18 files changed, 437 insertions, 261 deletions
diff --git a/dev-libs/Manifest.gz b/dev-libs/Manifest.gz
index 996fadeb775e..501fe26f5e55 100644
--- a/dev-libs/Manifest.gz
+++ b/dev-libs/Manifest.gz
diff --git a/dev-libs/iniparser/Manifest b/dev-libs/iniparser/Manifest
index 2caf11bfa5a6..b6aa37450f15 100644
--- a/dev-libs/iniparser/Manifest
+++ b/dev-libs/iniparser/Manifest
@@ -1,13 +1,5 @@
-AUX iniparser-3.0-autotools.patch 833 BLAKE2B 6d1328b0b5c7afcf769a55d5fa03741449364343a174f466afbb6eeac3a1fd8df799f4f1f866c982c15eb9f5c32dd04b8e914e621b788c770f77a3546c66ef95 SHA512 7da9af6dd9d72148fcdc2a0cf11b1308e33ccf208448af6e7aa3cb3e1f2f34696b8098458a3903b498445dc5627e15e7ccb20347de13f7ddb8e5e999890acd21
-AUX iniparser-3.0b-cpp.patch 1032 BLAKE2B bc558d7c0263b2fef25a0cca617a717378a203f3acc95ec276c66122d5f1db99bbd510f35b07107ffc4f59fc6c853d961211be66c5999a7b8a991b00e21b2d33 SHA512 62a2514898a710293c7dabea089aa21597c47eec030eca1d0f3d8a3f7043f7811f374ef56b3b60527568b012af593e86c66f3e7c52f9ff64a000975978e88379
-AUX iniparser-4.0-out-of-bounds-read.patch 330 BLAKE2B b60d6a3a514d5e5704e2a97c67ead108150375d850d6afe6f57815e9c4b434415596c514632e0575ea1cdf0cb464d6ca12e47780db5cd237bcf38849771ee41a SHA512 f1f01120fbf740cce5749f8ee9ba2014794523bc045999f45ad28a2bd4842d1e822b65fab2feb0751cba074de956c753949fb8b188454daf129c1ba8f0b6a1d4
-AUX iniparser-4.1-CVE-null-getstring.patch 1667 BLAKE2B b6fa1285106d77167a519cd5ce378c7aabf506da64b9a72b37776c63014e5fd96df9ec426b7ce59293c7162e7086151cb9f56d7dc37b02914e6758a06f67ae05 SHA512 72152482e45792bf3a93302f700dbfb799265b07ad767986b06886cf4b3b353c76ef8cce454548ec5fbbdd7c0a21d66b67604df0753e2270a928d9410263be75
-DIST iniparser-3.1.tar.gz 39097 BLAKE2B 4ada36f5bb95476c06deffa7938a750bcdeb0bd5bb817b24274c1e1c588d9abbd23c3a58f3cb3b6f961912f3e12e74aadf224da4cd81863b874e4a84d11c1744 SHA512 8fd8324c5629fdc3e3eff00afb5f0832402ccc760c5b92db82aa29b340ec891419ca2c4fee3a4d4d67cf9bc51c76b095bc0c458e087c2b8e72ac36867c47ae86
-DIST iniparser-4.1.tar.gz 44732 BLAKE2B a3480dab512b41eb9635c733b76048ab089a311c2970aae5ce89d103ff6ab1923d5824a5fca3bf445ba213ecd9954018fdef2831fd98c1a43c9ae7d4fb1cb388 SHA512 a8125aaaead1f9dfde380fa1e45bae31ca2312be029f2c53b4072cb3b127d16578a95c7c0aee1e3dda5e7b8db7a865ba6dfe8a1d80eb673061b3babef744e968
 DIST iniparser-v4.2.5.tar.bz2 34574 BLAKE2B 47eeffa4f441d491c153717df5b713e56181e090509b4496e9768b7f4654970b9cc6f261f9c821afbd2769b194a5742f82d20fc46471c92577bcde5ad350f989 SHA512 db7ebab3336bf9854efc9a70784762b1917da616d4c1f5e6c2409b238dd967967c196df85f444c1d21732dc47d195ca044a93ae2b0d8d556fe150e7dd1b78d64
 DIST iniparser-v4.2.6.tar.bz2 34731 BLAKE2B ce63256b8a6640e188184f7d1d7de40690ca612938d6d06cb97d012fe40e05e647510d97221bc61fa25db47a96565b21e7fd346f370afde7d3c461f93c3e2fc0 SHA512 6a37c0bad24093c5852d232e13e1c2182ab97508be3b03a44ea5510a70884cb7ac1fa8a9e8415ece2d2a13c9b38efabc1d37d920d894a198b89cd04731f32392
-EBUILD iniparser-3.1-r3.ebuild 1072 BLAKE2B 076bfca31d21e39c0a1d04f8acf4719f4330aaecfce3d518f57ff5f0009d6aee4542f1357a2ae408720a691969bdcf193bd2ec762cec9ec17c00bdd5665d595e SHA512 c7c10d21b87c1d5818827f4d91152edc2a963311aa202bfde6001de6f6b95c48386373a01d7b413bf12d66a41402d665a79abdf029c62614a4a26efbe84c22a9
-EBUILD iniparser-4.1-r2.ebuild 1112 BLAKE2B c18f4e7fbceaa5302cebc294f18e9b27767aca43b92c882723a8705c1d61083a36d81a54139a019e832f04db9738bb729d2eed18ce89c02521514bf79f3c3d88 SHA512 ee5952a2519576a15632e5aaa5afcbe0b943a0d5166d473fcb03fb10efdf57ce2a6333d10d60220fa8708064de0d3fdd36be2df73cbeb5de34797427980d353b
 EBUILD iniparser-4.2.5.ebuild 840 BLAKE2B ce8b6612a659c5cf70a8afa86db1572cd7d7738e060bdfd6920a11862ee89e408c4bbcd19297393df1911b233af9170c4449892bf3ec82919a54aeb7e14de1d5 SHA512 de8ec78698f837e7fd510834396ecae5661ad9d9bb347b8b53b125da1a415fa78d4a02e706eefca26f727e573344bfd875be952caefd4796b5c65bf494009ce1
 EBUILD iniparser-4.2.6.ebuild 907 BLAKE2B 884b67acd8b97af6779be2a83c9a9bde46ecd8530e804f7fa676f7ba01e668c0cc205c6c0c8d4e2a4e55b45f1d8857547aefaf9fe4a61175ff50c26bace157a3 SHA512 f28ee1635ac1ecdec25a33bdaede7414d0e2a6f0dd09c59fb9629ae3df2eb87f4d00a7cd63d7fdb384e30e290882dd1b97a0f2e6e49348c3c18029f71d9841dc
 MISC metadata.xml 330 BLAKE2B 6ae3eaf3992b63f57e0c2a5cb863502e5a2a91f0945f05e344852f58c8b7eefd1657444e7ba32f11a06cc782f168666f90d45bda6c490a1704ddeaace373e315 SHA512 05108493932293e676d7079061f6484831db6d904d700be9350846641b8f9cc684e06fa3c4e7bb101ef9ca3180497643b72295024b50e4e8d5393bbd0d5d12b8
diff --git a/dev-libs/iniparser/files/iniparser-3.0-autotools.patch b/dev-libs/iniparser/files/iniparser-3.0-autotools.patch
deleted file mode 100644
index 361c96a7d4fb..000000000000
--- a/dev-libs/iniparser/files/iniparser-3.0-autotools.patch
+++ /dev/null
@@ -1,38 +0,0 @@
---- /dev/null
-+++ b/Makefile.am
-@@ -0,0 +1,8 @@
-+ACLOCAL_AMFLAGS = -I config
-+
-+lib_LTLIBRARIES = libiniparser.la
-+
-+libiniparser_la_LDFLAGS = -no-undefined -version-info @SHARED_VERSION_INFO@
-+libiniparser_la_SOURCES = src/dictionary.c  src/iniparser.c
-+
-+include_HEADERS = src/dictionary.h  src/iniparser.h
---- /dev/null
-+++ b/configure.ac
-@@ -0,0 +1,24 @@
-+AC_PREREQ([2.65])
-+AC_INIT([iniparser], [3.0], [ndevilla@free.fr])
-+
-+AC_CONFIG_AUX_DIR(config)
-+AC_CONFIG_MACRO_DIR(config)
-+
-+AM_INIT_AUTOMAKE([1.8 foreign])
-+
-+SHARED_VERSION_INFO="0"
-+AC_SUBST(SHARED_VERSION_INFO)
-+
-+# Checks for programs.
