKE2B fd77876d1ca3973ad30c9ebb60bf28e163dd29dcaebaa2b94d84f4c2ab060617d96f4df3d5114f17f882b0cb8b9e2ecdb284fdd1e4aaf8a34cc0c1f06a295c04 SHA512 e1ac7dfc4743cbdea3050b18c1714d06c8bcca4abc51d56e13362c8379fbdd3d37a1916c962fcb1389783c9b1fd72783c9ee45fbb649538ca0fc0cb7b05bcacf
 AUX libreoffice-7.5.6.2-gcc-14.patch 2056 BLAKE2B 1bc549e8afcb2720f2c25b7df1facd4aabf239dd91e85014c5cf33392718a81408e0318f300ad297795f5c7f0dbf1ad7fd8d48428f54f56523c439a9137ab185 SHA512 0579a167aed562c40dfe949459d9d8417fbd27e5cfdd2fa952b34c8207e8e6064a466a1fdf22780eb91cfb0e0cc788c7d99b9f0145249025e18acba14f2e07b2
+AUX libreoffice-7.5.8.2-curl-8.3.0-mitigation.patch 11727 BLAKE2B a3c82b6802595b61ea6967b616820057ea6548626b6833e79c68345eb1e4317a7f8e26d3be737dc4cb37ed87e0add1aab5854fb761652f4d53fb406e66a521c1 SHA512 1a94ddfee57e2e1bd9794164682de11347cb4134b46da54748871d3684c0b2b63f2025eeeca5d74c6883f0b18a5393371d162cbbd27de38733c136c607215660
 AUX libreoffice-7.5.8.2-icu-74-compatibility.patch 5299 BLAKE2B b1c12af133c48ef3e586c41f2fa1cd4b7b6c4d7e93d783ada5c3670a30eb7e2bf3039df242d2f186270810b479621b38f4e91cde6428ee6453170eaffe326a56 SHA512 d64618c007d35ea873d25c7e40058fdc50de29ce1fe2c573aa8b9d628094d681af8ef31e4cd992b0baa996b097dec9c0a28e4d5881ac17b7916ec3bf330f4128
+AUX libreoffice-7.5.8.2-libcmis-0.6.patch 1501 BLAKE2B c9ca894061e1439ead362432d969a27ea8ae96d2a86baec46085ec3e9e62871ea127f52afa9be5ef214e5e9b91d8cf9600610c1867d14ea0230ecafb519c42ce SHA512 9fea4cc4e4378e48faa0b27db8d0308c50d974ff8fa3cc971bc4cad3f9b08467ab97c44e03424dd1f0fa73f27826cb6403bac04ae0879c6b8e3a0436110675c9
 AUX libreoffice.confd 228 BLAKE2B 7b9ed0d08b91b6e78dd3a2ac242cac48ef141c25bf25713b5fa6c4fdea3d5b0e16b4073a864fbec328edf4008729869fba5236e9cc113ba9bd3d6de5c10153c3 SHA512 6718cfd481b4349d70b718d4811f80ac0eff60d465b9f9eeff8ab9641de1fecb6197023f98bb1fca77a57b48ae2d8e38803f3af3a51191b1df71aa8cc5d33661
 AUX libreoffice.initd 507 BLAKE2B d49fd0f48254160fff3eb90a75294c6cf044805352a982ab3d2127426a18a6171e5043c071b59581a1f927a7c499c8abb58820081c6ba6e285097c883917f0e3 SHA512 fee4720898510b1aa07a9ed597d041d1e1edfb8f8b8e9596ef4254d4d3c1e8a959bbd65202a377289910ed28283f9c8a4bdc893d2d0835f37ee28cd3c7cb010d
 DIST 17410483b5b5f267aa18b7e00b65e6e0-hsqldb_1_8_0.zip 3519470 BLAKE2B ccfdf6b7f88f22d3ec7898c529c374f13059979450aabdccc9781ca91dd27d0119dfec3d33dda073c2973fa4a8aacae13924c9a67e38a1422c48bfee41b6f3e8 SHA512 a231eba4a1baca11766ef292ab45e302081115477fe23018652882923308856835cf8c9ecba61a5cf22543474ccef3136965d794a90c9e4e9e6dcc21f9af6e1a
@@ -37,7 +39,7 @@ DIST skia-m103-b301ff025004c9cd82816c86c547588e6c24b466.tar.xz 11079112 BLAKE2B
 DIST skia-m116-2ddcf183eb260f63698aa74d1bb380f247ad7ccd.tar.xz 10868024 BLAKE2B ce8247de4cd6939b0593adf1c3dc6b78cdf4220fbcd2dfb2b9cf6d80d42f9c49f4d93fbe3cff68d079f04cc5801daf20999b288f7fdc85b58e32035151a3616a SHA512 6c10785ed9ab8cdf3385ebd3f3d13a64b850df9cc7a12e513326a84c7a3e6f6235f9f4dbce128eac2e43a2707fe6a6011716de5985adf4742d55879210bf32e9
