gentoo resync : 25.11.2020

89 files changed, 892 insertions, 4703 deletions

diff --git a/sys-auth/AusweisApp2/AusweisApp2-1.20.1.ebuild b/sys-auth/AusweisApp2/AusweisApp2-1.20.1.ebuild
deleted file mode 100644
index 10c6acdf2f5f..000000000000
--- a/sys-auth/AusweisApp2/AusweisApp2-1.20.1.ebuild
+++ /dev/null
@@ -1,48 +0,0 @@
-# Copyright 2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit cmake xdg-utils
-
-DESCRIPTION="Official authentication app for German ID cards and residence permits"
-HOMEPAGE="https://www.ausweisapp.bund.de/"
-SRC_URI="https://github.com/Governikus/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="EUPL-1.2"
-SLOT="0"
-KEYWORDS="amd64 x86"
-
-BDEPEND="
-	dev-qt/linguist-tools:5
-	virtual/pkgconfig"
-
-RDEPEND="
-	dev-libs/openssl:0=
-	dev-qt/qtconcurrent:5
-	dev-qt/qtcore:5
-	dev-qt/qtdeclarative:5
-	dev-qt/qtgui:5
-	dev-qt/qtnetwork:5
-	dev-qt/qtquickcontrols2:5
-	dev-qt/qtsvg:5
-	dev-qt/qtwebsockets:5[qml]
-	dev-qt/qtwidgets:5
-	net-libs/http-parser:0=
-	sys-apps/pcsc-lite
-	virtual/udev"
-
-DEPEND="${RDEPEND}"
-
-src_configure() {
-	local mycmakeargs=( -DBUILD_SHARED_LIBS=OFF )
-	cmake_src_configure
-}
-
-pkg_postinst() {
-	xdg_icon_cache_update
-}
-
-pkg_postrm() {
-	xdg_icon_cache_update
-}
diff --git a/sys-auth/AusweisApp2/AusweisApp2-1.20.2.ebuild b/sys-auth/AusweisApp2/AusweisApp2-1.20.2.ebuild
index 869fe92ebae0..10c6acdf2f5f 100644
--- a/sys-auth/AusweisApp2/AusweisApp2-1.20.2.ebuild
+++ b/sys-auth/AusweisApp2/AusweisApp2-1.20.2.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/Governikus/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz
 
 LICENSE="EUPL-1.2"
 SLOT="0"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="amd64 x86"
 