-+AC_PROG_CC
-+AC_SYS_LARGEFILE
-+
-+LT_INIT
-+# Checks for header files.
-+AC_CHECK_HEADERS([ ctype.h stdio.h stdlib.h string.h ])
-+
-+# Checks for library functions.
-+AC_CHECK_FUNCS([strcmp])
-+
-+AC_CONFIG_FILES([Makefile])
-+AC_OUTPUT
diff --git a/dev-libs/iniparser/files/iniparser-3.0b-cpp.patch b/dev-libs/iniparser/files/iniparser-3.0b-cpp.patch
deleted file mode 100644
index b7cd17d2d226..000000000000
--- a/dev-libs/iniparser/files/iniparser-3.0b-cpp.patch
+++ /dev/null
@@ -1,45 +0,0 @@
---- a/src/dictionary.c
-+++ b/src/dictionary.c
-@@ -32,6 +32,9 @@
- /*---------------------------------------------------------------------------
-                             Private functions
-  ---------------------------------------------------------------------------*/
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
- 
- /* Doubles the allocated size associated to a pointer */
- /* 'size' is the current allocated size. */
-@@ -394,5 +397,10 @@
-     dictionary_del(d);
-     return 0 ;
- }
-+
-+#ifdef __cplusplus
-+}
-+#endif
-+
- #endif
- /* vim: set ts=4 et sw=4 tw=75 */
---- a/src/iniparser.h
-+++ b/src/iniparser.h
-@@ -49,6 +49,10 @@
- int iniparser_getnsec(dictionary * d);
- 
- 
-+#ifdef __cplusplus
-+extern "C" {
-+#endif
-+
- /*-------------------------------------------------------------------------*/
- /**
-   @brief    Get name for section n in a dictionary.
-@@ -304,4 +308,8 @@
- /*--------------------------------------------------------------------------*/
- void iniparser_freedict(dictionary * d);
- 
-+#ifdef __cplusplus
-+}
-+#endif
-+
- #endif
diff --git a/dev-libs/iniparser/files/iniparser-4.0-out-of-bounds-read.patch b/dev-libs/iniparser/files/iniparser-4.0-out-of-bounds-read.patch
deleted file mode 100644
index f6488810ac12..000000000000
--- a/dev-libs/iniparser/files/iniparser-4.0-out-of-bounds-read.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/src/iniparser.c
-+++ b/src/iniparser.c
-@@ -663,7 +663,7 @@
-     while (fgets(line+last, ASCIILINESZ-last, in)!=NULL) {
-         lineno++ ;
-         len = (int)strlen(line)-1;
--        if (len==0)
-+        if (len<=0)
-             continue;
-         /* Safety check against buffer overflows */
-         if (line[len]!='\n') {
diff --git a/dev-libs/iniparser/files/iniparser-4.1-CVE-null-getstring.patch b/dev-libs/iniparser/files/iniparser-4.1-CVE-null-getstring.patch
deleted file mode 100644
index bf3c035fda07..000000000000
--- a/dev-libs/iniparser/files/iniparser-4.1-CVE-null-getstring.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From ace9871f65d11b5d73f0b9ee8cf5d2807439442d Mon Sep 17 00:00:00 2001
-From: Antonio <antoniolrt@gmail.com>
-Date: Fri, 2 Jun 2023 15:03:10 -0300
-Subject: [PATCH] Handle null return from iniparser_getstring
-
-Fix handling of NULL returns from iniparser_getstring in
-iniparser_getboolean, iniparser_getlongint and iniparser_getdouble,
-avoiding a crash.
