9 files changed, 399 insertions, 6 deletions
diff --git a/dev-libs/Manifest.gz b/dev-libs/Manifest.gz
index b9a512af3e60..ed0c1af79ce7 100644
--- a/dev-libs/Manifest.gz
+++ b/dev-libs/Manifest.gz
diff --git a/dev-libs/apr-util/Manifest b/dev-libs/apr-util/Manifest
index 7617f56f43bc..9c6e5fdf11a5 100644
--- a/dev-libs/apr-util/Manifest
+++ b/dev-libs/apr-util/Manifest
@@ -6,5 +6,5 @@ AUX apr-util-1.6.1-mariadb-support.patch 4929 BLAKE2B 9f8a06e657386f5f773642f36f
 AUX apr-util-1.6.1-my_bool.patch 311 BLAKE2B c0fdf523983dc75ff977c8f602678cdd7d0b3e539fc266891e2266fa3b60e0971e93d77f2e28ed95959d8ca62bca4f9f566fefea525c845d49ce545ee6b5a99a SHA512 ed7d7857be8b5d29cc17a7216c1b06134798eb5129d50389bb0d5484a46e19e3169f8cea80cab7f845548e528a2cd9909b72016a7216b402092ae15879db792c
 DIST apr-util-1.6.1.tar.bz2 428595 BLAKE2B ab6eaf1594aaa1c7aae151319b630b83bdb8b68ec04f0e2b429b7c7789bdf274873270200ba43701359e2502d2be8624d8e42a56a5f399ec95a841e7c73ce706 SHA512 40eff8a37c0634f7fdddd6ca5e596b38de15fd10767a34c30bbe49c632816e8f3e1e230678034f578dd5816a94f246fb5dfdf48d644829af13bf28de3225205d
 EBUILD apr-util-1.6.1-r8.ebuild 3787 BLAKE2B 1e4f8ec847da2607556c7cf58773ee5e5a94793d9231168eff0f96eb4ed359a18d87a19c193ba55b8753c123de75e194ef9fad797d60e6808b0a181a9ec8341b SHA512 1c85cb121e872b923188db6fc568ae7f7fa240a051caaa2b8df871deb2012c316402f7457547a3ffaba4d7e477427ccece507978bdba0508bfa232ba4c1fa566
-EBUILD apr-util-1.6.1-r9.ebuild 3840 BLAKE2B 763177753afad1ecf26eabf352aca7f1d6bec739a9ffdb0ac05758461ce8b956289d74c9eb344635e4a28f022afc62f6da8718f0df68af349c8057ae24085c66 SHA512 ee77a7b479d45e307acd20d946a17d89f4f3a93ac3c2fc31b9252cb8a4f17a4d400526bece2e2628f8c2adc8680c4bf75f931b6e917b4dba9b34a2276dba55ab
+EBUILD apr-util-1.6.1-r9.ebuild 3838 BLAKE2B b13ae850ab30a8103a9e1442ab80de76ea326a61062d806b7dbaa575bbeec5ae6a36b0bf66d196141643f0d860f9fea1d2b0b29edc7a25b0f74d9ff04998864d SHA512 c03a5ee1aad83998a23d8674e8c8e5757a2588e6efa4b186844e2d46704b375cc894a88bffa37d978b317695acd5318fc8b0a0a338a66d90274e88cdeea29c44
 MISC metadata.xml 469 BLAKE2B d4ef8b9223183a322e324290e26e78fd291bfd3e60b48a18d1345f0aaf467302cabb62ae330ee5282bf38fcdf84a020dcca1b32a8351e3494d9fecd723196031 SHA512 727443f6ab071b3c657287a698ccaccea336a3b861f199dd07c4472cd61e1252e2a25f24a86dcdd72cedcfb73fb6cb0ebe0cbdc93220223dab5501e9626ecb4e
diff --git a/dev-libs/apr-util/apr-util-1.6.1-r9.ebuild b/dev-libs/apr-util/apr-util-1.6.1-r9.ebuild
index b418bfc7f546..31a4acc7b4c7 100644
--- a/dev-libs/apr-util/apr-util-1.6.1-r9.ebuild
+++ b/dev-libs/apr-util/apr-util-1.6.1-r9.ebuild
@@ -15,7 +15,7 @@ SRC_URI="mirror://apache/apr/${P}.tar.bz2"
 
 LICENSE="Apache-2.0"
 SLOT="1"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="berkdb doc gdbm ldap mysql nss odbc openssl postgres sqlite static-libs"
 #RESTRICT="test"
 
diff --git a/dev-libs/apr/Manifest b/dev-libs/apr/Manifest
index 68697a0fda43..6d3403e813d8 100644
--- a/dev-libs/apr/Manifest
