From 71deace00d1a2b091313fe137ab7092418c6f87c Mon Sep 17 00:00:00 2001
From: V3n3RiX <venerix@redcorelinux.org>
Date: Mon, 10 Feb 2020 21:05:55 +0000
Subject: gentoo resync : 10.02.2020

---
 app-shells/Manifest.gz                             | Bin 8134 -> 8302 bytes
 app-shells/bash/Manifest                           |   7 +-
 app-shells/bash/bash-5.0_p16.ebuild                | 264 ++++++++++++++++++++
 app-shells/bash/bash-5.0_p9.ebuild                 | 265 ---------------------
 app-shells/fish/Manifest                           |   2 +-
 app-shells/fish/fish-3.0.2.ebuild                  |   4 +-
 app-shells/gentoo-bashcomp/Manifest                |   4 +-
 .../gentoo-bashcomp-20180302.ebuild                |   2 +-
 .../gentoo-bashcomp-20190211.ebuild                |   2 +-
 app-shells/ksh/Manifest                            |   3 +-
 app-shells/ksh/files/CVE-2019-14868.patch          |  89 +++++++
 app-shells/ksh/ksh-2020.0.0-r1.ebuild              |  50 ++++
 app-shells/ksh/ksh-2020.0.0.ebuild                 |  49 ----
 app-shells/zsh-syntax-highlighting/Manifest        |   3 +
 app-shells/zsh-syntax-highlighting/metadata.xml    |   8 +
 .../zsh-syntax-highlighting-0.7.0_beta1.ebuild     |  42 ++++
 16 files changed, 471 insertions(+), 323 deletions(-)
 create mode 100644 app-shells/bash/bash-5.0_p16.ebuild
 delete mode 100644 app-shells/bash/bash-5.0_p9.ebuild
 create mode 100644 app-shells/ksh/files/CVE-2019-14868.patch
 create mode 100644 app-shells/ksh/ksh-2020.0.0-r1.ebuild
 delete mode 100644 app-shells/ksh/ksh-2020.0.0.ebuild
 create mode 100644 app-shells/zsh-syntax-highlighting/Manifest
 create mode 100644 app-shells/zsh-syntax-highlighting/metadata.xml
 create mode 100644 app-shells/zsh-syntax-highlighting/zsh-syntax-highlighting-0.7.0_beta1.ebuild

(limited to 'app-shells')

diff --git a/app-shells/Manifest.gz b/app-shells/Manifest.gz
index 01fbc69ef3db..83268eeaaf7e 100644
Binary files a/app-shells/Manifest.gz and b/app-shells/Manifest.gz differ
diff --git a/app-shells/bash/Manifest b/app-shells/bash/Manifest
index c8a4e94684c8..cc0fff6501bc 100644
--- a/app-shells/bash/Manifest
+++ b/app-shells/bash/Manifest
@@ -386,6 +386,11 @@ DIST bash50-008 2622 BLAKE2B 9919e24840f32a44a9040fd8fa9fb482da1859223e70e75d21d
 DIST bash50-009 1095 BLAKE2B 4a9b2035173dd23f9c8ac5474e573080112d9edcf918816b5dd41e880f212f66c2c80dd41793ec62449c487fec1ad2c57b353a00c0976a782098fa6be76d0f23 SHA512 6b770dbd4ca1175f9b958931b1e725d96626a24fb270bac5414d1679dde05276c87654815e9957d6932c515e8792caf8a5f0e9f2dc108bdd041d8024cf75a833
 DIST bash50-010 6407 BLAKE2B 94792141dedbb8d2c9f9355c94eec56b1fa84459291c61ac31e9ee9a67e80edb95234b67ab59c5f3f039d596275c9b154544439bc730256beaf303e6cbf99c4c SHA512 8ca2cea0264bc0401414207fd8752d4d6eda64be3bb10fdc22529fa2bcedb84e6ab257ba2badc7078ece7f2ae1e2964635926f227eea7aed58166e82871322c2
 DIST bash50-011 1870 BLAKE2B 7307aa709810ea3e9fbc0db6a558cb6a660736677edf56904721599be5c0a6e69b74cc01fb3988f1b06e7f8bcce512a3b5d773b7ebb3a7397a0e4815e84f48ce SHA512 05833d6c85f3795a9c100246335f39155c1b5d190e073bf382269c2bbceb13a2de3f85dbe1dd5d4c7824fcca481febe3bdbb4c555e1f2de86bec05fcf6f5871e
+DIST bash50-012 1571 BLAKE2B 3a107454439fa84b1416d0b17b81fd86cfd4cc046bb4c4ca820e09b4595f4bc95dd188f2957b2f2c83937a776eee3db19a7c070403014bfeb5d5778b26705aa1 SHA512 24d67358eec07cc4cd0457ec0c296567558f20bf713b917fc8a8e5095a83f1c5db880bb863d483ca0c9e003972ac5f56596a2eb10c26c82bf6326d0475784e7e
+DIST bash50-013 2328 BLAKE2B 8797fe0b8e01027222af9798ee8d57d161bfbedb617b257e91402ef60e7010dd32fc68e2477487813746842800387c5ea0cdd853e039cf7065a2786fd6d6a182 SHA512 38fff9856c2259fbba607aacee027dd61e8733c6e5f476b7491bc43755fb5a63e82372f9f18663ec81e7480f0738b296271c948e1932e851f68f53cf3a1935b5
+DIST bash50-014 1747 BLAKE2B d52f9160d74b340fd5722725b572ac1abe74caf41add5421dfa56fd44916ead691e4d698de3ba118ff0f8fc8eadade7a980551134eb0daf18b0767ff9601a4b4 SHA512 e8f65be24b425ecaf66672eb4271e0efac2f495f882aeb559d60b52359a468b51852ed7aeeea0ab77cf648a48c9d37f2a00e263d06d29e9fa75b67a648399d91
+DIST bash50-015 2565 BLAKE2B 7df76369726332299c089db156c1e9bc6619fe2e925732da46ca47ca627f1bd7df4ea188a2c0f636e42623f2ee7ca40bc98551b5bd339ed4d5bee20b24ba38d0 SHA512 3a1a552d1f03dec9ed41be8d8c319fb3cbd01df9978ab25a7b37322913014beca6703980f342ea908250b666d72db95402d7b8219ffdd3df717acb36ed4b72b9
+DIST bash50-016 1534 BLAKE2B 8c9bb752a441b70b11655a9bd48e48ec9756a34d0513837faa94c64675c11d57ba1fb0bfc43a033040539f9c475a0efd00f375cf8ffe04a6d9d1d1c19575572e SHA512 dbc3bd0fe3bddad8f6417b210fc5638a9c0c545f9d27638d63bac48aba9d3b93181a4f2e9898584d231b658589573fad5e4627ccbcf3e9d87e7663ac730b51aa
