gentoo auto-resync : 06:02:2025 - 00:10:59

13 files changed, 1226 insertions, 4 deletions

diff --git a/dev-libs/Manifest.gz b/dev-libs/Manifest.gz
index 7cd7206d64f0..3ade3b23d2d6 100644
--- a/dev-libs/Manifest.gz
+++ b/dev-libs/Manifest.gz
diff --git a/dev-libs/botan/Manifest b/dev-libs/botan/Manifest
index f3f18eb13918..84d0439bfe63 100644
--- a/dev-libs/botan/Manifest
+++ b/dev-libs/botan/Manifest
@@ -15,10 +15,13 @@ DIST Botan-3.2.0.tar.xz 8998204 BLAKE2B f21e7574af93ab3331607f4a4ecf1b2cbbc0db4b
 DIST Botan-3.2.0.tar.xz.asc 488 BLAKE2B f7bc716dd18eedf35928933e22c75de3d2731330dfdaf8a5048e8ad86e1f3896ea55294a64b7f82593af16dd2e4097a9ba68f25baa024e175b7334478bcf84a6 SHA512 3ee42ac73e1bd6cea0a2e9f468b88d67c02a4a69786c41ddf9fc7f94b6847be00e0f3f0f38f934ab599b8d6dd29006414294df8b371f5cf2422292f3dd176756
 DIST Botan-3.6.1.tar.xz 7581864 BLAKE2B 744eed158e021d26b9414b3a098e017e6e2c2160fc7fb6a0f24f6cbbb4b08501157108dedd7a71fc3645e27c86608a9ba5d18a11087adfd1c9b174ca3ce85b30 SHA512 06327c55bee5e0d2e142f81b997dd8a1ef98f61ef920b57f6eb4e80ebf6b3de1c62373b889d4a32e62509495792e0b46d5dcc82a6446266974b4d4ead8d9f287
 DIST Botan-3.6.1.tar.xz.asc 488 BLAKE2B 3538c941f707a182f86226dfdbb8222570671e0bce3ca61137a5d978c2b1f5e658ffc1168d7e73a1861210adfac8aa661124c9cbc4950973f7b1e2c3360aab90 SHA512 871c6d91368d8a080e704afb53b1339c6d06aa57aaa45f260bccf1cb1ed31c635587ba930f954ab55668a7ca13b89b2f2acba3c0f1723e3f7190c6ebe9dc2e0b
+DIST Botan-3.7.1.tar.xz 8659408 BLAKE2B 3cd934bc738c0665c4a5b3ea4391402058ade2159a185ee257aa2746ef8aa29e59873fd0a95dbdf978ce950bab6c25a72975d73b5d17da898cb16bc04ae7b8ba SHA512 f9b5d793642e9f9e9f444de3a0851840b4ed1f5f82804ad60bb5ede62c5a90ea05cb41e8aefcf556caa15da1aaa78ba1fcb040df3365705e3fd9c6a12788b72e
+DIST Botan-3.7.1.tar.xz.asc 488 BLAKE2B 6f00bf01f0f02e8cefd926e4b5f70feb8e689ef9286684e45c5d1139a686af649bf44950e7bfc6a9c881d1d233c1ab5d10ee0815e8119e0ffdc89ec62ec5089c SHA512 a3fc9958e606b0bc073287dc45cb4e2143ff3399a8891a4d51a0c25052d9eb395d97bd31eb97b13344a27186e32906a6411927211345f3ae06464acb73eaa3b6
 EBUILD botan-2.19.3-r2.ebuild 5084 BLAKE2B 4e38d5f419f00e83691cc0eabf70679ef9c2b3ca6583de89bdd629ff047b7ed2fb42e8a577b4352bd5702925de8df0c4c1694562d2fa7b37a3599e13af276da9 SHA512 018dc521bc66d71373865307debdf1bd556b8c663fde27a8e2abb1ab96ce783851024255d8059b0c0146f6ea33d8c43469e77d07996bf3c4ccc7b69a90c0c65a
 EBUILD botan-2.19.5.ebuild 5224 BLAKE2B b24860c971aabe2a3eacfe3b617b0db00f991e2615785107b6fe8c7d5e85b5c16637b7afc2912c80c6d972d81f57831b3358e54dedce303d10471e34823feafd SHA512 3043e3d0b6ca928985e2265ac358b576dc1c8659d530b6a615a5b63528f8865d31409fb0d0585a83808175972284279697528bc38f2e53fc9b11be6a1fba7b27
 EBUILD botan-3.1.1.ebuild 5687 BLAKE2B 2a54f03f4c60f34a426306a440c961d8c670d353dc309eece4b89c251e280a3025faf8c46d76b5f3c2778678fb5302bffa4d13192b7c49b83ff2c4830bd53cf9 SHA512 039403784b9e5314fbf44491a075337e82b88a872965d9c4ec230c9e62b72d2758fb22c0270232faaf07c6de85bc6c9476986f5a264b5253cdb147f8d6c0fd09
 EBUILD botan-3.2.0-r1.ebuild 5949 BLAKE2B d3896126f123289ba540718729e96b72fb5c40527be15fe3b7921040210014efdb65748c4dc601130949bf48fced3864f746915ee9ada72f77d85120fbf85a10 SHA512 623175e58b1b045757ff939c05b1cc55357e0d32b76485027ab45179adc5278eb01f46bac5b944ebbb00e0fcb6963da4ae7202721546c306dc0355e7bb747161
 EBUILD botan-3.2.0-r2.ebuild 5974 BLAKE2B 0d13e2fd6b89cd5cd4254b0d4d109ce1df29f7e191df73c453786db9e2c134fc79a7faa592147c0bd780e1ea2e0d0c230b51402e028ea1b45f6fa188e20cd8a5 SHA512 d1ec5f53985ddcd8ef65439385a9fa4b33be4686e8fbcedf1c7c3b15eeb74dc635bf46bbba39195e6a5487297ac71e68b9442c129ab36d92c60b8d366dfde1f3
 EBUILD botan-3.6.1.ebuild 6065 BLAKE2B 3aabed0798a41be5fe48eba353bb5065ce43f609e5ff0a5c2e80e0c1f16e3b26ffb1a619144f0777cd3ee857de8c1205434494edf6fe96a3056a057949c95767 SHA512 2654262dc89039fb45b8548fc8643490b2a4d15c89b6c5ae25d85be8009313530e377ec2a3afc18a18ba07f7f82cf1203cba9ae0dd5699078ed04a6710f285eb
+EBUILD botan-3.7.1.ebuild 5955 BLAKE2B 8f44aff18efdc3d4c83aa8f2be3c63da3368a89f943adc8adf9c5a99e1226298a79f8414f828ad2a43607a964b10ec55adb6eba27995343a0f9dd2004823e478 SHA512 ff73d548bf6865ab9a89ef71b05b42f7f24e35a1ffa6e6e81147aaa164361562b1de1fffb356743ed38018f015726062db8a8e6d7f1269f88fbad8789c1a66d1
 MISC metadata.xml 587 BLAKE2B 8d46466fee633fda0f81549a6e512e4ef5963eda31d7c882cee2fe2bfae8b0379509f046d0bdfdb1fe9481eea0585f1754753ed6b509c4f922b8fbf9ae089f39 SHA512 258e04098b9db5821a66e38d02ffb195b57378621fd2a549c8892744cf257be857ebf75c8e4a2f041cd267f07c2f1c3a5fca8df61db0538d8282507cf03a029d
diff --git a/dev-libs/botan/botan-3.7.1.ebuild b/dev-libs/botan/botan-3.7.1.ebuild
new file mode 100644
index 000000000000..fedf9575a46c
--- /dev/null
+++ b/dev-libs/botan/botan-3.7.1.ebuild
@@ -0,0 +1,224 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/botan.asc
+inherit edo flag-o-matic multiprocessing ninja-utils python-r1 toolchain-funcs verify-sig
+
+MY_P="Botan-${PV}"
+DESCRIPTION="C++ crypto library"
+HOMEPAGE="https://botan.randombit.net/"
+SRC_URI="https://botan.randombit.net/releases/${MY_P}.tar.xz"
+SRC_URI+=" verify-sig? ( https://botan.randombit.net/releases/${MY_P}.tar.xz.asc )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="BSD-2"
+# New major versions are parallel-installable
+SLOT="$(ver_cut 1)/$(ver_cut 1-2)" # soname version
+KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-macos"
+IUSE="doc boost bzip2 lzma python static-libs sqlite test tools zlib"
+CPU_USE=(
+	cpu_flags_arm_{aes,neon,sha1,sha2}
+	cpu_flags_ppc_altivec
+	cpu_flags_x86_{aes,avx2,popcnt,rdrand,sha,sse2,ssse3,sse4_1,sse4_2}
+)
+IUSE+=" ${CPU_USE[@]}"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+# NOTE: Boost is needed at runtime too for the CLI tool.