----
- src/iniparser.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/src/iniparser.c b/src/iniparser.c
-index f1d1658..dbceb20 100644
---- a/src/iniparser.c
-+++ b/src/iniparser.c
-@@ -456,7 +456,7 @@ long int iniparser_getlongint(const dictionary * d, const char * key, long int n
-     const char * str ;
- 
-     str = iniparser_getstring(d, key, INI_INVALID_KEY);
--    if (str==INI_INVALID_KEY) return notfound ;
-+    if (str==NULL || str==INI_INVALID_KEY) return notfound ;
-     return strtol(str, NULL, 0);
- }
- 
-@@ -511,7 +511,7 @@ double iniparser_getdouble(const dictionary * d, const char * key, double notfou
-     const char * str ;
- 
-     str = iniparser_getstring(d, key, INI_INVALID_KEY);
--    if (str==INI_INVALID_KEY) return notfound ;
-+    if (str==NULL || str==INI_INVALID_KEY) return notfound ;
-     return atof(str);
- }
- 
-@@ -553,7 +553,7 @@ int iniparser_getboolean(const dictionary * d, const char * key, int notfound)
-     const char * c ;
- 
-     c = iniparser_getstring(d, key, INI_INVALID_KEY);
--    if (c==INI_INVALID_KEY) return notfound ;
-+    if (c==NULL || c==INI_INVALID_KEY) return notfound ;
-     if (c[0]=='y' || c[0]=='Y' || c[0]=='1' || c[0]=='t' || c[0]=='T') {
-         ret = 1 ;
-     } else if (c[0]=='n' || c[0]=='N' || c[0]=='0' || c[0]=='f' || c[0]=='F') {
diff --git a/dev-libs/iniparser/iniparser-3.1-r3.ebuild b/dev-libs/iniparser/iniparser-3.1-r3.ebuild
deleted file mode 100644
index 00798d267bb7..000000000000
--- a/dev-libs/iniparser/iniparser-3.1-r3.ebuild
+++ /dev/null
@@ -1,50 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit autotools
-
-DESCRIPTION="A free stand-alone ini file parsing library"
-HOMEPAGE="http://ndevilla.free.fr/iniparser/"
-SRC_URI="http://ndevilla.free.fr/iniparser/${P}.tar.gz"
-
-LICENSE="MIT"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~m68k ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="doc examples"
-# the tests are rather examples than tests, no point in running them
-RESTRICT="test"
-
-BDEPEND="doc? ( app-text/doxygen )"
-
-S="${WORKDIR}/${PN}"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-3.0b-cpp.patch
-	"${FILESDIR}"/${PN}-3.0-autotools.patch
-	"${FILESDIR}"/${PN}-4.0-out-of-bounds-read.patch
-)
-
-src_prepare() {
-	default
-	eautoreconf
-}
-
-src_install() {
-	if use doc; then
-		emake -C doc
-		HTML_DOCS=( html/. )
-	fi
-
-	default
-
-	if use examples; then
-		docinto examples
-		dodoc test/*.{c,ini,py}
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-
-	# No static archives
-	find "${ED}" -name '*.la' -delete || die
-}
diff --git a/dev-libs/iniparser/iniparser-4.1-r2.ebuild b/dev-libs/iniparser/iniparser-4.1-r2.ebuild
deleted file mode 100644
index d48fac06d4e7..000000000000
--- a/dev-libs/iniparser/iniparser-4.1-r2.ebuild
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit toolchain-funcs flag-o-matic
-
-DESCRIPTION="Free stand-alone ini file parsing library"
-HOMEPAGE="https://github.com/ndevilla/iniparser/"
-SRC_URI="
-	https://github.com/ndevilla/iniparser/archive/refs/tags/v${PV}.tar.gz
-		-> ${P}.tar.gz
-"
-
-LICENSE="MIT"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="doc examples"
-
-BDEPEND="doc? ( app-text/doxygen )"
-
-PATCHES=(
-	"${FILESDIR}"/${P}-CVE-null-getstring.patch
-)
-
-src_prepare() {
-	default
-
-	rm -r html || die
-}
-
-src_compile() {
-	append-lfs-flags
-	tc-export AR CC
-
-	emake V=1 ADDITIONAL_CFLAGS=
-	use doc && emake -C doc
-}
-
-src_test() {
-	emake V=1 -C test
-}
-
-src_install() {
-	dolib.so lib${PN}.so.1
-	dosym -r /usr/$(get_libdir)/lib${PN}.so{.1,}
-
-	doheader src/*.h
-
-	if use examples; then
-		docinto examples
-		dodoc -r example/.
-		docompress -x /usr/share/doc/${PF}/examples
-	fi
-
-	use doc && local HTML_DOCS=( html/. )
-	einstalldocs
-}
diff --git a/dev-libs/libffi/Manifest b/dev-libs/libffi/Manifest
index 2446ae3559dd..fef894227485 100644
--- a/dev-libs/libffi/Manifest
+++ b/dev-libs/libffi/Manifest
@@ -22,7 +22,7 @@ DIST libffi-3.4.6.tar.gz 1391684 BLAKE2B af8402a09bdbd59b4e9400d2d71bd5ce98f6f1d
 DIST libffi-3.4.7.tar.gz 1393979 BLAKE2B 0dd17b4fd358beb9842889168437443137445a5dba1f0a7e8669ae420d8efb927815c08602c1b1b141acfdfdbaa12b417863402a5c8df5f36519fd3e772d3f37 SHA512 d19f59a5b5d61bd7d9e8a7a74b8bf2e697201a19c247c410c789e93ca8678a4eb9f13c9bee19f129be80ade8514f6b1acb38d66f44d86edd32644ed7bbe31dd6
 EBUILD libffi-3.4.4-r4.ebuild 2540 BLAKE2B 6a85dd1d002e6ec61c57a4d5db58a20ff58e987da7ceb6630abfdd08ebd9f2fad574c29ab10d7a623310bb61b161e4c26c23a5d26af91e67bfa193d191e8a822 SHA512 f5d4049d6e5fe432321df11c0295a7bc579212eb5db54613d0ecc986975bdae1d9f26b9abcd9949db7e2efe156f4e5c9f8a90d870b9cf380308a848ad533c747
 EBUILD libffi-3.4.6-r2.ebuild 2858 BLAKE2B 34b481067c36cc8bdabe8e1ce75443d0c3c776c5b85530aa0b0afe8b8c162c0dc14d8f255fe154c46d83553677ee5f8e9ad36ea336ad72326b373e00939a567c SHA512 c7d035d7aa67ee230d2050c9b3e63d3d75821e6a679f07799204f0bec12e9254def244abef0b7e98550221e6ac6ac3e6abfaddab6b35e687c5b386af4cc41680
-EBUILD libffi-3.4.6-r3.ebuild 2792 BLAKE2B d903460a6ad4e4726db1c868e1476399e56f3ab88d583aa9b7077f6bb0775602c89896189da2268b9810419f559b21914ecc814e1dc9cc598fa562456bd3e524 SHA512 f0eebc4f1a9bb9781f7d7f4cd84ab8e4149730f787898d77240adb52bcc671d77f3e1b4bbb8b474136067bca8370d68eb2b1dbba55339f90b2c10678d765386c