 EBUILD libreoffice-7.5.6.2.ebuild 19446 BLAKE2B 7bc24fdae7098c30a0f54f62a61285fde75b2859b42dcf7c5cc5000e00ea01660ee985b9b5830ab4cee65af3205a979c9f955b45e6640f1079a1af4e58ccc2dc SHA512 040fbe601f618075ddda4dedbbbb15fe16a549fb76f2afc71bb5f99775ca16f561b3f316e030624f87b277cda35e411c2f7921b82adee80bf18df9a9d0824a5a
 EBUILD libreoffice-7.5.7.1.ebuild 19449 BLAKE2B 12fc9e583e53cd5d74b994c9a0370ccec25f0c14ed9a268c0aacb837c69f4987d3cdf859e47f444f2857548c7cd4e2d4366b383c343320a032d4cc5d7b0576f4 SHA512 e3ad6263ba419952fb0f527d19dd31cfb9f479f55a44a3ef2d85bb4cd451f82116ed3cc1099390d8406c68d7f1859d0bc917f514bc0474bd6bba867dddf73fe7
-EBUILD libreoffice-7.5.8.2-r1.ebuild 19605 BLAKE2B 8ea2e82612ac15caba5f8c885769712b9d4d3586af88391b9470d6d593b3b795a66826fc3d090db650557d6a5167a4029466fb827478bdcbcd07a8c137aba570 SHA512 3ac870c67a0405c08bd9e85d0089d13bc2b6edda9c1aa23ba9832f802ea5d3bf7b531219300bacce8476f5f4e98d3f371b4cf4eb5d28bbb85a91da81f31f7568
+EBUILD libreoffice-7.5.8.2-r2.ebuild 19803 BLAKE2B 6522e82e4c31ce6deb3469bff5f6a2242cee3dfb19432585b0580a694bafc2aec47cf7aa11e54308bdb2f9eb1320d46f8a96f2dd0ef72fa5315faa632c78f9ec SHA512 6b738e4a19ad250a6e76153de708b67490938e0b4b420f0e007c32144655651bcb82fba0000245fd12e349c191bcd8520a716ffe55e2732feb3b64b7ebdbcca5
 EBUILD libreoffice-7.5.8.2.ebuild 19520 BLAKE2B 119d01b5ab7efcdec41787b5cf981bbf5757da9da2b261d75e31a103c6de0283c03d68a89d1ab5b155a54e1e5eb4299a94ecdbdcb4b48b6a97fa28031a7ed1f9 SHA512 a1c4cb82b15c939b2abbae52b892764a5ec1b9a85d18a99230da846521499e248d5c579cdf5546ee2a90fb3a69fd556cca3d467309b22934cc0b721dfe1b5cb2
-EBUILD libreoffice-9999.ebuild 19449 BLAKE2B 55ee235108d625f6805369959a4aadf89140856239ec64ec0b2edb728953b7373148b4705598d56cb2bfe01e3fe6e3b2a48f8d48cc1f1d70d1bcde9cae0d9f03 SHA512 b6010e9ae393cfe49f4e09a1c5d5d2e273dd1dc8eb54e1462ea5cded2b76410dd17494516aec30700da48a7f136c5e52b45c2559e230c049176dcbcf8b26907c
+EBUILD libreoffice-9999.ebuild 19449 BLAKE2B 4f19c09ca4cf1cbdafcca8f22c2df4d5dce15e8e0c9e34cb86d49af8c267a688b8d70c399252cce53070da26f87c1d9568e7cf226227ecd0d6ff5605b31e541c SHA512 fb7e2341f7a1bf5492a004cb3408703ccd1ab212b55861a06589c33051bc7d154b02b93e8a5750a0f91b6be7760c264be62ecf84559abf0a6b1b408144a40d51
 MISC metadata.xml 1233 BLAKE2B f93989caf1340cda4c3327a3d3d033d224050848b32b9d80e0b093b024bf124d238f1aae9852d1a6173e8aee79314517dd12e589079e58378e5f63626a80957c SHA512 3af0cefdceeba7a45658a2151b0534f44b9dfe6d3af8374f3061cb098f607a36a2fe134e3c0280ce6d807b523f68e708b51e6f1b4178292a528405e18f12d686
diff --git a/app-office/libreoffice/files/libreoffice-7.5.8.2-curl-8.3.0-mitigation.patch b/app-office/libreoffice/files/libreoffice-7.5.8.2-curl-8.3.0-mitigation.patch
new file mode 100644
index 000000000000..78afc0e88692
--- /dev/null
+++ b/app-office/libreoffice/files/libreoffice-7.5.8.2-curl-8.3.0-mitigation.patch
@@ -0,0 +1,316 @@
+From 045bef390a025c3615d904524bf5ee21fa697ca4 Mon Sep 17 00:00:00 2001
+From: Michael Stahl <michael.stahl@allotropia.de>