+DEPEND="
+	boost? ( dev-libs/boost:= )
+	bzip2? ( >=app-arch/bzip2-1.0.5:= )
+	lzma? ( app-arch/xz-utils:= )
+	python? ( ${PYTHON_DEPS} )
+	sqlite? ( dev-db/sqlite:3= )
+	zlib? ( >=sys-libs/zlib-1.2.3:= )
+"
+RDEPEND="
+	${DEPEND}
+	!<dev-libs/botan-2.19.3-r1:2[tools]
+"
+BDEPEND="
+	${PYTHON_DEPS}
+	${NINJA_DEPEND}
+	$(python_gen_any_dep '
+		doc? ( dev-python/sphinx[${PYTHON_USEDEP}] )
+	')
+	|| ( >=sys-devel/gcc-11:* >=llvm-core/clang-14:* )
+	verify-sig? ( sec-keys/openpgp-keys-botan )
+"
+
+# NOTE: Considering patching Botan?
+# Please see upstream's guidance:
+# https://botan.randombit.net/handbook/packaging.html#minimize-distribution-patches
+
+python_check_deps() {
+	use doc || return 0
+	python_has_version "dev-python/sphinx[${PYTHON_USEDEP}]"
+}
+
+pkg_pretend() {
+	[[ ${MERGE_TYPE} == binary ]] && return
+
+	# bug #908958
+	if tc-is-gcc && ver_test $(gcc-version) -lt 11 ; then
+		eerror "Botan needs >=gcc-11 or >=clang-14 to compile."
+		eerror "Please upgrade GCC: emerge -v1 sys-devel/gcc"
+		die "GCC version is too old to compile Botan!"
+	elif tc-is-clang && ver_test $(clang-version) -lt 14 ; then
+		eerror "Botan needs >=gcc-11 or >=clang-14 to compile."
+		eerror "Please upgrade Clang: emerge -v1 llvm-core/clang"
+		die "Clang version is too old to compile Botan!"
+	fi
+}
+
+src_configure() {
+	tc-export AR CC CXX
+	python_setup
+
+	local disable_modules=(
+		$(usev !boost 'boost')
+	)
+
+	if [[ -z "${DISABLE_MODULES}" ]] ; then
+		elog "Disabling module(s): ${disable_modules[@]}"
+	fi
+
+	local chostarch="${CHOST%%-*}"
+
+	# Arch specific wrangling
+	local myos=
+	case ${CHOST} in
+		*-darwin*)
+			myos=darwin
+			;;
+		*)
+			myos=linux
+
+			if [[ ${CHOST} == *hppa* ]] ; then
+				chostarch=parisc
+			elif [[ ${ABI} == sparc64 ]] ; then
+				chostarch="sparc64"
+			elif [[ ${ABI} == sparc32 ]] ; then
+				chostarch="sparc32"
+			fi
+			;;
+	esac
+
+	local pythonvers=()
+	if use python ; then
+		_append() {
+			pythonvers+=( ${EPYTHON/python/} )
+		}
+
+		python_foreach_impl _append
+	fi
+
+	local myargs=(
+		# Intrinsics
+		# TODO: x86 RDSEED (new CPU_FLAGS_X86?)
+		# TODO: POWER Crypto (new CPU_FLAGS_PPC?)
+		$(usev !cpu_flags_arm_aes '--disable-armv8crypto')
+		$(usev !cpu_flags_arm_neon '--disable-neon')
+		$(usev !cpu_flags_arm_sha1 '--disable-armv8crypto')
+		$(usev !cpu_flags_arm_sha2 '--disable-armv8crypto')
+		$(usev !cpu_flags_ppc_altivec '--disable-altivec')
+		$(usev !cpu_flags_x86_aes '--disable-aes-ni')
+		$(usev !cpu_flags_x86_avx2 '--disable-avx2')
+		$(usev !cpu_flags_x86_popcnt '--disable-bmi2')
+		$(usev !cpu_flags_x86_rdrand '--disable-rdrand')
+		$(usev !cpu_flags_x86_sha '--disable-sha-ni')
+		$(usev !cpu_flags_x86_sse2 '--disable-sse2')
+		$(usev !cpu_flags_x86_ssse3 '--disable-ssse3')
+		$(usev !cpu_flags_x86_sse4_1 '--disable-sse4.1')
+		$(usev !cpu_flags_x86_sse4_2 '--disable-sse4.2')
+
+		# HPPA's GCC doesn't support SSP
+		$(usev hppa '--without-stack-protector')
+
+		$(use_with boost)
+		$(use_with bzip2)
+		$(use_with doc documentation)
+		$(use_with doc sphinx)
+		$(use_with lzma)
+		$(use_enable static-libs static-library)
+		$(use_with sqlite sqlite3)
+		$(use_with zlib)
+
+		--build-tool=ninja
+		--cpu=${chostarch}
+		--docdir=share/doc
+		--disable-modules=$(IFS=","; echo "${disable_modules[*]}")
+		--distribution-info="Gentoo ${PVR}"
+		--libdir="$(get_libdir)"
+		# Avoid collisions between slots for tools (bug #905700)
+		--program-suffix=$(ver_cut 1)
+
+		# Don't install Python bindings automatically
+		# (do it manually later in the right place)
+		# bug #723096
+		--no-install-python-module
+
+		--os=${myos}
+		--prefix="${EPREFIX}"/usr
+		--lto-cxxflags-to-ldflags
+		--with-endian="$(tc-endian)"
+		--with-python-version=$(IFS=","; echo "${pythonvers[*]}")
+	)
+
+	local build_targets=(
+		shared
+		$(usev static-libs static)
+		$(usev tools cli)
+		$(usev test tests)
+	)
+
+	myargs+=(
+		--build-targets=$(IFS=","; echo "${build_targets[*]}")
+	)
+
+	if ( use elibc_glibc || use elibc_musl ) && use kernel_linux ; then
+		myargs+=(
+			--with-os-features=getrandom,getentropy
+		)
+	fi
+
+	local sanitizers=()
+	if is-flagq -fsanitize=address ; then
+		sanitizers+=( address )
+	fi
+	if is-flagq -fsanitize=undefined ; then
+		sanitizers+=( undefined )
+	fi
+	filter-flags '-fsanitize=*'
+	myargs+=(
+		--enable-sanitizers=$(IFS=","; echo "${sanitizers[*]}")
+	)
+
+	edo ${EPYTHON} configure.py --verbose "${myargs[@]}"
+}
+
+src_compile() {
+	eninja
+}
+
+src_test() {
+	LD_LIBRARY_PATH="${S}" edo ./botan-test$(ver_cut 1) --test-threads="$(makeopts_jobs)"
+}
+
+src_install() {
+	DESTDIR="${D}" eninja install
+
+	if [[ -d "${ED}"/usr/share/doc/${P} && ${P} != ${PF} ]] ; then
+		# --docdir in configure controls the parent directory unfortunately
+		mv "${ED}"/usr/share/doc/${P} "${ED}"/usr/share/doc/${PF} || die
+	fi
+
+	# Manually install the Python bindings (bug #723096)
+	if use python ; then
+		python_foreach_impl python_domodule src/python/botan$(ver_cut 1).py
+	fi
+}
diff --git a/dev-libs/libdbusmenu-lxqt/Manifest b/dev-libs/libdbusmenu-lxqt/Manifest
index f6bcdf1abf87..6fe3e6e7726c 100644
--- a/dev-libs/libdbusmenu-lxqt/Manifest
+++ b/dev-libs/libdbusmenu-lxqt/Manifest
@@ -2,5 +2,5 @@ AUX libdbusmenu-lxqt-0.1.0-cmake.patch 4430 BLAKE2B c8d76059ce1ba821e3dccc012559
 DIST libdbusmenu-lxqt-0.1.0.tar.xz 39232 BLAKE2B 7c2741609996a33fb1bffb9aff938130e31ebc6796dcf613ccbb2bbf9bae2290fa09bda9777ebec2b819c7ac2ce04ad086483db409c2809517ce7e41729cd71d SHA512 8c09f9bd4b3c60db1666f5a53ea84c67d2d120b215eca6563c32385387e100fe591cb8653a283750444356c61306cf385507edb6a507b22427eb6f18aa972fb5
 DIST libdbusmenu-lxqt-0.2.0.tar.xz 39068 BLAKE2B f0cdb9d89f5823978b096d353caef72c78c3924bd908cf36bb9b95ad536205d0aa13d632649cf2487691621dc5910403987df7cb8b2b06caba7f99ffad6b1772 SHA512 891cdd44bbe0ecc12e10dd35dda481097e8c29fd7e2385c322890caebaf92afc5788711225c9cc8e4a480ed4ea2548e88a26a385a36a8329ef1e73eebc037ea4
 EBUILD libdbusmenu-lxqt-0.1.0.ebuild 552 BLAKE2B b2e3f8ee861167212855dc8c206df22eafca634fdabc5dd9f30c264387255c109e3c3e73a0b6143c1c61a198b43e042110004eba99614df20c0559fb84741e0e SHA512 4e2b69fef14547c564e186b83fb3ace623018b76ee450e2410effe9cfc7145f9f3d678c88784b3283d8cf08fd02ca0e2e7d257f8ca022972eeb185389e816d85