+EBUILD libffi-3.4.6-r3.ebuild 2791 BLAKE2B 40d0960dca2327fcc805e5a73125b92b363c62ca87adfb93f6fb22be06a585ec4f74e3c687adcb8004354a9e8de8af3f0b9fd68166b3e5de7f3232e30e57c56e SHA512 9ca523f3d6f376fe894e297885a29baa30c19ef00371d956533c0a1a8fdf6e8fa78110406bbf01de5fcd732cb7e6fcfc5702983ae16d08b6aac36c015d0dad1e
 EBUILD libffi-3.4.6.ebuild 2270 BLAKE2B a8af8687618bc1541f71db585727f33228b96c446729761accd7e2dc3ebd59de141e629371b97a3e7fc6e7c412f4696a7cac7e02ca8c271e103747f7c9d439b4 SHA512 6447b4fd561836bee7cd7148f1b2fdf7e100ffa292a1e94051aca03ed19acf5446f1db74241e6ecc445317f272b3773930f1184f25588658aa12234472897ce0
 EBUILD libffi-3.4.7.ebuild 2534 BLAKE2B b834d3f2d3a44149e2d32068eac6072c373ee417cec4a28bf43682d8b80fe7a3deff4a69e31259e4372f9b12f270faa8d2df8e9425fab7d1af5a1ca57d7a78d9 SHA512 cf4af86505759d8d9ab948988a71bfebde8ca46f86a6cc71e77312a40aaa17916e4e1adc2d77a7f549c2abed0ae46e6518977883e3d34d263f9e7f7d18c53e3d
 EBUILD libffi-9999.ebuild 2534 BLAKE2B b834d3f2d3a44149e2d32068eac6072c373ee417cec4a28bf43682d8b80fe7a3deff4a69e31259e4372f9b12f270faa8d2df8e9425fab7d1af5a1ca57d7a78d9 SHA512 cf4af86505759d8d9ab948988a71bfebde8ca46f86a6cc71e77312a40aaa17916e4e1adc2d77a7f549c2abed0ae46e6518977883e3d34d263f9e7f7d18c53e3d
diff --git a/dev-libs/libffi/libffi-3.4.6-r3.ebuild b/dev-libs/libffi/libffi-3.4.6-r3.ebuild
index 91b74d8b3c1a..e71339d70dc1 100644
--- a/dev-libs/libffi/libffi-3.4.6-r3.ebuild
+++ b/dev-libs/libffi/libffi-3.4.6-r3.ebuild
@@ -17,7 +17,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
 
-	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 S="${WORKDIR}"/${MY_P}
diff --git a/dev-libs/libvformat/Manifest b/dev-libs/libvformat/Manifest
index 98a5f07cdcbf..c59acd531122 100644
--- a/dev-libs/libvformat/Manifest
+++ b/dev-libs/libvformat/Manifest
@@ -6,5 +6,5 @@ DIST libvformat_1.13-10.debian.tar.gz 25884 BLAKE2B 73f2ef1126dcf51ef1d8128a74b1
 DIST libvformat_1.13-12.debian.tar.xz 21560 BLAKE2B a226c3a0488c78357c44f3b45608bb07b002e3e59eb01db4bc42c284ef8b24484e75368dc24a9dcba637a99ddcff1f19b39462c800606e1f73327bbe3bdc6eaf SHA512 9fd7f3765fd53d3dd90698973e582b9a61e9e0192c5f588f984c323b36939535a47c33ff89d8eb9c7aa9c567b8a785e077c626db13668532f683834ee53c234a
 DIST libvformat_1.13.orig.tar.gz 254463 BLAKE2B ee7d7bf9585e670ed3f6999d002669072535ce7c2c474b1f86d80026ea4bf6852a5c000a45a03b881e6d15695bd3162c132864ccb4f7cc574207209ea3a6c579 SHA512 80b47897dd4f5dfa05e78a40de821406a007e330fc82584a0d26e2d1580a5ce52b6af90ecd4c0f7f36eaf00d6a78d9ba3b84ec2b7c7d814ba890a629d7a2c7ba
 EBUILD libvformat-1.13-r2.ebuild 792 BLAKE2B a328991fedb8f70c1f160b30bf96f1cf5ee8287c0b9e3e070fc5d096779ad0fd7ec6663d7f73482981a60f5abb387590bc7782e8aa86a98f7013034fa1e6c4ba SHA512 0e02a6e9fc678ca2ba52f47c103c70a417ced2e1c5f698e5ac72a1aef653574d174b7169e4c71859670558710e467d863f976524b74704a0b2701aa74668f8fd
-EBUILD libvformat-1.13-r3.ebuild 788 BLAKE2B 1986589038f81b036fe5ba1e543889bb53f8c60ea659edb060a435de691577629302a0f2d6fcca979ae6d1000fdf2bd8b0c50aea3cc05e161dd8540de58101d3 SHA512 6232ca9e70bca57d627f398c2c30210c31c6989e37097b93a85926f9e9f3047a1ebe206f9ee0b82d5dec4b26edc7d23c1a21f57f9e994a8151f3dc4e3529548a
+EBUILD libvformat-1.13-r3.ebuild 785 BLAKE2B 01379024d6d12d565bb6d0d3765687f7922a32fd741cf8906e2f3a4584052592580a31fb2084713398f336e443c7dc63722acd06731acc2802a97da6fdb2c62b SHA512 04e6ed023df062372f1d574dae71cc78e8173cf4c3d23e3fb740f36e4f234590bebfcfcb0bbb8d3d55a9b042234822c818b216a3c5498ec4909be59b6d022f33
 MISC metadata.xml 245 BLAKE2B 4638c053531b6db111751ef8d0ea5a0ce2626384eacdef18b57604990ae5da28cc802a307e8de392a35878aa9eb9927f32a5c16e9f33a1409d5833a8b1204497 SHA512 46e0ada7fb753716ca0ffa7b183b843731a6c5d7dd50f5ea3cd37e4c79a1aacbdfa241fea318780d809e798655a4c693632a4134db1285f530ff90eaa523c537
diff --git a/dev-libs/libvformat/libvformat-1.13-r3.ebuild b/dev-libs/libvformat/libvformat-1.13-r3.ebuild
index 879ad26638d7..b2b07a3e0d69 100644
--- a/dev-libs/libvformat/libvformat-1.13-r3.ebuild
+++ b/dev-libs/libvformat/libvformat-1.13-r3.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${P}.orig"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="~alpha amd64 ~ppc ~ppc64 sparc x86"
 
 src_prepare() {
 	eapply \
diff --git a/dev-libs/nettle/Manifest b/dev-libs/nettle/Manifest
index 22094231e770..731b027e2b48 100644
--- a/dev-libs/nettle/Manifest
+++ b/dev-libs/nettle/Manifest
@@ -6,7 +6,7 @@ DIST nettle-3.8.1.tar.gz 2406251 BLAKE2B 22b4ec81645b579504356597ba87b637e462856
 DIST nettle-3.8.1.tar.gz.sig 374 BLAKE2B e2bfce4aaa1be114fb9bf8724f25db75c69c3b98538df46e9b1428ce615f7db3b9e9f9240d232fddac195db4568439b3f58989c20beca82aa6db79f4956db547 SHA512 978304b1faa5adc3b0d6ea7e9597af6154ad5d6e328913ac19184ece94771fdb2a7d5ce0af535ae8d28cb6ccd94fb3d4ef2613c0356df9e08b5d4c26ea646e09
 DIST nettle-3.9.1.tar.gz 2396741 BLAKE2B e3ceaefa19491e58f26b900beaf8b4e746feb2357c7677f5c050f257f4a23c304773446b6283a42a82cf9640e16522b8a71c47f137759f1df23cdeee4625d142 SHA512 5939c4b43cf9ff6c6272245b85f123c81f8f4e37089fa4f39a00a570016d837f6e706a33226e4bbfc531b02a55b2756ff312461225ed88de338a73069e031ced
 DIST nettle-3.9.1.tar.gz.sig 374 BLAKE2B 41c37cc0ea649445c7e4bbe2d0e9ab1c6f7bb50000adef2c2ee4828e7efdd2d7c6d823d64209f251cb7d82ce85e73768430a435ee7f1d5a3732e744987918d0c SHA512 fe6f4c9746e7dbc10f61843673de95d2faea209b1caea5c7bf69b81d3f6b2248a4907012b2baf0d65e54682f835cff465482db37615b789017ce0a9e7e267d7d
