12 files changed, 426 insertions, 8 deletions
diff --git a/net-libs/Manifest.gz b/net-libs/Manifest.gz
index a553554fd919..ab1539340439 100644
--- a/net-libs/Manifest.gz
+++ b/net-libs/Manifest.gz
diff --git a/net-libs/courier-authlib/Manifest b/net-libs/courier-authlib/Manifest
index 56258cc01b8a..15ed8e974b51 100644
--- a/net-libs/courier-authlib/Manifest
+++ b/net-libs/courier-authlib/Manifest
@@ -4,5 +4,5 @@ DIST courier-authlib-0.72.0.tar.bz2 2274507 BLAKE2B 238fbc8d046dd3c1f2eb6357f9b1
 DIST courier-authlib-0.72.1.tar.bz2 2288448 BLAKE2B 0af13cb4d4e8661011acae46c7134ed7d76b5d114129846397bbaf95db3d05ac792a99c9088e1101c0d8f040bccace9e813d54bc864cabb67ba2501701567bce SHA512 2e46f3ee91dc3b0e81e1f2fb2ebae9615fd1bc2349946167ebb0d6701fc60f1ed754f0d9de160730b45991869ab30849f153a0e523777f5eae28f8a38426e814
 EBUILD courier-authlib-0.71.0-r4.ebuild 4446 BLAKE2B 9d0042f3e6c65a735532eb7b0b30223d01d49b7c6197ef88511f734d6b7af9b779c46761eea445420f6ac27ad254b0cf7eff850b99f1c5a69a855341d976a334 SHA512 8f708363dc3519931ae0854543b9060d0209181a5e01c65ea6d2d4f6024043ba7f66bd95815f75f4d9eb6d02e13a32385792461da5ca741553187f4de64ec054
 EBUILD courier-authlib-0.72.0.ebuild 4464 BLAKE2B d7d9e2f9084b4decc45d56fd95da770befe9c8d40fb10dc122a0c61184f8216483cd5718cddcce285320ffec6b46b73fa25adad46a6a0c3c4898986fb769d052 SHA512 1eacf02025cb15b8c20d70a0410d926af1f44247b3ef922166f39f365514b65cb17de4248add057f2e1c07237de167bffa45b31a725b03e5b9d90eb3da4efc62
-EBUILD courier-authlib-0.72.1.ebuild 4485 BLAKE2B 4a34f1b4b0b0d0844c7b0b2fdf7fccd1c3e05513890ff8862501d34fd55a515a344abcd5b62f825352023fec410029d00856c24a2a0e4afc87fbe91e2639f0bd SHA512 848fa89a6b073135b53c6158a5f60bf907af25877455585f1dbc8c45dbd1afc1e341ed6ac595490548091871921c87eb6f15c1df3c98d730599908fcade1dee6
+EBUILD courier-authlib-0.72.1.ebuild 4483 BLAKE2B eee2fb197a645e9baa2867e3fe8f5b696f2fe5d291ad17a903ac024433d838c15d4d2903b2bf275f5411781e494b60bbb3d5e54a8f73f011d8d70a5f8de4c356 SHA512 74263d9a287daaeef3e7a878dacd30a5fe60ae747479b5aa727082c48eaaa4da2db670467ece5fbb535675909993b39cdf275c775352afdcf7117cbfd0ec7182
 MISC metadata.xml 302 BLAKE2B f4a6bbc1e616a769172499ca1f863a8e43d608e25d2a99a6384fd0a0880e4e23f2c64c97404ad80ae12c3cd23eda5854ded0ed2c9000875c701aa22ff70b9e80 SHA512 3f25d55e6f6169b696d210cfbd7df486337885cd0905b62d307e6b3fd1595ac1471dccb59794ecfe0bbcd009339348ef7bb9debb4752533d1b28043cb5d1f918
diff --git a/net-libs/courier-authlib/courier-authlib-0.72.1.ebuild b/net-libs/courier-authlib/courier-authlib-0.72.1.ebuild
index 616bcc104784..cc82d999c472 100644
--- a/net-libs/courier-authlib/courier-authlib-0.72.1.ebuild
+++ b/net-libs/courier-authlib/courier-authlib-0.72.1.ebuild
@@ -11,7 +11,7 @@ HOMEPAGE="https://www.courier-mta.org/authlib/"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="berkdb debug gdbm ldap mysql pam postgres sqlite static-libs"
 
 RESTRICT="!berkdb? ( test )"
diff --git a/net-libs/courier-unicode/Manifest b/net-libs/courier-unicode/Manifest
index cf7046cab5ea..e8d2b75ef682 100644
--- a/net-libs/courier-unicode/Manifest
+++ b/net-libs/courier-unicode/Manifest
@@ -3,5 +3,5 @@ DIST courier-unicode-2.2.6.tar.bz2 598551 BLAKE2B 870e3add65747354ea8a91d58272a5
 DIST courier-unicode-2.3.0.tar.bz2 657354 BLAKE2B 4ccb4743330b5da8b4ab8f39d3ca186bcb826ef466a909d6cc011df5c2e15a8d547cf59f44dc40a02108d08695fa2747eab0050c3cd3e913277c9cc32ddf61db SHA512 f0db382a5c3fbe76fa1395e90f5f5489f83e95753f95058aa1c1b16dbcd5aba0425e88674337d18d32d00ed932609c3e984ae684bb122fea40eaae9489f470d4