-EBUILD libdbusmenu-lxqt-0.2.0.ebuild 559 BLAKE2B dddab55e2b9298db82681435bd6611da311cc8436fe83c3f5edce4cb2e433f7af0b08b2f1e6ac70331b17237a1c6d1c9ab6bd1b1c24346d279aa7676dfd4f00c SHA512 7e8502f63e00a4b3f8039fadbcb30c7747da713cc63fe27b67cd068391f32447ce65eb800cc8ef4b70fb292f5a5c273c5d7dc009c09a7cd4a74519300da5a479
+EBUILD libdbusmenu-lxqt-0.2.0.ebuild 558 BLAKE2B acaa0704547086d1dcab7c5b81b70f05ed7bdc529cebd6b78edc0c516afe98a059505800bd4c39d35d4867fea6328c5fa2c0227c57f7354ad16b67a09a8a0694 SHA512 9b7f1adbd1ed7a3a55959d7444c6852846efcd99c3766d582984fa141aa5298640c730d75ece757677934bbcc49ce228c755c9b3115e9f4032670327a632de64
 MISC metadata.xml 323 BLAKE2B 552d31a9b5cbdca671675a528047bbcfa99652a2d1ca26c241297bab1b8e93fb08a67bb7ffff25404443e6eae35ae97fb351c63854262c1254e72347fcd2eaff SHA512 9dce1557e11fd191761810afef65ea8c49375445a64b179a8c38875f55f0a5163344cae538a503bbb365af38265c6fda5ed5b9ae3dc751560c7a88e5d91bfd6e
diff --git a/dev-libs/libdbusmenu-lxqt/libdbusmenu-lxqt-0.2.0.ebuild b/dev-libs/libdbusmenu-lxqt/libdbusmenu-lxqt-0.2.0.ebuild
index ae539acde3e3..129d52e1c06a 100644
--- a/dev-libs/libdbusmenu-lxqt/libdbusmenu-lxqt-0.2.0.ebuild
+++ b/dev-libs/libdbusmenu-lxqt/libdbusmenu-lxqt-0.2.0.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/lxqt/${PN}.git"
 else
 	SRC_URI="https://github.com/lxqt/${PN}/releases/download/${PV}/${P}.tar.xz"
-	KEYWORDS="~amd64 arm64 ~ppc64 ~riscv ~x86"
+	KEYWORDS="amd64 arm64 ~ppc64 ~riscv ~x86"
 fi
 
 LICENSE="LGPL-2"
diff --git a/dev-libs/libffi/Manifest b/dev-libs/libffi/Manifest
index 8457c1c0115b..acd471b171c5 100644
--- a/dev-libs/libffi/Manifest
+++ b/dev-libs/libffi/Manifest
@@ -20,6 +20,7 @@ DIST libffi-3.4.4.tar.gz 1362394 BLAKE2B 189fe1ffe9507f204581b0ab09995dc7e7b761b
 DIST libffi-3.4.6.tar.gz 1391684 BLAKE2B af8402a09bdbd59b4e9400d2d71bd5ce98f6f1d981d35d1ab40d77a831b13b32c5bd34ca54ff75999e39f0d8a9c066381fae7a8d6c5216d955e064f929f08b88 SHA512 033d2600e879b83c6bce0eb80f69c5f32aa775bf2e962c9d39fbd21226fa19d1e79173d8eaa0d0157014d54509ea73315ad86842356fc3a303c0831c94c6ab39
 EBUILD libffi-3.4.4-r4.ebuild 2540 BLAKE2B 6a85dd1d002e6ec61c57a4d5db58a20ff58e987da7ceb6630abfdd08ebd9f2fad574c29ab10d7a623310bb61b161e4c26c23a5d26af91e67bfa193d191e8a822 SHA512 f5d4049d6e5fe432321df11c0295a7bc579212eb5db54613d0ecc986975bdae1d9f26b9abcd9949db7e2efe156f4e5c9f8a90d870b9cf380308a848ad533c747
 EBUILD libffi-3.4.6-r2.ebuild 2858 BLAKE2B 34b481067c36cc8bdabe8e1ce75443d0c3c776c5b85530aa0b0afe8b8c162c0dc14d8f255fe154c46d83553677ee5f8e9ad36ea336ad72326b373e00939a567c SHA512 c7d035d7aa67ee230d2050c9b3e63d3d75821e6a679f07799204f0bec12e9254def244abef0b7e98550221e6ac6ac3e6abfaddab6b35e687c5b386af4cc41680
+EBUILD libffi-3.4.6-r3.ebuild 2798 BLAKE2B ad5cef3fdf2b91ebbaada2f9b917cc179ab32750582f8f55648357336a5291119f8fa2b07ec1500d2dbb1e40134ac99d941cb65528c208ab4f8dbea437396719 SHA512 b429dffb3ca124a6a392b55bb9e7c61555dd1824b82140523e0de74289b0841b24d9d11f11ca40f8d99fe33c642b567a9736a2f7455f9519cc2f7db92b39ec9d
 EBUILD libffi-3.4.6.ebuild 2270 BLAKE2B a8af8687618bc1541f71db585727f33228b96c446729761accd7e2dc3ebd59de141e629371b97a3e7fc6e7c412f4696a7cac7e02ca8c271e103747f7c9d439b4 SHA512 6447b4fd561836bee7cd7148f1b2fdf7e100ffa292a1e94051aca03ed19acf5446f1db74241e6ecc445317f272b3773930f1184f25588658aa12234472897ce0
 EBUILD libffi-9999.ebuild 2434 BLAKE2B 92ace4cdabf80f2f920c9137140a2f81520413359f21714640d3ce0dfa9d39ea66d0e2e653dfd1c9566448a688ec4406a012f0d0c9c6fc374bccdd0fa4e4a183 SHA512 f0e0133ed6bf82f97289b002546e8777d9a38873b47d691fcbeb2ce0167c850e246307783dba13258fa8225ef278b5ad809cb7fec8dda50337f3290dc4551c6a
 MISC metadata.xml 2110 BLAKE2B 2653be2cf09c047e45e489d7265d00165ddab2f94744988e4e8bca449bd1e40eeab74cb0b8d7d47a2d8b73563869460fcccb06e1fbccad697a9f213be362cb03 SHA512 e1a280792b929d38451fea1eb360053ed3a452592094f3e327ce4a4ff7eb8e0119435e8ee98f215585d8d98440512b5b68f92d1cd472a3bfd12e2f382e1981a1
diff --git a/dev-libs/libffi/libffi-3.4.6-r3.ebuild b/dev-libs/libffi/libffi-3.4.6-r3.ebuild
new file mode 100644
index 000000000000..e8471b2b545b
--- /dev/null
+++ b/dev-libs/libffi/libffi-3.4.6-r3.ebuild
@@ -0,0 +1,94 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit multilib-minimal preserve-libs
+
+MY_PV=${PV/_rc/-rc}
+MY_P=${PN}-${MY_PV}
+
+DESCRIPTION="Portable, high level programming interface to various calling conventions"
+HOMEPAGE="https://sourceware.org/libffi/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://github.com/libffi/libffi"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/libffi/libffi/releases/download/v${MY_PV}/${MY_P}.tar.gz"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+S="${WORKDIR}"/${MY_P}
+
+LICENSE="MIT"
+# This is a core package which is depended on by e.g. Python.
+# Please use preserve-libs.eclass in pkg_{pre,post}inst to cover users
+# with FEATURES="-preserved-libs" or another package manager if SONAME changes.
+SLOT="0/8" # SONAME=libffi.so.8
+IUSE="debug exec-static-trampoline pax-kernel static-libs test"
+
+RESTRICT="!test? ( test )"
+BDEPEND="test? ( dev-util/dejagnu )"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-arm64-bti.patch
+	"${FILESDIR}"/${P}-arm64-bti-spelling.patch
+	"${FILESDIR}"/${P}-arm64-support-pac.patch
+	"${FILESDIR}"/${P}-arm64-fix-build.patch
+	"${FILESDIR}"/${P}-sparc-struct-targs.patch
+	"${FILESDIR}"/${P}-test-typo.patch
+	"${FILESDIR}"/${P}-arm64-cfi.patch
+	"${FILESDIR}"/${P}-asan.patch
+	"${FILESDIR}"/${P}-regenerate-autotools.patch
+	"${FILESDIR}"/${P}-c23-tests.patch
+)
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == arm64-*-darwin* ]] ; then
+		# ensure we use aarch64 asm, not x86 on arm64
+		sed -i -e 's/aarch64\*-\*-\*/arm64*-*-*|&/' \
+			configure configure.host || die
+	fi
+}
+
+multilib_src_configure() {
+	# --includedir= path maintains a few properties:
+	# 1. have stable name across libffi versions: some packages like
+	#    dev-lang/ghc or kde-frameworks/networkmanager-qt embed
+	#    ${includedir} at build-time. Don't require those to be
+	#    rebuilt unless SONAME changes. bug #695788
+	#
+	#    We use /usr/.../${PN} (instead of former /usr/.../${P}).
+	#
+	# 2. have ${ABI}-specific location as ffi.h is target-dependent.
+	#
+	#    We use /usr/$(get_libdir)/... to have ABI identifier.