 EBUILD bash-2.05b_p13.ebuild 4604 BLAKE2B 0813fddad287f8ad0424e39ccd0f3155bc312d833856e22123c8454c110022bd0a1c1daa33fd88f39ae936bf04a080e9a54b8cd49342c8f99a851b8ad3e17a0e SHA512 059d1e4464566c9c9785125a8a393184ea0a4445f43c7898fcaab5201b0988b65445812c57a97ce6b0b6a7c1cc65fddc06b001d80915d4c54af4dc6f9124bcfd
 EBUILD bash-3.0_p22.ebuild 4737 BLAKE2B 6ca8a22f0aace907dbf7eb57804c602ed39395198045a94fa31b34c98b3f4b80b7077247dabee7351639043a33f797ea861d7cbbc1f6327805b3bc289d27adf9 SHA512 53aad975e2703a6d0766b2a9399cefb3e031a151df5dc63fbdb648868e86bcab647d818efc0b7f473f4e57bfb83d8758f595dabc41cf8d1209432537bd8e843b
 EBUILD bash-3.1_p23.ebuild 4418 BLAKE2B af3f33a9cb2cdcb95956d2aa7c674411efc12777779ebee5b929f7e74c7deaa894ae799e20451f444d572e382ddd0c863841aa98751779d12329179a8874708f SHA512 e80b15131bcffa55092dfef44172d8514cd8740ae4f4a5814354bc000a318f563833c8c84bcbe88983d02360ed122ff904ad7a3374d70a01b1b9a40e0a14227d
@@ -396,5 +401,5 @@ EBUILD bash-4.2_p53.ebuild 4323 BLAKE2B c228182e505b67d7d598a1b3b707c785302615fa
 EBUILD bash-4.3_p48-r2.ebuild 5621 BLAKE2B 7197e814c59e552720f8c25e634c283c12eaaf18910e25b29deff79ce53031fef0599372f6f6a3380cd98c34a234cae02b9a136053af10f56ab57d67b789a017 SHA512 6959eecb84e85f77e415f16e0df5314f2fa2b0fbef90723de6878e7f5539732a340f119c12a92ff915e3fbce5f7eff20a039ca642fd5d5f963e0b97a0c9e6e83
 EBUILD bash-4.4_p23-r1.ebuild 7368 BLAKE2B 7f070e824465c6868d2c09cbb97b44570be88a52f0930984db2c4cf1b9715e7897e227dfc8ff556c3c995d00b63b9073b7f5c4974bd05ee270ae483c49457aa6 SHA512 a9c6a27d042f003344f05fee3b3c68441dca8fca5ef16df81e118f8905b2ef43aa68f1028e16def30ae32bfb9abb7b28ea495e176b00f7529c14dd058cb436cd
 EBUILD bash-5.0_p11.ebuild 7428 BLAKE2B a912551c6ab6cbcdd504baa74286935b7f83ef31c3db4fe144a93fb3ac24b2cfa057331710b9ab88aa1d9a4cb46b4ea48eaa427ca0c696a880f926ed346dc406 SHA512 36735b4668d3e65cc18db9bdacf7bd3030f7a5629f4876317ddd24f660194dc8ff661587fabdf4da0aa8f30b2bd3d0f355e915cea97aa51f7c67f7b5c698da82
-EBUILD bash-5.0_p9.ebuild 7488 BLAKE2B 1de7e377d32bb1b08699fe8b418f5fbbbf7cf92fa865f2bc14dddc3010fa78b0803aa4dfa489888a812698b5646bcceb4bfdb7951fe647454b6f5cc90cf48b0f SHA512 f63c093db4c160bfe41ff2605d42f4aa184bac33ff6b0d89fb025571c88907bea3a2a5b71486bfac238ca1d842abf93fe671147b68bead2c0f9b5d498a4428d0
+EBUILD bash-5.0_p16.ebuild 7428 BLAKE2B 2ec57c0463ecfcb9a663099f8af5516aab2e36a1236c0510d4b3a85467d7a25d9dd40774501f112538744c29061002dc4a8a37bdb9f2ee305568aa1150411bfd SHA512 3337e6e8927d017fa0a8c71b9e893b34d1e1191b2c7291d0d4314033a3426e729f1478769edb6ba144b174989341e5caec483978758fc49337934ad0b170b670
 MISC metadata.xml 734 BLAKE2B 242fda202379209b74e12c1726c4f4aa487eb09423d2249d13cae38cb9b077a285beff221a824647c826c39f7400178cd04d6082915ad9c23287ea70da9ef961 SHA512 a9301e8d2347e0cf90a97325d9a705076150c00609d28338e5d7d72c135468e4f0531b2a4077b69679ae6ccf89eee691e0e5f0748caab60689f5f017afb544f1
diff --git a/app-shells/bash/bash-5.0_p16.ebuild b/app-shells/bash/bash-5.0_p16.ebuild
new file mode 100644
index 000000000000..dadb54e7e863
--- /dev/null
+++ b/app-shells/bash/bash-5.0_p16.ebuild
@@ -0,0 +1,264 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit flag-o-matic toolchain-funcs multilib prefix
+
+# Official patchlevel
+# See ftp://ftp.cwru.edu/pub/bash/bash-5.0-patches/
+PLEVEL=${PV##*_p}
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
+is_release() {
+	case ${PV} in
+	*_alpha*|*_beta*|*_rc*) return 1 ;;
+	*) return 0 ;;
+	esac
+}
+[[ ${PV} != *_p* ]] && PLEVEL=0
+patches() {
+	local opt=$1 plevel=${2:-${PLEVEL}} pn=${3:-${PN}} pv=${4:-${MY_PV}}
+	[[ ${plevel} -eq 0 ]] && return 1
+	eval set -- {1..${plevel}}
+	set -- $(printf "${pn}${pv/\.}-%03d " "$@")
+	if [[ ${opt} == -s ]] ; then
+		echo "${@/#/${DISTDIR}/}"
+	else
+		local u
+		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
+			printf "${u}/${pn}-${pv}-patches/%s " "$@"
+		done
+	fi
+}
+
+# The version of readline this bash normally ships with.
+READLINE_VER="8.0"
+
+DESCRIPTION="The standard GNU Bourne again shell"
+HOMEPAGE="http://tiswww.case.edu/php/chet/bash/bashtop.html"
+if is_release ; then
+	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
+else
+	SRC_URI="ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
+fi
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="afs bashlogger examples mem-scramble +net nls plugins +readline"
+
+DEPEND="
+	>=sys-libs/ncurses-5.2-r2:0=
+	nls? ( virtual/libintl )
+	readline? ( >=sys-libs/readline-${READLINE_VER}:0= )
+"
+RDEPEND="
+	${DEPEND}
+	!<sys-apps/portage-2.1.6.7_p1
+"
+# we only need yacc when the .y files get patched (bash42-005)
+#DEPEND+=" virtual/yacc"
+
+S="${WORKDIR}/${MY_P}"
+
+PATCHES=(
+	# Patches from Chet sent to bashbug ml
+	"${FILESDIR}"/${PN}-5.0-history-append.patch
+	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+)
+
+pkg_setup() {
+	if is-flag -malign-double ; then #7332
+		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
+		eerror "as it breaks LFS (struct stat64) on x86."