-EBUILD nettle-3.10.1.ebuild 3278 BLAKE2B c3d930cd92a80ed36b167ba7888d52c7eb0919d4f3a1f0a5a6b5ef337959d1c493d4da037514ca109b02f41d545a9102c8ddad6e95a12e615f54d2778bf4ddfb SHA512 c41e57016cbd40b4d7778eef15a37305f8a285de45b06a96ee57619176d31bb87b4f615ec9dda293a6b233771334f48ca28b4c2c1e2404d0ddef0d017880ae69
+EBUILD nettle-3.10.1.ebuild 3277 BLAKE2B 3072b010e0631e5239d29719b58cce24a7bba3c5de157fec2e30bc20fc053593e7dcf7616b2f601f16a6557504fcf601223858d05fe7b881cec61f8ae18a347c SHA512 b1afe9cc0fbc4bccb4bdb6fb30f9fa884287af9eaa512304a390ee67dfe83918af2c3b982c397b5920c6aa95c1c8bc3b37ecffd0475fe66aab7cb75a84220ddc
 EBUILD nettle-3.10.ebuild 3277 BLAKE2B 2f2c2dcbcc1bb6187a2f213644b0732a35fc16e3dd51b2759394cc398f797132bc2fa9055f0ab76dd6ed0d8be14f200272b1f0d92494f784aa65309c843a56e6 SHA512 01537ec6c164a83d9903ae907ba1f2474f141cb2b9faefa9bd29df083ff19fee4afb3e75473fa9936f4944b14ec43d3bdd092705416b8d8ec4a5971d14fafe91
 EBUILD nettle-3.8.1.ebuild 2617 BLAKE2B 1200a36eff892bbd644ec5828906487d972df46eb398b74f6aaa72bc3d926a657e78bfc8b99c0199e27ac0b9066763486cab3baa09ca4c211edfd0842b666941 SHA512 37e4b9fc9f0043d273a71dc13db14c20426d0376e1b33d8937ab796a350ff90b69064c2635aa5933b22517fe464e0f4d379f48d452fd8317932541ae5d483c53
 EBUILD nettle-3.9.1-r1.ebuild 3103 BLAKE2B 51483db5d9c48b0deec2808d9056e4d8cbc7b5f1ef4b0b31b58b8a46f7e39b272e4a0ed23e68ea352320a1e937170e44d691edac51dc9048d2ed09cca15f7365 SHA512 5a90d4857e86d149ce72b8af5c3d6a405e8e72a9fe75d555a0883935a21f88c66d03dbd0178c899e28abc99148614bebe5665bf4079d16c79275d49fbe69ad7f
diff --git a/dev-libs/nettle/nettle-3.10.1.ebuild b/dev-libs/nettle/nettle-3.10.1.ebuild
index 1d12a68cd3d7..21c7bc669e28 100644
--- a/dev-libs/nettle/nettle-3.10.1.ebuild
+++ b/dev-libs/nettle/nettle-3.10.1.ebuild
@@ -14,7 +14,7 @@ SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${P}.tar.gz.sig )"
 LICENSE="|| ( LGPL-3 LGPL-2.1 )"
 # Subslot = libnettle - libhogweed soname version
 SLOT="0/8-6"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="+asm doc +gmp static-libs cpu_flags_arm_neon cpu_flags_arm_aes cpu_flags_arm_sha1 cpu_flags_arm_sha2 cpu_flags_ppc_altivec cpu_flags_ppc_vsx2 cpu_flags_ppc_vsx3 cpu_flags_x86_aes cpu_flags_x86_sha cpu_flags_x86_pclmul"
 # The arm64 crypto option controls AES, SHA1, and SHA2 usage.
 REQUIRED_USE="
diff --git a/dev-libs/nss/Manifest b/dev-libs/nss/Manifest
index 21c7c1fc800a..c9a35f8b4851 100644
--- a/dev-libs/nss/Manifest
+++ b/dev-libs/nss/Manifest
@@ -9,8 +9,10 @@ DIST nss-3.101.3.tar.gz 76462813 BLAKE2B 03a38804da9e9df79df6c06ebd8b4d5f185cc84
 DIST nss-3.104-cacert-class1-class3.patch 22038 BLAKE2B 66e2dd47230d6aa58a767e35c9c069fa29f3111d470345e0f69486d1eead3cd1741939ac394f6b9b637e79a10d658cfb1a9da4387953b8968a9001bab94d4de0 SHA512 bafc4212e0e0ca3eb129a5b88767727159c6ec3da450c7625d0b282f82699378d64eaa2c3fecb72c61000ec9b6d3c24f20bc7defdac6edc673e0fbb26e0c1f7e
 DIST nss-3.107.tar.gz 76617725 BLAKE2B 6f42cc9fa3c681083e7af0fe46b695a1b37b32facf7fe7f80718649db40a62a9d9a3de0be8910316a46fd42857fe713a77d72e45fa69fa980d9ad90d35b1db20 SHA512 a710459a46f5ca084fc5eb96047aeeece5010ebbffff3691a8487b667e9c520bd22d810cacca7b7b63b76d85a04c920748d169d0abb845b89b7b9804f9c38918
 DIST nss-3.108.tar.gz 76630022 BLAKE2B f7e58bc55ca9ccec83bfa0118267c9e4bec41f0f9852b31413cc19889c9e7e4beb87a7de303c7b3dfee3d8c84cc32cc90d84cf128daae1cea380c08ecc9b3ec5 SHA512 8a9545ec201f610abfae40d29e989c6a140b066755c02a36225a95fb9abfe47834352f3eae168e1cfb16382dfd12820c63bb9ad37361a624907cc45faa7bd34b
+DIST nss-3.109.tar.gz 76610986 BLAKE2B 0d7b3e7395c7b22a5cea0355e00131c9f2eada9fd3ce3ff23a29697b4a21f09178ca625a6e1b1847c3e869628e5ca3948ad91ae6e664130f3ac6bfee1368d91e SHA512 eb7997004db8046c985372d1b05a4e7563584fb0febaf05abd26cd223e23dc2e84099c76ca97596d67a8c4bab9fd9df5999e14a7242704f27b8a80710cc135be
 EBUILD nss-3.101.2.ebuild 11562 BLAKE2B 9759fc450f14ff746940714ccdf14e6342d953383cb5411fa7aae7a1bd79d9a70c7cb356372d4199116fadc9e81a65903a41b00690af48f8a3c67488bc1c3b98 SHA512 ee193cf6494afa7d75e9d2b60cb9a0a69d5484e6d1fe8790bf5202636ed5e0dcc57a5d553dca5ab8065d8014cb4c2ea9f665798bd14d7a147848f826bad451cf
 EBUILD nss-3.101.3.ebuild 11684 BLAKE2B 82f0cac49247caeb35c3df60faba8ad4910a3087764a36dbc2f0615f3a162eec649070cb6261fd963433c0d4671ff24e81ea1a5a9820a2551ad2b08fa0515170 SHA512 5646197286cb67242897377b6ed1eb9ee30ed31f851c1da8d066ca698f61066ff274843d879d33a46d67262c813cb12daa16656983957f9d34bb9f8bfa63cca0
 EBUILD nss-3.107.ebuild 11806 BLAKE2B d52058c3c43a743706d3aa996849634011b82b9309901869cbec9b094501334c617948ccc2bfacb758033c7bc6ece036142c910ab511c8c1c3bda2d3c64f656e SHA512 075359144c5ebfff3d265febf8c636e465ffa08876ebf6de0634db5bd0fdb593fad57c7eb81c6bff1c0ad3c3c48d571b06cd57aa7822c6066437efb4be17104a
 EBUILD nss-3.108.ebuild 11806 BLAKE2B 836c348f9115c3b6f76c809308e7823f4c4c3d69b1c2905cbda65e3e02d2c84c302962d300de53a81f2a2abbf233107f3af171f848d5b60284fb8cae264852e4 SHA512 f44bc2e7eb1f2fdb69c152cf2b02a3824754189109bbd80553c1aa81f80ccbb6788abdd745b04eba5c271c3de39fd62ce2f8b0cb830d210070db415d6a95b400
+EBUILD nss-3.109.ebuild 11806 BLAKE2B 836c348f9115c3b6f76c809308e7823f4c4c3d69b1c2905cbda65e3e02d2c84c302962d300de53a81f2a2abbf233107f3af171f848d5b60284fb8cae264852e4 SHA512 f44bc2e7eb1f2fdb69c152cf2b02a3824754189109bbd80553c1aa81f80ccbb6788abdd745b04eba5c271c3de39fd62ce2f8b0cb830d210070db415d6a95b400