+Date: Fri, 3 Nov 2023 20:16:09 +0100
+Subject: [PATCH] curl: mitigate migration to OpenSSL on Linux
+
+The problem is that curl 8.3.0 removed the NSS backend, so we now
+have no other choice than to use the bundled OpenSSL on Linux.
+
+Currently any curl https connection fails with:
+
+  CurlSession.cxx:963: curl_easy_perform failed: (60) SSL certificate problem: unable to get local issuer certificate
+
+Apparently this requires manually telling curl which CA certificates to
+trust; there is a configure flag --with-ca-bundle but that is useless as
+it tries to load the file relative to whatever is the current working
+directory, and also did i mention that there are at least 3 different
+locations where a Linux system may store its system trusted CA
+certificates because ALL ABOUT CHOICE.
+
+So add a new header with an init function to try out various file
+locations listed in this nice blog article and call it from way too many
+places that independently use curl.
+
+https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
+
+TODO: perhaps bundle a cacert.pem as a fallback in case the system chose
+to innovate by putting its certificates in yet another unexpected place
+
+(regression from commit c2930ebff82c4f7ffe8377ab82627131f8544226)
+
+Change-Id: Ibf1cc0069bc2ae011ecead9a4c2b455e94b01241
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/158915
+Tested-by: Jenkins
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 11f439b861922b9286b2e47ed326f3508a48d44e)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159125
+Reviewed-by: Xisco Fauli <xiscofauli@libreoffice.org>
+---
+ desktop/source/app/updater.cxx                |  4 ++
+ desktop/source/minidump/minidump.cxx          |  4 ++
+ extensions/source/update/check/download.cxx   |  4 ++
+ include/curlinit.hxx                          | 59 +++++++++++++++++++
+ .../languagetool/languagetoolimp.cxx          |  5 ++
+ linguistic/source/translate.cxx               |  4 ++
+ svl/source/crypto/cryptosign.cxx              |  6 ++
+ ucb/source/ucp/cmis/cmis_content.cxx          |  5 ++
+ ucb/source/ucp/ftp/ftploaderthread.cxx        |  4 ++
+ ucb/source/ucp/webdav-curl/CurlSession.cxx    |  2 +
+ 10 files changed, 97 insertions(+)
+ create mode 100644 include/curlinit.hxx
+
+diff --git a/desktop/source/app/updater.cxx b/desktop/source/app/updater.cxx
+index 5fb18dfad0bf8..4e4d2cda413ff 100644
+--- a/desktop/source/app/updater.cxx
++++ b/desktop/source/app/updater.cxx
+@@ -37,6 +37,8 @@
+ #include <orcus/json_document_tree.hpp>
+ #include <orcus/config.hpp>
+ #include <orcus/pstring.hpp>
++
++#include <curlinit.hxx>
+ #include <comphelper/hash.hxx>
+ 
+ #include <com/sun/star/container/XNameAccess.hpp>
+@@ -546,6 +548,8 @@ std::string download_content(const OString& rURL, bool bFile, OUString& rHash)
+     if (!curl)
+         return std::string();
+ 
++    ::InitCurl_easy(curl.get());
++
+     curl_easy_setopt(curl.get(), CURLOPT_URL, rURL.getStr());