 EBUILD courier-unicode-2.1-r1.ebuild 524 BLAKE2B c1ca8d907f4dd69b3ac761e975d2b27b98a79411e21abb125b566ef43862f96d94f8e43b4e4a72d131d9e8616b98a9bc99f1261af00dbbe012d9b37c9b617924 SHA512 ce98696af03e2b2fb11ba2835238087c8fb2eeef341b21da8e1aca0ae0a7eed1365e3b3cd355f956acfb7198869b8415d6dce8e03533a88f598d0a4a9d159415
 EBUILD courier-unicode-2.2.6.ebuild 535 BLAKE2B bfde1d17ebc59461f1b919648955f5a2793e7c45ec210774a61b535949617c5b84ce6692b4fc8da0e65a63cab260f7b163b5ec9368c56646d5e11218ca8b36cb SHA512 a62e88bce13ee0cfffd185485789d385e7faed3d441d8339368d123a13078baf734f083e49e5c765e2eb2927b03e52a8b75c203b01223dacbf4fb215d02dcb8b
-EBUILD courier-unicode-2.3.0.ebuild 538 BLAKE2B 41394cce2d25eb8cbf1af7ec8c85a6fd405e2ef3407e2e16de7be60a590d95b1515596e01e6e0e10a618a33ccd6555cde09e9a580f34df65c987b72a8ed073a6 SHA512 99c1bb0955dad85992c3319b125977d8c82ec86a41b68249bba1a277155e933d84da0bfa7dad66a7acf1c6ceec774dffa9bd80480b463b4f0ea9c83bc7f546a4
+EBUILD courier-unicode-2.3.0.ebuild 536 BLAKE2B 9012ec90e29599bf506f958827e703c92526155a7ff637cdd7584fc1edff3717673e2864b43ffd40ffb6ad83e282db95e351cf969ac9db9e9f000b2ba6749944 SHA512 a61dfb16b33f716b04b1a358e1e45000e3e57e13bcc5ce1b0d857018419daba93e8983f7c31f25d438098c480bfa36348490295aec5044ea30007580c233e88c
 MISC metadata.xml 294 BLAKE2B 529ed84dfbb6d03b115e2ed70383004be4908c1164d320822c212a7be40ce17d6dab03fdf76bdc8c4fb2355bf74b3a9d0dbf403556867c34532c7f0d497715bc SHA512 bd738845d02840a3e451e87ccded91513d5d7d23f4a4a0efff9ea7ce24debb1b41c4283be1898bb6b1a354c91a765c4a5e83c0745ec069865e57a0ce77c5f273
diff --git a/net-libs/courier-unicode/courier-unicode-2.3.0.ebuild b/net-libs/courier-unicode/courier-unicode-2.3.0.ebuild
index e1bc7ca824f9..d039bdb48cd6 100644
--- a/net-libs/courier-unicode/courier-unicode-2.3.0.ebuild
+++ b/net-libs/courier-unicode/courier-unicode-2.3.0.ebuild
@@ -9,7 +9,7 @@ SRC_URI="mirror://sourceforge/courier/${P}.tar.bz2"
 
 LICENSE="GPL-3"
 SLOT="0/7"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~mips ~ppc ppc64 ~riscv ~s390 sparc x86"
 
 src_configure() {
 	econf --disable-static
diff --git a/net-libs/gnutls/Manifest b/net-libs/gnutls/Manifest
index 47998de6a0d6..03f7caa38ad2 100644
--- a/net-libs/gnutls/Manifest
+++ b/net-libs/gnutls/Manifest
@@ -1,3 +1,4 @@
+AUX gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch 7361 BLAKE2B ca74ef7ca3070f2b44b6958547595acaac0c3aa783a6a67897ad9536f32f27838df6538bbe2fa5cb6430279c81373dd9bec9c7828db5d88492f8f24b679be045 SHA512 0319255a2427b993a6191b42cb034876909c6ff3cf5132cda60bc4bdff6f3fb1db191c6394beb9457d0abd99e375505c2c572f74a2ca263996eaedc7e186d318
 DIST gnutls-3.7.8.tar.xz 6029220 BLAKE2B 0a21e63c7cb0ba4eeff23593c7282e0b4d704fa2d2a1cd5289998fd04b58ea36fc343f872225ad05478e278b1cdebbcd0fd376459abcb58547f8fa1488485530 SHA512 4199bcf7c9e3aab2f52266aadceefc563dfe2d938d0ea1f3ec3be95d66f4a8c8e5494d3a800c03dd02ad386dec1738bd63e1fe0d8b394a2ccfc7d6c6a0cc9359
 DIST gnutls-3.7.8.tar.xz.sig 1250 BLAKE2B 66c6a335c3b2290a4e44ffa6ae715ad71d2bcd7df485c1d2d9490985d9dcd445768d6eb021ad3a61614431183c6652254c63ebd8abd0f0a03d3164a6193b6192 SHA512 cecf9843e8683a278d065b663dc98ac2b5fcad1905ee25333038c93c2289b518c974629367e77e66552ac1c9d122d551616edba35cb0c4204202ec676f1a2db7