 BDEPEND="
 	dev-qt/linguist-tools:5
diff --git a/sys-auth/AusweisApp2/Manifest b/sys-auth/AusweisApp2/Manifest
index d6719d506c9b..1e14c9418c03 100644
--- a/sys-auth/AusweisApp2/Manifest
+++ b/sys-auth/AusweisApp2/Manifest
@@ -1,6 +1,4 @@
-DIST AusweisApp2-1.20.1.tar.gz 10103225 BLAKE2B 79afb6e793827bec16c0ba4830d87e4ab5da35a76cb1ce1a9e59ee70a7e8c7606ae1f2244ac73fbe6ac758d559451dbaefe7cc4ad9f49adb33228af3d2647051 SHA512 08e51207bca38871b6cfc3146fa5252bd18bc018d91b7c4cb847519b0282aa5d0e6ff40ffa0bf389c421fed0d40855044e7eb9e0630ca8dc639c263d3055c1bf
 DIST AusweisApp2-1.20.2.tar.gz 10110603 BLAKE2B cb3063decb3a5aacbc1d7690c58566914776032cd305d29f6352df659a27dcf81e07550613809849822ee20d7aaa467303f33602c40aaa39a99501daa7d1e887 SHA512 4a968d3d9043f9eba5927f049155e203448a27034f0c051c10fbaa262bb7b4257c5a6de4763c1fa470a1c46d51bf67636f14c136c7e7c8038eab7e929dcb38c2
-EBUILD AusweisApp2-1.20.1.ebuild 925 BLAKE2B 7af37159e128a4c5b6a4773f0a529c16863558c919471b103cd8f362e01d69b5ccc61d0fedbc8a76b38923f2b669e34f39178eaef1fa02e33759c5d3b5d439fb SHA512 27383f1f34166f1f041715dbf2d0526a854dd64cfb429c0750d0de3616388b85bf67a6cf18d001715af3d586618082f906cf040348c4c5c381c5662c14ca3983
-EBUILD AusweisApp2-1.20.2.ebuild 927 BLAKE2B 189d052846901114eab68f288d8cab9ff15795b52fb573c17cb48a3ed03d5f2d496fe1937a9bf48486804ed63d9fbb60d1f6e56ec952bd8f9e49b8e0d1c9a156 SHA512 fb174fc212561015ce6ecc55a7b2f9f2785d4fe91b8a1834189b88a4fffdc7fb0995a3f82c83f1283154f108430271136eeeb3e1385d335eb5fddeb92d913bb1
+EBUILD AusweisApp2-1.20.2.ebuild 925 BLAKE2B 7af37159e128a4c5b6a4773f0a529c16863558c919471b103cd8f362e01d69b5ccc61d0fedbc8a76b38923f2b669e34f39178eaef1fa02e33759c5d3b5d439fb SHA512 27383f1f34166f1f041715dbf2d0526a854dd64cfb429c0750d0de3616388b85bf67a6cf18d001715af3d586618082f906cf040348c4c5c381c5662c14ca3983
 EBUILD AusweisApp2-9999.ebuild 891 BLAKE2B 924618ee8a22a0ef8ad2ef62a0e8fc7448033f142371c32f814965275cb376d46e15822a9899031cc03a8003cd7159c1a94e8652a0eaf8c4acfa34eeeffa4e40 SHA512 83506e86320528f4ac17c6ac9aa80060aa9ecdf875817d12f0a680dffaf242495546aa0076c1f8185dc7eccf3dd00e87490e7ccf18028b14a57330f9f75a9894
 MISC metadata.xml 569 BLAKE2B ff252fd4eb0ba94a0b1737dc7170be7e77c031bd7be1c642c1b1b6a83ab2c217facfdc3a689bf10bcbecf044d2b4fd01563e9bd77e84d8b31a85a900f865e137 SHA512 cafac913b71aa8a40dcca2e1dd69132aad723b2d2a75dae6fb0c8954c5c3692aea1cbfb94bb1e0d8638bf4d0a74c9adfeca4d8243fe6f20cd3ad941d239760e1
diff --git a/sys-auth/Manifest.gz b/sys-auth/Manifest.gz
index 98b65b931779..236812bf74a2 100644
--- a/sys-auth/Manifest.gz
+++ b/sys-auth/Manifest.gz
diff --git a/sys-auth/consolekit/Manifest b/sys-auth/consolekit/Manifest
deleted file mode 100644
index 774251633fef..000000000000
--- a/sys-auth/consolekit/Manifest
+++ /dev/null
@@ -1,22 +0,0 @@
-AUX 90-consolekit-3 1027 BLAKE2B aa264d21acf56c93b71bc16bdbafca2758a018d08ed7632b63920b2284ec547ce086e3e440a2bddd1b03db0be3c5a124658eabdcfc60013e86fca99229912514 SHA512 2a1273d775aeb69a3e0873d6a82868d909cdbc3d5003b7625ab12e76ef44f115b464514e7890f7e562c44a92383475e698c3679f6c9f1bf42b5199d03d8c604a
-AUX consolekit-0.2.rc 513 BLAKE2B 19257e33f95e7ac9008789e2b023e43ac7a5a085ab9f5dc174313346fcf8d5b023cd74a4542de3d5587010cb4039c41a3513748022b6d30f43d293ecfa55a638 SHA512 09263369d9769d34305c716ab107a01227b615d2cca4ff067fbc629d15fa5b478dcb70f505b8b981eaf9baef41ba2de7f09a356efd2ce9cb0924de5154c8fdc7
-AUX consolekit-0.4.5-polkit-automagic.patch 870 BLAKE2B 30a92f26c69d09599a30db606a771ae29411302e344ea8bccccc732c483d0760804ded0e8599307d7fe41b18172bfddc6a2533e8921619e50e690495a9314f68 SHA512 50c2bafe2bf995bd5ef863557a1783211e172d77d819c8001c9007b4833b4e6b3ccfa7c04bf6811086dff6371be488411fdd23a49cecec3f545c388a0bbd61ab
-AUX consolekit-1.0.0.initd 360 BLAKE2B a67c6fe5e5fd34db11eba6dd12fbd9dc4d079e76d4e9f6b5f5c94f5d957151c1f7aa1a007b8d5aecf9d399df67e07a365523d933b9f057026c66983c00d06fef SHA512 68cbc15ea711c8cfbd810627912a1fa050b076804013e35a370ded64affe7458db6f89e9f4436a685fa8ccd4840f299790e9e2641ecf474bd029254f7198067b
-AUX consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch 1640 BLAKE2B e41722a5e6b2a057e867ce13d0cd533e7582b46fa4f62d25f9e80d7645158c36e193560a37bb3c7e6453c09a751e40c798c217e7a69b34c4b05166b6f11bc7e5 SHA512 a56ff368c1a674d4088a68db972bcb15c0107339704063839cf6b024eee000cff36dc9e39886f59ace3f5aefc4807de126225960e90b49b1d53bcd1674fc5d71
-AUX consolekit-cleanup_console_tags.patch 1596 BLAKE2B e3dd7f1c5e34e3bb6c09ceefdb2a5a544bd934907f625c58aef3325337223d8b518834fcb0806e4ea03f2594a635e99bfcff022795a6fb897c6e6e3ec222d792 SHA512 8639c45baefc5fa4751654345225029b455e9a5ee5be5835c69ff0d6bf3532fc1ccf606fdb0cd29849071a26ab3defff8f7e31d19e83117dfe467b6209a37a77
-AUX consolekit-shutdown-reboot-without-policies.patch 924 BLAKE2B ab8c6931b30850e75dc865438370713bad87a635d4a4051a91a4c035f64918fea5bdc9e1a4fa61d8ae2885e65bcc1f915cf14d5b6b04495ab685d98e4f8944bf SHA512 7bca0a448329cabbaa42028e212edc4ae242dcef9947cc2d49e66280cfae1193aedcac9921be90b9dd24265c17c3c53876bbea1ca223906a20252d94c4d65a9c
-AUX consolekit-udev-acl-install_to_usr.patch 750 BLAKE2B 61d79d690b7c70ddd8bee68739f1b5b1ff0a1c4598b187da187333730dd7662fdbc8b53e05616a7aea18a889da41cbaa18d27984262f8077417cef83aed5c4d8 SHA512 d2d6fcedea5e72f5a1b387f411ac62a59fd3c9e90a318bd85c35d210b89b18f01511f6b05352c1a4a9508622f0b9242c1b9c15d5ae4f8adf2819b6c3a0ff5ac9
-AUX pam-foreground-compat.ck 389 BLAKE2B 641c972edf4ce3a14e31f4e2f03b58150ce0c6b8e80becc917d057c694a4b202ee418da7a7441a24fc65f6ec1e078e24775b72cbfebc9be0a28a5036bf2f2fff SHA512 3cabd23ff7dc5de0a86284c3a3d3ff923228969cc954a1036290d4f7f6d58646ea6ea1445f472476b6f319df4dcd22f71e5e0f5cc8c845cd7e0b148af689ce5a
-DIST ConsoleKit-0.4.6.tar.xz 366572 BLAKE2B ab4c277fd47b8f99ce8c5a67de86e89b1bdd8d6a5a8682dd436feefec76f7902e71c05d9d22d52c297d3294a945f057d53f18c9c9b7d29c84aa7c26665b05fee SHA512 54955e3e83778a9216846104da8762fd50a37190e209127dd5d211e2227da617e14f6f5c1359905396d299656e526d14e1187b28eaff7d0ae1d7563dc8d9b46d
-DIST ConsoleKit2-1.1.0.tar.bz2 630178 BLAKE2B 20d1994a19fbe03d411ac5437f77b75571fbdc19478100676e51e2a1232c643f4b0c86125b5bf1d42aeb5cfb7c8b34601221d674ac27d9bf3112fcd8a83afacb SHA512 14ded07d4140e7a31132de21e84c2878475676b8c98f72b42340708972ed384abb9ba9380d74719718fc220c001387c788cf709cd15f8b19d598467dfe8a57df
-DIST ConsoleKit2-1.1.2.tar.bz2 1125567 BLAKE2B 1b7c60d224ea4197687c566d324a302aa2f5ed92ed0cfc563ba4d42f78af2999d1693e4587208e5412d042fb0cff99919dfa02ca5b5a43bda3310c17b39ca5d6 SHA512 fadca85e05c176b06ead40fba5c068d497bf69bcc322287363d0c27cdd6627b758295db1ef534b908c0e6240486430d8cb36660b4d71216a60d19a52d6d0db39
-DIST ConsoleKit2-1.2.0.tar.bz2 1125402 BLAKE2B c2119287ff173783c377a1353f8ce59432f8aa3e64f654716c895fadb5d07462069e457aae7925a6c44bc48bfd4147fc10e9f488a39714386fb6c14bced09f36 SHA512 c0f6e629b7229c2ffaafe8da899970b48c8372402447af18560fffd8804d9ab91a4ad2eb82c8f648a14807f8ccc5fb1ab4366de14faa8a2d5fb3767a6a4253f7
-DIST ConsoleKit2-1.2.1.tar.bz2 1182946 BLAKE2B f76f99008c78bd3a318c918776129072944e4c3ac18348960e3a725179d3ce4dc2cfb4d04ec5c143bb998f23f63cf36c0f88d8296dc3d0a382a138f3a0a2fecc SHA512 31befe89f7fa604138bfb0722fc6cf12f0934bac004f98fc331004eb5a7f466ed7bd0dc9adc9869da739974208f9a3bc125068ff8a60d4b2badb58ef70a3eb10
-DIST consolekit_0.4.6-4.debian.tar.gz 12192 BLAKE2B e88ed907ea3ceecb9ac399618614b1aa5d7eb2c46a706451d78e4ec1598dee5a02d6c5a1b0dd678f6bed4c25277884ec6969a23f8181ef3d8ede94452b6570db SHA512 f7fc5965b1f495d16a8ca167940431bc2569e9bde9e4a356b9c9ed00c2825db61da7b6db3d434d977fff72b3aaef30c455a365b9eba282a887a523753613b58f
-EBUILD consolekit-0.4.6.ebuild 3406 BLAKE2B 6d49e5357209d35c35f275c4446d1928f305e656a2cc39933d9ffedfd41bfbd080a120cc2baaf59f68f3a75e6e9fa9ada06cc4925f5c515f9c60e045a03d21c3 SHA512 facce2912931d60c4ba905693ef0f7965617ff66062f1fea44d70ca386e370983b8f854be8ae7a9fbed66317041e27bd590d4baf331364b3b1ee2e556f03e737
-EBUILD consolekit-1.1.0-r1.ebuild 3252 BLAKE2B cc8be7fa6e9aad8f28ab3892253c6ace2cb20928361fbe45126f80bcaac87cf286564af16b6e4f62696ebb66aeae65d40495bb2211ee7ff4708234b71758662d SHA512 84aadd15ceed3a78a5058590ec7ff460e2c0836e1c9dea20a8177865b7b26666e12f0e4adea280e0eac1485f2a59c141d7a4fc8236ef6d880c192e2db0712e94
-EBUILD consolekit-1.1.2.ebuild 3519 BLAKE2B d37892a8e0e01736e9fd03c545a4f285b9c4ef7441f26cf5ed9428e6b193ab1257d31b056ff3bcd399cb2f2c9fa4d293ad450619a7be7d1578a347399ede1574 SHA512 4b3b4b32c5f9ddcf548b5b6c892b27be06f3e5ee2a629a55874c41b145bec733cff43fbe38a6d408cdc8532fe3c8cee660be6a66454eec4a8116448e31b60458
-EBUILD consolekit-1.2.0.ebuild 3555 BLAKE2B 38d5ee8742efb528182cc8bb3dc110dc8582015977bd36722eaccb9e17772bc325b9a640672dd0755d5fd86f5f73a21e5e5d662b91242004fbdf395224e4e9a9 SHA512 29d8546c897ac53277db6cddef3c7e57dd0e6d6e3a9496559b409663e4ef5e39ea9622ea00449b609bf6324b7e9e049beec2ed47d8f2ede52fe9a08f36d2fc48
-EBUILD consolekit-1.2.1.ebuild 3553 BLAKE2B b549800c1925f47a3ef1da7defccbcd186a788c627cb17be5b3c699f409bc9941b7ef11661a8e498d7d873f83251db33cb7948e63d5bf5a1177432228415b49b SHA512 062e12668cb0e23758b58e8da95f961d97b67735173e960cf20260074b04bb1e2bdcefaee1010b05d8e808ecf4bbbb4dbfed712ce92afa9864fefe2c528264bb
-EBUILD consolekit-9999.ebuild 3344 BLAKE2B b504b18a9d6c07b1c0e737afe23b49a29804bb5db3d9d8ce17e1032a856e9bd6b8723c14f0373560a9099531a2535f8d18aea583823752ae3574114f7f125fa0 SHA512 29b1cf34f1ec36dcc6c1f5772ff33b2fd55d04b6743bf1f4a5e4f7c573a0edc4157fe0028490181f71ae63f5feaac38a83a10c05f069878da9ec892fabf8e5a2
-MISC metadata.xml 1053 BLAKE2B 221df4a94a8c48265cc70ab9fa60a409fdfaa0cf9662a3b89b3851e6aac9664e183e54bf09b957ee5f8f69dd3bdcb9d5c8493071d00dde7daf11378f0bed2fd7 SHA512 866958aa11b4410414886c8de76948212e356bb9784f241238aae0bb1b5cccc39731b660ec7affe88aff1095470c37ff076bd09a7546d202aa7a95acc5748014
diff --git a/sys-auth/consolekit/consolekit-0.4.6.ebuild b/sys-auth/consolekit/consolekit-0.4.6.ebuild
deleted file mode 100644
index e190382dadf5..000000000000
--- a/sys-auth/consolekit/consolekit-0.4.6.ebuild
+++ /dev/null
@@ -1,125 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=5
-inherit autotools eutils linux-info ltprune pam systemd
-
-MY_PN=ConsoleKit
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://www.freedesktop.org/wiki/Software/ConsoleKit"
-SRC_URI="https://www.freedesktop.org/software/${MY_PN}/dist/${MY_P}.tar.xz
-	https://launchpad.net/debian/+archive/primary/+files/${PN}_${PV}-4.debian.tar.gz" # for logrotate file
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="acl debug doc kernel_linux pam policykit selinux systemd-units test"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/dbus-glib-0.100:=
-	>=dev-libs/glib-2.38.2-r1:2=
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )"
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-S=${WORKDIR}/${MY_P}
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	epatch \
-		"${FILESDIR}"/${PN}-cleanup_console_tags.patch \
-		"${FILESDIR}"/${PN}-shutdown-reboot-without-policies.patch \
-		"${FILESDIR}"/${PN}-udev-acl-install_to_usr.patch \
-		"${FILESDIR}"/${PN}-0.4.5-polkit-automagic.patch
-
-	if ! use systemd-units; then
-		sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-	fi
-
-	eautoreconf
-}
-
-src_configure() {
-	local myconf
-	if use systemd-units; then
-		myconf="$(systemd_with_unitdir)"
-	else
-		myconf="--with-systemdsystemunitdir=/tmp"
-	fi
-
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/${MY_PN} \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable acl udev-acl) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		${myconf}
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/${MY_PN} /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-0.2.rc consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	exeinto /usr/lib/ConsoleKit/run-session.d
-	doexe "${FILESDIR}"/pam-foreground-compat.ck
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	use systemd-units || rm -rf "${ED}"/tmp
-
-	rm -rf "${ED}"/var/run # let the init script create the directory
-
-	insinto /etc/logrotate.d
-	newins "${WORKDIR}"/debian/${PN}.logrotate ${PN} #374513
-}
diff --git a/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild b/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild
deleted file mode 100644
index 6cfe969c7952..000000000000
--- a/sys-auth/consolekit/consolekit-1.1.0-r1.ebuild
+++ /dev/null
@@ -1,120 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-inherit libtool linux-info ltprune pam
-
-MY_PN=ConsoleKit2
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
-SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="acl cgroups debug doc kernel_linux pam pm-utils policykit selinux test"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
-	>=sys-devel/gettext-0.19
-	sys-apps/dbus
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	cgroups? (
-		app-admin/cgmanager
-		>=sys-libs/libnih-1.0.2[dbus]
-		)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )"
-# pm-utils: bug 557432
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	pm-utils? ( sys-power/pm-utils )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-S=${WORKDIR}/${MY_P}
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-PATCHES=( "${FILESDIR}/${P}-Remove-the-root-restriction-for-runtime-dirs.patch" )
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-
-	default
-	elibtoolize # bug 593314
-}
-
-src_configure() {
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable acl udev-acl) \
-		$(use_enable cgroups) \
-		$(use_enable test tests) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
-		--without-systemdsystemunitdir
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	if use kernel_linux; then
-		# bug 571524
-		exeinto /usr/lib/ConsoleKit/run-session.d
-		doexe "${FILESDIR}"/pam-foreground-compat.ck
-	fi
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	rm -rf "${ED}"/var/run || die # let the init script create the directory
-}
diff --git a/sys-auth/consolekit/consolekit-1.1.2.ebuild b/sys-auth/consolekit/consolekit-1.1.2.ebuild
deleted file mode 100644
index 9eb051c9c376..000000000000
--- a/sys-auth/consolekit/consolekit-1.1.2.ebuild
+++ /dev/null
@@ -1,131 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-inherit autotools libtool linux-info ltprune pam xdg-utils
-
-MY_PN=ConsoleKit2
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
-SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
-	>=sys-devel/gettext-0.19
-	sys-apps/dbus
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	cgroups? (
-		app-admin/cgmanager
-		>=sys-libs/libnih-1.0.2[dbus]
-		)
-	evdev? ( dev-libs/libevdev:= )
-	udev? (
-		virtual/libudev
-		x11-libs/libdrm:=
-	)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )
-	selinux? ( sys-libs/libselinux )"
-# pm-utils: bug 557432
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	pm-utils? ( sys-power/pm-utils )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-S=${WORKDIR}/${MY_P}
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	xdg_environment_reset
-
-	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-
-	default
-	# patch needs autoreconf, so dont need libtoolize
-	eautoreconf
-	#elibtoolize # bug 593314
-}
-
-src_configure() {
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable evdev libevdev) \
-		$(use_enable acl udev-acl) \
-		$(use_enable cgroups libcgmanager) \
-		$(use_enable selinux libselinux) \
-		$(use_enable udev libudev) \
-		$(use_enable test tests) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
-		--without-systemdsystemunitdir
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	if use kernel_linux; then
-		# bug 571524
-		exeinto /usr/lib/ConsoleKit/run-session.d
-		doexe "${FILESDIR}"/pam-foreground-compat.ck
-	fi
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	rm -rf "${ED}"/var/run || die # let the init script create the directory
-}
diff --git a/sys-auth/consolekit/consolekit-1.2.0.ebuild b/sys-auth/consolekit/consolekit-1.2.0.ebuild
deleted file mode 100644
index 853ffde35398..000000000000
--- a/sys-auth/consolekit/consolekit-1.2.0.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-inherit autotools libtool linux-info ltprune pam xdg-utils
-
-MY_PN=ConsoleKit2
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
-SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ppc ppc64 s390 ~sparc x86 ~amd64-linux ~x86-linux"
-IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
-	>=sys-devel/gettext-0.19
-	sys-apps/dbus
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	cgroups? (
-		app-admin/cgmanager
-		>=sys-libs/libnih-1.0.2[dbus]
-		)
-	evdev? ( dev-libs/libevdev:= )
-	udev? (
-		virtual/libudev
-		x11-libs/libdrm:=
-	)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )
-	selinux? ( sys-libs/libselinux )"
-# pm-utils: bug 557432
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	pm-utils? ( sys-power/pm-utils )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-S=${WORKDIR}/${MY_P}
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	xdg_environment_reset
-
-	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-
-	default
-	# patch needs autoreconf, so dont need libtoolize
-	eautoreconf
-	#elibtoolize # bug 593314
-}
-
-src_configure() {
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable evdev libevdev) \
-		$(use_enable acl udev-acl) \
-		$(use_enable cgroups libcgmanager) \
-		$(use_enable selinux libselinux) \
-		$(use_enable udev libdrm) \
-		$(use_enable udev libudev) \
-		$(use_enable test tests) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
-		--without-systemdsystemunitdir
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	if use kernel_linux; then
-		# bug 571524
-		exeinto /usr/lib/ConsoleKit/run-session.d
-		doexe "${FILESDIR}"/pam-foreground-compat.ck
-	fi
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	rm -rf "${ED}"/var/run || die # let the init script create the directory
-}
diff --git a/sys-auth/consolekit/consolekit-1.2.1.ebuild b/sys-auth/consolekit/consolekit-1.2.1.ebuild
deleted file mode 100644
index cc3e4dc331d9..000000000000
--- a/sys-auth/consolekit/consolekit-1.2.1.ebuild
+++ /dev/null
@@ -1,132 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-inherit autotools libtool linux-info ltprune pam xdg-utils
-
-MY_PN=ConsoleKit2
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
-SRC_URI="https://github.com/${MY_PN}/${MY_PN}/releases/download/${PV}/${MY_P}.tar.bz2"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
-	>=sys-devel/gettext-0.19
-	sys-apps/dbus
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	cgroups? (
-		app-admin/cgmanager
-		>=sys-libs/libnih-1.0.2[dbus]
-		)
-	evdev? ( dev-libs/libevdev:= )
-	udev? (
-		virtual/libudev
-		x11-libs/libdrm:=
-	)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )
-	selinux? ( sys-libs/libselinux )"
-# pm-utils: bug 557432
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	pm-utils? ( sys-power/pm-utils )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-S=${WORKDIR}/${MY_P}
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	xdg_environment_reset
-
-	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-
-	default
-	# patch needs autoreconf, so dont need libtoolize
-	eautoreconf
-	#elibtoolize # bug 593314
-}
-
-src_configure() {
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable evdev libevdev) \
-		$(use_enable acl udev-acl) \
-		$(use_enable cgroups libcgmanager) \
-		$(use_enable selinux libselinux) \
-		$(use_enable udev libdrm) \
-		$(use_enable udev libudev) \
-		$(use_enable test tests) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
-		--without-systemdsystemunitdir
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	if use kernel_linux; then
-		# bug 571524
-		exeinto /usr/lib/ConsoleKit/run-session.d
-		doexe "${FILESDIR}"/pam-foreground-compat.ck
-	fi
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	rm -rf "${ED}"/var/run || die # let the init script create the directory
-}
diff --git a/sys-auth/consolekit/consolekit-9999.ebuild b/sys-auth/consolekit/consolekit-9999.ebuild
deleted file mode 100644
index cec91280e66d..000000000000
--- a/sys-auth/consolekit/consolekit-9999.ebuild
+++ /dev/null
@@ -1,128 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-inherit autotools libtool git-r3 linux-info ltprune pam xdg-utils
-
-MY_PN=ConsoleKit2
-MY_P=${MY_PN}-${PV}
-
-DESCRIPTION="Framework for defining and tracking users, login sessions and seats"
-HOMEPAGE="https://github.com/ConsoleKit2/ConsoleKit2 https://www.freedesktop.org/wiki/Software/ConsoleKit"
-EGIT_REPO_URI="https://github.com/${MY_PN}/${MY_PN}.git"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS=""
-IUSE="acl cgroups debug doc evdev kernel_linux pam pm-utils policykit selinux test udev"
-RESTRICT="!test? ( test )"
-
-COMMON_DEPEND=">=dev-libs/glib-2.40:2=[dbus]
-	>=sys-devel/gettext-0.19
-	sys-apps/dbus
-	sys-libs/zlib:=
-	x11-libs/libX11:=
-	acl? (
-		sys-apps/acl:=
-		>=virtual/udev-200
-		)
-	cgroups? (
-		app-admin/cgmanager
-		>=sys-libs/libnih-1.0.2[dbus]
-		)
-	evdev? ( dev-libs/libevdev:= )
-	udev? (
-		virtual/libudev
-		x11-libs/libdrm:=
-	)
-	pam? ( sys-libs/pam )
-	policykit? ( >=sys-auth/polkit-0.110 )
-	selinux? ( sys-libs/libselinux )"
-# pm-utils: bug 557432
-RDEPEND="${COMMON_DEPEND}
-	kernel_linux? ( sys-apps/coreutils[acl?] )
-	pm-utils? ( sys-power/pm-utils )
-	selinux? ( sec-policy/selinux-consolekit )"
-DEPEND="${COMMON_DEPEND}
-	dev-libs/libxslt
-	virtual/pkgconfig
-	doc? ( app-text/xmlto )
-	test? (
-		app-text/docbook-xml-dtd:4.1.2
-		app-text/xmlto
-		)"
-
-QA_MULTILIB_PATHS="usr/lib/ConsoleKit/.*"
-
-pkg_setup() {
-	if use kernel_linux; then
-		# This is from https://bugs.gentoo.org/376939
-		use acl && CONFIG_CHECK="~TMPFS_POSIX_ACL"
-		# This is required to get login-session-id string with pam_ck_connector.so
-		use pam && CONFIG_CHECK+=" ~AUDITSYSCALL"
-		linux-info_pkg_setup
-	fi
-}
-
-src_prepare() {
-	xdg_environment_reset
-
-	sed -i -e '/SystemdService/d' data/org.freedesktop.ConsoleKit.service.in || die
-
-	default
-	eautoreconf
-	#elibtoolize # bug 593314
-}
-
-src_configure() {
-	econf \
-		XMLTO_FLAGS='--skip-validation' \
-		--libexecdir="${EPREFIX}"/usr/lib/ConsoleKit \
-		--localstatedir="${EPREFIX}"/var \
-		$(use_enable pam pam-module) \
-		$(use_enable doc docbook-docs) \
-		$(use_enable test docbook-docs) \
-		$(use_enable debug) \
-		$(use_enable policykit polkit) \
-		$(use_enable evdev libevdev) \
-		$(use_enable acl udev-acl) \
-		$(use_enable cgroups libcgmanager) \
-		$(use_enable selinux libselinux) \
-		$(use_enable udev libudev) \
-		$(use_enable test tests) \
-		--with-dbus-services="${EPREFIX}"/usr/share/dbus-1/services \
-		--with-pam-module-dir="$(getpam_mod_dir)" \
-		--with-xinitrc-dir="${EPREFIX}"/etc/X11/xinit/xinitrc.d \
-		--without-systemdsystemunitdir
-}
-
-src_install() {
-	emake \
-		DESTDIR="${D}" \
-		htmldocdir="${EPREFIX}"/usr/share/doc/${PF}/html \
-		install
-
-	dosym /usr/lib/ConsoleKit /usr/lib/${PN}
-
-	dodoc AUTHORS HACKING NEWS README TODO
-
-	newinitd "${FILESDIR}"/${PN}-1.0.0.initd consolekit
-
-	keepdir /usr/lib/ConsoleKit/run-seat.d
-	keepdir /usr/lib/ConsoleKit/run-session.d
-	keepdir /etc/ConsoleKit/run-session.d
-	keepdir /var/log/ConsoleKit
-
-	exeinto /etc/X11/xinit/xinitrc.d
-	newexe "${FILESDIR}"/90-consolekit-3 90-consolekit
-
-	if use kernel_linux; then
-		# bug 571524
-		exeinto /usr/lib/ConsoleKit/run-session.d
-		doexe "${FILESDIR}"/pam-foreground-compat.ck
-	fi
-
-	prune_libtool_files --all # --all for pam_ck_connector.la
-
-	rm -rf "${ED}"/var/run || die # let the init script create the directory
-}
diff --git a/sys-auth/consolekit/files/90-consolekit-3 b/sys-auth/consolekit/files/90-consolekit-3
deleted file mode 100644
index 358fc24f1a72..000000000000
--- a/sys-auth/consolekit/files/90-consolekit-3
+++ /dev/null
@@ -1,32 +0,0 @@
-# -*- sh -*-
-# Xsession.d script for ck-launch-session.
-#
-#
-# This file is sourced by Xsession(5), not executed.
-
-CK_LAUNCH_SESSION=/usr/bin/ck-launch-session
-
-is_on_console() {
-	session=$(dbus-send --system --dest=org.freedesktop.ConsoleKit \
-		--type=method_call --print-reply --reply-timeout=2000 \
-		/org/freedesktop/ConsoleKit/Manager \
-		org.freedesktop.ConsoleKit.Manager.GetCurrentSession \
-		| grep path | awk '{print $3}' | sed s/\"//g)
-	x11_display=$(dbus-send --system --dest=org.freedesktop.ConsoleKit \
-		--type=method_call --print-reply --reply-timeout=2000 \
-		$session org.freedesktop.ConsoleKit.Session.GetX11Display \
-		| grep string | awk '{print $2}' | sed s/\"//g)
-
-	if [ -z "$x11_display" ] ; then
-		return 0
-	else
-		return 1
-	fi
-}
-
-# gdm already creates a CK session for us, so do not run the expensive D-Bus
-# calls if we have $GDMSESSION
-if [ -z "$GDMSESSION" ] && [ -x "$CK_LAUNCH_SESSION" ] && \
- ( [ -z "$XDG_SESSION_COOKIE" ] || is_on_console ) ; then
-    command="$CK_LAUNCH_SESSION $command"
-fi
diff --git a/sys-auth/consolekit/files/consolekit-0.2.rc b/sys-auth/consolekit/files/consolekit-0.2.rc
deleted file mode 100644
index e2be0de6e1aa..000000000000
--- a/sys-auth/consolekit/files/consolekit-0.2.rc
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2016 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License, v2 or later
-
-depend() {
-	need dbus
-	use logger
-}
-
-start() {
-	ebegin "Starting ConsoleKit daemon"
-
-	checkpath -q -d -m 0755 /var/run/ConsoleKit
-
-	start-stop-daemon --start -q \
-		--pidfile /var/run/ConsoleKit/pid \
-		--exec /usr/sbin/console-kit-daemon -- 
-	eend $?
-}
-
-stop() {
-	ebegin "Stopping ConsoleKit daemon"
-	start-stop-daemon --stop -q --pidfile /var/run/ConsoleKit/pid 
-	eend $?
-}
diff --git a/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch b/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch
deleted file mode 100644
index b896089d4485..000000000000
--- a/sys-auth/consolekit/files/consolekit-0.4.5-polkit-automagic.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-http://bugs.freedesktop.org/show_bug.cgi?id=47587
-
---- configure.ac
-+++ configure.ac
-@@ -56,10 +56,21 @@
-   gthread-2.0 >= $GLIB_REQUIRED_VERSION
- )
- 
--PKG_CHECK_MODULES(POLKIT,
--  polkit-gobject-1 >= $POLKIT_REQUIRED_VERSION,
--  have_polkit=yes,
--  have_polkit=no)
-+AC_ARG_ENABLE([polkit],
-+  AC_HELP_STRING([--enable-polkit], [Enable PolicyKit support (default auto)]),
-+  enable_polkit=$enableval,
-+  enable_polkit=auto)
-+
-+if test "x$enable_polkit" != "xno"; then
-+  PKG_CHECK_MODULES(POLKIT,
-+    polkit-gobject-1 >= $POLKIT_REQUIRED_VERSION,
-+    have_polkit=yes,
-+    have_polkit=no)
-+  if test "x$enable_polkit"  = "xyes" -a "x$have_polkit" = "xno"; then
-+    AC_MSG_ERROR([PolicyKit support explicitly requested but dependencies not found])
-+  fi
-+fi
-+
- if test "x$have_polkit" = "xyes" ; then
-        AC_DEFINE(HAVE_POLKIT, [], [Define if we have polkit])
- fi
diff --git a/sys-auth/consolekit/files/consolekit-1.0.0.initd b/sys-auth/consolekit/files/consolekit-1.0.0.initd
deleted file mode 100644
index 4fd1140fe209..000000000000
--- a/sys-auth/consolekit/files/consolekit-1.0.0.initd
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/sbin/openrc-run
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License, v2 or later
-
-description="consolekit - tracks login sessions and seats"
-pidfile="/run/ConsoleKit/pid"
-command="/usr/sbin/console-kit-daemon"
-
-depend() {
-	need dbus
-	use logger
-}
-
-start_pre() {
-	checkpath -q -d -m 0755 /run/ConsoleKit
-}
diff --git a/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch b/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch
deleted file mode 100644
index 301c68f5d904..000000000000
--- a/sys-auth/consolekit/files/consolekit-1.1.0-Remove-the-root-restriction-for-runtime-dirs.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 664d2fdbd966764836b1f4da2dbc5750c7f01f0f Mon Sep 17 00:00:00 2001
-From: Eric Koegel <eric.koegel@gmail.com>
-Date: Sun, 10 Apr 2016 11:20:24 +0300
-Subject: [PATCH] Remove the root restriction for runtime dirs
-
----
- src/ck-sysdeps-unix.c       |  5 -----
- tools/ck-remove-directory.c | 10 ----------
- 2 files changed, 15 deletions(-)
-
-diff --git a/src/ck-sysdeps-unix.c b/src/ck-sysdeps-unix.c
-index 67d8eac..ecd176a 100644
---- a/src/ck-sysdeps-unix.c
-+++ b/src/ck-sysdeps-unix.c
-@@ -409,11 +409,6 @@ ck_generate_runtime_dir_for_user (guint uid)
- 
-         TRACE ();
- 
--        if (uid < 1) {
--                g_debug ("We do not create runtime dirs for root");
--                return NULL;
--        }
--
-         errno = 0;
-         pwent = getpwuid (uid);
-         if (pwent == NULL) {
-diff --git a/tools/ck-remove-directory.c b/tools/ck-remove-directory.c
-index cf44fd6..b1a5722 100644
---- a/tools/ck-remove-directory.c
-+++ b/tools/ck-remove-directory.c
-@@ -51,11 +51,6 @@ become_user (uid_t uid, const gchar* dest)
-         int            res;
-         struct passwd *pwent;
- 
--        if (uid < 1) {
--                g_critical ("invalid UID");
--                exit (1);
--        }
--
-         if (dest == NULL) {
-                 g_critical ("invalid dest");
-                 exit (1);
-@@ -148,11 +143,6 @@ main (int    argc,
-                 exit (1);
-         }
- 
--        if (user_id < 1) {
--                g_warning ("Invalid UID");
--                exit (1);
--        }
--
-         /* Ensure we have a dest and that it starts with the correct prefix
-          * so we don't remove something important.
-          */
--- 
-2.7.3
-
diff --git a/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch b/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch
deleted file mode 100644
index c02411ebded5..000000000000
--- a/sys-auth/consolekit/files/consolekit-cleanup_console_tags.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-http://bugs.gentoo.org/257761
-http://patches.ubuntu.com/by-release/extracted/ubuntu/c/consolekit/
-
---- src/main.c
-+++ src/main.c
-@@ -148,6 +148,43 @@
-         unlink (CONSOLE_KIT_PID_FILE);
- }
- 
-+#define CONSOLE_TAGS_DIR "/var/run/console"
-+
-+static void
-+delete_console_tags (void)
-+{
-+	GDir *dir;
-+	GError *error = NULL;
-+	const gchar *name;
-+
-+	g_debug ("Cleaning up %s", CONSOLE_TAGS_DIR);
-+
-+	dir = g_dir_open (CONSOLE_TAGS_DIR, 0, &error);
-+	if (dir == NULL) {
-+		g_debug ("Couldn't open directory %s: %s", CONSOLE_TAGS_DIR,
-+		           error->message);
-+		g_error_free (error);
-+		return;
-+	}
-+	while ((name = g_dir_read_name (dir)) != NULL) {
-+		gchar *file;
-+		file = g_build_filename (CONSOLE_TAGS_DIR, name, NULL);
-+
-+		g_debug ("Removing tag file: %s", file);
-+		if (unlink (file) == -1) {
-+			g_warning ("Couldn't delete tag file: %s", file);
-+		}
-+		g_free (file);
-+	}
-+}
-+
-+static void
-+cleanup (void)
-+{
-+	delete_console_tags ();
-+	delete_pid ();
-+}
-+
- /* copied from nautilus */
- static int debug_log_pipes[2];
- 
-@@ -228,7 +265,7 @@
-                 snprintf (pid, sizeof (pid), "%lu\n", (long unsigned) getpid ());
-                 written = write (pf, pid, strlen (pid));
-                 close (pf);
--                g_atexit (delete_pid);
-+                g_atexit (cleanup);
-         } else {
-                 g_warning ("Unable to write pid file %s: %s",
-                            CONSOLE_KIT_PID_FILE,
-@@ -317,6 +354,8 @@
-                 goto out;
-         }
- 
-+	delete_console_tags ();
-+
-         create_pid_file ();
- 
-         loop = g_main_loop_new (NULL, FALSE);
diff --git a/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch b/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch
deleted file mode 100644
index 6a46649f7587..000000000000
--- a/sys-auth/consolekit/files/consolekit-shutdown-reboot-without-policies.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Romain Perier <mrpouet@gentoo.org>
-Date: Sat, 24 Oct 2009 18:43:43 +0200
-Subject: [PATCH] Be able to shutdown or reboot even without polkit or RBAC supports
-
-Ck does NOTHING at the origin if its built without polkit or RBAC supports, except
-display a warning using g_warning() (which does not make sense).
-The trick is to to call do_stop()/do_restart() in the #else directive :)
-
---- src/ck-manager.c
-+++ src/ck-manager.c
-@@ -1131,6 +1131,7 @@
-         check_rbac_permissions (manager, context, RBAC_SHUTDOWN_KEY, do_restart);
- #else
-         g_warning ("Compiled without PolicyKit or RBAC support!");
-+        do_restart(manager, context);
- #endif
- 
-         return TRUE;
-@@ -1207,6 +1208,7 @@
-         check_rbac_permissions (manager, context, RBAC_SHUTDOWN_KEY, do_stop);
- #else
-         g_warning ("Compiled without PolicyKit or RBAC support!");
-+        do_stop(manager, context);
- #endif
- 
-         return TRUE;
diff --git a/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch b/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch
deleted file mode 100644
index 3ef39873dbd6..000000000000
--- a/sys-auth/consolekit/files/consolekit-udev-acl-install_to_usr.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-http://bugs.gentoo.org/398049
-
---- tools/Makefile.am
-+++ tools/Makefile.am
-@@ -144,11 +144,10 @@
- 	$(NULL)
- 
- if ENABLE_UDEV_ACL
--udevdir = $(UDEVDIR)
- udevrulesdir = $(UDEVDIR)/rules.d
- 
- dist_udevrules_DATA = 70-udev-acl.rules
--udev_PROGRAMS = udev-acl
-+libexec_PROGRAMS = udev-acl
- 
- udev_acl_SOURCES = udev-acl.c
- udev_acl_LDADD = $(UDEV_ACL_LIBS)
-@@ -156,7 +155,9 @@
- 
- install-exec-hook:
- 	mkdir -p $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d
--	ln -sf $(UDEVDIR)/udev-acl $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d/udev-acl.ck
-+	mkdir -p $(DESTDIR)$(UDEVDIR)
-+	ln -sf $(libexecdir)/udev-acl $(DESTDIR)$(prefix)/lib/ConsoleKit/run-seat.d/udev-acl.ck