+		die "remove -malign-double from your CFLAGS mr ricer"
+	fi
+	if use bashlogger ; then
+		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
+		ewarn "This will log ALL output you enter into the shell, you have been warned."
+	fi
+}
+
+src_unpack() {
+	unpack ${MY_P}.tar.gz
+}
+
+src_prepare() {
+	# Include official patches
+	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 $(patches -s)
+
+	# Clean out local libs so we know we use system ones w/releases.
+	if is_release ; then
+		rm -rf lib/{readline,termcap}/*
+		touch lib/{readline,termcap}/Makefile.in # for config.status
+		sed -ri -e 's:\$[(](RL|HIST)_LIBSRC[)]/[[:alpha:]]*.h::g' Makefile.in || die
+	fi
+
+	# Prefixify hardcoded path names. No-op for non-prefix.
+	hprefixify pathnames.h.in
+
+	# Avoid regenerating docs after patches #407985
+	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
+	touch -r . doc/*
+
+	eapply -p0 "${PATCHES[@]}"
+	eapply_user
+}
+
+src_configure() {
+	local myconf=(
+		--disable-profiling
+		--docdir='$(datarootdir)'/doc/${PF}
+		--htmldir='$(docdir)/html'
+		--with-curses
+		$(use_enable mem-scramble)
+		$(use_enable net net-redirections)
+		$(use_enable readline)
+		$(use_enable readline bang-history)
+		$(use_enable readline history)
+		$(use_with afs)
+		$(use_with mem-scramble bash-malloc)
+	)
+
+	# For descriptions of these, see config-top.h
+	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	append-cppflags \
+		-DDEFAULT_PATH_VALUE=\'\"${EPREFIX}/usr/local/sbin:${EPREFIX}/usr/local/bin:${EPREFIX}/usr/sbin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/bin\"\' \
+		-DSTANDARD_UTILS_PATH=\'\"${EPREFIX}/bin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/usr/sbin\"\' \
+		-DSYS_BASHRC=\'\"${EPREFIX}/etc/bash/bashrc\"\' \
+		-DSYS_BASH_LOGOUT=\'\"${EPREFIX}/etc/bash/bash_logout\"\' \
+		-DNON_INTERACTIVE_LOGIN_SHELLS \
+		-DSSH_SOURCE_BASHRC \
+		$(use bashlogger && echo -DSYSLOG_HISTORY)
+
+	# Don't even think about building this statically without
+	# reading Bug 7714 first.  If you still build it statically,
+	# don't come crying to us with bugs ;).
+	#use static && export LDFLAGS="${LDFLAGS} -static"
+	use nls || myconf+=( --disable-nls )
+
+	# Historically, we always used the builtin readline, but since
+	# our handling of SONAME upgrades has gotten much more stable
+	# in the PM (and the readline ebuild itself preserves the old
+	# libs during upgrades), linking against the system copy should
+	# be safe.
+	# Exact cached version here doesn't really matter as long as it
+	# is at least what's in the DEPEND up above.
+	export ac_cv_rl_version=${READLINE_VER%%_*}
+
+	# Force linking with system curses ... the bundled termcap lib
+	# sucks bad compared to ncurses.  For the most part, ncurses
+	# is here because readline needs it.  But bash itself calls
+	# ncurses in one or two small places :(.
+
+	if is_release ; then
+		# Use system readline only with released versions.
+		myconf+=( --with-installed-readline=. )
+	fi
+
+	if use plugins; then
+		append-ldflags -Wl,-rpath,/usr/$(get_libdir)/bash
+	else
+		# Disable the plugins logic by hand since bash doesn't
+		# provide a way of doing it.
+		export ac_cv_func_dl{close,open,sym}=no \
+			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
+		sed -i \
+			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
+			configure || die
+	fi
+	tc-export AR #444070
+	econf "${myconf[@]}"
+}
+
+src_compile() {
+	emake
+
+	if use plugins ; then
+		emake -C examples/loadables all others
+	fi
+}
+
+src_install() {
+	local d f
+
+	default
+
+	dodir /bin
+	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	dosym bash /bin/rbash
+
+	insinto /etc/bash
+	doins "${FILESDIR}"/bash_logout
+	doins "$(prefixify_ro "${FILESDIR}"/bashrc)"
+	keepdir /etc/bash/bashrc.d
+	insinto /etc/skel
+	for f in bash{_logout,_profile,rc} ; do
+		newins "${FILESDIR}"/dot-${f} .${f}
+	done
+
+	local sed_args=(
+		-e "s:#${USERLAND}#@::"
+		-e '/#@/d'
+	)
+	if ! use readline ; then
+		sed_args+=( #432338
+			-e '/^shopt -s histappend/s:^:#:'
+			-e 's:use_color=true:use_color=false:'
+		)
+	fi
+	sed -i \
+		"${sed_args[@]}" \
+		"${ED}"/etc/skel/.bashrc \
+		"${ED}"/etc/bash/bashrc || die
+
+	if use plugins ; then
+		exeinto /usr/$(get_libdir)/bash
+		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+		insinto /usr/include/bash-plugins
+		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
+	fi
+
+	if use examples ; then
+		for d in examples/{functions,misc,scripts,startup-files} ; do
+			exeinto /usr/share/doc/${PF}/${d}
+			insinto /usr/share/doc/${PF}/${d}
+			for f in ${d}/* ; do
+				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
+					doexe ${f}
+				else
+					doins ${f}
+				fi
+			done
+		done
+	fi
+
+	doman doc/*.1
+	newdoc CWRU/changelog ChangeLog
+	dosym bash.info /usr/share/info/bashref.info
+}
+
+pkg_preinst() {
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
+		mkdir -p "${EROOT}"/etc/bash
+		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+	fi
+
+	if [[ -L ${EROOT}/bin/sh ]] ; then
+		# rewrite the symlink to ensure that its mtime changes. having /bin/sh
+		# missing even temporarily causes a fatal error with paludis.
+		local target=$(readlink "${EROOT}"/bin/sh)
+		local tmp=$(emktemp "${EROOT}"/bin)
+		ln -sf "${target}" "${tmp}"
+		mv -f "${tmp}" "${EROOT}"/bin/sh
+	fi
+}
+
+pkg_postinst() {
+	# If /bin/sh does not exist, provide it
+	if [[ ! -e ${EROOT}/bin/sh ]] ; then
+		ln -sf bash "${EROOT}"/bin/sh
+	fi
+}
diff --git a/app-shells/bash/bash-5.0_p9.ebuild b/app-shells/bash/bash-5.0_p9.ebuild
deleted file mode 100644
index e112f72e3aa0..000000000000
--- a/app-shells/bash/bash-5.0_p9.ebuild
+++ /dev/null
@@ -1,265 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit flag-o-matic toolchain-funcs multilib prefix
-
-# Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-5.0-patches/
-PLEVEL=${PV##*_p}
-MY_PV=${PV/_p*}
-MY_PV=${MY_PV/_/-}
-MY_P=${PN}-${MY_PV}
-is_release() {
-	case ${PV} in
-	*_alpha*|*_beta*|*_rc*) return 1 ;;
-	*) return 0 ;;
-	esac
-}
-[[ ${PV} != *_p* ]] && PLEVEL=0
-patches() {
-	local opt=$1 plevel=${2:-${PLEVEL}} pn=${3:-${PN}} pv=${4:-${MY_PV}}
-	[[ ${plevel} -eq 0 ]] && return 1
-	eval set -- {1..${plevel}}
-	set -- $(printf "${pn}${pv/\.}-%03d " "$@")
-	if [[ ${opt} == -s ]] ; then
-		echo "${@/#/${DISTDIR}/}"
-	else
-		local u
-		for u in ftp://ftp.cwru.edu/pub/bash mirror://gnu/${pn} ; do
-			printf "${u}/${pn}-${pv}-patches/%s " "$@"
-		done
-	fi
-}
-
-# The version of readline this bash normally ships with.
