gentoo resync : 02.09.2020

15 files changed, 245 insertions, 66 deletions

diff --git a/kde-apps/Manifest.gz b/kde-apps/Manifest.gz
index 0d3688384187..4a79b3bcf54c 100644
--- a/kde-apps/Manifest.gz
+++ b/kde-apps/Manifest.gz
diff --git a/kde-apps/cantor/Manifest b/kde-apps/cantor/Manifest
index 210261dd9dbe..13b0bec68d26 100644
--- a/kde-apps/cantor/Manifest
+++ b/kde-apps/cantor/Manifest
@@ -1,5 +1,5 @@
 DIST cantor-20.04.3.tar.xz 9029068 BLAKE2B c5b436304d3aa84150a0994d556318600f73ccb606b59fc67d8476828c356f54d64cda85f781c9c939403b0bb6808e2a943d37ad306fbc751800944ad27e74f4 SHA512 07351d8b4b72653394a337bc3ae5c8f8c669dd8cd66f4cf9d41bbdd25b47a8b3666f79580e319ef56c878ab626ce959d825b4a34243c5f639de96674a1bc111d
 DIST cantor-20.08.0.tar.xz 9078720 BLAKE2B e630d3d6fbd24b67927dcc7b4480e6e454dff00a8bcbe9ed5d42211b6f91bc826e8be4d4c2f02ec517aea0d61500b438c79b2994fe24431eb8fdc6bf9b75af5d SHA512 2b73804e30541a22f5eb1f74d82d44918c7340477219392094849fd0c9530b3ca227a46ed2a75b61ce01bb52eb95f4852c9340101c199bdad040efe74988b578
-EBUILD cantor-20.04.3.ebuild 3185 BLAKE2B 8a907fad33afbf70c9a427e5293425b22e5e69c7fac57bc8ea40022d9849836583c5bb2ffe27008302dbdae3c56a01bf5752c614045b9d65a89651d5d50b1ba2 SHA512 76d36c6f4aa7434bd36c8d448c08a2d1410e20306a5778428685afb5748f987c77043a9bd86dec6959fceaf607e42bdec74262bb720c14f9cee3d4530dabb3e3
+EBUILD cantor-20.04.3-r1.ebuild 3208 BLAKE2B 4f898e218a51e89ac90d09a049b293d1754853b2eaee14efbeb889f9bc10e1651873832eb9243c027f00a11abff6147f5bc97695cadf78d234ea5b3a46486c88 SHA512 4b451a499178fd8efc23455f2ef344f6f3fba7d541c2401c798a905479c2d853bb463bc1a7f801c0edf93d90ee98e6149423e52da843b012eb681d767c281989
 EBUILD cantor-20.08.0.ebuild 3176 BLAKE2B 2eaa47f428afda4d27748e50e6a833d408fa5d34a299d5e487ec9360f554e44c4ee9cb8773c9679def4ad6c2be8131a2674b6bb994296715fee23b1a86eeb85a SHA512 af80c023b73a93d816e1e66da61737ef6d24a32e2ff448fc116551c5b50c6fc3bfdfd139371a5d93b9732578a66fc3204b7f52cf0ac8883aeedeb8fd2c8d12b6
 MISC metadata.xml 581 BLAKE2B 7cfc048a2cf032149544315ef1f9925a2a98908f052cbabc3964d97a76d4cb7f9d7b5adc0eacd10b6b85b5bb32546b005329940f092013b38840f8b4bd266baa SHA512 708d09a5c43b10211c5eeac3458c4803a9956e62b25c58f4bc360fb1037c83554780eae6c85fa8fbff9ddef12c2f48159308b8a29f1882ca066d87997c474e53
diff --git a/kde-apps/cantor/cantor-20.04.3.ebuild b/kde-apps/cantor/cantor-20.04.3-r1.ebuild
index 0980ffdc2956..fa579218619c 100644
--- a/kde-apps/cantor/cantor-20.04.3.ebuild
+++ b/kde-apps/cantor/cantor-20.04.3-r1.ebuild
@@ -25,6 +25,7 @@ REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
 
 # TODO Add Sage Mathematics Software backend (http://www.sagemath.org)
 DEPEND="
+	app-text/poppler[qt5]
 	>=dev-qt/qtgui-${QTMIN}:5
 	>=dev-qt/qtprintsupport-${QTMIN}:5
 	>=dev-qt/qtsvg-${QTMIN}:5
diff --git a/kde-apps/kanagram/Manifest b/kde-apps/kanagram/Manifest
index 504459c742fe..31675b646ab0 100644
--- a/kde-apps/kanagram/Manifest
+++ b/kde-apps/kanagram/Manifest
@@ -1,5 +1,5 @@