-+	ln -sf $(libexecdir)/udev-acl $(DESTDIR)$(UDEVDIR)/udev-acl
- endif
- 
- EXTRA_DIST =				\
diff --git a/sys-auth/consolekit/files/pam-foreground-compat.ck b/sys-auth/consolekit/files/pam-foreground-compat.ck
deleted file mode 100644
index 0697ca81ba45..000000000000
--- a/sys-auth/consolekit/files/pam-foreground-compat.ck
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/bin/sh
-TAGDIR=/var/run/console
-
-[ -n "$CK_SESSION_USER_UID" ] || exit 1
-
-TAGFILE="$TAGDIR/`getent passwd $CK_SESSION_USER_UID | cut -f 1 -d:`"
-
-if [ "$1" = "session_added" ]; then
-	mkdir -p "$TAGDIR"
-	echo "$CK_SESSION_ID" >> "$TAGFILE"
-fi
-
-if [ "$1" = "session_removed" ] && [ -e "$TAGFILE" ]; then
-	sed -i "\%^$CK_SESSION_ID\$%d" "$TAGFILE"
-	[ -s "$TAGFILE" ] || rm -f "$TAGFILE"
-fi
-
diff --git a/sys-auth/consolekit/metadata.xml b/sys-auth/consolekit/metadata.xml
deleted file mode 100644
index 3aa5069e61cb..000000000000
--- a/sys-auth/consolekit/metadata.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-	<maintainer type="person">
-		<email>perfinion@gentoo.org</email>
-		<name>Jason Zaman</name>
-	</maintainer>
-	<maintainer type="project">
-		<email>freedesktop-bugs@gentoo.org</email>
-	</maintainer>
-	<use>
-		<flag name="cgroups">Use the kernel to track processes instead of the session cookie.</flag>
-		<flag name="evdev">For handling VT switching with a session controller.</flag>
-		<flag name="pm-utils">Adds support for suspend/resume using <pkg>sys-power/pm-utils</pkg></flag>
-		<flag name="policykit">Use the PolicyKit framework (<pkg>sys-auth/polkit</pkg>) to get authorization for suspend/shutdown.</flag>
-		<flag name="systemd-units">Install systemd unit files to replace the modern functionality of logind in <pkg>sys-apps/systemd</pkg>. Not recommended.</flag>
-	</use>
-	<upstream>
-		<remote-id type="github">ConsoleKit2/ConsoleKit2</remote-id>
-		<remote-id type="launchpad">debian</remote-id>
-	</upstream>
-</pkgmetadata>
diff --git a/sys-auth/elogind/Manifest b/sys-auth/elogind/Manifest
index 152707592c2f..55a0b3055155 100644
--- a/sys-auth/elogind/Manifest
+++ b/sys-auth/elogind/Manifest
@@ -3,5 +3,6 @@ AUX elogind-243.7-nodocs.patch 999 BLAKE2B f4fc95f14ce0412e88bb8b2a001975fae3b42
 AUX elogind.conf.in 218 BLAKE2B 7ee0a72c4a628a233fdbb2d3104487859aaa7e5c4f2624e5a4eafb37ed90fb8f64349b1a8acc92e69ec618496bb7f6263b7a5d0fe15a1afe1c03f5955743f079 SHA512 2c62ab28d7db9cd52489069f80363159000385a25dd7f2afe5a03598a0b7a1f61af7c18df71f6286e72f5966e55b62a4029e30cb786dd813bb201b9e20adccd7
 AUX elogind.init 490 BLAKE2B 71c102f89a71a2963da50b153d8696a9480d81caa48e8422e7f39614e9bfb0b09037bc4dea202c3735e170140752429dd54747b99941d861453b4714dcb98819 SHA512 60fe1cb55ec0f605f06fb3744a0300accebfc14c4ecd24b7db2e8b0cb1537e816a4a4ccbc4b2eeac45e2f3ca8942dd10d24bdcd814cccbc2ceed198b2657238a
 DIST elogind-243.7.tar.gz 1338186 BLAKE2B f3efc2af50f56c2cda18d721c18f4d88ca608fb35b2c7e2ebb35c3f3f743124dcf17efcc9db47810a13093397b1c1bc82cb42e017b3db493af5d2bb70bcf0eff SHA512 fd17c5016d083d63805f9ed0326ee32597870f6c48c9c246712cb09a77db775036b0fd0f4258b6557e189a1eceb4b50f4ae2e9e7881f4d9759b87a0b49ce3472
+EBUILD elogind-243.7-r1.ebuild 4133 BLAKE2B 50218c57ea3a2f8ac9d3a24702ea9cf4b116caec19af85bf2b6966cc73d0f9046b5608e53c30e2534134f317adce0646db7a2d499357d8c6321bcad8e3367c9d SHA512 adef0c04b80c8cd91317ecb26c18d8690237e50f68cb91e1edcaf762fb6182841a0b2a9e6e53f7bb70367537935e89f5e849b21586fcab2e700b4c2179c8a2fd
 EBUILD elogind-243.7.ebuild 4055 BLAKE2B 1eee3558814325ccd0f107bafc3eee1facbf7d15eb901073f9d38e25ec1669c1fa8b95c7a2a0e552eec41d96f0da332d6e2d01c0a31a20af8e1aa6d8cd91545d SHA512 182abf35ceccc60bcbbc31534b590b6a7c871a2142efc21ca1d0013f651952502e7d15b43c0f8f9c7e5d37db9cb0307867b19e36ccf49cce9a718ec5753c2315
 MISC metadata.xml 492 BLAKE2B 5a8b55fb5fd3c98d72f0f003e69275d50a511c2cfa8b8c15c3e06c105b96ad19515e0144c9cffe5e6a86002656a2101ab811c6b9178ece9b050a32f65fd9ebd2 SHA512 220bde659ec75567f5d78eca23fa7e03f49a829cb1c08abe66be3d22ae2d7dd7ba2f177fdb33642a2b0ffc125abe7547d6a77153e88de9bb62d7009a898e8969
diff --git a/sys-auth/elogind/elogind-243.7-r1.ebuild b/sys-auth/elogind/elogind-243.7-r1.ebuild
new file mode 100644
index 000000000000..727303951d29
--- /dev/null
+++ b/sys-auth/elogind/elogind-243.7-r1.ebuild
@@ -0,0 +1,148 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+if [[ ${PV} = *9999* ]]; then
+	EGIT_BRANCH="v241-stable"
+	EGIT_REPO_URI="https://github.com/elogind/elogind.git"
+	inherit git-r3
+else
+	SRC_URI="https://github.com/${PN}/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+fi
+
+inherit linux-info meson pam udev xdg-utils
+
+DESCRIPTION="The systemd project's logind, extracted to a standalone package"
+HOMEPAGE="https://github.com/elogind/elogind"
+
+LICENSE="CC0-1.0 LGPL-2.1+ public-domain"
+SLOT="0"
+IUSE="+acl audit debug doc +pam +policykit selinux"
+
+BDEPEND="
+	app-text/docbook-xml-dtd:4.2
+	app-text/docbook-xml-dtd:4.5
+	app-text/docbook-xsl-stylesheets
+	dev-util/gperf
+	dev-util/intltool
+	virtual/pkgconfig
+"
+DEPEND="
+	audit? ( sys-process/audit )
+	sys-apps/util-linux
+	sys-libs/libcap
+	virtual/libudev:=
+	acl? ( sys-apps/acl )
+	pam? ( sys-libs/pam )
+	selinux? ( sys-libs/libselinux )
+"
+RDEPEND="${DEPEND}
+	!sys-apps/systemd
+"
+PDEPEND="
+	sys-apps/dbus
+	policykit? ( sys-auth/polkit )
+"
+
+DOCS=( README.md src/libelogind/sd-bus/GVARIANT-SERIALIZATION )
+
+PATCHES=(
+	"${FILESDIR}/${P}-nodocs.patch"
+	"${FILESDIR}/${PN}-241.4-broken-test.patch" # bug 699116
+)
+
+pkg_setup() {
+	local CONFIG_CHECK="~CGROUPS ~EPOLL ~INOTIFY_USER ~SIGNALFD ~TIMERFD"
+
+	use kernel_linux && linux-info_pkg_setup
+}
+
+src_prepare() {
+	default
+	xdg_environment_reset
+}
+
+src_configure() {
+	local rccgroupmode="$(grep rc_cgroup_mode ${EPREFIX}/etc/rc.conf | cut -d '"' -f 2)"
+	local cgroupmode="legacy"
+
+	if [[ "xhybrid" = "x${rccgroupmode}" ]] ; then
+		cgroupmode="hybrid"
+	elif [[ "xunified" = "x${rccgroupmode}" ]] ; then
+		cgroupmode="unified"
+	fi
+
+	local emesonargs=(
+		-Ddocdir="${EPREFIX}/usr/share/doc/${PF}"
+		-Dhtmldir="${EPREFIX}/usr/share/doc/${PF}/html"
+		-Dpamlibdir=$(getpam_mod_dir)
+		-Dudevrulesdir="${EPREFIX}$(get_udevdir)"/rules.d
+		--libdir="${EPREFIX}"/usr/$(get_libdir)
+		-Drootlibdir="${EPREFIX}"/$(get_libdir)
+		-Drootlibexecdir="${EPREFIX}"/$(get_libdir)/elogind
+		-Drootprefix="${EPREFIX}/"
+		-Dbashcompletiondir="${EPREFIX}/usr/share/bash-completion/completions"
+		-Dman=auto
+		-Dsmack=true
+		-Dcgroup-controller=openrc
+		-Ddefault-hierarchy=${cgroupmode}
+		-Ddefault-kill-user-processes=false
+		-Dacl=$(usex acl true false)
+		-Daudit=$(usex audit true false)
+		--buildtype $(usex debug debug release)
+		-Dhtml=$(usex doc auto false)
+		-Dpam=$(usex pam true false)
+		-Dselinux=$(usex selinux true false)
+		-Dutmp=$(usex elibc_musl false true)
+	)
+
+	meson_src_configure
+}
+
+src_install() {
+	DOCS+=( src/libelogind/sd-bus/GVARIANT-SERIALIZATION )
+
+	meson_src_install
+
+	newinitd "${FILESDIR}"/${PN}.init ${PN}
+
+	sed -e "s/@libdir@/$(get_libdir)/" "${FILESDIR}"/${PN}.conf.in > ${PN}.conf || die
+	newconfd ${PN}.conf ${PN}
+}
+
+pkg_postinst() {
+	if ! use pam; then
+		ewarn "${PN} will not be managing user logins/seats without USE=\"pam\"!"
+		ewarn "In other words, it will be useless for most applications."
+		ewarn
+	fi
+	if ! use policykit; then
+		ewarn "loginctl will not be able to perform privileged operations without"
+		ewarn "USE=\"policykit\"! That means e.g. no suspend or hibernate."
+		ewarn
+	fi
+	if [[ "$(rc-config list boot | grep elogind)" != "" ]]; then
+		elog "elogind is currently started from boot runlevel."
+	elif [[ "$(rc-config list default | grep elogind)" != "" ]]; then
+		ewarn "elogind is currently started from default runlevel."
+		ewarn "Please remove elogind from the default runlevel and"
+		ewarn "add it to the boot runlevel by:"
+		ewarn "# rc-update del elogind default"
+		ewarn "# rc-update add elogind boot"
+	else
+		elog "elogind is currently not started from any runlevel."
+		elog "You may add it to the boot runlevel by:"
+		elog "# rc-update add elogind boot"
+		elog
+		elog "Alternatively, you can leave elogind out of any"
+		elog "runlevel. It will then be started automatically"
+		if use pam; then
+			elog "when the first service calls it via dbus, or"
+			elog "the first user logs into the system."
+		else
+			elog "when the first service calls it via dbus."
+		fi
+	fi
+}
diff --git a/sys-auth/fingerprint-gui/Manifest b/sys-auth/fingerprint-gui/Manifest
deleted file mode 100644
index 140caaddccd1..000000000000
--- a/sys-auth/fingerprint-gui/Manifest
+++ /dev/null
@@ -1,3 +0,0 @@
-DIST fingerprint-gui-1.09.tar.gz 7037943 BLAKE2B b35b8a1c5f53752709da44903961527c01db20773298e4636d8c316946cd7d23022c9407081c55ba5f6ec55d9ed53b7f8ef858c44a623873834fa1cbd6aa941f SHA512 c4fb22368d82d72586f80009b5adb9db0a8e8777c3d1c1f23cf58a21f718a3e3d05bbc90fff295be969cf7f744f037fb886e975e626cf6d599f8f6b5f8323724
-EBUILD fingerprint-gui-1.09-r1.ebuild 3156 BLAKE2B 249d2387a405b4e50b4daa94b702bf7485179b6ce63e25db901d5847f3e1f9169c6c4b3ed42b9a9231ee2be51a06c75fd883178e25b7d1315ce6e630e275dfce SHA512 198d7adfc9e67da2395d53b978a08ccb253927cda73f02801da8bc437b871f699e92d889e8925996f0794475a26e79d483c80cfb87173040dca1c74dbff8c11a
-MISC metadata.xml 272 BLAKE2B dc736ec507e2494539281305ce81c89ec28ec154346788fc6e7cce71aa896342172d76215812dde5347c87e1f1be4184fe1b8057bfcc7c47ced8f24ee52fe851 SHA512 c56415b9a69f30904588186bf6a65c8415e7803d1071a3d4e672bceb9c1234e1ddbc762d5ccd01931f02307d7138ebf2814b03e60acf6d2eba0850554fd6ad18
diff --git a/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r1.ebuild b/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r1.ebuild
deleted file mode 100644
index 755c638be78a..000000000000
--- a/sys-auth/fingerprint-gui/fingerprint-gui-1.09-r1.ebuild
+++ /dev/null
@@ -1,113 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit qmake-utils readme.gentoo-r1 udev user gnome2-utils
-
-DESCRIPTION="Use Fingerprint Devices with Linux"
-HOMEPAGE="http://www.ullrich-online.cc/fingerprint/ https://github.com/maksbotan/fingerprint-gui"
-SRC_URI="https://github.com/maksbotan/fingerprint-gui/archive/v${PV}-qt5.tar.gz -> ${P}.tar.gz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~amd64 ~x86"
-IUSE="+upekbsapi"
-
-DEPEND="
-	app-crypt/qca[qt5(+)]
-	dev-qt/qtcore:5
-	dev-qt/qtwidgets:5
-	dev-qt/qtxml:5
-	dev-qt/qtx11extras:5
-	sys-auth/libfprint
-	sys-auth/polkit-qt[qt5(+)]
-	sys-libs/pam
-	x11-libs/libX11
-	x11-libs/libfakekey
-	dev-libs/libusb
-	!sys-auth/thinkfinger
-"
-RDEPEND="${DEPEND}"
-
-QA_SONAME="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
-QA_PRESTRIPPED="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
-QA_FLAGS_IGNORED="/usr/lib/libbsapi.so.* /usr/lib64/libbsapi.so.*"
-
-S="${WORKDIR}/${P}-qt5"
-
-HTML_DOCS=( doc/Hacking.html doc/Step-by-step-manual.html )
-
-src_prepare() {
-	eapply_user
-
-	sed -e '/Icon=/s:=.*:=Fingerprint:' \
-		-i bin/${PN}/${PN}.desktop || die
-	sed -e "s:/etc/udev/rules.d:\"$(get_udevdir)\"/rules.d:g" \
-		-i bin/${PN%-gui}-helper/${PN%-gui}-helper.pro || die
-	sed -e 's:GROUP="plugdev":GROUP="fingerprint":' \
-		-i bin/fingerprint-helper/92-fingerprint-gui-uinput.rules \
-		-i upek/91-fingerprint-gui-upek.rules || die
-	sed -e '/DOCDIR\s\+=/s:'${PN}':'${PF}/html':' \
-		-i bin/fingerprint-gui/fingerprint-gui.pro || die
-	sed -e '/#define DOCDIR/s:'${PN}':'${PF}/html':' \
-		-i include/Globals.h || die
-}
-
-src_configure() {
-	eqmake5 \
-		PREFIX="${EROOT}"usr \
-		LIB="$(get_libdir)" \
-		LIBEXEC=libexec \
-		LIBPOLKIT_QT=LIBPOLKIT_QT_1_1
-}
-
-src_install() {
-	export INSTALL_ROOT="${D}" #submakes need it as well, re-install fails otherwise.
-	emake -j1 install
-	if use upekbsapi ; then
-		use amd64 && dolib.so upek/lib64/libbsapi.so*
-		use x86 && dolib.so upek/lib/libbsapi.so*
-		udev_dorules upek/91-fingerprint-gui-upek.rules
-		insinto /etc
-		doins upek/upek.cfg
-		#dodir /var/upek_data
-		#fowners root:plugdev /var/upek_data
-		#fperms 0775 /var/upek_data
-	fi
-	doicon src/res/Fingerprint.png
-
-	einstalldocs
-
-	keepdir /var/lib/fingerprint-gui
-
-	readme.gentoo_create_doc
-}
-
-pkg_preinst() {
-	enewgroup fingerprint
-
-	gnome2_icon_cache_update
-}
-
-pkg_postinst() {
-	einfo "Fixing permisisons of fingerprints..."
-	find "${EROOT}"/var/lib/fingerprint-gui -exec chown root:root {} + || die "chown root:root failed"
-	find "${EROOR}"/var/lib/fingerprint-gui -type d -exec chmod 755 {} + || die "chmod 755 failed"
-	find "${EROOT}"/var/lib/fingerprint-gui -type f -exec chmod 600 {} + || die "chmod 600 failed"
-
-	readme.gentoo_print_elog
-
-	gnome2_icon_cache_update
-}
-
-FORCE_PRINT_ELOG=1
-DISABLE_AUTOFORMATTING=1
-DOC_CONTENTS="Please take a thorough look a the Step-by-step-manual.html
-in /usr/share/doc/${PF}/html for integration with pam/polkit/...
-Hint: You may want
-auth sufficient  pam_fingerprint-gui.so
-in /etc/pam.d/system-auth
-
-There are udev rules to enforce group fingerprint on the reader device
-Please put yourself in that group and re-trigger the udev rules."
diff --git a/sys-auth/fingerprint-gui/metadata.xml b/sys-auth/fingerprint-gui/metadata.xml
deleted file mode 100644
index 4905ac7e34ff..000000000000
--- a/sys-auth/fingerprint-gui/metadata.xml
+++ /dev/null
@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-<!-- maintainer-needed -->
-<use>
-	<flag name="upekbsapi">Add UPEK BSAPI drivers for identify functions on some readers</flag>
-</use>
-</pkgmetadata>
diff --git a/sys-auth/keystone/Manifest b/sys-auth/keystone/Manifest
index 4cb9b0b92211..580b932fd6d3 100644
--- a/sys-auth/keystone/Manifest
+++ b/sys-auth/keystone/Manifest
@@ -1,6 +1,11 @@
 DIST keystone-17.0.0.tar.gz 1607717 BLAKE2B d59ccc651fa5363442ad6c1f3b2f2c2f6393468502e41d3aca7a9f4bd1d27fb558101ed37d051dcf7cdd77edb04df5ec1a739346dd889a5c873a607383897d25 SHA512 9d52a49fdcf1e891ae936ca221815576985a0f9a252960628dfbed18ca80c3f2af5a6311d7cf7c3d868ff4b02187515702ec297db1b2d49314662c46edf5c080
+DIST keystone-18.0.0.tar.gz 1679326 BLAKE2B 714df5a1d7c6d601d1743a2dd3bac57c1006aeb9361241edf4205c583b6df6763411c27aa0d420aa94ee2a8cc581678013cc27ae8a97747f903d61fc852afb6e SHA512 48aa9aae46e0f61596222aa37def152cdb48876afb7edc1eadf84ea91c8bd2f6bfd645d64e9bfb82cf9d041d7ae432c34d25e34130b32b4815d9a73cea903ffc
 DIST keystone.conf.sample-17.0.0 105293 BLAKE2B f0e685f99ca3b6cdfb9ccd0b41709bd6c51cb4aa79d20fa12773f96cd6ecad730691cf7fb2384b0ab44787d6e2825c5f147310ca19d82a2adb6cd2ab623b52f2 SHA512 fc7e7272b1a0f8703fe8ec8f93208573b84a2121b55de919beb05c7bb7dd3542c71983dfdc73b7cb618eb68167e6c6a51aa8384839ae3503c677e17ff030f383
+DIST keystone.conf.sample-18.0.0 107458 BLAKE2B c1d826acdd671638fc4542864811bda8baa237cfbf24438fa0cedc12e6f29047178cfb1b837c0aef035410848ce3e473e58b51f0eadee4c61eb75f214c65c35a SHA512 6488a1c3eac0d1376db0950cda65c62ba04dc03d896a6c0465ea09b870e5d077ed5012a84657defb9f63db25ce320c884f72c4083e4a233f18930120194ba73b
 DIST keystone.conf.sample-2020.1.9999 105293 BLAKE2B f0e685f99ca3b6cdfb9ccd0b41709bd6c51cb4aa79d20fa12773f96cd6ecad730691cf7fb2384b0ab44787d6e2825c5f147310ca19d82a2adb6cd2ab623b52f2 SHA512 fc7e7272b1a0f8703fe8ec8f93208573b84a2121b55de919beb05c7bb7dd3542c71983dfdc73b7cb618eb68167e6c6a51aa8384839ae3503c677e17ff030f383
+DIST keystone.conf.sample-2020.2.9999 105293 BLAKE2B f0e685f99ca3b6cdfb9ccd0b41709bd6c51cb4aa79d20fa12773f96cd6ecad730691cf7fb2384b0ab44787d6e2825c5f147310ca19d82a2adb6cd2ab623b52f2 SHA512 fc7e7272b1a0f8703fe8ec8f93208573b84a2121b55de919beb05c7bb7dd3542c71983dfdc73b7cb618eb68167e6c6a51aa8384839ae3503c677e17ff030f383
 EBUILD keystone-17.0.0.ebuild 5508 BLAKE2B 8779e0f11ccdd028b6db17d837e7b6c5663cf018737c728ea6e0396234a06676446c3087d28c004ea5a25c5af1c157f903d7d3b65ffca0b05596a94014245876 SHA512 e70b26e703b47948099f156ad6031b29d2df99a3e17057897a8530002fff9a314c94e20702881f3b98961bd233f47a2de8f8f0ea0fe30b25c281d01e25ed96c0
+EBUILD keystone-18.0.0.ebuild 5517 BLAKE2B 55b1c4231cc1e012cb76ba4cd8bd6e198fd5261881cfc45ac8350bd39bca758d5db52d5aa83adb1a5774ecbcf072d27d18682622542f69c1f66e4c0743a35486 SHA512 c8461b7b509acc14a534b752cfedb656220f0e4690cdaf6d01791d3c94a5bbda0ad0758fad678013a371940c0ef146cb4ff54fd139f9ca64fa361430274c59b2
 EBUILD keystone-2020.1.9999.ebuild 5510 BLAKE2B e122338074aa33c3ec97d483df5d3c75bb72575cdb59543f33b090bf29b9e1dfefe24a1a2296b5b6455423234f49f4dc04f18e5fcb07310ab8a2ffdb2bb61abb SHA512 a9328e60a80c112041ee2798b7f2106f1c937003886d9d73326cfad19f4fca9b6cd834415ec7a42f156ef10f835a420c6488c8c6d67b5ef923eb6c7517063e9c
+EBUILD keystone-2020.2.9999.ebuild 5517 BLAKE2B 55b1c4231cc1e012cb76ba4cd8bd6e198fd5261881cfc45ac8350bd39bca758d5db52d5aa83adb1a5774ecbcf072d27d18682622542f69c1f66e4c0743a35486 SHA512 c8461b7b509acc14a534b752cfedb656220f0e4690cdaf6d01791d3c94a5bbda0ad0758fad678013a371940c0ef146cb4ff54fd139f9ca64fa361430274c59b2
 MISC metadata.xml 654 BLAKE2B f4ab0710d9df108ad25c402094d8586777b892ac135a5cb690f54a1656d77bb8fac1283f687b65a86bc3eff1ef77e11b3e5899f36f135f4b0d88f445135e21dd SHA512 01f0b211a0560c451cafb7653790b8f84930c542713637ba6305a536d65103bb54e80d66dfd12daecfbb189b33825393ea13b4cc19d9733a09478920165e3f6e
diff --git a/sys-auth/keystone/keystone-18.0.0.ebuild b/sys-auth/keystone/keystone-18.0.0.ebuild
new file mode 100644
index 000000000000..875d600dda54
--- /dev/null
+++ b/sys-auth/keystone/keystone-18.0.0.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_7 python3_8 )
+DISTUTILS_USE_SETUPTOOLS=rdepend
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/victoria/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/victoria"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/victoria/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.7[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.3.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.3.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.3.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.13.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-6.0.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-3.0.2[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-5.0.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-3.2.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/keystone/keystone-2020.2.9999.ebuild b/sys-auth/keystone/keystone-2020.2.9999.ebuild
new file mode 100644
index 000000000000..875d600dda54
--- /dev/null
+++ b/sys-auth/keystone/keystone-2020.2.9999.ebuild
@@ -0,0 +1,156 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+PYTHON_COMPAT=( python3_7 python3_8 )
+DISTUTILS_USE_SETUPTOOLS=rdepend
+
+inherit distutils-r1
+
+DESCRIPTION="The Openstack authentication, authorization, and service catalog"
+HOMEPAGE="https://launchpad.net/keystone"
+if [[ ${PV} == *9999 ]];then
+	inherit git-r3
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/victoria/keystone.conf.sample -> keystone.conf.sample-${PV}"
+	EGIT_REPO_URI="https://github.com/openstack/keystone.git"
+	EGIT_BRANCH="stable/victoria"
+else
+	SRC_URI="https://dev.gentoo.org/~prometheanfire/dist/openstack/keystone/victoria/keystone.conf.sample -> keystone.conf.sample-${PV}
+	https://tarballs.openstack.org/${PN}/${P}.tar.gz"
+	KEYWORDS="~amd64 ~arm64 ~x86"
+fi
+
+LICENSE="Apache-2.0"
+SLOT="0"
+IUSE="+sqlite ldap memcached mongo mysql postgres test"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="|| ( mysql postgres sqlite )"
+
+CDEPEND=">=dev-python/pbr-2.0.0[${PYTHON_USEDEP}]
+	!~dev-python/pbr-2.1.0"
+DEPEND="
+	${CDEPEND}"
+RDEPEND="
+	${CDEPEND}
+	>=dev-python/webob-1.7.1[${PYTHON_USEDEP}]
+	>=dev-python/flask-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/flask-restful-0.3.5[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-2.7[${PYTHON_USEDEP}]
+	sqlite? (
+		>=dev-python/sqlalchemy-1.3.0[sqlite,${PYTHON_USEDEP}]
+	)
+	mysql? (
+		>=dev-python/pymysql-0.7.6[${PYTHON_USEDEP}]
+		!~dev-python/pymysql-0.7.7[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.3.0[${PYTHON_USEDEP}]
+	)
+	postgres? (
+		>=dev-python/psycopg-2.5.0[${PYTHON_USEDEP}]
+		>=dev-python/sqlalchemy-1.3.0[${PYTHON_USEDEP}]
+	)
+	>=dev-python/sqlalchemy-migrate-0.13.0[${PYTHON_USEDEP}]
+	>=dev-python/stevedore-1.20.0[${PYTHON_USEDEP}]
+	>=dev-python/passlib-1.7.0[${PYTHON_USEDEP}]
+	>=dev-python/python-keystoneclient-3.8.0[${PYTHON_USEDEP}]
+	>=dev-python/keystonemiddleware-7.0.0[${PYTHON_USEDEP}]
+	>=dev-python/bcrypt-3.1.3[${PYTHON_USEDEP}]
+	>=dev-python/scrypt-0.8.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-cache-1.26.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-config-5.2.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-context-2.22.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-messaging-5.29.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-db-6.0.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-i18n-3.15.3[${PYTHON_USEDEP}]
+	>=dev-python/oslo-log-3.44.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-middleware-3.31.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-policy-3.0.2[${PYTHON_USEDEP}]
+	>=dev-python/oslo-serialization-1.18.0[${PYTHON_USEDEP}]
+	!~dev-python/oslo-serialization-1.19.1[${PYTHON_USEDEP}]
+	>=dev-python/oslo-upgradecheck-0.1.0[${PYTHON_USEDEP}]
+	>=dev-python/oslo-utils-3.33.0[${PYTHON_USEDEP}]
+	>=dev-python/oauthlib-0.6.2[${PYTHON_USEDEP}]
+	>=dev-python/pysaml2-5.0.0[${PYTHON_USEDEP}]
+	>=dev-python/pyjwt-1.6.1[${PYTHON_USEDEP}]
+	>=dev-python/dogpile-cache-1.0.2[${PYTHON_USEDEP}]
+	>=dev-python/jsonschema-3.2.0[${PYTHON_USEDEP}]
+	>=dev-python/pycadf-1.1.0[${PYTHON_USEDEP}]
+	!~dev-python/pycadf-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/msgpack-0.5.0[${PYTHON_USEDEP}]
+	>=dev-python/osprofiler-1.4.0[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2013.6[${PYTHON_USEDEP}]
+	memcached? (
+		>=dev-python/python-memcached-1.56[${PYTHON_USEDEP}]
+	)
+	mongo? (
+		>=dev-python/pymongo-3.0.2[${PYTHON_USEDEP}]
+		!~dev-python/pymongo-3.1[${PYTHON_USEDEP}]
+	)
+	ldap? (
+		>=dev-python/python-ldap-3.1.0[${PYTHON_USEDEP}]
+		>=dev-python/ldappool-2.3.1[${PYTHON_USEDEP}]
+	)
+	|| (
+		www-servers/uwsgi[python,${PYTHON_USEDEP}]
+		www-apache/mod_wsgi[${PYTHON_USEDEP}]
+		www-servers/gunicorn[${PYTHON_USEDEP}]
+	)
+	acct-user/keystone
+	acct-group/keystone"
+
+python_prepare_all() {
+	# it's in git, but not in the tarball.....
+	sed -i '/^hacking/d' test-requirements.txt || die
+	mkdir -p ${PN}/tests/tmp/ || die
+	sed -i 's|/usr/local|/usr|g' httpd/keystone-uwsgi-* || die
+	sed -i 's|python|python27|g' httpd/keystone-uwsgi-* || die
+	# allow useage of renamed msgpack
+	sed -i '/^msgpack/d' requirements.txt || die
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	nosetests -I 'test_keystoneclient*' \
+		-e test_static_translated_string_is_Message \
+		-e test_get_token_id_error_handling \
+		-e test_provider_token_expiration_validation \
+		-e test_import --process-restartworker --process-timeout=60 || die "testsuite failed under python2.7"
+}
+
+python_install_all() {
+	distutils-r1_python_install_all
+
+	diropts -m 0750
+	keepdir /etc/keystone /var/log/keystone
+	insinto /etc/keystone
+	insopts -m0640 -okeystone -gkeystone
+	newins "${DISTDIR}/keystone.conf.sample-${PV}" keystone.conf.sample
+	doins etc/logging.conf.sample
+	doins etc/default_catalog.templates
+#	doins etc/policy.v3cloudsample.json
+	insinto /etc/keystone/httpd
+	doins httpd/*
+
+	fowners keystone:keystone /etc/keystone /etc/keystone/httpd /var/log/keystone
+	# stupid python doing stupid things
+	rm -r "${ED}"/usr/etc
+}
+
+pkg_postinst() {
+	elog "You might want to run:"
+	elog "emerge --config =${CATEGORY}/${PF}"
+	elog "if this is a new install."
+	elog "If you have not already configured your openssl installation"
+	elog "please do it by modifying /etc/ssl/openssl.cnf"
+	elog "BEFORE issuing the configuration command."
+	elog "Otherwise default values will be used."
+}
+
+pkg_config() {
+	if [ ! -d "${ROOT}"/etc/keystone/ssl ] ; then
+		einfo "Press ENTER to configure the keystone PKI, or Control-C to abort now..."
+		read
+		"${ROOT}"/usr/bin/keystone-manage pki_setup --keystone-user keystone --keystone-group keystone
+	else
+		einfo "keystone PKI certificates directory already present, skipping configuration"
+	fi
+}
diff --git a/sys-auth/libfprint/Manifest b/sys-auth/libfprint/Manifest
index e606994f74fe..b9bc4dd3cd09 100644
--- a/sys-auth/libfprint/Manifest
+++ b/sys-auth/libfprint/Manifest
@@ -4,9 +4,11 @@ DIST libfprint-1.0.tar.gz 475347 BLAKE2B cb560898cec11861c4529c0c37c328f74eaf271
 DIST libfprint-1.90.0.tar.gz 1760869 BLAKE2B fd0692e5a4924101399684289501d607da2183acf7f7b7c7ce22b7ed301fe0da75cb0b88c0642e1b1b6f82fe7d8505616ead456b48c3b0449201fd91669ce782 SHA512 99d7a62b3a1c329a2c13f508c98b60c6311fd01cd165fca12de5873305980167dd79c7d75edc74f53fce5066047e814fa654c6ac4f3f12342b57afa5b2dbe6d3
 DIST libfprint-1.90.1.tar.gz 2348486 BLAKE2B d9f43253d8be874f3d78e19dbd148788d8abdc3cd0d6f5c931a4aad650acaf647f9c818c22a575f9ebe0a698a338693448f6f460c780adcd7140dedbdc4e025f SHA512 0548d29e55aaa59e73f0fd13cac6b85dd3a048358c365423e12884c3877c3e30422ee3fc4d18a3daba2f26383fb886f1d40a74dba5d947f7bdec6b8852995b4e
 DIST libfprint-1.90.2.tar.gz 4152489 BLAKE2B d8e8dde93acfc83dc253741517eb840b1a950b5626f2aabef4d4a44fcef2db95096e7d467ae3191c3478e93c0919acbf48010b0c4dd23a538466a25d8204ddf6 SHA512 58326714ce92514e2f95da84c94ca1286cadb0f0bb7de68f15aba0120a22e4a51d8bc6d3d7dc0a4e46e3620e2bd0b3247d07782a3308daf2edd44a4ddb60d226
+DIST libfprint-1.90.3.tar.gz 4169175 BLAKE2B ae883910dac19159c9183eac263d0ab71a92f67c233d9ec562630897f51063154bc207f54b41396ce169e87304d7989930b3f3204b87590eb56a82f7e796eba9 SHA512 3420df99c0e388af523f74c008fe603d28599d2ca482ec12a777d8b876e959cac946405fb14ba41fa536997ebd6857d945453e1374a0e05cd8f4fb02ca739891
 EBUILD libfprint-0.99.0.ebuild 1064 BLAKE2B cd423e193f99820215e80732b76b90052a762934bf586c7a963a723195632e21b0a7ee75308f6aab96e5929a7c609f208ac51255c05aaee93fe5befea450e450 SHA512 5e0d8c1a8172be18a722c458013062adad86338cd25fdefb25747cdb54c4092976c2bf9f1830b3dd0ba532110078d8e0721d81fd8238e2c762874debf5032084
 EBUILD libfprint-1.0.ebuild 1070 BLAKE2B e0e493c3286514549b4649c595d4bc90b133891973e5826c572381d19e1bdcc20c70253e585ccbe0cebf6f3a9ce8d54d3d0a81468d04dabbed0872bd1b025d04 SHA512 8d0a321813e7330e385d7fc2f7f7c361cd6c04a4347877c0a78b289d9ecdcd7a885cd33847a56d626369f8f23476448c68c7d392606254bbc777427e0c74d091
 EBUILD libfprint-1.90.0.ebuild 1090 BLAKE2B 72d7872b019cab605c6319467a0891cc1a37913a97751feda05782d6082a8ec82e5b9da3f774f16233da9edb13ccccb787dec6995f33181f90d973fc560a7f74 SHA512 b90c80988627727b95969e5ae14fdff193ef2b1a76cd83772df29a1e132cc0ca2f463c24065057715744ed4bd1277ece2aca7eb96b7a8fd699506f72faa2ae3b
 EBUILD libfprint-1.90.1.ebuild 1140 BLAKE2B 94f6ee0925e3b0dac172347e36d43a7344036b2498f0056cd6d322da744644c08e87eb07b16cfc0f4b3b824ae2d6b9ea698dc41e9a2023a4a35b33b78d12ba27 SHA512 594f0d9c06472cfcb1101dfcdbe24f19de8f6fc8b512339243d16a10ac8f3826baf90198a8ed39397905281b27f50b8d135e1bebdd943e886dc62b6792d8458b
 EBUILD libfprint-1.90.2.ebuild 1140 BLAKE2B 94f6ee0925e3b0dac172347e36d43a7344036b2498f0056cd6d322da744644c08e87eb07b16cfc0f4b3b824ae2d6b9ea698dc41e9a2023a4a35b33b78d12ba27 SHA512 594f0d9c06472cfcb1101dfcdbe24f19de8f6fc8b512339243d16a10ac8f3826baf90198a8ed39397905281b27f50b8d135e1bebdd943e886dc62b6792d8458b
+EBUILD libfprint-1.90.3.ebuild 1140 BLAKE2B 94f6ee0925e3b0dac172347e36d43a7344036b2498f0056cd6d322da744644c08e87eb07b16cfc0f4b3b824ae2d6b9ea698dc41e9a2023a4a35b33b78d12ba27 SHA512 594f0d9c06472cfcb1101dfcdbe24f19de8f6fc8b512339243d16a10ac8f3826baf90198a8ed39397905281b27f50b8d135e1bebdd943e886dc62b6792d8458b
 MISC metadata.xml 347 BLAKE2B dd0d99ac1a5a8cc925618bc556216a23f14fab90dd2e1d66747e4af3fd64d410812aac366a0e11cc169af7345c8bbf304577da5a1faf75f557bb4ba18033fb0f SHA512 f3303670a2e7d4b30732d335b313edda6c97952f2f6290ff6b1d67a8a237e147ba7c7c4edcb58994679ff9cbf606fb82b79bec1ba840a22b46ee21cfd26aefc9
diff --git a/sys-auth/libfprint/libfprint-1.90.3.ebuild b/sys-auth/libfprint/libfprint-1.90.3.ebuild
new file mode 100644
index 000000000000..311455ba8c5a
--- /dev/null
+++ b/sys-auth/libfprint/libfprint-1.90.3.ebuild
@@ -0,0 +1,45 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson udev
+
+DESCRIPTION="library to add support for consumer fingerprint readers"
+HOMEPAGE="https://cgit.freedesktop.org/libfprint/libfprint/ https://github.com/freedesktop/libfprint https://gitlab.freedesktop.org/libfprint/libfprint"
+SRC_URI="https://gitlab.freedesktop.org/libfprint/libfprint/-/archive/v${PV}/${PN}-v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="LGPL-2.1"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+IUSE="examples"
+
+RDEPEND="dev-libs/glib:2
+	dev-libs/nss
+	>=dev-libs/libgusb-0.3.1
+	virtual/libusb:1=
+	x11-libs/gtk+:3
+	x11-libs/pixman
+	x11-libs/libX11
+	x11-libs/libXv"
+
+DEPEND="${RDEPEND}
+	dev-util/gtk-doc"
+
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( ${FILESDIR}/${PN}-0.8.2-fix-implicit-declaration.patch )
+
+S="${WORKDIR}/${PN}-v${PV}"
+
+src_configure() {
+		local emesonargs=(
+			-Ddoc=false
+			-Dgtk-examples=$(usex examples true false)
+			-Ddrivers=all
+			-Dudev_rules=true
+			-Dudev_rules_dir=$(get_udevdir)/rules.d
+			--libdir=/usr/$(get_libdir)
+		)
+		meson_src_configure
+}
diff --git a/sys-auth/pam_mount/Manifest b/sys-auth/pam_mount/Manifest
index 81cdfd3b6eba..4b20aafd503d 100644
--- a/sys-auth/pam_mount/Manifest
+++ b/sys-auth/pam_mount/Manifest
@@ -1,7 +1,5 @@
 AUX pam_mount-2.16-crypto-Add-support-for-LUKS2.patch 1547 BLAKE2B f6c0ceba9ac683bd852606988688c18321b36192ea3e3d4b7443ac225b53446d594aafa78123a84847dd0b622cea54150a32a0852b572842f6f48fa7bf5e59e5 SHA512 7b37add4202fbbfef9ccbab10f4c3fc10da7dc976adab8c550ee2197b92e7f8f1db06186d155d0ae05b8c775d919d754071854a69c5d7f2a54c5b890f33bbc8f
 AUX pam_mount-2.16-remove-obsolete-openssl-api.patch 518 BLAKE2B 06dcaf0237e5e89549c1f1a6d6fef038785e9f170dc1065596b7ea2833a64d829ac762837cd0f1141db3f67571f4b43899ecc5b5e9a6ba093d9f55e8cdd7473f SHA512 362f44008810b4f9bd260cbbecba4f10b65bf7c98c77135eb5d365e91660d1fdd0c5dde65286f706c340b812e71f5f6cec85e8536263cce5e1c666068b27860c
 DIST pam_mount-2.16.tar.xz 312316 BLAKE2B 5954af8f8bf8b9cb47e1c07dc0d5fc5c4db099eeca5de90a3a53dc65aac0a2a6fba3f99c4d91d12f53b13abb5d3bae262b42536434553872a36ec108dc8d2c0c SHA512 3a579d7287cfcaef831d3e54d3e912407b65a966303e81c47f445d601f38f866ce04326e3d37a061f74f97b9cfb201e56109f57e55699d15d8f947ae2b91c8e3
-EBUILD pam_mount-2.16-r1.ebuild 961 BLAKE2B a0c8f006aae049f028a4ac968c9aa72f944174fa075681342fa6075cd71ef3a286683d300cda5b204145040f0aa41bb6bbcd0afee0a122ad2bffd76787d6ec9f SHA512 c931f62aec97428a8bc9eea02854021736da8a525b16454aa86e690225e74939958d2d2b17efa7586c6e3560f89e79445ceab20033f292b8097b1135533a9486
-EBUILD pam_mount-2.16-r2.ebuild 1234 BLAKE2B ad4df7502727a67ff6f73980df4ca625233d1694f020f7196c78e0fd773c89b60202f976430b3f70dc442912129ca93c748963dbe2a10f0c0da36d57a36f5d90 SHA512 a456634da4cf9b6ecf039136f676cec34e5f8a628944a8deecfd121775e52d48cb87606c24d133b7990ebafd9f2e007390bcf8f977b843b598c07c4e9b4123d6
-EBUILD pam_mount-2.16.ebuild 879 BLAKE2B f3bd44da6e9f928f2a66dd6b5c3ec1d57f4545bed909d2724e389203ee8db6f247d6d195014f4b64c4560b6a3848247c95a972508eb709b4c7b1f095362b83e6 SHA512 4be055ec65355fcf175b6f19613715ddb795342741f706e3983b0586898498d3b412f1d6f4b37d61f5faefc943487abb53187eb417cce188a655b6d89ca4644d
+EBUILD pam_mount-2.16-r3.ebuild 1233 BLAKE2B cc7355b64c1770f7bbda48ad0bd3521da2e2513a1d57da02420ce4dbe64934f75e79d8bc9a81db85b25f93f06a424b868a8556b1820754ad4bd5d16910314c37 SHA512 2334795bd1742559f35d1b6ce1b75eac80fc0fad6ee036aad1cb9c54514e8162cd179b21de33373bfc30e124dff95492a7f0f36692622a69a0431569646d0df1
 MISC metadata.xml 402 BLAKE2B 001c9702dee12640adcb05c6a6d9750e13ac0d45ebdb46859fc19e4071af76fcde847163f59b876992169968fefed8423352eec067ecf2ae6baa60dfdf412cc4 SHA512 546dd1bb071d1cc634250930b70328fc83f8bb4ac8a857fc3ccddadae5fcfb48d0a40adb0845e07535c63fd2dd2e6ef91779c0b48b6d147efa7aeb7fcde412e1
diff --git a/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild b/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild
deleted file mode 100644
index 4aa9be59ce6a..000000000000
--- a/sys-auth/pam_mount/pam_mount-2.16-r1.ebuild
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-DESCRIPTION="A PAM module that can mount volumes for a user session"
-HOMEPAGE="http://pam-mount.sourceforge.net"
-SRC_URI="mirror://sourceforge/pam-mount/${P}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~amd64 ~ppc ~x86"
-
-IUSE="crypt ssl selinux"
-
-COMMON_DEPEND=">=sys-libs/pam-0.99
-	>=sys-libs/libhx-3.12.1
-	>=dev-libs/libxml2-2.6
-	crypt? ( >=sys-fs/cryptsetup-1.1.0:= )
-	ssl? ( dev-libs/openssl:0= )
-	selinux? ( sys-libs/libselinux )"
-DEPEND="${COMMON_DEPEND}
-	virtual/pkgconfig"
-RDEPEND="${COMMON_DEPEND}
-	>=sys-apps/util-linux-2.20"
-
-PATCHES=(
-		"${FILESDIR}"/pam_mount-2.16-crypto-Add-support-for-LUKS2.patch
-)
-
-src_configure() {
-	econf --with-slibdir="/$(get_libdir)" \
-			$(use_with crypt cryptsetup) \
-			$(use_with ssl crypto) \
-			$(use_with selinux)
-}
-
-src_install() {
-	default
-	use selinux || rm -r "${D}"/etc/selinux
-	dodoc doc/*.txt
-}
diff --git a/sys-auth/pam_mount/pam_mount-2.16-r2.ebuild b/sys-auth/pam_mount/pam_mount-2.16-r3.ebuild
index 6ba3bfb73868..597e2da7f05f 100644
--- a/sys-auth/pam_mount/pam_mount-2.16-r2.ebuild
+++ b/sys-auth/pam_mount/pam_mount-2.16-r3.ebuild
@@ -9,12 +9,12 @@ SRC_URI="mirror://sourceforge/pam-mount/${P}.tar.xz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~amd64 ~ppc ~x86"
+KEYWORDS="amd64 ppc x86"
 
