gentoo resync : 25.11.2020

5 files changed, 591 insertions, 3 deletions

diff --git a/net-misc/curl/Manifest b/net-misc/curl/Manifest
index 4a078afa15a5..81ddcd22000e 100644
--- a/net-misc/curl/Manifest
+++ b/net-misc/curl/Manifest
@@ -4,8 +4,11 @@ AUX curl-respect-cflags-3.patch 406 BLAKE2B 1b533144858aff5566150c4a2648ad2e48e8
 DIST curl-7.71.0.tar.xz 2379056 BLAKE2B 50d7369e4335823c3032b8801b270f7d8e687b0552f25ed5f9752549483cf68870e0422132ecf86e756e1c7c27cdf60048a7765850608c3a1b734cffb1fe7b99 SHA512 f1ea045f23b6a7e2c84ea83954d3299c612f57c3b1e5fee0b39493dc92fc4e95e7af2a5424c2e5bc480659e80cf1adce1fc528fc816f8ff2d0e7bfcfe4c5830a
 DIST curl-7.71.1.tar.xz 2387660 BLAKE2B 47b3a4704ae8b09b37f7a9d8850fd7d692d91db3dd4ad776aad9a57d0162e0f4091e0387a850eb048f834e6dfee5bcb36da56493a106696c72072c612b47f623 SHA512 631e0ee8562e5029fe022bfab4222836a3e6d666e82e2bfbd78311fe5985105218a36d1ea68c93472fc57a12b713957a3bcca6e385eda4e58a47ca8d5d50265b
 DIST curl-7.72.0.tar.xz 2390040 BLAKE2B 8f20efe7255ffe6d68619645b634b9cb10557ba0ca458904e99105133fb54cfafe4cafa0e7a1c5e20bbf5b5d24c8c44670cb5ddc1a2035ca43eadd24899ea953 SHA512 e5025a32eac6108ccb13d1fcce9c2de28b3a6d6e9a258a647c4be45d71718f75653e1ccd477ef5f29242a15588255c4ef43fe47bf9908b938b6769fccfaac107
+DIST curl-7.73.0.tar.xz 2394228 BLAKE2B 33ce983878dd3154d5e3e44b2b64a02e47a3faac77615db1c67cc6617495c16f40a36406e1627e2cef62bc1a01cdd0c5ae47ccc6cc4265257fc47b2f34eaac65 SHA512 95330bac2d6bc5306d47723b3c7bdb754fabe2ba2df7b2a8027453a40286f1c7caaee69333f0715e59fbc7fdf09080968ea624398c995cabf3d57493973867bd
 EBUILD curl-7.71.0.ebuild 7692 BLAKE2B a2114c226d010472ced5ed0a4d25feeba6d820defc786c49022c74dd0eb72a56015086fb549d3187dcd01f6cead02da6f9668a3442c833a6f52b8e76419d5bae SHA512 0d10f62aeb9a91c6199034060295064621ece66181019b7530b98d38bd36d31c0d404d1a92a4245cab7386363c84c6bf3c054b977ea07e3a8fb5aa541b877f28
 EBUILD curl-7.71.1-r1.ebuild 8734 BLAKE2B 748f1f1564ee84bd716679a8b336f324d325c51e74efe8db34797a9deecbc153a4158fb5c563076f5b8459798b9a3ebd4f2a6851ea71d9fa2f5da40de716d5cc SHA512 dbf4dc6fcb9ca884d36373661242558ba2240f6d9b88c1cf1a4285cebd06425d3fce7c38f52eb3b1cbf832e3cd3712d76d214824fefb6040168f9475081a00a6
 EBUILD curl-7.71.1.ebuild 7695 BLAKE2B d47481a0edef1362479059a346768e2c2ad9a9059591e8f73c69bb545cf5c825b04a7049ba36849a34dbf8ecb8d8d41fd2da8ebc5e497b9b8b8da2568abc34a7 SHA512 8a7cf22108e3bffdc3f89adcf3d292f62200e562596253c920890356ff82f697a391f17f8a18f02bda4678e224d2927b42e969887975253245af5a7d972375a2
-EBUILD curl-7.72.0.ebuild 8727 BLAKE2B da3c0ca477e9795975e943f0fbfd3bd4f8e94a166de3edfb4107a9872fdfbff8e26cc470e2c68380ab0a9c7f8a6f53b8fcae9f830e1777dd383a5c9019b737ac SHA512 23acf3454edc0267748b54498d3689163e9edc3288e9038176fd862763210ebc1fb2bb139c138170565e6c16f7e6aead92e41531b36cf2191466798cde79b062
-MISC metadata.xml 1916 BLAKE2B 8907ea9d5ded3fadb233b056b41b3daeb00bba44caa631a77fbd07215a5a9fd1bf47b4751485a59c6b41684e4b14e0abb99b5d79566e2dc8f21a3d749f0d5d20 SHA512 8e52e382804b4d2f10de345240f7cb46203e454dd3cab31ff92be3d2d9ce2d1ae8f36d95546061208205c330c58ece1d19fb08c257da683342b484b2e53f3ed1