+	ECONF_SOURCE="${S}" econf \
+		--includedir="${EPREFIX}"/usr/$(get_libdir)/${PN}/include \
+		--disable-multi-os-directory \
+		$(use_enable static-libs static) \
+		$(use_enable exec-static-trampoline exec-static-tramp) \
+		$(use_enable pax-kernel pax_emutramp) \
+		$(use_enable debug)
+}
+
+multilib_src_test() {
+	emake -Onone check
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -name "*.la" -delete || die
+}
+
+pkg_preinst() {
+	preserve_old_lib /usr/$(get_libdir)/libffi.so.7
+}
+
+pkg_postinst() {
+	preserve_old_lib_notify /usr/$(get_libdir)/libffi.so.7
+}
diff --git a/dev-libs/libqtxdg/Manifest b/dev-libs/libqtxdg/Manifest
index 964c277448b6..9dce342bf8f0 100644
--- a/dev-libs/libqtxdg/Manifest
+++ b/dev-libs/libqtxdg/Manifest
@@ -3,5 +3,5 @@ DIST libqtxdg-4.0.1.tar.xz 71964 BLAKE2B 11c45e8e27a539e8c9b001667479e7a7c447937
 DIST libqtxdg-4.1.0.tar.xz 71980 BLAKE2B 5fbebcd5fe65a6c8d5f0fd79d694b326cfc122d64f2f815401efdd2e0c9e66300b86806015446a325021951afcb62bed557fc59006aecc561e1d358081995e24 SHA512 6c28b611d32284e28982b89658c051297ed739d35e9d795b837e822d93651a4c282695c7fa8fe27861cd1e5703578b8dcc28711ba1ad0a73cc3686f0eef461ea
 EBUILD libqtxdg-4.0.0.ebuild 1075 BLAKE2B 3101e61c1b1972d333e1d41d9683ad7afc2f3932686317893878af9af9e8261b040001f6b719ffdbef225ca227da569fc433ac57b189ca1696df1cacaf90d296 SHA512 7461450cdd0ca7ac586c235c7c6465275c3a8fa945fde165e90d5696bce5b6bb22a58a8cbd64ca390d375217e2f21a062e425b36f37f865ea3afd727649a3ce3
 EBUILD libqtxdg-4.0.1.ebuild 1076 BLAKE2B 3cadeeffb332d6b499c1a55168bd2859ea1d21f0fdc740c5ae78977c65e75ef3e05e4dbd09ee5d734095a9196adfe75408445b2a4c9b9a18bc5900feab61d74b SHA512 3cdcb70719fafba07fd9031e563dc24f1d8c1b70c379e0e067790a3624d0846ea0bc820eb5f4a90ae9932c46e3e04164810c9ddbc23efd5a4ea38331bde821c8
-EBUILD libqtxdg-4.1.0.ebuild 1076 BLAKE2B d7eb8d00abfa02f573348b23eb121d3aae8b717ed4706e9d0cdb4538f62249c80190e1d60f19c90e3932dd7d0e4ed3ed574a6119f69a1093e82ff99c9788202e SHA512 ef4af067f160ce9da3756d3fe01fc583fce22055b5e296b5b5127f4ac143ab907ee3d93443d8129ad32b61eaa7262a2225465ff174b96f5ae02228fa3acafa59
+EBUILD libqtxdg-4.1.0.ebuild 1075 BLAKE2B b7a1e6ba0b12fad14a2b81a9f38debefbe3225579e6f20ef2b5eb964697814cfc773bbf14c8a023d5743889e1bd6fb70adab5227678b20a09159d14d6919207b SHA512 f8bf5053724f76d2b91788f7acf8b6f43ccc5d57b9267e036e571ac81293f32a51b8920acfce97c5ac228311b5e6b1bf6187705be7f7666335762837995b72d7
 MISC metadata.xml 315 BLAKE2B 6a1fa84e6e1b91af913f0b00257961e03ef8607723e7f585f57ee131d09a7e406e9cbcd77cd035e6e003a3eda582ede77580e0568457036e682cd569eb0b1c6c SHA512 d4ee7f4e49f8258a956b397b6ff352fe0f1d53cb350717b01f8eda431d7f62976c338b4768a6bd9c842f29fcd76023240c1f5a39df43ed4bda967c23ef0dfcbd
diff --git a/dev-libs/libqtxdg/libqtxdg-4.1.0.ebuild b/dev-libs/libqtxdg/libqtxdg-4.1.0.ebuild
index b3c1a8f0f8f9..de59799ee0df 100644
--- a/dev-libs/libqtxdg/libqtxdg-4.1.0.ebuild
+++ b/dev-libs/libqtxdg/libqtxdg-4.1.0.ebuild
@@ -13,7 +13,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://github.com/lxqt/${PN}.git"
 else
 	SRC_URI="https://github.com/lxqt/${PN}/releases/download/${PV}/${P}.tar.xz"
-	KEYWORDS="~amd64 arm64 ~loong ~ppc64 ~riscv ~x86"
+	KEYWORDS="amd64 arm64 ~loong ~ppc64 ~riscv ~x86"
 fi
 
 LICENSE="LGPL-2.1+ Nokia-Qt-LGPL-Exception-1.1"
diff --git a/dev-libs/nss/Manifest b/dev-libs/nss/Manifest
index c471d3e8551e..21c7c1fc800a 100644
--- a/dev-libs/nss/Manifest
+++ b/dev-libs/nss/Manifest
@@ -1,11 +1,16 @@
+AUX nss-3.101.3-update-expected-error-code-in-pkg12util-pbmac1-tests.patch 2267 BLAKE2B 873bf6fcdf51f0a1266f4fd266b8e4f921dced71df20acd45922e6cdf4cdf35502b9f656c65eb68c8ef2820088d82032790f7e3cf24d603434f2010a6026cefc SHA512 758064a067a06e2557d8da00316266370a70be4df5c35e87657941a9652dd0e8beb7cd30b1eae1f26b9fb84ae3507c55f73c4f25d70a5a6e97d9bda8777e7fbe
 AUX nss-3.103-gentoo-fixes-add-pkgconfig-files.patch 6214 BLAKE2B af2b685f5ef32b971abd27c9cf77aed0cee684863aae1d2dd3a1106814aa6a4df3a654012962ce0bbf5d0d354a349ee2366c6281c98ba5f3fe849dd5ec13d4c4 SHA512 cdf8bb84ee0192be165b0ddacc6a55295153d587d653381a4d92ca39e69a9f178ea9720bd68ef8193930149b17c26e2fe31e39a10d6b32e8f4a2edf9c89ab632
 AUX nss-3.21-gentoo-fixup-warnings.patch 178 BLAKE2B b51f80310db3db416d8aeaf9117ef801389b5b2df47c04aff51bf0759dd5bff41b09d1e9011f99b345d5769a3aab19acb943ee97f8437465518115f6902a0da1 SHA512 7667a020311ca11e8f1836bc146e4a3c94ff2a489882dbe87debcccfeaafeb50e6607574c64254a826b4b6f0bb436b310a3386fff4a58324f0e5e58debaa9d51
 AUX nss-3.53-gentoo-fixups.patch 6886 BLAKE2B 1c605d8db02ebe0492c41955207368197a79990e43e219a71962cb28ac0cecd9e0acc2b76e16f5b116fdb8bf8790d96046cb4f376df9b8634ac48e54924589f8 SHA512 51031f92519f57d4b57a547cf549f2d5da1c5a7212d4b304fb0d71d6a85a5aefd64724ec9075c14c9b49c1e99c3ffe91cbec501c3504985aa9b16eacf2aa15ed
 AUX nss-3.87-use-clang-as-bgo892686.patch 2693 BLAKE2B fe8a25c9c8599e0f3e630202c824b854ebfa5b3580e79a61f7172a93a5aad2df3754e2e5aba718a22bb2ad5102f4d638ca10508f0b66cf6e8f21da4ea52bf966 SHA512 67d231aa1b2433e5feeff59af6849eee78f6d5ebf601c0f7baaf0e1b5b44c25ca63f012ced677f5562bb45e3fc0dabe0210b123a78b56de4dfe11c5eaafac3bc
 DIST nss-3.101-cacert-class1-class3.patch 21925 BLAKE2B 2b37f6b69e0541f31087ff0401b195c035f4b607865c4d29976e4ad2c8143321d65b41b996e922362e076aa8259304ed67b0c4a1f8df2fdfdb1d893319f5d5e7 SHA512 19438aefbb361881c1b4620d8b1b5e7d2bf5afb44900858d3728ff6999a792bf6fe073a11f591ab70461bee8c54fdfb097e4084b402842bc49d2139897de304d
 DIST nss-3.101.2.tar.gz 76462495 BLAKE2B 3a0dfd7aa68bc11f332decfc9cb7003b8d8fa6a9dad556ad736229d7d3847e68aeaf5b74e68989a0483bd1b9e2e3afd3bdf8df3d428ebc815eda9a255f5695aa SHA512 65ac338ee1b13ecc2b190f1ea39c987110a06f3b67610e094ffc1ef4117d487c34af1e11b90de0c28035bfc5cb10ca7996ed991d9afce7985973fabb48cd7ac8
+DIST nss-3.101.3.tar.gz 76462813 BLAKE2B 03a38804da9e9df79df6c06ebd8b4d5f185cc841d10cd81239f0b3e55ddec3c1ac2b626850004f8d78ea698c8c4d55dbb4adcae9d58fd3890526300c15be96a3 SHA512 105be3ce7b34221ae16a681db12291d08b19fe6f9557bd975627570b5de92d3e2349b16453cca07675483efa0a72e41995750171f08a0d6bac61de2ac3b05850
 DIST nss-3.104-cacert-class1-class3.patch 22038 BLAKE2B 66e2dd47230d6aa58a767e35c9c069fa29f3111d470345e0f69486d1eead3cd1741939ac394f6b9b637e79a10d658cfb1a9da4387953b8968a9001bab94d4de0 SHA512 bafc4212e0e0ca3eb129a5b88767727159c6ec3da450c7625d0b282f82699378d64eaa2c3fecb72c61000ec9b6d3c24f20bc7defdac6edc673e0fbb26e0c1f7e
 DIST nss-3.107.tar.gz 76617725 BLAKE2B 6f42cc9fa3c681083e7af0fe46b695a1b37b32facf7fe7f80718649db40a62a9d9a3de0be8910316a46fd42857fe713a77d72e45fa69fa980d9ad90d35b1db20 SHA512 a710459a46f5ca084fc5eb96047aeeece5010ebbffff3691a8487b667e9c520bd22d810cacca7b7b63b76d85a04c920748d169d0abb845b89b7b9804f9c38918
+DIST nss-3.108.tar.gz 76630022 BLAKE2B f7e58bc55ca9ccec83bfa0118267c9e4bec41f0f9852b31413cc19889c9e7e4beb87a7de303c7b3dfee3d8c84cc32cc90d84cf128daae1cea380c08ecc9b3ec5 SHA512 8a9545ec201f610abfae40d29e989c6a140b066755c02a36225a95fb9abfe47834352f3eae168e1cfb16382dfd12820c63bb9ad37361a624907cc45faa7bd34b
 EBUILD nss-3.101.2.ebuild 11562 BLAKE2B 9759fc450f14ff746940714ccdf14e6342d953383cb5411fa7aae7a1bd79d9a70c7cb356372d4199116fadc9e81a65903a41b00690af48f8a3c67488bc1c3b98 SHA512 ee193cf6494afa7d75e9d2b60cb9a0a69d5484e6d1fe8790bf5202636ed5e0dcc57a5d553dca5ab8065d8014cb4c2ea9f665798bd14d7a147848f826bad451cf
