gentoo auto-resync : 01:02:2024 - 17:48:32

12 files changed, 939 insertions, 0 deletions

diff --git a/dev-libs/Manifest.gz b/dev-libs/Manifest.gz
index 7ae6f8844984..56462a7f3a4a 100644
--- a/dev-libs/Manifest.gz
+++ b/dev-libs/Manifest.gz
diff --git a/dev-libs/heatshrink/Manifest b/dev-libs/heatshrink/Manifest
new file mode 100644
index 000000000000..32966d83c414
--- /dev/null
+++ b/dev-libs/heatshrink/Manifest
@@ -0,0 +1,4 @@
+AUX heatshrink-0.4.1-cmake.patch 3494 BLAKE2B 7c7de2b3673ee80b4dd79ade1979774d54c0daa417a057a8fce286882cc2761fcdb60be58a6c551ad881fa7ec4046da7f9ed7e434eb9c5bdf01992f9838408c3 SHA512 70ef9d8e830c35ac1e77b6f1ca9c35db434e0434a5bc22a0f690d97db47aafacf2559551bdd7a0f8636d8893b92acd851620789604aa0c09196e43d32f5e0a90
+DIST heatshrink-0.4.1.tar.gz 36945 BLAKE2B 526e3f88ddaec8116e5eef1a73a4450454ca808545dfe4a36069be8a0d771ca92c850c51f9b3c3e73f244454ba17d03da8fb0be4849728300c7eb8181e39651e SHA512 bb9610b963da0762b1ac21d0907f3801b525431abff495b66cadc244a2b2b334441de2b14442b722bfeb56cb4459fe4021eae0d0454f9e26a80e6efa11f079d2
+EBUILD heatshrink-0.4.1.ebuild 456 BLAKE2B 7565d451d2d4fff34c350fff1e6e4a270dc65e7269bc860b7725e6886dfbfd2a8276c3583b6263f5b1dc976dbb1f873a0d0991b27eabb8b38271c9d576845b71 SHA512 dca4a30e0451564993d38041819abfc2fd50109851c813a1c75fa168438b1b2bdca1239e21a7610a6f78544764775e9274a472ebfc429c40440d063f9fcc2e97
+MISC metadata.xml 529 BLAKE2B f28e5b96f0051e5986331231b6ee3c39a112d04434e69b1f59b1f64345a7ab41aa60597a4c27da4927a0fbeced3a1dd19cbeccd0f40bf85465bb369697ccb1e3 SHA512 2c8f0272a07aef6708035a9d9001a297e11d379c61d023df8b142bdc14599f5b0eb305438a4ec6772b93baf812c412ae598df74786878f953b9271d100334130
diff --git a/dev-libs/heatshrink/files/heatshrink-0.4.1-cmake.patch b/dev-libs/heatshrink/files/heatshrink-0.4.1-cmake.patch
new file mode 100644
index 000000000000..3230949b84bf
--- /dev/null
+++ b/dev-libs/heatshrink/files/heatshrink-0.4.1-cmake.patch
@@ -0,0 +1,108 @@
+diff -urN heatshrink-0.4.1.orig/CMakeLists.txt heatshrink-0.4.1/CMakeLists.txt
+--- heatshrink-0.4.1.orig/CMakeLists.txt	1970-01-01 03:00:00.000000000 +0300
++++ heatshrink-0.4.1/CMakeLists.txt	2024-02-01 15:11:32.356696150 +0300
+@@ -0,0 +1,93 @@
++cmake_minimum_required(VERSION 3.10)
++
++project(heatshrink LANGUAGES C VERSION 0.4.1)
++
++set(CMAKE_C_STANDARD 99)
++set(CMAKE_C_STANDARD_REQUIRED ON)
++set(CMAKE_WINDOWS_EXPORT_ALL_SYMBOLS ON)
++
++add_library(${PROJECT_NAME} heatshrink_decoder.c heatshrink_encoder.c)
++add_library(${PROJECT_NAME}_dynalloc heatshrink_decoder.c heatshrink_encoder.c)
++
++find_library(MATH_LIBRARY m) # Business as usual
++if(MATH_LIBRARY)
++    target_link_libraries(${PROJECT_NAME} PUBLIC ${MATH_LIBRARY})
++endif()
++
++target_include_directories(${PROJECT_NAME} PUBLIC $<INSTALL_INTERFACE:include>)
++target_include_directories(${PROJECT_NAME}_dynalloc PUBLIC $<INSTALL_INTERFACE:include>)
++
++target_compile_definitions(${PROJECT_NAME} PUBLIC HEATSHRINK_DYNAMIC_ALLOC=0)
++target_compile_definitions(${PROJECT_NAME}_dynalloc PUBLIC HEATSHRINK_DYNAMIC_ALLOC=1)
++
++if (UNIX)
++  add_executable(${PROJECT_NAME}_cmd heatshrink.c)
++  target_link_libraries(${PROJECT_NAME}_cmd ${PROJECT_NAME}_dynalloc)
++  set_target_properties(${PROJECT_NAME}_cmd PROPERTIES OUTPUT_NAME ${PROJECT_NAME})
++endif ()
++
++foreach (tgt ${PROJECT_NAME} ${PROJECT_NAME}_dynalloc)
++  set_target_properties(${tgt}
++    PROPERTIES