+EBUILD curl-7.72.0-r1.ebuild 8807 BLAKE2B 812d527d58295be590bb46afa53de21e1623945f8885ba308c0421d6938d27551ec6a7ad7e1a6c0238bc46e7dd0846e1d592910394298f457d1eb0ce254710ea SHA512 c421c48d772108e62a1809ac01b5984f741c3ff5ce20c57f8f2558721a426e23bac8ea10772f18adadb7d40b40bcdab675abbcc6837315c2afd4ed47847f09a0
+EBUILD curl-7.72.0.ebuild 8725 BLAKE2B be5a57258f10186d79ca54ee4dcd1eaa2475ec35bcd5cb5120fb526b71a3cef87706cc152259ab871efaea6fe32313cdc960bcc33119bffa8009906982242405 SHA512 b52bd92c3703eaefdaee0b1fa55ae0e3bc1ca602c78cf052811c88118442f9677245f89fa839aff00c36966dcc46e29c266620f9e311c82f4ade117b0134f2ca
+EBUILD curl-7.73.0.ebuild 8865 BLAKE2B fcad66ef5b64d166dc3a10eff742d97a4f33cb4da004f922df8b21db55aec687450c7c92cbe3374d76637aa3671257145aa6f9610ede9fd0896be5fa431011d4 SHA512 c1ad8d29b8f692d17ed455b822a8efbd7a848d798209dd155fbec1753ba72aa64ec7480d270afcedc0b018531af0e4a253e4fe78b9f50739422d6ad9abfe0e12
+MISC metadata.xml 1967 BLAKE2B ff6f524ed3c1865cfde9d3859ae4de39040a0218bd0222ec9d7e9bc58b2e1166bc3f424c47287a20bb474638d19c2b5e15092d80b1b8088cc23f2cb5e3a900ad SHA512 556278cde5d59379985db113f33fb3f20370080cb2ae387d186cd5547380df2014632f37b2df0f153c810dfa4b5c3bd383b73158fd466cfab363bb68fecd0c37
diff --git a/net-misc/curl/curl-7.72.0-r1.ebuild b/net-misc/curl/curl-7.72.0-r1.ebuild
new file mode 100644
index 000000000000..f1b9dbd3d191
--- /dev/null
+++ b/net-misc/curl/curl-7.72.0-r1.ebuild
@@ -0,0 +1,291 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit autotools eutils prefix multilib-minimal
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.haxx.se/"
+SRC_URI="https://curl.haxx.se/download/${P}.tar.xz"
+
+LICENSE="curl"
+SLOT="0"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="adns alt-svc brotli +ftp gnutls gopher +http2 idn +imap ipv6 kerberos ldap libressl mbedtls metalink nss +openssl +pop3 +progress-meter rtmp samba +smtp ssh ssl static-libs test telnet +tftp threads winssl zstd"
+IUSE+=" curl_ssl_gnutls curl_ssl_libressl curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_winssl"
+IUSE+=" nghttp3 quiche"
+IUSE+=" elibc_Winnt"
+
+#lead to lots of false negatives, bug #285669
+RESTRICT="!test? ( test )"
+
+RDEPEND="ldap? ( net-nds/openldap[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			net-libs/gnutls:0=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:0=[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+		mbedtls? (
+			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+		openssl? (
+			!libressl? ( dev-libs/openssl:0=[static-libs?,${MULTILIB_USEDEP}] )
+			libressl? ( dev-libs/libressl:0=[static-libs?,${MULTILIB_USEDEP}] )
+		)
+		nss? (
+			dev-libs/nss:0[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+	)
+	http2? ( net-libs/nghttp2[${MULTILIB_USEDEP}] )
+	nghttp3? (
+		net-libs/nghttp3[${MULTILIB_USEDEP}]
+		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
+	)
+	quiche? ( >=net-libs/quiche-0.3.0[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:0=[static-libs?,${MULTILIB_USEDEP}] )
+	adns? ( net-dns/c-ares:0[${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	metalink? ( >=media-libs/libmetalink-0.1.1[${MULTILIB_USEDEP}] )