 IUSE="crypt libressl ssl selinux"
 
 COMMON_DEPEND=">=sys-libs/pam-0.99
-	>=sys-libs/libhx-3.12.1
+	>=sys-libs/libhx-3.12.1:=
 	>=dev-libs/libxml2-2.6
 	crypt? ( >=sys-fs/cryptsetup-1.1.0:= )
 	ssl? (
diff --git a/sys-auth/pam_mount/pam_mount-2.16.ebuild b/sys-auth/pam_mount/pam_mount-2.16.ebuild
deleted file mode 100644
index 95e94fc71b07..000000000000
--- a/sys-auth/pam_mount/pam_mount-2.16.ebuild
+++ /dev/null
@@ -1,38 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-DESCRIPTION="A PAM module that can mount volumes for a user session"
-HOMEPAGE="http://pam-mount.sourceforge.net"
-SRC_URI="mirror://sourceforge/pam-mount/${P}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="amd64 ppc x86"
-
-IUSE="crypt ssl selinux"
-
-COMMON_DEPEND=">=sys-libs/pam-0.99
-	>=sys-libs/libhx-3.12.1
-	>=dev-libs/libxml2-2.6
-	crypt? ( >=sys-fs/cryptsetup-1.1.0:= )
-	ssl? ( dev-libs/openssl:0= )
-	selinux? ( sys-libs/libselinux )"
-DEPEND="${COMMON_DEPEND}
-	virtual/pkgconfig"
-RDEPEND="${COMMON_DEPEND}
-	>=sys-apps/util-linux-2.20"
-
-src_configure() {
-	econf --with-slibdir="/$(get_libdir)" \
-			$(use_with crypt cryptsetup) \
-			$(use_with ssl crypto) \
-			$(use_with selinux)
-}
-
-src_install() {
-	default
-	use selinux || rm -r "${D}"/etc/selinux
-	dodoc doc/*.txt
-}
diff --git a/sys-auth/pam_passwdqc/Manifest b/sys-auth/pam_passwdqc/Manifest
deleted file mode 100644
index 9e1c70d3e3e1..000000000000
--- a/sys-auth/pam_passwdqc/Manifest
+++ /dev/null
@@ -1,2 +0,0 @@
-EBUILD pam_passwdqc-1.3.0.ebuild 441 BLAKE2B 520f36bd4d6d42eb1da16a7a1d83e51445e06a14aeea7bce1860455f18a6042ff7cdc747473112f8777ceccb0e8b2270abf10945463f21df604694f24f49b107 SHA512 4dbaa4da67e618762b57eead7bde13efd882a154d59b544a0a74b5101f62e129a09d5c308d0c8ced49f77bcee072d054f55aa3595c00bc310a865dbdefdcc0b7
-MISC metadata.xml 533 BLAKE2B 4242a27a758a3c104ccf3ee1a3f15419d1870b299ded8f65ae5016ea5223eafbef03ecf7df0c2c5cfa8fc9269b43fa0a31d630e3e127daf0c9c970a84b6b4c5b SHA512 78bba55d003eb7fdfef30534078a683c16274db018ca16f89ecf4169a27dadfe56c84b140dbb30c2a4cd812a78c240518224d195197656669212e5aee7bb8356
diff --git a/sys-auth/pam_passwdqc/metadata.xml b/sys-auth/pam_passwdqc/metadata.xml
deleted file mode 100644
index 4abb4efe616c..000000000000
--- a/sys-auth/pam_passwdqc/metadata.xml
+++ /dev/null
@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
-<pkgmetadata>
-	<!-- maintainer-needed -->
-	<longdescription>
-		Password strength checking for PAM aware password changing programs. This is an alternative to the default cracklib.
-	</longdescription>
-	<longdescription lang="ja">
-		パスワード変更プログラムに反応する PAM のパスワード強度検査機能です。これはデフォルトの cracklib の代替です。
-	</longdescription>
-</pkgmetadata>
diff --git a/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild b/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild
deleted file mode 100644
index 0d8901ab8eed..000000000000
--- a/sys-auth/pam_passwdqc/pam_passwdqc-1.3.0.ebuild
+++ /dev/null
@@ -1,14 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-DESCRIPTION="Stub ebuild to help migrate to newer package name"
-HOMEPAGE="http://www.openwall.com/passwdqc/"
-
-LICENSE="Openwall BSD public-domain"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~amd64-linux ~x86-linux"
-
-DEPEND="sys-auth/passwdqc[pam(+)]"
-RDEPEND="${DEPEND}"
diff --git a/sys-auth/pam_ssh_agent_auth/Manifest b/sys-auth/pam_ssh_agent_auth/Manifest
index dc3c6dbedd81..0c1473643042 100644
--- a/sys-auth/pam_ssh_agent_auth/Manifest
+++ b/sys-auth/pam_ssh_agent_auth/Manifest
@@ -1,5 +1,5 @@
-AUX pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch 46417 BLAKE2B bb62c32fc9c1eb5dc0788b9a535fdf6000812c57a6a758e693406a0d01bcf0cc5ec9f7622c4f21cee74895657a5a3ad13255e19d51e20eca8978e63864266629 SHA512 279fad3be9289c1da06d34e08d2b81a8ad863e07c7b0471419c029aa121abe9942ae4cc4259b7f1e2c2dd32368fc07dc1f9432aba860820455e0d9419c9e7f74
+DIST pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch 46417 BLAKE2B bb62c32fc9c1eb5dc0788b9a535fdf6000812c57a6a758e693406a0d01bcf0cc5ec9f7622c4f21cee74895657a5a3ad13255e19d51e20eca8978e63864266629 SHA512 279fad3be9289c1da06d34e08d2b81a8ad863e07c7b0471419c029aa121abe9942ae4cc4259b7f1e2c2dd32368fc07dc1f9432aba860820455e0d9419c9e7f74
 DIST pam_ssh_agent_auth-0.10.3.tar.bz2 1066393 BLAKE2B 07b113d05e09f770d63dbea813ea644199d2b103f9c6d7e5960bfad37cb181ce5a5f111f72e0274c0335e4c217ccd19bd53d61af23f8bc6aff14c1995fc4edc9 SHA512 d75062c4e46b0b011f46aed9704a99049995fea8b5115ff7ee26dad7e93cbcf54a8af7efc6b521109d77dc03c6f5284574d2e1b84c6829cec25610f24fb4bd66
-EBUILD pam_ssh_agent_auth-0.10.3.ebuild 991 BLAKE2B 56a65cba4ee10a69b1c1826b6bce42b84f735426b69a0c22a761c8924b0f30a57062b8ed81dbe95b9ae457fdc573542b4b5381dbb164591a742436d08560f7e4 SHA512 da65ebda9921221636bec2e7e71d44f18db87f5ea982e5ee6e26a7df7aef1e34624270c82a66e017424fd1f44606f2b415af023c4e6adc4b7fcabcab7aaab659
-EBUILD pam_ssh_agent_auth-9999.ebuild 939 BLAKE2B 15e4b020134a9b85eb3119c2b79c139bc9c809295bea33c010b56d83f1a7573b580b66e4edbb4136823ed8610f4c1cb449abbe824db4c9eab891555ea6ee6b27 SHA512 11fa218a714fc92aecc51636df1bc8058c40657f2024ccca5f5771ea381eeaf90bfbee02f443cbcbc71f76c336853c43c232a54ab8e40778d4b4818174d4563f
+EBUILD pam_ssh_agent_auth-0.10.3.ebuild 1083 BLAKE2B be95146fea66f17bf4e7e307ca6c1abe3996f1036024a89feafe6ecc461bdff62a838cef6774a6febdf0848bfffd26bee32b893b0287009bdc72ec7cccb37f88 SHA512 e4c2fec3ba36d72dea9ab44cbda38684ad6b82c6e98877f4a49a5f93f825db33a660423e8bc11b36251305f72dbf276d323b13c81ecfdbde1ac73fd6d7e5ab03
+EBUILD pam_ssh_agent_auth-9999.ebuild 1083 BLAKE2B be95146fea66f17bf4e7e307ca6c1abe3996f1036024a89feafe6ecc461bdff62a838cef6774a6febdf0848bfffd26bee32b893b0287009bdc72ec7cccb37f88 SHA512 e4c2fec3ba36d72dea9ab44cbda38684ad6b82c6e98877f4a49a5f93f825db33a660423e8bc11b36251305f72dbf276d323b13c81ecfdbde1ac73fd6d7e5ab03
 MISC metadata.xml 319 BLAKE2B 20691dc382ee9681b1d2263cdb263eea3425cb4722cb04e014c992c091a793db3295ae9215447ade8e80ff00b26ecf255f59f98ad6f7474b98af3c50be0d4dce SHA512 c8813d731e8314b510c664ea221fe40524fabf52d5bf5785456c64c6797a55d2f71fb02e2d53832f9be7a855655ea6870c20abb06167abefb780f349d3034127
diff --git a/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch b/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch
deleted file mode 100644
index a422cd5e479f..000000000000
--- a/sys-auth/pam_ssh_agent_auth/files/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch
+++ /dev/null
@@ -1,1244 +0,0 @@
-From eef90424a0545b7b0125dfaf5e3cef3c5248ada0 Mon Sep 17 00:00:00 2001
-From: Guido Falsi <mad@madpilot.net>
-Date: Sat, 20 Oct 2018 14:29:43 +0200
-Subject: [PATCH 1/2] Adapt to OpenSSL 1.1.1.
-
-The FreeBSD operating system is migrating to OpenSSL 1.1.1 and I have created this set of patches to make pam_ssh_agent_auth compile with it.
-
-The patch comments out some parts of include files which are not actually used and reference now opaque OpenSSL internals.
-
-I also have migrated the source files to use accessors to use the OpenSSL objects.
-
-The patch works on FreeBSD head (will be 12.0) but the --without-openssl-header-check argument is required in configure there.
----
- authfd.c    |  50 ++++++++++++++++++++
- bufbn.c     |   4 ++
- cipher.h    |   6 ++-
- kex.h       |   9 +++-
- key.c       | 133 ++++++++++++++++++++++++++++++++++++++++++++++++++--
- ssh-dss.c   |  51 ++++++++++++++++----
- ssh-ecdsa.c |  40 ++++++++++++----
- ssh-rsa.c   |  22 +++++++--
- 8 files changed, 287 insertions(+), 28 deletions(-)
-
-diff --git a/authfd.c b/authfd.c
-index 7b96921..35f8de1 100644
---- a/authfd.c
-+++ b/authfd.c
-@@ -372,6 +372,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
- 	case 1:
- 		key = pamsshagentauth_key_new(KEY_RSA1);
- 		bits = pamsshagentauth_buffer_get_int(&auth->identities);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->e);
- 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->n);
- 		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
-@@ -379,6 +380,15 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
- 		if (keybits < 0 || bits != (u_int)keybits)
- 			pamsshagentauth_logit("Warning: identity keysize mismatch: actual %d, announced %u",
- 			    BN_num_bits(key->rsa->n), bits);
-+#else
-+		pamsshagentauth_buffer_get_bignum(&auth->identities, RSA_get0_e(key->rsa));
-+		pamsshagentauth_buffer_get_bignum(&auth->identities, RSA_get0_n(key->rsa));
-+		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
-+		keybits = BN_num_bits(RSA_get0_n(key->rsa));
-+		if (keybits < 0 || bits != (u_int)keybits)
-+			pamsshagentauth_logit("Warning: identity keysize mismatch: actual %d, announced %u",
-+			    BN_num_bits(RSA_get0_n(key->rsa)), bits);
-+#endif
- 		break;
- 	case 2:
- 		blob = pamsshagentauth_buffer_get_string(&auth->identities, &blen);
-@@ -422,9 +432,15 @@ ssh_decrypt_challenge(AuthenticationConnection *auth,
- 	}
- 	pamsshagentauth_buffer_init(&buffer);
- 	pamsshagentauth_buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
- 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->e);
- 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->n);
-+#else
-+	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(RSA_get0_n(key->rsa)));
-+	pamsshagentauth_buffer_put_bignum(&buffer, RSA_get0_e(key->rsa));
-+	pamsshagentauth_buffer_put_bignum(&buffer, RSA_get0_n(key->rsa));
-+#endif
- 	pamsshagentauth_buffer_put_bignum(&buffer, challenge);
- 	pamsshagentauth_buffer_append(&buffer, session_id, 16);
- 	pamsshagentauth_buffer_put_int(&buffer, response_type);
-@@ -501,6 +517,7 @@ ssh_agent_sign(AuthenticationConnection *auth,
- static void
- ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
- {
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	pamsshagentauth_buffer_put_int(b, BN_num_bits(key->n));
- 	pamsshagentauth_buffer_put_bignum(b, key->n);
- 	pamsshagentauth_buffer_put_bignum(b, key->e);
-@@ -509,6 +526,16 @@ ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
- 	pamsshagentauth_buffer_put_bignum(b, key->iqmp);	/* ssh key->u */
- 	pamsshagentauth_buffer_put_bignum(b, key->q);	/* ssh key->p, SSL key->q */
- 	pamsshagentauth_buffer_put_bignum(b, key->p);	/* ssh key->q, SSL key->p */
-+#else
-+	pamsshagentauth_buffer_put_int(b, BN_num_bits(RSA_get0_n(key)));
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_n(key));
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_e(key));
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_d(key));
-+	/* To keep within the protocol: p < q for ssh. in SSL p > q */
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_iqmp(key));	/* ssh key->u */
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_q(key));	/* ssh key->p, SSL key->q */
-+	pamsshagentauth_buffer_put_bignum(b, RSA_get0_p(key));	/* ssh key->q, SSL key->p */
-+#endif
- 	pamsshagentauth_buffer_put_cstring(b, comment);
- }
- 
-@@ -518,19 +545,36 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
- 	pamsshagentauth_buffer_put_cstring(b, key_ssh_name(key));
- 	switch (key->type) {
- 	case KEY_RSA:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->n);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->e);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->d);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->iqmp);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->p);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->q);
-+#else
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_n(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_e(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_d(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_iqmp(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_p(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(b, RSA_get0_q(key->rsa));
-+#endif
- 		break;
- 	case KEY_DSA:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->p);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->q);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->g);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->pub_key);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->priv_key);
-+#else
-+		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_p(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_q(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_g(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_pub_key(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(b, DSA_get0_priv_key(key->dsa));
-+#endif
- 		break;
- 	}
- 	pamsshagentauth_buffer_put_cstring(b, comment);
-@@ -610,9 +654,15 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
- 
- 	if (key->type == KEY_RSA1) {
- 		pamsshagentauth_buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(key->rsa->n));
- 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->e);
- 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->n);
-+#else
-+		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(RSA_get0_n(key->rsa)));
-+		pamsshagentauth_buffer_put_bignum(&msg, RSA_get0_e(key->rsa));
-+		pamsshagentauth_buffer_put_bignum(&msg, RSA_get0_n(key->rsa));
-+#endif
- 	} else if (key->type == KEY_DSA || key->type == KEY_RSA) {
- 		pamsshagentauth_key_to_blob(key, &blob, &blen);
- 		pamsshagentauth_buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY);
-diff --git a/bufbn.c b/bufbn.c
-index 6a49c73..4ecedc1 100644
---- a/bufbn.c
-+++ b/bufbn.c
-@@ -151,7 +151,11 @@ pamsshagentauth_buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
- 		pamsshagentauth_buffer_put_int(buffer, 0);
- 		return 0;
- 	}
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	if (value->neg) {
-+#else
-+	if (BN_is_negative(value)) {
-+#endif
- 		pamsshagentauth_logerror("buffer_put_bignum2_ret: negative numbers not supported");
- 		return (-1);
- 	}
-diff --git a/cipher.h b/cipher.h
-index 49bbc16..64f59ca 100644
---- a/cipher.h
-+++ b/cipher.h
-@@ -59,15 +59,18 @@
- #define CIPHER_DECRYPT		0
- 
- typedef struct Cipher Cipher;
--typedef struct CipherContext CipherContext;
-+// typedef struct CipherContext CipherContext;
- 
- struct Cipher;
-+/*
- struct CipherContext {
- 	int	plaintext;
- 	EVP_CIPHER_CTX evp;
- 	Cipher *cipher;
- };
-+*/
- 
-+/*
- u_int	 cipher_mask_ssh1(int);
- Cipher	*cipher_by_name(const char *);
- Cipher	*cipher_by_number(int);
-@@ -88,4 +91,5 @@ void	 cipher_set_keyiv(CipherContext *, u_char *);
- int	 cipher_get_keyiv_len(const CipherContext *);
- int	 cipher_get_keycontext(const CipherContext *, u_char *);
- void	 cipher_set_keycontext(CipherContext *, u_char *);
-+*/
- #endif				/* CIPHER_H */
-diff --git a/kex.h b/kex.h
-index 8e29c90..81ca57d 100644
---- a/kex.h
-+++ b/kex.h
-@@ -70,7 +70,7 @@ enum kex_exchange {
- #define KEX_INIT_SENT	0x0001
- 
- typedef struct Kex Kex;
--typedef struct Mac Mac;
-+// typedef struct Mac Mac;
- typedef struct Comp Comp;
- typedef struct Enc Enc;
- typedef struct Newkeys Newkeys;
-@@ -84,6 +84,7 @@ struct Enc {
- 	u_char	*key;
- 	u_char	*iv;
- };
-+/*
- struct Mac {
- 	char	*name;
- 	int	enabled;
-@@ -95,11 +96,13 @@ struct Mac {
- 	HMAC_CTX	evp_ctx;
- 	struct umac_ctx *umac_ctx;
- };
-+*/
- struct Comp {
- 	int	type;
- 	int	enabled;
- 	char	*name;
- };
-+/*
- struct Newkeys {
- 	Enc	enc;
- 	Mac	mac;
-@@ -126,7 +129,9 @@ struct Kex {
- 	int	(*host_key_index)(Key *);
- 	void	(*kex[KEX_MAX])(Kex *);
- };
-+*/
- 
-+/*
- Kex	*kex_setup(char *[PROPOSAL_MAX]);
- void	 kex_finish(Kex *);
- 
-@@ -152,6 +157,8 @@ kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *,
- void
- derive_ssh1_session_id(BIGNUM *, BIGNUM *, u_int8_t[8], u_int8_t[16]);
- 
-+*/
-+
- #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
- void	dump_digest(char *, u_char *, int);
- #endif
-diff --git a/key.c b/key.c
-index 107a442..aedbbb5 100644
---- a/key.c
-+++ b/key.c
-@@ -77,15 +77,21 @@ pamsshagentauth_key_new(int type)
- 	case KEY_RSA:
- 		if ((rsa = RSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: RSA_new failed");
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((rsa->n = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
- 		if ((rsa->e = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
-+#else
-+		if (RSA_set0_key(rsa, BN_new(), BN_new(), NULL) != 1)
-+			pamsshagentauth_fatal("key_new: RSA_set0_key failed");
-+#endif
- 		k->rsa = rsa;
- 		break;
- 	case KEY_DSA:
- 		if ((dsa = DSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: DSA_new failed");
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((dsa->p = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
- 		if ((dsa->q = BN_new()) == NULL)
-@@ -94,6 +100,12 @@ pamsshagentauth_key_new(int type)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
- 		if ((dsa->pub_key = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
-+#else
-+		if (DSA_set0_pqg(dsa, BN_new(), BN_new(), BN_new()) != 1)
-+			pamsshagentauth_fatal("key_new: DSA_set0_pqg failed");
-+		if (DSA_set0_key(dsa, BN_new(), NULL) != 1)
-+			pamsshagentauth_fatal("key_new: DSA_set0_key failed");
-+#endif
- 		k->dsa = dsa;
- 		break;
- 	case KEY_ECDSA:
-@@ -118,6 +130,7 @@ pamsshagentauth_key_new_private(int type)
- 	switch (k->type) {
- 	case KEY_RSA1:
- 	case KEY_RSA:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((k->rsa->d = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
- 		if ((k->rsa->iqmp = BN_new()) == NULL)
-@@ -130,14 +143,30 @@ pamsshagentauth_key_new_private(int type)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
- 		if ((k->rsa->dmp1 = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
-+#else
-+		if (RSA_set0_key(k->rsa, NULL, NULL, BN_new()) != 1)
-+			pamsshagentauth_fatal("key_new: RSA_set0_key failed");
-+		if (RSA_set0_crt_params(k->rsa, BN_new(), BN_new(), BN_new()) != 1)
-+			pamsshagentauth_fatal("key_new: RSA_set0_crt_params failed");
-+		if (RSA_set0_factors(k->rsa, BN_new(), BN_new()) != 1)
-+			pamsshagentauth_fatal("key_new: RSA_set0_factors failed");
-+#endif
- 		break;
- 	case KEY_DSA:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((k->dsa->priv_key = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
-+#else
-+		if (DSA_set0_key(k->dsa, NULL, BN_new()) != 1)
-+			pamsshagentauth_fatal("key_new_private: DSA_set0_key failed");
-+#endif
- 		break;
- 	case KEY_ECDSA:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if (EC_KEY_set_private_key(k->ecdsa, BN_new()) != 1)
- 			pamsshagentauth_fatal("key_new_private: EC_KEY_set_private_key failed");
-+#else
-+#endif
- 		break;
- 	case KEY_ED25519:
- 		RAND_bytes(k->ed25519->sk, sizeof(k->ed25519->sk));
-@@ -195,14 +224,26 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
- 	case KEY_RSA1:
- 	case KEY_RSA:
- 		return a->rsa != NULL && b->rsa != NULL &&
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
- 		    BN_cmp(a->rsa->n, b->rsa->n) == 0;
-+#else
-+		    BN_cmp(RSA_get0_e(a->rsa), RSA_get0_e(b->rsa)) == 0 &&
-+		    BN_cmp(RSA_get0_n(a->rsa), RSA_get0_n(b->rsa)) == 0;
-+#endif
- 	case KEY_DSA:
- 		return a->dsa != NULL && b->dsa != NULL &&
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
- 		    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
- 		    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
- 		    BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
-+#else
-+		    BN_cmp(DSA_get0_p(a->dsa), DSA_get0_p(b->dsa)) == 0 &&
-+		    BN_cmp(DSA_get0_q(a->dsa), DSA_get0_q(b->dsa)) == 0 &&
-+		    BN_cmp(DSA_get0_g(a->dsa), DSA_get0_g(b->dsa)) == 0 &&
-+		    BN_cmp(DSA_get0_pub_key(a->dsa), DSA_get0_pub_key(b->dsa)) == 0;
-+#endif
- 	case KEY_ECDSA:
- 		return a->ecdsa != NULL && b->ecdsa != NULL &&
- 			EC_KEY_check_key(a->ecdsa) == 1 &&
-@@ -231,7 +272,7 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
-     u_int *dgst_raw_length)
- {
- 	const EVP_MD *md = NULL;
--	EVP_MD_CTX ctx;
-+	EVP_MD_CTX *ctx;
- 	u_char *blob = NULL;
- 	u_char *retval = NULL;
- 	u_int len = 0;
-@@ -252,12 +293,21 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
- 	}
- 	switch (k->type) {
- 	case KEY_RSA1:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		nlen = BN_num_bytes(k->rsa->n);
- 		elen = BN_num_bytes(k->rsa->e);
- 		len = nlen + elen;
- 		blob = pamsshagentauth_xmalloc(len);
- 		BN_bn2bin(k->rsa->n, blob);
- 		BN_bn2bin(k->rsa->e, blob + nlen);
-+#else
-+		nlen = BN_num_bytes(RSA_get0_n(k->rsa));
-+		elen = BN_num_bytes(RSA_get0_e(k->rsa));
-+		len = nlen + elen;
-+		blob = pamsshagentauth_xmalloc(len);
-+		BN_bn2bin(RSA_get0_n(k->rsa), blob);
-+		BN_bn2bin(RSA_get0_e(k->rsa), blob + nlen);
-+#endif
- 		break;
- 	case KEY_DSA:
- 	case KEY_ECDSA:
-@@ -273,11 +323,14 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
- 	}
- 	if (blob != NULL) {
- 		retval = pamsshagentauth_xmalloc(EVP_MAX_MD_SIZE);
--		EVP_DigestInit(&ctx, md);
--		EVP_DigestUpdate(&ctx, blob, len);
--		EVP_DigestFinal(&ctx, retval, dgst_raw_length);
-+		/* XXX Errors from EVP_* functions are not hadled */
-+		ctx = EVP_MD_CTX_create();
-+		EVP_DigestInit(ctx, md);
-+		EVP_DigestUpdate(ctx, blob, len);
-+		EVP_DigestFinal(ctx, retval, dgst_raw_length);
- 		memset(blob, 0, len);
- 		pamsshagentauth_xfree(blob);
-+		EVP_MD_CTX_destroy(ctx);
- 	} else {
- 		pamsshagentauth_fatal("key_fingerprint_raw: blob is null");
- 	}
-@@ -457,10 +510,17 @@ pamsshagentauth_key_read(Key *ret, char **cpp)
- 			return -1;
- 		*cpp = cp;
- 		/* Get public exponent, public modulus. */
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if (!read_bignum(cpp, ret->rsa->e))
- 			return -1;
- 		if (!read_bignum(cpp, ret->rsa->n))
- 			return -1;
-+#else
-+		if (!read_bignum(cpp, RSA_get0_e(ret->rsa)))
-+			return -1;
-+		if (!read_bignum(cpp, RSA_get0_n(ret->rsa)))
-+			return -1;
-+#endif
- 		success = 1;
- 		break;
- 	case KEY_UNSPEC:
-@@ -583,10 +643,17 @@ pamsshagentauth_key_write(const Key *key, FILE *f)
- 
- 	if (key->type == KEY_RSA1 && key->rsa != NULL) {
- 		/* size of modulus 'n' */
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		bits = BN_num_bits(key->rsa->n);
- 		fprintf(f, "%u", bits);
- 		if (write_bignum(f, key->rsa->e) &&
- 		    write_bignum(f, key->rsa->n)) {
-+#else
-+		bits = BN_num_bits(RSA_get0_n(key->rsa));
-+		fprintf(f, "%u", bits);
-+		if (write_bignum(f, RSA_get0_e(key->rsa)) &&
-+		    write_bignum(f, RSA_get0_n(key->rsa))) {
-+#endif
- 			success = 1;
- 		} else {
- 			pamsshagentauth_logerror("key_write: failed for RSA key");
-@@ -675,10 +742,17 @@ pamsshagentauth_key_size(const Key *k)
- {
- 	switch (k->type) {
- 	case KEY_RSA1:
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	case KEY_RSA:
- 		return BN_num_bits(k->rsa->n);
- 	case KEY_DSA:
- 		return BN_num_bits(k->dsa->p);
-+#else
-+	case KEY_RSA:
-+		return BN_num_bits(RSA_get0_n(k->rsa));
-+	case KEY_DSA:
-+		return BN_num_bits(DSA_get0_p(k->dsa));
-+#endif
- 	case KEY_ECDSA:
- 	{
- 		int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(k->ecdsa));
-@@ -769,17 +843,29 @@ pamsshagentauth_key_from_private(const Key *k)
- 	switch (k->type) {
- 	case KEY_DSA:
- 		n = pamsshagentauth_key_new(k->type);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
- 		    (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
- 		    (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
- 		    (BN_copy(n->dsa->pub_key, k->dsa->pub_key) == NULL))
-+#else
-+		if ((BN_copy(DSA_get0_p(n->dsa), DSA_get0_p(k->dsa)) == NULL) ||
-+		    (BN_copy(DSA_get0_q(n->dsa), DSA_get0_q(k->dsa)) == NULL) ||
-+		    (BN_copy(DSA_get0_g(n->dsa), DSA_get0_g(k->dsa)) == NULL) ||
-+		    (BN_copy(DSA_get0_pub_key(n->dsa), DSA_get0_pub_key(k->dsa)) == NULL))
-+#endif
- 			pamsshagentauth_fatal("key_from_private: BN_copy failed");
- 		break;
- 	case KEY_RSA:
- 	case KEY_RSA1:
- 		n = pamsshagentauth_key_new(k->type);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
- 		    (BN_copy(n->rsa->e, k->rsa->e) == NULL))
-+#else
-+		if ((BN_copy(RSA_get0_n(n->rsa), RSA_get0_n(k->rsa)) == NULL) ||
-+		    (BN_copy(RSA_get0_e(n->rsa), RSA_get0_e(k->rsa)) == NULL))
-+#endif
- 			pamsshagentauth_fatal("key_from_private: BN_copy failed");
- 		break;
- 	case KEY_ECDSA:
-@@ -881,8 +967,13 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
- 	switch (type) {
- 	case KEY_RSA:
- 		key = pamsshagentauth_key_new(type);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->e) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->n) == -1) {
-+#else
-+		if (pamsshagentauth_buffer_get_bignum2_ret(&b, RSA_get0_e(key->rsa)) == -1 ||
-+		    pamsshagentauth_buffer_get_bignum2_ret(&b, RSA_get0_n(key->rsa)) == -1) {
-+#endif
- 			pamsshagentauth_logerror("key_from_blob: can't read rsa key");
- 			pamsshagentauth_key_free(key);
- 			key = NULL;
-@@ -894,10 +985,17 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
- 		break;
- 	case KEY_DSA:
- 		key = pamsshagentauth_key_new(type);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->p) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->q) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->g) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->pub_key) == -1) {
-+#else
-+		if (pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_p(key->dsa)) == -1 ||
-+		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_q(key->dsa)) == -1 ||
-+		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_g(key->dsa)) == -1 ||
-+		    pamsshagentauth_buffer_get_bignum2_ret(&b, DSA_get0_pub_key(key->dsa)) == -1) {
-+#endif
- 			pamsshagentauth_logerror("key_from_blob: can't read dsa key");
- 			pamsshagentauth_key_free(key);
- 			key = NULL;
-@@ -1015,6 +1113,7 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
- 	}
- 	pamsshagentauth_buffer_init(&b);
- 	switch (key->type) {
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	case KEY_DSA:
- 		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
- 		pamsshagentauth_buffer_put_bignum2(&b, key->dsa->p);
-@@ -1027,6 +1126,20 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
- 		pamsshagentauth_buffer_put_bignum2(&b, key->rsa->e);
- 		pamsshagentauth_buffer_put_bignum2(&b, key->rsa->n);
- 		break;
-+#else
-+	case KEY_DSA:
-+		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
-+		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_p(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_q(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_g(key->dsa));
-+		pamsshagentauth_buffer_put_bignum2(&b, DSA_get0_pub_key(key->dsa));
-+		break;
-+	case KEY_RSA:
-+		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
-+		pamsshagentauth_buffer_put_bignum2(&b, RSA_get0_e(key->rsa));
-+		pamsshagentauth_buffer_put_bignum2(&b, RSA_get0_n(key->rsa));
-+		break;
-+#endif
- 	case KEY_ECDSA:
- 	{
- 		size_t l = 0;
-@@ -1138,14 +1251,20 @@ pamsshagentauth_key_demote(const Key *k)
- 	case KEY_RSA:
- 		if ((pk->rsa = RSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_demote: RSA_new failed");
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
- 		if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
-+#else
-+		if (RSA_set0_key(pk->rsa, BN_dup(RSA_get0_n(k->rsa)), BN_dup(RSA_get0_e(k->rsa)), NULL) != 1)
-+			pamsshagentauth_fatal("key_demote: RSA_set0_key failed");
-+#endif
- 		break;
- 	case KEY_DSA:
- 		if ((pk->dsa = DSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_demote: DSA_new failed");
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
- 		if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
-@@ -1154,6 +1273,12 @@ pamsshagentauth_key_demote(const Key *k)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
- 		if ((pk->dsa->pub_key = BN_dup(k->dsa->pub_key)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
-+#else
-+		if (DSA_set0_pqg(pk->dsa, BN_dup(DSA_get0_p(k->dsa)), BN_dup(DSA_get0_q(k->dsa)), BN_dup(DSA_get0_g(k->dsa))) != 1)
-+			pamsshagentauth_fatal("key_demote: DSA_set0_pqg failed");
-+		if (DSA_set0_key(pk->dsa, BN_dup(DSA_get0_pub_key(k->dsa)), NULL) != 1)
-+			pamsshagentauth_fatal("key_demote: DSA_set0_key failed");
-+#endif
- 		break;
- 	case KEY_ECDSA:
- 		pamsshagentauth_fatal("key_demote: implement me");
-diff --git a/ssh-dss.c b/ssh-dss.c
-index 9fdaa5d..1051ae2 100644
---- a/ssh-dss.c
-+++ b/ssh-dss.c
-@@ -48,37 +48,53 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
- {
- 	DSA_SIG *sig;
- 	const EVP_MD *evp_md = EVP_sha1();
--	EVP_MD_CTX md;
-+	EVP_MD_CTX *md;
- 	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
- 	u_int rlen, slen, len, dlen;
- 	Buffer b;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+	const BIGNUM *r, *s;
-+#endif
- 
- 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
- 		pamsshagentauth_logerror("ssh_dss_sign: no DSA key");
- 		return -1;
- 	}
--	EVP_DigestInit(&md, evp_md);
--	EVP_DigestUpdate(&md, data, datalen);
--	EVP_DigestFinal(&md, digest, &dlen);
-+	md = EVP_MD_CTX_create();
-+	EVP_DigestInit(md, evp_md);
-+	EVP_DigestUpdate(md, data, datalen);
-+	EVP_DigestFinal(md, digest, &dlen);
- 
- 	sig = DSA_do_sign(digest, dlen, key->dsa);
- 	memset(digest, 'd', sizeof(digest));
-+	EVP_MD_CTX_destroy(md);
- 
- 	if (sig == NULL) {
- 		pamsshagentauth_logerror("ssh_dss_sign: sign failed");
- 		return -1;
- 	}
- 
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	rlen = BN_num_bytes(sig->r);
- 	slen = BN_num_bytes(sig->s);
-+#else
-+	DSA_SIG_get0((const DSA_SIG *)sig, (const BIGNUM **)r, (const BIGNUM **)s);
-+	rlen = BN_num_bytes(r);
-+	slen = BN_num_bytes(s);
-+#endif
- 	if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
- 		pamsshagentauth_logerror("bad sig size %u %u", rlen, slen);
- 		DSA_SIG_free(sig);
- 		return -1;
- 	}
- 	memset(sigblob, 0, SIGBLOB_LEN);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
- 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
-+#else
-+	BN_bn2bin(r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
-+	BN_bn2bin(s, sigblob+ SIGBLOB_LEN - slen);
-+#endif
- 	DSA_SIG_free(sig);
- 
- 	if (datafellows & SSH_BUG_SIGBLOB) {
-@@ -110,11 +126,14 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- {
- 	DSA_SIG *sig;
- 	const EVP_MD *evp_md = EVP_sha1();
--	EVP_MD_CTX md;
-+	EVP_MD_CTX *md;
- 	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
- 	u_int len, dlen;
- 	int rlen, ret;
- 	Buffer b;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+	BIGNUM *r, *s;
-+#endif
- 
- 	if (key == NULL || key->type != KEY_DSA || key->dsa == NULL) {
- 		pamsshagentauth_logerror("ssh_dss_verify: no DSA key");
-@@ -157,6 +176,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 	/* parse signature */
- 	if ((sig = DSA_SIG_new()) == NULL)
- 		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_new failed");
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	if ((sig->r = BN_new()) == NULL)
- 		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
- 	if ((sig->s = BN_new()) == NULL)
-@@ -164,18 +184,33 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 	if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig->r) == NULL) ||
- 	    (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, sig->s) == NULL))
- 		pamsshagentauth_fatal("ssh_dss_verify: BN_bin2bn failed");
-+#else
-+	if ((r = BN_new()) == NULL)
-+		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
-+	if ((s = BN_new()) == NULL)
-+		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
-+	if (DSA_SIG_set0(sig, r, s) != 1)
-+		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_set0 failed");
-+	if ((BN_bin2bn(sigblob, INTBLOB_LEN, r) == NULL) ||
-+	    (BN_bin2bn(sigblob+ INTBLOB_LEN, INTBLOB_LEN, s) == NULL))
-+		pamsshagentauth_fatal("ssh_dss_verify: BN_bin2bn failed");
-+	if (DSA_SIG_set0(sig, r, s) != 1)
-+		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_set0 failed");
-+#endif
- 
- 	/* clean up */
- 	memset(sigblob, 0, len);
- 	pamsshagentauth_xfree(sigblob);
- 
- 	/* sha1 the data */
--	EVP_DigestInit(&md, evp_md);
--	EVP_DigestUpdate(&md, data, datalen);
--	EVP_DigestFinal(&md, digest, &dlen);
-+	md = EVP_MD_CTX_create();
-+	EVP_DigestInit(md, evp_md);
-+	EVP_DigestUpdate(md, data, datalen);
-+	EVP_DigestFinal(md, digest, &dlen);
- 
- 	ret = DSA_do_verify(digest, dlen, sig, key->dsa);
- 	memset(digest, 'd', sizeof(digest));
-+	EVP_MD_CTX_destroy(md);
- 
- 	DSA_SIG_free(sig);
- 
-diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
-index efa0f3d..c213959 100644
---- a/ssh-ecdsa.c
-+++ b/ssh-ecdsa.c
-@@ -41,22 +41,27 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
- {
-     ECDSA_SIG *sig;
-     const EVP_MD *evp_md = evp_from_key(key);
--    EVP_MD_CTX md;
-+    EVP_MD_CTX *md;
-     u_char digest[EVP_MAX_MD_SIZE];
-     u_int len, dlen;
-     Buffer b, bb;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+	BIGNUM *r, *s;
-+#endif
- 
-     if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
-         pamsshagentauth_logerror("ssh_ecdsa_sign: no ECDSA key");
-         return -1;
-     }
- 
--    EVP_DigestInit(&md, evp_md);
--    EVP_DigestUpdate(&md, data, datalen);
--    EVP_DigestFinal(&md, digest, &dlen);
-+    md = EVP_MD_CTX_create();
-+    EVP_DigestInit(md, evp_md);
-+    EVP_DigestUpdate(md, data, datalen);
-+    EVP_DigestFinal(md, digest, &dlen);
- 
-     sig = ECDSA_do_sign(digest, dlen, key->ecdsa);
-     memset(digest, 'd', sizeof(digest));
-+    EVP_MD_CTX_destroy(md);
- 
-     if (sig == NULL) {
-         pamsshagentauth_logerror("ssh_ecdsa_sign: sign failed");
-@@ -64,8 +69,14 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
-     }
- 
-     pamsshagentauth_buffer_init(&bb);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-     if (pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->r) == -1 ||
-         pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->s) == -1) {
-+#else
-+    DSA_SIG_get0(sig, &r, &s);
-+    if (pamsshagentauth_buffer_get_bignum2_ret(&bb, r) == -1 ||
-+        pamsshagentauth_buffer_get_bignum2_ret(&bb, s) == -1) {
-+#endif
-         pamsshagentauth_logerror("couldn't serialize signature");
-         ECDSA_SIG_free(sig);
-         return -1;
-@@ -94,11 +105,14 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- {
-     ECDSA_SIG *sig;
-     const EVP_MD *evp_md = evp_from_key(key);
--    EVP_MD_CTX md;
-+    EVP_MD_CTX *md;
-     u_char digest[EVP_MAX_MD_SIZE], *sigblob;
-     u_int len, dlen;
-     int rlen, ret;
-     Buffer b;
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+	BIGNUM *r, *s;
-+#endif
- 
-     if (key == NULL || key->type != KEY_ECDSA || key->ecdsa == NULL) {
-         pamsshagentauth_logerror("ssh_ecdsa_sign: no ECDSA key");
-@@ -127,8 +141,14 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 
-     pamsshagentauth_buffer_init(&b);
-     pamsshagentauth_buffer_append(&b, sigblob, len);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-     if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
-         (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
-+#else
-+    DSA_SIG_get0(sig, &r, &s);
-+    if ((pamsshagentauth_buffer_get_bignum2_ret(&b, r) == -1) ||
-+        (pamsshagentauth_buffer_get_bignum2_ret(&b, s) == -1))
-+#endif
-         pamsshagentauth_fatal("ssh_ecdsa_verify:"
-             "pamsshagentauth_buffer_get_bignum2_ret failed");
- 
-@@ -137,16 +157,18 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
-     pamsshagentauth_xfree(sigblob);
- 
-     /* sha256 the data */
--    EVP_DigestInit(&md, evp_md);
--    EVP_DigestUpdate(&md, data, datalen);
--    EVP_DigestFinal(&md, digest, &dlen);
-+    md = EVP_MD_CTX_create();
-+    EVP_DigestInit(md, evp_md);
-+    EVP_DigestUpdate(md, data, datalen);
-+    EVP_DigestFinal(md, digest, &dlen);
- 
-     ret = ECDSA_do_verify(digest, dlen, sig, key->ecdsa);
-     memset(digest, 'd', sizeof(digest));
-+    EVP_MD_CTX_destroy(md);
- 
-     ECDSA_SIG_free(sig);
- 
-     pamsshagentauth_verbose("ssh_ecdsa_verify: signature %s",
-         ret == 1 ? "correct" : ret == 0 ? "incorrect" : "error");
-     return ret;
--}
-\ No newline at end of file
-+}
-diff --git a/ssh-rsa.c b/ssh-rsa.c
-index d05844b..9d74eb6 100644
---- a/ssh-rsa.c
-+++ b/ssh-rsa.c
-@@ -40,7 +40,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
-     const u_char *data, u_int datalen)
- {
- 	const EVP_MD *evp_md;
--	EVP_MD_CTX md;
-+	EVP_MD_CTX *md;
- 	u_char digest[EVP_MAX_MD_SIZE], *sig;
- 	u_int slen, dlen, len;
- 	int ok, nid;
-@@ -55,6 +55,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
- 		pamsshagentauth_logerror("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid);
- 		return -1;
- 	}
-+	md = EVP_MD_CTX_create();
- 	EVP_DigestInit(&md, evp_md);
- 	EVP_DigestUpdate(&md, data, datalen);
- 	EVP_DigestFinal(&md, digest, &dlen);
-@@ -64,6 +65,7 @@ ssh_rsa_sign(const Key *key, u_char **sigp, u_int *lenp,
- 
- 	ok = RSA_sign(nid, digest, dlen, sig, &len, key->rsa);
- 	memset(digest, 'd', sizeof(digest));
-+	EVP_MD_CTX_destroy(md);
- 
- 	if (ok != 1) {
- 		int ecode = ERR_get_error();
-@@ -107,7 +109,7 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- {
- 	Buffer b;
- 	const EVP_MD *evp_md;
--	EVP_MD_CTX md;
-+	EVP_MD_CTX *md;
- 	char *ktype;
- 	u_char digest[EVP_MAX_MD_SIZE], *sigblob;
- 	u_int len, dlen, modlen;
-@@ -117,9 +119,17 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 		pamsshagentauth_logerror("ssh_rsa_verify: no RSA key");
- 		return -1;
- 	}
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-+#else
-+	if (BN_num_bits(RSA_get0_n(key->rsa)) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-+#endif
- 		pamsshagentauth_logerror("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits",
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
- 		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
-+#else
-+		    BN_num_bits(RSA_get0_n(key->rsa)), SSH_RSA_MINIMUM_MODULUS_SIZE);
-+#endif
- 		return -1;
- 	}
- 	pamsshagentauth_buffer_init(&b);
-@@ -161,12 +171,14 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 		pamsshagentauth_xfree(sigblob);
- 		return -1;
- 	}
--	EVP_DigestInit(&md, evp_md);
--	EVP_DigestUpdate(&md, data, datalen);
--	EVP_DigestFinal(&md, digest, &dlen);
-+	md = EVP_MD_CTX_create();
-+	EVP_DigestInit(md, evp_md);
-+	EVP_DigestUpdate(md, data, datalen);
-+	EVP_DigestFinal(md, digest, &dlen);
- 
- 	ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa);
- 	memset(digest, 'd', sizeof(digest));
-+	EVP_MD_CTX_destroy(md);
- 	memset(sigblob, 's', len);
- 	pamsshagentauth_xfree(sigblob);
- 	pamsshagentauth_verbose("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : "");
-
-From 4dc87369134f215378042ec4d971a4fe48d1a02b Mon Sep 17 00:00:00 2001
-From: Guido Falsi <mad@madpilot.net>
-Date: Wed, 24 Oct 2018 20:36:15 +0200
-Subject: [PATCH 2/2] Check against the correct OPENSSL_VERSION_NUMBER
-
-Alexey Dokuchaev (a fellow FreeBSD developer) pointed out to me the opaque structures were introduced in 1.1.0-pre
-5, so the correct OPENSSL_VERSION_NUMBER to discriminate is 0x10100005L.
----
- authfd.c    | 12 ++++++------
- bufbn.c     |  2 +-
- key.c       | 36 ++++++++++++++++++------------------
- ssh-dss.c   | 10 +++++-----
- ssh-ecdsa.c |  8 ++++----
- ssh-rsa.c   |  4 ++--
- 6 files changed, 36 insertions(+), 36 deletions(-)
-
-diff --git a/authfd.c b/authfd.c
-index 35f8de1..01d1d89 100644
---- a/authfd.c
-+++ b/authfd.c
-@@ -372,7 +372,7 @@ ssh_get_next_identity(AuthenticationConnection *auth, char **comment, int versio
- 	case 1:
- 		key = pamsshagentauth_key_new(KEY_RSA1);
- 		bits = pamsshagentauth_buffer_get_int(&auth->identities);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->e);
- 		pamsshagentauth_buffer_get_bignum(&auth->identities, key->rsa->n);
- 		*comment = pamsshagentauth_buffer_get_string(&auth->identities, NULL);
-@@ -432,7 +432,7 @@ ssh_decrypt_challenge(AuthenticationConnection *auth,
- 	}
- 	pamsshagentauth_buffer_init(&buffer);
- 	pamsshagentauth_buffer_put_char(&buffer, SSH_AGENTC_RSA_CHALLENGE);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	pamsshagentauth_buffer_put_int(&buffer, BN_num_bits(key->rsa->n));
- 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->e);
- 	pamsshagentauth_buffer_put_bignum(&buffer, key->rsa->n);
-@@ -517,7 +517,7 @@ ssh_agent_sign(AuthenticationConnection *auth,
- static void
- ssh_encode_identity_rsa1(Buffer *b, RSA *key, const char *comment)
- {
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	pamsshagentauth_buffer_put_int(b, BN_num_bits(key->n));
- 	pamsshagentauth_buffer_put_bignum(b, key->n);
- 	pamsshagentauth_buffer_put_bignum(b, key->e);
-@@ -545,7 +545,7 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
- 	pamsshagentauth_buffer_put_cstring(b, key_ssh_name(key));
- 	switch (key->type) {
- 	case KEY_RSA:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->n);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->e);
- 		pamsshagentauth_buffer_put_bignum2(b, key->rsa->d);
-@@ -562,7 +562,7 @@ ssh_encode_identity_ssh2(Buffer *b, Key *key, const char *comment)
- #endif
- 		break;
- 	case KEY_DSA:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->p);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->q);
- 		pamsshagentauth_buffer_put_bignum2(b, key->dsa->g);
-@@ -654,7 +654,7 @@ ssh_remove_identity(AuthenticationConnection *auth, Key *key)
- 
- 	if (key->type == KEY_RSA1) {
- 		pamsshagentauth_buffer_put_char(&msg, SSH_AGENTC_REMOVE_RSA_IDENTITY);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		pamsshagentauth_buffer_put_int(&msg, BN_num_bits(key->rsa->n));
- 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->e);
- 		pamsshagentauth_buffer_put_bignum(&msg, key->rsa->n);
-diff --git a/bufbn.c b/bufbn.c
-index 4ecedc1..b4754cc 100644
---- a/bufbn.c
-+++ b/bufbn.c
-@@ -151,7 +151,7 @@ pamsshagentauth_buffer_put_bignum2_ret(Buffer *buffer, const BIGNUM *value)
- 		pamsshagentauth_buffer_put_int(buffer, 0);
- 		return 0;
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	if (value->neg) {
- #else
- 	if (BN_is_negative(value)) {
-diff --git a/key.c b/key.c
-index aedbbb5..dcc5fc8 100644
---- a/key.c
-+++ b/key.c
-@@ -77,7 +77,7 @@ pamsshagentauth_key_new(int type)
- 	case KEY_RSA:
- 		if ((rsa = RSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: RSA_new failed");
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((rsa->n = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
- 		if ((rsa->e = BN_new()) == NULL)
-@@ -91,7 +91,7 @@ pamsshagentauth_key_new(int type)
- 	case KEY_DSA:
- 		if ((dsa = DSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: DSA_new failed");
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((dsa->p = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new: BN_new failed");
- 		if ((dsa->q = BN_new()) == NULL)
-@@ -130,7 +130,7 @@ pamsshagentauth_key_new_private(int type)
- 	switch (k->type) {
- 	case KEY_RSA1:
- 	case KEY_RSA:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((k->rsa->d = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
- 		if ((k->rsa->iqmp = BN_new()) == NULL)
-@@ -153,7 +153,7 @@ pamsshagentauth_key_new_private(int type)
- #endif
- 		break;
- 	case KEY_DSA:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((k->dsa->priv_key = BN_new()) == NULL)
- 			pamsshagentauth_fatal("key_new_private: BN_new failed");
- #else
-@@ -162,7 +162,7 @@ pamsshagentauth_key_new_private(int type)
- #endif
- 		break;
- 	case KEY_ECDSA:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if (EC_KEY_set_private_key(k->ecdsa, BN_new()) != 1)
- 			pamsshagentauth_fatal("key_new_private: EC_KEY_set_private_key failed");
- #else
-@@ -224,7 +224,7 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
- 	case KEY_RSA1:
- 	case KEY_RSA:
- 		return a->rsa != NULL && b->rsa != NULL &&
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		    BN_cmp(a->rsa->e, b->rsa->e) == 0 &&
- 		    BN_cmp(a->rsa->n, b->rsa->n) == 0;
- #else
-@@ -233,7 +233,7 @@ pamsshagentauth_key_equal(const Key *a, const Key *b)
- #endif
- 	case KEY_DSA:
- 		return a->dsa != NULL && b->dsa != NULL &&
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		    BN_cmp(a->dsa->p, b->dsa->p) == 0 &&
- 		    BN_cmp(a->dsa->q, b->dsa->q) == 0 &&
- 		    BN_cmp(a->dsa->g, b->dsa->g) == 0 &&
-@@ -293,7 +293,7 @@ pamsshagentauth_key_fingerprint_raw(const Key *k, enum fp_type dgst_type,
- 	}
- 	switch (k->type) {
- 	case KEY_RSA1:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		nlen = BN_num_bytes(k->rsa->n);
- 		elen = BN_num_bytes(k->rsa->e);
- 		len = nlen + elen;
-@@ -510,7 +510,7 @@ pamsshagentauth_key_read(Key *ret, char **cpp)
- 			return -1;
- 		*cpp = cp;
- 		/* Get public exponent, public modulus. */
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if (!read_bignum(cpp, ret->rsa->e))
- 			return -1;
- 		if (!read_bignum(cpp, ret->rsa->n))
-@@ -643,7 +643,7 @@ pamsshagentauth_key_write(const Key *key, FILE *f)
- 
- 	if (key->type == KEY_RSA1 && key->rsa != NULL) {
- 		/* size of modulus 'n' */
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		bits = BN_num_bits(key->rsa->n);
- 		fprintf(f, "%u", bits);
- 		if (write_bignum(f, key->rsa->e) &&
-@@ -742,7 +742,7 @@ pamsshagentauth_key_size(const Key *k)
- {
- 	switch (k->type) {
- 	case KEY_RSA1:
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	case KEY_RSA:
- 		return BN_num_bits(k->rsa->n);
- 	case KEY_DSA:
-@@ -843,7 +843,7 @@ pamsshagentauth_key_from_private(const Key *k)
- 	switch (k->type) {
- 	case KEY_DSA:
- 		n = pamsshagentauth_key_new(k->type);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((BN_copy(n->dsa->p, k->dsa->p) == NULL) ||
- 		    (BN_copy(n->dsa->q, k->dsa->q) == NULL) ||
- 		    (BN_copy(n->dsa->g, k->dsa->g) == NULL) ||
-@@ -859,7 +859,7 @@ pamsshagentauth_key_from_private(const Key *k)
- 	case KEY_RSA:
- 	case KEY_RSA1:
- 		n = pamsshagentauth_key_new(k->type);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((BN_copy(n->rsa->n, k->rsa->n) == NULL) ||
- 		    (BN_copy(n->rsa->e, k->rsa->e) == NULL))
- #else
-@@ -967,7 +967,7 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
- 	switch (type) {
- 	case KEY_RSA:
- 		key = pamsshagentauth_key_new(type);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->e) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->rsa->n) == -1) {
- #else
-@@ -985,7 +985,7 @@ pamsshagentauth_key_from_blob(const u_char *blob, u_int blen)
- 		break;
- 	case KEY_DSA:
- 		key = pamsshagentauth_key_new(type);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if (pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->p) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->q) == -1 ||
- 		    pamsshagentauth_buffer_get_bignum2_ret(&b, key->dsa->g) == -1 ||
-@@ -1113,7 +1113,7 @@ pamsshagentauth_key_to_blob(const Key *key, u_char **blobp, u_int *lenp)
- 	}
- 	pamsshagentauth_buffer_init(&b);
- 	switch (key->type) {
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	case KEY_DSA:
- 		pamsshagentauth_buffer_put_cstring(&b, key_ssh_name(key));
- 		pamsshagentauth_buffer_put_bignum2(&b, key->dsa->p);
-@@ -1251,7 +1251,7 @@ pamsshagentauth_key_demote(const Key *k)
- 	case KEY_RSA:
- 		if ((pk->rsa = RSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_demote: RSA_new failed");
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((pk->rsa->e = BN_dup(k->rsa->e)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
- 		if ((pk->rsa->n = BN_dup(k->rsa->n)) == NULL)
-@@ -1264,7 +1264,7 @@ pamsshagentauth_key_demote(const Key *k)
- 	case KEY_DSA:
- 		if ((pk->dsa = DSA_new()) == NULL)
- 			pamsshagentauth_fatal("key_demote: DSA_new failed");
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		if ((pk->dsa->p = BN_dup(k->dsa->p)) == NULL)
- 			pamsshagentauth_fatal("key_demote: BN_dup failed");
- 		if ((pk->dsa->q = BN_dup(k->dsa->q)) == NULL)
-diff --git a/ssh-dss.c b/ssh-dss.c
-index 1051ae2..9b96274 100644
---- a/ssh-dss.c
-+++ b/ssh-dss.c
-@@ -52,7 +52,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
- 	u_char digest[EVP_MAX_MD_SIZE], sigblob[SIGBLOB_LEN];
- 	u_int rlen, slen, len, dlen;
- 	Buffer b;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
- 	const BIGNUM *r, *s;
- #endif
- 
-@@ -74,7 +74,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
- 		return -1;
- 	}
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	rlen = BN_num_bytes(sig->r);
- 	slen = BN_num_bytes(sig->s);
- #else
-@@ -88,7 +88,7 @@ ssh_dss_sign(const Key *key, u_char **sigp, u_int *lenp,
- 		return -1;
- 	}
- 	memset(sigblob, 0, SIGBLOB_LEN);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	BN_bn2bin(sig->r, sigblob+ SIGBLOB_LEN - INTBLOB_LEN - rlen);
- 	BN_bn2bin(sig->s, sigblob+ SIGBLOB_LEN - slen);
- #else
-@@ -131,7 +131,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 	u_int len, dlen;
- 	int rlen, ret;
- 	Buffer b;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
- 	BIGNUM *r, *s;
- #endif
- 
-@@ -176,7 +176,7 @@ ssh_dss_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 	/* parse signature */
- 	if ((sig = DSA_SIG_new()) == NULL)
- 		pamsshagentauth_fatal("ssh_dss_verify: DSA_SIG_new failed");
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	if ((sig->r = BN_new()) == NULL)
- 		pamsshagentauth_fatal("ssh_dss_verify: BN_new failed");
- 	if ((sig->s = BN_new()) == NULL)
-diff --git a/ssh-ecdsa.c b/ssh-ecdsa.c
-index c213959..5b13b30 100644
---- a/ssh-ecdsa.c
-+++ b/ssh-ecdsa.c
-@@ -45,7 +45,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
-     u_char digest[EVP_MAX_MD_SIZE];
-     u_int len, dlen;
-     Buffer b, bb;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
- 	BIGNUM *r, *s;
- #endif
- 
-@@ -69,7 +69,7 @@ ssh_ecdsa_sign(const Key *key, u_char **sigp, u_int *lenp,
-     }
- 
-     pamsshagentauth_buffer_init(&bb);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
-     if (pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->r) == -1 ||
-         pamsshagentauth_buffer_get_bignum2_ret(&bb, sig->s) == -1) {
- #else
-@@ -110,7 +110,7 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
-     u_int len, dlen;
-     int rlen, ret;
-     Buffer b;
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100005L
- 	BIGNUM *r, *s;
- #endif
- 
-@@ -141,7 +141,7 @@ ssh_ecdsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 
-     pamsshagentauth_buffer_init(&b);
-     pamsshagentauth_buffer_append(&b, sigblob, len);
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
-     if ((pamsshagentauth_buffer_get_bignum2_ret(&b, sig->r) == -1) ||
-         (pamsshagentauth_buffer_get_bignum2_ret(&b, sig->s) == -1))
- #else
-diff --git a/ssh-rsa.c b/ssh-rsa.c
-index 9d74eb6..35f2e36 100644
---- a/ssh-rsa.c
-+++ b/ssh-rsa.c
-@@ -119,13 +119,13 @@ ssh_rsa_verify(const Key *key, const u_char *signature, u_int signaturelen,
- 		pamsshagentauth_logerror("ssh_rsa_verify: no RSA key");
- 		return -1;
- 	}
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 	if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
- #else
- 	if (BN_num_bits(RSA_get0_n(key->rsa)) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
- #endif
- 		pamsshagentauth_logerror("ssh_rsa_verify: RSA modulus too small: %d < minimum %d bits",
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100005L
- 		    BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
- #else
- 		    BN_num_bits(RSA_get0_n(key->rsa)), SSH_RSA_MINIMUM_MODULUS_SIZE);
diff --git a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild
index 37eb86d8b47a..0f8057731085 100644
--- a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild
+++ b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-0.10.3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -12,7 +12,8 @@ if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/jbeverly/${PN}.git"
 	inherit git-r3
 else
-	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2"
+	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2
+	https://dev.gentoo.org/~juippis/distfiles/tmp/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch"
 	KEYWORDS="~amd64 ~arm ~x86"
 fi
 