+EBUILD nss-3.101.3.ebuild 11684 BLAKE2B 82f0cac49247caeb35c3df60faba8ad4910a3087764a36dbc2f0615f3a162eec649070cb6261fd963433c0d4671ff24e81ea1a5a9820a2551ad2b08fa0515170 SHA512 5646197286cb67242897377b6ed1eb9ee30ed31f851c1da8d066ca698f61066ff274843d879d33a46d67262c813cb12daa16656983957f9d34bb9f8bfa63cca0
 EBUILD nss-3.107.ebuild 11806 BLAKE2B d52058c3c43a743706d3aa996849634011b82b9309901869cbec9b094501334c617948ccc2bfacb758033c7bc6ece036142c910ab511c8c1c3bda2d3c64f656e SHA512 075359144c5ebfff3d265febf8c636e465ffa08876ebf6de0634db5bd0fdb593fad57c7eb81c6bff1c0ad3c3c48d571b06cd57aa7822c6066437efb4be17104a
+EBUILD nss-3.108.ebuild 11806 BLAKE2B 836c348f9115c3b6f76c809308e7823f4c4c3d69b1c2905cbda65e3e02d2c84c302962d300de53a81f2a2abbf233107f3af171f848d5b60284fb8cae264852e4 SHA512 f44bc2e7eb1f2fdb69c152cf2b02a3824754189109bbd80553c1aa81f80ccbb6788abdd745b04eba5c271c3de39fd62ce2f8b0cb830d210070db415d6a95b400
 MISC metadata.xml 693 BLAKE2B c8be043e957f4d85411a10da490e67c9d37f5dd9fe37c112c92e8b666d828cabe75f5fe7c46e5b40dd872f082fb4463af79fb7eb3ad69b9e01c9c088edd750a8 SHA512 66374f8b8739c68a8a276159af3d493bb012b5ee722a939a1d87899d0307d572fcabf76ba71b4f34eeb83a414c0727182ef16f98418cbbbbd4aed311ac5be06b
diff --git a/dev-libs/nss/files/nss-3.101.3-update-expected-error-code-in-pkg12util-pbmac1-tests.patch b/dev-libs/nss/files/nss-3.101.3-update-expected-error-code-in-pkg12util-pbmac1-tests.patch
new file mode 100644
index 000000000000..db3b6a33008d
--- /dev/null
+++ b/dev-libs/nss/files/nss-3.101.3-update-expected-error-code-in-pkg12util-pbmac1-tests.patch
@@ -0,0 +1,49 @@
+
+# HG changeset patch
+# User John Schanck <jschanck@mozilla.com>
+# Date 1731689351 0
+# Node ID 74feb03fe4f9efc0d5e5018b9a34376fc1261404
+# Parent  98e011fd3a24428abb886525630caacffabe01eb
+Bug 1927096 - update expected error code in pk12util pbmac1 tests. r=rrelyea
+
+Differential Revision: https://phabricator.services.mozilla.com/D227894
+
+diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
+--- a/tests/tools/tools.sh
++++ b/tests/tools/tools.sh
+@@ -539,31 +539,31 @@ tools_p12_import_pbmac1_samples()
+   ${BINDIR}/pk12util -i ${TOOLSDIR}/data/pbmac1-valid-sha512.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234' 2>&1
+   ret=$?
+   html_msg $ret 0 "Importing private key pbmac1 hmac-sha-512 from PKCS#12 file"
+   check_tmpfile
+ 
+   echo "${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-bad-iter.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234'"
+   ${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-bad-iter.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234' 2>&1
+   ret=$?
+-  html_msg $ret 19 "Fail to list private key with bad iterator"
++  html_msg $ret 17 "Fail to list private key with bad iterator"
+   check_tmpfile
+ 
+   echo "${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-bad-salt.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234'"
+   ${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-bad-salt.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234' 2>&1
+   ret=$?
+   echo "Fail to list private key with bad salt val=$ret"
+-  html_msg $ret 19 "Fail to import private key with bad salt"
++  html_msg $ret 17 "Fail to import private key with bad salt"
+   check_tmpfile
+ 
+   echo "${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-no-length.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234'"
+   ${BINDIR}/pk12util -l ${TOOLSDIR}/data/pbmac1-invalid-no-length.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '1234' 2>&1
+   ret=$?
+   echo "Fail to import private key with no length val=$ret"
+-  html_msg $ret 19 "Fail to import private key with no length"
++  html_msg $ret 17 "Fail to import private key with no length"
+   check_tmpfile
+ }
+ 
+ ############################## tools_p12 ###############################
+ # local shell function to test basic functionality of pk12util
+ ########################################################################
+ tools_p12()
+ {
+
diff --git a/dev-libs/nss/nss-3.101.3.ebuild b/dev-libs/nss/nss-3.101.3.ebuild
new file mode 100644
index 000000000000..a4d32ecb1c03
--- /dev/null
+++ b/dev-libs/nss/nss-3.101.3.ebuild
@@ -0,0 +1,419 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib toolchain-funcs multilib-minimal
+
+NSPR_VER="4.35"
+RTM_NAME="NSS_${PV//./_}_RTM"
+
+DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
+HOMEPAGE="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
+SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/nss-3.101_3.tar.gz -> ${P}.tar.gz
+	cacert? ( https://dev.gentoo.org/~juippis/mozilla/patchsets/nss-3.101-cacert-class1-class3.patch )"
+
+LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-solaris"
+IUSE="cacert test +utils cpu_flags_ppc_altivec cpu_flags_x86_avx2 cpu_flags_x86_sse3 cpu_flags_ppc_vsx"
+RESTRICT="!test? ( test )"
+# pkg-config called by nss-config -> virtual/pkgconfig in RDEPEND
+RDEPEND="
+	>=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
+	>=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-lang/perl"
+
+S="${WORKDIR}/nss-3.101_3/${PN}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/nss-config
+)
+
+PATCHES=(
+	"${FILESDIR}/${PN}-3.53-gentoo-fixups.patch"
+	"${FILESDIR}/${PN}-3.21-gentoo-fixup-warnings.patch"
+	"${FILESDIR}"/nss-3.87-use-clang-as-bgo892686.patch
+	"${FILESDIR}"/nss-3.101.3-update-expected-error-code-in-pkg12util-pbmac1-tests.patch
+)
+
+src_prepare() {
+	default
+
+	if use cacert ; then
+		eapply -p2 "${DISTDIR}"/nss-3.101-cacert-class1-class3.patch
+	fi
+
+	pushd coreconf >/dev/null || die
+	# hack nspr paths
+	echo 'INCLUDES += -I$(DIST)/include/dbm' \
+		>> headers.mk || die "failed to append include"
+
+	# modify install path
+	sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
+		-i source.mk || die
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
+
+	# Workaround make-4.4's change to sub-make, bmo#1800237, bgo#882069
+	sed -i -e "s/^CPU_TAG = _.*/CPU_TAG = _$(nssarch)/" Linux.mk || die
+
+	popd >/dev/null || die
+
+	# Fix pkgconfig file for Prefix
+	sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
+		config/Makefile || die
+
+	# use host shlibsign if need be #436216
+	if tc-is-cross-compiler ; then
+		sed -i \
+			-e 's:"${2}"/shlibsign:shlibsign:' \
+			cmd/shlibsign/sign.sh || die
+	fi
+
+	# dirty hack
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
+		lib/ssl/config.mk || die
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
+		cmd/platlibs.mk || die
+
+	multilib_copy_sources
+
+	strip-flags
+}
+
+multilib_src_configure() {
+	# Ensure we stay multilib aware
+	sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
+}
+
+nssarch() {
+	# Most of the arches are the same as $ARCH
+	local t=${1:-${CHOST}}
+	case ${t} in
+		*86*-pc-solaris2*) echo "i86pc"   ;;
+		aarch64*)          echo "aarch64" ;;
+		hppa*)             echo "parisc"  ;;
+		i?86*)             echo "i686"    ;;
+		x86_64*)           echo "x86_64"  ;;
+		*)                 tc-arch ${t}   ;;