-READLINE_VER="8.0"
-
-DESCRIPTION="The standard GNU Bourne again shell"
-HOMEPAGE="http://tiswww.case.edu/php/chet/bash/bashtop.html"
-if is_release ; then
-	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz $(patches)"
-else
-	SRC_URI="ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
-fi
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-IUSE="afs bashlogger examples mem-scramble +net nls plugins +readline"
-
-DEPEND="
-	>=sys-libs/ncurses-5.2-r2:0=
-	nls? ( virtual/libintl )
-	readline? ( >=sys-libs/readline-${READLINE_VER}:0= )
-"
-RDEPEND="
-	${DEPEND}
-	!<sys-apps/portage-2.1.6.7_p1
-"
-# we only need yacc when the .y files get patched (bash42-005)
-#DEPEND+=" virtual/yacc"
-
-S="${WORKDIR}/${MY_P}"
-
-PATCHES=(
-	# Patches from Chet sent to bashbug ml
-	"${FILESDIR}"/${PN}-5.0-history-append.patch
-	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
-	"${FILESDIR}"/${PN}-5.0-assignment-preceding-builtin.patch
-)
-
-pkg_setup() {
-	if is-flag -malign-double ; then #7332
-		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
-		eerror "as it breaks LFS (struct stat64) on x86."
-		die "remove -malign-double from your CFLAGS mr ricer"
-	fi
-	if use bashlogger ; then
-		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
-		ewarn "This will log ALL output you enter into the shell, you have been warned."
-	fi
-}
-
-src_unpack() {
-	unpack ${MY_P}.tar.gz
-}
-
-src_prepare() {
-	# Include official patches
-	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 $(patches -s)
-
-	# Clean out local libs so we know we use system ones w/releases.
-	if is_release ; then
-		rm -rf lib/{readline,termcap}/*
-		touch lib/{readline,termcap}/Makefile.in # for config.status
-		sed -ri -e 's:\$[(](RL|HIST)_LIBSRC[)]/[[:alpha:]]*.h::g' Makefile.in || die
-	fi
-
-	# Prefixify hardcoded path names. No-op for non-prefix.
-	hprefixify pathnames.h.in
-
-	# Avoid regenerating docs after patches #407985
-	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
-	touch -r . doc/*
-
-	eapply -p0 "${PATCHES[@]}"
-	eapply_user
-}
-
-src_configure() {
-	local myconf=(
-		--disable-profiling
-		--docdir='$(datarootdir)'/doc/${PF}
-		--htmldir='$(docdir)/html'
-		--with-curses
-		$(use_enable mem-scramble)
-		$(use_enable net net-redirections)
-		$(use_enable readline)
-		$(use_enable readline bang-history)
-		$(use_enable readline history)
-		$(use_with afs)
-		$(use_with mem-scramble bash-malloc)
-	)
-
-	# For descriptions of these, see config-top.h
-	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
-	append-cppflags \
-		-DDEFAULT_PATH_VALUE=\'\"${EPREFIX}/usr/local/sbin:${EPREFIX}/usr/local/bin:${EPREFIX}/usr/sbin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/bin\"\' \
-		-DSTANDARD_UTILS_PATH=\'\"${EPREFIX}/bin:${EPREFIX}/usr/bin:${EPREFIX}/sbin:${EPREFIX}/usr/sbin\"\' \
-		-DSYS_BASHRC=\'\"${EPREFIX}/etc/bash/bashrc\"\' \
-		-DSYS_BASH_LOGOUT=\'\"${EPREFIX}/etc/bash/bash_logout\"\' \
-		-DNON_INTERACTIVE_LOGIN_SHELLS \
-		-DSSH_SOURCE_BASHRC \
-		$(use bashlogger && echo -DSYSLOG_HISTORY)
-
-	# Don't even think about building this statically without
-	# reading Bug 7714 first.  If you still build it statically,
-	# don't come crying to us with bugs ;).
-	#use static && export LDFLAGS="${LDFLAGS} -static"
-	use nls || myconf+=( --disable-nls )
-
-	# Historically, we always used the builtin readline, but since
-	# our handling of SONAME upgrades has gotten much more stable
-	# in the PM (and the readline ebuild itself preserves the old
-	# libs during upgrades), linking against the system copy should
-	# be safe.
-	# Exact cached version here doesn't really matter as long as it
-	# is at least what's in the DEPEND up above.
-	export ac_cv_rl_version=${READLINE_VER%%_*}
-
-	# Force linking with system curses ... the bundled termcap lib
-	# sucks bad compared to ncurses.  For the most part, ncurses
-	# is here because readline needs it.  But bash itself calls
-	# ncurses in one or two small places :(.
-
-	if is_release ; then
-		# Use system readline only with released versions.
-		myconf+=( --with-installed-readline=. )
-	fi
-
-	if use plugins; then
-		append-ldflags -Wl,-rpath,/usr/$(get_libdir)/bash
-	else
-		# Disable the plugins logic by hand since bash doesn't
-		# provide a way of doing it.
-		export ac_cv_func_dl{close,open,sym}=no \
-			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
-		sed -i \
-			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
-			configure || die
-	fi
-	tc-export AR #444070
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake
-
-	if use plugins ; then
-		emake -C examples/loadables all others
-	fi
-}
-
-src_install() {
-	local d f
-
-	default
-
-	dodir /bin
-	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
-	dosym bash /bin/rbash
-
-	insinto /etc/bash
-	doins "${FILESDIR}"/bash_logout
-	doins "$(prefixify_ro "${FILESDIR}"/bashrc)"
-	keepdir /etc/bash/bashrc.d
-	insinto /etc/skel
-	for f in bash{_logout,_profile,rc} ; do
-		newins "${FILESDIR}"/dot-${f} .${f}
-	done
-
-	local sed_args=(
-		-e "s:#${USERLAND}#@::"
-		-e '/#@/d'
-	)
-	if ! use readline ; then
-		sed_args+=( #432338
-			-e '/^shopt -s histappend/s:^:#:'
-			-e 's:use_color=true:use_color=false:'
-		)
-	fi
-	sed -i \
-		"${sed_args[@]}" \
-		"${ED}"/etc/skel/.bashrc \
-		"${ED}"/etc/bash/bashrc || die
-
-	if use plugins ; then
-		exeinto /usr/$(get_libdir)/bash
-		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
-		insinto /usr/include/bash-plugins
-		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
-	fi
-
-	if use examples ; then
-		for d in examples/{functions,misc,scripts,startup-files} ; do
-			exeinto /usr/share/doc/${PF}/${d}
-			insinto /usr/share/doc/${PF}/${d}
-			for f in ${d}/* ; do
-				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
-					doexe ${f}
-				else
-					doins ${f}
-				fi
-			done
-		done
-	fi
-
-	doman doc/*.1
-	newdoc CWRU/changelog ChangeLog
-	dosym bash.info /usr/share/info/bashref.info
-}
-
-pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
-		mkdir -p "${EROOT}"/etc/bash
-		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
-	fi
-
-	if [[ -L ${EROOT}/bin/sh ]] ; then
-		# rewrite the symlink to ensure that its mtime changes. having /bin/sh
-		# missing even temporarily causes a fatal error with paludis.