@@ -21,7 +22,7 @@ SLOT="0"
 IUSE=""
 
 PATCHES=(
-	"${FILESDIR}/${P}-openssl-1.1.1.patch"
+	"${DISTDIR}/${P}-openssl-1.1.1.patch"
 )
 DEPEND="sys-libs/pam
 	dev-libs/openssl:0="
diff --git a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild
index 12b2fba91df3..0f8057731085 100644
--- a/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild
+++ b/sys-auth/pam_ssh_agent_auth/pam_ssh_agent_auth-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -12,7 +12,8 @@ if [[ ${PV} == *9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/jbeverly/${PN}.git"
 	inherit git-r3
 else
-	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2"
+	SRC_URI="mirror://sourceforge/pamsshagentauth/${PN}/v${PV}/${P}.tar.bz2
+	https://dev.gentoo.org/~juippis/distfiles/tmp/pam_ssh_agent_auth-0.10.3-openssl-1.1.1.patch"
 	KEYWORDS="~amd64 ~arm ~x86"
 fi
 
@@ -20,6 +21,9 @@ LICENSE="MIT"
 SLOT="0"
 IUSE=""
 
+PATCHES=(
+	"${DISTDIR}/${P}-openssl-1.1.1.patch"
+)
 DEPEND="sys-libs/pam
 	dev-libs/openssl:0="
 
diff --git a/sys-auth/pam_u2f/Manifest b/sys-auth/pam_u2f/Manifest
index e0d42fb88de0..02b412cff06f 100644
--- a/sys-auth/pam_u2f/Manifest
+++ b/sys-auth/pam_u2f/Manifest
@@ -1,4 +1,6 @@
 AUX pam_u2f-1.0.2-fix-Makefile.patch 324 BLAKE2B bc32459e011106e0f8516afe8e1afaa288e1bb53190b350467a12b9c6bbfaee9beb885bd78f1f1c3665b5f6907c1d7d99fb70d8d476b2dc3fe1fad2cba52f940 SHA512 eddf3c607e953b952ba91acb7d7bb1b8a43d6b70da86faece994011eb3eac43476c6ad9721be0a76805688dc9f9bab02ee5e13f58ce556bb68b8d574135ca44d
 DIST pam_u2f-1.0.8.tar.gz 384163 BLAKE2B 99767601027db25e6f8d2e59aad5f72b078cf7344ca10fa310a990d512c5e5a4c9ff7c24acb5b21b88b82aa47b4052b9164a422426d1f0889c8f6776526e5c80 SHA512 0bdbea6307428bbed2af69129af207304f7951418ad7df339563f47d678a2cfe6b80321552382e15771cfc06306fae746521850056376f533c430556d051ad36
+DIST pam_u2f-1.1.0.tar.gz 415677 BLAKE2B dba5cd195d390ba4537752549fa5e0f4487930637fedd64b2750424d21d968bf8be54b75dccba92ac13a18b4e2d44825ec18089e9c4f5dc8e11ac12c36b8d28c SHA512 0ffcc32f0bbee279ad02f9c1cd928e2cf1df2fdebe718d869c16b7fece8edafd73cf08c5dfd6a2bc08434ed1970e16e4f89b6dae3b027a961ab43b26818b634f
 EBUILD pam_u2f-1.0.8.ebuild 721 BLAKE2B 1619ee4cc3cebf5dfc616df0503e17f98aaf86a3bcc03da8891d3b53f7dc1673d7dbec3f6e58bb0eb409397237a469c051f1d64aae26247e11152e7aee34d9f2 SHA512 d5a015b54ea6a697f0a676cd067d67e4ef7b0c738d974e679cb2289d153c03671d89c9ae5d2a22575bd3231278a1e349ca03024684614cf1e2cfa7ad9eaf8000
+EBUILD pam_u2f-1.1.0.ebuild 767 BLAKE2B 674ebe683368cbdcbdb703ec030b324bddf37f8c29650ea4210983e20fc4982464e0a0a3dd1f56eca61c53f53957fb887857070c155aa0f8ca7cff718a67d687 SHA512 f75d8b68e05efa792907390719a9c4d6fd8733fad2ecc8a37c5dce9fb989822bdd0f4ed88ab033892f08c77127b5b16b5870636795367718fe07199b5736359e
 MISC metadata.xml 714 BLAKE2B 8694b13d8ec22eb56c2bf5637f0ef83c5adf369025aeec8f4512a79914cc00e43620d6db1d95361199c7861a41afd2f1c215758e84584af7d6fdeb7d00619101 SHA512 a59a8b6a51c50c63495eecf712d3a5c9f60b0a94d78a6d2a12d789eb334d77bc80b00de3c2368cbc3cc684c359085af71153f09d0ce5f9cf4f74be77fdc09277
diff --git a/sys-auth/pam_u2f/pam_u2f-1.1.0.ebuild b/sys-auth/pam_u2f/pam_u2f-1.1.0.ebuild
new file mode 100644
index 000000000000..6d719d8985b6
--- /dev/null
+++ b/sys-auth/pam_u2f/pam_u2f-1.1.0.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic pam
+
+DESCRIPTION="PAM module for FIDO2 and U2F keys"
+HOMEPAGE="https://github.com/Yubico/pam-u2f"
+SRC_URI="https://developers.yubico.com/${PN/_/-}/Releases/${P}.tar.gz"
+
+LICENSE="BSD ISC"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="debug libressl"
+
+DEPEND="
+	dev-libs/libfido2:0=
+	!libressl? ( dev-libs/openssl:0= )
+	libressl? ( dev-libs/libressl:0= )
+	sys-libs/pam"
+RDEPEND="${DEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+PATCHES=( "${FILESDIR}/${PN}-1.0.2-fix-Makefile.patch" )
+
+src_prepare() {
+	default
+	use debug || append-cppflags -UDEBUG_PAM -UPAM_DEBUG
+	eautoreconf
+}
+
+src_configure() {
+	econf --with-pam-dir=$(getpam_mod_dir)
+}
diff --git a/sys-auth/pambase/Manifest b/sys-auth/pambase/Manifest
index 33d290e1b392..659e7e3827f0 100644
--- a/sys-auth/pambase/Manifest
+++ b/sys-auth/pambase/Manifest
@@ -1,5 +1,3 @@
-DIST pambase-20200304.tar.gz 3466 BLAKE2B e4d406460d435403ed7a46d517f9006cacc54a94f5019a573c81b331731c88679ed6d388354b5946894bdfada556b4c73735c3f4de88fc7678cd831c68ab46c3 SHA512 c2a7f3fd143637fbdf5c0a3c58ba5a3c23c5e8adb1f057d02b4b9d64660435fc529031a0f710a9e5fc7091710f78dcb2f3e1ff48f033fb491ddd0399ef05b189
-DIST pambase-20200917.tar.gz 3342 BLAKE2B 4dde3a6a4a22f02464a2a703a2385038c53c05398904dc47431880a16d7dd1ba89c8f5fdf19a7d50406f2487f8bdf90264ca2941cc6a2ad9d404e89c3d73edca SHA512 0cae27f7cd7ef258771b61110ba3ce5a44a0f9d71030670b2a40aa47a609d30ae3e3d7bc0649dcce25a2cfe2e1259e6d9ff435118ab1d2db771a162898ab5143
-EBUILD pambase-20200304.ebuild 2169 BLAKE2B 04b9658390ae7c88df12dfc4611665fd9bbdb21c4f7fe2c3e0d2b52eb795842a3f80f429a44d0f15027e2092d7f3cae7fb5978178b78cf580504feec194d6a84 SHA512 f718edc810dc14ed9f93816c997bf74e0563003535bcc82c524f3febdc7c8c32f187a954d5d99ecbd06a6c154b004d1ce0c86674e5f5a30eda3fe2368f771ef5
-EBUILD pambase-20200917.ebuild 2640 BLAKE2B e5adae78bf0e9352a9912f5f6f9197206ebfa367754f16920eb55113e5a4f90d58908d40d0115c13215d6e7c6c235261dffba3facf3733b5ab75c8cd6277948e SHA512 69964dd314abe7bd2b6d86faaaa8f16c91fbdde84e2b3b76521e9d7bec5bce6dbbee5746cc95de9ff0b007e7d8798153a8da8f490fa2335829b5259303f103da
-MISC metadata.xml 4274 BLAKE2B 76b7588ad42eeff135eb81cf0f9e4eb1c1ce6329e62138cf934ea99cc74ae4eb45ad224072210cd5630484a71583e86d2d304a07e83f3f36284d760a73848195 SHA512 6f0fe0ac7c20e8203bc858ff54323c3e9ffb564fdb67da601c7a99218e3a5b7666bbc2c548314547a4d842cc0cd40058d98f7d13ca103cd427482fe25ff89af6
+DIST pambase-20201103.tar.gz 3295 BLAKE2B 7e104b5342842a21e10dce6e5c5a2d330ec06146b4791b888518463d915eebefbd694a809ff676b32c9c43945087935dc5c3496ae93ac17b7e4fd4e2e2974d1a SHA512 b94e47780f45c5e897b5fd073ce2184a901d241d51516ac5007658b1ae423d0f34c37a09a9e1d055962aa7158675ea7740dfe6466fad5e4a1b50b66a0812f51d
+EBUILD pambase-20201103.ebuild 2660 BLAKE2B 036c5ee1f9b4d50384dbff61dce8270440269f009811d306b24abe13159df6275f0029033637e808340ae0d25b47597ea3cbad68836270c9b0fa460fe1b568fe SHA512 3c1910c0f2c0a7a23bb154d69e04fd0774591df3d64a2acd5287556416b22ec699dc8726853e515d43cc92a93ddc8c08ec09af164735066a1b812802e73d5c56
+MISC metadata.xml 3810 BLAKE2B f4485cfec915c9e239c9328e6df338ba787ab26c3bb4f84773aa29361f4e2c48b56afb787c176fb38e8dc1c923e07c5baa6aeb5dba2774fe61f20250baf36b7d SHA512 ea58b1a801e68eeb8b7325192f5f26b406879bb70a46383222ffb9f69c71e5f9803532f2cca510ec0bc5cc3a96ceb165ed11725341a51b123fe8d4a712f4c26a
diff --git a/sys-auth/pambase/metadata.xml b/sys-auth/pambase/metadata.xml
index f64b16605601..6b0d63269f7e 100644
--- a/sys-auth/pambase/metadata.xml
+++ b/sys-auth/pambase/metadata.xml
@@ -10,17 +10,6 @@
 		<name>Sam James</name>
 	</maintainer>
 	<use>
-		<flag name="cracklib">
-			Enable pam_cracklib module on system authentication stack. This
-			produces warnings when changing password to something easily
-			crackable. It requires the same USE flag to be enabled on
-			<pkg>sys-libs/pam</pkg> or system login might be impossible.
-		</flag>
-		<flag name="consolekit">
-			Enable pam_ck_connector module on local system logins. This
-			allows for console logins to make use of ConsoleKit
-			authorization.
-		</flag>
 		<flag name="elogind">
 			Use pam_elogind module to register user sessions with elogind.
 		</flag>
diff --git a/sys-auth/pambase/pambase-20200304.ebuild b/sys-auth/pambase/pambase-20200304.ebuild
deleted file mode 100644
index de4c295e21f7..000000000000
--- a/sys-auth/pambase/pambase-20200304.ebuild
+++ /dev/null
@@ -1,86 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit toolchain-funcs
-
-DESCRIPTION="PAM base configuration files"
-HOMEPAGE="https://github.com/gentoo/pambase"
-SRC_URI="https://github.com/gentoo/pambase/archive/${P}.tar.gz"
-
-LICENSE="GPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="caps consolekit +cracklib debug elogind minimal mktemp +nullok pam_krb5 pam_ssh passwdqc securetty selinux +sha512 systemd"
-
-RESTRICT="binchecks"
-
-REQUIRED_USE="?? ( consolekit elogind systemd )"
-
-MIN_PAM_REQ=1.1.3
-
-RDEPEND="
-	>=sys-libs/pam-${MIN_PAM_REQ}
-	consolekit? ( sys-auth/consolekit[pam] )
-	cracklib? ( sys-libs/pam[cracklib(+)] )
-	elogind? ( sys-auth/elogind[pam] )
-	mktemp? ( sys-auth/pam_mktemp )
-	pam_krb5? (
-		>=sys-libs/pam-${MIN_PAM_REQ}
-		sys-auth/pam_krb5
-	)
-	caps? ( sys-libs/libcap[pam] )
-	pam_ssh? ( sys-auth/pam_ssh )
-	passwdqc? ( sys-auth/pam_passwdqc )
-	selinux? ( sys-libs/pam[selinux] )
-	sha512? ( >=sys-libs/pam-${MIN_PAM_REQ} )
-	systemd? ( sys-apps/systemd[pam] )
-"
-DEPEND="
-	app-arch/xz-utils
-	app-portage/portage-utils
-"
-
-S="${WORKDIR}/${PN}-${P}"
-
-src_compile() {
-	local linux_pam_version
-	if has_version sys-libs/pam; then
-		local ver_str=$(qatom $(best_version sys-libs/pam) | cut -d ' ' -f 3)
-		linux_pam_version=$(printf "0x%02x%02x%02x" ${ver_str//\./ })
-	fi
-
-	use_var() {
-		local varname=$(echo "$1" | tr '[:lower:]' '[:upper:]')
-		local usename=${2-$(echo "$1" | tr '[:upper:]' '[:lower:]')}
-		local varvalue=$(usex ${usename})
-		echo "${varname}=${varvalue}"
-	}
-
-	emake \
-		GIT=true \
-		CPP="$(tc-getPROG CPP cpp)" \
-		$(use_var debug) \
-		$(use_var LIBCAP caps) \
-		$(use_var cracklib) \
-		$(use_var passwdqc) \
-		$(use_var consolekit) \
-		$(use_var elogind) \
-		$(use_var systemd) \
-		$(use_var selinux) \
-		$(use_var nullok) \
-		$(use_var mktemp) \
-		$(use_var pam_ssh) \
-		$(use_var securetty) \
-		$(use_var sha512) \
-		$(use_var KRB5 pam_krb5) \
-		$(use_var minimal) \
-		LINUX_PAM_VERSION=${linux_pam_version}
-}
-
-src_test() { :; }
-
-src_install() {
-	emake GIT=true DESTDIR="${ED}" install
-}
diff --git a/sys-auth/pambase/pambase-20200917.ebuild b/sys-auth/pambase/pambase-20201103.ebuild
index a1bd1d6b4bae..30aca642bcf0 100644
--- a/sys-auth/pambase/pambase-20200917.ebuild
+++ b/sys-auth/pambase/pambase-20201103.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/gentoo/pambase/archive/${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86 ~amd64-linux ~x86-linux"
 IUSE="caps debug elogind gnome-keyring minimal mktemp +nullok pam_krb5 pam_ssh +passwdqc pwhistory pwquality securetty selinux +sha512 systemd"
 
 RESTRICT="binchecks"
@@ -56,28 +56,29 @@ S="${WORKDIR}/${PN}-${P}"
 
 src_configure() {
 	${EPYTHON} ./${PN}.py \
-	$(usex caps '--libcap' '') \
-	$(usex debug '--debug' '') \
-	$(usex elogind '--elogind' '') \
-	$(usex gnome-keyring '--gnome-keyring' '') \
-	$(usex minimal '--minimal' '') \
-	$(usex mktemp '--mktemp' '') \
-	$(usex nullok '--nullok' '') \
-	$(usex pam_krb5 '--krb5' '') \
-	$(usex pam_ssh '--pam-ssh' '') \
-	$(usex passwdqc '--passwdqc' '') \
-	$(usex pwhistory '--pwhistory' '') \
-	$(usex pwquality '--pwquality' '') \
-	$(usex securetty '--securetty' '') \
-	$(usex selinux '--selinux' '') \
-	$(usex sha512 '--sha512' '') \
-	$(usex systemd '--systemd' '')
+		$(usex caps '--caps' '') \
+		$(usex debug '--debug' '') \
+		$(usex elogind '--elogind' '') \
+		$(usex gnome-keyring '--gnome-keyring' '') \
+		$(usex minimal '--minimal' '') \
+		$(usex mktemp '--mktemp' '') \
+		$(usex nullok '--nullok' '') \
+		$(usex pam_krb5 '--krb5' '') \
+		$(usex pam_ssh '--pam-ssh' '') \
+		$(usex passwdqc '--passwdqc' '') \
+		$(usex pwhistory '--pwhistory' '') \
+		$(usex pwquality '--pwquality' '') \
+		$(usex securetty '--securetty' '') \
+		$(usex selinux '--selinux' '') \
+		$(usex sha512 '--sha512' '') \
+		$(usex systemd '--systemd' '') \
+	|| die
 }
 
 src_test() { :; }
 
 src_install() {
-	DOC_CONTENTS=
+	local DOC_CONTENTS
 
 	if use passwdqc; then
 		DOC_CONTENTS="To amend the existing password policy please see the man 5 passwdqc.conf
diff --git a/sys-auth/passwdqc/Manifest b/sys-auth/passwdqc/Manifest
index 3a5fe0c20852..4dcc986fc5f8 100644
--- a/sys-auth/passwdqc/Manifest
+++ b/sys-auth/passwdqc/Manifest
@@ -1,6 +1,3 @@
-AUX passwdqc-1.3.0-build.patch 1773 BLAKE2B e954aa56f4f12c57430b9c53cac9220360b6450a747fd50305db8838638833e5f76fc893be762593f89ab02b665499fbc4063dfd7ad3019134ef81771e3dcc50 SHA512 da43381deab4c39e8c905187f17e49379e44b96c729d229a1fa5aff067b510fae5cbb107896fd83273cc8f41e916023eff5d1b1f37ad739e4de3cf3945f289b8
-DIST passwdqc-1.3.0.tar.gz 48833 BLAKE2B bf6353749376ca8b52a8aac89b05561d4a0dde54133361b77228dd4d35f2e1e75f0b53a0f9c4fc2f6be5717110c1d762e2aa76f6461281b60fa3bdc9b19f2f7d SHA512 d9c2fd075ed4ff1f1dfa63fe40010d446abf8db306cacc77fd1e429fbd2dd1a6d2e4e91df46beb4c30bc30ff0cdd183ba85cefd362455ead9629d3a1c4eefece
 DIST passwdqc-1.4.0.tar.gz 55219 BLAKE2B 3f96a2d219ee23f11db2ad8ba433eaa56b97a263ad1a49159e0356b779cb4486ec9aa74cd7002fdd6d273e5a7bae4fe1b94e02f60256d331e5afc30d63e81360 SHA512 b9be6632688a1d7d929ec546679a366a67d44e7841e106c7f739a8e0656842866125160c87b04c8e0b3189a3e85eb182aa789196f68925b2f8ec71cd6a479800
-EBUILD passwdqc-1.3.0.ebuild 1711 BLAKE2B 19a51a550eb5824a35341c0638c1c1fec3d9e5ce73772151b6e4eae9afa99211b562519a796aab117f4ebfad16e2c8716cb067ebc1162da4d021694f38102f72 SHA512 8e245c777ef722106cc0e89d413dfc83b434e9b90ff9559eea47d90245f4e9b8bcf9ed8a15d42922cef7084c8e1be618d60aca6b99b06dc73a619638aecb28e0
-EBUILD passwdqc-1.4.0-r1.ebuild 1282 BLAKE2B 80353f2c519fd5afb65a4d567948407088e3cad8605ac6f87f34aec548f5e27d277619ddbe4f7140dbd59bc823b89fc22a1c9ce5bf8c8bb3d34c022b419c137d SHA512 30806db924279bb17fd0f1466628f51c0bd7a7e110ff2b4959fc6c76f9222f9d232678a6906ad802ec50a01f1f0edae1de57a24ca3cfd0ab8b6b3ff9a4452abc
-MISC metadata.xml 328 BLAKE2B 708e739a28626b1451952b869907c4c2513774329dfdac794178b468ffe1044db82ea5c015c641a5142f1f6ee6176545193e97beed1698f7f8c42a3d38e3f84a SHA512 383c32b28259f9a70406eb6c9a3d05143212a63c347019143983c3e6a2c48eb9a32ed7e8e50c99339b65c60d680b530770c4fa3e826c6e746429274814716d97
+EBUILD passwdqc-1.4.0-r1.ebuild 1274 BLAKE2B 64a1c52ee69fc3697d85d11083a57853eb483c60f7a6c41ada89e06ee8a885f921705a81246b2ad566f6ffa205fd9d2a12334f5b9b17fdb854a3be023a3ae007 SHA512 3c9372041f51b688d43f29aca59f411a77c3497d50a3cce06ad895331486ff6869f95be0670b3f0f6dba9821598455e6e129de644d75ebe70c113aa0ea6098cb
+MISC metadata.xml 243 BLAKE2B f7576f14be2c0aa21ca2c7147133e4a4132d6559cca1519745dd2f4ea912b3856950c7645e13d2317f38c80ba93b13d47370260920241a5ab60a4eae59f2cf33 SHA512 0dc1f228861badffd9c4175af734b72435dc7c60d369a3d9ff946c5b98b3f2f49af7d433f7ec5fc2afee7015b8f75259e8debe150b1bcffa0cb66425bed10d8d
diff --git a/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch b/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch
deleted file mode 100644
index c8adeb89b4ab..000000000000
--- a/sys-auth/passwdqc/files/passwdqc-1.3.0-build.patch
+++ /dev/null
@@ -1,58 +0,0 @@
---- a/Makefile
-+++ b/Makefile
-@@ -20,10 +20,11 @@
- BINMODE = 755
- CONFDIR = /etc
- CONFMODE = 644
--SHARED_LIBDIR = /lib
-+LIBDIR = lib
-+SHARED_LIBDIR = /$(LIBDIR)
- SHARED_LIBDIR_SUN = /usr/lib
- SHARED_LIBDIR_REL = ../..$(SHARED_LIBDIR)
--DEVEL_LIBDIR = /usr/lib
-+DEVEL_LIBDIR = /usr/$(LIBDIR)
--SECUREDIR = /lib/security
-+SECUREDIR = /$(LIBDIR)/security
- SECUREDIR_SUN = /usr/lib/security
- SECUREDIR_DARWIN = /usr/lib/pam
-@@ -48,7 +49,7 @@
- INSTALL_SUN = /usr/ucb/install -c
- CFLAGS = -Wall -W -O2
- CFLAGS_lib = $(CFLAGS) -fPIC
--CFLAGS_bin = $(CFLAGS) -fomit-frame-pointer
-+CFLAGS_bin = $(CFLAGS)
- 
- LDFLAGS =
- LDFLAGS_shared = --shared
-@@ -93,7 +94,7 @@
- 
- default: all
- 
--all pam utils install install_lib install_pam install_utils uninstall remove remove_lib remove_pam remove_utils:
-+all lib pam utils install install_lib install_pam install_utils uninstall remove remove_lib remove_pam remove_utils:
- 	case "`uname -s`" in \
- 	Linux)	$(MAKE) CFLAGS_lib="$(CFLAGS_lib) -DHAVE_SHADOW" \
- 			LDFLAGS_lib="$(LDFLAGS_lib_LINUX)" \
-@@ -126,18 +127,20 @@
- 
- all_wrapped: pam_wrapped utils_wrapped
- 
-+lib_wrapped: $(SHARED_LIB) $(DEVEL_LIB)
-+
- pam_wrapped: $(SHARED_PAM)
- 
- utils_wrapped: $(BINS)
- 
- $(SHARED_LIB): $(OBJS_LIB) $(MAP_LIB)
--	$(LD_lib) $(LDFLAGS_lib) $(OBJS_LIB) $(LDLIBS_lib) -o $(SHARED_LIB)
-+	$(LD_lib) $(LDFLAGS) $(LDFLAGS_lib) $(OBJS_LIB) $(LDLIBS_lib) -o $(SHARED_LIB)
- 
- $(DEVEL_LIB): $(SHARED_LIB)
- 	$(LN_s) $(SHARED_LIB) $(DEVEL_LIB)
- 
- $(SHARED_PAM): $(OBJS_PAM) $(MAP_PAM) $(DEVEL_LIB)
--	$(LD_lib) $(LDFLAGS_pam) $(OBJS_PAM) $(LDLIBS_pam) -L. -lpasswdqc -o $(SHARED_PAM)
-+	$(LD_lib) $(LDFLAGS) $(LDFLAGS_pam) $(OBJS_PAM) $(LDLIBS_pam) -L. -lpasswdqc -o $(SHARED_PAM)
- 
- pwqgen: $(OBJS_GEN) $(DEVEL_LIB)
- 	$(LD) $(LDFLAGS) $(OBJS_GEN) -L. -lpasswdqc -o $@
diff --git a/sys-auth/passwdqc/metadata.xml b/sys-auth/passwdqc/metadata.xml
index dec6162a1b7c..203fa55c746f 100644
--- a/sys-auth/passwdqc/metadata.xml
+++ b/sys-auth/passwdqc/metadata.xml
@@ -5,7 +5,4 @@
 	<email>zlogene@gentoo.org</email>
 	<name>Mikle Kolyada</name>
 </maintainer>
-<use>
-	<flag name="utils">Install pwqcheck and pwqgen helper utilities</flag>
-</use>
 </pkgmetadata>
diff --git a/sys-auth/passwdqc/passwdqc-1.3.0.ebuild b/sys-auth/passwdqc/passwdqc-1.3.0.ebuild
deleted file mode 100644
index 61f8e548190d..000000000000
--- a/sys-auth/passwdqc/passwdqc-1.3.0.ebuild
+++ /dev/null
@@ -1,69 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit pam eutils toolchain-funcs multilib
-
-DESCRIPTION="Password strength checking library (and PAM module)"
-HOMEPAGE="http://www.openwall.com/passwdqc/"
-SRC_URI="http://www.openwall.com/${PN}/${P}.tar.gz"
-
-LICENSE="Openwall BSD public-domain"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm ~arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 s390 sparc x86 ~amd64-linux ~x86-linux"
-IUSE="pam utils"
-
-RDEPEND="
-	pam? (
-		sys-libs/pam
-		!<sys-auth/pam_passwdqc-1.3.0
-	)"
-DEPEND="${RDEPEND}"
-
-src_prepare() {
-	epatch "${FILESDIR}"/${PN}-1.3.0-build.patch
-	sed -i \
-		-e 's:`uname -s`:Linux:' \
-		Makefile || die
-	# See if the system has a shadow.h. #554504
-	echo '#include <shadow.h>' > "${T}"/test.c
-	if ! $(tc-getCPP) ${CPPFLAGS} "${T}"/test.c >& /dev/null ; then
-		sed -i -e 's:-DHAVE_SHADOW::' Makefile || die
-	fi
-}
-
-_emake() {
-	emake \
-		LIBDIR="$(get_libdir)" \
-		CFLAGS="${CFLAGS} ${CPPFLAGS}" \
-		LDFLAGS="${LDFLAGS}" \
-		CC="$(tc-getCC)" \
-		LD="$(tc-getCC)" \
-		"$@"
-}
-
-src_compile() {
-	# The use of wrapped targets defeats the Makefile dep tracking.
-	# Build all the targets explicitly after the library.
-	_emake lib
-	if use pam || use utils ; then
-		_emake $(usev pam) $(usev utils)
-	fi
-}
-
-src_install() {
-	_emake \
-		DESTDIR="${ED}" \
-		install_lib $(usex pam install_pam '') $(usex utils install_utils '')
-	dodoc README PLATFORMS INTERNALS
-}
-
-pkg_postinst() {
-	if use pam ; then
-		elog "To activate pam_passwdqc use pam_passwdqc.so instead"
-		elog "of pam_cracklib.so in /etc/pam.d/system-auth."
-		elog "Also, if you want to change the parameters, read up"
-		elog "on the pam_passwdqc(8) man page."
-	fi
-}
diff --git a/sys-auth/passwdqc/passwdqc-1.4.0-r1.ebuild b/sys-auth/passwdqc/passwdqc-1.4.0-r1.ebuild
index 3861096f8540..462be697b147 100644
--- a/sys-auth/passwdqc/passwdqc-1.4.0-r1.ebuild
+++ b/sys-auth/passwdqc/passwdqc-1.4.0-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="http://www.openwall.com/${PN}/${P}.tar.gz"
 
 LICENSE="Openwall BSD public-domain"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux"
 