+	esac
+}
+
+nssbits() {
+	local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
+	if [[ ${1} == BUILD_ ]]; then
+		cc=$(tc-getBUILD_CC)
+	else
+		cc=$(tc-getCC)
+	fi
+	# TODO: Port this to toolchain-funcs tc-get-ptr-size/tc-get-build-ptr-size
+	echo > "${T}"/test.c || die
+	${cc} ${!cppflags} ${!cflags} -fno-lto -c "${T}"/test.c -o "${T}/${1}test.o" || die
+	case $(file -S "${T}/${1}test.o") in
+		*32-bit*x86-64*) echo USE_X32=1;;
+		*64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
+		*32-bit*|*ppc*|*i386*) ;;
+		*) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
+	esac
+}
+
+multilib_src_compile() {
+	# use ABI to determine bit'ness, or fallback if unset
+	local buildbits mybits
+	case "${ABI}" in
+		n32) mybits="USE_N32=1";;
+		x32) mybits="USE_X32=1";;
+		s390x|*64) mybits="USE_64=1";;
+		${DEFAULT_ABI})
+			einfo "Running compilation test to determine bit'ness"
+			mybits=$(nssbits)
+			;;
+	esac
+	# bitness of host may differ from target
+	if tc-is-cross-compiler; then
+		buildbits=$(nssbits BUILD_)
+	fi
+
+	local makeargs=(
+		CC="$(tc-getCC)"
+		CCC="$(tc-getCXX)"
+		AR="$(tc-getAR) rc \$@"
+		RANLIB="$(tc-getRANLIB)"
+		OPTIMIZER=
+		${mybits}
+		disable_ckbi=0
+	)
+
+	# Take care of nspr settings #436216
+	local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
+	unset NSPR_INCLUDE_DIR
+
+	export NSS_ALLOW_SSLKEYLOGFILE=1
+	export NSS_ENABLE_WERROR=0 #567158
+	export BUILD_OPT=1
+	export NSS_USE_SYSTEM_SQLITE=1
+	export NSDISTMODE=copy
+	export FREEBL_NO_DEPEND=1
+	export FREEBL_LOWHASH=1
+	export NSS_SEED_ONLY_DEV_URANDOM=1
+	export USE_SYSTEM_ZLIB=1
+	export ZLIB_LIBS=-lz
+	export ASFLAGS=""
+	# Fix build failure on arm64
+	export NS_USE_GCC=1
+	# Detect compiler type and set proper environment value
+	if tc-is-gcc; then
+		export CC_IS_GCC=1
+	elif tc-is-clang; then
+		export CC_IS_CLANG=1
+	fi
+
+	export NSS_DISABLE_GTESTS=$(usex !test 1 0)
+
+	# Include exportable custom settings defined by users, #900915
+	# Two examples uses:
+	#   EXTRA_NSSCONF="MYONESWITCH=1"
+	#   EXTRA_NSSCONF="MYVALUE=0 MYOTHERVALUE=1 MYTHIRDVALUE=1"
+	# e.g.
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0"
+	# or
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0 NSS_ENABLE_WERROR=1"
+	# etc.
+	if [[ -n "${EXTRA_NSSCONF}" ]]; then
+		ewarn "EXTRA_NSSCONF applied, please disable custom settings before reporting bugs."
+		read -a myextranssconf <<< "${EXTRA_NSSCONF}"
+
+		for (( i=0; i<${#myextranssconf[@]}; i++ )); do
+			export "${myextranssconf[$i]}"
+			echo "exported ${myextranssconf[$i]}"
+		done
+	fi
+
+	# explicitly disable altivec/vsx if not requested
+	# https://bugs.gentoo.org/789114
+	case ${ARCH} in
+		ppc*)
+			use cpu_flags_ppc_altivec || export NSS_DISABLE_ALTIVEC=1
+			use cpu_flags_ppc_vsx || export NSS_DISABLE_CRYPTO_VSX=1
+			;;
+	esac
+
+	use cpu_flags_x86_avx2 || export NSS_DISABLE_AVX2=1
+	use cpu_flags_x86_sse3 || export NSS_DISABLE_SSE3=1
+
+	local d
+
+	# Build the host tools first.
+	LDFLAGS="${BUILD_LDFLAGS}" \
+	XCFLAGS="${BUILD_CFLAGS}" \
+	NSPR_LIB_DIR="${T}/fakedir" \
+	emake -C coreconf \
+		CC="$(tc-getBUILD_CC)" \
+			${buildbits-${mybits}}
+	makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
+
+	# Then build the target tools.
+	for d in . lib/dbm ; do
+		CPPFLAGS="${myCPPFLAGS}" \
+		XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		NSPR_LIB_DIR="${T}/fakedir" \
+		emake "${makeargs[@]}" -C ${d} OS_TEST="$(nssarch)"
+	done
+}
+
+multilib_src_test() {
+	einfo "Tests can take a *long* time, especially on a multilib system."
+	einfo "30-45+ minutes per lib configuration. Bug #852755"
+
+	# https://www.linuxfromscratch.org/blfs/view/svn/postlfs/nss.html
+	# https://firefox-source-docs.mozilla.org/security/nss/legacy/nss_sources_building_testing/index.html#running_the_nss_test_suite
+	# https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html (older)
+	export BUILD_OPT=1
+	export HOST="localhost"
+	export DOMSUF="localdomain"
+	export USE_IP=TRUE
+	export IP_ADDRESS="127.0.0.1"
+
+	# Only run the standard cycle instead of full, reducing testing time from 45 minutes to 15
+	# per lib implementation.
+	export NSS_CYCLES=standard
+
+	NSINSTALL="${PWD}/$(find -type f -name nsinstall)"
+
+	cd "${BUILD_DIR}"/tests || die
+	# Hack to get current objdir (prefixed dir where built binaries are)
+	# Without this, at least multilib tests go wrong when building the amd64 variant
+	# after x86.
+	local objdir=$(find "${BUILD_DIR}"/dist -maxdepth 1 -iname Linux* | rev | cut -d/ -f1 | rev)
+
+	# Can tweak to a subset of tests in future if we need to, but would prefer not
+	OBJDIR="${objdir}" DIST="${BUILD_DIR}/dist" MOZILLA_ROOT="${BUILD_DIR}" ./all.sh || die
+}
+
+# Altering these 3 libraries breaks the CHK verification.
+# All of the following cause it to break:
+# - stripping
+# - prelink
+# - ELF signing
+# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
+# Either we have to NOT strip them, or we have to forcibly resign after
+# stripping.
+#local_libdir="$(get_libdir)"
+#export STRIP_MASK="
+#	*/${local_libdir}/libfreebl3.so*
+#	*/${local_libdir}/libnssdbm3.so*
+#	*/${local_libdir}/libsoftokn3.so*"
+
+export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
+
+generate_chk() {
+	local shlibsign="$1"
+	local libdir="$2"
+	einfo "Resigning core NSS libraries for FIPS validation"
+	shift 2
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libname=lib${i}.so
+		local chkname=lib${i}.chk
+		"${shlibsign}" \
+			-i "${libdir}"/${libname} \
+			-o "${libdir}"/${chkname}.tmp \
+		&& mv -f \
+			"${libdir}"/${chkname}.tmp \
+			"${libdir}"/${chkname} \
+		|| die "Failed to sign ${libname}"
+	done
+}
+
+cleanup_chk() {
+	local libdir="$1"
+	shift 1
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libfname="${libdir}/lib${i}.so"
+		# If the major version has changed, then we have old chk files.
+		[ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
+			&& rm -f "${libfname}.chk"
+	done
+}
+
+multilib_src_install() {
+	pushd dist >/dev/null || die
+
+	dodir /usr/$(get_libdir)
+	cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
+	local i
+	for i in crmf freebl nssb nssckfw ; do
+		cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
+	done
+
+	# Install nss-config and pkgconfig file
+	dodir /usr/bin
+	cp -L */bin/nss-config "${ED}"/usr/bin || die
+	dodir /usr/$(get_libdir)/pkgconfig
+	cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
+
+	# create an nss-softokn.pc from nss.pc for libfreebl and some private headers
+	# bug 517266
+	sed 	-e 's#Libs:#Libs: -lfreebl#' \
+		-e 's#Cflags:#Cflags: -I${includedir}/private#' \
+		*/lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
+		|| die "could not create nss-softokn.pc"
+
+	# all the include files
+	insinto /usr/include/nss
+	doins public/nss/*.{h,api}
+	insinto /usr/include/nss/private
+	doins private/nss/{blapi,alghmac,cmac}.h
+
+	popd >/dev/null || die
+
+	local f nssutils
+	# Always enabled because we need it for chk generation.
+	nssutils=( shlibsign )
+
+	if multilib_is_native_abi ; then
+		if use utils; then
+			# The tests we do not need to install.