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
+
+# Do we need to enforce the same ssl backend for curl and rtmpdump? Bug #423303
+#	rtmp? (
+#		media-video/rtmpdump
+#		curl_ssl_gnutls? ( media-video/rtmpdump[gnutls] )
+#		curl_ssl_openssl? ( media-video/rtmpdump[-gnutls,ssl] )
+#	)
+
+# ssl providers to be added:
+# fbopenssl  $(use_with spnego)
+
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		dev-lang/perl
+	)"
+
+# c-ares must be disabled for threads
+# only one default ssl provider can be enabled
+REQUIRED_USE="
+	winssl? ( elibc_Winnt )
+	threads? ( !adns )
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_libressl
+			curl_ssl_mbedtls
+			curl_ssl_nss
+			curl_ssl_openssl
+			curl_ssl_winssl
+		)
+	)"
+
+DOCS=( CHANGES README docs/FEATURES docs/INTERNALS.md \
+	docs/FAQ docs/BUGS docs/CONTRIBUTE.md )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+src_prepare() {
+	eapply "${FILESDIR}"/${PN}-7.30.0-prefix.patch
+	eapply "${FILESDIR}"/${PN}-respect-cflags-3.patch
+	eapply "${FILESDIR}"/${PN}-fix-gnutls-nettle.patch
+
+	sed -i '/LD_LIBRARY_PATH=/d' configure.ac || die #382241
+	sed -i '/CURL_MAC_CFLAGS/d' configure.ac || die #637252
+
+	eapply_user
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-gnutls --without-mbedtls --without-nss --without-polarssl --without-ssl --without-winssl )
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	#myconf+=( --without-default-ssl-backend )
+	if use ssl ; then
+		if use gnutls || use curl_ssl_gnutls; then
+			einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls --with-nettle )
+		fi
+		if use mbedtls || use curl_ssl_mbedtls; then
+			einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use nss || use curl_ssl_nss; then
+			einfo "SSL provided by nss"
+			myconf+=( --with-nss )
+		fi
+		if use openssl || use curl_ssl_openssl || use curl_ssl_libressl; then
+			einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use winssl || use curl_ssl_winssl; then
+			einfo "SSL provided by Windows"
+			myconf+=( --with-winssl )
+		fi
+
+		if use curl_ssl_gnutls; then
+			einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_libressl; then
+			einfo "Default SSL provided by LibreSSL"
+			myconf+=( --with-default-ssl-backend=openssl )  # NOTE THE HACK HERE
+		elif use curl_ssl_mbedtls; then
+			einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_nss; then
+			einfo "Default SSL provided by nss"
+			myconf+=( --with-default-ssl-backend=nss )
+		elif use curl_ssl_openssl; then
+			einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_winssl; then
+			einfo "Default SSL provided by Windows"
+			myconf+=( --with-default-ssl-backend=winssl )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+		fi
+
+	else
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	ECONF_SOURCE="${S}" \
+	econf \
+		$(use_enable alt-svc) \
+		--enable-crypto-auth \
+		--enable-dict \
+		--disable-esni \
+		--enable-file \
+		$(use_enable ftp) \
+		$(use_enable gopher) \
+		--enable-http \
+		$(use_enable imap) \