++    VERSION ${PROJECT_VERSION}
++    SOVERSION ${PROJECT_VERSION})
++endforeach()
++
++# Installation and export:
++
++include(CMakePackageConfigHelpers)
++
++write_basic_package_version_file(
++    "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}ConfigVersion.cmake"
++    VERSION ${PROJECT_VERSION}
++    COMPATIBILITY AnyNewerVersion
++)
++
++set(_exported_targets ${PROJECT_NAME} ${PROJECT_NAME}_dynalloc)
++if (UNIX)
++  list(APPEND _exported_targets ${PROJECT_NAME}_cmd)
++endif ()
++
++install(TARGETS ${_exported_targets}
++        EXPORT ${PROJECT_NAME}Targets
++)
++
++export(EXPORT ${PROJECT_NAME}Targets 
++       FILE "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Targets.cmake" 
++       NAMESPACE ${PROJECT_NAME}::
++)
++
++include(GNUInstallDirs)
++set(ConfigPackageLocation ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME})
++
++configure_package_config_file(${CMAKE_CURRENT_SOURCE_DIR}/Config.cmake.in
++  "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake"
++  INSTALL_DESTINATION ${ConfigPackageLocation}
++)
++
++install(
++    FILES
++      heatshrink_common.h
++      heatshrink_config.h
++      heatshrink_encoder.h
++      heatshrink_decoder.h
++    DESTINATION
++      include/${PROJECT_NAME}
++  )
++
++install(EXPORT ${PROJECT_NAME}Targets
++  FILE
++    ${PROJECT_NAME}Targets.cmake
++  NAMESPACE
++    ${PROJECT_NAME}::
++  DESTINATION
++    ${ConfigPackageLocation}
++)
++
++install(
++  FILES
++    "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}Config.cmake"
++    "${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}ConfigVersion.cmake"
++  DESTINATION
++    ${ConfigPackageLocation}
++)
+\ В конце файла нет новой строки
+diff -urN heatshrink-0.4.1.orig/Config.cmake.in heatshrink-0.4.1/Config.cmake.in
+--- heatshrink-0.4.1.orig/Config.cmake.in	1970-01-01 03:00:00.000000000 +0300
++++ heatshrink-0.4.1/Config.cmake.in	2024-02-01 15:11:32.356696150 +0300
+@@ -0,0 +1,5 @@
++@PACKAGE_INIT@
++
++if (EXISTS ${CMAKE_CURRENT_LIST_DIR}/@PROJECT_NAME@Targets.cmake)
++    include("${CMAKE_CURRENT_LIST_DIR}/@PROJECT_NAME@Targets.cmake")
++endif ()
+\ В конце файла нет новой строки
diff --git a/dev-libs/heatshrink/heatshrink-0.4.1.ebuild b/dev-libs/heatshrink/heatshrink-0.4.1.ebuild
new file mode 100644
index 000000000000..172cf6a7e44c
--- /dev/null
+++ b/dev-libs/heatshrink/heatshrink-0.4.1.ebuild
@@ -0,0 +1,16 @@
+# Copyright 2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake
+
+DESCRIPTION="A data compression/decompression library for embedded/real-time systems"
+HOMEPAGE="https://github.com/atomicobject/heatshrink"
+SRC_URI="https://github.com/atomicobject/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="ISC"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64 ~x86"
+
+PATCHES=( "${FILESDIR}/${P}-cmake.patch" )
diff --git a/dev-libs/heatshrink/metadata.xml b/dev-libs/heatshrink/metadata.xml
new file mode 100644
index 000000000000..df9f753c622a
--- /dev/null
+++ b/dev-libs/heatshrink/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="project">
+		<email>3dprint@gentoo.org</email>
+		<name>Gentoo 3D Printer Project</name>
+	</maintainer>
+	<maintainer type="person">
+		<email>alexxy@gentoo.org</email>
+		<name>Alexey Shvetsov</name>
+	</maintainer>
+	<upstream>
+		<bugs-to>https://github.com/atomicobject/heatshrink/issues</bugs-to>
+		<remote-id type="github">atomicobject/heatshrink</remote-id>