 MISC metadata.xml 693 BLAKE2B c8be043e957f4d85411a10da490e67c9d37f5dd9fe37c112c92e8b666d828cabe75f5fe7c46e5b40dd872f082fb4463af79fb7eb3ad69b9e01c9c088edd750a8 SHA512 66374f8b8739c68a8a276159af3d493bb012b5ee722a939a1d87899d0307d572fcabf76ba71b4f34eeb83a414c0727182ef16f98418cbbbbd4aed311ac5be06b
diff --git a/dev-libs/nss/nss-3.109.ebuild b/dev-libs/nss/nss-3.109.ebuild
new file mode 100644
index 000000000000..352be19c4d9a
--- /dev/null
+++ b/dev-libs/nss/nss-3.109.ebuild
@@ -0,0 +1,427 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib toolchain-funcs multilib-minimal
+
+NSPR_VER="4.35"
+RTM_NAME="NSS_${PV//./_}_RTM"
+
+DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
+HOMEPAGE="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
+SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
+	cacert? ( https://dev.gentoo.org/~juippis/mozilla/patchsets/nss-3.104-cacert-class1-class3.patch )"
+
+LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-solaris"
+IUSE="cacert test test-full +utils cpu_flags_ppc_altivec cpu_flags_x86_avx2 cpu_flags_x86_sse3 cpu_flags_ppc_vsx"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="test-full? ( test )"
+
+# pkg-config called by nss-config -> virtual/pkgconfig in RDEPEND
+RDEPEND="
+	>=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
+	>=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-lang/perl"
+
+S="${WORKDIR}/${P}/${PN}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/nss-config
+)
+
+PATCHES=(
+	"${FILESDIR}"/nss-3.103-gentoo-fixes-add-pkgconfig-files.patch
+	"${FILESDIR}"/nss-3.21-gentoo-fixup-warnings.patch
+	"${FILESDIR}"/nss-3.87-use-clang-as-bgo892686.patch
+)
+
+src_prepare() {
+	default
+
+	if use cacert ; then
+		eapply -p2 "${DISTDIR}"/nss-3.104-cacert-class1-class3.patch
+	fi
+
+	pushd coreconf >/dev/null || die
+	# hack nspr paths
+	echo 'INCLUDES += -I$(DIST)/include/dbm' \
+		>> headers.mk || die "failed to append include"
+
+	# modify install path
+	sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
+		-i source.mk || die
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
+
+	# Workaround make-4.4's change to sub-make, bmo#1800237, bgo#882069
+	sed -i -e "s/^CPU_TAG = _.*/CPU_TAG = _$(nssarch)/" Linux.mk || die
+
+	popd >/dev/null || die
+
+	# Fix pkgconfig file for Prefix
+	sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
+		config/Makefile || die
+
+	# use host shlibsign if need be #436216
+	if tc-is-cross-compiler ; then
+		sed -i \
+			-e 's:"${2}"/shlibsign:shlibsign:' \
+			cmd/shlibsign/sign.sh || die
+	fi
+
+	# dirty hack
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
+		lib/ssl/config.mk || die
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
+		cmd/platlibs.mk || die
+
+	multilib_copy_sources
+
+	strip-flags
+}
+
+multilib_src_configure() {
+	# Ensure we stay multilib aware
+	sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
+}
+
+nssarch() {
+	# Most of the arches are the same as $ARCH
+	local t=${1:-${CHOST}}
+	case ${t} in
+		*86*-pc-solaris2*) echo "i86pc"   ;;
+		aarch64*)          echo "aarch64" ;;
+		hppa*)             echo "parisc"  ;;
+		i?86*)             echo "i686"    ;;
+		x86_64*)           echo "x86_64"  ;;
+		*)                 tc-arch ${t}   ;;
+	esac
+}
+
+nssbits() {
+	local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
+	if [[ ${1} == BUILD_ ]]; then
+		cc=$(tc-getBUILD_CC)
+	else
+		cc=$(tc-getCC)
+	fi
+	# TODO: Port this to toolchain-funcs tc-get-ptr-size/tc-get-build-ptr-size
+	echo > "${T}"/test.c || die
+	${cc} ${!cppflags} ${!cflags} -fno-lto -c "${T}"/test.c -o "${T}/${1}test.o" || die
+	case $(file -S "${T}/${1}test.o") in
+		*32-bit*x86-64*) echo USE_X32=1;;
+		*64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
+		*32-bit*|*ppc*|*i386*) ;;
+		*) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
+	esac
+}
+
+multilib_src_compile() {
+	# use ABI to determine bit'ness, or fallback if unset
+	local buildbits mybits
+	case "${ABI}" in
+		n32) mybits="USE_N32=1";;
+		x32) mybits="USE_X32=1";;
+		s390x|*64) mybits="USE_64=1";;
+		${DEFAULT_ABI})
+			einfo "Running compilation test to determine bit'ness"
+			mybits=$(nssbits)
+			;;
+	esac
+	# bitness of host may differ from target
+	if tc-is-cross-compiler; then
+		buildbits=$(nssbits BUILD_)
+	fi
+
+	local makeargs=(
+		CC="$(tc-getCC)"
+		CCC="$(tc-getCXX)"
+		AR="$(tc-getAR) rc \$@"
+		RANLIB="$(tc-getRANLIB)"
+		OPTIMIZER=
+		${mybits}
+		disable_ckbi=0
+	)
+
+	# Take care of nspr settings #436216
+	local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
+	unset NSPR_INCLUDE_DIR
+
+	export NSS_ALLOW_SSLKEYLOGFILE=1
+	export NSS_ENABLE_WERROR=0 #567158
+	export BUILD_OPT=1
+	export NSS_USE_SYSTEM_SQLITE=1
+	export NSDISTMODE=copy
+	export FREEBL_NO_DEPEND=1
+	export FREEBL_LOWHASH=1
+	export NSS_SEED_ONLY_DEV_URANDOM=1
+	export USE_SYSTEM_ZLIB=1
+	export ZLIB_LIBS=-lz
+	export ASFLAGS=""
+	# Fix build failure on arm64
+	export NS_USE_GCC=1
+	# Detect compiler type and set proper environment value
+	if tc-is-gcc; then
+		export CC_IS_GCC=1
+	elif tc-is-clang; then
+		export CC_IS_CLANG=1
+	fi
+
+	export NSS_DISABLE_GTESTS=$(usex !test 1 0)
+
+	# Include exportable custom settings defined by users, #900915
+	# Two examples uses:
+	#   EXTRA_NSSCONF="MYONESWITCH=1"
+	#   EXTRA_NSSCONF="MYVALUE=0 MYOTHERVALUE=1 MYTHIRDVALUE=1"
+	# e.g.