 DIST kanagram-20.04.3.tar.xz 8024860 BLAKE2B 59fa4cd16da329138baffdb6466868d4b24c843cc02367a424967dca0ece621c00b632f54694dc9c6149d5a980c4d0720d28182c5550f32e969c6880f5936c5f SHA512 e25f5bd4724b8f55ccf6b1fc71ab614ed7cb813c6558abafb0c1cfcc002d04edee856667f361c1a23b1297fc71b70af28069f320bab923403dcd56b48e2143a2
 DIST kanagram-20.08.0.tar.xz 8028540 BLAKE2B 593bf58971a86b2c09e46f5bf197ebd76f49e90e8877d6e4b11c0068215833fde7e938dd6a8d634c8e1333d2b77dd0ca7a1a5389ef3349a4a54533f65dd64edb SHA512 bac419fa08c27d964bda2e96544827728f9d66f5df0e5bca0df587464c6e32be9c50e023154e60022d4a6f6c8310c86f76f7b741e3788b95b05cb393ea717c57
-EBUILD kanagram-20.04.3.ebuild 1289 BLAKE2B 8967e9b0b1a143af29d826c096cdb98ce7451c55ce6a22f0cb8f891626c8c9d7e3b18ade3f6f4364e0d07193ad958aa68064efe4e3c2210507f7cf06b4f3a223 SHA512 c9c14d2dbf2c30c7a1b3c7df47b6cb2065e7fac810ba62a6cd09f94e7deb56aebb9cb306461fb8ddb1c1850bfa61124ddfd8a9a984965a77588ba235547eabcf
-EBUILD kanagram-20.08.0.ebuild 1292 BLAKE2B 9d43185b55bed78f49a23ba09467d2e352a5fdcd4326075e5d36d5c78577d72b6f981ed3a28a35341de3203648a6616c3ce661258621b421b049ff2d966b8617 SHA512 8be46f6b2486b3e103b4d7b3cd360593cf402f6556b5b6110a0f24e917146219a89a638fbe834babd17a948bd24d00e07346a94c24ecd5ef51c16bf8009bfb05
+EBUILD kanagram-20.04.3.ebuild 1356 BLAKE2B 3128f883fde697a1437ecdc5413b141f860131ba5a97c91a2c040d4df2ca54528e6b353ae6b52556ca86aa311c3d300e004d8c889b3ad5dfb764cad69d3fac8a SHA512 66a7f23ea3450d27e077afe85c750cbabcfd1db9b06d4d4dce4bd16d1e71c9c14e1dba4f97713c8ebaafd96697eb17bcc6cce05bddd97e699076ba62692bbf0a
+EBUILD kanagram-20.08.0.ebuild 1359 BLAKE2B 6ff7c907366768acc801e89062e81d7de13988b6e66632e5c532b11db28f26450f738ea291ff8ad5f0e1a2bcd67f10b6e0bd3edbfdd65005b9633a1c4d30c9e8 SHA512 69aee74ddfcb40c6b60348cf1557aa2d2061e56b9e150339a678cc34f19b0ea19a43f69e7d4bbd37d9befb6818109b44c31913bfa57f5baf62ea5d515e5198c1
 MISC metadata.xml 323 BLAKE2B 2ca644434642a951be5bd9043197403222aa71e73e2eaf896b61862bd9f955ba06490f20af1c9e3a4cbc9c83a33fecae0b1c58bc10aec95a93ee518bf3d4099a SHA512 873c648b3985a05f119b13bca927dc15bce53b193d7225e1129b4327629192a1b5c23f6137406b2944b01369f2a6d0cd71442f48a14e67758b54c3fb27f07b17
diff --git a/kde-apps/kanagram/kanagram-20.04.3.ebuild b/kde-apps/kanagram/kanagram-20.04.3.ebuild
index 49254fb640fc..2e2be545c5aa 100644
--- a/kde-apps/kanagram/kanagram-20.04.3.ebuild
+++ b/kde-apps/kanagram/kanagram-20.04.3.ebuild
@@ -42,6 +42,11 @@ RDEPEND="${DEPEND}
 	>=kde-apps/kdeedu-data-${PVCUT}:5
 "
 
+src_prepare() {
+	ecm_src_prepare
+	ecm_punt_bogus_dep Qt5 OpenGL
+}
+
 src_configure() {
 	local mycmakeargs=(
 		$(cmake_use_find_package speech Qt5TextToSpeech)
diff --git a/kde-apps/kanagram/kanagram-20.08.0.ebuild b/kde-apps/kanagram/kanagram-20.08.0.ebuild
index 06d8e5d78add..70a640b36eb0 100644
--- a/kde-apps/kanagram/kanagram-20.08.0.ebuild
+++ b/kde-apps/kanagram/kanagram-20.08.0.ebuild
@@ -42,6 +42,11 @@ RDEPEND="${DEPEND}
 	>=kde-apps/kdeedu-data-${PVCUT}:5
 "
 
+src_prepare() {
+	ecm_src_prepare
+	ecm_punt_bogus_dep Qt5 OpenGL
+}
+
 src_configure() {
 	local mycmakeargs=(