+	</upstream>
+</pkgmetadata>
diff --git a/dev-libs/openssl/Manifest b/dev-libs/openssl/Manifest
index edcc90476bd4..cd3a8800810a 100644
--- a/dev-libs/openssl/Manifest
+++ b/dev-libs/openssl/Manifest
@@ -2,6 +2,8 @@ AUX gentoo.config-1.0.2 5302 BLAKE2B b699533ed86c48c0d033092b4d901de837a6a495113
 AUX gentoo.config-1.0.4 5931 BLAKE2B 9c0d515204feefbfc5c579a43c3ec5a09c28dd915781a8d5d26e96f5b4f65cf6a5d74d48e5911bfcbace1a825e94338d40482bc642a391374016bd6af9308f81 SHA512 a4e673b1ce2f16aa5bfc127ecd6f5de9dc40a1ddda66ab4fa06694f85bf6184621f131502e01771f0fc97c42dc7009b46fdae82fd58509a4ab20b9ee79d8d5bc
 AUX openssl-1.1.0j-parallel_install_fix.patch 515 BLAKE2B a1bcffce4dc9e0566e21e753cf1a18ee6eac92aca5880c50b33966d8ecb391f7430e1db6ea5a30ee4e3a9d77fb9e5542e864508b01c325011e368165e079a96c SHA512 0badd29ec8cffd95b2b69a4b8f8eecfc9ea0c00a812b298a650ee353e3965147fd2da1f9058d2d51744838f38168257b89aaf317287c55a7b76f16a69c781828
 AUX openssl-1.1.1i-riscv32.patch 2557 BLAKE2B 97e51303706ee96d3fae46959b91d1021dcbb3efa421866f6e09bbee6287aae95c6f5d9498bd9d8974b0de747ef696242691cfebec90b31dc9e2cc31b41b81ec SHA512 f75ae1034bb9dda7f4959e8a5d6d0dae21200723d82aebfbea58bd1d7775ef4042e49fdf49d5738771d79d764e44a1b6e0da341d210ea51d21516bb3874b626a
+AUX openssl-3.1.5-p11-segfault.patch 2274 BLAKE2B 6a283f0ab89386435272b096893ec1835557c15a699d7579f12d33b95c692abb50bd03289d01ccd85dd56058931f5b0d55320d36cfe0a824521fde2218bba734 SHA512 9d9810f0d8b9163fa8fa58c6e47db47dbe392236ed6990e246185e10bc9e7af44007cc8cb7973706480b41a84e3479aefdcaf9b95f0ac041aaf88eb8c078a725
+AUX openssl-3.2.1-p11-segfault.patch 2275 BLAKE2B d47816615ece0d015be0a307db950cee1217a522570040a48b9a9a7f7a23927f73ba5633718937c07c90c9a49564e9acc00de239d156cf8632b473afcdba8705 SHA512 9ab62a72036f8fbae34e844e6b17ab3482259de24918279230c2e5daa373de8ee59bd17942c2f4b2dcf06b1bf31796dc539324055e1cded099f6d8630bc13fff
 DIST openssl-1.0.2-patches-1.5.tar.xz 12404 BLAKE2B 6c1b8c28f339f539b2ab8643379502a24cf62bffde00041dce54d5dd9e8d2620b181362ee5464b0ab32ba4948e209697bfabadbea2944a409a1009100d298f24 SHA512 5725e2d9d1ee8cc074bcef3bed61c71bdab2ff1c114362110c3fb8da11ad5bc8f2ff28e90a293f5f3a5cf96ecda54dffdb7ab3fb3f8b23ef6472250dc3037659
 DIST openssl-1.0.2t-bindist-1.0.tar.xz 13872 BLAKE2B b2aade96a6e0ca6209a39e205b1c838de945903fcf959c62cc29ddcd1a0cb360fc5db234df86860a6a4c096f5ecc237611e4c2946b986a5500c24ba93c208ef4 SHA512 a48a7efb9b973b865bcc5009d450b428ed6b4b95e4cefe70c51056e47392c8a7bec58215168d8b07712419dc74646c2bd2fd23bcfbba2031376e292249a6b1b6
 DIST openssl-1.0.2u.tar.gz 5355412 BLAKE2B b2ff2a10e5851af5aca4093422a9a072c794e87b997263826c1c35910c040f695fac63decac5856cb49399ed03d410f97701d9fd4e1ebfbcacd8f3a74ce8bf57 SHA512 c455bb309e20e2c2d47fdc5619c734d107d5c8c38c1409903ce979acc120b0d5fa0312917c0aa0d630e402d092a703d4249643f36078e8528a3cafc9dac6ab32
@@ -30,7 +32,9 @@ EBUILD openssl-3.0.11.ebuild 8719 BLAKE2B fa28b31cc2f72147114cdc89b4253603855bd6
 EBUILD openssl-3.0.12.ebuild 8719 BLAKE2B fa28b31cc2f72147114cdc89b4253603855bd6cdf93b62a124caaff88f927412fdd1811e50ca35adb9885fa3fccb53203a46f231479373047fbd0fe709c8e228 SHA512 b5a46310bc8a5e842cca20c7755494fa6ff1d63eab24efbad516362cd68dce74380790050143beee437808fd724a41f323e04f4815833f6ea535c8022bc12162