-		local target=$(readlink "${EROOT}"/bin/sh)
-		local tmp=$(emktemp "${EROOT}"/bin)
-		ln -sf "${target}" "${tmp}"
-		mv -f "${tmp}" "${EROOT}"/bin/sh
-	fi
-}
-
-pkg_postinst() {
-	# If /bin/sh does not exist, provide it
-	if [[ ! -e ${EROOT}/bin/sh ]] ; then
-		ln -sf bash "${EROOT}"/bin/sh
-	fi
-}
diff --git a/app-shells/fish/Manifest b/app-shells/fish/Manifest
index 5880bf59cc53..efd1e8f2513e 100644
--- a/app-shells/fish/Manifest
+++ b/app-shells/fish/Manifest
@@ -4,6 +4,6 @@ AUX fix-histfile-test-on-ppc.patch 1068 BLAKE2B fa407d7f5d02f061a3ca9d79bdf09ae6
 DIST fish-2.7.1.tar.gz 5760550 BLAKE2B 71568a3a17f4222b05a314464a61fceb241409a7d42c46249486ca742ef0cf990c46d693bcc22521c18f58a558e6aab35759d0da6eb62ee6611a2a7946fe714d SHA512 45ee3453404c5d6c56d307b4cd19197de862f9f42d7fa06461acec56dea7146db5675cf6419dd5f72e939b3e4b1955d3761098df1de89a8cebe47645eb6f7a4b
 DIST fish-3.0.2.tar.gz 6477869 BLAKE2B fedc8bd5fd6d7856b695207ce9ac7a5a47f0e3c211d2aa2151a7a3c1bd944b3cf5c86ddf8b6e4c4d3499bb72d4ede64886706e05a44786d70c665b4ffb85369f SHA512 cd4a8e6a0d7770ef17e92d3d20ea23e754b9fa53e5ee5459ab5838fcbbcac69544ca2f83551e93a004b140cc14ec556860a711ce216197753c1704901518c9c3
 EBUILD fish-2.7.1.ebuild 2446 BLAKE2B e3ef925138c3db3412cd276dbaa374e3073beca1371c7f3b26be53b4ceb62fd603b0574c888aea9949c195c0f1c3ae540096aab951cc4dba30b03771161aa847 SHA512 179f0ae63b1ca6694bc579fa93a1bdc86f1e7aface1ea98e6fe1a6c08fe0ff460e6599cc0d0e496a9b02aea271bdc2f416c9fc0e2c2f6d3e805c7246141b804b
-EBUILD fish-3.0.2.ebuild 1636 BLAKE2B c6596d235523292dc48628cd49233cdeaa2e1a515dbee4670daa8c3113e079a106d8e57ec368fa5b080816232322dc622d188e328836aec6b7ab0f809ee95098 SHA512 4844329691943c21fcde1024b259dfb4316db8512f9537bcf0610bf6a34ddaa76dd9fe25773849f05db82c77dd9d623ec32fb399b7339f37ddeedd0f51fc92e0
+EBUILD fish-3.0.2.ebuild 1642 BLAKE2B eea0911019da09f2690aa0767c43cb463ef5ea18fe53f0e6b31e8e138e2b8335aca207a0ec2ed527e46c841824634533cc16360226a3cd8a17ad94db536386ef SHA512 6261192db56af260ab3c86f2ae650cc23c89a00267fa11dc9d1a6efe6811ba63c894fda64031efdc7a5b7e05bb88ad3915ffa12e0268724628483ea31e8bf468
 EBUILD fish-9999.ebuild 1545 BLAKE2B fd23d23d813a9f9ca5309a2cf60e3b275b746e76a13cc27fc9ba4c5fa0df7a6fd60fe1f25d44ee79d842cc850df74d6992a4aaf10c9dde8af95dc9e454d37563 SHA512 41e8f5fddf53c6cbb43097a4cff062474d89e575b8923f706ac98b32916c7856ebee2b220adaa5684a3992b2c55cc53c10de3f09869c49218289c6d91a4346ca
 MISC metadata.xml 739 BLAKE2B 4ab30ae3cb92888979e23f8e6d59e6d09596e945bd683d58d34017f87e080c486eeebda42bd7a346522e4db072b55ad2db5a68d13738cb4ac2aeddeae84c777a SHA512 1c9a1ed56437553376f32f030a2bd50259a3bebc27eb05b288c68769ebda80cbafc54b75d1d1345a4675c9a79bf4a0ed02d94f2e32bfcdc2aa7d171a42570d97
diff --git a/app-shells/fish/fish-3.0.2.ebuild b/app-shells/fish/fish-3.0.2.ebuild
index 3a16d56f7c07..4d88d4b1e94b 100644
--- a/app-shells/fish/fish-3.0.2.ebuild
+++ b/app-shells/fish/fish-3.0.2.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -16,7 +16,7 @@ if [[ ${PV} == "9999" ]]; then
 	EGIT_REPO_URI="https://github.com/${PN}-shell/${PN}-shell.git"
 else
 	SRC_URI="https://github.com/${PN}-shell/${PN}-shell/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="amd64 arm arm64 ppc ppc64 x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x86-solaris"
+	KEYWORDS="amd64 arm arm64 ~hppa ppc ppc64 x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~x86-solaris"
 fi
 
 LICENSE="GPL-2"
diff --git a/app-shells/gentoo-bashcomp/Manifest b/app-shells/gentoo-bashcomp/Manifest
index 33da7df03456..aae68493ba8b 100644
--- a/app-shells/gentoo-bashcomp/Manifest
+++ b/app-shells/gentoo-bashcomp/Manifest
@@ -1,5 +1,5 @@
 DIST gentoo-bashcomp-20180302.tar.bz2 21485 BLAKE2B 887ac5cfa8c6ba431a6aa5f5918b8bdfbe6a1ae9a2e7ac21b3c06ec2062b448d924f928b1372e81749ece6d4aa673bbbaaa364ca744124c842e3819349917169 SHA512 6b4551b078505e6348cb10ca2d67faab4d323a0f0ddefc872145314303d6f95fe31f9706d43d9f20c0139610ce47e4cf70ba7516d911dc4927cfbf5d863bc063
 DIST gentoo-bashcomp-20190211.tar.bz2 21508 BLAKE2B 410994819f62b0bd105ca398c335d76993fd694b8e7f56c761b94fc1e2f6e90f2010f2f2a88febd71ac0c5643fc0e923c60151fbf9411e8a553b5917d6bcd8db SHA512 4b0a5e79f90ee8122fa8d0a7224fee6472b1762a0dda680ea1c0e8d4069760be9b6472e052b1b166a389c0e779816b98715386dbc62a3574e7ad851b2567a070