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0"
+	# or
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0 NSS_ENABLE_WERROR=1"
+	# etc.
+	if [[ -n "${EXTRA_NSSCONF}" ]]; then
+		ewarn "EXTRA_NSSCONF applied, please disable custom settings before reporting bugs."
+		read -a myextranssconf <<< "${EXTRA_NSSCONF}"
+
+		for (( i=0; i<${#myextranssconf[@]}; i++ )); do
+			export "${myextranssconf[$i]}"
+			echo "exported ${myextranssconf[$i]}"
+		done
+	fi
+
+	# explicitly disable altivec/vsx if not requested
+	# https://bugs.gentoo.org/789114
+	case ${ARCH} in
+		ppc*)
+			use cpu_flags_ppc_altivec || export NSS_DISABLE_ALTIVEC=1
+			use cpu_flags_ppc_vsx || export NSS_DISABLE_CRYPTO_VSX=1
+			;;
+	esac
+
+	use cpu_flags_x86_avx2 || export NSS_DISABLE_AVX2=1
+	use cpu_flags_x86_sse3 || export NSS_DISABLE_SSE3=1
+
+	local d
+
+	# Build the host tools first.
+	LDFLAGS="${BUILD_LDFLAGS}" \
+	XCFLAGS="${BUILD_CFLAGS}" \
+	NSPR_LIB_DIR="${T}/fakedir" \
+	emake -C coreconf \
+		CC="$(tc-getBUILD_CC)" \
+			${buildbits-${mybits}}
+	makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
+
+	# Then build the target tools.
+	for d in . lib/dbm ; do
+		CPPFLAGS="${myCPPFLAGS}" \
+		XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		NSPR_LIB_DIR="${T}/fakedir" \
+		emake "${makeargs[@]}" -C ${d} OS_TEST="$(nssarch)"
+	done
+}
+
+multilib_src_test() {
+	einfo "Tests can take a *long* time, especially on a multilib system."
+	einfo "~10 minutes per lib configuration with only 'standard' tests,"
+	einfo "~40 minutes per lib configuration with 'full' tests. Bug #852755"
+
+	# https://www.linuxfromscratch.org/blfs/view/svn/postlfs/nss.html
+	# https://firefox-source-docs.mozilla.org/security/nss/legacy/nss_sources_building_testing/index.html#running_the_nss_test_suite
+	# https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html (older)
+	export BUILD_OPT=1
+	export HOST="localhost"
+	export DOMSUF="localdomain"
+	export USE_IP=TRUE
+	export IP_ADDRESS="127.0.0.1"
+
+	# Only run the standard cycle instead of full, reducing testing time from 45 minutes to 15
+	# per lib implementation.
+	if use test-full ; then
+		# export NSS_CYCLES="standard pkix sharedb"
+		:;
+	else
+		export NSS_CYCLES="standard"
+	fi
+
+	NSINSTALL="${PWD}/$(find -type f -name nsinstall)"
+
+	cd "${BUILD_DIR}"/tests || die
+	# Hack to get current objdir (prefixed dir where built binaries are)
+	# Without this, at least multilib tests go wrong when building the amd64 variant
+	# after x86.
+	local objdir=$(find "${BUILD_DIR}"/dist -maxdepth 1 -iname Linux* | rev | cut -d/ -f1 | rev)
+
+	# Can tweak to a subset of tests in future if we need to, but would prefer not
+	OBJDIR="${objdir}" DIST="${BUILD_DIR}/dist" MOZILLA_ROOT="${BUILD_DIR}" ./all.sh || die
+}
+
+# Altering these 3 libraries breaks the CHK verification.
+# All of the following cause it to break:
+# - stripping
+# - prelink
+# - ELF signing
+# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
+# Either we have to NOT strip them, or we have to forcibly resign after
+# stripping.
+#local_libdir="$(get_libdir)"
+#export STRIP_MASK="
+#	*/${local_libdir}/libfreebl3.so*
+#	*/${local_libdir}/libnssdbm3.so*
+#	*/${local_libdir}/libsoftokn3.so*"
+
+export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
+
+generate_chk() {
+	local shlibsign="$1"
+	local libdir="$2"
+	einfo "Resigning core NSS libraries for FIPS validation"
+	shift 2
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libname=lib${i}.so
+		local chkname=lib${i}.chk
+		"${shlibsign}" \
+			-i "${libdir}"/${libname} \
+			-o "${libdir}"/${chkname}.tmp \
+		&& mv -f \
+			"${libdir}"/${chkname}.tmp \
+			"${libdir}"/${chkname} \
+		|| die "Failed to sign ${libname}"
+	done
+}
+
+cleanup_chk() {
+	local libdir="$1"
+	shift 1
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libfname="${libdir}/lib${i}.so"
+		# If the major version has changed, then we have old chk files.