+++ b/dev-libs/apr/Manifest
@@ -8,5 +8,5 @@ AUX apr-1.7.0-autoconf-2.70.patch 1970 BLAKE2B b552e2bb1be932a692e2d1fad5124b5db
 AUX config.layout.patch 745 BLAKE2B 9877db3d76339b70f2bd354d118eff0df4d63bc81e4af9e65169c1c5862c3fa3532cc02df8e084b540e7a81091c3b16d50388c6234cba469b15fff896d0428fc SHA512 3a87e718859c8f95793f828b764d240907d65c21fe2c99143815ab835f8b657154092c4ad496e86d79490bd85ef03d394d3acb57a15186f2f06a518b32d77fdf
 DIST apr-1.7.0.tar.bz2 872238 BLAKE2B a8750c45ca6495073a7120f3ae9b858905aecb24b6af5966c3900b06ac1f6d6b55346b17a39a9604cf1b595882335adedf8c8cf4db10e322501bfff4ad7adfe7 SHA512 3dc42d5caf17aab16f5c154080f020d5aed761e22db4c5f6506917f6bfd2bf8becfb40af919042bd4ce1077d5de74aa666f5edfba7f275efba78e8893c115148
 EBUILD apr-1.7.0-r4.ebuild 4511 BLAKE2B 74ea0dd4227e2785e1a45eff3d1293d9fe937b57917107e736c0a1b056623eca5524e2bd3fe6c4f53c807e41394beca57513fed1318cf34c2b96abe8dede4c40 SHA512 dcf4320fe8c7ac38b3e89fe32a94fa9f4150d2269fc0e49822a9f488c9de485449f1ffa9e4d370b2f2c8ed1aecf46eea5313dfe779c1b08f55f4baa13bf0ac51
-EBUILD apr-1.7.0-r5.ebuild 4570 BLAKE2B 8c0a999779d2b0aa7242483cdca2bf1a4a99bd861ea1eac237ab4f932855d08c1b224ee418f79945f64a14e32a0ed2e949def6d9dfce31486736233dbaae5d04 SHA512 a57724ce3b525cfc94b632d71303b128da9bd585077408f7f329c166dea9348a072cc60ea03859a9265746baf3bdd6ee1f189b32f2efe2c8dbbd4c4074edb7ce
+EBUILD apr-1.7.0-r5.ebuild 4568 BLAKE2B 6350799dc75d8c20c6aad27d7378fc7ea1f1b62600c80c77dcfefae2b4981313433c44e221a5200bb36b2e3a6458251a488c7c7a0607e485ec2815f928d331c4 SHA512 c368c2c5c05110da877abcc3a5ad57df0f532ed113d35d06f663b2db37cc82c8cd2dd65b9e50f6d41f1672999d927215edc2875bb14b52020bebbc2bb7ef8b0a
 MISC metadata.xml 511 BLAKE2B 5b4f31f74a9e3fe93b63bb337b5e0b7396c18439c269de0ec6c8308becf69ac8474d72dc921c80c06321bcaf708d49c9e26ec282036e84a9b03c08858c942980 SHA512 82063beddf8ce88d5f151ddeb8b3b69c10124af1c7b727b4c73885b4b14a427e93cd4164ddd4e3dfcdf7175727a8dffa357f1f14c3daee192a255f8995e6b0b5
diff --git a/dev-libs/apr/apr-1.7.0-r5.ebuild b/dev-libs/apr/apr-1.7.0-r5.ebuild
index 4d5d4eb4be38..0d8ee43698ce 100644
--- a/dev-libs/apr/apr-1.7.0-r5.ebuild
+++ b/dev-libs/apr/apr-1.7.0-r5.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://apache/apr/${P}.tar.bz2"
 
 LICENSE="Apache-2.0"
 SLOT="1/${PV%.*}"
-KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ~ppc64 ~riscv ~s390 ~sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 arm arm64 ~hppa ~ia64 ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="doc older-kernels-compatibility selinux static-libs +urandom"
 
 # See bug #815265 for libcrypt dependency
diff --git a/dev-libs/libxlsxwriter/Manifest b/dev-libs/libxlsxwriter/Manifest
index 2cb1d5ccfa51..810572b33f78 100644
--- a/dev-libs/libxlsxwriter/Manifest
+++ b/dev-libs/libxlsxwriter/Manifest
@@ -1,4 +1,4 @@