+     curl_easy_setopt(curl.get(), CURLOPT_USERAGENT, kUserAgent);
+     bool bUseProxy = false;
+diff --git a/desktop/source/minidump/minidump.cxx b/desktop/source/minidump/minidump.cxx
+index 0bf20f2aa419e..7fbb0884987d8 100644
+--- a/desktop/source/minidump/minidump.cxx
++++ b/desktop/source/minidump/minidump.cxx
+@@ -17,6 +17,8 @@
+ 
+ #include <curl/curl.h>
+ 
++#include <curlinit.hxx>
++
+ #ifdef _WIN32
+ #include <memory>
+ #include <windows.h>
+@@ -95,6 +97,8 @@ static bool uploadContent(std::map<std::string, std::string>& parameters, std::s
+     if (!curl)
+         return false;
+ 
++    ::InitCurl_easy(curl);
++
+     std::string proxy, proxy_user_pwd, ca_certificate_file, file, url, version;
+ 
+     getProperty("Proxy", proxy, parameters);
+diff --git a/extensions/source/update/check/download.cxx b/extensions/source/update/check/download.cxx
+index ba371bdee570b..cdbbe2c327343 100644
+--- a/extensions/source/update/check/download.cxx
++++ b/extensions/source/update/check/download.cxx
+@@ -23,6 +23,8 @@
+ 
+ #include <curl/curl.h>
+ 
++#include <curlinit.hxx>
++
+ #include <o3tl/string_view.hxx>
+ #include <osl/diagnose.h>
+ #include <osl/file.h>
+@@ -222,6 +224,8 @@ static bool curl_run(std::u16string_view rURL, OutData& out, const OString& aPro
+ 
+     if( nullptr != pCURL )
+     {
++        ::InitCurl_easy(pCURL);
++
+         out.curl = pCURL;
+ 
+         OString aURL(OUStringToOString(rURL, RTL_TEXTENCODING_UTF8));
+diff --git a/include/curlinit.hxx b/include/curlinit.hxx
+new file mode 100644
+index 0000000000000..8b3a9968419da
+--- /dev/null
++++ b/include/curlinit.hxx
+@@ -0,0 +1,59 @@
++/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4; fill-column: 100 -*- */
++/*
++ * This file is part of the LibreOffice project.
++ *
++ * This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
++ */
++
++#pragma once
++
++#include <curl/curl.h>
++
++#if defined(LINUX) && !defined(SYSTEM_CURL)
++#include <com/sun/star/uno/RuntimeException.hpp>
++
++#include <unistd.h>
++
++static char const* GetCABundleFile()
++{
++    // try system ones first; inspired by:
++    // https://www.happyassassin.net/posts/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
++    auto const candidates = {
++        "/etc/pki/tls/certs/ca-bundle.crt",
++        "/etc/pki/tls/certs/ca-bundle.trust.crt",
++        "/etc/ssl/certs/ca-certificates.crt",
++        "/var/lib/ca-certificates/ca-bundle.pem",
++    };
++    for (char const* const candidate : candidates)
++    {
++        if (access(candidate, R_OK) == 0)
++        {
++            return candidate;
++        }
++    }
++
++    throw css::uno::RuntimeException("no OpenSSL CA certificate bundle found");
++}
++
++static void InitCurl_easy(CURL* const pCURL)
++{
++    char const* const path = GetCABundleFile();
++    auto rc = curl_easy_setopt(pCURL, CURLOPT_CAINFO, path);
++    if (rc != CURLE_OK) // only if OOM?