 DIST gnutls-3.7.9.tar.xz 6377212 BLAKE2B c8263381132b0c96f23a580823cfaf57112056876e5f2cc21aec4eeddec641b0c01fa02ff9493ea686f49fd917190b06f89379eb448a510cf4d50fe3a0742851 SHA512 56ccbab5f214f9e3cf10a43dd90dedc1e10a38d08b8359a4305dc05c59ddb4a1d3680b282077b6446605c31675a4261cd0579c2c0d976e0b2ced02e6dba224c1
@@ -12,5 +13,6 @@ EBUILD gnutls-3.7.8.ebuild 4510 BLAKE2B 071712c5a26ac5208b8c3b76e8e30cd697bfe46c
 EBUILD gnutls-3.7.9.ebuild 4518 BLAKE2B 1677d20875850c62130350dcbc92b61f51c6aa5de64d16179944caad10616859f082c11bf327d57f836b7cc24e3803821b61e2df4fc2c17862d35a26a033aaeb SHA512 e30ea13f425d0a6eba30b1235e3a6240e9f0481df318c7f0b6699088bb8c98c07e146a891c8ccd8efe0cc0b8f70a8456d84e62f8db118ad8ae380e679769259b
 EBUILD gnutls-3.8.0.ebuild 4569 BLAKE2B 4b3dbdec9ab063ef44ec516c91b3777028d627e89260885a033756be8e0edcecd7c0e0c4f27f9ea8c2e2cf929b6f729c62bc265b64a8ed9ed7785bfe442ba274 SHA512 81d3331058c8dc1a121d2b618462ad07797b5b3f118842e6fb634b1d7bef27d1a8657ca04319b16b709989987b91cd4de8e582516840abfd3c74bd60f357e0cb
 EBUILD gnutls-3.8.3.ebuild 4683 BLAKE2B b19f9797b93c00e98106ece1395fcb0625ae071fbcdc31efc539f081c2770f5e61e0288bbddeb5e2b41fbfaddbe4b27ca7e68048def487d5397e80a8af52cd96 SHA512 f533871504131a7bb76fac115460b01a564c52ae72c9ed0fbe1b4a2e1388e7512f8144891adfeea4853ed55a13137d05ed7fef8516c8933a790847ac320319ab
+EBUILD gnutls-3.8.5-r1.ebuild 4831 BLAKE2B 318f57de485ee58e3b598c095d686fcef2918472c6c18b05349481631a3d35c19bf8b9be91ca825b6fcd9eb244bdc3435ce53361ae7c50718243ed2d9970bca5 SHA512 f4cc2ce252c8b13cc5759b2ba5c83599cd327ed7fbc50791fe14d2a7abb51c4fdbb3cd70c914c08761e734e255c44c889f60b451845db53cb6b6401c6066dd59
 EBUILD gnutls-3.8.5.ebuild 4683 BLAKE2B dfd03e9f80c1c9142ba16145414d4c9204fc79a5d5b3e956a8042ac93f7aa12e1207ae031e6b3e4df17fe309367a96eb9b2fed94eecca8c8da90137cc2d39856 SHA512 8e2aad44f15ef216cc2a641bb955c878dcd7eea71209db38cf7df6381a1b9d1647b6e724a13d3fa2f997ac3d28ad111e2fb49548dcba832a3e3be0d2e46949d7
 MISC metadata.xml 1141 BLAKE2B 70657c924a576930a14064d750074cce08bfe3f99970987aca13f9f1dc49024d8a99de54336b5e51f7cee4fa944045a323cf8384e0363189c4ee60962b185a42 SHA512 467370ffa9762eff75e73ffcb959c7bbe65528b33256c871b702be90c7b6f06e6b60a0a358c81dadba43388ec803a9dabe09a6f7cb3616ee3c65eaa6416140ee
diff --git a/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
new file mode 100644
index 000000000000..6905f793ab4f
--- /dev/null
+++ b/net-libs/gnutls/files/gnutls-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
@@ -0,0 +1,261 @@
+https://bugs.gentoo.org/930752
+https://bugs.gentoo.org/930529
+https://gitlab.com/gnutls/gnutls/-/issues/1540
+https://gitlab.com/gnutls/gnutls/-/merge_requests/1830
+https://gitlab.com/gnutls/gnutls/-/commit/2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d
+
+From 2d73d945c4b1dfcf8d2328c4d23187d62ffaab2d Mon Sep 17 00:00:00 2001
+From: Zoltan Fridrich <zfridric@redhat.com>
+Date: Wed, 10 Apr 2024 12:51:33 +0200
+Subject: [PATCH] Fix RSAES-PKCS1-v1_5 system-wide configuration
+
+Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
+--- a/lib/priority.c
++++ b/lib/priority.c
+@@ -1018,6 +1018,12 @@ struct cfg {
+ 	bool force_ext_master_secret_set;
+ };
+ 
++static inline void cfg_init(struct cfg *cfg)
++{
++	memset(cfg, 0, sizeof(*cfg));
++	cfg->allow_rsa_pkcs1_encrypt = true;
++}
++
+ static inline void cfg_deinit(struct cfg *cfg)
+ {
+ 	if (cfg->priority_strings) {
+@@ -1095,6 +1101,12 @@ struct ini_ctx {
+ 	size_t curves_size;
+ };
+ 
++static inline void ini_ctx_init(struct ini_ctx *ctx)