 		$(cmake_use_find_package speech Qt5TextToSpeech)
diff --git a/kde-apps/kget/Manifest b/kde-apps/kget/Manifest
index 1cf855d2752b..a2139ffa1359 100644
--- a/kde-apps/kget/Manifest
+++ b/kde-apps/kget/Manifest
@@ -1,5 +1,5 @@
 DIST kget-20.04.3.tar.xz 5238644 BLAKE2B 4ee1f615e8a176249b051a8c4d225a4dc4c7578a6e659cb96c19919b832ecd3af5922522987f6ced336886fb9186ef11904dd344d545561e8e1a975ca22de512 SHA512 55223e8e32392ea46dd50d90e532119fe8908641c6e49a29e62bd2f6a67db29940efc5e6344089c9e090810e9319399ce3dbdde61bb93f737591df03bfdf7f33
 DIST kget-20.08.0.tar.xz 5583492 BLAKE2B c80235d08365311f142852263fd860c62eeb6feae6b8a1294803e0bc6255d7532ee5a4a53d76d35bcef205a7c999827c547ef8dfe30154c110061b3ff414fd04 SHA512 9b6066c16e8edd32336395b74ee712851698e6033dfe0f24e10098b31e19b8008e84fc051d4a491a6b285c406f6bdc297dbbe69aa160d6cbc1f0fd56d24e761f
 EBUILD kget-20.04.3.ebuild 1997 BLAKE2B 8259975e4797c902214122cdf9959f5bc795ad60dff3bcf4655eb7f80af6d4d95348dd3bac3cfe6c31c9f8139ddee8f723d63ebd4e40136aaa143d24f5ca82db SHA512 330a1694688cbf10506df9def1d7c0db33e2deda745cd83dc043744771e4ecd358c88794c4769b84a62a23f36361335e072ac6dacd496dbc5fbce754cdd3a442
-EBUILD kget-20.08.0.ebuild 2000 BLAKE2B 3df68a0ab56a450c853f92ca8e8e1bb99526dc3707fded0942fc6838c211e254a204385bec2d308209f85a5af907e6f5507035d9713d9698f6f4df905297cb9c SHA512 c7f81daf7e83adced73c6418a8e4d09468c8e36c6b06fb5a2a8f8d4f18ed9576bfd7d38dc30d99c8f2a6982b952eb858d5118455e979396a247ca298f48ffe3b
+EBUILD kget-20.08.0.ebuild 2032 BLAKE2B 1f6c757f6ee73f20b8ad1ab38da4c4caa7ca2491bf41ba04183337651d458b138593e090ec4300d8a1e672d4be111b9c5f0116975b91457fe601628d41bd77ab SHA512 8907dc9ca560c3dee010a932fa6417cd188a0070d069f10ee6d11bd2f8491f153a38ec965bb76d2a5d5f7e075edcb2150f8a626ff2f22eadc2fdca3463c5af2c
 MISC metadata.xml 575 BLAKE2B bb45bf1f9dda42b69d9934b45343f36ad73c907eb7a408b41108237269467b9d77f0f65abfdf88cd9087c6f7d444814c76b0d5a4f65a333cc29908abcf7da50f SHA512 854827c48f8b6120747f6428d3ba98de77217c810664272d7e7732358eb5aef3fdeb6829f5be4cf9a2bf40fcffdcc7cb2aad2a7fedb5850c01237339b77ad000
diff --git a/kde-apps/kget/kget-20.08.0.ebuild b/kde-apps/kget/kget-20.08.0.ebuild
index a0a627fd08af..3d392408d98c 100644
--- a/kde-apps/kget/kget-20.08.0.ebuild
+++ b/kde-apps/kget/kget-20.08.0.ebuild
@@ -18,6 +18,8 @@ SLOT="5"
 KEYWORDS="~amd64 ~arm64 ~x86"
 IUSE="bittorrent gpg kde mms sqlite"
 
+RESTRICT+=" test" # bug 739670
+
 RDEPEND="
 	>=dev-qt/qtdbus-${QTMIN}:5
 	>=dev-qt/qtgui-${QTMIN}:5
diff --git a/kde-apps/kleopatra/Manifest b/kde-apps/kleopatra/Manifest
index b4cde40d2027..8ec75df64a61 100644
--- a/kde-apps/kleopatra/Manifest
+++ b/kde-apps/kleopatra/Manifest
@@ -1,5 +1,7 @@
+AUX kleopatra-20.04.3-CVE-2020-24972.patch 5485 BLAKE2B 1836b3783ddc67791e847f310da68837a5a5e244326514cadaea334788b1df44c2d0ab68482921f227343627b00421ef4566b79d8cba3bb2d6807e753f43ba62 SHA512 0eb8b7ce25e86e9e4733f9fe155cac62a4503db83f02f1bbb43c9c46af02c0a41cc842413f2a9d97b76e110fe2fd48cf55cf95a3be33042aba7167498cc16442