++    {
++        throw css::uno::RuntimeException("CURLOPT_CAINFO failed");
++    }
++}
++
++#else
++
++static void InitCurl_easy(CURL* const)
++{
++    // these don't use OpenSSL so CAs work out of the box
++}
++
++#endif
++
++/* vim:set shiftwidth=4 softtabstop=4 expandtab cinoptions=b1,g0,N-s cinkeys+=0=break: */
+diff --git a/lingucomponent/source/spellcheck/languagetool/languagetoolimp.cxx b/lingucomponent/source/spellcheck/languagetool/languagetoolimp.cxx
+index 4fa88ac0118f4..455fa12803d51 100644
+--- a/lingucomponent/source/spellcheck/languagetool/languagetoolimp.cxx
++++ b/lingucomponent/source/spellcheck/languagetool/languagetoolimp.cxx
+@@ -35,6 +35,9 @@
+ #include <boost/property_tree/json_parser.hpp>
+ #include <algorithm>
+ #include <string_view>
++
++#include <curlinit.hxx>
++
+ #include <sal/log.hxx>
+ #include <svtools/languagetoolcfg.hxx>
+ #include <tools/color.hxx>
+@@ -336,6 +339,8 @@ std::string LanguageToolGrammarChecker::makeHttpRequest(std::string_view aURL, H
+     if (!curl)
+         return {}; // empty string
+ 
++    ::InitCurl_easy(curl.get());
++
+     bool isPremium = false;
+     SvxLanguageToolOptions& rLanguageOpts = SvxLanguageToolOptions::Get();
+     OString apiKey = OUStringToOString(rLanguageOpts.getApiKey(), RTL_TEXTENCODING_UTF8);
+diff --git a/linguistic/source/translate.cxx b/linguistic/source/translate.cxx
+index 12f5491e21297..fdd95fca2988e 100644
+--- a/linguistic/source/translate.cxx
++++ b/linguistic/source/translate.cxx
+@@ -4,6 +4,7 @@
+ #include <rtl/string.h>
+ #include <boost/property_tree/ptree.hpp>
+ #include <boost/property_tree/json_parser.hpp>
++#include <curlinit.hxx>
+ #include <vcl/htmltransferable.hxx>
+ #include <tools/long.hxx>
+ 
+@@ -16,6 +17,9 @@ OString Translate(const OString& rTargetLang, const OString& rAPIUrl, const OStr
+ 
+     std::unique_ptr<CURL, std::function<void(CURL*)>> curl(curl_easy_init(),
+                                                            [](CURL* p) { curl_easy_cleanup(p); });
++
++    ::InitCurl_easy(curl.get());
++
+     (void)curl_easy_setopt(curl.get(), CURLOPT_URL, rAPIUrl.getStr());
+     (void)curl_easy_setopt(curl.get(), CURLOPT_FAILONERROR, 1L);
+     (void)curl_easy_setopt(curl.get(), CURLOPT_TIMEOUT, CURL_TIMEOUT);
+diff --git a/svl/source/crypto/cryptosign.cxx b/svl/source/crypto/cryptosign.cxx
+index 1d63378455690..b5e2eb0155e13 100644
+--- a/svl/source/crypto/cryptosign.cxx
++++ b/svl/source/crypto/cryptosign.cxx
+@@ -15,6 +15,10 @@
+ #include <svl/sigstruct.hxx>
+ #include <config_crypto.h>
+ 
++#if USE_CRYPTO_NSS
++#include <curlinit.hxx>
++#endif
++
+ #include <rtl/character.hxx>
+ #include <rtl/strbuf.hxx>
+ #include <rtl/string.hxx>
+@@ -1081,6 +1085,8 @@ bool Signing::Sign(OStringBuffer& rCMSHexBuffer)
+             return false;
+         }
+ 
++        ::InitCurl_easy(curl);
++
+         SAL_INFO("svl.crypto", "Setting curl to verbose: " << (curl_easy_setopt(curl, CURLOPT_VERBOSE, 1) == CURLE_OK ? "OK" : "FAIL"));
+ 