 AUX libxlsxwriter-1.1.4-fix-pkgconfig-version.patch 675 BLAKE2B 19771b0b921a613191695ab0dfc65dabf3941678df01e7241cc37b5dcb9544c59f917d9d0090781e525708b4e1fa314cd49b6887c9915e809f4111b3fe0d2831 SHA512 dd43e9b8738298dbf568f9fe7cc518ff44ecd352a01554af776506be6c815e51c954195f4bcd046dfeb35ced4d590824f4dc26881f03a70639486f8fee768797
 DIST libxlsxwriter-1.1.4.tar.gz 20442200 BLAKE2B 38308dd8e954820b6debf15bc884effd583c0e0fa1667ed4451085ff8cf1bf4101807110873a501617785763886c107c19ab30c16390b5fb608f52b2736465be SHA512 fad36f7882fcb21b87e13cf603022cfad3f14e6f955a06e2771712facd0fe12f83f4d1655dc1a744724bda1ac83af7e7bf1393457c5507d8983f63002ab294b5
-EBUILD libxlsxwriter-1.1.4-r1.ebuild 1111 BLAKE2B eec3645c297df0c215dd1510c205671f7b2c33effefbde7f117a55ce341eee9ea5974feb3477dbf2954facd6774961893377412aea4d51263b7ee9c1dca06b17 SHA512 ed6ecef414dceb917c9f6d367e7faab3358f5c8a11d1df479a59cf0f928fd3e5d01557dabf7a23acc8e93f61f392300376824a61839ad2747c1f20d24e052691
+EBUILD libxlsxwriter-1.1.4-r1.ebuild 1110 BLAKE2B 4dd289fb62d3f85062d6b1f3a80184111e9a2886e23705a5feafcb9a0c92b84179001e627933ee610c848d14356cff3c8b674c64e2c2d527120afeaff464cf8d SHA512 39840ff3765bd608f597dc275fe72fc2b8c1181b83ca6fe5984bb1848cf8648f1eae87017a9aa215835579e4397cca419d8737c86e5f50d44bfde30eb5cca014
 MISC metadata.xml 579 BLAKE2B 0c3294a1f69d9cc7e3e95a37f2708ce4672cc931f28cdded82aadc9cdffb323ac4bd7518c61fee57ad30022617acb572625f3b6b0972fd903a1ae3afcf98aee1 SHA512 83d288575e27337692c3cd94bad56d8e2882240343b739eeed72742bd82e9177c45a81ef94ebab9e035b99431ecc2cf21723e408a90fa6b5f551e8a7f1f17a0d
diff --git a/dev-libs/libxlsxwriter/libxlsxwriter-1.1.4-r1.ebuild b/dev-libs/libxlsxwriter/libxlsxwriter-1.1.4-r1.ebuild
index 1f5575723644..8f131ad06a59 100644
--- a/dev-libs/libxlsxwriter/libxlsxwriter-1.1.4-r1.ebuild
+++ b/dev-libs/libxlsxwriter/libxlsxwriter-1.1.4-r1.ebuild
@@ -12,7 +12,7 @@ S="${WORKDIR}/${PN}-RELEASE_${PV}"
 
 LICENSE="BSD-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 ~arm64"
 IUSE="openssl"
 
 DEPEND="
diff --git a/dev-libs/nss/Manifest b/dev-libs/nss/Manifest
index 276a75fe7653..14cd48674402 100644
--- a/dev-libs/nss/Manifest
+++ b/dev-libs/nss/Manifest
@@ -6,8 +6,10 @@ AUX nss-3.79-gcc-13.patch 1058 BLAKE2B d0249304f09fdea7e391732e7da63344c3e29c185
 DIST nss-3.68.4.tar.gz 82409303 BLAKE2B a3cf572e82ce29dbc77e9356e0db425170f7294f1468755843746539663fe486089660e1c1b379d0184003d9ccf57db6cf0b2c161d7038301c1cb5028175b16d SHA512 f97b63a9f8218f8fbd7b5d48c084b8166366d02cd50aac69a22d56324d2fea01c49d074e51430bd128f510c733085f3f43c9739ce4073a07a5666675e0ef3b15
 DIST nss-3.79.1.tar.gz 84694831 BLAKE2B 209a502ba4b808bb4cb9b8775328fa26e36c55147ee5da7b8f661349129250f09685dd69919e24d7ff72cc55a2e9cbbbc9c059e543cf1b0a6a08e809be262d4c SHA512 e841efe9d0300d99b50e54c159c75df76c09c34c74bbc9b6ca007ad017b2cb91a8d33f6f4195e52bd8f3ed7be5d53f3ce7ce10825fa21abbf5dbba3db109e037
 DIST nss-3.83.tar.gz 84844191 BLAKE2B f2e26f69450cbd2c94c5efdd959cb19e874bcb63d09098406ef49f4997bd04bc0ee4bc285c1c4f0ec461194171342c7d31965ac7bc7eefc284783542dfe853b1 SHA512 550cf1116e39e58041feaa67913f570d791e8153cc0522ba7ae02e27a61e0a4e6a25224be0f25d51a842dc11c70d600263450ebff0a9fdaa2840bafa3fc9ddd5