+		$(use_enable ldap) \
+		$(use_enable ldap ldaps) \
+		--disable-mqtt \
+		--disable-ntlm-wb \
+		$(use_enable pop3) \
+		--enable-rt  \
+		--enable-rtsp \
+		$(use_enable samba smb) \
+		$(use_with ssh libssh2) \
+		$(use_enable smtp) \
+		$(use_enable telnet) \
+		$(use_enable tftp) \
+		--enable-tls-srp \
+		$(use_enable adns ares) \
+		--enable-cookies \
+		--enable-dateparse \
+		--enable-dnsshuffle \
+		--enable-doh \
+		--enable-hidden-symbols \
+		--enable-http-auth \
+		$(use_enable ipv6) \
+		--enable-largefile \
+		--enable-manual \
+		--enable-mime \
+		--enable-netrc \
+		$(use_enable progress-meter) \
+		--enable-proxy \
+		--disable-sspi \
+		$(use_enable static-libs static) \
+		$(use_enable threads threaded-resolver) \
+		$(use_enable threads pthreads) \
+		--disable-versioned-symbols \
+		--without-amissl \
+		--without-bearssl \
+		--without-cyassl \
+		--without-darwinssl \
+		--without-fish-functions-dir \
+		$(use_with idn libidn2) \
+		$(use_with kerberos gssapi "${EPREFIX}"/usr) \
+		$(use_with metalink libmetalink) \
+		$(use_with http2 nghttp2) \
+		--without-libpsl \
+		$(use_with nghttp3) \
+		$(use_with nghttp3 ngtcp2) \
+		$(use_with quiche) \
+		$(use_with rtmp librtmp) \
+		$(use_with brotli) \
+		--without-schannel \
+		--without-secure-transport \
+		--without-spnego \
+		--without-winidn \
+		--without-wolfssl \
+		--with-zlib \
+		$(use_with zstd) \
+		"${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# avoid building the client
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+	# Fix up the pkg-config file to be more robust.
+	# https://github.com/curl/curl/issues/864
+	local priv=() libs=()
+	# We always enable zlib.
+	libs+=( "-lz" )
+	priv+=( "zlib" )
+	if use http2; then
+		libs+=( "-lnghttp2" )
+		priv+=( "libnghttp2" )
+	fi
+	if use quiche; then
+		libs+=( "-lquiche" )
+		priv+=( "quiche" )
+	fi
+	if use nghttp3; then
+		libs+=( "-lnghttp3" "-lngtcp2" )
+		priv+=( "libnghttp3" "-libtcp2" )
+	fi
+	if use ssl && use curl_ssl_openssl; then
+		libs+=( "-lssl" "-lcrypto" )
+		priv+=( "openssl" )
+	fi
+	grep -q Requires.private libcurl.pc && die "need to update ebuild"
+	libs=$(printf '|%s' "${libs[@]}")
+	sed -i -r \
+		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
+		libcurl.pc || die
+	echo "Requires.private: ${priv[*]}" >> libcurl.pc
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete
+	rm -rf "${ED}"/etc/
+}
diff --git a/net-misc/curl/curl-7.72.0.ebuild b/net-misc/curl/curl-7.72.0.ebuild
index 6d3d4ec616b6..c2870a90b659 100644
--- a/net-misc/curl/curl-7.72.0.ebuild
+++ b/net-misc/curl/curl-7.72.0.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://curl.haxx.se/download/${P}.tar.xz"
 LICENSE="curl"
 SLOT="0"
 #KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE="adns alt-svc brotli +ftp gnutls gopher +http2 idn +imap ipv6 kerberos ldap libressl mbedtls metalink nss +openssl +pop3 +progress-meter rtmp samba +smtp ssh ssl static-libs test telnet +tftp threads winssl"
 IUSE+=" curl_ssl_gnutls curl_ssl_libressl curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_winssl"