++{
++	memset(ctx, 0, sizeof(*ctx));
++	cfg_init(&ctx->cfg);
++}
++
+ static inline void ini_ctx_deinit(struct ini_ctx *ctx)
+ {
+ 	cfg_deinit(&ctx->cfg);
+@@ -1423,9 +1435,6 @@ static inline int cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)
+ 		_gnutls_default_priority_string = cfg->default_priority_string;
+ 	}
+ 
+-	/* enable RSA-PKCS1-V1_5 by default */
+-	cfg->allow_rsa_pkcs1_encrypt = true;
+-
+ 	if (cfg->allowlisting) {
+ 		/* also updates `flags` of global `hash_algorithms[]` */
+ 		ret = cfg_hashes_set_array(cfg, ctx->hashes, ctx->hashes_size);
+@@ -2217,22 +2226,73 @@ update_system_wide_priority_string(void)
+ 	return 0;
+ }
+ 
++/* Returns false on parse error, otherwise true.
++ * The system_wide_config must be locked for writing.
++ */
++static inline bool load_system_priority_file(void)
++{
++	int err;
++	FILE *fp;
++	struct ini_ctx ctx;
++
++	cfg_init(&system_wide_config);
++
++	fp = fopen(system_priority_file, "re");
++	if (fp == NULL) {
++		_gnutls_debug_log("cfg: unable to open: %s: %d\n",
++				  system_priority_file, errno);
++		return true;
++	}
++
++	/* Parsing the configuration file needs to be done in 2 phases:
++	 * first parsing the [global] section
++	 * and then the other sections,
++	 * because the [global] section modifies the parsing behavior.
++	 */
++	ini_ctx_init(&ctx);
++	err = ini_parse_file(fp, global_ini_handler, &ctx);
++	if (!err) {
++		if (fseek(fp, 0L, SEEK_SET) < 0) {
++			_gnutls_debug_log("cfg: unable to rewind: %s\n",
++					  system_priority_file);
++			if (fail_on_invalid_config)
++				exit(1);
++		}
++		err = ini_parse_file(fp, cfg_ini_handler, &ctx);
++	}
++	fclose(fp);
++	if (err) {
++		ini_ctx_deinit(&ctx);
++		_gnutls_debug_log("cfg: unable to parse: %s: %d\n",
++				  system_priority_file, err);
++		return false;
++	}
++	cfg_apply(&system_wide_config, &ctx);
++	ini_ctx_deinit(&ctx);
++	return true;
++}
++
+ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ {
+-	int ret, err = 0;
++	int ret;
++	bool config_parse_error = false;
+ 	struct stat sb;
+-	FILE *fp;
+ 	gnutls_buffer_st buf;
+-	struct ini_ctx ctx;
+ 
+ 	ret = gnutls_rwlock_rdlock(&system_wide_config_rwlock);
+-	if (ret < 0) {
++	if (ret < 0)
+ 		return gnutls_assert_val(ret);
+-	}
+ 
+ 	if (stat(system_priority_file, &sb) < 0) {
+ 		_gnutls_debug_log("cfg: unable to access: %s: %d\n",
+ 				  system_priority_file, errno);
++
++		(void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
++		ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock);
++		if (ret < 0)
++			goto out;
++		/* If system-wide config is unavailable, apply the defaults */
++		cfg_init(&system_wide_config);
+ 		goto out;
+ 	}
+ 
+@@ -2240,63 +2300,27 @@ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ 	    system_priority_last_mod == sb.st_mtime) {
+ 		_gnutls_debug_log("cfg: system priority %s has not changed\n",
+ 				  system_priority_file);
+-		if (system_wide_config.priority_string) {
++		if (system_wide_config.priority_string)
+ 			goto out; /* nothing to do */
+-		}
+ 	}
+ 
+ 	(void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
+ 
+ 	ret = gnutls_rwlock_wrlock(&system_wide_config_rwlock);
+-	if (ret < 0) {
++	if (ret < 0)
+ 		return gnutls_assert_val(ret);
+-	}
+ 
+ 	/* Another thread could have successfully re-read system-wide config,
+ 	 * skip re-reading if the mtime it has used is exactly the same.
