gentoo auto-resync : 22:12:2024 - 06:30:44

7 files changed, 1264 insertions, 0 deletions

diff --git a/dev-libs/botan/Manifest b/dev-libs/botan/Manifest
index 94e2313bcb28..60493935c7e2 100644
--- a/dev-libs/botan/Manifest
+++ b/dev-libs/botan/Manifest
@@ -1,18 +1,28 @@
+AUX botan-2.19.5-boost-1.87.patch 15481 BLAKE2B f1a03cb17ee5a56845cd3e469c64e4bb4c5a54c689c623e65e6fd15fbbf931ce5b42623ad96d579b072bc1a7f85cd19bfb75f2c596fbbe79b46f0aea867e3aec SHA512 b30882c312395b81563d21cdd87c67ba1ac74010995a5f4bd81ae26c855b984f7243e9a20bcf147b6c6ef7c613032d5302296a33004a76ca165f1ef767ffb569
+AUX botan-2.19.5-cloudflare.patch 3012 BLAKE2B 066cd7a5d1e384ebd0596e2af0f00f98c9abd8d939e11a431530f98576dc5073399b00a0a2408bdc46315aa0f5b9850bdfb75d53162f3964b2ac076bc49b52c3 SHA512 fb9780ad3f004b1a5818d9d8ffad14378d9e587ed83454583dff48c977700276e72ba533f07a20aa8c18a88245dc97a76218ba8071922b7172aec2d7d064fa02
+AUX botan-2.19.5-no-distutils.patch 2597 BLAKE2B 5d2cf7e89939abdbf97cb01f6364809782c504c22a613b0fb0fdd112beda35b7f824fb9756a5782b55de775926c4447f3cbf5cc2803844acdd115e6ac1db8cce SHA512 171400cffbefb1d6a50bd0cd134083c6e63efd439a9f0129152637dcc4d3ec00d06494e6d8d3a526a71198a2f3e3a87951e23bcf8f647b3e9e7e3e59c9370c98
 AUX botan-3.2.0-ninja.patch 575 BLAKE2B f75eb0a16fadfae6e0a1bb554262d8d902152c054fd97c19a1c4eda31a780138efd42ce05992896d16d98415c555a7cfa01b6dfa201c7e97ad971deab851e7b7 SHA512 ff9078ae1a43404680cf757da15bd17541f51f8de02a1a8d02f075676a1e35ff9a78adba0f3b84847634bc4904ed7b5824df6c708785865a4d01d4f9139e617b
+AUX botan-3.6.1-boost-1.87.patch 14585 BLAKE2B 175d0a7e0bd16fb1e8f1d2493ad41e6633ec32284704cfb182892acf35695adb38f142ebf557697a422b40b11a0b7842f9852b45022168ffa691ddd84f8334a3 SHA512 f4adea3772b7bff4304c3189f3be38c75c2a3ddcfeb451f7578e2f0e1487e2d1eedef0c7dd782a699cf966931a7ab32f0ca4079d9145b7c43495a6281bf68bea
 DIST Botan-2.19.3.tar.xz 6105896 BLAKE2B 6d7778d9e9a101c76f35c65b0fb0201641cd91967ba934510f3836ee4b924d54cabdc760dd460997679250aa66e1d2a99369cd03f8fb9e7b2fe672d4b355215f SHA512 80012397e2aa7cc88a9536340ac9b770d1195fddda53b9d4cfde82318dd05f9d4f925bbdff773aba99883a701f4d30581e9d5c97e915fa80c3ca2acfa5a92110
 DIST Botan-2.19.3.tar.xz.asc 488 BLAKE2B cd86bf77306aad2956cced6ac4fb96081279af88743e87d8fe5437e72e9fa8db8aaf40d0b5cb9c5b3a85204cb7d63c3baa3054126ab4c9a2db527e6835a069d7 SHA512 9142f932c958138b4bac32f503a550e6c73b61612690a280dcb98efe8c367aa6bd3cd88b4ed4decec376bb87596a780a21bdcb01d4a3573a1c44fbeb0aa49d23
 DIST Botan-2.19.4.tar.xz 6099528 BLAKE2B c35dfec5aad13c76fe09b33f97a72d15f84bfd6c434cae89be13c3fd3e6f7deaa9ea21474890bb6a1f4fa7d23369c32b9fc747862233eac33c8c88dbc912d31f SHA512 2fab4347367703dce8302b7710698ed228c6cc6dd609c39829ba17ad580407ed40d822862d467aa7aea4bfd633c1f1d1c0d437e86376f453845cc609596335d8
 DIST Botan-2.19.4.tar.xz.asc 488 BLAKE2B b8b7db32d61859778c0866e782ed94ef89ba48a0f0f2289d9452fe7f540ae37ad495cb7eede68199d9bed8e23f695e1860c0d379cd4c35c92de8c45db167b68a SHA512 e00c4e2944655919507300650d81fbee03dd22d1a84cb8135848ea9ee061ca4d4dfada618643193143c0123e56f22e4a6d3a26c73923d872754d80dc2a4779c5
+DIST Botan-2.19.5.tar.xz 6140148 BLAKE2B ab3a133a84c1beb2efd32fcb1746c13ec58cf24cf28cea43c93e9dd4b45c65a47225ff92139e34e1470cf150f839794e3bbd316df5e72a060f11d03141002b79 SHA512 323930fbabd833a6affd71f90835e4ca31a9632e346dee9c5f396aca898697d0f2993b860f739d02cdf49fa7fbb3a2d306c4790e5d5f39620b2dea284983669c
+DIST Botan-2.19.5.tar.xz.asc 488 BLAKE2B 7d52f66f7495ccc249a58ec30206234a9ea4420bcc6e6412593a975bec1173afe55bbcd2c0cbe3859a3fdf547464d3d2949bc03dcb9dbd25c4d5c97589f48202 SHA512 3ba185cf077c109d183fff14270fa60c7be01fd87077e233e6473365111ba83d41448db6d5b5849fe1194c47e84cc2da91a0f75c30ea43538772f13138e472fa
 DIST Botan-3.1.1.tar.xz 8800368 BLAKE2B c31365e6bd4106f96a033e5f092c528c0185577f41d9a698d2630ece0f660f87f03e0775ebeb5c4d812819bbc6eb556b5ff15c16f243288ae73c8bf1fbb991ce SHA512 ed6bdadb910b0775245648140212953ed364aa26107f851e39ac5cb664d7f476c519a22cdad41f0e520796c4ebe453c56ca68a2178e39f815d445e9979333795
 DIST Botan-3.1.1.tar.xz.asc 488 BLAKE2B 9ac94473d90a26932e507cdb3f46d8381565deecff38a5a2f7fe043b33405071adf0baee4235dd94bb6d35fa3ffedca6192fb5f5d76030874a90a399d88f9744 SHA512 f52e8602a57f590150f6f49829e788910006e5113ab6e85c6efe73009b8db752b5f28b869c6265ef6dd3c2727c64c0182d125f02f92485485768416c618acdb9
 DIST Botan-3.2.0.tar.xz 8998204 BLAKE2B f21e7574af93ab3331607f4a4ecf1b2cbbc0db4b510ea8ad19a5286d46d3a8e37e13746d2d4751eb16a70fdc8371b4435b030ef0a17f1ab6dcd76bd81bb3a4fa SHA512 526cf71144584fef6e73f14f6aa1e2a7b03a92a3e51436287764bb61e742a94e02926bcc2aab038f08ef2169cb511152c8ecd71d51e06deb4875dc676875c2d9
 DIST Botan-3.2.0.tar.xz.asc 488 BLAKE2B f7bc716dd18eedf35928933e22c75de3d2731330dfdaf8a5048e8ad86e1f3896ea55294a64b7f82593af16dd2e4097a9ba68f25baa024e175b7334478bcf84a6 SHA512 3ee42ac73e1bd6cea0a2e9f468b88d67c02a4a69786c41ddf9fc7f94b6847be00e0f3f0f38f934ab599b8d6dd29006414294df8b371f5cf2422292f3dd176756
 DIST Botan-3.3.0.tar.xz 7164024 BLAKE2B 051a24c28e6858fdff2af15d01a871ebe5bab11d773be821c0a56a55c725c91cf3119280195ac736f4df83305c1d4910430e6b26deded0d4c634e5c2fc23b389 SHA512 90930add225a2b4376046b3ed0177c71e7d19e983fb2b99c40751de5e6c3959b520eaa1e836782eb02ebc8aff8e9a4fd928f585de5e6b1798a8ad4aa0464f19b