+AUX kleopatra-20.04.3-exec-w-double-dash.patch 4138 BLAKE2B 92b1512c437dce78efebf5b248fc6cb8fb2447fb37ee24aabc92a3c907f8af4bd025a6aceff2118518379ef3fde111d4d01b32b762626f380e626c3a099b58a5 SHA512 7ecc38876df91934412ea9c3a16a566d3454369504a0bbe0ff865cb5e6435a40e964d4ba49df9becee8a52d7964bf6b9f0a32d45473f9d084c831468db982df4
 DIST kleopatra-20.04.3.tar.xz 1935784 BLAKE2B 3c64c29762c06ce196149f0e9de3ec1a3c9970e2dce03dea600b4096da2100a1138548ddbc794bd0d47852e1b6e2ff962ec38f5b245a453f4a9953c1d846b909 SHA512 b72ffb37b3116525d8a531c056a0457e6fb3257081d639fc1c175c8dd4566e4f3c0989cfc696c43c92b630b43dcad90f667a9f3496fede0121065553041c554a
 DIST kleopatra-20.08.0.tar.xz 1936932 BLAKE2B 0f2d78b4f304c0ada1472671ede7898a502ff74576d820e937b39f1c454ad0a39748a26d11879202e4f0981f32f57e64fd5b7ed57d959af1d6ae6f49887d8b21 SHA512 2651432124a4327680a1c2cef0a6a06ba426c900cd8bfd90f9f56fdf0b234588be52e9c42351368a5009a441233fe5ede3a06e4273dd855793a3cba76806fd0e
-EBUILD kleopatra-20.04.3.ebuild 1491 BLAKE2B 635590513d36944ffa3a7026c7fe4fb2efb3b9a22bf24ee0b3448273d2abf7af5c91951ae1c5bdf2665c3fbbf68b0dcefd88a6242434c285cbcda61d00889f7b SHA512 3cf223f2e3ccf0a1d6ad3a383dd7bd193a508b29cabc381ddf73fefc3c00d9d852564ded72eba49d3a1e47b98af5c9a41f63a2a2ea644f29e6526cfa52d66742
+EBUILD kleopatra-20.04.3-r1.ebuild 1590 BLAKE2B 500d250a7ade1cf0883be418c53398704c48255ed9e1bc810d9ed509aef69aa361b88f9c2e764c02ac795d7298bb034836de61ca423987c42df88781f79f4703 SHA512 07fa72c5b06fde135f28f2e3d7e04213ed311ac81d311cc609a89e264b536ef2f0cdb24e62821e786f751214a2473166d05240379f63f6d87857eb3e599a11b9
 EBUILD kleopatra-20.08.0.ebuild 1494 BLAKE2B 365dfb25105e2193743aa8a47e97cec6595d1fc655f03e8cb2dbab0c0bbb92c3f8940b68793378c7ccc6400f5d718de7a83edc0f1b40b349de1e9d545b1f63ce SHA512 9c003dcf7fa6eae1b6d76d4ceece4fdd37b9bfc76e3904a5ada420b9e85faab68617b13b322d535a3c2ab9e92c4e267625e477f140fd16e5302b55c21d0ec507
 MISC metadata.xml 249 BLAKE2B ad415db89e5dee1627aa77f44ded9d4e1e5b8217d06c7ca25bbaa3fe92ce67c2b1090957c45a821b407d7927e5af798498aa6a5b903895ee1af8ee20a446c7f7 SHA512 76a5a340b13f0053ca3c5e94ed24380ea8d29b45ac8655419e22eaadb1e4a827c04d2e7e36b65145c4964e6526f656618fc6ac144e277ef53cb7373e6239e3c3
diff --git a/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch b/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch
new file mode 100644
index 000000000000..ebcbb232e08f
--- /dev/null
+++ b/kde-apps/kleopatra/files/kleopatra-20.04.3-CVE-2020-24972.patch
@@ -0,0 +1,110 @@
+From b4bd63c1739900d94c04da03045e9445a5a5f54b Mon Sep 17 00:00:00 2001
+From: Andre Heinecke <aheinecke@gnupg.org>
+Date: Tue, 7 Jul 2020 14:39:29 +0200
+Subject: [PATCH] Allow safe usage of query
+
+To allow secure usage of query and search the parameters are
+no longer parsed as value but instead of positional arguments.
+
+This allows us to register "kleoptra --query -- $1" as an
+URL handler for openpgp4fpr: without the risk of command
+line injection through an unsescaped query string.
+
+Similarly the double dash should be used for file handling
+to avoid command line injection through filenames.