 RDEPEND="sys-libs/pam"
 DEPEND="${RDEPEND}"
diff --git a/sys-auth/polkit/Manifest b/sys-auth/polkit/Manifest
index 2417ae87205b..7d434ac007cb 100644
--- a/sys-auth/polkit/Manifest
+++ b/sys-auth/polkit/Manifest
@@ -1,12 +1,8 @@
-AUX CVE-2018-19788.patch 12204 BLAKE2B d139c3e9e9814af9bbc3d605e4d25e354c860359b095d12a0269f6d44d83471cf08d96190ae8dbea173bf298512670bd36168fa1aad20592de9f27cb6dca7581 SHA512 b9be88d53521626914ba9c65c00d145b6e377835452defb1951f6fb40502e09325fe217de20469ac64d838b19f0a2c24a2e22d816e83c38c20dc3dab90ea86f1
 AUX polkit-0.115-elogind.patch 1069 BLAKE2B 6c5a3d7d3e716a994b951181808f64d864e6ca58b3a018a5354022f08c6e7c1d8987366c9777f47cc970916ad9fe39f288a1b1643113fc99745f333e02dab56f SHA512 06432fa56788699762c6978484640554f91728a1cb40679eb47b8514b3c7aa23aac5b9c26586eb4d7043a0af1b319bbe7f869d24844d9151317299b74a8e8f7f
-AUX polkit-0.115-spidermonkey-60.patch 5562 BLAKE2B 8f262d682ea413f83bc555bacbeb4306cdee156cc1ee1a98ab76de20f1aeaef405e772536190eaf3a842ef365514f7b68760200e9ddb9342498b01f40f0f9662 SHA512 41d6a9e63dfbd788267b7de231161d57988b4bf90fd52fb49ac7c139a4621476e76b891ae510786611a0c3cf9914a62aa105e2a1a202d29c47a2091fe6e7e9b9
-DIST polkit-0.115.tar.gz 1550932 BLAKE2B 3185ebed46209f88a9ffccbbcaf1bf180d1ae6d5ec53cf3c66d867ad43910b47a1123a3db190991ebb382a0d28fc5a119ea4bab942db324e9af5663056cf6ee1 SHA512 1153011fa93145b2c184e6b3446d3ca21b38918641aeccd8fac3985ac3e30ec6bc75be6973985fde90f2a24236592f1595be259155061c2d33358dd17c4ee4fc
 DIST polkit-0.116.tar.gz 1548311 BLAKE2B e9761a2934136d453a47b81dd1f132f9fc96c45b731d5fceb2aa7706f5325b6499f6acbb68032befc1b21878b1b54754685607c916ca8e02a8accca3ca014b31 SHA512 b66b01cc2bb4349de70147f41f161f0f6f41e7230b581dfb054058b48969ec57041ab05b51787c749ccfc36aa5f317952d7e7ba337b4f6f6c0a923ed5866c2d5
 DIST polkit-0.117.tar.gz 1554536 BLAKE2B 1cf7e0ff9db19a29be626f4bea96c9e2ef8b1eab4b8287a5f1f4d2a818b86d58c1c4c4a41849d95e31559dba1b18853a31e934ebbadd8e07f94dfd58b45240e0 SHA512 c10ea984f2386fe436e58a2866e5323afc80d24f744f0ee61d966941259aa491bd96b07d911434aa731b300c3cca25b647804b396501175ab5b3c53384e94c70
 DIST polkit-0.118.tar.gz 1556765 BLAKE2B d048b37b1ff8ad59a2d8a333a3b459d1592b61f7a6d9a9569f8b2984de913d71abfc9748e242c7453f0bce4f322bd44672e35309f181afd22488794ca0e47119 SHA512 3d412f40c903cfaf68530f9c0cb616106f8edf43bec6805de129f8bb9cb4e64c98da6bf02caa3ef5619974f3e2df7a70564f08b92901662453477e9005752b4e
-EBUILD polkit-0.115-r4.ebuild 3619 BLAKE2B 5b29fe32227148a5df98c5a921733858a77877f4675aa3b63ecb81aaaba3341a22487066d31bdc2ccd603fc0ffc57ba64602b1efaef1124476b4b5c906be9c4e SHA512 7fdc1889d96952ce59745f05c7965638fb398f46f53a72ec71db2d02fdd1b11134467c25d8ad1a5ef97d847a93cbf9c6cac42192a553b1952a65c3e116903a30
-EBUILD polkit-0.116-r1.ebuild 3355 BLAKE2B 6ac0430904eb9dea92ab769396c9793843bc047bc52167905d420ef6f703c192ca1110318b46b244b9122e6547028e6417db9ae4b7460cee304963165a2d97c0 SHA512 c59dc110588ae6f8b1a967b46b86f3993a73e6a08ddd667e944f71407572a38c3a3e1649407ddf01f360673d4252fbdf2bbfe7ea9fb281cc5294e8200ade154d
-EBUILD polkit-0.117.ebuild 3362 BLAKE2B e9867f28f2f6b6f917fe002dd0fa6714602d3b049b5cc4e86122362fe19c74ce8334bc4d20d2223057f1ad6be64e61ab716f379c4866816a87065fd29441bc30 SHA512 5520b41547f5990948b12917aedb3e2b234dc042090c1f5345fdc19cbc1bd84d137b34bf76178c946628c309f0fd3d737ba582cd8032ef1b755683a03b966b5e
-EBUILD polkit-0.118.ebuild 3331 BLAKE2B ba7e4c24375aa0a3081e0c08c0ff60d63527d969e4ebeaf1d7e4019b9f4e3f0aadcc19c2099235512e44355ef74b8ff154c25c368ee79629e4d0b42c73198475 SHA512 1613284944bcb8fb6a171982291f5f6819c4e5e26687973d02309131155ebee3124bb0793328ca78511e93b17415a3bd6ee7d2085a4d5f18c6b32a00a0da70f6
-MISC metadata.xml 498 BLAKE2B 8bbfe2ee11b53b77dc26215776a87acd7cade59a5a139ada605f2ad293c569005d2bd517aaee1c6f4ea45251a0cc67f10082c96c2224d47fd84b5e1d87dcb724 SHA512 16ab1ff82daad858eb9adf7396b0e3d5845914eb7d7f1590cdea44fe1a2214043f011cd65cdde2e2195b959bae6581845bc6b4981fd400b3d8719f400f85b6dc
+EBUILD polkit-0.116-r1.ebuild 3285 BLAKE2B 2335b08fcb3df2d97966d3905ce5278fc227453e2b3c471fd3840a2923835501aa3303065f2df853cbb907677a08994baeda02293a887416026c71492b7604e3 SHA512 2afd17bdf487ff35efb756c2fd37b2adefde481c09b383249f2ceb383c6129ec8de25a500b78b6e21f50a737e64447e2757625a5ea0ec64e5810af4e51fc0699
+EBUILD polkit-0.117.ebuild 3289 BLAKE2B 9d31fda505af71e16140221f7cc0e6745c66dd0f551c7e553dad7038b98fd05afbb84c08ab837cdae9264878116363c70c8c4dca3fc1fc59f9d70a71b0a039d2 SHA512 ef628789608e9fc40aee36b76f78b006ada9d93ad1c9d2713b6fcaf84438d3b4eccaba63492d650f3d8cd402c67cf77c4da7152e918bb2c52564a110dc88e1ce
+EBUILD polkit-0.118.ebuild 3256 BLAKE2B ea4711630dfbe7354e1cec2624dc9858f024ae60f76505bac58b70f99143ae2a9e1c7da271e22bc3d1b520df9f3f2086f3884c9fea06b81fd6ace9807668d24e SHA512 26843a555ed592587df1d6aa8d3413225021106853de691506a6a356d39be7cdb9dce64b90c102ddc33ec2dcb7659bfb42c896ef7666b704e8dc134981565df7
+MISC metadata.xml 409 BLAKE2B 5460681a61f218f9347ddaaf9f4171aba5d270d9742588e9c2d9f78d4ba495a811062098ae65ce866ce6c5177adaf6b943db33739214ccaecc2a5e3914c67809 SHA512 e5a26398bdbc9251d175235e40477f20b814753e16565e6ca4f56a7d2f7b22c7238fcadd07519eecef7dee3428bd5b76b377ff19b24b7be5b0f52d4cfff32743
diff --git a/sys-auth/polkit/files/CVE-2018-19788.patch b/sys-auth/polkit/files/CVE-2018-19788.patch
deleted file mode 100644
index 97e3608a12ba..000000000000
--- a/sys-auth/polkit/files/CVE-2018-19788.patch
+++ /dev/null
@@ -1,339 +0,0 @@
-From 2cb40c4d5feeaa09325522bd7d97910f1b59e379 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Mon, 3 Dec 2018 10:28:58 +0100
-Subject: [PATCH 1/2] Allow negative uids/gids in PolkitUnixUser and Group
- objects
-
-(uid_t) -1 is still used as placeholder to mean "unset". This is OK, since
-there should be no users with such number, see
-https://systemd.io/UIDS-GIDS#special-linux-uids.
-
-(uid_t) -1 is used as the default value in class initialization.
-
-When a user or group above INT32_MAX is created, the numeric uid or
-gid wraps around to negative when the value is assigned to gint, and
-polkit gets confused. Let's accept such gids, except for -1.
-
-A nicer fix would be to change the underlying type to e.g. uint32 to
-not have negative values. But this cannot be done without breaking the
-API, so likely new functions will have to be added (a
-polkit_unix_user_new variant that takes a unsigned, and the same for
-_group_new, _set_uid, _get_uid, _set_gid, _get_gid, etc.). This will
-require a bigger patch.
-
-Fixes https://gitlab.freedesktop.org/polkit/polkit/issues/74.
----
- src/polkit/polkitunixgroup.c   | 15 +++++++++++----
- src/polkit/polkitunixprocess.c | 12 ++++++++----
- src/polkit/polkitunixuser.c    | 13 ++++++++++---
- 3 files changed, 29 insertions(+), 11 deletions(-)
-
-diff --git a/src/polkit/polkitunixgroup.c b/src/polkit/polkitunixgroup.c
-index c57a1aa..309f689 100644
---- a/src/polkit/polkitunixgroup.c
-+++ b/src/polkit/polkitunixgroup.c
-@@ -71,6 +71,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixGroup, polkit_unix_group, G_TYPE_OBJECT,
- static void
- polkit_unix_group_init (PolkitUnixGroup *unix_group)
- {
-+  unix_group->gid = -1; /* (git_t) -1 is not a valid GID under Linux */
- }
- 
- static void
-@@ -100,11 +101,14 @@ polkit_unix_group_set_property (GObject      *object,
-                                GParamSpec   *pspec)
- {
-   PolkitUnixGroup *unix_group = POLKIT_UNIX_GROUP (object);
-+  gint val;
- 
-   switch (prop_id)
-     {
-     case PROP_GID:
--      unix_group->gid = g_value_get_int (value);
-+      val = g_value_get_int (value);
-+      g_return_if_fail (val != -1);
-+      unix_group->gid = val;
-       break;
- 
-     default:
-@@ -131,9 +135,9 @@ polkit_unix_group_class_init (PolkitUnixGroupClass *klass)
-                                    g_param_spec_int ("gid",
-                                                      "Group ID",
-                                                      "The UNIX group ID",
--                                                     0,
-+                                                     G_MININT,
-                                                      G_MAXINT,
--                                                     0,
-+                                                     -1,
-                                                      G_PARAM_CONSTRUCT |
-                                                      G_PARAM_READWRITE |
-                                                      G_PARAM_STATIC_NAME |
-@@ -166,9 +170,10 @@ polkit_unix_group_get_gid (PolkitUnixGroup *group)
-  */
- void
- polkit_unix_group_set_gid (PolkitUnixGroup *group,
--                          gint gid)
-+                           gint gid)
- {
-   g_return_if_fail (POLKIT_IS_UNIX_GROUP (group));
-+  g_return_if_fail (gid != -1);
-   group->gid = gid;
- }
- 
-@@ -183,6 +188,8 @@ polkit_unix_group_set_gid (PolkitUnixGroup *group,
- PolkitIdentity *
- polkit_unix_group_new (gint gid)
- {
-+  g_return_val_if_fail (gid != -1, NULL);
-+
-   return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_GROUP,
-                                        "gid", gid,
-                                        NULL));
-diff --git a/src/polkit/polkitunixprocess.c b/src/polkit/polkitunixprocess.c
-index 972b777..b02b258 100644
---- a/src/polkit/polkitunixprocess.c
-+++ b/src/polkit/polkitunixprocess.c
-@@ -159,9 +159,14 @@ polkit_unix_process_set_property (GObject      *object,
-       polkit_unix_process_set_pid (unix_process, g_value_get_int (value));
-       break;
- 
--    case PROP_UID:
--      polkit_unix_process_set_uid (unix_process, g_value_get_int (value));
-+    case PROP_UID: {
-+      gint val;
-+
-+      val = g_value_get_int (value);
-+      g_return_if_fail (val != -1);
-+      polkit_unix_process_set_uid (unix_process, val);
-       break;
-+    }
- 
-     case PROP_START_TIME:
-       polkit_unix_process_set_start_time (unix_process, g_value_get_uint64 (value));
-@@ -239,7 +244,7 @@ polkit_unix_process_class_init (PolkitUnixProcessClass *klass)
-                                    g_param_spec_int ("uid",
-                                                      "User ID",
-                                                      "The UNIX user ID",
--                                                     -1,
-+                                                     G_MININT,
-                                                      G_MAXINT,
-                                                      -1,
-                                                      G_PARAM_CONSTRUCT |
-@@ -303,7 +308,6 @@ polkit_unix_process_set_uid (PolkitUnixProcess *process,
-                              gint               uid)
- {
-   g_return_if_fail (POLKIT_IS_UNIX_PROCESS (process));
--  g_return_if_fail (uid >= -1);
-   process->uid = uid;
- }
- 
-diff --git a/src/polkit/polkitunixuser.c b/src/polkit/polkitunixuser.c
-index 8bfd3a1..234a697 100644
---- a/src/polkit/polkitunixuser.c
-+++ b/src/polkit/polkitunixuser.c
-@@ -72,6 +72,7 @@ G_DEFINE_TYPE_WITH_CODE (PolkitUnixUser, polkit_unix_user, G_TYPE_OBJECT,
- static void
- polkit_unix_user_init (PolkitUnixUser *unix_user)
- {
-+  unix_user->uid = -1;  /* (uid_t) -1 is not a valid UID under Linux */
-   unix_user->name = NULL;
- }
- 
-@@ -112,11 +113,14 @@ polkit_unix_user_set_property (GObject      *object,
-                                GParamSpec   *pspec)
- {
-   PolkitUnixUser *unix_user = POLKIT_UNIX_USER (object);
-+  gint val;
- 
-   switch (prop_id)
-     {
-     case PROP_UID:
--      unix_user->uid = g_value_get_int (value);
-+      val = g_value_get_int (value);
-+      g_return_if_fail (val != -1);
-+      unix_user->uid = val;
-       break;
- 
-     default:
-@@ -144,9 +148,9 @@ polkit_unix_user_class_init (PolkitUnixUserClass *klass)
-                                    g_param_spec_int ("uid",
-                                                      "User ID",
-                                                      "The UNIX user ID",
--                                                     0,
-+                                                     G_MININT,
-                                                      G_MAXINT,
--                                                     0,
-+                                                     -1,
-                                                      G_PARAM_CONSTRUCT |
-                                                      G_PARAM_READWRITE |
-                                                      G_PARAM_STATIC_NAME |
-@@ -182,6 +186,7 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
-                           gint uid)
- {
-   g_return_if_fail (POLKIT_IS_UNIX_USER (user));
-+  g_return_if_fail (uid != -1);
-   user->uid = uid;
- }
- 
-@@ -196,6 +201,8 @@ polkit_unix_user_set_uid (PolkitUnixUser *user,
- PolkitIdentity *
- polkit_unix_user_new (gint uid)
- {
-+  g_return_val_if_fail (uid != -1, NULL);
-+
-   return POLKIT_IDENTITY (g_object_new (POLKIT_TYPE_UNIX_USER,
-                                         "uid", uid,
-                                         NULL));
--- 
-2.18.1
-
-
-From b534a10727455409acd54018a9c91000e7626126 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
-Date: Mon, 3 Dec 2018 11:20:34 +0100
-Subject: [PATCH 2/2] tests: add tests for high uids
-
----
- test/data/etc/group                           |  1 +
- test/data/etc/passwd                          |  2 +
- .../etc/polkit-1/rules.d/10-testing.rules     | 21 ++++++
- .../test-polkitbackendjsauthority.c           | 72 +++++++++++++++++++
- 4 files changed, 96 insertions(+)
-
-diff --git a/test/data/etc/group b/test/data/etc/group
-index 12ef328..b9acab9 100644
---- a/test/data/etc/group
-+++ b/test/data/etc/group
-@@ -5,3 +5,4 @@ john:x:500:
- jane:x:501:
- sally:x:502:
- henry:x:503:
-+highuid2:x:4000000000:
-diff --git a/test/data/etc/passwd b/test/data/etc/passwd
-index 8544feb..5cf14a5 100644
---- a/test/data/etc/passwd
-+++ b/test/data/etc/passwd
-@@ -3,3 +3,5 @@ john:x:500:500:John Done:/home/john:/bin/bash
- jane:x:501:501:Jane Smith:/home/jane:/bin/bash
- sally:x:502:502:Sally Derp:/home/sally:/bin/bash
- henry:x:503:503:Henry Herp:/home/henry:/bin/bash
-+highuid1:x:2147483648:2147483648:The first high uid:/home/highuid1:/sbin/nologin
-+highuid2:x:4000000000:4000000000:An example high uid:/home/example:/sbin/nologin
-diff --git a/test/data/etc/polkit-1/rules.d/10-testing.rules b/test/data/etc/polkit-1/rules.d/10-testing.rules
-index 446e622..98bf062 100644
---- a/test/data/etc/polkit-1/rules.d/10-testing.rules
-+++ b/test/data/etc/polkit-1/rules.d/10-testing.rules
-@@ -53,6 +53,27 @@ polkit.addRule(function(action, subject) {
-     }
- });
- 
-+polkit.addRule(function(action, subject) {
-+    if (action.id == "net.company.john_action") {
-+        if (subject.user == "john") {
-+            return polkit.Result.YES;
-+        } else {
-+            return polkit.Result.NO;
-+        }
-+    }
-+});
-+
-+polkit.addRule(function(action, subject) {
-+    if (action.id == "net.company.highuid2_action") {
-+        if (subject.user == "highuid2") {
-+            return polkit.Result.YES;
-+        } else {
-+            return polkit.Result.NO;
-+        }
-+    }
-+});
-+
-+
- // ---------------------------------------------------------------------
- // variables
- 
-diff --git a/test/polkitbackend/test-polkitbackendjsauthority.c b/test/polkitbackend/test-polkitbackendjsauthority.c
-index b484a26..71aad23 100644
---- a/test/polkitbackend/test-polkitbackendjsauthority.c
-+++ b/test/polkitbackend/test-polkitbackendjsauthority.c
-@@ -330,6 +330,78 @@ static const RulesTestCase rules_test_cases[] = {
-     NULL,
-     POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
-   },
-+
-+  {
-+    /* highuid1 is not a member of group 'users', see test/data/etc/group */
-+    "group_membership_with_non_member(highuid22)",
-+    "net.company.group.only_group_users",
-+    "unix-user:highuid2",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
-+
-+  {
-+    /* highuid2 is not a member of group 'users', see test/data/etc/group */
-+    "group_membership_with_non_member(highuid21)",
-+    "net.company.group.only_group_users",
-+    "unix-user:highuid2",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
-+
-+  {
-+    /* highuid1 is not a member of group 'users', see test/data/etc/group */
-+    "group_membership_with_non_member(highuid24)",
-+    "net.company.group.only_group_users",
-+    "unix-user:2147483648",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
-+
-+  {
-+    /* highuid2 is not a member of group 'users', see test/data/etc/group */
-+    "group_membership_with_non_member(highuid23)",
-+    "net.company.group.only_group_users",
-+    "unix-user:4000000000",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
-+
-+  {
-+    /* john is authorized to do this, see 10-testing.rules */
-+    "john_action",
-+    "net.company.john_action",
-+    "unix-user:john",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
-+  },
-+
-+  {
-+    /* only john is authorized to do this, see 10-testing.rules */
-+    "jane_action",
-+    "net.company.john_action",
-+    "unix-user:jane",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
-+
-+  {
-+    /* highuid2 is authorized to do this, see 10-testing.rules */
-+    "highuid2_action",
-+    "net.company.highuid2_action",
-+    "unix-user:highuid2",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_AUTHORIZED,
-+  },
-+
-+  {
-+    /* only highuid2 is authorized to do this, see 10-testing.rules */
-+    "highuid1_action",
-+    "net.company.highuid2_action",
-+    "unix-user:highuid1",
-+    NULL,
-+    POLKIT_IMPLICIT_AUTHORIZATION_NOT_AUTHORIZED,
-+  },
- };
- 
- /* ---------------------------------------------------------------------------------------------------- */
--- 
-2.18.1
-
diff --git a/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch b/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch
deleted file mode 100644
index 8a4510ad2051..000000000000
--- a/sys-auth/polkit/files/polkit-0.115-spidermonkey-60.patch
+++ /dev/null
@@ -1,180 +0,0 @@
-From c9cd7024140b837b5693d7c1bbaad1b0cd31cce6 Mon Sep 17 00:00:00 2001
-From: Emmanuele Bassi <ebassi@gnome.org>
-Date: Fri, 31 Aug 2018 13:32:16 +0100
-Subject: [PATCH] Depend on mozjs-60
-
-This is the new ESR version of the Mozilla JS engine, superceding
-mozjs-52.
----
- configure.ac | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 5c37e48..5cedb4e 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -79,7 +79,7 @@ PKG_CHECK_MODULES(GLIB, [gmodule-2.0 gio-unix-2.0 >= 2.30.0])
- AC_SUBST(GLIB_CFLAGS)
- AC_SUBST(GLIB_LIBS)
- 
--PKG_CHECK_MODULES(LIBJS, [mozjs-52])
-+PKG_CHECK_MODULES(LIBJS, [mozjs-60])
- 
- AC_SUBST(LIBJS_CFLAGS)
- AC_SUBST(LIBJS_CXXFLAGS)
-
-
-From dd00683e8781d230a45781d509d86ad676138564 Mon Sep 17 00:00:00 2001
-From: Emmanuele Bassi <ebassi@gnome.org>
-Date: Fri, 31 Aug 2018 13:33:20 +0100
-Subject: [PATCH] Port the JS authority to mozjs-60
-
-API changes in mozjs that need to be reflected in the JS authority:
-
- - the JS::CompileOptions constructor and the JS::CompartmentOptions
-   do not allow setting a JS version any more
-
- - do not use NULL comparisons for C++ objects
-
- - the resize() method for a vector has a return value that needs
-   to be handled
-
- - JSClassOps has different fields
----
- .../polkitbackendjsauthority.cpp              | 65 +++++++++----------
- 1 file changed, 32 insertions(+), 33 deletions(-)
-
-diff --git a/src/polkitbackend/polkitbackendjsauthority.cpp b/src/polkitbackend/polkitbackendjsauthority.cpp
-index 7602714..984a0f0 100644
---- a/src/polkitbackend/polkitbackendjsauthority.cpp
-+++ b/src/polkitbackend/polkitbackendjsauthority.cpp
-@@ -150,18 +150,17 @@ G_DEFINE_TYPE (PolkitBackendJsAuthority, polkit_backend_js_authority, POLKIT_BAC
- /* ---------------------------------------------------------------------------------------------------- */
- 
- static const struct JSClassOps js_global_class_ops = {
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL
-+  nullptr,  // addProperty
-+  nullptr,  // deleteProperty
-+  nullptr,  // enumerate
-+  nullptr,  // newEnumerate
-+  nullptr,  // resolve
-+  nullptr,  // mayResolve
-+  nullptr,  // finalize
-+  nullptr,  // call
-+  nullptr,  // hasInstance
-+  nullptr,  // construct
-+  JS_GlobalObjectTraceHook
- };
- 
- static JSClass js_global_class = {
-@@ -172,18 +171,17 @@ static JSClass js_global_class = {
- 
- /* ---------------------------------------------------------------------------------------------------- */
- static const struct JSClassOps js_polkit_class_ops = {
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL,
--  NULL
-+  nullptr,  // addProperty
-+  nullptr,  // deleteProperty
-+  nullptr,  // enumerate
-+  nullptr,  // newEnumerate
-+  nullptr,  // resolve
-+  nullptr,  // mayResolve
-+  nullptr,  // finalize
-+  nullptr,  // call
-+  nullptr,  // hasInstance
-+  nullptr,  // construct
-+  nullptr   // trace
- };
- 
- static JSClass js_polkit_class = {
-@@ -469,19 +467,18 @@ polkit_backend_js_authority_constructed (GObject *object)
- 
-   {
-     JS::CompartmentOptions compart_opts;
--    compart_opts.behaviors().setVersion(JSVERSION_LATEST);
-+
-     JS::RootedObject global(authority->priv->cx);
- 
-     authority->priv->js_global = new JS::Heap<JSObject*> (JS_NewGlobalObject (authority->priv->cx, &js_global_class, NULL, JS::FireOnNewGlobalHook, compart_opts));
- 
-     global = authority->priv->js_global->get ();
--
--    if (global == NULL)
-+    if (!global)
-       goto fail;
- 
-     authority->priv->ac = new JSAutoCompartment(authority->priv->cx,  global);
- 
--    if (authority->priv->ac == NULL)
-+    if (!authority->priv->ac)
-       goto fail;
- 
-     if (!JS_InitStandardClasses (authority->priv->cx, global))
-@@ -493,7 +490,7 @@ polkit_backend_js_authority_constructed (GObject *object)
- 
-     polkit = authority->priv->js_polkit->get ();
- 
--    if (polkit == NULL)
-+    if (!polkit)
-       goto fail;
- 
-     if (!JS_DefineProperty(authority->priv->cx, global, "polkit", polkit, JSPROP_ENUMERATE))
-@@ -504,7 +501,7 @@ polkit_backend_js_authority_constructed (GObject *object)
-                              js_polkit_functions))
-       goto fail;
- 
--    JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
-+    JS::CompileOptions options(authority->priv->cx);
-     JS::RootedValue rval(authority->priv->cx);
-     if (!JS::Evaluate (authority->priv->cx,
-                        options,
-@@ -684,7 +681,9 @@ set_property_strv (PolkitBackendJsAuthority  *authority,
-   JS::AutoValueVector elems(authority->priv->cx);
-   guint n;
- 
--  elems.resize(value->len);
-+  if (!elems.resize(value->len))
-+    g_error ("Unable to resize vector");
-+
-   for (n = 0; n < value->len; n++)
-     {
-       const char *c_string = (const char *) g_ptr_array_index(value, n);
-@@ -741,7 +740,7 @@ subject_to_jsval (PolkitBackendJsAuthority  *authority,
-                   GError                   **error)
- {
-   gboolean ret = FALSE;
--  JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
-+  JS::CompileOptions options(authority->priv->cx);
-   const char *src;
-   JS::RootedObject obj(authority->priv->cx);
-   pid_t pid;
-@@ -868,7 +867,7 @@ action_and_details_to_jsval (PolkitBackendJsAuthority  *authority,
-                              GError                   **error)
- {
-   gboolean ret = FALSE;
--  JS::CompileOptions options(authority->priv->cx, JSVERSION_UNKNOWN);
-+  JS::CompileOptions options(authority->priv->cx);
-   const char *src;
-   JS::RootedObject obj(authority->priv->cx);
-   gchar **keys;
diff --git a/sys-auth/polkit/metadata.xml b/sys-auth/polkit/metadata.xml
index c60e1e361ab3..b6d2fdc3cad1 100644
--- a/sys-auth/polkit/metadata.xml
+++ b/sys-auth/polkit/metadata.xml
@@ -5,7 +5,6 @@
 		<email>freedesktop-bugs@gentoo.org</email>
 	</maintainer>
 	<use>
-		<flag name="consolekit">Use <pkg>sys-auth/consolekit</pkg> for session tracking</flag>
 		<flag name="elogind">Use <pkg>sys-auth/elogind</pkg> for session tracking</flag>
 		<flag name="systemd">Use <pkg>sys-apps/systemd</pkg> for session tracking</flag>
 	</use>
diff --git a/sys-auth/polkit/polkit-0.115-r4.ebuild b/sys-auth/polkit/polkit-0.115-r4.ebuild
deleted file mode 100644
index 675bff797101..000000000000
--- a/sys-auth/polkit/polkit-0.115-r4.ebuild
+++ /dev/null
@@ -1,144 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools pam pax-utils systemd user xdg-utils
-
-DESCRIPTION="Policy framework for controlling privileges for system-wide services"
-HOMEPAGE="https://www.freedesktop.org/wiki/Software/polkit https://gitlab.freedesktop.org/polkit/polkit"
-SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz"
-
-LICENSE="LGPL-2"
-SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 s390 sparc x86"
-IUSE="consolekit elogind examples gtk +introspection jit kde nls pam selinux systemd test"
-RESTRICT="!test? ( test )"
-
-REQUIRED_USE="^^ ( consolekit elogind systemd )"
-
-BDEPEND="
-	app-text/docbook-xml-dtd:4.1.2
-	app-text/docbook-xsl-stylesheets
-	dev-libs/gobject-introspection-common
-	dev-libs/libxslt
-	dev-util/glib-utils
-	dev-util/gtk-doc-am
-	dev-util/intltool
-	sys-devel/gettext
-	virtual/pkgconfig
-	introspection? ( dev-libs/gobject-introspection )
-"
-DEPEND="
-	dev-lang/spidermonkey:60[-debug]
-	dev-libs/glib:2
-	dev-libs/expat
-	elogind? ( sys-auth/elogind )
-	pam? (
-		sys-auth/pambase
-		sys-libs/pam
-	)
-	systemd? ( sys-apps/systemd:0=[policykit] )
-"
-RDEPEND="${DEPEND}
-	selinux? ( sec-policy/selinux-policykit )
-"
-PDEPEND="
-	consolekit? ( sys-auth/consolekit[policykit] )
-	gtk? ( || (
-		>=gnome-extra/polkit-gnome-0.105
-		>=lxde-base/lxsession-0.5.2
-	) )
-	kde? ( kde-plasma/polkit-kde-agent )
-"
-
-DOCS=( docs/TODO HACKING NEWS README )
-
-PATCHES=(
-	# bug 660880
-	"${FILESDIR}"/polkit-0.115-elogind.patch
-	"${FILESDIR}"/CVE-2018-19788.patch
-	"${FILESDIR}"/polkit-0.115-spidermonkey-60.patch
-)
-
-QA_MULTILIB_PATHS="
-	usr/lib/polkit-1/polkit-agent-helper-1
-	usr/lib/polkit-1/polkitd"
-
-pkg_setup() {
-	local u=polkitd
-	local g=polkitd
-	local h=/var/lib/polkit-1
-
-	enewgroup ${g}
-	enewuser ${u} -1 -1 ${h} ${g}
-	esethome ${u} ${h}
-}
-
-src_prepare() {
-	default
-
-	sed -i -e 's|unix-group:wheel|unix-user:0|' src/polkitbackend/*-default.rules || die #401513
-
-	# Workaround upstream hack around standard gtk-doc behavior, bug #552170
-	sed -i -e 's/@ENABLE_GTK_DOC_TRUE@\(TARGET_DIR\)/\1/' \
-		-e '/install-data-local:/,/uninstall-local:/ s/@ENABLE_GTK_DOC_TRUE@//' \
-		-e 's/@ENABLE_GTK_DOC_FALSE@install-data-local://' \
-		docs/polkit/Makefile.in || die
-
-	# disable broken test - bug #624022
-	sed -i -e "/^SUBDIRS/s/polkitbackend//" test/Makefile.am || die
-
-	# Fix cross-building, bug #590764, elogind patch, bug #598615
-	eautoreconf
-}
-
-src_configure() {
-	xdg_environment_reset
-
-	local myeconfargs=(
-		--localstatedir="${EPREFIX}"/var
-		--disable-static
-		--enable-man-pages
-		--disable-gtk-doc
-		--disable-examples
-		$(use_enable elogind libelogind)
-		$(use_enable introspection)
-		$(use_enable nls)
-		$(usex pam "--with-pam-module-dir=$(getpam_mod_dir)" '')
-		--with-authfw=$(usex pam pam shadow)
-		$(use_enable systemd libsystemd-login)
-		--with-systemdsystemunitdir="$(systemd_get_systemunitdir)"
-		$(use_enable test)
-		--with-os-type=gentoo
-	)
-	econf "${myeconfargs[@]}"
-}
-
-src_compile() {
-	default
-
-	# Required for polkitd on hardened/PaX due to spidermonkey's JIT
-	pax-mark mr src/polkitbackend/.libs/polkitd test/polkitbackend/.libs/polkitbackendjsauthoritytest
-}
-
-src_install() {
-	default
-
-	fowners -R polkitd:root /{etc,usr/share}/polkit-1/rules.d
-
-	diropts -m0700 -o polkitd -g polkitd
-	keepdir /var/lib/polkit-1
-
-	if use examples; then
-		docinto examples
-		dodoc src/examples/{*.c,*.policy*}
-	fi
-
-	find "${ED}" -name '*.la' -delete || die
-}
-
-pkg_postinst() {
-	chown -R polkitd:root "${EROOT}"/{etc,usr/share}/polkit-1/rules.d
-	chown -R polkitd:polkitd "${EROOT}"/var/lib/polkit-1
-}
diff --git a/sys-auth/polkit/polkit-0.116-r1.ebuild b/sys-auth/polkit/polkit-0.116-r1.ebuild
index 0dd63c22b5a9..1f872b3a5df2 100644
--- a/sys-auth/polkit/polkit-0.116-r1.ebuild
+++ b/sys-auth/polkit/polkit-0.116-r1.ebuild
@@ -12,10 +12,10 @@ SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz"
 LICENSE="LGPL-2"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86"
-IUSE="consolekit elogind examples gtk +introspection jit kde nls pam selinux systemd test"
+IUSE="elogind examples gtk +introspection jit kde nls pam selinux systemd test"
 RESTRICT="!test? ( test )"
 
-REQUIRED_USE="^^ ( consolekit elogind systemd )"
+REQUIRED_USE="^^ ( elogind systemd )"
 
 BDEPEND="
 	acct-user/polkitd
@@ -46,7 +46,6 @@ RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-policykit )
 "
 PDEPEND="
-	consolekit? ( sys-auth/consolekit[policykit] )
 	gtk? ( || (
 		>=gnome-extra/polkit-gnome-0.105
 		>=lxde-base/lxsession-0.5.2
diff --git a/sys-auth/polkit/polkit-0.117.ebuild b/sys-auth/polkit/polkit-0.117.ebuild
index 550786e55344..81ee0f97f217 100644
--- a/sys-auth/polkit/polkit-0.117.ebuild
+++ b/sys-auth/polkit/polkit-0.117.ebuild
@@ -11,11 +11,11 @@ SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz"
 
 LICENSE="LGPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
-IUSE="consolekit elogind examples gtk +introspection jit kde nls pam selinux systemd test"
+KEYWORDS="~alpha ~amd64 arm ~arm64 ~hppa ~ia64 ~mips ppc ~ppc64 ~s390 sparc ~x86"
+IUSE="elogind examples gtk +introspection jit kde nls pam selinux systemd test"
 RESTRICT="!test? ( test )"
 
-REQUIRED_USE="^^ ( consolekit elogind systemd )"
+REQUIRED_USE="^^ ( elogind systemd )"
 
 BDEPEND="
 	acct-user/polkitd
@@ -46,7 +46,6 @@ RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-policykit )
 "
 PDEPEND="
-	consolekit? ( sys-auth/consolekit[policykit] )
 	gtk? ( || (
 		>=gnome-extra/polkit-gnome-0.105
 		>=lxde-base/lxsession-0.5.2
diff --git a/sys-auth/polkit/polkit-0.118.ebuild b/sys-auth/polkit/polkit-0.118.ebuild
index a3123451cf84..02ecc8c4a3bc 100644
--- a/sys-auth/polkit/polkit-0.118.ebuild
+++ b/sys-auth/polkit/polkit-0.118.ebuild
@@ -11,11 +11,11 @@ SRC_URI="https://www.freedesktop.org/software/${PN}/releases/${P}.tar.gz"
 