+ 	 */
+-	if (system_priority_file_loaded) {
++	if (system_priority_file_loaded)
+ 		system_priority_file_loaded =
+ 			(system_priority_last_mod == sb.st_mtime);
+-	}
+ 
+ 	if (!system_priority_file_loaded) {
+-		_name_val_array_clear(&system_wide_config.priority_strings);
+-
+-		gnutls_free(system_wide_config.priority_string);
+-		system_wide_config.priority_string = NULL;
+-
+-		fp = fopen(system_priority_file, "re");
+-		if (fp == NULL) {
+-			_gnutls_debug_log("cfg: unable to open: %s: %d\n",
+-					  system_priority_file, errno);
++		config_parse_error = !load_system_priority_file();
++		if (config_parse_error)
+ 			goto out;
+-		}
+-		/* Parsing the configuration file needs to be done in 2 phases:
+-		 * first parsing the [global] section
+-		 * and then the other sections,
+-		 * because the [global] section modifies the parsing behavior.
+-		 */
+-		memset(&ctx, 0, sizeof(ctx));
+-		err = ini_parse_file(fp, global_ini_handler, &ctx);
+-		if (!err) {
+-			if (fseek(fp, 0L, SEEK_SET) < 0) {
+-				_gnutls_debug_log("cfg: unable to rewind: %s\n",
+-						  system_priority_file);
+-				if (fail_on_invalid_config)
+-					exit(1);
+-			}
+-			err = ini_parse_file(fp, cfg_ini_handler, &ctx);
+-		}
+-		fclose(fp);
+-		if (err) {
+-			ini_ctx_deinit(&ctx);
+-			_gnutls_debug_log("cfg: unable to parse: %s: %d\n",
+-					  system_priority_file, err);
+-			goto out;
+-		}
+-		cfg_apply(&system_wide_config, &ctx);
+-		ini_ctx_deinit(&ctx);
+ 		_gnutls_debug_log("cfg: loaded system config %s mtime %lld\n",
+ 				  system_priority_file,
+ 				  (unsigned long long)sb.st_mtime);
+@@ -2332,9 +2356,8 @@ static int _gnutls_update_system_priorities(bool defer_system_wide)
+ out:
+ 	(void)gnutls_rwlock_unlock(&system_wide_config_rwlock);
+ 
+-	if (err && fail_on_invalid_config) {
++	if (config_parse_error && fail_on_invalid_config)
+ 		exit(1);
+-	}
+ 
+ 	return ret;
+ }
+--- a/tests/system-override-allow-rsa-pkcs1-encrypt.sh
++++ b/tests/system-override-allow-rsa-pkcs1-encrypt.sh
+@@ -19,9 +19,8 @@
+ # You should have received a copy of the GNU Lesser General Public License
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>
+ 
+-: ${srcdir=.}
+-TEST=${srcdir}/rsaes-pkcs1-v1_5
+-CONF=${srcdir}/config.$$.tmp
++TEST=${builddir}/rsaes-pkcs1-v1_5
++CONF=config.$$.tmp
+ export GNUTLS_SYSTEM_PRIORITY_FILE=${CONF}
+ export GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID=1
+ 
+@@ -38,15 +37,33 @@ cat <<_EOF_ > ${CONF}
+ allow-rsa-pkcs1-encrypt = true
+ _EOF_
+ 
+-${TEST} && fail "RSAES-PKCS1-v1_5 expected to succeed"
++${TEST}
++if [ $? != 0 ]; then
++	echo "${TEST} expected to succeed"
++	exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully enabled"
+ 
+ cat <<_EOF_ > ${CONF}
+ [overrides]
+ allow-rsa-pkcs1-encrypt = false
+ _EOF_
+ 
+-${TEST} || fail "RSAES-PKCS1-v1_5 expected to fail"
++${TEST}
++if [ $? = 0 ]; then
++	echo "${TEST} expected to fail"
++	exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully disabled"
+ 
+ unset GNUTLS_SYSTEM_PRIORITY_FILE
+ unset GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALID
++
++${TEST}
++if [ $? != 0 ]; then
++	echo "${TEST} expected to succeed by default"
++	exit 1
++fi
++echo "RSAES-PKCS1-v1_5 successfully enabled by default"
++
+ exit 0
+-- 
+GitLab
diff --git a/net-libs/gnutls/gnutls-3.8.5-r1.ebuild b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild
new file mode 100644
index 000000000000..24fba955fe8e
--- /dev/null
+++ b/net-libs/gnutls/gnutls-3.8.5-r1.ebuild
@@ -0,0 +1,155 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnutls.asc
+inherit libtool multilib-minimal verify-sig
+
+DESCRIPTION="A secure communications library implementing the SSL, TLS and DTLS protocols"
+HOMEPAGE="https://www.gnutls.org/"
+SRC_URI="mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnutls/v$(ver_cut 1-2)/${P}.tar.xz.sig )"
+
+LICENSE="GPL-3 LGPL-2.1+"
+# As of 3.8.0, the C++ library is header-only, but we won't drop the subslot
+# component for it until libgnutls.so breaks ABI, to avoid pointless rebuilds.