+			#nssutils_test="bltest crmftest dbtest dertimetest
+			#fipstest remtest sdrtest"
+			# checkcert utils has been removed in nss-3.22:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
+			# https://hg.mozilla.org/projects/nss/rev/df1729d37870
+			# certcgi has been removed in nss-3.36:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
+			nssutils+=(
+				addbuiltin
+				atob
+				baddbdir
+				btoa
+				certutil
+				cmsutil
+				conflict
+				crlutil
+				derdump
+				digest
+				makepqg
+				mangle
+				modutil
+				multinit
+				nonspr10
+				ocspclnt
+				oidcalc
+				p7content
+				p7env
+				p7sign
+				p7verify
+				pk11mode
+				pk12util
+				pp
+				rsaperf
+				selfserv
+				signtool
+				signver
+				ssltap
+				strsclnt
+				symkeyutil
+				tstclnt
+				vfychain
+				vfyserv
+			)
+			# install man-pages for utils (bug #516810)
+			doman doc/nroff/*.1
+		fi
+		pushd dist/*/bin >/dev/null || die
+		for f in ${nssutils[@]}; do
+			dobin ${f}
+		done
+		popd >/dev/null || die
+	fi
+}
+
+pkg_postinst() {
+	multilib_pkg_postinst() {
+		# We must re-sign the libraries AFTER they are stripped.
+		local shlibsign="${EROOT}/usr/bin/shlibsign"
+		# See if we can execute it (cross-compiling & such). #436216
+		"${shlibsign}" -h >&/dev/null
+		if [[ $? -gt 1 ]] ; then
+			shlibsign="shlibsign"
+		fi
+		generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postinst
+}
+
+pkg_postrm() {
+	multilib_pkg_postrm() {
+		cleanup_chk "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postrm
+}
diff --git a/dev-libs/nss/nss-3.108.ebuild b/dev-libs/nss/nss-3.108.ebuild
new file mode 100644
index 000000000000..352be19c4d9a
--- /dev/null
+++ b/dev-libs/nss/nss-3.108.ebuild
@@ -0,0 +1,427 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic multilib toolchain-funcs multilib-minimal
+
+NSPR_VER="4.35"
+RTM_NAME="NSS_${PV//./_}_RTM"
+
+DESCRIPTION="Mozilla's Network Security Services library that implements PKI support"
+HOMEPAGE="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS"
+SRC_URI="https://archive.mozilla.org/pub/security/nss/releases/${RTM_NAME}/src/${P}.tar.gz
+	cacert? ( https://dev.gentoo.org/~juippis/mozilla/patchsets/nss-3.104-cacert-class1-class3.patch )"
+
+LICENSE="|| ( MPL-2.0 GPL-2 LGPL-2.1 )"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~x64-solaris"
+IUSE="cacert test test-full +utils cpu_flags_ppc_altivec cpu_flags_x86_avx2 cpu_flags_x86_sse3 cpu_flags_ppc_vsx"
+RESTRICT="!test? ( test )"
+
+REQUIRED_USE="test-full? ( test )"
+
+# pkg-config called by nss-config -> virtual/pkgconfig in RDEPEND
+RDEPEND="
+	>=dev-libs/nspr-${NSPR_VER}[${MULTILIB_USEDEP}]
+	>=dev-db/sqlite-3.8.2[${MULTILIB_USEDEP}]
+	>=sys-libs/zlib-1.2.8-r1[${MULTILIB_USEDEP}]
+	virtual/pkgconfig
+"
+DEPEND="${RDEPEND}"
+BDEPEND="dev-lang/perl"
+
+S="${WORKDIR}/${P}/${PN}"
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/nss-config
+)
+
+PATCHES=(
+	"${FILESDIR}"/nss-3.103-gentoo-fixes-add-pkgconfig-files.patch
+	"${FILESDIR}"/nss-3.21-gentoo-fixup-warnings.patch
+	"${FILESDIR}"/nss-3.87-use-clang-as-bgo892686.patch
+)
+
+src_prepare() {
+	default
+
+	if use cacert ; then
+		eapply -p2 "${DISTDIR}"/nss-3.104-cacert-class1-class3.patch
+	fi
+
+	pushd coreconf >/dev/null || die
+	# hack nspr paths
+	echo 'INCLUDES += -I$(DIST)/include/dbm' \
+		>> headers.mk || die "failed to append include"
+
+	# modify install path
+	sed -e '/CORE_DEPTH/s:SOURCE_PREFIX.*$:SOURCE_PREFIX = $(CORE_DEPTH)/dist:' \
+		-i source.mk || die
+
+	# Respect LDFLAGS
+	sed -i -e 's/\$(MKSHLIB) -o/\$(MKSHLIB) \$(LDFLAGS) -o/g' rules.mk
+
+	# Workaround make-4.4's change to sub-make, bmo#1800237, bgo#882069
+	sed -i -e "s/^CPU_TAG = _.*/CPU_TAG = _$(nssarch)/" Linux.mk || die
+
+	popd >/dev/null || die
+
+	# Fix pkgconfig file for Prefix
+	sed -i -e "/^PREFIX =/s:= /usr:= ${EPREFIX}/usr:" \
+		config/Makefile || die
+
+	# use host shlibsign if need be #436216
+	if tc-is-cross-compiler ; then
+		sed -i \
+			-e 's:"${2}"/shlibsign:shlibsign:' \
+			cmd/shlibsign/sign.sh || die
+	fi
+
+	# dirty hack
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../freebl/\$(OBJDIR):" \
+		lib/ssl/config.mk || die
+	sed -i -e "/CRYPTOLIB/s:\$(SOFTOKEN_LIB_DIR):../../lib/freebl/\$(OBJDIR):" \
+		cmd/platlibs.mk || die
+
+	multilib_copy_sources
+
+	strip-flags
+}
+
+multilib_src_configure() {
+	# Ensure we stay multilib aware
+	sed -i -e "/@libdir@/ s:lib64:$(get_libdir):" config/Makefile || die
+}
+
+nssarch() {
+	# Most of the arches are the same as $ARCH
+	local t=${1:-${CHOST}}
+	case ${t} in
+		*86*-pc-solaris2*) echo "i86pc"   ;;
+		aarch64*)          echo "aarch64" ;;
+		hppa*)             echo "parisc"  ;;
+		i?86*)             echo "i686"    ;;
+		x86_64*)           echo "x86_64"  ;;
+		*)                 tc-arch ${t}   ;;
+	esac
+}
+
+nssbits() {
+	local cc cppflags="${1}CPPFLAGS" cflags="${1}CFLAGS"
+	if [[ ${1} == BUILD_ ]]; then
+		cc=$(tc-getBUILD_CC)
+	else
+		cc=$(tc-getCC)
+	fi
+	# TODO: Port this to toolchain-funcs tc-get-ptr-size/tc-get-build-ptr-size
+	echo > "${T}"/test.c || die
+	${cc} ${!cppflags} ${!cflags} -fno-lto -c "${T}"/test.c -o "${T}/${1}test.o" || die
+	case $(file -S "${T}/${1}test.o") in
+		*32-bit*x86-64*) echo USE_X32=1;;
+		*64-bit*|*ppc64*|*x86_64*) echo USE_64=1;;
+		*32-bit*|*ppc*|*i386*) ;;
+		*) die "Failed to detect whether ${cc} builds 64bits or 32bits, disable distcc if you're using it, please";;
+	esac
+}
+
+multilib_src_compile() {
+	# use ABI to determine bit'ness, or fallback if unset
+	local buildbits mybits
+	case "${ABI}" in
+		n32) mybits="USE_N32=1";;
+		x32) mybits="USE_X32=1";;
+		s390x|*64) mybits="USE_64=1";;
+		${DEFAULT_ABI})
+			einfo "Running compilation test to determine bit'ness"
+			mybits=$(nssbits)
+			;;
+	esac
+	# bitness of host may differ from target
+	if tc-is-cross-compiler; then
+		buildbits=$(nssbits BUILD_)
+	fi
+
+	local makeargs=(
+		CC="$(tc-getCC)"
+		CCC="$(tc-getCXX)"
+		AR="$(tc-getAR) rc \$@"
+		RANLIB="$(tc-getRANLIB)"
+		OPTIMIZER=
+		${mybits}
+		disable_ckbi=0
+	)
+
+	# Take care of nspr settings #436216
+	local myCPPFLAGS="${CPPFLAGS} $($(tc-getPKG_CONFIG) nspr --cflags)"
+	unset NSPR_INCLUDE_DIR
+
+	export NSS_ALLOW_SSLKEYLOGFILE=1
+	export NSS_ENABLE_WERROR=0 #567158
+	export BUILD_OPT=1
+	export NSS_USE_SYSTEM_SQLITE=1
+	export NSDISTMODE=copy
+	export FREEBL_NO_DEPEND=1
+	export FREEBL_LOWHASH=1
+	export NSS_SEED_ONLY_DEV_URANDOM=1
+	export USE_SYSTEM_ZLIB=1
+	export ZLIB_LIBS=-lz
+	export ASFLAGS=""
+	# Fix build failure on arm64
+	export NS_USE_GCC=1
+	# Detect compiler type and set proper environment value
+	if tc-is-gcc; then
+		export CC_IS_GCC=1
+	elif tc-is-clang; then
+		export CC_IS_CLANG=1
+	fi
+
+	export NSS_DISABLE_GTESTS=$(usex !test 1 0)
+
+	# Include exportable custom settings defined by users, #900915
+	# Two examples uses:
+	#   EXTRA_NSSCONF="MYONESWITCH=1"
+	#   EXTRA_NSSCONF="MYVALUE=0 MYOTHERVALUE=1 MYTHIRDVALUE=1"
+	# e.g.