 EBUILD openssl-3.0.13.ebuild 8495 BLAKE2B 622335e6f8a5186131dc7f0b037127785bef026e843b376b03b37b53c5e8a3cdf52682627b18407329e0ac519eaa3533a394bdfdfcc6fba38ab7eee406316fa2 SHA512 1718ff8b1afddd18604863f0a3cce9675bf77d0e49d45c87405aaf5e4b40f5e7c00f78904ce9b67c92b941627e2addcb4c887b90701ffa406b87b350c5570548
 EBUILD openssl-3.1.4.ebuild 8773 BLAKE2B efccc59361afb398ff899f09c07c1cba34498d7ceea6acf6d26b10088a32830855c03946f5ec56d0f9a842aed448b8b7438a05520164f9edffd37b4d5c0aebed SHA512 0796f29900094b5d7cd7e500d726c7a941fd9776afad2e699a326ea7381a78078cc6fb60df02fd90410c7770f33ca7401852f9be867fdf3896486532d8c7279e
+EBUILD openssl-3.1.5-r1.ebuild 8586 BLAKE2B c22d038b5af42c19389048b43618e3aad090062a8b5ca78eccf3572714d5d2469c1535ea3c4801241d313bf508191448dfa7e8bb52efc24f82523d1fc5273f85 SHA512 fa711d41776c086f9b31001143730e7f8524a41f6272d9df11fe7315c666113b8ba817fbaed7cd85482275014112e8f6a95213f0078531b2bd6a9f503c3f96a1
 EBUILD openssl-3.1.5.ebuild 8534 BLAKE2B b0d0b4c64ad7b025272ac54150ef9ea18e6ab974d558c002098a058600d8aff9253fe9a5d9eb78866f7734e6b2c0cc3222141a7738c5b21311d8d64f0867e2b9 SHA512 6b2c1cb64541d043048864110d4eb35df6c9b45228a4224a9788ac392f59358e1fb62a6c821bc5c05af4cf7ba29b7a0bfbb7f8ef3fbeb619b5b97444b1daff39
 EBUILD openssl-3.2.0.ebuild 9212 BLAKE2B 4e0af2380d1ad5195f5172bfa4607e5f86f3b92b5dd0948b5fa507c97213d8049504690b0b6706a299550db95050a3f60f0000fb93c9da1b06e26e42821fd41b SHA512 a2fbb05ea65c0c0a18df39ab4ce21421cb8c47971049c37758ed992fadfde2e5b89a1de75e56bd3de73b407915187fba79dc97d73c475ee13e55ab8ee8242c07
+EBUILD openssl-3.2.1-r1.ebuild 9155 BLAKE2B 7cf140a43c74e83319ec7e8a309beefa9268e7a075a1168be996de87b5e217b669af0d4452dfe08b59f225139fcc197de513835687e1f3b882d0f2b637bba1cc SHA512 768d48bcd44cd92e4934054963611b1b7377cf93decbbfa3992de240a2c0faed0c07d10c2bc1994d55fc0af74f725aaef4a70949c864aef71fa66b60855ba320
 EBUILD openssl-3.2.1.ebuild 9106 BLAKE2B ebf124ec47719b760b4afe73bebdbc8a1c3bb72e4817ae040a4613523b3d87a2f1183e4039cef376e6240f2776ddd7d449355c11015ae5efb59d592f3754c3fc SHA512 efe7e4100a2ad23e2a8df3739c5c60c5520ccb62f6ea09b0d159ed6fd8f88a8f8bb88a3abba4f93f3ae11e732fb3f27772adccc96bae3e5aaca8317b3c35bdeb
 MISC metadata.xml 1566 BLAKE2B ae4515c90356b8a2d3e2df8e0cea43c587f73bd2e08f696c065c2254639009b6806806df8a84c63d00781b0cbf906a0d11e94b715749ab1292e77afa9cd5bcc2 SHA512 4a5e6b894476e74f1f93f00c326139eadf1afd498f4508fb723322539f29e53aec6dd198da878db714d2da61ab266089c2dd2f91b9fc66a34375ceb6f68ca394
diff --git a/dev-libs/openssl/files/openssl-3.1.5-p11-segfault.patch b/dev-libs/openssl/files/openssl-3.1.5-p11-segfault.patch
new file mode 100644
index 000000000000..50bc63ef2d14
--- /dev/null
+++ b/dev-libs/openssl/files/openssl-3.1.5-p11-segfault.patch
@@ -0,0 +1,78 @@
+https://bugs.gentoo.org/916328
+https://github.com/opendnssec/SoftHSMv2/issues/729
+https://github.com/openssl/openssl/issues/22508
+https://github.com/openssl/openssl/commit/0058a55407d824d5b55ecc0a1cbf8931803dc238
+
+From 0058a55407d824d5b55ecc0a1cbf8931803dc238 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Fri, 15 Dec 2023 13:45:50 +0100
+Subject: [PATCH] Revert "Improved detection of engine-provided private
+ "classic" keys"
+
+This reverts commit 2b74e75331a27fc89cad9c8ea6a26c70019300b5.
+
+The commit was wrong. With 3.x versions the engines must be themselves
+responsible for creating their EVP_PKEYs in a way that they are treated
+as legacy - either by using the respective set1 calls or by setting
+non-default EVP_PKEY_METHOD.
+
+The workaround has caused more problems than it solved.