+		[ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
+			&& rm -f "${libfname}.chk"
+	done
+}
+
+multilib_src_install() {
+	pushd dist >/dev/null || die
+
+	dodir /usr/$(get_libdir)
+	cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
+	local i
+	for i in crmf freebl nssb nssckfw ; do
+		cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
+	done
+
+	# Install nss-config and pkgconfig file
+	dodir /usr/bin
+	cp -L */bin/nss-config "${ED}"/usr/bin || die
+	dodir /usr/$(get_libdir)/pkgconfig
+	cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
+
+	# create an nss-softokn.pc from nss.pc for libfreebl and some private headers
+	# bug 517266
+	sed -e 's#Libs:#Libs: -lfreebl#' \
+		-e 's#Cflags:#Cflags: -I${includedir}/private#' \
+		*/lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
+		|| die "could not create nss-softokn.pc"
+
+	# all the include files
+	insinto /usr/include/nss
+	doins public/nss/*.{h,api}
+	insinto /usr/include/nss/private
+	doins private/nss/{blapi,alghmac,cmac}.h
+
+	popd >/dev/null || die
+
+	local f nssutils
+	# Always enabled because we need it for chk generation.
+	nssutils=( shlibsign )
+
+	if multilib_is_native_abi ; then
+		if use utils; then
+			# The tests we do not need to install.
+			#nssutils_test="bltest crmftest dbtest dertimetest
+			#fipstest remtest sdrtest"
+			# checkcert utils has been removed in nss-3.22:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
+			# https://hg.mozilla.org/projects/nss/rev/df1729d37870
+			# certcgi has been removed in nss-3.36:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
+			nssutils+=(
+				addbuiltin
+				atob
+				baddbdir
+				btoa
+				certutil
+				cmsutil
+				conflict
+				crlutil
+				derdump
+				digest
+				makepqg
+				mangle
+				modutil
+				multinit
+				nonspr10
+				ocspclnt
+				oidcalc
+				p7content
+				p7env
+				p7sign
+				p7verify
+				pk11mode
+				pk12util
+				pp
+				rsaperf
+				selfserv
+				signtool
+				signver
+				ssltap
+				strsclnt
+				symkeyutil
+				tstclnt
+				vfychain
+				vfyserv
+			)
+			# install man-pages for utils (bug #516810)
+			doman doc/nroff/*.1
+		fi
+		pushd dist/*/bin >/dev/null || die
+		for f in ${nssutils[@]}; do
+			dobin ${f}
+		done
+		popd >/dev/null || die
+	fi
+}
+
+pkg_postinst() {
+	multilib_pkg_postinst() {
+		# We must re-sign the libraries AFTER they are stripped.
+		local shlibsign="${EROOT}/usr/bin/shlibsign"
+		# See if we can execute it (cross-compiling & such). #436216
+		"${shlibsign}" -h >&/dev/null
+		if [[ $? -gt 1 ]] ; then
+			shlibsign="shlibsign"
+		fi
+		generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postinst
+}
+
+pkg_postrm() {
+	multilib_pkg_postrm() {
+		cleanup_chk "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postrm
+}
diff --git a/dev-libs/openspecfun/Manifest b/dev-libs/openspecfun/Manifest
index 577a7a3595fa..6ef49ca64fb7 100644
--- a/dev-libs/openspecfun/Manifest
+++ b/dev-libs/openspecfun/Manifest
@@ -3,5 +3,5 @@ AUX openspecfun-0.5.5-Makefile.patch 1802 BLAKE2B 9e1174fb6663d394dcd7bf4cc400d6
 DIST openspecfun-0.5.3.tar.gz 121156 BLAKE2B 4b1d883634524db9a5c1d5c2e291667264f3bc15c2b6cd1c335ef7a4748668091255c4940c54cea27ab0fd301e7c08156825bcdecfef71802b7d571d74af021e SHA512 503da7592b126cce9ecb8af5ce16c667a9b022676721063e5f551fb88c0955f465ed66df7728ed2391f068ea14b77414bfd9934c0ee38081d11b998826d6b88a
 DIST openspecfun-0.5.5.tar.gz 121025 BLAKE2B 72d92a676c90f24378f9902f76d59df47a403810b56d9a90bd39d6348082d34be59223b0f6b9ad00cd1ebdeb03001b31141134088d8e8164cf9a9c4fad239c78 SHA512 429c0ce47c3a3a044266fee0e285bd4e53e7433c83bf02b03fc4526b8d0e415295143693642a34cdf1c6b59aa86e76fd76c51ffc9440d0ba655c16a8a24a2a1b
 EBUILD openspecfun-0.5.3.ebuild 846 BLAKE2B 8a4e82c5387f30b2207808473812ca9e16353a812fa2ad81a508d9a74d2306f5724ad24f3dec1e3ddd4181252f016937d7aada30fef6c46fb14c2ca6fc7061fb SHA512 1d39fad14ca2b13b56f1e5cec714720001baf66bc80b42cdbd41368e7290d897921afaf2f3abe9900099ae104270a978e284640abc299e075c62825d920b78f2
-EBUILD openspecfun-0.5.5.ebuild 885 BLAKE2B 7bad9feff5debcfb0b68fcbaac25c76191f7f73c79baa9127647a59b0e18d6a4714b2502790aa7679495e7f6e11a526bf173b29574c4589cebf9ca1e59f05255 SHA512 fdb8268a150c936ec64899d737d03cae85be45984a2ddf48d00623e98c14ec83bd05e36703c039fe6ab23638172d557d1fa314cf3c34e6f87eec6c9915523963
+EBUILD openspecfun-0.5.5.ebuild 884 BLAKE2B 49379470901f9993dddd5e49458d9afb79b83a247e3a94f67e83a685e749f9533438cffede853c09084df10345dc33962be455fd4a543168ec9e708c7990c669 SHA512 0c011016342dcd8ee0cd9cc54eed32b2db081124924bf5363d3de618168cf8e6b436ea74d0a03e0d440cdc09d02d29df70c6e3497740b5e95e708b4c13e8697b
 MISC metadata.xml 464 BLAKE2B 5fe304df52f66ccc4bb5c7a123c9f49e9e43c33201c073334fd2e3a43410f066f4e071009c570482acb118a4183ad60195ef92dae426a98621f8c12306284902 SHA512 36c099b5a0d2ee685fc7acbea16b9d9809e5705d08befc530cf6514f704cc16437089f1f6f48e7c64ece4ed7939cf1a31775dfd71ae72da0e33e1733cfc92d38
diff --git a/dev-libs/openspecfun/openspecfun-0.5.5.ebuild b/dev-libs/openspecfun/openspecfun-0.5.5.ebuild
index 951a5d905401..0718518477f7 100644
--- a/dev-libs/openspecfun/openspecfun-0.5.5.ebuild
+++ b/dev-libs/openspecfun/openspecfun-0.5.5.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/JuliaLang/openspecfun/archive/v${PV}.tar.gz -> ${P}.
 
 LICENSE="MIT public-domain"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~s390 ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="amd64 arm arm64 ~loong ppc ppc64 ~riscv ~s390 x86 ~amd64-linux ~x86-linux"
 
 DEPEND="sci-libs/openlibm:="
 RDEPEND="${DEPEND}"