-EBUILD gentoo-bashcomp-20180302.ebuild 733 BLAKE2B 456fbabf34865e1abf3a9562c71c2c3d21183f58f0ea0e6a27cb099573ca88c573e58be9d8fe4a2daf19838ff7ea2e2c0701339b65d7e485c9722684c7991397 SHA512 d5fe6776fc097ab63162600e03d4b47aed37bc6b6d709c06b2747e90e1e67e718767c8606ad972745cbeb6636b26af9d56acf0a8c6beb64700c17a6b6b617480
-EBUILD gentoo-bashcomp-20190211.ebuild 731 BLAKE2B debd7174305a45a66434f640309ed73552b3c2de71a235a0395bfaa96faa9f18cb2226d5ab3b9fb39dae3ee3bc9d7297979c921058e4a05accafd799d0f80557 SHA512 088797a6a93da38333d2702e82c8e868793dd2d6b08ea17966b54d7eeb1504c6d3e6595433d9ba1c8ac790a278cb61afc6db429137cbdb47e1974eea9b755d38
+EBUILD gentoo-bashcomp-20180302.ebuild 750 BLAKE2B add404bd23f06ab6ba580f829d39d3f539a9539cd1448aa07e795b5b374e9a66e0b823c0aed31f07d98c485d324dc0be4bbc7917128c6bbc511fb8ef1e556348 SHA512 8275afdf9b16f34c3ba17c189546fb6022a897cfc5c05eda9ce867cfd29c287b93339de595f082480af5ba4f99513e0a140bc1efe38775c402d1275196d4a1c7
+EBUILD gentoo-bashcomp-20190211.ebuild 748 BLAKE2B c60b95f875ffbb2becd17afc634e9ab2cf32572d94bb2a4e9be047702f22a7f4de50ca8c2075d4f281ccc49d2f24796167b7a9d3d34b2929895add9288684968 SHA512 1ddbb88dff3ecdc1a318a6b3f2e74b2b11c4c3bf77d636c237b87172d95615f4d6cf08cea8a0b0f32ce678bd3ce32d76c94ea38427a612de9fddae621551d762
 MISC metadata.xml 265 BLAKE2B 75452ad720a31a08fc0dcd02eec704c18b11bc0660686f9a320b85fc879f55a564ce9c3b6a8c710781b74c5e8eb3d0544c02a042fb35a0b62a5e1491f675296a SHA512 176f814d8c555e8726f36e012367b698e8a19a0662982621029a7f9190beecc5e6798e43c51698dc149364966cdeff7061121e54fa9d4cf2a3559a6ce4904e25
diff --git a/app-shells/gentoo-bashcomp/gentoo-bashcomp-20180302.ebuild b/app-shells/gentoo-bashcomp/gentoo-bashcomp-20180302.ebuild
index 7dd04476f8d2..049875ede2c9 100644
--- a/app-shells/gentoo-bashcomp/gentoo-bashcomp-20180302.ebuild
+++ b/app-shells/gentoo-bashcomp/gentoo-bashcomp-20180302.ebuild
@@ -6,7 +6,7 @@ EAPI=6
 inherit bash-completion-r1
 
 DESCRIPTION="Gentoo-specific bash command-line completions (emerge, ebuild, equery, etc)"
-HOMEPAGE="https://www.gentoo.org/"
+HOMEPAGE="https://wiki.gentoo.org/wiki/No_homepage"
 SRC_URI="https://gitweb.gentoo.org/proj/${PN}.git/snapshot/${P}.tar.bz2"
 
 LICENSE="GPL-2"
diff --git a/app-shells/gentoo-bashcomp/gentoo-bashcomp-20190211.ebuild b/app-shells/gentoo-bashcomp/gentoo-bashcomp-20190211.ebuild
index 7e03f0ec3362..eb66ceedc060 100644
--- a/app-shells/gentoo-bashcomp/gentoo-bashcomp-20190211.ebuild
+++ b/app-shells/gentoo-bashcomp/gentoo-bashcomp-20190211.ebuild
@@ -6,7 +6,7 @@ EAPI=6
 inherit bash-completion-r1
 
 DESCRIPTION="Gentoo-specific bash command-line completions (emerge, ebuild, equery, etc)"
-HOMEPAGE="https://www.gentoo.org/"
+HOMEPAGE="https://wiki.gentoo.org/wiki/No_homepage"
 SRC_URI="https://gitweb.gentoo.org/proj/${PN}.git/snapshot/${P}.tar.bz2"
 
 LICENSE="GPL-2"
diff --git a/app-shells/ksh/Manifest b/app-shells/ksh/Manifest
index 8b775bc28c1d..69c06c4e0daf 100644
--- a/app-shells/ksh/Manifest
+++ b/app-shells/ksh/Manifest
@@ -1,6 +1,7 @@
+AUX CVE-2019-14868.patch 3746 BLAKE2B 0be6843120195f876631e92205430f8a389d23c6c9f85b72b4fd7b646551ede464eebaa28db1988a0b831642ab7d3c0e633cdfe28f5279ab29f69aa3bb6bb755 SHA512 ad21464b95ff69b0d8a54f54eee11d638738ba79a87fc5834d409af2d183e5a68e706b3f5df49223dd784e634de353335689981228c7ca57edf94794434d6ea9
 AUX ksh-2020.0.0-ensure-user-set.patch 1017 BLAKE2B 8a0d9fd9fd8940969741214f6ba9251ae1b404bae80385d79428ab7231a5809bafcaa5033084af0582872171666e89b590b7c2cfba1ded740da49c77b1751888 SHA512 bea76ef4350d2813395bbfaa682b97a34548292efe9986a1d63dde2476bbfbfd21dc9b10ccb7ac3bcf33e9aeb3c0eebdcffb22a3b6472302597473ac994b2493
 AUX ksh-2020.0.0-skip-api-test.patch 1394 BLAKE2B bcf521012bb197d234b119dc56ddc068f8ec3e46b6f4c6d82e1043629368bfcabd1a5d360bae702777e5b01914ac70c9edbdce5ee0bba7e9f69916a3c38b1820 SHA512 e4314599821b3f654b4c87900aa696930953a96b984f43ca00fd17aa91b968ed8f277944c6736ebddae4ee7086e9806f84e3432b24450565d1c679bdbb39e01a
 DIST ksh-2020.0.0.tar.gz 2022880 BLAKE2B cb952c4febe88a3ccf8fd48f511a30a73bfc812ebf0b7a5fe799470b29ee13ca61004fd34e367d836940a88214da2aa05b7cb96f173a1b8d57c8e644c8c3a2a6 SHA512 7d6da3af341a62718d691ddc52e10bdf3b7290d74f1cd01610093c587af47b6d6d04b74b210eb31f93a3559855a5bc5155f9b188d2f8bb4444042c26bfaf1792