 DIST Botan-3.3.0.tar.xz.asc 488 BLAKE2B 043538ff2572a449d4d9ad4bba6d7cab78865e924f712d1b4d4aad9f378cc417f07c19a25adefa22b6e1c06259a50880414c11ce8d3ad1e7f815cf458dbbe6b8 SHA512 c951079c22665966b96cf18c20df7b709353b42dab4aeb33d021b4a8abbc0f06d8fe909f1a5db3e736b4f93b17374d8f832f7aa9f25757a5d5ab1604320581b2
+DIST Botan-3.6.1.tar.xz 7581864 BLAKE2B 744eed158e021d26b9414b3a098e017e6e2c2160fc7fb6a0f24f6cbbb4b08501157108dedd7a71fc3645e27c86608a9ba5d18a11087adfd1c9b174ca3ce85b30 SHA512 06327c55bee5e0d2e142f81b997dd8a1ef98f61ef920b57f6eb4e80ebf6b3de1c62373b889d4a32e62509495792e0b46d5dcc82a6446266974b4d4ead8d9f287
+DIST Botan-3.6.1.tar.xz.asc 488 BLAKE2B 3538c941f707a182f86226dfdbb8222570671e0bce3ca61137a5d978c2b1f5e658ffc1168d7e73a1861210adfac8aa661124c9cbc4950973f7b1e2c3360aab90 SHA512 871c6d91368d8a080e704afb53b1339c6d06aa57aaa45f260bccf1cb1ed31c635587ba930f954ab55668a7ca13b89b2f2acba3c0f1723e3f7190c6ebe9dc2e0b
 EBUILD botan-2.19.3-r2.ebuild 5084 BLAKE2B 4e38d5f419f00e83691cc0eabf70679ef9c2b3ca6583de89bdd629ff047b7ed2fb42e8a577b4352bd5702925de8df0c4c1694562d2fa7b37a3599e13af276da9 SHA512 018dc521bc66d71373865307debdf1bd556b8c663fde27a8e2abb1ab96ce783851024255d8059b0c0146f6ea33d8c43469e77d07996bf3c4ccc7b69a90c0c65a
 EBUILD botan-2.19.4.ebuild 5158 BLAKE2B 851298f127c510589a3f1a19fef3485318e8ec7bc90f197101cc8d0950cfd935b9f8299d8994135d1d1c6790da5ef5d9492322d6ec2f193b50f7ef6dcd20b05e SHA512 1f3c042a943b5e51d2c10d62ea96e6772457423667f8803ea39e8443f74641be99893eb0015f179c2a9a0440d1a8fccf81134eb963fae5d03ec289ad5a032a4d
+EBUILD botan-2.19.5.ebuild 5211 BLAKE2B 680b22edc892be863fdab189b2b9c753d41c31dcd39f999b4d039e0a9f2b1f73575c7aee72a860e2f3e74fc5dbfeba4fa057d9039e351c647ded82a1094ba74c SHA512 f3260993c3149bba2ec86bb782919ecc2c7cd8e3fc20ba544aaf56ec6e17f64e63d0d7a6adc12ad53bed977f3af1880a57f3be9554d24d032af838ec6c8ac8a0
 EBUILD botan-3.1.1.ebuild 5687 BLAKE2B 2a54f03f4c60f34a426306a440c961d8c670d353dc309eece4b89c251e280a3025faf8c46d76b5f3c2778678fb5302bffa4d13192b7c49b83ff2c4830bd53cf9 SHA512 039403784b9e5314fbf44491a075337e82b88a872965d9c4ec230c9e62b72d2758fb22c0270232faaf07c6de85bc6c9476986f5a264b5253cdb147f8d6c0fd09
 EBUILD botan-3.2.0-r1.ebuild 5949 BLAKE2B d3896126f123289ba540718729e96b72fb5c40527be15fe3b7921040210014efdb65748c4dc601130949bf48fced3864f746915ee9ada72f77d85120fbf85a10 SHA512 623175e58b1b045757ff939c05b1cc55357e0d32b76485027ab45179adc5278eb01f46bac5b944ebbb00e0fcb6963da4ae7202721546c306dc0355e7bb747161
 EBUILD botan-3.2.0-r2.ebuild 5974 BLAKE2B 0d13e2fd6b89cd5cd4254b0d4d109ce1df29f7e191df73c453786db9e2c134fc79a7faa592147c0bd780e1ea2e0d0c230b51402e028ea1b45f6fa188e20cd8a5 SHA512 d1ec5f53985ddcd8ef65439385a9fa4b33be4686e8fbcedf1c7c3b15eeb74dc635bf46bbba39195e6a5487297ac71e68b9442c129ab36d92c60b8d366dfde1f3
 EBUILD botan-3.3.0.ebuild 6000 BLAKE2B 536ec0d6f2b6d832bcd2bfe5a8ecc9f1656ec644fb023dafd0592a5b1492b13fdb9ee75d5c9a6589b822a3882aec19ca35dc737766d4cd073cac7357e1225acb SHA512 179a8f6c557b4d797bb2508d409c0bfff23d35b7d46cc398a888f7f0a6a4e05049800f0dfc62505b7b1448b92a81c3b53001645dd4fd0395848b79336f268009
+EBUILD botan-3.6.1.ebuild 5984 BLAKE2B e88d6380a0ff866a1c2cd5da3898f550de57f74453bbc71c83a2b38b544ed64ee6b4f29ab246d5240720dc9c37ed8371b62198a6bea324b42a687fa79c15aea8 SHA512 78e32e4a696549b39ca7d798cc0767f7c17edd55e5a9c3c251abe748772c95de6acfcb2e59572e4fac8e2a9a0cf5c9f356d8c556050a9a3ea4a7f475f815ddfc
 MISC metadata.xml 587 BLAKE2B 8d46466fee633fda0f81549a6e512e4ef5963eda31d7c882cee2fe2bfae8b0379509f046d0bdfdb1fe9481eea0585f1754753ed6b509c4f922b8fbf9ae089f39 SHA512 258e04098b9db5821a66e38d02ffb195b57378621fd2a549c8892744cf257be857ebf75c8e4a2f041cd267f07c2f1c3a5fca8df61db0538d8282507cf03a029d
diff --git a/dev-libs/botan/botan-2.19.5.ebuild b/dev-libs/botan/botan-2.19.5.ebuild
new file mode 100644
index 000000000000..bece06dd2ab4
--- /dev/null
+++ b/dev-libs/botan/botan-2.19.5.ebuild
@@ -0,0 +1,206 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/botan.asc
+inherit edo flag-o-matic multiprocessing python-r1 toolchain-funcs verify-sig
+
+MY_P="Botan-${PV}"
+DESCRIPTION="C++ crypto library"
+HOMEPAGE="https://botan.randombit.net/"
+SRC_URI="https://botan.randombit.net/releases/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://botan.randombit.net/releases/${MY_P}.tar.xz.asc )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD-2"
+# New major versions are parallel-installable
+SLOT="$(ver_cut 1)/$(ver_cut 1-2)" # soname version
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
+IUSE="doc boost bzip2 lzma python static-libs sqlite test tools zlib"
+CPU_USE=(
+	cpu_flags_arm_{aes,neon}
+	cpu_flags_ppc_altivec
+	cpu_flags_x86_{aes,avx2,popcnt,rdrand,sha,sse2,ssse3,sse4_1,sse4_2}
+)
+IUSE+=" ${CPU_USE[@]}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# NOTE: Boost is needed at runtime too for the CLI tool.
+DEPEND="
+	boost? ( dev-libs/boost:= )
+	bzip2? ( >=app-arch/bzip2-1.0.5:= )
+	lzma? ( app-arch/xz-utils:= )
+	python? ( ${PYTHON_DEPS} )
+	sqlite? ( dev-db/sqlite:3= )
+	zlib? ( >=sys-libs/zlib-1.2.3:= )
+"
+RDEPEND="
+	${DEPEND}
+	!<dev-libs/botan-3.0.0-r1:3[tools]
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	$(python_gen_any_dep '
+		doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	')
+	verify-sig? ( sec-keys/openpgp-keys-botan )
+"
+
+# NOTE: Considering patching Botan?