 LICENSE="LGPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~mips ~ppc64 ~s390 ~x86"
-IUSE="consolekit elogind examples gtk +introspection jit kde nls pam selinux systemd test"
+KEYWORDS="amd64 arm arm64 ~mips ppc64 ~s390 x86"
+IUSE="elogind examples gtk +introspection jit kde nls pam selinux systemd test"
 RESTRICT="!test? ( test )"
 
-REQUIRED_USE="^^ ( consolekit elogind systemd )"
+REQUIRED_USE="^^ ( elogind systemd )"
 
 BDEPEND="
 	acct-user/polkitd
@@ -46,7 +46,6 @@ RDEPEND="${DEPEND}
 	selinux? ( sec-policy/selinux-policykit )
 "
 PDEPEND="
-	consolekit? ( sys-auth/consolekit[policykit] )
 	gtk? ( || (
 		>=gnome-extra/polkit-gnome-0.105
 		>=lxde-base/lxsession-0.5.2
diff --git a/sys-auth/rtkit/Manifest b/sys-auth/rtkit/Manifest
index cdaf4fcb8150..3811f20847fb 100644
--- a/sys-auth/rtkit/Manifest
+++ b/sys-auth/rtkit/Manifest
@@ -5,5 +5,5 @@ AUX rtkit-0.13_meson_xxd_optional.patch 2002 BLAKE2B 6b6ba9a3a48e31e1f61c8fe97ef
 DIST rtkit-0.12.tar.xz 127504 BLAKE2B c2132098b98f24c1f1662df08c9940772cdad9a326c0c4b9180aac2e0878b0c71e5917ab2535628aab12ff29546faef1c68f455625c77bc2bac25864dddfa4b6 SHA512 cee48058367b5b8a705203865538d0ab4bda9d2f1d06d155360922cb095b5d6a5b0311fdda6c45d9f33227324394ca5fd3b5a399fc71e11ea4c609eab18a7b04
 DIST rtkit-0.13.tar.xz 130796 BLAKE2B 842d04556a47c199bed9fc6bc9281c0d88f83e183f01ef57ecbd80ce72949a301d6682a3aab96e996e71b82d8e8c7a85e1d44524f2ed6fbdffc6bf236cdcadaa SHA512 c058d770a4ccfdf4e2e3a713748b6a705b6d3e148a903b9dbba4bba9d3ded2b819d7dfbfa37b9fad78e57c0a5f10f2f94226f8738f666e692a085ab297a36b36
 EBUILD rtkit-0.12-r1.ebuild 1165 BLAKE2B 8c0ddde1f2c211a31ccc0aade28c8d72b895d78bb999d38e862f0ed99e717767a462972fe9aa748dcb99a3331081e295e3a3e490391741a634d35712b94fab7d SHA512 438f4bf77aecaefc977634f58360a2c334739bacd9b005caa86f039411e530fe97fe06c6347e3febbca3ff69dcadd163eedb1c78c5049019b9607a24065efaa8
-EBUILD rtkit-0.13-r1.ebuild 1179 BLAKE2B c2cc1d449af644760e3cceffeb271bd1cc5241434de67c521a8fc81916a2af8ae11ec660a639b420ee7bd1eb84f8d4ce22f45c344bb3ccd069bcabe9f3896277 SHA512 dfbc2cd978ed8797f42736ca544548ddcc690c8009c2634ba123cba1289e2177ce701e054d6f63dcbefb1ee90e35d7554808dce1bd9e0944ee05798b0a0fb518
+EBUILD rtkit-0.13-r1.ebuild 1172 BLAKE2B 41dcb9d10f5d49dfb2e5b32c30a7577d10771bf399bd73a3e6b1f9a916b233f9b7bc8a3847545b4adc86cc79d874144dcd7c5f0a167d06213b1ad9a93378fa5b SHA512 90dc8100a4c8733d810adb3a65a65d49a0ec8d2d74efdd1a3279bed65bae95bc9496f185347199c6e96bac962c4372ac8fab719e03b8504575fefbb88e4ac207
 MISC metadata.xml 455 BLAKE2B cc63fbcf541ef442091a8bd3f8b2da07f629b71778b0ece05a18617088de554f6f8ffdc1d4aeed4a73bb957c88b470fcec52781704800575b364a3d2164b3914 SHA512 90bde656e242fe6cd7b408671f419ee54f73a781b67ee9047c8cd06d7fb29fee2882aed7ab95b42f22fdb65570f389e04931f8fa24506307b1bc8387c213850e
diff --git a/sys-auth/rtkit/rtkit-0.13-r1.ebuild b/sys-auth/rtkit/rtkit-0.13-r1.ebuild
index feb00a847531..09fccb721a9c 100644
--- a/sys-auth/rtkit/rtkit-0.13-r1.ebuild
+++ b/sys-auth/rtkit/rtkit-0.13-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/heftig/${PN}/releases/download/v${PV}/${P}.tar.xz"
 
 LICENSE="GPL-3 BSD"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ppc ppc64 sparc x86"
 IUSE="systemd"
 
 BDEPEND="virtual/pkgconfig"
diff --git a/sys-auth/seatd/Manifest b/sys-auth/seatd/Manifest
new file mode 100644
index 000000000000..31466a6671ab
--- /dev/null
+++ b/sys-auth/seatd/Manifest
@@ -0,0 +1,5 @@
+AUX seatd.initd 87 BLAKE2B e88a8c353191ad9b69c0ee263aee7a050333d43e8dd26c8b3ee40cfbcb17f9b7a9391720ac34d19f375a880fae8178cd7dfc0b45cc9565b4b073bbe43cadf5ce SHA512 a19171b55e6650a9237f89258d92aba18508684412fe8a072387c505945b8e54557bd52261de76230553a572d627f40e00770087040111a7473fadfe3c33c931
+DIST seatd-0.4.0.tar.gz 34242 BLAKE2B 295ee18736b5f7e1b06013d00514321aad5fb09c285690cfbd78833a9efbfeb2cfaef69c075fb096fedaac42ff249ee1a43593dbd03132770c1be293ffe7ddc1 SHA512 498ab4040c19ff90842bf82f580ba24c2c98e0aded7ba636dcffc80f6bfd8869eec3e87e784455b66e2b69786b2fc6e7315b2867effa825440759d58e391378c
+EBUILD seatd-0.4.0.ebuild 987 BLAKE2B 0a1b3fb32190f69559bcfddc1f135131988f2885513e6625a5050462daae7e93a8e38fd7df86f9bf36fa8f36773cacaf4ccab13a7e9619dc7071bb095be8f189 SHA512 30b2ad7adc0ddcf6b9719e0efd7f4f468eae26e2bba5737bf6bc73d2cc2385eebb756f27349bda4d07b0a984e1d675b93ba7d06d0ddab861e6da7bc19d73303a
+EBUILD seatd-9999.ebuild 986 BLAKE2B 3fc01db4ea08a49215179dd4db19a7816f6c33ef221bbfd8e8bff99a299e635d51e8fbd12a216781de4196712ea93eba8c9302e00d2696ae3009dac57f4fde6f SHA512 f8425b2cafa0e44bf7035374f4ce6358fda18dd6ceada20fc5cfd6344ec8c65e784c6cc7d952d3b88e6aada6bd7749de8a754fc1963abe9829521d6646ce4dc8
+MISC metadata.xml 371 BLAKE2B 91b47ce16cdda23db5bd32abf120406a37fe6c17a0f412b7566ca82168ffbe30a5659a9f49326ecc752a147364bc0484b1342fbbb4409db1496ed86f148ad942 SHA512 2942272dd7bba259e32f6a6169d47e6d56707ecdaa0bf9d04a21be5bdc687734c59c0895361555ab6c34b113fd391f7177c26b2e08e0b298ba48eaeb70ec8e7d
diff --git a/sys-auth/seatd/files/seatd.initd b/sys-auth/seatd/files/seatd.initd
new file mode 100644
index 000000000000..f95a52f15632
--- /dev/null
+++ b/sys-auth/seatd/files/seatd.initd
@@ -0,0 +1,4 @@
+#!/sbin/openrc-run
+supervisor=supervise-daemon
+command="seatd"
+command_args="-g video"
diff --git a/sys-auth/seatd/metadata.xml b/sys-auth/seatd/metadata.xml
new file mode 100644
index 000000000000..fa389813e2dd
--- /dev/null
+++ b/sys-auth/seatd/metadata.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="person">
+	<email>contact@hacktivis.me</email>
+	<name>Haelwenn (lanodan) Monnier</name>
+</maintainer>
+<maintainer type="project">
+	<email>proxy-maint@gentoo.org</email>
+	<name>Proxy Maintainers</name>
+</maintainer>
+</pkgmetadata>
diff --git a/sys-auth/seatd/seatd-0.4.0.ebuild b/sys-auth/seatd/seatd-0.4.0.ebuild
new file mode 100644
index 000000000000..06bf3fce1be6
--- /dev/null
+++ b/sys-auth/seatd/seatd-0.4.0.ebuild
@@ -0,0 +1,48 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson
+
+DESCRIPTION="Minimal seat management daemon and universal library"
+HOMEPAGE="https://sr.ht/~kennylevinsen/seatd"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://git.sr.ht/~kennylevinsen/seatd"
+else
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+	SRC_URI="https://git.sr.ht/~kennylevinsen/seatd/archive/${PV}.tar.gz -> ${P}.tar.gz"
+fi
+LICENSE="MIT"
+SLOT="0/1"
+IUSE="elogind systemd"
+REQUIRED_USE="?? ( elogind systemd )"
+
+DEPEND="
+	elogind? ( sys-auth/elogind )
+	systemd? ( sys-apps/systemd )
+"
+RDEPEND="${DEPEND}"
+BDEPEND=">=app-text/scdoc-1.9.7"
+
+src_configure() {
+	local emesonargs=(
+		-Dman-pages=enabled
+		-Dwerror=false
+	)
+
+	if use elogind || use systemd; then
+		emesonargs+=( -Dlogind=enabled )
+	else
+		emesonargs+=( -Dlogind=disabled )
+	fi
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+	newinitd "${FILESDIR}/seatd.initd" seatd
+}
diff --git a/sys-auth/seatd/seatd-9999.ebuild b/sys-auth/seatd/seatd-9999.ebuild
new file mode 100644
index 000000000000..3d89eb8e867b
--- /dev/null
+++ b/sys-auth/seatd/seatd-9999.ebuild
@@ -0,0 +1,47 @@
+# Copyright 2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit meson
+
+DESCRIPTION="Minimal seat management daemon and universal library"
+HOMEPAGE="https://sr.ht/~kennylevinsen/seatd"
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://git.sr.ht/~kennylevinsen/seatd"
+else
+	KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+	SRC_URI="https://git.sr.ht/~kennylevinsen/seatd/archive/${PV}.tar.gz -> ${P}.tar.gz"
+fi
+LICENSE="MIT"
+SLOT="0/1"
+IUSE="elogind systemd"
+REQUIRED_USE="?? ( elogind systemd )"
+
+DEPEND="
+	elogind? ( sys-auth/elogind )
+	systemd? ( sys-apps/systemd )
+"
+RDEPEND="${DEPEND}"
+BDEPEND=">=app-text/scdoc-1.9.7"
+
+src_configure() {
+	local emesonargs=(
+		-Dman-pages=enabled
+		-Dwerror=false
+	)
+
+	if use elogind || use systemd; then
+		emesonargs+=( -Dlogind=enabled )
+	else
+		emesonargs+=( -Dlogind=disabled )
+	fi
+
+	meson_src_configure
+}
+
+src_install() {
+	meson_src_install
+	newinitd "${FILESDIR}/seatd.initd" seatd
+}
diff --git a/sys-auth/sssd/Manifest b/sys-auth/sssd/Manifest
index 8c1932e6f23b..561735083799 100644
--- a/sys-auth/sssd/Manifest
+++ b/sys-auth/sssd/Manifest
@@ -1,20 +1,11 @@
 AUX sssd 489 BLAKE2B 552ffc9c5053e6de3e4d59ae50cbd95ae44460f51d7f753d9792eefb10507225a32beb91c1a47adf0ddbffff339a245f09c260738a781d05a0a955b8bf283148 SHA512 eab8d42d0188e55a18803b738af77c1969bf7c4b59503ee99975d4739e3c532c300e394a393327b7b98254672c1c2b0b15f81c9c27479e7cbbfb4995ab12b43e
-AUX sssd-2.2.3-glibc-2.32-compat.patch 2699 BLAKE2B b05f536d5f189f005cf97e8f64a44ac88e18161b025dfa4e901c7670cebc55090d0c692a9f5a3287313892b59592982f17b22d97aad21a3f58a76d963ff2b31b SHA512 fd1eef46a1127393738bb3bd1aa6eb99a1953afb7e6979b938d4b0519291f74284e5443ba323052f4ee0d54ef64e73200bdd13177c7bca1399ca79336d16b774
 AUX sssd-2.3.1-test_ca-Look-for-libsofthsm2.so-in-usr-libdir-sofths.patch 1180 BLAKE2B 22b12936b8a4256af39396ce31a90742bc93331b2adb9c44442ddd1285ee19e03c24f99b899dfe35768d4383f7e46a241a0fa3975cc3cf4b32e93f1dd0805915 SHA512 d4519c7d9a63d6902da028584379457fda0be7b4e3b882498586504543e944462d93a3fe804f307562d75cd15257a1595c09bc1e804a41f47f1d2ff9999c7973
-AUX sssd-curl-macros.patch 1104 BLAKE2B c03179ab4d608988316224b184c6bc349230e4ee4b79b866615ceb76f091cc28a667f09a591a8b3b98655d1f6160d2e49a4df4177e616d27e7f1e50d465642dc SHA512 77b311c7a8101e5facf046d08deb7a7d363ef6e393fa44feddf82e1398dede44aa3ac57555c10496b5ba1ca370f0f6370ba8c7cd1ae80a3b2657c3e3f9fbb063
-AUX sssd-fix-CVE-2019-3811.patch 3745 BLAKE2B c09dcdd2d4f698771e099c1aca008a42833375b0d723348ead780f84ce3491b54b7a9266b83c5c7e481ec997f69662bd45e33520a0b1ec37b93a8ef800093985 SHA512 b9d95fb9515e367dd7d645778f330a5c7c7fadb9c49ddbbcd78aee18c5918d0bb8e45735c508bf1f574307afc6076a34c420cacb7963b70333e0f678ff3864b6
 AUX sssd.conf 124 BLAKE2B b6f9c016a014510f97b036d23d5f50e1e13085220fe82b0e6ef7a3ceeb114e59af935f39e66e4ad60a46f43983930e5d381b16b0ed31ba4349abe38c4b509367 SHA512 f16908c44b213edbf6b0c6e8d49df92e8c06fc623279037074fe51e49b8aca7dc18f5ed83f71909fc8209df80dfc150583edb1687f88e61588bdf9d1fbf6ed5a
 AUX sssd.service 341 BLAKE2B 0cffcd43786633aa8e5bb42c54741cba676021c5a07554b08499504f8f630ff821ff334a21e2a4f9ae2d77d70d969018dd5a85d11b12bb31235a0ffcda4105c8 SHA512 99510d11f390722f56bc164059033fc40299dd4ea29f98cd5f08b2648f31b2e70afeb6b2d90f919bde595546c80b4e6941cf6f48130661ead09c0576043e4cf5
-DIST sssd-1.16.3.tar.gz 6217114 BLAKE2B eefaf8de466d0d76e9a4b60aefef6eb63c17a55b9a1f2e07e973a61d71cbe5432e92357656a1eb353d45bbc2fa92290cef45898d0b315d4a4c4074652ff25a23 SHA512 6165923f652f624bbe3ddc625ae682c4867eb7a20652d0cf74bbb8dda2307c917d3189ede26fd21a4fb5fd5926149271a65fa09f3affe928029ed99e6422b728
-DIST sssd-2.1.0.tar.gz 6463331 BLAKE2B 9226370dc384c58841d944bdf9b067d953bf138ee7a289f01a4b8bb5d09beee3b9f21609989123d8f4f9fc13237670d61e32dcb194555ddc6785c598ce78d08c SHA512 12a7e5b89d462350af3c43e15b24a437dd985ac4a2e419d5e52cc0d05c6eacb9319d39b23681595ef860120cd1ae6e5fb265054afeddcb05d3d5f5de5d6ffa63
 DIST sssd-2.2.0.tar.gz 6642715 BLAKE2B e6c16ca69effe59769fc166c02203faee445ebe2bf551c6a1460bdee2474ccbce1a38b3aa59b1ae4a79bb170696a784b800a9299025bf6a58bc9aeb94b946338 SHA512 9ebd8784e1f0c72cb808bbc153c0b0aa9bf507938f78336a260073a89b49350dc2c6172653509738ea7a50bb9da596725e1d6c92f99c7a03308aa42f6378dbbb
-DIST sssd-2.2.2.tar.gz 6767578 BLAKE2B e0eedaf1da1de953903730c96479af0709ee14dd83eca82a11316dc96c29573b5f3de5965f386d5c12a69e7d98b6168c9d197bbd46ac51f0122feababe52dfe1 SHA512 4cce8fdbcc05d1469dad5ba987cb0f9bc33702b37f85e8e248975461bb50b0740fec92ff213bdb640b506405be7ead936ff253ab02d4a27205ddf20cc0e54801
-DIST sssd-2.2.3.tar.gz 6894302 BLAKE2B b72443ebd4f50581a0d9d2b7cf691fdda0dfe3cfb2ed82c383595aeca8d6198c7f44f1c49e56bdfeac23f9151897ac2df70d1afbbeceb2231daee71492884420 SHA512 b61d52a53e26e8efa9cb799fc6efc2314bf9d174d3cacfe591a4ca77530637591eacc0dc70c0555252e04a9617e8b134b1ab2d9b0f7351b4228e7b61499e6a10
 DIST sssd-2.3.1.tar.gz 7186526 BLAKE2B 6d630fe75b9b426ef54adbe1704fde8e01fc34df7861028c07ce2985db8a151ce743d633061386fea6460fe8eabb89242b816d4bac87975bb9b7b2064ad1d547 SHA512 6aeb52d5222c5992d581296996749327bcaf276e4eb4413a6a32ea6529343432cfe413006aca4245c19b38b515be1c4c2ef88a157c617d889274179253355bc6
-EBUILD sssd-1.16.3-r3.ebuild 6052 BLAKE2B 4b869f470adef34441936aa90a0459bf844b0570c55cdc30b3a921c7fb5cb1ef1da7823cdca8112120291583ef57649979c5f4013954decb147dd029b00c6d2f SHA512 6a9e06194fd352ce9b2afca5c4307de5dbdb29177c67cac2a6ab31d01c4480912d7c9e362d3bf9f8144070c70de4a72c806a65a253046c58f8872ef543a47693
-EBUILD sssd-2.1.0-r1.ebuild 5972 BLAKE2B 59fe7c880dd738dd827f77b22522c8be2ad65f41bf8e5fc447a1c1bcd9631eda1549ddb6b15490c6e64b294338d08d41454da15fe6129dd7fb2611e4463f1349 SHA512 0057b815e569d4e0056d2117eb600f321b77b3dfcacbacb0230433e37134e48a90a54f8bf97444bfc29113860d4014cdf8399e493d9a5851c6bea37bf5209dde
-EBUILD sssd-2.2.0-r1.ebuild 5972 BLAKE2B 59fe7c880dd738dd827f77b22522c8be2ad65f41bf8e5fc447a1c1bcd9631eda1549ddb6b15490c6e64b294338d08d41454da15fe6129dd7fb2611e4463f1349 SHA512 0057b815e569d4e0056d2117eb600f321b77b3dfcacbacb0230433e37134e48a90a54f8bf97444bfc29113860d4014cdf8399e493d9a5851c6bea37bf5209dde
-EBUILD sssd-2.2.2.ebuild 5972 BLAKE2B 59fe7c880dd738dd827f77b22522c8be2ad65f41bf8e5fc447a1c1bcd9631eda1549ddb6b15490c6e64b294338d08d41454da15fe6129dd7fb2611e4463f1349 SHA512 0057b815e569d4e0056d2117eb600f321b77b3dfcacbacb0230433e37134e48a90a54f8bf97444bfc29113860d4014cdf8399e493d9a5851c6bea37bf5209dde
-EBUILD sssd-2.2.3.ebuild 6029 BLAKE2B 85d4f9e21aa17352e91a31bfed555fce87f59d7689b621c0ee5adc2c41ac7047b6093c6d6a7426bc5c46295de5080538bd76cdf12574847338eefbb809f251c3 SHA512 22d791eca85e1e50f0cfe9bdf8a580f4e32bb3a746f129eef01a3a637b4dd7a6a9a355524c49d0f62bfb4e205241daaf3c7742c703c9ebea268a8dd48d3f4313
-EBUILD sssd-2.3.1-r1.ebuild 7537 BLAKE2B ad16d49bd320814edf43bf982ba5e03ccb15e1d81e75d87be7090efbc0805b0bdd4bccf4dc6718a728c85f01e17f5bedec996079616bd4b967052994de6763e3 SHA512 a58f795102845b1f3d8337f11712d268cdd5d24935532d4d4caf3fc9a9a1c2293e0df10ff4703e84bffa067272bebb7e74ccdc27bc249da1eade8d24214a5435
+DIST sssd-2.4.0.tar.gz 7280358 BLAKE2B 28136953cd7c9f3119bd5a223c911a3b3f97921402c5a8ba34c6fca90434fead46906266e33450688fe131a515edf9e5f8654658cc10cfaafb44a9c2d8c59dd8 SHA512 d9a4b17665ce3a1ea51cfe2fdb53818ac1e265a33c61f657f61699ecc716e1244e45b5b628aeae6c54e601383084f3cac327cb3edd7bea80bca397b1fbe4ab72
+EBUILD sssd-2.2.0-r1.ebuild 5970 BLAKE2B 700d5ab7604c65ae3a8e293cacb7406dcd7d8749a8513f5df5b81ade4cf7387a79586f08aaf9635f967db2d7171a4fe787a181b82d6cbcecc9d43e680d9f237b SHA512 97099d496e46380d55b059a440920684e88820b526b5ecfb662ad0c9b9c54459d63595a12b1f616dc2eab662eb3e40acc1955c0143df98055a32f70bdbe01b04
+EBUILD sssd-2.3.1-r2.ebuild 7560 BLAKE2B 02f77e567793ff2cb7aac669fb7a55cde18ebfa09338310ac05112729d7bc9888bb28165711233e9892cf08c4e9a29464e159bdc213d40201aead07b2ec972c1 SHA512 09330464511c7ec1a1b49e8f1397c578d015b5eb559eb45d0f5969176ef4afa052035e0827aec944f15cb922360758f7e7a929892a174a7218d0abecccf2edae
+EBUILD sssd-2.4.0.ebuild 7442 BLAKE2B 4e151e126bd5ebbfa231ae822cdfcb499802d1020299182f28c7712422f6149a03f98772eddbf5863e89bc5854e2813229a1cb9279b4788ba4c0e3b2fa09baf5 SHA512 b76cc430c711e5260d1be19fc0d4d6ccec9e0d8911ea94d15e18426f369d5958c8f0fa42f51c88b8a862003d39ed1602929ddc9b06432fd4c2e4c91e636e5bd5
 MISC metadata.xml 1480 BLAKE2B e2903840a3b7e9c92145fdded6fc6a7a275323186d2636e401b9d4c7992b61ea410f43a565482e0bdab6056feaf140a63e3f0db3da532c6686d4f7edb3d58c43 SHA512 35c81d5fdb496a9d2ca39379b0844a30c0313b2606a62e1bbf8816c0b95712089b99e4dd5f526a5bc593e8b93b8c47eb54125e25568b4c485aac379e0764d039
diff --git a/sys-auth/sssd/files/sssd-2.2.3-glibc-2.32-compat.patch b/sys-auth/sssd/files/sssd-2.2.3-glibc-2.32-compat.patch
deleted file mode 100644
index 9d59ae91be55..000000000000
--- a/sys-auth/sssd/files/sssd-2.2.3-glibc-2.32-compat.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From fe9eeb51be06059721e873f77092b1e9ba08e6c1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
-Date: Thu, 27 Feb 2020 06:50:40 +0100
-Subject: [PATCH] nss: Collision with external nss symbol
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-One of our internal static function names started
-to collide with external nss symbol. Additional
-sss_ suffix was added to avoid the collision.
-
-This is needed to unblock Fedora Rawhide's
-SSSD build.
-
-Reviewed-by: Pavel Březina <pbrezina@redhat.com>
----
- src/responder/nss/nss_cmd.c | 18 ++++++++++--------
- 1 file changed, 10 insertions(+), 8 deletions(-)
-
-diff --git a/src/responder/nss/nss_cmd.c b/src/responder/nss/nss_cmd.c
-index 356aea1564..02706c4b94 100644
---- a/src/responder/nss/nss_cmd.c
-+++ b/src/responder/nss/nss_cmd.c
-@@ -731,11 +731,13 @@ static void nss_getent_done(struct tevent_req *subreq)
-     talloc_free(cmd_ctx);
- }
- 
--static void nss_setnetgrent_done(struct tevent_req *subreq);
-+static void sss_nss_setnetgrent_done(struct tevent_req *subreq);
- 
--static errno_t nss_setnetgrent(struct cli_ctx *cli_ctx,
--                               enum cache_req_type type,
--                               nss_protocol_fill_packet_fn fill_fn)
-+/* This function's name started to collide with external nss symbol,
-+ * so it has additional sss_* prefix unlike other functions here. */
-+static errno_t sss_nss_setnetgrent(struct cli_ctx *cli_ctx,
-+                                   enum cache_req_type type,
-+                                   nss_protocol_fill_packet_fn fill_fn)
- {
-     struct nss_ctx *nss_ctx;
-     struct nss_state_ctx *state_ctx;
-@@ -777,7 +779,7 @@ static errno_t nss_setnetgrent(struct cli_ctx *cli_ctx,
-         goto done;
-     }
- 
--    tevent_req_set_callback(subreq, nss_setnetgrent_done, cmd_ctx);
-+    tevent_req_set_callback(subreq, sss_nss_setnetgrent_done, cmd_ctx);
- 
-     ret = EOK;
- 
-@@ -790,7 +792,7 @@ static errno_t nss_setnetgrent(struct cli_ctx *cli_ctx,
-     return EOK;
- }
- 
--static void nss_setnetgrent_done(struct tevent_req *subreq)
-+static void sss_nss_setnetgrent_done(struct tevent_req *subreq)
- {
-     struct nss_cmd_ctx *cmd_ctx;
-     errno_t ret;
-@@ -1040,8 +1042,8 @@ static errno_t nss_cmd_initgroups_ex(struct cli_ctx *cli_ctx)
- 
- static errno_t nss_cmd_setnetgrent(struct cli_ctx *cli_ctx)
- {
--    return nss_setnetgrent(cli_ctx, CACHE_REQ_NETGROUP_BY_NAME,
--                           nss_protocol_fill_setnetgrent);
-+    return sss_nss_setnetgrent(cli_ctx, CACHE_REQ_NETGROUP_BY_NAME,
-+                               nss_protocol_fill_setnetgrent);
- }
- 
- static errno_t nss_cmd_getnetgrent(struct cli_ctx *cli_ctx)
diff --git a/sys-auth/sssd/files/sssd-curl-macros.patch b/sys-auth/sssd/files/sssd-curl-macros.patch
deleted file mode 100644
index 91e71e837875..000000000000
--- a/sys-auth/sssd/files/sssd-curl-macros.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From d3cdf9cbfbace4874c6e5c96f1e5ef5b342c813e Mon Sep 17 00:00:00 2001
-From: Mikle Kolyada <zlogene@gentoo.org>
-Date: Sun, 16 Dec 2018 20:42:39 +0300
-Subject: [PATCH] tev_curl.c: remove case duplication
-
-CURLE_SSL_CACERT and CURLE_PEER_FAILED_VERIFICATION macros are provided
-by net-misc/curl-7.62.0 and older
----
- tev_curl.c | 3 ---
- 1 file changed, 3 deletions(-)
-
-diff --git a/tev_curl.c b/tev_curl.c
-index 6a7a580..ce6fdba 100644
---- a/src/util/tev_curl.c
-+++ b/src/util/tev_curl.c
-@@ -97,7 +97,6 @@ static errno_t curl_code2errno(CURLcode crv)
-         return ETIMEDOUT;
-     case CURLE_SSL_ISSUER_ERROR:
-     case CURLE_SSL_CACERT_BADFILE:
--    case CURLE_SSL_CACERT:
-     case CURLE_SSL_CERTPROBLEM:
-         return ERR_INVALID_CERT;
- 
-@@ -110,8 +109,6 @@ static errno_t curl_code2errno(CURLcode crv)
-     case CURLE_SSL_ENGINE_NOTFOUND:
-     case CURLE_SSL_CONNECT_ERROR:
-         return ERR_SSL_FAILURE;
--    case CURLE_PEER_FAILED_VERIFICATION:
--        return ERR_UNABLE_TO_VERIFY_PEER;
-     case CURLE_COULDNT_RESOLVE_HOST:
-         return ERR_UNABLE_TO_RESOLVE_HOST;
-     default:
--- 
-2.19.2
\ No newline at end of file
diff --git a/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch b/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
deleted file mode 100644
index 87db45fd24bb..000000000000
--- a/sys-auth/sssd/files/sssd-fix-CVE-2019-3811.patch
+++ /dev/null
@@ -1,96 +0,0 @@
-From 28792523a01a7d21bcc8931794164f253e691a68 Mon Sep 17 00:00:00 2001
-From: Tomas Halman <thalman@redhat.com>
-Date: Mon, 3 Dec 2018 14:11:31 +0100
-Subject: [PATCH] nss: sssd returns '/' for emtpy home directories
-
-For empty home directory in passwd file sssd returns "/". Sssd
-should respect system behaviour and return the same as nsswitch
-"files" module - return empty string.
-
-Resolves:
-https://pagure.io/SSSD/sssd/issue/3901
-
-Reviewed-by: Simo Sorce <simo@redhat.com>
-Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
-(cherry picked from commit 90f32399b4100ce39cf665649fde82d215e5eb49)
----
- src/confdb/confdb.c                      |  9 +++++++++
- src/man/include/ad_modified_defaults.xml | 19 +++++++++++++++++++
- src/responder/nss/nss_protocol_pwent.c   |  2 +-
- src/tests/intg/test_files_provider.py    |  2 +-
- 4 files changed, 30 insertions(+), 2 deletions(-)
-
-diff --git a/src/confdb/confdb.c b/src/confdb/confdb.c
-index a3eb9c66d9..17bb4f8274 100644
---- a/src/confdb/confdb.c
-+++ b/src/confdb/confdb.c
-@@ -1301,6 +1301,15 @@ static int confdb_get_domain_internal(struct confdb_ctx *cdb,
-             ret = ENOMEM;
-             goto done;
-         }
-+    } else {
-+        if (strcasecmp(domain->provider, "ad") == 0) {
-+            /* ad provider default */
-+            domain->fallback_homedir = talloc_strdup(domain, "/home/%d/%u");
-+            if (!domain->fallback_homedir) {
-+                ret = ENOMEM;
-+                goto done;
-+            }
-+        }
-     }
- 
-     tmp = ldb_msg_find_attr_as_string(res->msgs[0],
-diff --git a/src/man/include/ad_modified_defaults.xml b/src/man/include/ad_modified_defaults.xml
-index 818a2bf787..425b7e8ee0 100644
---- a/src/man/include/ad_modified_defaults.xml
-+++ b/src/man/include/ad_modified_defaults.xml
-@@ -76,4 +76,23 @@
-             </listitem>
-         </itemizedlist>
-     </refsect2>
-+    <refsect2 id='nss_modifications'>
-+        <title>NSS configuration</title>
-+        <itemizedlist>
-+            <listitem>
-+                <para>
-+                    fallback_homedir = /home/%d/%u
-+                </para>
-+                <para>
-+                    The AD provider automatically sets
-+                    "fallback_homedir = /home/%d/%u" to provide personal
-+                    home directories for users without the homeDirectory
-+                    attribute. If your AD Domain is properly
-+                    populated with Posix attributes, and you want to avoid
-+                    this fallback behavior, you can explicitly
-+                    set "fallback_homedir = %o".
-+                </para>
-+            </listitem>
-+        </itemizedlist>
-+    </refsect2>
- </refsect1>
-diff --git a/src/responder/nss/nss_protocol_pwent.c b/src/responder/nss/nss_protocol_pwent.c
-index af9e74fc86..86fa4ec465 100644
---- a/src/responder/nss/nss_protocol_pwent.c
-+++ b/src/responder/nss/nss_protocol_pwent.c
-@@ -118,7 +118,7 @@ nss_get_homedir(TALLOC_CTX *mem_ctx,
- 
-     homedir = nss_get_homedir_override(mem_ctx, msg, nss_ctx, domain, &hd_ctx);
-     if (homedir == NULL) {
--        return "/";
-+        return "";
-     }
- 
-     return homedir;
-diff --git a/src/tests/intg/test_files_provider.py b/src/tests/intg/test_files_provider.py
-index ead1cc4c34..4761f1bd15 100644
---- a/src/tests/intg/test_files_provider.py
-+++ b/src/tests/intg/test_files_provider.py
-@@ -678,7 +678,7 @@ def test_user_no_dir(setup_pw_with_canary, files_domain_only):
-     Test that resolving a user without a homedir defined works and returns
-     a fallback value
-     """
--    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', '/'))
-+    check_user(incomplete_user_setup(setup_pw_with_canary, 'dir', ''))
- 
- 
- def test_user_no_gecos(setup_pw_with_canary, files_domain_only):
diff --git a/sys-auth/sssd/sssd-1.16.3-r3.ebuild b/sys-auth/sssd/sssd-1.16.3-r3.ebuild
deleted file mode 100644
index a887a0cb720e..000000000000
--- a/sys-auth/sssd/sssd-1.16.3-r3.ebuild
+++ /dev/null
@@ -1,233 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
-
-DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
-HOMEPAGE="https://pagure.io/SSSD/sssd"
-SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
-KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86"
-
-LICENSE="GPL-3"
-SLOT="0"
-IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
-RESTRICT="!test? ( test )"
-
-COMMON_DEP="
-	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/popt-1.16
-	dev-libs/glib:2
-	>=dev-libs/ding-libs-0.2
-	>=sys-libs/talloc-2.0.7
-	>=sys-libs/tdb-1.2.9
-	>=sys-libs/tevent-0.9.16
-	>=sys-libs/ldb-1.1.17-r1:=
-	>=net-nds/openldap-2.4.30[sasl]
-	net-libs/http-parser
-	>=dev-libs/libpcre-8.30
-	>=app-crypt/mit-krb5-1.10.3
-	dev-libs/jansson
-	net-misc/curl
-	locator? (
-		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
-		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
-	)
-	>=sys-apps/keyutils-1.5:=
-	>=net-dns/c-ares-1.7.4
-	>=dev-libs/nss-3.12.9
-	selinux? (
-		>=sys-libs/libselinux-2.1.9
-		>=sys-libs/libsemanage-2.1
-	)
-	>=net-dns/bind-tools-9.9[gssapi]
-	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
-	>=sys-apps/dbus-1.6
-	acl? ( net-fs/cifs-utils[acl] )
-	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
-	nls? ( >=sys-devel/gettext-0.18 )
-	virtual/libintl
-	netlink? ( dev-libs/libnl:3 )
-	samba? ( >=net-fs/samba-4.5 )
-	"
-
-RDEPEND="${COMMON_DEP}
-	>=sys-libs/glibc-2.17[nscd]
-	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
-	"
-DEPEND="${COMMON_DEP}
-	test? ( dev-libs/check )
-	manpages? (
-		>=dev-libs/libxslt-1.1.26
-		app-text/docbook-xml-dtd:4.4
-		)"
-
-CONFIG_CHECK="~KEYS"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/ipa_hbac.h
-	/usr/include/sss_idmap.h
-	/usr/include/sss_nss_idmap.h
-	/usr/include/wbclient_sssd.h
-	# --with-ifp
-	/usr/include/sss_sifp.h
-	/usr/include/sss_sifp_dbus.h
-	# from 1.15.3
-	/usr/include/sss_certmap.h
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-}
-
-src_prepare() {
-	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
-		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
-
-	eapply "${FILESDIR}"/${PN}-curl-macros.patch
-	eapply "${FILESDIR}"/${PN}-fix-CVE-2019-3811.patch
-
-	default
-	eautoreconf
-	multilib_copy_sources
-}
-
-src_configure() {
-	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	# set initscript to sysv because the systemd option needs systemd to
-	# be installed. We provide our own systemd file anyway.
-	local myconf=()
-	#Work around linker dependency problem.
-	append-ldflags "-Wl,--allow-shlib-undefined"
-
-	myconf+=(
-		--localstatedir="${EPREFIX}"/var
-		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
-		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
-		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
-		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
-		--with-os=gentoo
-		--with-nscd
-		--with-unicode-lib="glib2"
-		--disable-rpath
-		--sbindir=/usr/sbin
-		--without-kcm
-		$(use_with samba libwbclient)
-		--with-secrets
-		$(multilib_native_use_with samba)
-		$(multilib_native_use_enable acl cifs-idmap-plugin)
-		$(multilib_native_use_with selinux)
-		$(multilib_native_use_with selinux semanage)
-		$(use_enable locator krb5-locator-plugin)
-		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
-		$(use_enable nls )
-		$(multilib_native_use_with netlink libnl)
-		$(multilib_native_use_with manpages)
-		$(multilib_native_use_with sudo)
-		$(multilib_native_use_with autofs)
-		$(multilib_native_use_with ssh)
-		--with-crypto="nss"
-		--with-initscript="sysv"
-		--without-python2-bindings
-		--without-python3-bindings
-
-		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
-	)
-
-	if ! multilib_is_native_abi; then
-		# work-around all the libraries that are used for CLI and server
-		myconf+=(
-			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
-			# ldb headers are fine since native needs it
-			# ldb lib fails... but it does not seem to bother
-			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
-			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
-
-			# use native include path for dbus (needed for build)
-			DBUS_CFLAGS="${native_dbus_cflags}"
-
-			# non-pkgconfig checks
-			ac_cv_lib_ldap_ldap_search=yes
-			--without-secrets
-			--without-libwbclient
-			--without-kcm
-			--with-crypto=""
-		)
-
-		use locator || myconf+=(
-				KRB5_CONFIG=/bin/true
-		)
-	fi
-
-	econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi; then
-		default
-	else
-		emake libnss_sss.la pam_sss.la
-		use locator && emake sssd_krb5_locator_plugin.la
-	fi
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
-	else
-		# easier than playing with automake...
-		dopammod .libs/pam_sss.so
-
-		into /
-		dolib.so .libs/libnss_sss.so*
-
-		if use locator; then
-			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
-			doexe .libs/sssd_krb5_locator_plugin.so
-		fi
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	insinto /etc/sssd
-	insopts -m600
-	doins "${S}"/src/examples/sssd-example.conf
-
-	insinto /etc/logrotate.d
-	insopts -m644
-	newins "${S}"/src/examples/logrotate sssd
-
-	newconfd "${FILESDIR}"/sssd.conf sssd
-	newinitd "${FILESDIR}"/sssd sssd
-
-	keepdir /var/lib/sss/db
-	keepdir /var/lib/sss/deskprofile
-	keepdir /var/lib/sss/gpo_cache
-	keepdir /var/lib/sss/keytabs
-	keepdir /var/lib/sss/mc
-	keepdir /var/lib/sss/pipes/private
-	keepdir /var/lib/sss/pubconf/krb5.include.d
-	keepdir /var/lib/sss/secrets
-	keepdir /var/log/sssd
-
-	systemd_dounit "${FILESDIR}/${PN}.service"
-}
-
-multilib_src_test() {
-	default
-}
-
-pkg_postinst() {
-	elog "You must set up sssd.conf (default installed into /etc/sssd)"
-	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/index.html#implemented-in-1-16-x"
-}
diff --git a/sys-auth/sssd/sssd-2.1.0-r1.ebuild b/sys-auth/sssd/sssd-2.1.0-r1.ebuild
deleted file mode 100644
index 98af8535a88f..000000000000
--- a/sys-auth/sssd/sssd-2.1.0-r1.ebuild
+++ /dev/null
@@ -1,230 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
-
-DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
-HOMEPAGE="https://pagure.io/SSSD/sssd"
-SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
-
-LICENSE="GPL-3"
-SLOT="0"
-IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
-RESTRICT="!test? ( test )"
-
-COMMON_DEP="
-	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/popt-1.16
-	dev-libs/glib:2
-	>=dev-libs/ding-libs-0.2
-	>=sys-libs/talloc-2.0.7
-	>=sys-libs/tdb-1.2.9
-	>=sys-libs/tevent-0.9.16
-	>=sys-libs/ldb-1.1.17-r1:=
-	>=net-nds/openldap-2.4.30[sasl]
-	net-libs/http-parser
-	>=dev-libs/libpcre-8.30
-	>=app-crypt/mit-krb5-1.10.3
-	dev-libs/jansson
-	net-misc/curl
-	locator? (
-		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
-		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
-	)
-	>=sys-apps/keyutils-1.5:=
-	>=net-dns/c-ares-1.7.4
-	>=dev-libs/nss-3.12.9
-	selinux? (
-		>=sys-libs/libselinux-2.1.9
-		>=sys-libs/libsemanage-2.1
-	)
-	>=net-dns/bind-tools-9.9[gssapi]
-	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
-	>=sys-apps/dbus-1.6
-	acl? ( net-fs/cifs-utils[acl] )
-	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
-	nls? ( >=sys-devel/gettext-0.18 )
-	virtual/libintl
-	netlink? ( dev-libs/libnl:3 )
-	samba? ( >=net-fs/samba-4.10.2[winbind] )
-	"
-
-RDEPEND="${COMMON_DEP}
-	>=sys-libs/glibc-2.17[nscd]
-	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
-	"
-DEPEND="${COMMON_DEP}
-	test? ( dev-libs/check )
-	manpages? (
-		>=dev-libs/libxslt-1.1.26
-		app-text/docbook-xml-dtd:4.4
-		)"
-
-CONFIG_CHECK="~KEYS"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/ipa_hbac.h
-	/usr/include/sss_idmap.h
-	/usr/include/sss_nss_idmap.h
-	/usr/include/wbclient_sssd.h
-	# --with-ifp
-	/usr/include/sss_sifp.h
-	/usr/include/sss_sifp_dbus.h
-	# from 1.15.3
-	/usr/include/sss_certmap.h
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-}
-
-src_prepare() {
-	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
-		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
-
-	default
-	eautoreconf
-	multilib_copy_sources
-}
-
-src_configure() {
-	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	# set initscript to sysv because the systemd option needs systemd to
-	# be installed. We provide our own systemd file anyway.
-	local myconf=()
-	#Work around linker dependency problem.
-	append-ldflags "-Wl,--allow-shlib-undefined"
-
-	myconf+=(
-		--localstatedir="${EPREFIX}"/var
-		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
-		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
-		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
-		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
-		--with-os=gentoo
-		--with-nscd
-		--with-unicode-lib="glib2"
-		--disable-rpath
-		--sbindir=/usr/sbin
-		--without-kcm
-		$(use_with samba libwbclient)
-		--with-secrets
-		$(multilib_native_use_with samba)
-		$(multilib_native_use_enable acl cifs-idmap-plugin)
-		$(multilib_native_use_with selinux)
-		$(multilib_native_use_with selinux semanage)
-		$(use_enable locator krb5-locator-plugin)
-		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
-		$(use_enable nls )
-		$(multilib_native_use_with netlink libnl)
-		$(multilib_native_use_with manpages)
-		$(multilib_native_use_with sudo)
-		$(multilib_native_use_with autofs)
-		$(multilib_native_use_with ssh)
-		--with-crypto="nss"
-		--with-initscript="sysv"
-		--without-python2-bindings
-		--without-python3-bindings
-
-		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
-	)
-
-	if ! multilib_is_native_abi; then
-		# work-around all the libraries that are used for CLI and server
-		myconf+=(
-			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
-			# ldb headers are fine since native needs it
-			# ldb lib fails... but it does not seem to bother
-			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
-			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
-
-			# use native include path for dbus (needed for build)
-			DBUS_CFLAGS="${native_dbus_cflags}"
-
-			# non-pkgconfig checks
-			ac_cv_lib_ldap_ldap_search=yes
-			--without-secrets
-			--without-libwbclient
-			--without-kcm
-			--with-crypto=""
-		)
-
-		use locator || myconf+=(
-				KRB5_CONFIG=/bin/true
-		)
-	fi
-
-	econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi; then
-		default
-	else
-		emake libnss_sss.la pam_sss.la
-		use locator && emake sssd_krb5_locator_plugin.la
-	fi
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
-	else
-		# easier than playing with automake...
-		dopammod .libs/pam_sss.so
-
-		into /
-		dolib.so .libs/libnss_sss.so*
-
-		if use locator; then
-			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
-			doexe .libs/sssd_krb5_locator_plugin.so
-		fi
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	insinto /etc/sssd
-	insopts -m600
-	doins "${S}"/src/examples/sssd-example.conf
-
-	insinto /etc/logrotate.d
-	insopts -m644
-	newins "${S}"/src/examples/logrotate sssd
-
-	newconfd "${FILESDIR}"/sssd.conf sssd
-	newinitd "${FILESDIR}"/sssd sssd
-
-	keepdir /var/lib/sss/db
-	keepdir /var/lib/sss/deskprofile
-	keepdir /var/lib/sss/gpo_cache
-	keepdir /var/lib/sss/keytabs
-	keepdir /var/lib/sss/mc
-	keepdir /var/lib/sss/pipes/private
-	keepdir /var/lib/sss/pubconf/krb5.include.d
-	keepdir /var/lib/sss/secrets
-	keepdir /var/log/sssd
-
-	systemd_dounit "${FILESDIR}/${PN}.service"
-}
-
-multilib_src_test() {
-	default
-}
-
-pkg_postinst() {
-	elog "You must set up sssd.conf (default installed into /etc/sssd)"
-	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
-}
diff --git a/sys-auth/sssd/sssd-2.2.0-r1.ebuild b/sys-auth/sssd/sssd-2.2.0-r1.ebuild
index 98af8535a88f..7b60f06f16c6 100644
--- a/sys-auth/sssd/sssd-2.2.0-r1.ebuild
+++ b/sys-auth/sssd/sssd-2.2.0-r1.ebuild
@@ -8,7 +8,7 @@ inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain
 DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
 HOMEPAGE="https://pagure.io/SSSD/sssd"
 SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86"
 