+
+Fixes #22945
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Neil Horman <nhorman@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/23063)
+
+(cherry picked from commit 39ea78379826fa98e8dc8c0d2b07e2c17cd68380)
+--- a/crypto/engine/eng_pkey.c
++++ b/crypto/engine/eng_pkey.c
+@@ -79,48 +79,6 @@ EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
+         ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+         return NULL;
+     }
+-    /* We enforce check for legacy key */
+-    switch (EVP_PKEY_get_id(pkey)) {
+-    case EVP_PKEY_RSA:
+-        {
+-        RSA *rsa = EVP_PKEY_get1_RSA(pkey);
+-        EVP_PKEY_set1_RSA(pkey, rsa);
+-        RSA_free(rsa);
+-        }
+-        break;
+-#  ifndef OPENSSL_NO_EC
+-    case EVP_PKEY_SM2:
+-    case EVP_PKEY_EC:
+-        {
+-        EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
+-        EVP_PKEY_set1_EC_KEY(pkey, ec);
+-        EC_KEY_free(ec);
+-        }
+-        break;
+-#  endif
+-#  ifndef OPENSSL_NO_DSA
+-    case EVP_PKEY_DSA:
+-        {
+-        DSA *dsa = EVP_PKEY_get1_DSA(pkey);
+-        EVP_PKEY_set1_DSA(pkey, dsa);
+-        DSA_free(dsa);
+-        }
+-        break;
+-#endif
+-#  ifndef OPENSSL_NO_DH
+-    case EVP_PKEY_DH:
+-        {
+-        DH *dh = EVP_PKEY_get1_DH(pkey);
+-        EVP_PKEY_set1_DH(pkey, dh);
+-        DH_free(dh);
+-        }
+-        break;
+-#endif
+-    default:
+-        /*Do nothing */
+-        break;
+-    }
+-
+     return pkey;
+ }
+ 
diff --git a/dev-libs/openssl/files/openssl-3.2.1-p11-segfault.patch b/dev-libs/openssl/files/openssl-3.2.1-p11-segfault.patch
new file mode 100644
index 000000000000..59e785caac7c
--- /dev/null
+++ b/dev-libs/openssl/files/openssl-3.2.1-p11-segfault.patch
@@ -0,0 +1,79 @@
+https://bugs.gentoo.org/916328
+https://github.com/opendnssec/SoftHSMv2/issues/729
+https://github.com/openssl/openssl/issues/22508
+https://github.com/openssl/openssl/commit/934943281267259fa928f4a5814b176525461a65
+
+From 934943281267259fa928f4a5814b176525461a65 Mon Sep 17 00:00:00 2001
+From: Tomas Mraz <tomas@openssl.org>
+Date: Fri, 15 Dec 2023 13:45:50 +0100
+Subject: [PATCH] Revert "Improved detection of engine-provided private
+ "classic" keys"
+
+This reverts commit 2b74e75331a27fc89cad9c8ea6a26c70019300b5.
+
+The commit was wrong. With 3.x versions the engines must be themselves
+responsible for creating their EVP_PKEYs in a way that they are treated
+as legacy - either by using the respective set1 calls or by setting
+non-default EVP_PKEY_METHOD.
+
+The workaround has caused more problems than it solved.
+
+Fixes #22945
+
+Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com>
+Reviewed-by: Neil Horman <nhorman@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/23063)
+
+(cherry picked from commit 39ea78379826fa98e8dc8c0d2b07e2c17cd68380)
+--- a/crypto/engine/eng_pkey.c
++++ b/crypto/engine/eng_pkey.c
+@@ -79,48 +79,6 @@ EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
+         ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+         return NULL;
+     }
+-    /* We enforce check for legacy key */
+-    switch (EVP_PKEY_get_id(pkey)) {
+-    case EVP_PKEY_RSA:
+-        {
+-        RSA *rsa = EVP_PKEY_get1_RSA(pkey);
+-        EVP_PKEY_set1_RSA(pkey, rsa);
+-        RSA_free(rsa);
+-        }
+-        break;
+-#  ifndef OPENSSL_NO_EC
+-    case EVP_PKEY_SM2:
+-    case EVP_PKEY_EC:
+-        {
+-        EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
+-        EVP_PKEY_set1_EC_KEY(pkey, ec);
+-        EC_KEY_free(ec);
+-        }
+-        break;
+-#  endif
+-#  ifndef OPENSSL_NO_DSA
+-    case EVP_PKEY_DSA:
+-        {
+-        DSA *dsa = EVP_PKEY_get1_DSA(pkey);
+-        EVP_PKEY_set1_DSA(pkey, dsa);
+-        DSA_free(dsa);
+-        }
+-        break;
+-#endif
+-#  ifndef OPENSSL_NO_DH
+-    case EVP_PKEY_DH:
+-        {
+-        DH *dh = EVP_PKEY_get1_DH(pkey);
+-        EVP_PKEY_set1_DH(pkey, dh);
+-        DH_free(dh);
+-        }
+-        break;
+-#endif
+-    default:
+-        /*Do nothing */
+-        break;
+-    }
+-
+     return pkey;
+ }
+ 
+
diff --git a/dev-libs/openssl/openssl-3.1.5-r1.ebuild b/dev-libs/openssl/openssl-3.1.5-r1.ebuild
new file mode 100644
index 000000000000..23a3463ec688
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.1.5-r1.ebuild
@@ -0,0 +1,285 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://www.openssl.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	SRC_URI="
+		mirror://openssl/source/${MY_P}.tar.gz
+		verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )
+	"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230801 )"
+
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${P}-p11-segfault.patch
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308