 IUSE+=" nghttp3 quiche"
diff --git a/net-misc/curl/curl-7.73.0.ebuild b/net-misc/curl/curl-7.73.0.ebuild
new file mode 100644
index 000000000000..44c0b9c78f0a
--- /dev/null
+++ b/net-misc/curl/curl-7.73.0.ebuild
@@ -0,0 +1,293 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="7"
+
+inherit autotools eutils prefix multilib-minimal
+
+DESCRIPTION="A Client that groks URLs"
+HOMEPAGE="https://curl.haxx.se/"
+SRC_URI="https://curl.haxx.se/download/${P}.tar.xz"
+
+LICENSE="curl"
+SLOT="0"
+#KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86 ~ppc-aix ~x64-cygwin ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
+IUSE="adns alt-svc brotli +ftp gnutls gopher +http2 idn +imap ipv6 kerberos ldap libressl mbedtls metalink nss +openssl +pop3 +progress-meter rtmp samba +smtp ssh ssl static-libs test telnet +tftp threads winssl zstd"
+IUSE+=" curl_ssl_gnutls curl_ssl_libressl curl_ssl_mbedtls curl_ssl_nss +curl_ssl_openssl curl_ssl_winssl"
+IUSE+=" nghttp3 quiche"
+IUSE+=" elibc_Winnt"
+
+#lead to lots of false negatives, bug #285669
+RESTRICT="!test? ( test )"
+
+RDEPEND="ldap? ( net-nds/openldap[${MULTILIB_USEDEP}] )
+	brotli? ( app-arch/brotli:=[${MULTILIB_USEDEP}] )
+	ssl? (
+		gnutls? (
+			net-libs/gnutls:0=[static-libs?,${MULTILIB_USEDEP}]
+			dev-libs/nettle:0=[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+		mbedtls? (
+			net-libs/mbedtls:0=[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+		openssl? (
+			!libressl? ( dev-libs/openssl:0=[static-libs?,${MULTILIB_USEDEP}] )
+			libressl? ( dev-libs/libressl:0=[static-libs?,${MULTILIB_USEDEP}] )
+		)
+		nss? (
+			dev-libs/nss:0[${MULTILIB_USEDEP}]
+			app-misc/ca-certificates
+		)
+	)
+	http2? ( net-libs/nghttp2[${MULTILIB_USEDEP}] )
+	nghttp3? (
+		net-libs/nghttp3[${MULTILIB_USEDEP}]
+		net-libs/ngtcp2[ssl,${MULTILIB_USEDEP}]
+	)
+	quiche? ( >=net-libs/quiche-0.3.0[${MULTILIB_USEDEP}] )
+	idn? ( net-dns/libidn2:0=[static-libs?,${MULTILIB_USEDEP}] )
+	adns? ( net-dns/c-ares:0[${MULTILIB_USEDEP}] )
+	kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )
+	metalink? ( >=media-libs/libmetalink-0.1.1[${MULTILIB_USEDEP}] )
+	rtmp? ( media-video/rtmpdump[${MULTILIB_USEDEP}] )
+	ssh? ( net-libs/libssh2[${MULTILIB_USEDEP}] )
+	sys-libs/zlib[${MULTILIB_USEDEP}]
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )"
+
+# Do we need to enforce the same ssl backend for curl and rtmpdump? Bug #423303
+#	rtmp? (
+#		media-video/rtmpdump
+#		curl_ssl_gnutls? ( media-video/rtmpdump[gnutls] )
+#		curl_ssl_openssl? ( media-video/rtmpdump[-gnutls,ssl] )
+#	)
+
+# ssl providers to be added:
+# fbopenssl  $(use_with spnego)
+
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig
+	test? (
+		sys-apps/diffutils
+		dev-lang/perl
+	)"
+
+# c-ares must be disabled for threads
+# only one default ssl provider can be enabled
+REQUIRED_USE="
+	winssl? ( elibc_Winnt )
+	threads? ( !adns )
+	ssl? (
+		^^ (
+			curl_ssl_gnutls
+			curl_ssl_libressl
+			curl_ssl_mbedtls
+			curl_ssl_nss
+			curl_ssl_openssl
+			curl_ssl_winssl
+		)
+	)"
+