+---
+ src/kleopatra_options.h      | 19 ++++++++++++++-----
+ src/kleopatraapplication.cpp | 25 ++++++++++++++-----------
+ 2 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/src/kleopatra_options.h b/src/kleopatra_options.h
+index 661c44d7..8ce7fccf 100644
+--- a/src/kleopatra_options.h
++++ b/src/kleopatra_options.h
+@@ -79,8 +79,7 @@ static void kleopatra_options(QCommandLineParser *parser)
+                                   << QStringLiteral("D"),
+                                   i18n("Decrypt and/or verify file(s)"))
+             << QCommandLineOption(QStringList() << QStringLiteral("search"),
+-                                  i18n("Search for a certificate on a keyserver"),
+-                                  QStringLiteral("search string"))
++                                  i18n("Search for a certificate on a keyserver"))
+             << QCommandLineOption(QStringList() << QStringLiteral("checksum"),
+                                   i18n("Create or check a checksum file"))
+             << QCommandLineOption(QStringList() << QStringLiteral("query")
+@@ -88,8 +87,7 @@ static void kleopatra_options(QCommandLineParser *parser)
+                                   i18nc("If a certificate is already known it shows the certificate details dialog."
+                                         "Otherwise it brings up the certificate search dialog.",
+                                         "Show details of a local certificate or search for it on a keyserver"
+-                                        " by fingerprint"),
+-                                  QStringLiteral("fingerprint"))
++                                        " by fingerprint"))
+             << QCommandLineOption(QStringList() << QStringLiteral("gen-key"),
+                                   i18n("Create a new key pair or certificate signing request"))
+             << QCommandLineOption(QStringLiteral("parent-windowid"),
+@@ -100,8 +98,19 @@ static void kleopatra_options(QCommandLineParser *parser)
+ 
+     parser->addOptions(options);
+ 
++    /* Security note: To avoid code execution by shared library injection
++     * through e.g. -platformpluginpath any external input should be seperated
++     * by a double dash -- this is why query / search uses positional arguments.
++     *
++     * For example on Windows there is an URLhandler for openpgp4fpr:
++     * be opened with Kleopatra's query function. And while a browser should
++     * urlescape such a query there might be tricks to inject a quote character
++     * and as such inject command line options for Kleopatra in an URL. */
+     parser->addPositionalArgument(QStringLiteral("files"),
+                                   i18n("File(s) to process"),
+-                                  QStringLiteral("[files..]"));
++                                  QStringLiteral("-- [files..]"));
++    parser->addPositionalArgument(QStringLiteral("query"),
++                                  i18n("String or Fingerprint for query and search"),
++                                  QStringLiteral("-- [query..]"));
+ }
+ #endif
+diff --git a/src/kleopatraapplication.cpp b/src/kleopatraapplication.cpp
+index 989f14b4..a8c5dd08 100644
+--- a/src/kleopatraapplication.cpp
++++ b/src/kleopatraapplication.cpp
+@@ -273,13 +273,18 @@ QString KleopatraApplication::newInstance(const QCommandLineParser &parser,
+ 
+     QStringList files;
+     const QDir cwd = QDir(workingDirectory);
+-    Q_FOREACH (const QString &file, parser.positionalArguments()) {
+-        // We do not check that file exists here. Better handle
+-        // these errors in the UI.
+-        if (QFileInfo(file).isAbsolute()) {
+-            files << file;
+-        } else {
+-            files << cwd.absoluteFilePath(file);
++    bool queryMode = parser.isSet(QStringLiteral("query")) || parser.isSet(QStringLiteral("search"));
++
++    // Query and Search treat positional arguments differently, see below.
++    if (!queryMode) {
++        Q_FOREACH (const QString &file, parser.positionalArguments()) {
++            // We do not check that file exists here. Better handle
++            // these errors in the UI.
++            if (QFileInfo(file).isAbsolute()) {
++                files << file;
++            } else {
++                files << cwd.absoluteFilePath(file);
++            }
+         }
+     }
+ 
+@@ -313,10 +318,8 @@ QString KleopatraApplication::newInstance(const QCommandLineParser &parser,
+ 
+     // Handle openpgp4fpr URI scheme
+     QString needle;
+-    if (parser.isSet(QStringLiteral("search"))) {
+-        needle = parser.value(QStringLiteral("search"));
+-    } else if (parser.isSet(QStringLiteral("query"))) {
+-        needle = parser.value(QStringLiteral("query"));
++    if (queryMode) {
++        needle = parser.positionalArguments().join(QLatin1Char(' '));
+     }
+     if (needle.startsWith(QLatin1String("openpgp4fpr:"))) {
+         needle.remove(0, 12);
+-- 
+GitLab
+
diff --git a/kde-apps/kleopatra/files/kleopatra-20.04.3-exec-w-double-dash.patch b/kde-apps/kleopatra/files/kleopatra-20.04.3-exec-w-double-dash.patch
new file mode 100644
index 000000000000..d5ba1236c2df
--- /dev/null
+++ b/kde-apps/kleopatra/files/kleopatra-20.04.3-exec-w-double-dash.patch
@@ -0,0 +1,108 @@
+From 9abdda396818842de1d9af9a153b66a1399f7c0f Mon Sep 17 00:00:00 2001
+From: Andre Heinecke <aheinecke@gnupg.org>
+Date: Tue, 7 Jul 2020 14:46:31 +0200
+Subject: [PATCH] Add double dash for exec command for files
+
+This prevents shenannigans with file names that might
+inject command line options.