+# Please see upstream's guidance:
+# https://botan.randombit.net/handbook/packaging.html#minimize-distribution-patches
+
+PATCHES=(
+	"${FILESDIR}"/${P}-no-distutils.patch
+	"${FILESDIR}"/${P}-boost-1.87.patch
+	"${FILESDIR}"/${P}-cloudflare.patch
+)
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]"
+}
+
+src_configure() {
+	python_setup
+
+	local disable_modules=(
+		$(usev !boost 'boost')
+	)
+
+	if [[ -z "${DISABLE_MODULES}" ]] ; then
+		elog "Disabling module(s): ${disable_modules[@]}"
+	fi
+
+	local chostarch="${CHOST%%-*}"
+
+	# Arch specific wrangling
+	local myos=
+	case ${CHOST} in
+		*-darwin*)
+			myos=darwin
+			;;
+		*)
+			myos=linux
+
+			if [[ ${CHOST} == *hppa* ]] ; then
+				chostarch=parisc
+			elif [[ ${ABI} == sparc64 ]] ; then
+				chostarch="sparc64"
+			elif [[ ${ABI} == sparc32 ]] ; then
+				chostarch="sparc32"
+			fi
+			;;
+	esac
+
+	local pythonvers=()
+	if use python ; then
+		_append() {
+			pythonvers+=( ${EPYTHON/python/} )
+		}
+
+		python_foreach_impl _append
+	fi
+
+	local myargs=(
+		# Intrinsics
+		# TODO: x86 RDSEED (new CPU_FLAGS_X86?)
+		# TODO: POWER Crypto (new CPU_FLAGS_PPC?)
+		$(usev !cpu_flags_arm_aes '--disable-armv8crypto')
+		$(usev !cpu_flags_arm_neon '--disable-neon')
+		$(usev !cpu_flags_ppc_altivec '--disable-altivec')
+		$(usev !cpu_flags_x86_aes '--disable-aes-ni')
+		$(usev !cpu_flags_x86_avx2 '--disable-avx2')
+		$(usev !cpu_flags_x86_popcnt '--disable-bmi2')
+		$(usev !cpu_flags_x86_rdrand '--disable-rdrand')
+		$(usev !cpu_flags_x86_sha '--disable-sha-ni')
+		$(usev !cpu_flags_x86_sse2 '--disable-sse2')
+		$(usev !cpu_flags_x86_ssse3 '--disable-ssse3')
+		$(usev !cpu_flags_x86_sse4_1 '--disable-sse4.1')
+		$(usev !cpu_flags_x86_sse4_2 '--disable-sse4.2')
+
+		# HPPA's GCC doesn't support SSP
+		$(usev hppa '--without-stack-protector')
+
+		$(use_with boost)
+		$(use_with bzip2)
+		$(use_with doc documentation)
+		$(use_with doc sphinx)
+		$(use_with lzma)
+		$(use_enable static-libs static-library)
+		$(use_with sqlite sqlite3)
+		$(use_with zlib)
+
+		--cpu=${chostarch}
+		--docdir=share/doc
+		--disable-modules=$(IFS=","; echo "${disable_modules[*]}")
+		--distribution-info="Gentoo ${PVR}"
+		--libdir="$(get_libdir)"
+		# Avoid collisions between slots for tools (bug #905700)
+		--program-suffix=$(ver_cut 1)
+
+		# Don't install Python bindings automatically
+		# (do it manually later in the right place)
+		# bug #723096
+		--no-install-python-module
+
+		--os=${myos}
+		--prefix="${EPREFIX}"/usr
+		--with-endian="$(tc-endian)"
+		--with-python-version=$(IFS=","; echo "${pythonvers[*]}")
+	)
+
+	local build_targets=(
+		shared
+		$(usev static-libs static)
+		$(usev tools cli)
+		$(usev test tests)
+	)
+
+	myargs+=(
+		--build-targets=$(IFS=","; echo "${build_targets[*]}")
+	)
+
+	if use elibc_glibc && use kernel_linux ; then
+		myargs+=(
+			--with-os-features=getrandom,getentropy
+		)
+	fi
+
+	tc-export AR CC CXX
+
+	local sanitizers=()
+	if is-flagq -fsanitize=address ; then
+		sanitizers+=( address )
+	fi
+	if is-flagq -fsanitize=undefined ; then
+		sanitizers+=( undefined )
+	fi
+	filter-flags '-fsanitize=*'
+	myargs+=(
+		--enable-sanitizers=$(IFS=","; echo "${sanitizers[*]}")
+	)
+
+	edo ${EPYTHON} configure.py --verbose "${myargs[@]}"
+}
+
+src_test() {
+	LD_LIBRARY_PATH="${S}" edo ./botan-test$(ver_cut 1) --test-threads="$(makeopts_jobs)"
+}
+
+src_install() {
+	default
+
+	if [[ -d "${ED}"/usr/share/doc/${P} ]] ; then
+		# --docdir in configure controls the parent directory unfortunately
+		mv "${ED}"/usr/share/doc/${P} "${ED}"/usr/share/doc/${PF} || die
+	fi
+
+	# Manually install the Python bindings (bug #723096)
+	if use python ; then
+		python_foreach_impl python_domodule src/python/botan$(ver_cut 1).py
+	fi
+}
diff --git a/dev-libs/botan/botan-3.6.1.ebuild b/dev-libs/botan/botan-3.6.1.ebuild
new file mode 100644
index 000000000000..a74ebb175427
--- /dev/null
+++ b/dev-libs/botan/botan-3.6.1.ebuild
@@ -0,0 +1,227 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/botan.asc
+inherit edo flag-o-matic multiprocessing ninja-utils python-r1 toolchain-funcs verify-sig
+
+MY_P="Botan-${PV}"
+DESCRIPTION="C++ crypto library"
+HOMEPAGE="https://botan.randombit.net/"
+SRC_URI="https://botan.randombit.net/releases/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://botan.randombit.net/releases/${MY_P}.tar.xz.asc )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD-2"
+# New major versions are parallel-installable
+SLOT="$(ver_cut 1)/$(ver_cut 1-2)" # soname version
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-macos"
+IUSE="doc boost bzip2 lzma python static-libs sqlite test tools zlib"
+CPU_USE=(
+	cpu_flags_arm_{aes,neon,sha1,sha2}
+	cpu_flags_ppc_altivec
+	cpu_flags_x86_{aes,avx2,popcnt,rdrand,sha,sse2,ssse3,sse4_1,sse4_2}
+)
+IUSE+=" ${CPU_USE[@]}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# NOTE: Boost is needed at runtime too for the CLI tool.
+DEPEND="
+	boost? ( dev-libs/boost:= )
+	bzip2? ( >=app-arch/bzip2-1.0.5:= )
+	lzma? ( app-arch/xz-utils:= )
+	python? ( ${PYTHON_DEPS} )
+	sqlite? ( dev-db/sqlite:3= )
+	zlib? ( >=sys-libs/zlib-1.2.3:= )
+"
+RDEPEND="
+	${DEPEND}
+	!<dev-libs/botan-2.19.3-r1:2[tools]
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	${NINJA_DEPEND}
+	$(python_gen_any_dep '
+		doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	')
+	|| ( >=sys-devel/gcc-11:* >=llvm-core/clang-14:* )
+	verify-sig? ( sec-keys/openpgp-keys-botan )
+"
+
+# NOTE: Considering patching Botan?
+# Please see upstream's guidance:
+# https://botan.randombit.net/handbook/packaging.html#minimize-distribution-patches
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.6.1-boost-1.87.patch
+)
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]"
+}
+
+pkg_pretend() {
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# bug #908958
+	if tc-is-gcc && ver_test $(gcc-version) -lt 11 ; then
+		eerror "Botan needs >=gcc-11 or >=clang-14 to compile."
+		eerror "Please upgrade GCC: emerge -v1 sys-devel/gcc"
+		die "GCC version is too old to compile Botan!"
+	elif tc-is-clang && ver_test $(clang-version) -lt 14 ; then
+		eerror "Botan needs >=gcc-11 or >=clang-14 to compile."
+		eerror "Please upgrade Clang: emerge -v1 llvm-core/clang"
+		die "Clang version is too old to compile Botan!"
+	fi
+}
+
+src_configure() {
+	tc-export AR CC CXX
+	python_setup
+
+	local disable_modules=(
+		$(usev !boost 'boost')
+	)
+
+	if [[ -z "${DISABLE_MODULES}" ]] ; then
+		elog "Disabling module(s): ${disable_modules[@]}"
+	fi
+
+	local chostarch="${CHOST%%-*}"
+
+	# Arch specific wrangling
+	local myos=
+	case ${CHOST} in
+		*-darwin*)
+			myos=darwin
+			;;
+		*)
+			myos=linux
+
+			if [[ ${CHOST} == *hppa* ]] ; then
+				chostarch=parisc
+			elif [[ ${ABI} == sparc64 ]] ; then
+				chostarch="sparc64"
+			elif [[ ${ABI} == sparc32 ]] ; then
+				chostarch="sparc32"
+			fi
+			;;
+	esac
+
+	local pythonvers=()
+	if use python ; then
+		_append() {
+			pythonvers+=( ${EPYTHON/python/} )
+		}
+
+		python_foreach_impl _append
+	fi
+
+	local myargs=(
+		# Intrinsics
+		# TODO: x86 RDSEED (new CPU_FLAGS_X86?)