+DOCS=( CHANGES README docs/FEATURES docs/INTERNALS.md \
+	docs/FAQ docs/BUGS.md docs/CONTRIBUTE.md )
+
+MULTILIB_WRAPPED_HEADERS=(
+	/usr/include/curl/curlbuild.h
+)
+
+MULTILIB_CHOST_TOOLS=(
+	/usr/bin/curl-config
+)
+
+src_prepare() {
+	eapply "${FILESDIR}"/${PN}-7.30.0-prefix.patch
+	eapply "${FILESDIR}"/${PN}-respect-cflags-3.patch
+	eapply "${FILESDIR}"/${PN}-fix-gnutls-nettle.patch
+
+	sed -i '/LD_LIBRARY_PATH=/d' configure.ac || die #382241
+	sed -i '/CURL_MAC_CFLAGS/d' configure.ac || die #637252
+
+	eapply_user
+	eprefixify curl-config.in
+	eautoreconf
+}
+
+multilib_src_configure() {
+	# We make use of the fact that later flags override earlier ones
+	# So start with all ssl providers off until proven otherwise
+	# TODO: in the future, we may want to add wolfssl (https://www.wolfssl.com/)
+	local myconf=()
+
+	myconf+=( --without-gnutls --without-mbedtls --without-nss --without-polarssl --without-ssl --without-winssl )
+	myconf+=( --without-ca-fallback --with-ca-bundle="${EPREFIX}"/etc/ssl/certs/ca-certificates.crt  )
+	#myconf+=( --without-default-ssl-backend )
+	if use ssl ; then
+		if use gnutls || use curl_ssl_gnutls; then
+			einfo "SSL provided by gnutls"
+			myconf+=( --with-gnutls --with-nettle )
+		fi
+		if use mbedtls || use curl_ssl_mbedtls; then
+			einfo "SSL provided by mbedtls"
+			myconf+=( --with-mbedtls )
+		fi
+		if use nss || use curl_ssl_nss; then
+			einfo "SSL provided by nss"
+			myconf+=( --with-nss )
+		fi
+		if use openssl || use curl_ssl_openssl || use curl_ssl_libressl; then
+			einfo "SSL provided by openssl"
+			myconf+=( --with-ssl --with-ca-path="${EPREFIX}"/etc/ssl/certs )
+		fi
+		if use winssl || use curl_ssl_winssl; then
+			einfo "SSL provided by Windows"
+			myconf+=( --with-winssl )
+		fi
+
+		if use curl_ssl_gnutls; then
+			einfo "Default SSL provided by gnutls"
+			myconf+=( --with-default-ssl-backend=gnutls )
+		elif use curl_ssl_libressl; then
+			einfo "Default SSL provided by LibreSSL"
+			myconf+=( --with-default-ssl-backend=openssl )  # NOTE THE HACK HERE
+		elif use curl_ssl_mbedtls; then
+			einfo "Default SSL provided by mbedtls"
+			myconf+=( --with-default-ssl-backend=mbedtls )
+		elif use curl_ssl_nss; then
+			einfo "Default SSL provided by nss"
+			myconf+=( --with-default-ssl-backend=nss )
+		elif use curl_ssl_openssl; then
+			einfo "Default SSL provided by openssl"
+			myconf+=( --with-default-ssl-backend=openssl )
+		elif use curl_ssl_winssl; then
+			einfo "Default SSL provided by Windows"
+			myconf+=( --with-default-ssl-backend=winssl )
+		else
+			eerror "We can't be here because of REQUIRED_USE."
+		fi
+
+	else
+		einfo "SSL disabled"
+	fi
+
+	# These configuration options are organized alphabetically
+	# within each category.  This should make it easier if we
+	# ever decide to make any of them contingent on USE flags:
+	# 1) protocols first.  To see them all do
+	# 'grep SUPPORT_PROTOCOLS configure.ac'
+	# 2) --enable/disable options second.
+	# 'grep -- --enable configure | grep Check | awk '{ print $4 }' | sort
+	# 3) --with/without options third.