+---
+ src/data/kleopatra_decryptverifyfiles.desktop   | 2 +-
+ src/data/kleopatra_decryptverifyfolders.desktop | 2 +-
+ src/data/kleopatra_import.desktop               | 2 +-
+ src/data/kleopatra_signencryptfiles.desktop     | 8 ++++----
+ src/data/kleopatra_signencryptfolders.desktop   | 4 ++--
+ 5 files changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/src/data/kleopatra_decryptverifyfiles.desktop b/src/data/kleopatra_decryptverifyfiles.desktop
+index 5f4832fe..1bd3200e 100644
+--- a/src/data/kleopatra_decryptverifyfiles.desktop
++++ b/src/data/kleopatra_decryptverifyfiles.desktop
+@@ -102,4 +102,4 @@ Name[x-test]=xxDecrypt/Verify Filexx
+ Name[zh_CN]=解密/验证文件
+ Name[zh_TW]=解密/檢查檔案
+ Icon=kleopatra
+-Exec=kleopatra --decrypt-verify %F
++Exec=kleopatra --decrypt-verify -- %F
+diff --git a/src/data/kleopatra_decryptverifyfolders.desktop b/src/data/kleopatra_decryptverifyfolders.desktop
+index 8b6af1e2..54644c8f 100644
+--- a/src/data/kleopatra_decryptverifyfolders.desktop
++++ b/src/data/kleopatra_decryptverifyfolders.desktop
+@@ -101,4 +101,4 @@ Name[x-test]=xxDecrypt/Verify All Files In Folderxx
+ Name[zh_CN]=文件夹中的全部解密/验证文件
+ Name[zh_TW]=解密/檢查所有資料夾中的檔案
+ Icon=kleopatra
+-Exec=kleopatra --decrypt-verify %F
++Exec=kleopatra --decrypt-verify -- %F
+diff --git a/src/data/kleopatra_import.desktop b/src/data/kleopatra_import.desktop
+index 2b886b24..8a99c81d 100644
+--- a/src/data/kleopatra_import.desktop
++++ b/src/data/kleopatra_import.desktop
+@@ -1,7 +1,7 @@
+ [Desktop Entry]
+ Type=Application
+ Icon=kleopatra
+-Exec=kleopatra --import-certificate %F
++Exec=kleopatra --import-certificate -- %F
+ MimeType=application/pkcs7-mime;application/x-x509-ca-cert;application/x-pkcs12;application/pgp-keys;
+ Categories=Qt;KDE;Utility;X-KDE-Utilities-PIM;
+ 
+diff --git a/src/data/kleopatra_signencryptfiles.desktop b/src/data/kleopatra_signencryptfiles.desktop
+index d3ea5f98..8656bccb 100644
+--- a/src/data/kleopatra_signencryptfiles.desktop
++++ b/src/data/kleopatra_signencryptfiles.desktop
+@@ -103,7 +103,7 @@ Name[x-test]=xxSign & Encrypt Filexx
+ Name[zh_CN]=签名并加密文件
+ Name[zh_TW]=簽署並加密檔案
+ Icon=kleopatra
+-Exec=kleopatra --encrypt-sign %F
++Exec=kleopatra --encrypt-sign -- %F
+ 
+ [Desktop Action kleoencryptfiles]
+ Name=Encrypt File
+@@ -159,7 +159,7 @@ Name[x-test]=xxEncrypt Filexx
+ Name[zh_CN]=加密文件
+ Name[zh_TW]=加密檔案
+ Icon=kleopatra
+-Exec=kleopatra --encrypt %F
++Exec=kleopatra --encrypt -- %F
+ 
+ [Desktop Action kleosignfilesopenpgp]
+ Name=OpenPGP-Sign File
+@@ -211,7 +211,7 @@ Name[x-test]=xxOpenPGP-Sign Filexx
+ Name[zh_CN]=OpenPGP 签名文件
+ Name[zh_TW]=OpenPGP─簽署檔案
+ Icon=kleopatra
+-Exec=kleopatra --openpgp --sign %F
++Exec=kleopatra --openpgp --sign -- %F
+ 
+ [Desktop Action kleosignfilescms]
+ Name=S/MIME-Sign File
+@@ -263,5 +263,5 @@ Name[x-test]=xxS/MIME-Sign Filexx
+ Name[zh_CN]=S/MIME 签名文件
+ Name[zh_TW]=S/MIME─簽署檔案
+ Icon=kleopatra
+-Exec=kleopatra --cms --sign %F
++Exec=kleopatra --cms --sign -- %F
+ 