+		# TODO: POWER Crypto (new CPU_FLAGS_PPC?)
+		$(usev !cpu_flags_arm_aes '--disable-armv8crypto')
+		$(usev !cpu_flags_arm_neon '--disable-neon')
+		$(usev !cpu_flags_arm_sha1 '--disable-armv8crypto')
+		$(usev !cpu_flags_arm_sha2 '--disable-armv8crypto')
+		$(usev !cpu_flags_ppc_altivec '--disable-altivec')
+		$(usev !cpu_flags_x86_aes '--disable-aes-ni')
+		$(usev !cpu_flags_x86_avx2 '--disable-avx2')
+		$(usev !cpu_flags_x86_popcnt '--disable-bmi2')
+		$(usev !cpu_flags_x86_rdrand '--disable-rdrand')
+		$(usev !cpu_flags_x86_sha '--disable-sha-ni')
+		$(usev !cpu_flags_x86_sse2 '--disable-sse2')
+		$(usev !cpu_flags_x86_ssse3 '--disable-ssse3')
+		$(usev !cpu_flags_x86_sse4_1 '--disable-sse4.1')
+		$(usev !cpu_flags_x86_sse4_2 '--disable-sse4.2')
+
+		# HPPA's GCC doesn't support SSP
+		$(usev hppa '--without-stack-protector')
+
+		$(use_with boost)
+		$(use_with bzip2)
+		$(use_with doc documentation)
+		$(use_with doc sphinx)
+		$(use_with lzma)
+		$(use_enable static-libs static-library)
+		$(use_with sqlite sqlite3)
+		$(use_with zlib)
+
+		--build-tool=ninja
+		--cpu=${chostarch}
+		--docdir=share/doc
+		--disable-modules=$(IFS=","; echo "${disable_modules[*]}")
+		--distribution-info="Gentoo ${PVR}"
+		--libdir="$(get_libdir)"
+		# Avoid collisions between slots for tools (bug #905700)
+		--program-suffix=$(ver_cut 1)
+
+		# Don't install Python bindings automatically
+		# (do it manually later in the right place)
+		# bug #723096
+		--no-install-python-module
+
+		--os=${myos}
+		--prefix="${EPREFIX}"/usr
+		--with-endian="$(tc-endian)"
+		--with-python-version=$(IFS=","; echo "${pythonvers[*]}")
+	)
+
+	local build_targets=(
+		shared
+		$(usev static-libs static)
+		$(usev tools cli)
+		$(usev test tests)
+	)
+
+	myargs+=(
+		--build-targets=$(IFS=","; echo "${build_targets[*]}")
+	)
+
+	if ( use elibc_glibc || use elibc_musl ) && use kernel_linux ; then
+		myargs+=(
+			--with-os-features=getrandom,getentropy
+		)
+	fi
+
+	local sanitizers=()
+	if is-flagq -fsanitize=address ; then
+		sanitizers+=( address )
+	fi
+	if is-flagq -fsanitize=undefined ; then
+		sanitizers+=( undefined )
+	fi
+	filter-flags '-fsanitize=*'
+	myargs+=(
+		--enable-sanitizers=$(IFS=","; echo "${sanitizers[*]}")
+	)
+
+	edo ${EPYTHON} configure.py --verbose "${myargs[@]}"
+}
+
+src_compile() {
+	eninja
+}
+
+src_test() {
+	LD_LIBRARY_PATH="${S}" edo ./botan-test$(ver_cut 1) --test-threads="$(makeopts_jobs)"
+}
+
+src_install() {
+	DESTDIR="${D}" eninja install
+
+	if [[ -d "${ED}"/usr/share/doc/${P} && ${P} != ${PF} ]] ; then
+		# --docdir in configure controls the parent directory unfortunately
+		mv "${ED}"/usr/share/doc/${P} "${ED}"/usr/share/doc/${PF} || die
+	fi
+
+	# Manually install the Python bindings (bug #723096)
+	if use python ; then
+		python_foreach_impl python_domodule src/python/botan$(ver_cut 1).py
+	fi
+}
diff --git a/dev-libs/botan/files/botan-2.19.5-boost-1.87.patch b/dev-libs/botan/files/botan-2.19.5-boost-1.87.patch
new file mode 100644
index 000000000000..a52fbaea130d
--- /dev/null
+++ b/dev-libs/botan/files/botan-2.19.5-boost-1.87.patch
@@ -0,0 +1,361 @@
+https://bugs.gentoo.org/946389
+https://github.com/randombit/botan/commit/37fec38ff97604f964122cd2d33f5d503f319b10
+
+From 37fec38ff97604f964122cd2d33f5d503f319b10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ren=C3=A9=20Meusel?= <rene.meusel@rohde-schwarz.com>
+Date: Thu, 19 Dec 2024 10:28:40 +0100
+Subject: [PATCH] Backport: Remove usage of deprecated asio API
+
+These were all finally dropped with boost 1.87, so this fixes
+build with boost 1.87.
+
+Co-Authored-By: Jack Lloyd <jack@randombit.net>
+Co-Authored-By: q66 <q66@chimera-linux.org>
+---
+ src/cli/tls_http_server.cpp         | 16 +++++-----
+ src/cli/tls_proxy.cpp               | 46 ++++++++++++++++-------------
+ src/lib/utils/socket/socket.cpp     | 18 +++++------
+ src/lib/utils/socket/socket_udp.cpp | 18 +++++------
+ 4 files changed, 50 insertions(+), 48 deletions(-)
+
+diff --git a/src/cli/tls_http_server.cpp b/src/cli/tls_http_server.cpp
+index fc0b5bbb77e..67ab126b145 100644
+--- a/src/cli/tls_http_server.cpp
++++ b/src/cli/tls_http_server.cpp
+@@ -176,7 +176,7 @@ class TLS_Asio_HTTP_Session final : public std::enable_shared_from_this<TLS_Asio
+       typedef std::shared_ptr<TLS_Asio_HTTP_Session> pointer;
+ 
+       static pointer create(
+-         boost::asio::io_service& io,
++         boost::asio::io_context& io,
+          Botan::TLS::Session_Manager& session_manager,
+          Botan::Credentials_Manager& credentials,
+          Botan::TLS::Policy& policy)
+@@ -201,7 +201,7 @@ class TLS_Asio_HTTP_Session final : public std::enable_shared_from_this<TLS_Asio
+          }
+ 
+    private:
+-      TLS_Asio_HTTP_Session(boost::asio::io_service& io,
++      TLS_Asio_HTTP_Session(boost::asio::io_context& io,
+                             Botan::TLS::Session_Manager& session_manager,
+                             Botan::Credentials_Manager& credentials,
+                             Botan::TLS::Policy& policy)
+@@ -230,7 +230,8 @@ class TLS_Asio_HTTP_Session final : public std::enable_shared_from_this<TLS_Asio
+ 
+          m_client_socket.async_read_some(
+             boost::asio::buffer(&m_c2s[0], m_c2s.size()),
+-            m_strand.wrap(
++            boost::asio::bind_executor(
++               m_strand,
+                boost::bind(
+                   &TLS_Asio_HTTP_Session::client_read, shared_from_this(),
+                   boost::asio::placeholders::error,
+@@ -332,7 +333,8 @@ class TLS_Asio_HTTP_Session final : public std::enable_shared_from_this<TLS_Asio
+             boost::asio::async_write(
+                m_client_socket,
+                boost::asio::buffer(&m_s2c[0], m_s2c.size()),
+-               m_strand.wrap(
++               boost::asio::bind_executor(
++                  m_strand,
+                   boost::bind(
+                      &TLS_Asio_HTTP_Session::handle_client_write_completion,
+                      shared_from_this(),
+@@ -406,7 +408,7 @@ class TLS_Asio_HTTP_Session final : public std::enable_shared_from_this<TLS_Asio
+             }
+          }
+ 
+-      boost::asio::io_service::strand m_strand;
++      boost::asio::io_context::strand m_strand;
+ 
+       tcp::socket m_client_socket;
+ 
+@@ -427,7 +429,7 @@ class TLS_Asio_HTTP_Server final
+       typedef TLS_Asio_HTTP_Session session;
+ 
+       TLS_Asio_HTTP_Server(
+-         boost::asio::io_service& io, unsigned short port,
++         boost::asio::io_context& io, unsigned short port,
+          Botan::Credentials_Manager& creds,
+          Botan::TLS::Policy& policy,
+          Botan::TLS::Session_Manager& session_mgr,
+@@ -551,7 +553,7 @@ class TLS_HTTP_Server final : public Command
+             session_mgr.reset(new Botan::TLS::Session_Manager_In_Memory(rng()));
+             }
+ 
+-         boost::asio::io_service io;
++         boost::asio::io_context io;
+ 
+          TLS_Asio_HTTP_Server server(io, listen_port, creds, *policy, *session_mgr, max_clients);
+ 
+diff --git a/src/cli/tls_proxy.cpp b/src/cli/tls_proxy.cpp
+index bd96530c202..853be08161c 100644
+--- a/src/cli/tls_proxy.cpp
++++ b/src/cli/tls_proxy.cpp
+@@ -98,11 +98,11 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+       typedef std::shared_ptr<tls_proxy_session> pointer;
+ 