+DIST nss-3.84.tar.gz 84851235 BLAKE2B 5dead5ae336998db97acc6dc2a59b387aac9baeba0f2fad6eaf921bdc894867f6177179545378091d9b50b295b71409781b5ef5044222afe7a1cd2f920a7d15f SHA512 b4ed4b2e44d9f896a4a4c33f92813a84825dc4502f4e14e047f3583666c453138515e6edbcd71144c4b02a8ee16b3443803f1ff12458fd82c338ee1dd911b175
 DIST nss-cacert-class1-class3-r2.patch 21925 BLAKE2B 7627ff9a09f084c19d72d0490676865e3cab3ca7c920ae1ce4bea2db664f37fd0aa84fcda919809a516891ab2a62e2e7a43a9d6ada4c231adfe4c216525fac7d SHA512 1ce6ff9ab310aaca9005eafb461338b291df8523cc7044e096cd75774ce746c26eed19ec6bb2643c6c67f94650f2f309463492d80a90568f38ce2557f8ada2f4
 EBUILD nss-3.68.4.ebuild 9328 BLAKE2B 5883d294203e24b15b927cf60dd90b5a9b4666b26d5a8591ccbf248b99bf82da2866383de792c1bb5af794cb73fc7be73ead212cb3193ef98198509e061010d3 SHA512 0bb43a21931d5a3bd8ff9146ed4c63ad1d3d76075bb27eb25ed97fd3825dbd436576fc71387a6633961ad15bf03bfd37b315094cb2551073ca331187a55572c7
 EBUILD nss-3.79.1.ebuild 10473 BLAKE2B 617a363bef0b4cf1109d7df69c6d130799388ea6bea750d6274ab20bc8b5f05ce747ae8c77795fa0c777d7edd9736044e1f2f8a2ee605102fa078425a9b92a6e SHA512 167e811b1e830290f77c773080fc714a806c7b15d3e698077d4432b1d81fe470c8317738e3f27c581a77b9c5fe88396f371a96c2d4f5e3a0253f64ee4c44a0f1
 EBUILD nss-3.83.ebuild 10475 BLAKE2B 20ff6f2772ae88c8be0cf38360bf53b1deeb45d6fa3f3190ff48e520031657c0eba5730b0f26edb3a5c5e3a0c4f07c53861f6f7d8a948937ff14d8d322470cb5 SHA512 f055367b5226ac0d09a3d381225391105bcfaa68011ffe4e9c8c7cc79858332e84749ba9cda30048d2324edd285178994d02b8361f52a115eeb2bfad7536e7da
+EBUILD nss-3.84.ebuild 10490 BLAKE2B 977e8bfcd32f8124301da413077b763b12a1083177cd677c03b03405f21284271c54dfe9e52941d067a64dc45a44e197a99c19ccf356a12834219413f7a0d900 SHA512 0aa16c52712cddb4d5a9552bf30c2af8df95b1edca389b98d2680adba219c1d015673cbf81fc0a3ec469c038a27ac8435d99ae8c521bc868f39a8b719bbb07e9
 MISC metadata.xml 517 BLAKE2B 85fba14d0b8a3539c57b8dca15a0f7789bb78a92891ff39271f804fa07b1620f5f3ece89269e3305b578064a53aeae7ab298bb97cdc019f41793888d42159727 SHA512 7b1fba5488498d5499134f1b58ecaa01cb8c51af3da666d55fba3884703d34efb57b449e76461fb6e13c37687bf5125c5dbab1934a950d4d13c0cff5a3b3318e
diff --git a/dev-libs/nss/nss-3.84.ebuild b/dev-libs/nss/nss-3.84.ebuild
new file mode 100644
index 000000000000..ec5014639954
--- /dev/null
+++ b/dev-libs/nss/nss-3.84.ebuild
@@ -0,0 +1,391 @@
+# Copyright 1999-2022 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib toolchain-funcs multilib-minimal
+
+NSPR_VER="4.35"
+RTM_NAME="NSS_${PV//./_}_RTM"
+
+DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
+HOMEPAGE="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
+SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
+	cacert? ( https://dev.gentoo.org/~whissi/dist/ca-certificates/nss-cacert-class1-class3-r2.patch )"
+
+LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-solaris ~x86-solaris"
+IUSE="cacert test +utils cpu_flags_ppc_altivec cpu_flags_ppc_vsx"
+RESTRICT="!test? ( test )"
+# pkg-config called by nss-config -> virtual/pkgconfig in RDEPEND
+RDEPEND="
+	>=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
+	>=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-lang/perl"
+
+S="${WORKDIR}/${P}/${PN}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/nss-config
+)
+
+PATCHES=(
+	# Custom changes for gentoo
+	"${FILESDIR}/${PN}-3.53-gentoo-fixups.patch"
+	"${FILESDIR}/${PN}-3.21-gentoo-fixup-warnings.patch"
+	"${FILESDIR}/${PN}-3.23-hppa-byte_order.patch"
+)
+
+QA_PKGCONFIG_VERSION="${PV}.0"
+
+src_prepare() {
+	default
+
+	if use cacert ; then
+		eapply -p2 "${DISTDIR}"/nss-cacert-class1-class3-r2.patch
+	fi
+
+	pushd coreconf >/dev/null || die
+	# hack nspr paths
+	echo 'INCLUDES += -I$(DIST)/include/dbm' \
+		>> headers.mk || die "failed to append include"
+
+	# modify install path
+	sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
+		-i source.mk || die
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
+
+	popd >/dev/null || die
+
+	# Fix pkgconfig file for Prefix
+	sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
+		config/Makefile || die
+
+	# use host shlibsign if need be #436216
+	if tc-is-cross-compiler ; then
+		sed -i \
+			-e 's:"${2}"/shlibsign:shlibsign:' \
+			cmd/shlibsign/sign.sh || die
+	fi
+
+	# dirty hack
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
+		lib/ssl/config.mk || die
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
+		cmd/platlibs.mk || die
+
+	multilib_copy_sources
+
+	strip-flags
+}
+
+multilib_src_configure() {
+	# Ensure we stay multilib aware
+	sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
+}
+
+nssarch() {
+	# Most of the arches are the same as $ARCH
+	local t=${1:-${CHOST}}
+	case ${t} in
+		*86*-pc-solaris2*) echo "i86pc"   ;;
+		aarch64*)          echo "aarch64" ;;
+		hppa*)             echo "parisc"  ;;
+		i?86*)             echo "i686"    ;;
+		x86_64*)           echo "x86_64"  ;;
+		*)                 tc-arch ${t}   ;;
+	esac
+}
+
+nssbits() {
+	local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
+	if [[ ${1} == BUILD_ ]]; then
+		cc=$(tc-getBUILD_CC)
+	else
+		cc=$(tc-getCC)
+	fi
+	echo > "${T}"/test.c || die
+	${cc} ${!cppflags} ${!cflags} -c "${T}"/test.c -o "${T}/${1}test.o" || die
+	case $(file "${T}/${1}test.o") in
+		*32-bit*x86-64*) echo USE_X32=1;;
+		*64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
+		*32-bit*|*ppc*|*i386*) ;;
+		*) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
+	esac
+}
+
+multilib_src_compile() {
+	# use ABI to determine bit'ness, or fallback if unset
+	local buildbits mybits
+	case "${ABI}" in
+		n32) mybits="USE_N32=1";;
+		x32) mybits="USE_X32=1";;
+		s390x|*64) mybits="USE_64=1";;
+		${DEFAULT_ABI})
+			einfo "Running compilation test to determine bit'ness"
+			mybits=$(nssbits)