+         if ((rc = curl_easy_setopt(curl, CURLOPT_URL, OUStringToOString(m_aSignTSA, RTL_TEXTENCODING_UTF8).getStr())) != CURLE_OK)
+diff --git a/ucb/source/ucp/cmis/cmis_content.cxx b/ucb/source/ucp/cmis/cmis_content.cxx
+index 0bd38ea31f651..2ec1c336a706b 100644
+--- a/ucb/source/ucp/cmis/cmis_content.cxx
++++ b/ucb/source/ucp/cmis/cmis_content.cxx
+@@ -56,6 +56,8 @@
+ #include <ucbhelper/proxydecider.hxx>
+ #include <ucbhelper/macros.hxx>
+ #include <sax/tools/converter.hxx>
++#include <curlinit.hxx>
++
+ #include <utility>
+ 
+ #include "auth_provider.hxx"
+@@ -335,6 +337,9 @@ namespace cmis
+                     new CertValidationHandler( xEnv, m_xContext, aBindingUrl.GetHost( ) ) );
+             libcmis::SessionFactory::setCertificateValidationHandler( certHandler );
+ 
++            // init libcurl callback
++            libcmis::SessionFactory::setCurlInitProtocolsFunction(&::InitCurl_easy);
++
+             // Get the auth credentials
+             AuthProvider aAuthProvider(xEnv, m_xIdentifier->getContentIdentifier(), m_aURL.getBindingUrl());
+             AuthProvider::setXEnv( xEnv );
+diff --git a/ucb/source/ucp/ftp/ftploaderthread.cxx b/ucb/source/ucp/ftp/ftploaderthread.cxx
+index f5ebfe36cdda5..91130fc1bc9cf 100644
+--- a/ucb/source/ucp/ftp/ftploaderthread.cxx
++++ b/ucb/source/ucp/ftp/ftploaderthread.cxx
+@@ -25,6 +25,8 @@
+ #include "ftploaderthread.hxx"
+ #include "curl.hxx"
+ 
++#include <curlinit.hxx>
++
+ using namespace ftp;
+ 
+ 
+@@ -75,6 +77,8 @@ CURL* FTPLoaderThread::handle() {
+     if(!ret) {
+         ret = curl_easy_init();
+         if (ret != nullptr) {
++            ::InitCurl_easy(ret);
++
+             // Make sure curl is not internally using environment variables like
+             // "ftp_proxy":
+             if (curl_easy_setopt(ret, CURLOPT_PROXY, "") != CURLE_OK) {
+diff --git a/ucb/source/ucp/webdav-curl/CurlSession.cxx b/ucb/source/ucp/webdav-curl/CurlSession.cxx
+index 4839a1f85e03d..346d58b5969d5 100644
+--- a/ucb/source/ucp/webdav-curl/CurlSession.cxx
++++ b/ucb/source/ucp/webdav-curl/CurlSession.cxx
+@@ -34,6 +34,7 @@
+ #include <rtl/uri.hxx>
+ #include <rtl/strbuf.hxx>
+ #include <rtl/ustrbuf.hxx>
++#include <curlinit.hxx>
+ #include <config_version.h>
+ 
+ #include <map>
+@@ -679,6 +680,7 @@ CurlSession::CurlSession(uno::Reference<uno::XComponentContext> xContext,
+     assert(rc == CURLE_OK);
+     rc = curl_easy_setopt(m_pCurl.get(), CURLOPT_HEADERFUNCTION, &header_callback);
+     assert(rc == CURLE_OK);
++    ::InitCurl_easy(m_pCurl.get());
+     // tdf#149921 by default, with schannel (WNT) connection fails if revocation
+     // lists cannot be checked; try to limit the checking to when revocation
+     // lists can actually be retrieved (usually not the case for self-signed CA)
diff --git a/app-office/libreoffice/files/libreoffice-7.5.8.2-libcmis-0.6.patch b/app-office/libreoffice/files/libreoffice-7.5.8.2-libcmis-0.6.patch
new file mode 100644
index 000000000000..ae029a3c9a2c
--- /dev/null
+++ b/app-office/libreoffice/files/libreoffice-7.5.8.2-libcmis-0.6.patch
@@ -0,0 +1,39 @@