+       static pointer create(
+-         boost::asio::io_service& io,
++         boost::asio::io_context& io,
+          Botan::TLS::Session_Manager& session_manager,
+          Botan::Credentials_Manager& credentials,
+          Botan::TLS::Policy& policy,
+-         tcp::resolver::iterator endpoints)
++         tcp::resolver::results_type endpoints)
+          {
+          return pointer(
+                    new tls_proxy_session(
+@@ -141,11 +141,11 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+    private:
+       tls_proxy_session(
+-         boost::asio::io_service& io,
++         boost::asio::io_context& io,
+          Botan::TLS::Session_Manager& session_manager,
+          Botan::Credentials_Manager& credentials,
+          Botan::TLS::Policy& policy,
+-         tcp::resolver::iterator endpoints)
++         tcp::resolver::results_type endpoints)
+          : m_strand(io)
+          , m_server_endpoints(endpoints)
+          , m_client_socket(io)
+@@ -184,7 +184,8 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+          m_client_socket.async_read_some(
+             boost::asio::buffer(&m_c2p[0], m_c2p.size()),
+-            m_strand.wrap(
++            boost::asio::bind_executor(
++               m_strand,
+                boost::bind(
+                   &tls_proxy_session::client_read, shared_from_this(),
+                   boost::asio::placeholders::error,
+@@ -245,7 +246,8 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+             boost::asio::async_write(
+                m_client_socket,
+                boost::asio::buffer(&m_p2c[0], m_p2c.size()),
+-               m_strand.wrap(
++               boost::asio::bind_executor(
++                  m_strand,
+                   boost::bind(
+                      &tls_proxy_session::handle_client_write_completion,
+                      shared_from_this(),
+@@ -270,11 +272,11 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+             boost::asio::async_write(
+                m_server_socket,
+                boost::asio::buffer(&m_p2s[0], m_p2s.size()),
+-               m_strand.wrap(
+-                  boost::bind(
+-                     &tls_proxy_session::handle_server_write_completion,
+-                     shared_from_this(),
+-                     boost::asio::placeholders::error)));
++               boost::asio::bind_executor(m_strand,
++                                          boost::bind(
++                                             &tls_proxy_session::handle_server_write_completion,
++                                             shared_from_this(),
++                                             boost::asio::placeholders::error)));
+             }
+          }
+ 
+@@ -308,7 +310,8 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+          m_server_socket.async_read_some(
+             boost::asio::buffer(&m_s2p[0], m_s2p.size()),
+-            m_strand.wrap(
++            boost::asio::bind_executor(
++               m_strand,
+                boost::bind(&tls_proxy_session::server_read, shared_from_this(),
+                            boost::asio::placeholders::error,
+                            boost::asio::placeholders::bytes_transferred)));
+@@ -318,7 +321,8 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+          {
+          m_hostname = session.server_info().hostname();
+ 
+-         auto onConnect = [this](boost::system::error_code ec, tcp::resolver::iterator /*endpoint*/)
++         auto onConnect = [this](boost::system::error_code ec,
++                                 const boost::asio::ip::tcp::resolver::results_type::iterator& /*endpoint*/)
+             {
+             if(ec)
+                {
+@@ -328,7 +332,7 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+             server_read(boost::system::error_code(), 0); // start read loop
+             proxy_write_to_server(nullptr, 0);
+             };
+-         async_connect(m_server_socket, m_server_endpoints, onConnect);
++         async_connect(m_server_socket, m_server_endpoints.begin(), m_server_endpoints.end(), onConnect);
+          return true;
+          }
+ 
+@@ -341,9 +345,9 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+             }
+          }
+ 
+-      boost::asio::io_service::strand m_strand;
++      boost::asio::io_context::strand m_strand;
+ 
+-      tcp::resolver::iterator m_server_endpoints;
++      tcp::resolver::results_type m_server_endpoints;
+ 
+       tcp::socket m_client_socket;
+       tcp::socket m_server_socket;
+@@ -369,8 +373,8 @@ class tls_proxy_server final
+       typedef tls_proxy_session session;
+ 
+       tls_proxy_server(
+-         boost::asio::io_service& io, unsigned short port,
+-         tcp::resolver::iterator endpoints,
++         boost::asio::io_context& io, unsigned short port,
++         tcp::resolver::results_type endpoints,
+          Botan::Credentials_Manager& creds,
+          Botan::TLS::Policy& policy,
+          Botan::TLS::Session_Manager& session_mgr,
+@@ -428,7 +432,7 @@ class tls_proxy_server final
+          }
+ 
+       tcp::acceptor m_acceptor;
+-      tcp::resolver::iterator m_server_endpoints;
++      tcp::resolver::results_type m_server_endpoints;
+ 
+       Botan::Credentials_Manager& m_creds;
+       Botan::TLS::Policy& m_policy;
+@@ -479,10 +483,10 @@ class TLS_Proxy final : public Command
+ 
+          auto policy = load_tls_policy(get_arg("policy"));
+ 
+-         boost::asio::io_service io;
++         boost::asio::io_context io;
+ 
+          tcp::resolver resolver(io);
+-         auto server_endpoint_iterator = resolver.resolve({ target, target_port });
++         auto server_endpoint_iterator = resolver.resolve(target, target_port);
+ 
+          std::unique_ptr<Botan::TLS::Session_Manager> session_mgr;
+ 
+diff --git a/src/lib/utils/socket/socket.cpp b/src/lib/utils/socket/socket.cpp
+index bc632259a64..0ce4e85830f 100644
+--- a/src/lib/utils/socket/socket.cpp
++++ b/src/lib/utils/socket/socket.cpp
+@@ -48,19 +48,17 @@ class Asio_Socket final : public OS::Socket
+                   std::chrono::milliseconds timeout) :
+          m_timeout(timeout), m_timer(m_io), m_tcp(m_io)
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+          check_timeout();
+ 
+          boost::asio::ip::tcp::resolver resolver(m_io);
+-         boost::asio::ip::tcp::resolver::query query(hostname, service);
+-         boost::asio::ip::tcp::resolver::iterator dns_iter = resolver.resolve(query);
++         boost::asio::ip::tcp::resolver::results_type endpoints = resolver.resolve(hostname, service);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+          auto connect_cb = [&ec](const boost::system::error_code& e,
+-                                 boost::asio::ip::tcp::resolver::iterator) { ec = e; };
+-
+-         boost::asio::async_connect(m_tcp, dns_iter, connect_cb);
++                                 const boost::asio::ip::tcp::resolver::results_type::iterator&) { ec = e; };
++         boost::asio::async_connect(m_tcp, endpoints.begin(), endpoints.end(), connect_cb);
+ 
+          while(ec == boost::asio::error::would_block)
+             {
+@@ -75,7 +73,7 @@ class Asio_Socket final : public OS::Socket
+ 
+       void write(const uint8_t buf[], size_t len) override
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+@@ -92,7 +90,7 @@ class Asio_Socket final : public OS::Socket