+	append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	emake HARNESS_JOBS="$(makeopts_jobs)" -Onone VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/openssl/openssl-3.2.1-r1.ebuild b/dev-libs/openssl/openssl-3.2.1-r1.ebuild
new file mode 100644
index 000000000000..24ae65f3321f
--- /dev/null
+++ b/dev-libs/openssl/openssl-3.2.1-r1.ebuild
@@ -0,0 +1,304 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/openssl.org.asc
+inherit edo flag-o-matic linux-info toolchain-funcs
+inherit multilib multilib-minimal multiprocessing preserve-libs verify-sig
+
+DESCRIPTION="Robust, full-featured Open Source Toolkit for the Transport Layer Security (TLS)"
+HOMEPAGE="https://www.openssl.org/"
+
+MY_P=${P/_/-}
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/openssl/openssl.git"
+
+	inherit git-r3
+else
+	SRC_URI="
+		mirror://openssl/source/${MY_P}.tar.gz
+		verify-sig? ( mirror://openssl/source/${MY_P}.tar.gz.asc )
+	"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
+		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	fi
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="Apache-2.0"
+SLOT="0/$(ver_cut 1)" # .so version of libssl/libcrypto
+IUSE="+asm cpu_flags_x86_sse2 fips ktls rfc3779 sctp static-libs test tls-compression vanilla verify-sig weak-ssl-ciphers"
+RESTRICT="!test? ( test )"
+
+COMMON_DEPEND="
+	!<net-misc/openssh-9.2_p1-r3
+	tls-compression? ( >=sys-libs/zlib-1.2.8-r1[static-libs(+)?,${MULTILIB_USEDEP}] )
+"
+BDEPEND="
+	>=dev-lang/perl-5
+	sctp? ( >=net-misc/lksctp-tools-1.0.12 )
+	test? (
+		sys-apps/diffutils
+		app-alternatives/bc
+		sys-process/procps
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-openssl-20230801 )"
+
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}"
+PDEPEND="app-misc/ca-certificates"
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/openssl/configuration.h
+)
+
+PATCHES=(
+	"${FILESDIR}"/${P}-p11-segfault.patch
+)
+
+pkg_setup() {
+	if use ktls ; then
+		if kernel_is -lt 4 18 ; then
+			ewarn "Kernel implementation of TLS (USE=ktls) requires kernel >=4.18!"
+		else
+			CONFIG_CHECK="~TLS ~TLS_DEVICE"
+			ERROR_TLS="You will be unable to offload TLS to kernel because CONFIG_TLS is not set!"
+			ERROR_TLS_DEVICE="You will be unable to offload TLS to kernel because CONFIG_TLS_DEVICE is not set!"
+			use test && CONFIG_CHECK+=" ~CRYPTO_USER_API_SKCIPHER"
+
+			linux-info_pkg_setup
+		fi
+	fi
+
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# must check in pkg_setup; sysctl doesn't work with userpriv!
+	if use test && use sctp ; then
+		# test_ssl_new will fail with "Ensure SCTP AUTH chunks are enabled in kernel"
+		# if sctp.auth_enable is not enabled.
+		local sctp_auth_status=$(sysctl -n net.sctp.auth_enable 2>/dev/null)
+		if [[ -z "${sctp_auth_status}" ]] || [[ ${sctp_auth_status} != 1 ]] ; then
+			die "FEATURES=test with USE=sctp requires net.sctp.auth_enable=1!"
+		fi
+	fi
+}
+
+src_unpack() {
+	# Can delete this once test fix patch is dropped
+	if use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# Make sure we only ever touch Makefile.org and avoid patching a file
+	# that gets blown away anyways by the Configure script in src_configure
+	rm -f Makefile
+
+	if ! use vanilla ; then
+		PATCHES+=(
+			# Add patches which are Gentoo-specific customisations here
+		)
+	fi
+
+	default
+
+	if use test && use sctp && has network-sandbox ${FEATURES} ; then
+		einfo "Disabling test '80-test_ssl_new.t' which is known to fail with FEATURES=network-sandbox ..."
+		rm test/recipes/80-test_ssl_new.t || die
+	fi
+
+	# Test fails depending on kernel configuration, bug #699134
+	rm test/recipes/30-test_afalg.t || die
+}
+
+src_configure() {
+	# Keep this in sync with app-misc/c_rehash
+	SSL_CNF_DIR="/etc/ssl"
+
+	# Quiet out unknown driver argument warnings since openssl
+	# doesn't have well-split CFLAGS and we're making it even worse
+	# and 'make depend' uses -Werror for added fun (bug #417795 again)
+	tc-is-clang && append-flags -Qunused-arguments
+
+	# We really, really need to build OpenSSL w/ strict aliasing disabled.
+	# It's filled with violations and it *will* result in miscompiled
+	# code. This has been in the ebuild for > 10 years but even in 2022,
+	# it's still relevant:
+	# - https://github.com/llvm/llvm-project/issues/55255
+	# - https://github.com/openssl/openssl/issues/12247
+	# - https://github.com/openssl/openssl/issues/18225
+	# - https://github.com/openssl/openssl/issues/18663#issuecomment-1181478057
+	# Don't remove the no strict aliasing bits below!
+	filter-flags -fstrict-aliasing
+	append-flags -fno-strict-aliasing
+	# The OpenSSL developers don't test with LTO right now, it leads to various
+	# warnings/errors (which may or may not be false positives), it's considered
+	# unsupported, and it's not tested in CI: https://github.com/openssl/openssl/issues/18663.