+# Subslot format:
+# <libgnutls.so number>.<libgnutlsxx.so number>
+SLOT="0/30.30"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="brotli +cxx dane doc examples +idn nls +openssl pkcs11 seccomp sslv2 sslv3 static-libs test test-full +tls-heartbeat tools zlib zstd"
+REQUIRED_USE="test-full? ( cxx dane doc examples idn nls openssl pkcs11 seccomp tls-heartbeat tools )"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-libs/libtasn1-4.9:=[${MULTILIB_USEDEP}]
+	dev-libs/libunistring:=[${MULTILIB_USEDEP}]
+	>=dev-libs/nettle-3.6:=[gmp,${MULTILIB_USEDEP}]
+	>=dev-libs/gmp-5.1.3-r1:=[${MULTILIB_USEDEP}]
+	brotli? ( >=app-arch/brotli-1.0.0:=[${MULTILIB_USEDEP}] )
+	dane? ( >=net-dns/unbound-1.4.20:=[${MULTILIB_USEDEP}] )
+	nls? ( >=virtual/libintl-0-r1:=[${MULTILIB_USEDEP}] )
+	pkcs11? ( >=app-crypt/p11-kit-0.23.1[${MULTILIB_USEDEP}] )
+	idn? ( >=net-dns/libidn2-0.16-r1:=[${MULTILIB_USEDEP}] )
+	zlib? ( sys-libs/zlib[${MULTILIB_USEDEP}] )
+	zstd? ( >=app-arch/zstd-1.3.0:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		seccomp? ( sys-libs/libseccomp )
+	)
+"
+BDEPEND="
+	dev-build/gtk-doc-am
+	>=virtual/pkgconfig-0-r1
+	doc? ( dev-util/gtk-doc )
+	nls? ( sys-devel/gettext )
+	test-full? (
+		app-crypt/dieharder
+		|| ( sys-libs/libfaketime >=app-misc/datefudge-1.22 )
+		dev-libs/softhsm:2[-bindist(-)]
+		net-dialup/ppp
+		net-misc/socat
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-gnutls-20240415 )
+"
+
+DOCS=( README.md doc/certtool.cfg )
+
+HTML_DOCS=()
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs
+	MIN
+	alignof
+	static_assert
+)
+
+PATCHES=(
+	# Should no longer be needed for the next release
+	# bug #930529
+	"${FILESDIR}"/${PN}-3.8.5-fix-rsaes-pkcs1-systemd-wide-config.patch
+)
+
+src_prepare() {
+	default
+
+	# bug #520818
+	export TZ=UTC
+
+	use doc && HTML_DOCS+=( doc/gnutls.html )
+
+	# don't try to use system certificate store on macOS, it is
+	# confusingly ignoring our ca-certificates and more importantly
+	# fails to compile in certain configurations
+	sed -i -e 's/__APPLE__/__NO_APPLE__/' lib/system/certs.c || die
+
+	# Use sane .so versioning on FreeBSD.
+	elibtoolize
+}
+
+multilib_src_configure() {
+	LINGUAS="${LINGUAS//en/en@boldquot en@quot}"
+
+	local libconf=()
+
+	# TPM needs to be tested before being enabled
+	# Note that this may add a libltdl dep when enabled. Check configure.ac.
+	libconf+=(
+		--without-tpm
+		--without-tpm2
+	)
+
+	# hardware-accel is disabled on OSX because the asm files force
+	#   GNU-stack (as doesn't support that) and when that's removed ld
+	#   complains about duplicate symbols
+	[[ ${CHOST} == *-darwin* ]] && libconf+=( --disable-hardware-acceleration )
+
+	# -fanalyzer substantially slows down the build and isn't useful for
+	# us. It's useful for upstream as it's static analysis, but it's not
+	# useful when just getting something built.