+diff --git a/src/data/kleopatra_signencryptfolders.desktop b/src/data/kleopatra_signencryptfolders.desktop
+index 5ef802ce..b9146d5a 100644
+--- a/src/data/kleopatra_signencryptfolders.desktop
++++ b/src/data/kleopatra_signencryptfolders.desktop
+@@ -100,7 +100,7 @@ Name[x-test]=xxArchive, Sign && Encrypt Folderxx
+ Name[zh_CN]=归档、签名并加密文件夹
+ Name[zh_TW]=歸檔，簽署與加密資料夾
+ Icon=kleopatra
+-Exec=kleopatra --encrypt-sign %F
++Exec=kleopatra --encrypt-sign -- %F
+ 
+ [Desktop Action kleoencryptfolder]
+ Name=Archive && Encrypt Folder
+@@ -151,4 +151,4 @@ Name[x-test]=xxArchive && Encrypt Folderxx
+ Name[zh_CN]=归档并加密文件夹
+ Name[zh_TW]=歸檔並加密資料夾
+ Icon=kleopatra
+-Exec=kleopatra --encrypt %F
++Exec=kleopatra --encrypt -- %F
+-- 
+GitLab
+
diff --git a/kde-apps/kleopatra/kleopatra-20.04.3.ebuild b/kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild
index 3799bd46d123..57574a47f59b 100644
--- a/kde-apps/kleopatra/kleopatra-20.04.3.ebuild
+++ b/kde-apps/kleopatra/kleopatra-20.04.3-r1.ebuild
@@ -53,3 +53,8 @@ RDEPEND="${DEPEND}
 
 # tests completely broken, bug #641720
 RESTRICT+=" test"
+
+PATCHES=(
+	"${FILESDIR}/${P}-CVE-2020-24972.patch"
+	"${FILESDIR}/${P}-exec-w-double-dash.patch"
+)
diff --git a/kde-apps/yakuake/Manifest b/kde-apps/yakuake/Manifest
index 44ee9575d982..d7997e140aa8 100644
--- a/kde-apps/yakuake/Manifest
+++ b/kde-apps/yakuake/Manifest
@@ -1,7 +1,6 @@
 AUX yakuake-20.04.3-fix-fullscreen-mode-regression.patch 1256 BLAKE2B aba9e6e4be68bbf49050f5fd61ff28aed4e639dac28fbe2b2dd18ff62671984c388680215338c426175fbd59d6646d203d78cc76dc166c38a5df7f097a05ebb9 SHA512 8e5ac666093d6bf78467b78f750e317a5dd18f40cf5d9fc911a0a4e5fc34e0e92b692eaf6e61caf06c12c7e1b8be12fb8003fd60b757822b3ccd193c121f01a8
 DIST yakuake-20.04.3.tar.xz 374280 BLAKE2B aa53e81af0e77a74ac637d185108341b89ec82ff94dcbc3f3cb0a6a8916cb3b7bcd48bad4d127c073de7f6788a38ae7c8a8c4092aaa72ce9d405e7214ea7342a SHA512 a5b9b42b8fb47fe94c06cbdfc54683ae33ce9a84da3942efba1fee52e6103bd8ab60ef4bf46316793577813940250909fe74e722db77f57157e650612e592658
 DIST yakuake-20.08.0.tar.xz 380584 BLAKE2B 7685523c6b719f3c51cd12867a3b6089c823895033c8df6bb106256c846671575a9f60cd523fde6120851d064ada3be385c203b3e97e7c458fc5b0eab16cbfb9 SHA512 9f89bb7294e8c6fd022eeb6acc59e8766093b682108f42190b082ad3033e3a9832e8c2620e0948f1461d2d0a47fc585946e7c9b2e06e51e2666d6f391978fb48
-EBUILD yakuake-20.04.3-r1.ebuild 1649 BLAKE2B 5bbbecc21d8bf461f004a9b27b022f8909efd0155895b1642f4966fc096149949994579607e74f207433be08683bc651c970fb50047f1e33b4d94c4a0dfcd42d SHA512 503f8f3434f5717e2fa1eab9a64aa1c84941112a5106e331cd38752aaa0c5148a61f224fc166ccbdb8a9401c0ba05ff65a1328ad8050efe3cb46b3f9be5825f7
-EBUILD yakuake-20.04.3.ebuild 1565 BLAKE2B 5862fc864d4f3cc096c8df3e69664b95cd2d87705a5d24ae91589634fae7ef3f06631e05c866485dbc0cc9434f3c773b1f9a24dbc17ccf8ba5f83c8d43866e76 SHA512 a84c276f6d538c23bdcef719826a922ca8975b551dea4abfa8a09037dd11802308c37c50d70e9f3ab10ed008f2eebfbf75780c12ec62da9978f2be9ed607939a