+	filter-lto
+
+	append-flags $(test-flags-CC -Wa,--noexecstack)
+
+	# bug #895308
+	append-atomic-flags
+	# Configure doesn't respect LIBS
+	export LDLIBS="${LIBS}"
+
+	# bug #197996
+	unset APPS
+	# bug #312551
+	unset SCRIPTS
+	# bug #311473
+	unset CROSS_COMPILE
+
+	tc-export AR CC CXX RANLIB RC
+
+	multilib-minimal_src_configure
+}
+
+multilib_src_configure() {
+	use_ssl() { usex $1 "enable-${2:-$1}" "no-${2:-$1}" " ${*:3}" ; }
+
+	local krb5=$(has_version app-crypt/mit-krb5 && echo "MIT" || echo "Heimdal")
+
+	# See if our toolchain supports __uint128_t.  If so, it's 64bit
+	# friendly and can use the nicely optimized code paths, bug #460790.
+	#local ec_nistp_64_gcc_128
+	#
+	# Disable it for now though (bug #469976)
+	# Do NOT re-enable without substantial discussion first!
+	#
+	#echo "__uint128_t i;" > "${T}"/128.c
+	#if ${CC} ${CFLAGS} -c "${T}"/128.c -o /dev/null >&/dev/null ; then
+	#       ec_nistp_64_gcc_128="enable-ec_nistp_64_gcc_128"
+	#fi
+
+	local sslout=$(bash "${FILESDIR}/gentoo.config-1.0.4")
+	einfo "Using configuration: ${sslout:-(openssl knows best)}"
+
+	# https://github.com/openssl/openssl/blob/master/INSTALL.md#enable-and-disable-features
+	local myeconfargs=(
+		${sslout}
+
+		$(use cpu_flags_x86_sse2 || echo "no-sse2")
+		enable-camellia
+		enable-ec
+		enable-ec2m
+		enable-sm2
+		enable-srp
+		$(use elibc_musl && echo "no-async")
+		enable-idea
+		enable-mdc2
+		enable-rc5
+		$(use fips && echo "enable-fips")
+		$(use_ssl asm)
+		$(use_ssl ktls)
+		$(use_ssl rfc3779)
+		$(use_ssl sctp)
+		$(use test || echo "no-tests")
+		$(use_ssl tls-compression zlib)
+		$(use_ssl weak-ssl-ciphers)
+
+		--prefix="${EPREFIX}"/usr
+		--openssldir="${EPREFIX}"${SSL_CNF_DIR}
+		--libdir=$(get_libdir)
+
+		shared
+		threads
+	)
+
+	edo perl "${S}/Configure" "${myeconfargs[@]}"
+}
+
+multilib_src_compile() {
+	emake build_sw
+
+	if multilib_is_native_abi; then
+		emake build_docs
+	fi
+}
+
+multilib_src_test() {
+	# See https://github.com/openssl/openssl/blob/master/test/README.md for options.
+	#
+	# VFP = show subtests verbosely and show failed tests verbosely
+	# Normal V=1 would show everything verbosely but this slows things down.
+	#
+	# -j1 here for https://github.com/openssl/openssl/issues/21999, but it
+	# shouldn't matter as tests were already built earlier, and HARNESS_JOBS
+	# controls running the tests.
+	emake -Onone -j1 HARNESS_JOBS="$(makeopts_jobs)" VFP=1 test
+}
+
+multilib_src_install() {
+	# Only -j1 is supported for the install targets:
+	# https://github.com/openssl/openssl/issues/21999#issuecomment-1771150305
+	emake DESTDIR="${D}" -j1 install_sw
+	if use fips; then
+		emake DESTDIR="${D}" -j1 install_fips
+		# Regen this in pkg_preinst, bug 900625
+		rm "${ED}${SSL_CNF_DIR}"/fipsmodule.cnf || die
+	fi
+
+	if multilib_is_native_abi; then
+		emake DESTDIR="${D}" -j1 install_ssldirs
+		emake DESTDIR="${D}" DOCDIR='$(INSTALLTOP)'/share/doc/${PF} -j1 install_docs
+	fi
+
+	# This is crappy in that the static archives are still built even
+	# when USE=static-libs. But this is due to a failing in the openssl
+	# build system: the static archives are built as PIC all the time.
+	# Only way around this would be to manually configure+compile openssl
+	# twice; once with shared lib support enabled and once without.
+	if ! use static-libs ; then
+		rm "${ED}"/usr/$(get_libdir)/lib{crypto,ssl}.a || die
+	fi
+}
+
+multilib_src_install_all() {
+	# openssl installs perl version of c_rehash by default, but
+	# we provide a shell version via app-misc/c_rehash
+	rm "${ED}"/usr/bin/c_rehash || die
+
+	dodoc {AUTHORS,CHANGES,NEWS,README,README-PROVIDERS}.md doc/*.txt doc/${PN}-c-indent.el
+
+	# Create the certs directory
+	keepdir ${SSL_CNF_DIR}/certs
+
+	# bug #254521
+	dodir /etc/sandbox.d
+	echo 'SANDBOX_PREDICT="/dev/crypto"' > "${ED}"/etc/sandbox.d/10openssl
+
+	diropts -m0700
+	keepdir ${SSL_CNF_DIR}/private
+}
+
+pkg_preinst() {
+	if use fips; then
+		# Regen fipsmodule.cnf, bug 900625
+		ebegin "Running openssl fipsinstall"
+		"${ED}/usr/bin/openssl" fipsinstall -quiet \
+			-out "${ED}${SSL_CNF_DIR}/fipsmodule.cnf" \
+			-module "${ED}/usr/$(get_libdir)/ossl-modules/fips.so"
+		eend $?