+From e9320e567d6bca32783d0f716f386761d03a875a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Caol=C3=A1n=20McNamara?= <caolan.mcnamara@collabora.com>
+Date: Mon, 13 Nov 2023 10:13:50 +0000
+Subject: upgrade libcmis
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Change-Id: Ie2d5f3f8208f9952db5be10905b5905cd03b91de
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159366
+Tested-by: Jenkins
+Reviewed-by: Caolán McNamara <caolan.mcnamara@collabora.com>
+(cherry picked from commit 3368447e826d4204086e4d8bfe59af4412c16233)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159454
+Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
+(cherry picked from commit 25b159729f1202ca2a42de5e76f22718d68400c8)
+Reviewed-on: https://gerrit.libreoffice.org/c/core/+/159589
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+(limited to 'configure.ac')
+
+diff --git a/configure.ac b/configure.ac
+index a88c81646c40..bdd08abeeeb5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -7532,7 +7532,7 @@ AC_SUBST(GPERF)
+ dnl ===================================================================
+ dnl Check for system libcmis
+ dnl ===================================================================
+-libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.5 >= 0.5.2],enabled)
++libo_CHECK_SYSTEM_MODULE([libcmis],[LIBCMIS],[libcmis-0.6 >= 0.6.1],enabled)
+ 
+ dnl ===================================================================
+ dnl C++11
+-- 
+cgit v1.2.1
+
diff --git a/app-office/libreoffice/libreoffice-7.5.8.2-r1.ebuild b/app-office/libreoffice/libreoffice-7.5.8.2-r2.ebuild
index 71f73d7ece24..e2f24692185b 100644
--- a/app-office/libreoffice/libreoffice-7.5.8.2-r1.ebuild
+++ b/app-office/libreoffice/libreoffice-7.5.8.2-r2.ebuild
@@ -126,7 +126,7 @@ COMMON_DEPEND="${PYTHON_DEPS}
 	>=app-text/libwps-0.4
 	app-text/mythes
 	>=dev-cpp/clucene-2.3.3.4-r2
-	>=dev-cpp/libcmis-0.5.2-r2
+	>=dev-cpp/libcmis-0.5.2-r2:=
 	dev-db/unixODBC
 	dev-lang/perl
 	dev-libs/boost:=[nls]
@@ -298,6 +298,9 @@ PATCHES=(
 	# maybe upstreamable
 	"${FILESDIR}/libreoffice-7.5.8.2-icu-74-compatibility.patch"
 
+	# 7.5.9.1
+	"${FILESDIR}/${P}-curl-8.3.0-mitigation.patch" # bug 891903(?)
+
 	# git master
 	"${WORKDIR}/${PN}-7.5.2.2-loong-buildsys-fix.patch"
 	"${FILESDIR}/${PN}-7.5.6.2-gcc-14.patch"
@@ -351,6 +354,10 @@ src_unpack() {
 }
 
 src_prepare() {
+	if has_version '>=dev-cpp/libcmis-0.6.1'; then
+		PATCHES+=( "${FILESDIR}/${P}-libcmis-0.6.patch" ) # from 7.5.9.1
+	fi
+
 	default
 
 	# sandbox violations on many systems, we don't need it. Bug #646406
diff --git a/app-office/libreoffice/libreoffice-9999.ebuild b/app-office/libreoffice/libreoffice-9999.ebuild
index a24e522bc074..a706f71b5698 100644
--- a/app-office/libreoffice/libreoffice-9999.ebuild
+++ b/app-office/libreoffice/libreoffice-9999.ebuild
@@ -127,7 +127,7 @@ COMMON_DEPEND="${PYTHON_DEPS}
 	>=app-text/libwps-0.4
 	app-text/mythes
 	>=dev-cpp/clucene-2.3.3.4-r2
-	>=dev-cpp/libcmis-0.5.2-r2
+	>=dev-cpp/libcmis-0.6.2:0=
 	dev-db/unixODBC
 	dev-lang/perl
 	dev-libs/boost:=[nls]