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0"
+	# or
+	#   EXTRA_NSSCONF="NSS_ALLOW_SSLKEYLOGFILE=0 NSS_ENABLE_WERROR=1"
+	# etc.
+	if [[ -n "${EXTRA_NSSCONF}" ]]; then
+		ewarn "EXTRA_NSSCONF applied, please disable custom settings before reporting bugs."
+		read -a myextranssconf <<< "${EXTRA_NSSCONF}"
+
+		for (( i=0; i<${#myextranssconf[@]}; i++ )); do
+			export "${myextranssconf[$i]}"
+			echo "exported ${myextranssconf[$i]}"
+		done
+	fi
+
+	# explicitly disable altivec/vsx if not requested
+	# https://bugs.gentoo.org/789114
+	case ${ARCH} in
+		ppc*)
+			use cpu_flags_ppc_altivec || export NSS_DISABLE_ALTIVEC=1
+			use cpu_flags_ppc_vsx || export NSS_DISABLE_CRYPTO_VSX=1
+			;;
+	esac
+
+	use cpu_flags_x86_avx2 || export NSS_DISABLE_AVX2=1
+	use cpu_flags_x86_sse3 || export NSS_DISABLE_SSE3=1
+
+	local d
+
+	# Build the host tools first.
+	LDFLAGS="${BUILD_LDFLAGS}" \
+	XCFLAGS="${BUILD_CFLAGS}" \
+	NSPR_LIB_DIR="${T}/fakedir" \
+	emake -C coreconf \
+		CC="$(tc-getBUILD_CC)" \
+			${buildbits-${mybits}}
+	makeargs+=( NSINSTALL="${PWD}/$(find -type f -name nsinstall)" )
+
+	# Then build the target tools.
+	for d in . lib/dbm ; do
+		CPPFLAGS="${myCPPFLAGS}" \
+		XCFLAGS="${CFLAGS} ${CPPFLAGS}" \
+		NSPR_LIB_DIR="${T}/fakedir" \
+		emake "${makeargs[@]}" -C ${d} OS_TEST="$(nssarch)"
+	done
+}
+
+multilib_src_test() {
+	einfo "Tests can take a *long* time, especially on a multilib system."
+	einfo "~10 minutes per lib configuration with only 'standard' tests,"
+	einfo "~40 minutes per lib configuration with 'full' tests. Bug #852755"
+
+	# https://www.linuxfromscratch.org/blfs/view/svn/postlfs/nss.html
+	# https://firefox-source-docs.mozilla.org/security/nss/legacy/nss_sources_building_testing/index.html#running_the_nss_test_suite
+	# https://www-archive.mozilla.org/projects/security/pki/nss/testnss_32.html (older)
+	export BUILD_OPT=1
+	export HOST="localhost"
+	export DOMSUF="localdomain"
+	export USE_IP=TRUE
+	export IP_ADDRESS="127.0.0.1"
+
+	# Only run the standard cycle instead of full, reducing testing time from 45 minutes to 15
+	# per lib implementation.
+	if use test-full ; then
+		# export NSS_CYCLES="standard pkix sharedb"
+		:;
+	else
+		export NSS_CYCLES="standard"
+	fi
+
+	NSINSTALL="${PWD}/$(find -type f -name nsinstall)"
+
+	cd "${BUILD_DIR}"/tests || die
+	# Hack to get current objdir (prefixed dir where built binaries are)
+	# Without this, at least multilib tests go wrong when building the amd64 variant
+	# after x86.
+	local objdir=$(find "${BUILD_DIR}"/dist -maxdepth 1 -iname Linux* | rev | cut -d/ -f1 | rev)
+
+	# Can tweak to a subset of tests in future if we need to, but would prefer not
+	OBJDIR="${objdir}" DIST="${BUILD_DIR}/dist" MOZILLA_ROOT="${BUILD_DIR}" ./all.sh || die
+}
+
+# Altering these 3 libraries breaks the CHK verification.
+# All of the following cause it to break:
+# - stripping
+# - prelink
+# - ELF signing
+# http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html
+# Either we have to NOT strip them, or we have to forcibly resign after
+# stripping.
+#local_libdir="$(get_libdir)"
+#export STRIP_MASK="
+#	*/${local_libdir}/libfreebl3.so*
+#	*/${local_libdir}/libnssdbm3.so*
+#	*/${local_libdir}/libsoftokn3.so*"
+
+export NSS_CHK_SIGN_LIBS="freebl3 nssdbm3 softokn3"
+
+generate_chk() {
+	local shlibsign="$1"
+	local libdir="$2"
+	einfo "Resigning core NSS libraries for FIPS validation"
+	shift 2
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libname=lib${i}.so
+		local chkname=lib${i}.chk
+		"${shlibsign}" \
+			-i "${libdir}"/${libname} \
+			-o "${libdir}"/${chkname}.tmp \
+		&& mv -f \
+			"${libdir}"/${chkname}.tmp \
+			"${libdir}"/${chkname} \
+		|| die "Failed to sign ${libname}"
+	done
+}
+
+cleanup_chk() {
+	local libdir="$1"
+	shift 1
+	local i
+	for i in ${NSS_CHK_SIGN_LIBS} ; do
+		local libfname="${libdir}/lib${i}.so"
+		# If the major version has changed, then we have old chk files.
+		[ ! -f "${libfname}" -a -f "${libfname}.chk" ] \
+			&& rm -f "${libfname}.chk"
+	done
+}
+
+multilib_src_install() {
+	pushd dist >/dev/null || die
+
+	dodir /usr/$(get_libdir)
+	cp -L */lib/*$(get_libname) "${ED}"/usr/$(get_libdir) || die "copying shared libs failed"
+	local i
+	for i in crmf freebl nssb nssckfw ; do
+		cp -L */lib/lib${i}.a "${ED}"/usr/$(get_libdir) || die "copying libs failed"
+	done
+
+	# Install nss-config and pkgconfig file
+	dodir /usr/bin
+	cp -L */bin/nss-config "${ED}"/usr/bin || die
+	dodir /usr/$(get_libdir)/pkgconfig
+	cp -L */lib/pkgconfig/nss.pc "${ED}"/usr/$(get_libdir)/pkgconfig || die
+
+	# create an nss-softokn.pc from nss.pc for libfreebl and some private headers
+	# bug 517266
+	sed -e 's#Libs:#Libs: -lfreebl#' \
+		-e 's#Cflags:#Cflags: -I${includedir}/private#' \
+		*/lib/pkgconfig/nss.pc >"${ED}"/usr/$(get_libdir)/pkgconfig/nss-softokn.pc \
+		|| die "could not create nss-softokn.pc"
+
+	# all the include files
+	insinto /usr/include/nss
+	doins public/nss/*.{h,api}
+	insinto /usr/include/nss/private
+	doins private/nss/{blapi,alghmac,cmac}.h
+
+	popd >/dev/null || die
+
+	local f nssutils
+	# Always enabled because we need it for chk generation.
+	nssutils=( shlibsign )
+
+	if multilib_is_native_abi ; then
+		if use utils; then
+			# The tests we do not need to install.
+			#nssutils_test="bltest crmftest dbtest dertimetest
+			#fipstest remtest sdrtest"
+			# checkcert utils has been removed in nss-3.22:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1187545
+			# https://hg.mozilla.org/projects/nss/rev/df1729d37870
+			# certcgi has been removed in nss-3.36:
+			# https://bugzilla.mozilla.org/show_bug.cgi?id=1426602
+			nssutils+=(
+				addbuiltin
+				atob
+				baddbdir
+				btoa
+				certutil
+				cmsutil
+				conflict
+				crlutil
+				derdump
+				digest
+				makepqg
+				mangle
+				modutil
+				multinit
+				nonspr10
+				ocspclnt
+				oidcalc
+				p7content
+				p7env
+				p7sign
+				p7verify
+				pk11mode
+				pk12util
+				pp
+				rsaperf
+				selfserv
+				signtool
+				signver
+				ssltap
+				strsclnt
+				symkeyutil
+				tstclnt
+				vfychain
+				vfyserv
+			)
+			# install man-pages for utils (bug #516810)
+			doman doc/nroff/*.1
+		fi
+		pushd dist/*/bin >/dev/null || die
+		for f in ${nssutils[@]}; do
+			dobin ${f}
+		done
+		popd >/dev/null || die
+	fi
+}
+
+pkg_postinst() {
+	multilib_pkg_postinst() {
+		# We must re-sign the libraries AFTER they are stripped.
+		local shlibsign="${EROOT}/usr/bin/shlibsign"
+		# See if we can execute it (cross-compiling & such). #436216
+		"${shlibsign}" -h >&/dev/null
+		if [[ $? -gt 1 ]] ; then
+			shlibsign="shlibsign"
+		fi
+		generate_chk "${shlibsign}" "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postinst
+}
+
+pkg_postrm() {
+	multilib_pkg_postrm() {
+		cleanup_chk "${EROOT}"/usr/$(get_libdir)
+	}
+
+	multilib_foreach_abi multilib_pkg_postrm
+}