+	export gl_cv_warn_c__fanalyzer=no
+
+	local myeconfargs=(
+		--disable-valgrind-tests
+		$(multilib_native_enable manpages)
+		$(multilib_native_use_enable doc gtk-doc)
+		$(multilib_native_use_enable doc)
+		$(multilib_native_use_enable seccomp seccomp-tests)
+		$(multilib_native_use_enable test tests)
+		$(multilib_native_use_enable test-full full-test-suite)
+		$(multilib_native_use_enable tools)
+		$(use_enable cxx)
+		$(use_enable dane libdane)
+		$(use_enable nls)
+		$(use_enable openssl openssl-compatibility)
+		$(use_enable sslv2 ssl2-support)
+		$(use_enable sslv3 ssl3-support)
+		$(use_enable static-libs static)
+		$(use_enable tls-heartbeat heartbeat-support)
+		$(use_with brotli)
+		$(use_with idn)
+		$(use_with pkcs11 p11-kit)
+		$(use_with zlib)
+		$(use_with zstd)
+		--disable-rpath
+		--with-default-trust-store-file="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt
+		--with-unbound-root-key-file="${EPREFIX}"/etc/dnssec/root-anchors.txt
+		--without-included-libtasn1
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	ECONF_SOURCE="${S}" econf "${libconf[@]}" "${myeconfargs[@]}"
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete || die
+
+	if use examples; then
+		docinto examples
+		dodoc doc/examples/*.c
+	fi
+}
diff --git a/net-libs/miniupnpc/Manifest b/net-libs/miniupnpc/Manifest
index be4425cee7c9..2ca61181a273 100644
--- a/net-libs/miniupnpc/Manifest
+++ b/net-libs/miniupnpc/Manifest
@@ -4,5 +4,5 @@ DIST miniupnpc-2.2.6.tar.gz.sig 543 BLAKE2B 243d9eacab92a33c6c9bf064333c6d2620c8
 DIST miniupnpc-2.2.7.tar.gz 104258 BLAKE2B 5681c1747c8e330442a0ad46d673e1739283bfc23571cb2225abf82326caa7da979911b3182cab2e3eea49140b90619f4e00bb5b1e2f0cd6067c28017cf87016 SHA512 d24e653c2f7bfed4485342c5ec8d18b4dd4c3430975b5fae392d3534f38bb3fb59e6638e76d57847f49045e22f3afd6cac128d7d9d10ef05bd6ad24ef38303b6
 DIST miniupnpc-2.2.7.tar.gz.sig 543 BLAKE2B 6649e5866afd13034b05a9d771c25c419e85631ca17ed7457e5811aee0ba8c38b0ad34033caa5b611cde21a63251e902e3f24cc4748e52a4a379ef075bf59dc5 SHA512 188837275b20c61c05babac916bff86178774030dbc191ecd0e5314c6e9b6dbb627680b512c554a8b27a020bd7503b141be26a134e0ed7e2cc56c7e2c01d9e81
 EBUILD miniupnpc-2.2.6-r1.ebuild 1551 BLAKE2B ef8fdec98afa1f36e8e90908bcdc3b780e18de1d7685ed360d333027f68c7c3e741d420808117fbfbde42614a4d198fa35fca34ec88160911c4f5624601ecd28 SHA512 ab6e4a9c7cf113e7f9a8abbbcfaa589d240b9091a9f5ed74a6360004a2604d0ef78615f61b5870ffb0eb43a10dabfc6fa205b4c49629b625570541ab8ab80557
-EBUILD miniupnpc-2.2.7.ebuild 1552 BLAKE2B 54ae35db5b911669a56b1321c96dabe9b7f36a1fe7df7ae6e0f92f9066970f7fe2a10b14a9571a915d5f7aa65a7895a2a34f57795c3f9562e5de55ff268ede83 SHA512 862496aea0981f326de311131fba7fd418bc58772bb554d19929e9e025f2c034888e81272c017d16f89a10732860ec298b41b51b5e52b5d06337efc66d486e9a
+EBUILD miniupnpc-2.2.7.ebuild 1551 BLAKE2B ef8fdec98afa1f36e8e90908bcdc3b780e18de1d7685ed360d333027f68c7c3e741d420808117fbfbde42614a4d198fa35fca34ec88160911c4f5624601ecd28 SHA512 ab6e4a9c7cf113e7f9a8abbbcfaa589d240b9091a9f5ed74a6360004a2604d0ef78615f61b5870ffb0eb43a10dabfc6fa205b4c49629b625570541ab8ab80557
 MISC metadata.xml 330 BLAKE2B 02b7193f99aee0f3cad145954d1a6f7f9b2f63e21cc23d02ae3048d89618050a5a8df2e206d771a3d0853664d4a0de9a09f44660b108eb280618d9136d1c86be SHA512 6a395c2a579f4ce8c891261da25c031284904a8d6366733c14a201a948e6744ae0037067f178f799d6134e4be670f1be3582f257414e067de654e8050963b972