+			;;
+	esac
+	# bitness of host may differ from target
+	if tc-is-cross-compiler; then
+		buildbits=$(nssbits BUILD_)
+	fi
+
+	local makeargs=(
+		CC="$(tc-getCC)"
+		CCC="$(tc-getCXX)"
+		AR="$(tc-getAR) rc \$@"
+		RANLIB="$(tc-getRANLIB)"
+		OPTIMIZER=
+		${mybits}
+		disable_ckbi=0
+	)
+
+	# Take care of nspr settings #436216
+	local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
+	unset NSPR_INCLUDE_DIR
+
+	export NSS_ALLOW_SSLKEYLOGFILE=1
+	export NSS_ENABLE_WERROR=0 #567158
+	export BUILD_OPT=1
+	export NSS_USE_SYSTEM_SQLITE=1
+	export NSDISTMODE=copy
+	export FREEBL_NO_DEPEND=1
+	export FREEBL_LOWHASH=1
+	export NSS_SEED_ONLY_DEV_URANDOM=1
+	export USE_SYSTEM_ZLIB=1
+	export ZLIB_LIBS=-lz
+	export ASFLAGS=""
+	# Fix build failure on arm64
+	export NS_USE_GCC=1
+	# Detect compiler type and set proper environment value
+	if tc-is-gcc; then
+		export CC_IS_GCC=1
+	elif tc-is-clang; then
+		export CC_IS_CLANG=1
+	fi
+
+	export NSS_DISABLE_GTESTS=$(usex !test 1 0)
+
+	# explicitly disable altivec/vsx if not requested
+	# https://bugs.gentoo.org/789114
+	case ${ARCH} in
+		ppc*)
+			use cpu_flags_ppc_altivec || export NSS_DISABLE_ALTIVEC=1
+			use cpu_flags_ppc_vsx || export NSS_DISABLE_CRYPTO_VSX=1
+			;;
+	esac
+
+	local d
+
+	# Build the host tools first.
+	LDFLAGS="${BUILD_LDFLAGS}" \
+	XCFLAGS="${BUILD_CFLAGS}" \
+	NSPR_LIB_DIR="${T}/fakedir" \
+	emake -C coreconf \
+		CC="$(tc-getBUILD_CC)" \
+		${buildbits-${mybits}}
+	makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
+
+	# Then build the target tools.
+	for d in . lib/dbm ; do
+		CPPFLAGS="${myCPPFLAGS}" \
+		XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		NSPR_LIB_DIR="${T}/fakedir" \
+		emake "${makeargs[@]}" -C ${d} OS_TEST="$(nssarch)"
+	done
+}
+
+multilib_src_test() {
+	einfo "Tests can take a *long* time, especially on a multilib system."
+	einfo "30-45+ minutes per lib configuration. Bug #852755"
+
+	# https://www.linuxfromscratch.org/blfs/view/svn/postlfs/nss.html
+	# https://firefox-source-docs.mozilla.org/security/nss/legacy/nss_sources_building_testing/index.html#running_the_nss_test_suite
+	# https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html (older)
+	export BUILD_OPT=1
+	export HOST="localhost"
+	export DOMSUF="localdomain"
+	export USE_IP=TRUE
+	export IP_ADDRESS="127.0.0.1"
+
+	NSINSTALL="${PWD}/$(find -type f -name nsinstall)"
+
+	cd "${BUILD_DIR}"/tests || die
+	# Hack to get current objdir (prefixed dir where built binaries are)
+	# Without this, at least multilib tests go wrong when building the amd64 variant
+	# after x86.
+	local objdir=$(find "${BUILD_DIR}"/dist -maxdepth 1 -iname Linux* | rev | cut -d/ -f1 | rev)
+
+	# Can tweak to a subset of tests in future if we need to, but would prefer not
+	OBJDIR="${objdir}" DIST="${BUILD_DIR}/dist" MOZILLA_ROOT="${BUILD_DIR}" ./all.sh || die
+}
+
+# Altering these 3 libraries breaks the CHK verification.