+ 
+       size_t read(uint8_t buf[], size_t len) override
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+          size_t got = 0;
+@@ -115,7 +113,7 @@ class Asio_Socket final : public OS::Socket
+    private:
+       void check_timeout()
+          {
+-         if(m_tcp.is_open() && m_timer.expires_at() < std::chrono::system_clock::now())
++         if(m_tcp.is_open() && m_timer.expiry() < std::chrono::system_clock::now())
+             {
+             boost::system::error_code err;
+             m_tcp.close(err);
+@@ -125,7 +123,7 @@ class Asio_Socket final : public OS::Socket
+          }
+ 
+       const std::chrono::milliseconds m_timeout;
+-      boost::asio::io_service m_io;
++      boost::asio::io_context m_io;
+       boost::asio::system_timer m_timer;
+       boost::asio::ip::tcp::socket m_tcp;
+    };
+diff --git a/src/lib/utils/socket/socket_udp.cpp b/src/lib/utils/socket/socket_udp.cpp
+index fbbdd9abbcc..82a25b49cda 100644
+--- a/src/lib/utils/socket/socket_udp.cpp
++++ b/src/lib/utils/socket/socket_udp.cpp
+@@ -48,19 +48,17 @@ class Asio_SocketUDP final : public OS::SocketUDP
+                      std::chrono::microseconds timeout) :
+          m_timeout(timeout), m_timer(m_io), m_udp(m_io)
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+          check_timeout();
+ 
+          boost::asio::ip::udp::resolver resolver(m_io);
+-         boost::asio::ip::udp::resolver::query query(hostname, service);
+-         boost::asio::ip::udp::resolver::iterator dns_iter = resolver.resolve(query);
++         boost::asio::ip::udp::resolver::results_type endpoints = resolver.resolve(hostname, service);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+          auto connect_cb = [&ec](const boost::system::error_code& e,
+-         boost::asio::ip::udp::resolver::iterator) { ec = e; };
+-
+-         boost::asio::async_connect(m_udp, dns_iter, connect_cb);
++                                 const boost::asio::ip::udp::resolver::results_type::iterator&) { ec = e; };
++         boost::asio::async_connect(m_udp, endpoints.begin(), endpoints.end(), connect_cb);
+ 
+          while(ec == boost::asio::error::would_block)
+             {
+@@ -75,7 +73,7 @@ class Asio_SocketUDP final : public OS::SocketUDP
+ 
+       void write(const uint8_t buf[], size_t len) override
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+@@ -95,7 +93,7 @@ class Asio_SocketUDP final : public OS::SocketUDP
+ 
+       size_t read(uint8_t buf[], size_t len) override
+          {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+          size_t got = 0;
+@@ -121,7 +119,7 @@ class Asio_SocketUDP final : public OS::SocketUDP
+    private:
+       void check_timeout()
+          {
+-         if(m_udp.is_open() && m_timer.expires_at() < std::chrono::system_clock::now())
++         if(m_udp.is_open() && m_timer.expiry() < std::chrono::system_clock::now())
+             {
+             boost::system::error_code err;
+             m_udp.close(err);
+@@ -131,7 +129,7 @@ class Asio_SocketUDP final : public OS::SocketUDP
+          }
+ 
+       const std::chrono::microseconds m_timeout;
+-      boost::asio::io_service m_io;
++      boost::asio::io_context m_io;
+       boost::asio::system_timer m_timer;
+       boost::asio::ip::udp::socket m_udp;
+    };
+
diff --git a/dev-libs/botan/files/botan-2.19.5-cloudflare.patch b/dev-libs/botan/files/botan-2.19.5-cloudflare.patch
new file mode 100644
index 000000000000..0824fd9a1089
--- /dev/null
+++ b/dev-libs/botan/files/botan-2.19.5-cloudflare.patch
@@ -0,0 +1,52 @@
+https://github.com/randombit/botan/commit/698c383b050591ae1a239c9e6d4ebe05532d2eee
+
+From 698c383b050591ae1a239c9e6d4ebe05532d2eee Mon Sep 17 00:00:00 2001
+From: Luke Valenta <lvalenta@cloudflare.com>
+Date: Thu, 11 Apr 2024 14:24:36 -0400
+Subject: [PATCH] Backport: Update roughtime.cloudflare.com public key and port
+
+See also #4002.
+
+Fixes #3937. Note that the old Cloudflare public key is still present in
+test vectors in the codebase.
+---
+ src/cli/roughtime.cpp        | 2 +-
+ src/tests/test_roughtime.cpp | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/cli/roughtime.cpp b/src/cli/roughtime.cpp
+index ff38fe1c43c..6c1561efacd 100644
+--- a/src/cli/roughtime.cpp
++++ b/src/cli/roughtime.cpp
+@@ -72,7 +72,7 @@ class Roughtime final : public Command
+       <name> <key type> <base 64 encoded public key> <protocol> <host:port>
+ 
+    Example servers:
+-      Cloudflare-Roughtime ed25519 gD63hSj3ScS+wuOeGrubXlq35N1c5Lby/S+T7MNTjxo= udp roughtime.cloudflare.com:2002
++      Cloudflare-Roughtime ed25519 0GD7c3yP8xEc4Zl2zeuN2SlLvDVVocjsPSL8/Rl/7zg= udp roughtime.cloudflare.com:2003
+       Google-Sandbox-Roughtime ed25519 etPaaIxcBMY1oUeGpwvPMCJMwlRVNxv51KK/tktoJTQ= udp roughtime.sandbox.google.com:2002
+ 
+ --chain-file=<filename>
+diff --git a/src/tests/test_roughtime.cpp b/src/tests/test_roughtime.cpp
+index 48ac545876b..4b29837e9b6 100644
+--- a/src/tests/test_roughtime.cpp
++++ b/src/tests/test_roughtime.cpp
+@@ -191,7 +191,7 @@ class Roughtime final : public Test
+ 
+          const auto servers = Botan::Roughtime::servers_from_str(
+                                  "Chainpoint-Roughtime ed25519 bbT+RPS7zKX6w71ssPibzmwWqU9ffRV5oj2OresSmhE= udp roughtime.chainpoint.org:2002\n"
+-                                 "Cloudflare-Roughtime ed25519 gD63hSj3ScS+wuOeGrubXlq35N1c5Lby/S+T7MNTjxo= udp roughtime.cloudflare.com:2002\n"
++                                 "Cloudflare-Roughtime ed25519 0GD7c3yP8xEc4Zl2zeuN2SlLvDVVocjsPSL8/Rl/7zg= udp roughtime.cloudflare.com:2003\n"
+                                  "Google-Sandbox-Roughtime ed25519 etPaaIxcBMY1oUeGpwvPMCJMwlRVNxv51KK/tktoJTQ= udp roughtime.sandbox.google.com:2002\n"
+                                  "int08h-Roughtime ed25519 AW5uAoTSTDfG5NfY1bTh08GUnOqlRb+HVhbJ3ODJvsE= udp roughtime.int08h.com:2002\n"
+                                  "ticktock ed25519 cj8GsiNlRkqiDElAeNMSBBMwrAl15hYPgX50+GWX/lA= udp ticktock.mixmin.net:5333\n"
+@@ -224,7 +224,7 @@ class Roughtime final : public Test
+          Botan::Roughtime::Nonce nonce(Test::rng());
+          try
+             {
+-            const auto response_raw = Botan::Roughtime::online_request("roughtime.cloudflare.com:2002", nonce,
++            const auto response_raw = Botan::Roughtime::online_request("roughtime.cloudflare.com:2003", nonce,
+                                       std::chrono::seconds(5));
+             const auto now = std::chrono::system_clock::now();
+             const auto response = Botan::Roughtime::Response::from_bits(response_raw, nonce);
+
diff --git a/dev-libs/botan/files/botan-2.19.5-no-distutils.patch b/dev-libs/botan/files/botan-2.19.5-no-distutils.patch
new file mode 100644
index 000000000000..bc6631fb7cc6
--- /dev/null
+++ b/dev-libs/botan/files/botan-2.19.5-no-distutils.patch
@@ -0,0 +1,86 @@
+https://github.com/randombit/botan/commit/0fed26215b52a3d30122deb528f6b4deb824eae7
+
+From 0fed26215b52a3d30122deb528f6b4deb824eae7 Mon Sep 17 00:00:00 2001
+From: Jack Lloyd <jack@randombit.net>
+Date: Fri, 6 Sep 2024 11:56:01 -0400
+Subject: [PATCH] Remove code relying on Python distutils
+
+This was just used to check if Sphinx supports concurrency, but
+Sphinx is also barely faster with 1 core vs 32, so it hardly matters.