diff --git a/net-libs/miniupnpc/miniupnpc-2.2.7.ebuild b/net-libs/miniupnpc/miniupnpc-2.2.7.ebuild
index a58e57abe446..8f58e1fc3ffd 100644
--- a/net-libs/miniupnpc/miniupnpc-2.2.7.ebuild
+++ b/net-libs/miniupnpc/miniupnpc-2.2.7.ebuild
@@ -20,7 +20,7 @@ SRC_URI="
 
 LICENSE="BSD"
 SLOT="0/17"
-KEYWORDS="amd64 arm arm64 ~hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
+KEYWORDS="amd64 arm arm64 hppa ~loong ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 
 BDEPEND="
 	kernel_linux? ( sys-apps/lsb-release )
diff --git a/net-libs/nghttp2/Manifest b/net-libs/nghttp2/Manifest
index d647c1ba6eab..5c10f1df2387 100644
--- a/net-libs/nghttp2/Manifest
+++ b/net-libs/nghttp2/Manifest
@@ -7,6 +7,6 @@ EBUILD nghttp2-1.57.0.ebuild 1727 BLAKE2B e709c1600936992a2d6abb90ec2c72a0b9417f
 EBUILD nghttp2-1.58.0.ebuild 1735 BLAKE2B b9e4cca098780bf8dd36d637291cd357a54bc4e5399a0c3549acd2f4d9e4fcca5eeb4e27cac61f86613aa537e7e7100b2b616cebc6e08a1babb2125707b908a2 SHA512 eb6eb49b460cab1090c9a955d63d9a4665113e7b282700aa9254feb2a6d5afb7a7a217084226beebdf8532626518256674581992d5d96813cbf286317d468ceb
 EBUILD nghttp2-1.59.0.ebuild 1735 BLAKE2B 95cb3ea0a85644ef689dd3e3c3a473f5d42fb6e9823625c3bf0f008772d499635f316d64eb0de8539e40b1f1bfab8d3397bebd6f338b0cd8c6250677679f5593 SHA512 abb7d143ea738de0a2f3f5149fc10518d43fd9c2cd7b052a057df25a63a4b97bad20a293a85974a0771a9f9f946bd03a771a17df0e5beb6d72eda304340895e9
 EBUILD nghttp2-1.60.0.ebuild 1644 BLAKE2B a7a452e07ac45b9aaf613ecf4997c59fffb625862405823d5130699d714d9b4c90c13bc25abe62c23892a58046b84169d78db96e70ddcdfbee8779d2b940c48d SHA512 ef44e215c15ffd5b9566696480a522d7ec3c810cfd482a9206a3d95f49716578c3d4176ad218641dd4041106b52b4efe7e5ddd1abbce81b0d54b3ad068cfcfa5
-EBUILD nghttp2-1.61.0.ebuild 1823 BLAKE2B 4ee6b0e66e7ca06304c09b4733e6018458b767a77bc1d3ca56d9ede31cf51d5e07ee44d6594036fdbc4fa192b6d2c9b4e3690319e36370be3d87d4a4b677fe91 SHA512 c0d46b6f06d4cebfa939906c5bac5c5ba4aff900b80c9fb0322c4e304e50fe240e20f11b06d384e5febd7dc9c7c11c26f1505bf79788141ce5ef72802de4ffd5
+EBUILD nghttp2-1.61.0.ebuild 1822 BLAKE2B 1d2d6370b078a22c748f98dca91df6a83e312e50795434fd2024a77298c55d649bce4c1f9a01f8c0f890690e5d2398834cb814b4d4c2d2c2166a6038d110dc61 SHA512 8927e6ae9a364be9c06a8319c456aa0e4bf158f8245635c351c4c749e6ea7908048e07014bc8f67b193843917a61c362b9f3a5fd67206381b66c46a5a8cddd0b
 EBUILD nghttp2-9999.ebuild 1549 BLAKE2B 4b8e809fbc45b1cd4bc9860ad76706ccca2fe35d8ccbaa7f678b00464d678097bcdbd9bd296fdb06239d40e9acfc2ea8c64db939909a120f440705fb691e62f4 SHA512 a40bcc8d23913fc3f7623e04db0a7b291a19197fbae5a5befeed120882c61868c49af352fee058e4e1f4ca94e293f6272c3843cafa142726b79b6da694f1e85f
 MISC metadata.xml 553 BLAKE2B 694d0da32dab7f6eebd3b83a12b490b62d262de96e2bbb5c5822befbac792bc560cfe21c194d83d1afabf725967e0508c65057c8382904353abb0219d5ff3338 SHA512 4bce2e01c0b64eee279fc8a425393acf63e859a8b63346ddb2c5486d913bc58d0485d4c7fd6663bec88b070f21b6c9bbfd28e5775dbcbee02248e631610becd0
diff --git a/net-libs/nghttp2/nghttp2-1.61.0.ebuild b/net-libs/nghttp2/nghttp2-1.61.0.ebuild
index 5accde584b6c..3f8e52d14272 100644
--- a/net-libs/nghttp2/nghttp2-1.61.0.ebuild
+++ b/net-libs/nghttp2/nghttp2-1.61.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/nghttp2/nghttp2/releases/download/v${PV}/${P}.tar.xz
 
 LICENSE="MIT"
 SLOT="0/1.14" # 1.<SONAME>
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="debug hpack-tools jemalloc static-libs systemd test utils xml"
 
 REQUIRED_USE="test? ( static-libs )"