+	# grep -- --with configure | grep Check | awk '{ print $4 }' | sort
+
+	ECONF_SOURCE="${S}" \
+	econf \
+		$(use_enable alt-svc) \
+		--enable-crypto-auth \
+		--enable-dict \
+		--disable-ech \
+		--enable-file \
+		$(use_enable ftp) \
+		$(use_enable gopher) \
+		--enable-http \
+		$(use_enable imap) \
+		$(use_enable ldap) \
+		$(use_enable ldap ldaps) \
+		--disable-mqtt \
+		--disable-ntlm-wb \
+		$(use_enable pop3) \
+		--enable-rt  \
+		--enable-rtsp \
+		$(use_enable samba smb) \
+		$(use_with ssh libssh2) \
+		$(use_enable smtp) \
+		$(use_enable telnet) \
+		$(use_enable tftp) \
+		--enable-tls-srp \
+		$(use_enable adns ares) \
+		--enable-cookies \
+		--enable-dateparse \
+		--enable-dnsshuffle \
+		--enable-doh \
+		--disable-get-easy-options \
+		--enable-hidden-symbols \
+		--enable-http-auth \
+		$(use_enable ipv6) \
+		--enable-largefile \
+		--enable-manual \
+		--enable-mime \
+		--enable-netrc \
+		$(use_enable progress-meter) \
+		--enable-proxy \
+		--disable-sspi \
+		--disable-socketpair \
+		$(use_enable static-libs static) \
+		$(use_enable threads threaded-resolver) \
+		$(use_enable threads pthreads) \
+		--disable-versioned-symbols \
+		--without-amissl \
+		--without-bearssl \
+		--without-cyassl \
+		--without-darwinssl \
+		--without-fish-functions-dir \
+		$(use_with idn libidn2) \
+		$(use_with kerberos gssapi "${EPREFIX}"/usr) \
+		$(use_with metalink libmetalink) \
+		$(use_with http2 nghttp2) \
+		--without-libpsl \
+		$(use_with nghttp3) \
+		$(use_with nghttp3 ngtcp2) \
+		$(use_with quiche) \
+		$(use_with rtmp librtmp) \
+		$(use_with brotli) \
+		--without-schannel \
+		--without-secure-transport \
+		--without-spnego \
+		--without-winidn \
+		--without-wolfssl \
+		--with-zlib \
+		$(use_with zstd) \
+		"${myconf[@]}"
+
+	if ! multilib_is_native_abi; then
+		# avoid building the client
+		sed -i -e '/SUBDIRS/s:src::' Makefile || die
+		sed -i -e '/SUBDIRS/s:scripts::' Makefile || die
+	fi
+
+	# Fix up the pkg-config file to be more robust.
+	# https://github.com/curl/curl/issues/864
+	local priv=() libs=()
+	# We always enable zlib.
+	libs+=( "-lz" )
+	priv+=( "zlib" )
+	if use http2; then
+		libs+=( "-lnghttp2" )
+		priv+=( "libnghttp2" )
+	fi
+	if use quiche; then
+		libs+=( "-lquiche" )
+		priv+=( "quiche" )
+	fi
+	if use nghttp3; then
+		libs+=( "-lnghttp3" "-lngtcp2" )
+		priv+=( "libnghttp3" "-libtcp2" )
+	fi
+	if use ssl && use curl_ssl_openssl; then
+		libs+=( "-lssl" "-lcrypto" )
+		priv+=( "openssl" )
+	fi
+	grep -q Requires.private libcurl.pc && die "need to update ebuild"
+	libs=$(printf '|%s' "${libs[@]}")
+	sed -i -r \
+		-e "/^Libs.private/s:(${libs#|})( |$)::g" \
+		libcurl.pc || die
+	echo "Requires.private: ${priv[*]}" >> libcurl.pc
+}
+
+multilib_src_install_all() {
+	einstalldocs
+	find "${ED}" -type f -name '*.la' -delete
+	rm -rf "${ED}"/etc/
+}
diff --git a/net-misc/curl/metadata.xml b/net-misc/curl/metadata.xml
index a11184c0ca04..27424bfe2249 100644
--- a/net-misc/curl/metadata.xml
+++ b/net-misc/curl/metadata.xml
@@ -28,6 +28,7 @@
 		<flag name="telnet">Enable Telnet protocol support</flag>
 		<flag name="tftp">Enable TFTP support</flag>
 		<flag name="winssl">Enable winssl ssl backend</flag>
+		<flag name="zstd">Enable zstd compression</flag>
 	</use>
 	<upstream>
 		<remote-id type="cpe">cpe:/a:curl:curl</remote-id>