+
+Debian bug 1080557
+---
+ src/scripts/build_docs.py | 45 ---------------------------------------
+ 1 file changed, 45 deletions(-)
+
+diff --git a/src/scripts/build_docs.py b/src/scripts/build_docs.py
+index 6eb9b656c98..5bd04acb13b 100755
+--- a/src/scripts/build_docs.py
++++ b/src/scripts/build_docs.py
+@@ -18,18 +18,6 @@
+ import os
+ import stat
+ 
+-def get_concurrency():
+-    """
+-    Get default concurrency level of build
+-    """
+-    def_concurrency = 2
+-
+-    try:
+-        import multiprocessing
+-        return max(def_concurrency, multiprocessing.cpu_count())
+-    except ImportError:
+-        return def_concurrency
+-
+ def have_prog(prog):
+     """
+     Check if some named program exists in the path
+@@ -124,37 +112,6 @@ def log_level():
+ 
+     return options
+ 
+-def sphinx_supports_concurrency():
+-    import re
+-    from distutils.version import StrictVersion
+-
+-    proc = subprocess.Popen(['sphinx-build', '--version'],
+-                            stdout=subprocess.PIPE,
+-                            stderr=subprocess.STDOUT)
+-    output, _ = proc.communicate()
+-    if isinstance(output, bytes):
+-        output = output.decode('ascii')
+-    output = output.strip()
+-
+-    # Sphinx v1.1.3
+-    # sphinx-build 1.7.4
+-    match = re.match(r'^(?:[a-zA-Z_-]+) v?(([0-9]+)\.([0-9]+))', output)
+-
+-    if match is None:
+-        # If regex doesn't match, disable by default
+-        logging.warning("Did not recognize sphinx version from '%s'", output)
+-        return False
+-
+-    version = StrictVersion(match.group(1))
+-
+-    if version < StrictVersion('1.4'):
+-        # not supported
+-        return False
+-    if version == StrictVersion('3.0'):
+-        # Bug in Sphinx 3.0 https://github.com/sphinx-doc/sphinx/issues/7438
+-        return False
+-    return True
+-
+ def read_config(config):
+     try:
+         f = open(config)
+@@ -203,8 +160,6 @@ def main(args=None):
+ 
+     if with_sphinx:
+         sphinx_build = ['sphinx-build', '-q', '-c', cfg['sphinx_config_dir']]
+-        if sphinx_supports_concurrency():
+-            sphinx_build += ['-j', str(get_concurrency())]
+ 
+         cmds.append(sphinx_build + ['-b', 'html', handbook_src, handbook_output])
+ 
+
diff --git a/dev-libs/botan/files/botan-3.6.1-boost-1.87.patch b/dev-libs/botan/files/botan-3.6.1-boost-1.87.patch
new file mode 100644
index 000000000000..eb42cad0567d
--- /dev/null
+++ b/dev-libs/botan/files/botan-3.6.1-boost-1.87.patch
@@ -0,0 +1,322 @@
+https://bugs.gentoo.org/946389
+https://github.com/randombit/botan/pull/4484
+
+From 2a406beab449a2cb310fa543451a7087ca7b4b1a Mon Sep 17 00:00:00 2001
+From: q66 <q66@chimera-linux.org>
+Date: Sun, 15 Dec 2024 02:42:02 +0100
+Subject: [PATCH 1/2] Remove usage of deprecated asio API
+
+These were all finally dropped with boost 1.87, so this fixes
+build with boost 1.87.
+--- a/src/cli/tls_proxy.cpp
++++ b/src/cli/tls_proxy.cpp
+@@ -106,11 +106,11 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+       typedef std::shared_ptr<tls_proxy_session> pointer;
+ 
+-      static pointer create(boost::asio::io_service& io,
++      static pointer create(boost::asio::io_context& io,
+                             const std::shared_ptr<Botan::TLS::Session_Manager>& session_manager,
+                             const std::shared_ptr<Botan::Credentials_Manager>& credentials,
+                             const std::shared_ptr<Botan::TLS::Policy>& policy,
+-                            const tcp::resolver::iterator& endpoints) {
++                            const tcp::resolver::results_type& endpoints) {
+          auto session = std::make_shared<tls_proxy_session>(io, endpoints);
+ 
+          // Defer the setup of the TLS server to make use of
+@@ -144,7 +144,7 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+          }
+       }
+ 
+-      tls_proxy_session(boost::asio::io_service& io, tcp::resolver::iterator endpoints) :
++      tls_proxy_session(boost::asio::io_context& io, tcp::resolver::results_type endpoints) :
+             m_strand(io),
+             m_server_endpoints(std::move(endpoints)),
+             m_client_socket(io),
+@@ -287,7 +287,7 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+       void tls_session_activated() override {
+          auto onConnect = [self = weak_from_this()](boost::system::error_code ec,
+-                                                    const tcp::resolver::iterator& /*endpoint*/) {
++                                                    tcp::resolver::results_type::iterator /*endpoint*/) {
+             if(ec) {
+                log_error("Server connection", ec);
+                return;
+@@ -301,7 +301,7 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+                return;
+             }
+          };
+-         async_connect(m_server_socket, m_server_endpoints, onConnect);
++         async_connect(m_server_socket, m_server_endpoints.begin(), m_server_endpoints.end(), onConnect);
+       }
+ 
+       void tls_session_established(const Botan::TLS::Session_Summary& session) override {
+@@ -315,9 +315,9 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+          }
+       }
+ 
+-      boost::asio::io_service::strand m_strand;
++      boost::asio::io_context::strand m_strand;
+ 
+-      tcp::resolver::iterator m_server_endpoints;
++      tcp::resolver::results_type m_server_endpoints;
+ 
+       tcp::socket m_client_socket;
+       tcp::socket m_server_socket;
+@@ -341,9 +341,9 @@ class tls_proxy_server final {
+    public:
+       typedef tls_proxy_session session;
+ 
+-      tls_proxy_server(boost::asio::io_service& io,
++      tls_proxy_server(boost::asio::io_context& io,
+                        unsigned short port,
+-                       tcp::resolver::iterator endpoints,
++                       tcp::resolver::results_type endpoints,
+                        std::shared_ptr<Botan::Credentials_Manager> creds,
+                        std::shared_ptr<Botan::TLS::Policy> policy,
+                        std::shared_ptr<Botan::TLS::Session_Manager> session_mgr,
+@@ -383,7 +383,7 @@ class tls_proxy_server final {
+       }
+ 
+       tcp::acceptor m_acceptor;
+-      tcp::resolver::iterator m_server_endpoints;
++      tcp::resolver::results_type m_server_endpoints;
+ 
+       std::shared_ptr<Botan::Credentials_Manager> m_creds;
+       std::shared_ptr<Botan::TLS::Policy> m_policy;
+@@ -429,10 +429,10 @@ class TLS_Proxy final : public Command {
+ 
+          auto policy = load_tls_policy(get_arg("policy"));
+ 
+-         boost::asio::io_service io;
++         boost::asio::io_context io;
+ 
+          tcp::resolver resolver(io);
+-         auto server_endpoint_iterator = resolver.resolve({target, target_port});
++         auto server_endpoint_iterator = resolver.resolve(target, target_port);
+ 
+          std::shared_ptr<Botan::TLS::Session_Manager> session_mgr;
+ 
+--- a/src/lib/utils/socket/socket.cpp
++++ b/src/lib/utils/socket/socket.cpp
+@@ -46,20 +46,19 @@ class Asio_Socket final : public OS::Socket {
+    public:
+       Asio_Socket(std::string_view hostname, std::string_view service, std::chrono::milliseconds timeout) :
+             m_timeout(timeout), m_timer(m_io), m_tcp(m_io) {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+          check_timeout();
+ 
+          boost::asio::ip::tcp::resolver resolver(m_io);
+-         boost::asio::ip::tcp::resolver::query query(std::string{hostname}, std::string{service});
+-         boost::asio::ip::tcp::resolver::iterator dns_iter = resolver.resolve(query);
++         boost::asio::ip::tcp::resolver::results_type dns_iter = resolver.resolve(std::string{hostname}, std::string{service});
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+-         auto connect_cb = [&ec](const boost::system::error_code& e, const boost::asio::ip::tcp::resolver::iterator&) {
++         auto connect_cb = [&ec](const boost::system::error_code& e, boost::asio::ip::tcp::resolver::results_type::iterator) {
+             ec = e;
+          };
+ 
+-         boost::asio::async_connect(m_tcp, dns_iter, connect_cb);
++         boost::asio::async_connect(m_tcp, dns_iter.begin(), dns_iter.end(), connect_cb);
+ 
+          while(ec == boost::asio::error::would_block) {
+             m_io.run_one();
+@@ -74,7 +73,7 @@ class Asio_Socket final : public OS::Socket {