-EBUILD ksh-2020.0.0.ebuild 1087 BLAKE2B d4de3298e870b57abfd03b24e8bd7c40d166749452317ca52fde421634e6ba6ead52b3e736df297b04f8e6575735df0cbf0ff620e473a942abf6c61af51660a9 SHA512 69440a0266c563586fce52171e986b742ff40abcf9089b3a9f3b8307a221f5d0f9d0f5b944ada20216a404d99d86998b9d02045d78af4b61142f863e5ec63d2a
+EBUILD ksh-2020.0.0-r1.ebuild 1123 BLAKE2B a1ca7574835877a1354c39ccb6c65c4ae4aba7f7bfdd3c198b641f97174841a46bd6a3dc931808418ff0fa2a93e16d2a9fc11774f1b7d4c24b7f3899a2d6c4ff SHA512 1dc0af0d3469c8a9d106880d7b8e21c6bc48e6629965de6e53880bdca308e63f93bf610775592795c5d5caa844a9083fe8f4ba5fadb03ecb93bb3fb3095a6e0c
 EBUILD ksh-9999.ebuild 976 BLAKE2B 4807cd3805a2f7f05a726019c707c6fe0106b636f0d221f31dd08b62b249df4815cb4bf6c5b0309863e2916a919c53aabcbe4c8efe3e8218655f2078cbb03361 SHA512 09f6498596ea5cf1c9a49eec1d8572a30b27649b0aa3a1eda99eaff959279627db59fd3a694a5929e8075dc2e641bfa65442a1a4819b9f1af5ca174d91bb5fb5
 MISC metadata.xml 1371 BLAKE2B ab655b6d15894748f8125dcc0d25fd15aee57623de8b643793b1ca456025ee35db091b500f91b59ca0801778eb65798162b732778c56b80adff4f0402b299638 SHA512 b74fe4a12ce5868839cd32fe9c4f88c216a0703a3f477b005dcf7b47f697d129c695a011a9b37894c39716b5d47ddc9abeb5bd4946ba6b6849707a73b5901810
diff --git a/app-shells/ksh/files/CVE-2019-14868.patch b/app-shells/ksh/files/CVE-2019-14868.patch
new file mode 100644
index 000000000000..d5c80566bafc
--- /dev/null
+++ b/app-shells/ksh/files/CVE-2019-14868.patch
@@ -0,0 +1,89 @@
+From c7de8b641266bac7c77942239ac659edfee9ecd2 Mon Sep 17 00:00:00 2001
+From: Kurtis Rader <krader@skepticism.us>
+Date: Thu, 12 Dec 2019 18:46:50 -0800
+Subject: [PATCH] Harden env var imports
+
+---
+ src/cmd/ksh93/sh/arith.c        | 37 ++++++++++++++++++++++-----------
+ src/cmd/ksh93/tests/subshell.sh | 23 ++++++++++++++++++++
+
+diff --git a/src/cmd/ksh93/sh/arith.c b/src/cmd/ksh93/sh/arith.c
+index 30b3067590a2..8e68cbdc868a 100644
+--- a/src/cmd/ksh93/sh/arith.c
++++ b/src/cmd/ksh93/sh/arith.c
+@@ -567,19 +567,32 @@ Sfdouble_t sh_strnum(Shell_t *shp, const char *str, char **ptr, int mode) {
+     char *last;
+ 
+     if (*str == 0) {
+-        if (ptr) *ptr = (char *)str;
+-        return 0;
+-    }
+-    errno = 0;
+-    d = number(str, &last, shp->inarith ? 0 : 10, NULL);
+-    if (*last) {
+-        if (*last != '.' || last[1] != '.') {
+-            d = strval(shp, str, &last, arith, mode);
+-            Varsubscript = true;
++        d = 0.0;
++        last = (char *)str;
++    } else {
++        d = number(str, &last, shp->inarith ? 0 : 10, NULL);
++        if (*last && !shp->inarith && sh_isstate(shp, SH_INIT)) {
++            // This call is to handle "base#value" literals if we're importing untrusted env vars.
++            d = number(str, &last, 0, NULL);
++        }
++        if (*last) {
++            if (sh_isstate(shp, SH_INIT)) {
++                // Initializing means importing untrusted env vars. Since the string does not appear
++                // to be a recognized numeric literal give up. We can't safely call strval() since
++                // that allows arbitrary expressions which would create a security vulnerability.
++                d = 0.0;
++            } else {
++                if (*last != '.' || last[1] != '.') {
++                    d = strval(shp, str, &last, arith, mode);
++                    Varsubscript = true;
++                }
++                if (!ptr && *last && mode > 0) {
++                    errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
++                }
++            }
++        } else if (d == 0.0 && *str == '-') {
++            d = -0.0;
+         }
+-        if (!ptr && *last && mode > 0) errormsg(SH_DICT, ERROR_exit(1), e_lexbadchar, *last, str);
+-    } else if (!d && *str == '-') {
+-        d = -0.0;
+     }
+     if (ptr) *ptr = last;
+     return d;
+diff --git a/src/cmd/ksh93/tests/subshell.sh b/src/cmd/ksh93/tests/subshell.sh
+index b63a8051ed5c..3faba475d6de 100644
+--- a/src/cmd/ksh93/tests/subshell.sh
++++ b/src/cmd/ksh93/tests/subshell.sh
+@@ -856,3 +856,26 @@ for exp in 65535 65536
+ do    got=$($SHELL -c 'x=$(printf "%.*c" '$exp' x); print ${#x}' 2>&1)
+     [[ $got == $exp ]] || log_error "large command substitution failed" "$exp" "$got"
+ done
++
++# ==========
++# Verify that importing untrusted env vars does not allow evaluating arbitrary expressions but does
++# recognize all integer literals recognized by ksh.