+	fi
+
+	preserve_old_lib /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
+
+pkg_postinst() {
+	ebegin "Running 'openssl rehash ${EROOT}${SSL_CNF_DIR}/certs' to rebuild hashes (bug #333069)"
+	openssl rehash "${EROOT}${SSL_CNF_DIR}/certs"
+	eend $?
+
+	preserve_old_lib_notify /usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1) \
+		/usr/$(get_libdir)/lib{crypto,ssl}$(get_libname 1.1)
+}
diff --git a/dev-libs/skalibs/Manifest b/dev-libs/skalibs/Manifest
index dcbf9b8f166d..4ae770b9a99c 100644
--- a/dev-libs/skalibs/Manifest
+++ b/dev-libs/skalibs/Manifest
@@ -1,3 +1,5 @@
 DIST skalibs-2.14.1.0.tar.gz 237166 BLAKE2B a787bd5aab7e22f1c49422a3010ff186a3324bcf97b32b954ef05cd8609bc19a48b06e1e14c58481f0507bad5c3bbf294121826e9fdd3f895cf5d2735ca01fe7 SHA512 41e76a52e49d8bf9458f7feee6cc85b8168a346e5688261293fc556462695b573b70c51b67d85aa0a788db1d6ecc1dfc450f8e8e9807812d149dab88028d98c0
+DIST skalibs-2.14.1.1.tar.gz 237220 BLAKE2B 880f40a640e7680f847f8d9eb5e90ca472583d0badfbf233707be9bf64e2eb172543fdc9b663c99c3a5839ed58dbf7befebf9aa75820c9be9d70cd0c37959665 SHA512 01b3da7614ee626f838b62aff6fa2d4677ab5c5dfffcb3145232db9ac0b5bf70c063f4d83abdee809139fee721c75550eb997e2c3e265417b9493c98886236f9
 EBUILD skalibs-2.14.1.0.ebuild 899 BLAKE2B a9e4b321cee50647a674b8d4a337f058c72efb0b10eebe9df391340d85731aff8a6936a3dab07eafd4d9f8d9dd3fe663e277d094ef326f36c0c507743da1ed40 SHA512 ac34af44991b4d6ec5d4def73c3f4887f91f98ae2c456e6116ec047f101aed925610edb8240877ac17833ff207468050ac46abc9cf7a8a4050e2387b76a7e588
+EBUILD skalibs-2.14.1.1.ebuild 902 BLAKE2B 13ab7f88a5fae78e9d56154a3187f0d889ae589f9d6b6c192b08e915786b114b7d01e6e88c0e918dd8f41ede00ba507860d0c097aa6cde82cc4638edef0e9c10 SHA512 532af13b6c83cf949599b2bc56605093ed2340919394c01c2c384f5e63c5cfef8049c59e93317c543c28c214ea5177117eec09c59d8c999d6a994832920d19ff
 MISC metadata.xml 355 BLAKE2B 66e0a671da1ad125bd77d9d05bf03ea2e4bb9f8ec0c91bfe2f5b87192ce2de48a5137105af6e34260fb53c0a858577bc63681a53436d40ae635d87b2a346da25 SHA512 c6240c87d05a08450803a5887077715842112da1fa49264a8594735909d07e76a25a10bff4b09e7cf6049081153f520ac12019d93384357b692734ce82b07089
diff --git a/dev-libs/skalibs/skalibs-2.14.1.1.ebuild b/dev-libs/skalibs/skalibs-2.14.1.1.ebuild
new file mode 100644
index 000000000000..953d431a34f3
--- /dev/null
+++ b/dev-libs/skalibs/skalibs-2.14.1.1.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+DESCRIPTION="General-purpose libraries from skarnet.org"
+HOMEPAGE="https://www.skarnet.org/software/skalibs/"
+SRC_URI="https://www.skarnet.org/software/${PN}/${P}.tar.gz"
+
+LICENSE="ISC"
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+
+HTML_DOCS=( doc/. )
+
+src_prepare() {
+	default
+
+	# Avoid QA warning for LDFLAGS addition
+	sed -i -e 's/.*-Wl,--hash-style=both$/:/' configure || die
+
+	sed -i -e '/AR := /d' -e '/RANLIB := /d' Makefile || die
+}
+
+src_configure() {
+	tc-export AR CC RANLIB
+
+	local myconf=(
+		--dynlibdir="/$(get_libdir)"
+		--libdir="/usr/$(get_libdir)/${PN}"
+		--sysdepdir="/usr/$(get_libdir)/${PN}"
+		--sysconfdir=/etc
+
+		--disable-static
+		--enable-clock
+		--enable-ipv6
+		--enable-shared
+	)
+
+	econf "${myconf[@]}"
+}