+       }
+ 
+       void write(const uint8_t buf[], size_t len) override {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+@@ -90,7 +89,7 @@ class Asio_Socket final : public OS::Socket {
+       }
+ 
+       size_t read(uint8_t buf[], size_t len) override {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+          size_t got = 0;
+@@ -116,7 +115,7 @@ class Asio_Socket final : public OS::Socket {
+ 
+    private:
+       void check_timeout() {
+-         if(m_tcp.is_open() && m_timer.expires_at() < std::chrono::system_clock::now()) {
++         if(m_tcp.is_open() && m_timer.expiry() < std::chrono::system_clock::now()) {
+             boost::system::error_code err;
+ 
+             // NOLINTNEXTLINE(bugprone-unused-return-value,cert-err33-c)
+@@ -127,7 +126,7 @@ class Asio_Socket final : public OS::Socket {
+       }
+ 
+       const std::chrono::milliseconds m_timeout;
+-      boost::asio::io_service m_io;
++      boost::asio::io_context m_io;
+       boost::asio::system_timer m_timer;
+       boost::asio::ip::tcp::socket m_tcp;
+ };
+--- a/src/lib/utils/socket/socket_udp.cpp
++++ b/src/lib/utils/socket/socket_udp.cpp
+@@ -46,20 +46,19 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+    public:
+       Asio_SocketUDP(std::string_view hostname, std::string_view service, std::chrono::microseconds timeout) :
+             m_timeout(timeout), m_timer(m_io), m_udp(m_io) {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+          check_timeout();
+ 
+          boost::asio::ip::udp::resolver resolver(m_io);
+-         boost::asio::ip::udp::resolver::query query(std::string{hostname}, std::string{service});
+-         boost::asio::ip::udp::resolver::iterator dns_iter = resolver.resolve(query);
++         boost::asio::ip::udp::resolver::results_type dns_iter = resolver.resolve(std::string{hostname}, std::string{service});
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+-         auto connect_cb = [&ec](const boost::system::error_code& e, const boost::asio::ip::udp::resolver::iterator&) {
++         auto connect_cb = [&ec](const boost::system::error_code& e, boost::asio::ip::udp::resolver::results_type::iterator) {
+             ec = e;
+          };
+ 
+-         boost::asio::async_connect(m_udp, dns_iter, connect_cb);
++         boost::asio::async_connect(m_udp, dns_iter.begin(), dns_iter.end(), connect_cb);
+ 
+          while(ec == boost::asio::error::would_block) {
+             m_io.run_one();
+@@ -74,7 +73,7 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+       }
+ 
+       void write(const uint8_t buf[], size_t len) override {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+@@ -90,7 +89,7 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+       }
+ 
+       size_t read(uint8_t buf[], size_t len) override {
+-         m_timer.expires_from_now(m_timeout);
++         m_timer.expires_after(m_timeout);
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+          size_t got = 0;
+@@ -116,7 +115,7 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+ 
+    private:
+       void check_timeout() {
+-         if(m_udp.is_open() && m_timer.expires_at() < std::chrono::system_clock::now()) {
++         if(m_udp.is_open() && m_timer.expiry() < std::chrono::system_clock::now()) {
+             boost::system::error_code err;
+ 
+             // NOLINTNEXTLINE(bugprone-unused-return-value,cert-err33-c)
+@@ -127,7 +126,7 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+       }
+ 
+       const std::chrono::microseconds m_timeout;
+-      boost::asio::io_service m_io;
++      boost::asio::io_context m_io;
+       boost::asio::system_timer m_timer;
+       boost::asio::ip::udp::socket m_udp;
+ };
+
+From 3820f357017eacef1fcb5119582bc9789b88f6c2 Mon Sep 17 00:00:00 2001
+From: Jack Lloyd <jack@randombit.net>
+Date: Wed, 18 Dec 2024 17:10:34 -0500
+Subject: [PATCH 2/2] Address review comments
+
+--- a/src/cli/tls_proxy.cpp
++++ b/src/cli/tls_proxy.cpp
+@@ -287,7 +287,7 @@ class tls_proxy_session final : public std::enable_shared_from_this<tls_proxy_se
+ 
+       void tls_session_activated() override {
+          auto onConnect = [self = weak_from_this()](boost::system::error_code ec,
+-                                                    tcp::resolver::results_type::iterator /*endpoint*/) {
++                                                    const tcp::resolver::results_type::iterator& /*endpoint*/) {
+             if(ec) {
+                log_error("Server connection", ec);
+                return;
+--- a/src/examples/tls_stream_client.cpp
++++ b/src/examples/tls_stream_client.cpp
+@@ -35,7 +35,7 @@ class Credentials_Manager : public Botan::Credentials_Manager {
+ class client {
+    public:
+       client(boost::asio::io_context& io_context,
+-             boost::asio::ip::tcp::resolver::iterator endpoint_iterator,
++             const boost::asio::ip::tcp::resolver::results_type& endpoints,
+              std::string_view host,
+              const http::request<http::string_body>& req) :
+             m_request(req),
+@@ -46,7 +46,8 @@ class client {
+                                                         host)),
+             m_stream(io_context, m_ctx) {
+          boost::asio::async_connect(m_stream.lowest_layer(),
+-                                    std::move(endpoint_iterator),
++                                    endpoints.begin(),
++                                    endpoints.end(),
+                                     boost::bind(&client::handle_connect, this, ap::error));
+       }
+ 
+@@ -111,8 +112,7 @@ int main(int argc, char* argv[]) {
+       boost::asio::io_context io_context;
+ 
+       boost::asio::ip::tcp::resolver resolver(io_context);
+-      boost::asio::ip::tcp::resolver::query query(host, port);
+-      boost::asio::ip::tcp::resolver::iterator iterator = resolver.resolve(query);
++      boost::asio::ip::tcp::resolver::results_type endpoints = resolver.resolve(host, port);
+ 
+       http::request<http::string_body> req;
+       req.version(11);
+@@ -121,7 +121,7 @@ int main(int argc, char* argv[]) {
+       req.set(http::field::host, host);
+       req.set(http::field::user_agent, Botan::version_string());
+ 
+-      client c(io_context, iterator, host, req);
++      client c(io_context, endpoints, host, req);
+ 
+       io_context.run();
+    } catch(std::exception& e) {
+--- a/src/lib/utils/socket/socket.cpp
++++ b/src/lib/utils/socket/socket.cpp
+@@ -50,13 +50,12 @@ class Asio_Socket final : public OS::Socket {
+          check_timeout();
+ 
+          boost::asio::ip::tcp::resolver resolver(m_io);
+-         boost::asio::ip::tcp::resolver::results_type dns_iter = resolver.resolve(std::string{hostname}, std::string{service});
++         boost::asio::ip::tcp::resolver::results_type dns_iter =
++            resolver.resolve(std::string{hostname}, std::string{service});
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+-         auto connect_cb = [&ec](const boost::system::error_code& e, boost::asio::ip::tcp::resolver::results_type::iterator) {
+-            ec = e;
+-         };
++         auto connect_cb = [&ec](const boost::system::error_code& e, const auto&) { ec = e; };
+ 
+          boost::asio::async_connect(m_tcp, dns_iter.begin(), dns_iter.end(), connect_cb);
+ 
+--- a/src/lib/utils/socket/socket_udp.cpp
++++ b/src/lib/utils/socket/socket_udp.cpp
+@@ -50,13 +50,13 @@ class Asio_SocketUDP final : public OS::SocketUDP {
+          check_timeout();
+ 
+          boost::asio::ip::udp::resolver resolver(m_io);
+-         boost::asio::ip::udp::resolver::results_type dns_iter = resolver.resolve(std::string{hostname}, std::string{service});
++         boost::asio::ip::udp::resolver::results_type dns_iter =
++            resolver.resolve(std::string{hostname}, std::string{service});
+ 
+          boost::system::error_code ec = boost::asio::error::would_block;
+ 
+-         auto connect_cb = [&ec](const boost::system::error_code& e, boost::asio::ip::udp::resolver::results_type::iterator) {
+-            ec = e;
+-         };
++         auto connect_cb = [&ec](const boost::system::error_code& e,
++                                 const boost::asio::ip::udp::resolver::results_type::iterator&) { ec = e; };
+ 
+          boost::asio::async_connect(m_udp, dns_iter.begin(), dns_iter.end(), connect_cb);
+ 
+