++expect=8
++actual=$(env SHLVL='7' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "decimal int literal not recognized" "$expect" "$actual"
++
++expect=14
++actual=$(env SHLVL='013' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "leading zeros int literal not recognized" "$expect" "$actual"
++
++expect=4
++actual=$(env SHLVL='2#11' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=12
++actual=$(env SHLVL='16#B' $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "base#value int literal not recognized" "$expect" "$actual"
++
++expect=1
++actual=$(env SHLVL="2#11+x[\$($bin_echo DANGER WILL ROBINSON >&2)0]" $SHELL -c 'echo $SHLVL')
++[[ $actual == $expect ]] || log_error "expression allowed on env var import" "$expect" "$actual"
diff --git a/app-shells/ksh/ksh-2020.0.0-r1.ebuild b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
new file mode 100644
index 000000000000..3c4891ea637e
--- /dev/null
+++ b/app-shells/ksh/ksh-2020.0.0-r1.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/att/ast"
+else
+	KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~s390 ~sparc ~x86"
+	MY_PV="${PV/_/-}"
+	MY_P="${PN}-${MY_PV}"
+	SRC_URI="https://github.com/att/ast/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+DESCRIPTION="The Original Korn Shell, 1993 revision (ksh93)"
+HOMEPAGE="https://github.com/att/ast"
+
+LICENSE="CPL-1.0 EPL-1.0"
+SLOT="0"
+
+RDEPEND="!app-shells/pdksh"
+
+PATCHES=(
+	"${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch
+	"${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch
+	"${FILESDIR}"/CVE-2019-14868.patch
+)
+
+src_test() {
+	# https://bugs.gentoo.org/702570
+	addwrite /proc/self
+	local cmd=(
+		meson test
+		-C "${BUILD_DIR}"
+		--num-processes "$(makeopts_jobs ${NINJAOPTS:-${MAKEOPTS}})"
+	)
+	echo "${cmd[@]}" >&2
+	# https://github.com/att/ast/issues/1392
+	env -u T "${cmd[@]}" || die
+}
+
+src_install() {
+	meson_src_install
+	dodir /bin
+	mv "${ED}/usr/bin/ksh" "${ED}/bin/ksh" || die
+}
diff --git a/app-shells/ksh/ksh-2020.0.0.ebuild b/app-shells/ksh/ksh-2020.0.0.ebuild
deleted file mode 100644
index 6b40cd312997..000000000000
--- a/app-shells/ksh/ksh-2020.0.0.ebuild
+++ /dev/null
@@ -1,49 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit meson
-
-if [[ ${PV} == 9999 ]]; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/att/ast"
-else
-	KEYWORDS="~alpha ~amd64 ~arm ~ia64 ~ppc ~ppc64 ~s390 ~sparc ~x86"
-	MY_PV="${PV/_/-}"
-	MY_P="${PN}-${MY_PV}"
-	SRC_URI="https://github.com/att/ast/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	S="${WORKDIR}/${MY_P}"
-fi
-
-DESCRIPTION="The Original Korn Shell, 1993 revision (ksh93)"
-HOMEPAGE="https://github.com/att/ast"
-
-LICENSE="CPL-1.0 EPL-1.0"
-SLOT="0"
-
-RDEPEND="!app-shells/pdksh"
-
-PATCHES=(
-	"${FILESDIR}"/ksh-2020.0.0-ensure-user-set.patch
-	"${FILESDIR}"/ksh-2020.0.0-skip-api-test.patch
-)
-
-src_test() {
-	# https://bugs.gentoo.org/702570
-	addwrite /proc/self
-	local cmd=(
-		meson test
-		-C "${BUILD_DIR}"
-		--num-processes "$(makeopts_jobs ${NINJAOPTS:-${MAKEOPTS}})"
-	)
-	echo "${cmd[@]}" >&2
-	# https://github.com/att/ast/issues/1392
-	env -u T "${cmd[@]}" || die
-}
-
-src_install() {
-	meson_src_install
-	dodir /bin
-	mv "${ED}/usr/bin/ksh" "${ED}/bin/ksh" || die
-}
diff --git a/app-shells/zsh-syntax-highlighting/Manifest b/app-shells/zsh-syntax-highlighting/Manifest
new file mode 100644
index 000000000000..afd63a49bc94
--- /dev/null
+++ b/app-shells/zsh-syntax-highlighting/Manifest
@@ -0,0 +1,3 @@
+DIST zsh-syntax-highlighting-0.7.0_beta1.tar.gz 130063 BLAKE2B cf0f6319af22b47cb8a280de682a69b0479dc59033be5ce84840507b77dd2df0441b8d260af55bccb303c87d7f5a7e4cc6db9f46860aee040b4b8115c76f5e07 SHA512 1692015aad58103c752e2dd4161ea87f26aaa09d34eb2faec1f651fea1d9bfad29226455468017160a5393a87c1f7ed0514b09b0802b1810377beef72bfa6c87
+EBUILD zsh-syntax-highlighting-0.7.0_beta1.ebuild 1001 BLAKE2B c57f7c1481dfddccf9757faf2956563382bd43b32faceb7edaa47feb228c331064a664c4177e9cfac0066cbecef42b5b43ffc7fd9bdd7bb9d0ad4a30e4c1462b SHA512 37a1966be8434416fbd1a3a992a0cc3b0dc1a49293763b63a9f009060372208275f44c70304ecf707f002248bb5a41541680089a782a92f86506111074a9aace
+MISC metadata.xml 243 BLAKE2B f7576f14be2c0aa21ca2c7147133e4a4132d6559cca1519745dd2f4ea912b3856950c7645e13d2317f38c80ba93b13d47370260920241a5ab60a4eae59f2cf33 SHA512 0dc1f228861badffd9c4175af734b72435dc7c60d369a3d9ff946c5b98b3f2f49af7d433f7ec5fc2afee7015b8f75259e8debe150b1bcffa0cb66425bed10d8d
diff --git a/app-shells/zsh-syntax-highlighting/metadata.xml b/app-shells/zsh-syntax-highlighting/metadata.xml
new file mode 100644
index 000000000000..203fa55c746f
--- /dev/null
+++ b/app-shells/zsh-syntax-highlighting/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+	<email>zlogene@gentoo.org</email>
+	<name>Mikle Kolyada</name>
+</maintainer>
+</pkgmetadata>
diff --git a/app-shells/zsh-syntax-highlighting/zsh-syntax-highlighting-0.7.0_beta1.ebuild b/app-shells/zsh-syntax-highlighting/zsh-syntax-highlighting-0.7.0_beta1.ebuild
new file mode 100644
index 000000000000..8ca8ffb2e2b8
--- /dev/null
+++ b/app-shells/zsh-syntax-highlighting/zsh-syntax-highlighting-0.7.0_beta1.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit readme.gentoo-r1
+
+if [[ -z ${PV%%*9999} ]]; then
+	EGIT_REPO_URI="https://github.com/zsh-users/${PN}.git"
+	inherit git-r3
+else
+	MY_PV=$(ver_rs 3 -)
+	SRC_URI="https://github.com/zsh-users/zsh-syntax-highlighting/archive/${MY_PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~amd64 ~x86"
+	S="${WORKDIR}/${PN}-${MY_PV}"
+fi
+
+DESCRIPTION="Fish shell like syntax highlighting for zsh"
+HOMEPAGE="https://github.com/zsh-users/zsh-syntax-highlighting"
+
+LICENSE="BSD"
+SLOT="0"
+
+RDEPEND="app-shells/zsh"
+
+DISABLE_AUTOFORMATTING="true"
+DOC_CONTENTS="In order to use ${CATEGORY}/${PN} add
+. /usr/share/zsh/site-functions/zsh-syntax-highlighting.zsh
+at the end of your ~/.zshrc"
+
+src_prepare() {
+	sed -i -e 's/COPYING.md//' Makefile || die
+	default
+}
+
+src_install() {
+	emake \
+		SHARE_DIR="${ED}/usr/share/zsh/site-functions" \
+		DOC_DIR="${ED}/usr/share/doc/${PF}" \
+		install
+	readme.gentoo_create_doc
+}
-- 
cgit v1.2.3