+# All of the following cause it to break:
+# - stripping
+# - prelink
+# - ELF signing
+# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
+# Either we have to NOT strip them, or we have to forcibly resign after
+# stripping.
+#local_libdir="$(get_libdir)"
+#export STRIP_MASK="
+#	*/${local_libdir}/libfreebl3.so*
+#	*/${local_libdir}/libnssdbm3.so*
+#	*/${local_libdir}/libsoftokn3.so*"
+
+export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
+
+generate_chk() {
+	local shlibsign="$1"
+	local libdir="$2"
+	einfo "Resigning core NSS libraries for FIPS validation"
+	shift 2
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libname=lib${i}.so
+		local chkname=lib${i}.chk
+		"${shlibsign}" \
+			-i "${libdir}"/${libname} \
+			-o "${libdir}"/${chkname}.tmp \
+		&& mv -f \
+			"${libdir}"/${chkname}.tmp \
+			"${libdir}"/${chkname} \
+		|| die "Failed to sign ${libname}"
+	done
+}
+
+cleanup_chk() {
+	local libdir="$1"
+	shift 1
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libfname="${libdir}/lib${i}.so"
+		# If the major version has changed, then we have old chk files.
+		[ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
+			&& rm -f "${libfname}.chk"
+	done
+}
+
+multilib_src_install() {
+	pushd dist >/dev/null || die
+
+	dodir /usr/$(get_libdir)
+	cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
+	local i
+	for i in crmf freebl nssb nssckfw ; do
+		cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
+	done
+
+	# Install nss-config and pkgconfig file
+	dodir /usr/bin
+	cp -L */bin/nss-config "${ED}"/usr/bin || die
+	dodir /usr/$(get_libdir)/pkgconfig
+	cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
+
+	# create an nss-softokn.pc from nss.pc for libfreebl and some private headers
+	# bug 517266
+	sed 	-e 's#Libs:#Libs: -lfreebl#' \
+		-e 's#Cflags:#Cflags: -I${includedir}/private#' \
+		*/lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
+		|| die "could not create nss-softokn.pc"
+
+	# all the include files
+	insinto /usr/include/nss
+	doins public/nss/*.{h,api}
+	insinto /usr/include/nss/private
+	doins private/nss/{blapi,alghmac,cmac}.h
+
+	popd >/dev/null || die
+
+	local f nssutils
+	# Always enabled because we need it for chk generation.
+	nssutils=( shlibsign )
+
+	if multilib_is_native_abi ; then
+		if use utils; then
+			# The tests we do not need to install.
+			#nssutils_test="bltest crmftest dbtest dertimetest
+			#fipstest remtest sdrtest"
+			# checkcert utils has been removed in nss-3.22:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
+			# https://hg.mozilla.org/projects/nss/rev/df1729d37870
+			# certcgi has been removed in nss-3.36:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
+			nssutils+=(
+				addbuiltin
+				atob
+				baddbdir
+				btoa
+				certutil
+				cmsutil
+				conflict
+				crlutil
+				derdump
+				digest
+				makepqg
+				mangle
+				modutil
+				multinit
+				nonspr10
+				ocspclnt
+				oidcalc
+				p7content
+				p7env
+				p7sign
+				p7verify
+				pk11mode
+				pk12util
+				pp
+				rsaperf
+				selfserv
+				signtool
+				signver
+				ssltap
+				strsclnt
+				symkeyutil
+				tstclnt
+				vfychain
+				vfyserv
+			)
+			# install man-pages for utils (bug #516810)
+			doman doc/nroff/*.1
+		fi
+		pushd dist/*/bin >/dev/null || die
+		for f in ${nssutils[@]}; do
+			dobin ${f}
+		done
+		popd >/dev/null || die
+	fi
+}
+
+pkg_postinst() {
+	multilib_pkg_postinst() {
+		# We must re-sign the libraries AFTER they are stripped.
+		local shlibsign="${EROOT}/usr/bin/shlibsign"
+		# See if we can execute it (cross-compiling & such). #436216
+		"${shlibsign}" -h >&/dev/null
+		if [[ $? -gt 1 ]] ; then
+			shlibsign="shlibsign"
+		fi
+		generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postinst
+}
+
+pkg_postrm() {
+	multilib_pkg_postrm() {
+		cleanup_chk "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postrm
+}