+EBUILD yakuake-20.04.3-r1.ebuild 1647 BLAKE2B 5c62f1286f7345d41efb89ea1b73ee9e5d230bd85018851064bd4d279df63ea44b1d9c6124dfd68dbdd8e900acb30eb2a33d88d76c6fd656827a233b5010b582 SHA512 6e1bfc6048c7fa5fc6414b288c3222b94a6767f631b9a70649c5d47137473830c559eaa69b402299396ed887d0c9bee5eb077301e26be2b0f8cc50f77b638335
 EBUILD yakuake-20.08.0.ebuild 1568 BLAKE2B e339e69435f20f11922c82a3210a5ea30ce02338eb974f7c7aa30ef68e29ffdc94067543cd073ec2a1f9483192fc0cd0ba33a949665e63ae34d9ec32f996ff74 SHA512 828815417f89ed05b3f34bdf07ddbeeba2d5c94e14c236bdb344cd1d3e6b56ee6c41b82639bc68172e15210585db03928eb82ebf30342a10e00104791fa53c5d
 MISC metadata.xml 661 BLAKE2B c0ff7bbfa76614ec0d6ed52ca7af363bf4c441cc06343c613ba6100a68269915d71dea39329d02fc95384ce71331bb367d4cddfdc0c560ea2748843ea7c31c8a SHA512 a842fdcbb48892a13e74eacd0aca111cbba02bd4c43fb9544ed4e4a9c72d122a3190f0090e8b7f63cceba1d449fb7bf629954a9e60dd541e40908818478fcb13
diff --git a/kde-apps/yakuake/yakuake-20.04.3-r1.ebuild b/kde-apps/yakuake/yakuake-20.04.3-r1.ebuild
index 8f4fb0b6254f..1561b1597e60 100644
--- a/kde-apps/yakuake/yakuake-20.04.3-r1.ebuild
+++ b/kde-apps/yakuake/yakuake-20.04.3-r1.ebuild
@@ -13,7 +13,7 @@ HOMEPAGE="https://kde.org/applications/system/org.kde.yakuake"
 
 LICENSE="GPL-2 LGPL-2"
 SLOT="5"
-KEYWORDS="~amd64 arm64 ~ppc64 ~x86"
+KEYWORDS="amd64 arm64 ~ppc64 x86"
 IUSE="absolute-position X"
 
 DEPEND="
diff --git a/kde-apps/yakuake/yakuake-20.04.3.ebuild b/kde-apps/yakuake/yakuake-20.04.3.ebuild
deleted file mode 100644
index 1501ddff9a6c..000000000000
--- a/kde-apps/yakuake/yakuake-20.04.3.ebuild
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PVCUT=$(ver_cut 1-3)
-KFMIN=5.70.0
-QTMIN=5.14.2
-inherit ecm kde.org
-
-DESCRIPTION="Quake-style terminal emulator based on konsole"
-HOMEPAGE="https://kde.org/applications/system/org.kde.yakuake"
-
-LICENSE="GPL-2 LGPL-2"
-SLOT="5"
-KEYWORDS="amd64 arm64 ~ppc64 x86"
-IUSE="absolute-position X"
-
-DEPEND="
-	>=dev-qt/qtdbus-${QTMIN}:5
-	>=dev-qt/qtgui-${QTMIN}:5
-	>=dev-qt/qtsvg-${QTMIN}:5
-	>=dev-qt/qtwidgets-${QTMIN}:5
-	>=kde-apps/konsole-${PVCUT}:5
-	>=kde-frameworks/karchive-${KFMIN}:5
-	>=kde-frameworks/kconfig-${KFMIN}:5
-	>=kde-frameworks/kconfigwidgets-${KFMIN}:5
-	>=kde-frameworks/kcoreaddons-${KFMIN}:5
-	>=kde-frameworks/kcrash-${KFMIN}:5
-	>=kde-frameworks/kdbusaddons-${KFMIN}:5
-	>=kde-frameworks/kglobalaccel-${KFMIN}:5
-	>=kde-frameworks/ki18n-${KFMIN}:5
-	>=kde-frameworks/kiconthemes-${KFMIN}:5
-	>=kde-frameworks/kio-${KFMIN}:5
-	>=kde-frameworks/knewstuff-${KFMIN}:5
-	>=kde-frameworks/knotifications-${KFMIN}:5
-	>=kde-frameworks/knotifyconfig-${KFMIN}:5
-	>=kde-frameworks/kparts-${KFMIN}:5
-	>=kde-frameworks/kservice-${KFMIN}:5
-	>=kde-frameworks/kwidgetsaddons-${KFMIN}:5
-	>=kde-frameworks/kwindowsystem-${KFMIN}:5
-	>=kde-frameworks/kxmlgui-${KFMIN}:5
-	absolute-position? ( >=kde-frameworks/kwayland-${KFMIN}:5 )
-	X? (
-		>=dev-qt/qtx11extras-${QTMIN}:5
-		x11-libs/libX11
-	)
-"
-RDEPEND="${DEPEND}"
-
-src_configure() {
-	local mycmakeargs=(
-		$(cmake_use_find_package absolute-position KF5Wayland)
-		$(cmake_use_find_package X X11)
-	)
-
-	ecm_src_configure
-}