 LICENSE="GPL-3"
 SLOT="0"
diff --git a/sys-auth/sssd/sssd-2.2.2.ebuild b/sys-auth/sssd/sssd-2.2.2.ebuild
deleted file mode 100644
index 98af8535a88f..000000000000
--- a/sys-auth/sssd/sssd-2.2.2.ebuild
+++ /dev/null
@@ -1,230 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
-
-DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
-HOMEPAGE="https://pagure.io/SSSD/sssd"
-SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
-
-LICENSE="GPL-3"
-SLOT="0"
-IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
-RESTRICT="!test? ( test )"
-
-COMMON_DEP="
-	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/popt-1.16
-	dev-libs/glib:2
-	>=dev-libs/ding-libs-0.2
-	>=sys-libs/talloc-2.0.7
-	>=sys-libs/tdb-1.2.9
-	>=sys-libs/tevent-0.9.16
-	>=sys-libs/ldb-1.1.17-r1:=
-	>=net-nds/openldap-2.4.30[sasl]
-	net-libs/http-parser
-	>=dev-libs/libpcre-8.30
-	>=app-crypt/mit-krb5-1.10.3
-	dev-libs/jansson
-	net-misc/curl
-	locator? (
-		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
-		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
-	)
-	>=sys-apps/keyutils-1.5:=
-	>=net-dns/c-ares-1.7.4
-	>=dev-libs/nss-3.12.9
-	selinux? (
-		>=sys-libs/libselinux-2.1.9
-		>=sys-libs/libsemanage-2.1
-	)
-	>=net-dns/bind-tools-9.9[gssapi]
-	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
-	>=sys-apps/dbus-1.6
-	acl? ( net-fs/cifs-utils[acl] )
-	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
-	nls? ( >=sys-devel/gettext-0.18 )
-	virtual/libintl
-	netlink? ( dev-libs/libnl:3 )
-	samba? ( >=net-fs/samba-4.10.2[winbind] )
-	"
-
-RDEPEND="${COMMON_DEP}
-	>=sys-libs/glibc-2.17[nscd]
-	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
-	"
-DEPEND="${COMMON_DEP}
-	test? ( dev-libs/check )
-	manpages? (
-		>=dev-libs/libxslt-1.1.26
-		app-text/docbook-xml-dtd:4.4
-		)"
-
-CONFIG_CHECK="~KEYS"
-
-MULTILIB_WRAPPED_HEADERS=(
-	/usr/include/ipa_hbac.h
-	/usr/include/sss_idmap.h
-	/usr/include/sss_nss_idmap.h
-	/usr/include/wbclient_sssd.h
-	# --with-ifp
-	/usr/include/sss_sifp.h
-	/usr/include/sss_sifp_dbus.h
-	# from 1.15.3
-	/usr/include/sss_certmap.h
-)
-
-pkg_setup() {
-	linux-info_pkg_setup
-}
-
-src_prepare() {
-	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
-		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
-
-	default
-	eautoreconf
-	multilib_copy_sources
-}
-
-src_configure() {
-	local native_dbus_cflags=$($(tc-getPKG_CONFIG) --cflags dbus-1)
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	# set initscript to sysv because the systemd option needs systemd to
-	# be installed. We provide our own systemd file anyway.
-	local myconf=()
-	#Work around linker dependency problem.
-	append-ldflags "-Wl,--allow-shlib-undefined"
-
-	myconf+=(
-		--localstatedir="${EPREFIX}"/var
-		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
-		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
-		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
-		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
-		--with-os=gentoo
-		--with-nscd
-		--with-unicode-lib="glib2"
-		--disable-rpath
-		--sbindir=/usr/sbin
-		--without-kcm
-		$(use_with samba libwbclient)
-		--with-secrets
-		$(multilib_native_use_with samba)
-		$(multilib_native_use_enable acl cifs-idmap-plugin)
-		$(multilib_native_use_with selinux)
-		$(multilib_native_use_with selinux semanage)
-		$(use_enable locator krb5-locator-plugin)
-		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
-		$(use_enable nls )
-		$(multilib_native_use_with netlink libnl)
-		$(multilib_native_use_with manpages)
-		$(multilib_native_use_with sudo)
-		$(multilib_native_use_with autofs)
-		$(multilib_native_use_with ssh)
-		--with-crypto="nss"
-		--with-initscript="sysv"
-		--without-python2-bindings
-		--without-python3-bindings
-
-		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
-	)
-
-	if ! multilib_is_native_abi; then
-		# work-around all the libraries that are used for CLI and server
-		myconf+=(
-			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
-			# ldb headers are fine since native needs it
-			# ldb lib fails... but it does not seem to bother
-			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
-			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
-
-			# use native include path for dbus (needed for build)
-			DBUS_CFLAGS="${native_dbus_cflags}"
-
-			# non-pkgconfig checks
-			ac_cv_lib_ldap_ldap_search=yes
-			--without-secrets
-			--without-libwbclient
-			--without-kcm
-			--with-crypto=""
-		)
-
-		use locator || myconf+=(
-				KRB5_CONFIG=/bin/true
-		)
-	fi
-
-	econf "${myconf[@]}"
-}
-
-multilib_src_compile() {
-	if multilib_is_native_abi; then
-		default
-	else
-		emake libnss_sss.la pam_sss.la
-		use locator && emake sssd_krb5_locator_plugin.la
-	fi
-}
-
-multilib_src_install() {
-	if multilib_is_native_abi; then
-		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
-	else
-		# easier than playing with automake...
-		dopammod .libs/pam_sss.so
-
-		into /
-		dolib.so .libs/libnss_sss.so*
-
-		if use locator; then
-			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
-			doexe .libs/sssd_krb5_locator_plugin.so
-		fi
-	fi
-}
-
-multilib_src_install_all() {
-	einstalldocs
-	find "${ED}" -type f -name '*.la' -delete || die
-
-	insinto /etc/sssd
-	insopts -m600
-	doins "${S}"/src/examples/sssd-example.conf
-
-	insinto /etc/logrotate.d
-	insopts -m644
-	newins "${S}"/src/examples/logrotate sssd
-
-	newconfd "${FILESDIR}"/sssd.conf sssd
-	newinitd "${FILESDIR}"/sssd sssd
-
-	keepdir /var/lib/sss/db
-	keepdir /var/lib/sss/deskprofile
-	keepdir /var/lib/sss/gpo_cache
-	keepdir /var/lib/sss/keytabs
-	keepdir /var/lib/sss/mc
-	keepdir /var/lib/sss/pipes/private
-	keepdir /var/lib/sss/pubconf/krb5.include.d
-	keepdir /var/lib/sss/secrets
-	keepdir /var/log/sssd
-
-	systemd_dounit "${FILESDIR}/${PN}.service"
-}
-
-multilib_src_test() {
-	default
-}
-
-pkg_postinst() {
-	elog "You must set up sssd.conf (default installed into /etc/sssd)"
-	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
-}
diff --git a/sys-auth/sssd/sssd-2.3.1-r1.ebuild b/sys-auth/sssd/sssd-2.3.1-r2.ebuild
index 72dab04b2dc2..6d23123d5e87 100644
--- a/sys-auth/sssd/sssd-2.3.1-r1.ebuild
+++ b/sys-auth/sssd/sssd-2.3.1-r2.ebuild
@@ -10,7 +10,7 @@ inherit autotools flag-o-matic linux-info multilib-minimal python-single-r1 pam
 DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
 HOMEPAGE="https://github.com/SSSD/sssd"
 SRC_URI="https://github.com/SSSD/sssd/releases/download/${PN}-${PV//./_}/${P}.tar.gz"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc x86"
 
 LICENSE="GPL-3"
 SLOT="0"
@@ -151,6 +151,7 @@ multilib_src_configure() {
 		--disable-rpath
 		--sbindir=/usr/sbin
 		--with-crypto="libcrypto"
+		--enable-local-provider
 		$(multilib_native_use_with systemd kcm)
 		$(multilib_native_use_with systemd secrets)
 		$(use_with samba)
@@ -170,7 +171,6 @@ multilib_src_configure() {
 		$(use_enable valgrind)
 		--without-python2-bindings
 		$(multilib_native_use_with python python3-bindings)
-
 	)
 
 	# Annoyingly configure requires that you pick systemd XOR sysv
diff --git a/sys-auth/sssd/sssd-2.2.3.ebuild b/sys-auth/sssd/sssd-2.4.0.ebuild
index 044a58e86151..bcbe35cbeb98 100644
--- a/sys-auth/sssd/sssd-2.2.3.ebuild
+++ b/sys-auth/sssd/sssd-2.4.0.ebuild
@@ -3,65 +3,91 @@
 
 EAPI=7
 
-inherit autotools flag-o-matic linux-info multilib-minimal pam systemd toolchain-funcs
+PYTHON_COMPAT=( python3_{7,8,9} )
+
+inherit autotools flag-o-matic linux-info multilib-minimal python-single-r1 pam systemd toolchain-funcs
 
 DESCRIPTION="System Security Services Daemon provides access to identity and authentication"
-HOMEPAGE="https://pagure.io/SSSD/sssd"
-SRC_URI="http://releases.pagure.org/SSSD/${PN}/${P}.tar.gz"
+HOMEPAGE="https://github.com/SSSD/sssd"
+SRC_URI="https://github.com/SSSD/sssd/releases/download/${PN}-${PV//./_}/${P}.tar.gz"
 KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
 
 LICENSE="GPL-3"
 SLOT="0"
-IUSE="acl autofs +locator +netlink nfsv4 nls +manpages samba selinux sudo ssh test"
+IUSE="acl doc +locator +netlink nfsv4 nls +man pac python samba selinux sudo systemd test valgrind"
 RESTRICT="!test? ( test )"
 
-COMMON_DEP="
-	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
-	>=dev-libs/popt-1.16
-	dev-libs/glib:2
+REQUIRED_USE="pac? ( samba )
+	python? ( ${PYTHON_REQUIRED_USE} )"
+
+DEPEND="
+	>=app-crypt/mit-krb5-1.10.3
+	app-crypt/p11-kit
 	>=dev-libs/ding-libs-0.2
+	dev-libs/glib:2
+	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
+	>=dev-libs/libpcre-8.30:=
+	>=dev-libs/popt-1.16
+	>=dev-libs/openssl-1.0.2:0=
+	>=net-dns/bind-tools-9.9[gssapi]
+	>=net-dns/c-ares-1.7.4
+	>=net-nds/openldap-2.4.30[sasl]
+	>=sys-apps/dbus-1.6
+	>=sys-apps/keyutils-1.5:=
+	>=sys-libs/pam-0-r1[${MULTILIB_USEDEP}]
 	>=sys-libs/talloc-2.0.7
 	>=sys-libs/tdb-1.2.9
 	>=sys-libs/tevent-0.9.16
 	>=sys-libs/ldb-1.1.17-r1:=
-	>=net-nds/openldap-2.4.30[sasl]
-	net-libs/http-parser
-	>=dev-libs/libpcre-8.30
-	>=app-crypt/mit-krb5-1.10.3
-	dev-libs/jansson
-	net-misc/curl
+	virtual/libintl
 	locator? (
 		>=app-crypt/mit-krb5-1.12.2[${MULTILIB_USEDEP}]
 		>=net-dns/c-ares-1.10.0-r1[${MULTILIB_USEDEP}]
 	)
-	>=sys-apps/keyutils-1.5:=
-	>=net-dns/c-ares-1.7.4
-	>=dev-libs/nss-3.12.9
-	selinux? (
-		>=sys-libs/libselinux-2.1.9
-		>=sys-libs/libsemanage-2.1
-	)
-	>=net-dns/bind-tools-9.9[gssapi]
-	>=dev-libs/cyrus-sasl-2.1.25-r3[kerberos]
-	>=sys-apps/dbus-1.6
 	acl? ( net-fs/cifs-utils[acl] )
+	netlink? ( dev-libs/libnl:3 )
 	nfsv4? ( || ( >=net-fs/nfs-utils-2.3.1-r2 net-libs/libnfsidmap ) )
 	nls? ( >=sys-devel/gettext-0.18 )
-	virtual/libintl
-	netlink? ( dev-libs/libnl:3 )
+	pac? (
+		app-crypt/mit-krb5[${MULTILIB_USEDEP}]
+		net-fs/samba
+	)
+	python? ( ${PYTHON_DEPS} )
 	samba? ( >=net-fs/samba-4.10.2[winbind] )
+	selinux? (
+		>=sys-libs/libselinux-2.1.9
+		>=sys-libs/libsemanage-2.1
+	)
+	systemd? (
+		dev-libs/jansson:0=
+		net-libs/http-parser:0=
+		net-misc/curl:0=
+	)
 	"
 
-RDEPEND="${COMMON_DEP}
+RDEPEND="${DEPEND}
 	>=sys-libs/glibc-2.17[nscd]
 	selinux? ( >=sec-policy/selinux-sssd-2.20120725-r9 )
 	"
-DEPEND="${COMMON_DEP}
-	test? ( dev-libs/check )
-	manpages? (
-		>=dev-libs/libxslt-1.1.26
+BDEPEND="${DEPEND}
+	>=sys-devel/autoconf-2.69-r5
+	doc? ( app-doc/doxygen )
+	test? (
+		dev-libs/check
+		dev-libs/softhsm:2
+		dev-util/cmocka
+		net-libs/gnutls[pkcs11,tools]
+		sys-libs/libfaketime
+		sys-libs/nss_wrapper
+		sys-libs/pam_wrapper
+		sys-libs/uid_wrapper
+		valgrind? ( dev-util/valgrind )
+	)
+	man? (
 		app-text/docbook-xml-dtd:4.4
-		)"
+		>=dev-libs/libxslt-1.1.26
+		nls? ( app-text/po4a )
+	)"
 
 CONFIG_CHECK="~KEYS"
 
@@ -69,7 +95,6 @@ MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/ipa_hbac.h
 	/usr/include/sss_idmap.h
 	/usr/include/sss_nss_idmap.h
-	/usr/include/wbclient_sssd.h
 	# --with-ifp
 	/usr/include/sss_sifp.h
 	/usr/include/sss_sifp_dbus.h
@@ -77,21 +102,20 @@ MULTILIB_WRAPPED_HEADERS=(
 	/usr/include/sss_certmap.h
 )
 
-PATCHES=(
-	"${FILESDIR}"/${P}-glibc-2.32-compat.patch
-)
-
 pkg_setup() {
 	linux-info_pkg_setup
 }
 
 src_prepare() {
-	sed -i 's:#!/sbin/runscript:#!/sbin/openrc-run:' \
-		"${S}"/src/sysv/gentoo/sssd.in || die "sed sssd.in"
+	sed -i 's:/var/run:/run:' \
+		"${S}"/src/examples/logrotate || die
 
 	default
 	eautoreconf
 	multilib_copy_sources
+	if use python && multilib_is_native_abi; then
+		python_setup
+	fi
 }
 
 src_configure() {
@@ -101,54 +125,68 @@ src_configure() {
 }
 
 multilib_src_configure() {
-	# set initscript to sysv because the systemd option needs systemd to
-	# be installed. We provide our own systemd file anyway.
 	local myconf=()
-	#Work around linker dependency problem.
-	append-ldflags "-Wl,--allow-shlib-undefined"
 
 	myconf+=(
 		--localstatedir="${EPREFIX}"/var
-		--enable-nsslibdir="${EPREFIX}"/$(get_libdir)
+		--runstatedir="${EPREFIX}"/run
+		--with-pid-path="${EPREFIX}"/run
 		--with-plugin-path="${EPREFIX}"/usr/$(get_libdir)/sssd
 		--enable-pammoddir="${EPREFIX}"/$(getpam_mod_dir)
 		--with-ldb-lib-dir="${EPREFIX}"/usr/$(get_libdir)/samba/ldb
+		--with-db-path="${EPREFIX}"/var/lib/sss/db
+		--with-gpo-cache-path="${EPREFIX}"/var/lib/sss/gpo_cache
+		--with-pubconf-path="${EPREFIX}"/var/lib/sss/pubconf
+		--with-pipe-path="${EPREFIX}"/var/lib/sss/pipes
+		--with-mcache-path="${EPREFIX}"/var/lib/sss/mc
+		--with-secrets-db-path="${EPREFIX}"/var/lib/sss/secrets
+		--with-log-path="${EPREFIX}"/var/log/sssd
 		--with-os=gentoo
-		--with-nscd
+		--with-nscd="${EPREFIX}"/usr/sbin/nscd
 		--with-unicode-lib="glib2"
 		--disable-rpath
 		--sbindir=/usr/sbin
-		--without-kcm
-		$(use_with samba libwbclient)
-		--with-secrets
-		$(multilib_native_use_with samba)
+		--enable-local-provider
+		$(multilib_native_use_with systemd kcm)
+		$(multilib_native_use_with systemd secrets)
+		$(use_with samba)
+		--with-smb-idmap-interface-version=6
 		$(multilib_native_use_enable acl cifs-idmap-plugin)
 		$(multilib_native_use_with selinux)
 		$(multilib_native_use_with selinux semanage)
 		$(use_enable locator krb5-locator-plugin)
+		$(use_enable pac pac-responder)
 		$(multilib_native_use_with nfsv4 nfsv4-idmapd-plugin)
-		$(use_enable nls )
+		$(use_enable nls)
 		$(multilib_native_use_with netlink libnl)
-		$(multilib_native_use_with manpages)
+		$(multilib_native_use_with man manpages)
 		$(multilib_native_use_with sudo)
-		$(multilib_native_use_with autofs)
-		$(multilib_native_use_with ssh)
-		--with-crypto="nss"
-		--with-initscript="sysv"
+		$(multilib_native_with autofs)
+		$(multilib_native_with ssh)
+		$(use_enable valgrind)
 		--without-python2-bindings
-		--without-python3-bindings
-
-		KRB5_CONFIG=/usr/bin/${CHOST}-krb5-config
+		$(multilib_native_use_with python python3-bindings)
 	)
 
+	# Annoyingly configure requires that you pick systemd XOR sysv
+	if use systemd; then
+		myconf+=(
+			--with-initscript="systemd"
+			--with-systemdunitdir=$(systemd_get_systemunitdir)
+		)
+	else
+		myconf+=(--with-initscript="sysv")
+	fi
+
 	if ! multilib_is_native_abi; then
 		# work-around all the libraries that are used for CLI and server
 		myconf+=(
 			{POPT,TALLOC,TDB,TEVENT,LDB}_{CFLAGS,LIBS}=' '
 			# ldb headers are fine since native needs it
 			# ldb lib fails... but it does not seem to bother
-			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1}}_{CFLAGS,LIBS}=' '
-			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO}_{CFLAGS,LIBS}=' '
+			{DHASH,COLLECTION,INI_CONFIG_V{0,1,1_1,1_3}}_{CFLAGS,LIBS}=' '
+			{PCRE,CARES,SYSTEMD_LOGIN,SASL,GLIB2,DBUS,CRYPTO,P11_KIT}_{CFLAGS,LIBS}=' '
+			{NDR_NBT,SMBCLIENT,NDR_KRB5PAC}_{CFLAGS,LIBS}=' '
 
 			# use native include path for dbus (needed for build)
 			DBUS_CFLAGS="${native_dbus_cflags}"
@@ -156,13 +194,7 @@ multilib_src_configure() {
 			# non-pkgconfig checks
 			ac_cv_lib_ldap_ldap_search=yes
 			--without-secrets
-			--without-libwbclient
 			--without-kcm
-			--with-crypto=""
-		)
-
-		use locator || myconf+=(
-				KRB5_CONFIG=/bin/true
 		)
 	fi
 
@@ -172,15 +204,25 @@ multilib_src_configure() {
 multilib_src_compile() {
 	if multilib_is_native_abi; then
 		default
+		use doc && emake docs
+		if use man || use nls; then
+			emake update-po
+		fi
 	else
 		emake libnss_sss.la pam_sss.la
 		use locator && emake sssd_krb5_locator_plugin.la
+		use pac && emake sssd_pac_plugin.la
 	fi
 }
 
 multilib_src_install() {
 	if multilib_is_native_abi; then
 		emake -j1 DESTDIR="${D}" "${_at_args[@]}" install
+		if use python; then
+			python_optimize
+			python_fix_shebang "${ED}"
+		fi
+
 	else
 		# easier than playing with automake...
 		dopammod .libs/pam_sss.so
@@ -192,6 +234,11 @@ multilib_src_install() {
 			exeinto /usr/$(get_libdir)/krb5/plugins/libkrb5
 			doexe .libs/sssd_krb5_locator_plugin.so
 		fi
+
+		if use pac; then
+			exeinto /usr/$(get_libdir)/krb5/plugins/authdata
+			doexe .libs/sssd_pac_plugin.so
+		fi
 	fi
 }
 
@@ -208,7 +255,6 @@ multilib_src_install_all() {
 	newins "${S}"/src/examples/logrotate sssd
 
 	newconfd "${FILESDIR}"/sssd.conf sssd
-	newinitd "${FILESDIR}"/sssd sssd
 
 	keepdir /var/lib/sss/db
 	keepdir /var/lib/sss/deskprofile
@@ -220,15 +266,21 @@ multilib_src_install_all() {
 	keepdir /var/lib/sss/secrets
 	keepdir /var/log/sssd
 
-	systemd_dounit "${FILESDIR}/${PN}.service"
+	# strip empty dirs
+	if ! use doc ; then
+		rm -r "${ED}"/usr/share/doc/"${PF}"/doc || die
+		rm -r "${ED}"/usr/share/doc/"${PF}"/{hbac,idmap,nss_idmap,sss_simpleifp}_doc || die
+	fi
+
+	rm -r "${ED}"/run || die
 }
 
 multilib_src_test() {
-	default
+	multilib_is_native_abi && emake check
 }
 
 pkg_postinst() {
 	elog "You must set up sssd.conf (default installed into /etc/sssd)"
 	elog "and (optionally) configuration in /etc/pam.d in order to use SSSD"
-	elog "features. Please see howto in	https://docs.pagure.org/SSSD.sssd/design_pages/smartcard_authentication_require.html"
+	elog "features. Please see howto in	https://sssd.io/docs/design_pages/smartcard_authentication_require.html"
 }
diff --git a/sys-auth/ykclient/Manifest b/sys-auth/ykclient/Manifest
index 08d82b83ddf1..7a4ac84b564f 100644
--- a/sys-auth/ykclient/Manifest
+++ b/sys-auth/ykclient/Manifest
@@ -1,3 +1,3 @@
 DIST ykclient-2.15.tar.gz 388738 BLAKE2B 10f56d97c337de5ae8fe15fb526f89208e8e69563cd7b2f1494e5a972da0a218c1c89e608ed490b7f17efc619bfeacfb51d1615b6eff36d4bfa5351cf80e4061 SHA512 a6e00309330225c681702616aa9f5d7e042f33a22ebe7719c2d71276f1a660ed0dc180d7f50c24b1c65d7bba6e2f2285d03037d504e926ac75506c24e6826279
-EBUILD ykclient-2.15.ebuild 494 BLAKE2B a7104c7f71c473d0a3f0ac03b8011d44f478decad2fefcb11e56d378e1d42231fa56baad5ca8a134be8ee8f258730296c3e53fa2a1b4bf24472854f25fe76471 SHA512 5f5a3fe705a77caf1f42f3960eedd93baf8786ffb130b969cb77d5eb93712af0245d3d9b4c8864e62e0128142494be56904d429fe4f3f32362bdc2f6229ff4af
+EBUILD ykclient-2.15.ebuild 577 BLAKE2B efd60c6e93e1f18d8d33df21b9d61a9b640f1f36861c3c06a731322f3358d071b727be42f4d7be9aa2f555757ec3a41ce6d188f2ab4039ccde8d652b1bd0232b SHA512 5cc388cccadb2c805632a6ec05e0836c415b1b7f5f6257171e10dad34afc78d9e3eeb2aa67b41de7b245ec8c2c72f113e3006fd19c16c3962dbdabfb619b7de7
 MISC metadata.xml 321 BLAKE2B 189e81fb02e188f57bb417a5036fe6812e90debb69aa73140f9f1375450b1cc37c6f947c313e3bd93298b9bce2805075e0ff0d7ef610aec7a35aa4b2f9465c95 SHA512 a19889c9f91a995a6c1f4c753481271de980fb1d3b7653ea4160f1b4eb3443d2260e3ddd223b05b508b6dfa607f86a4d0412b666a6915fffcd2bd07e954a2870
diff --git a/sys-auth/ykclient/ykclient-2.15.ebuild b/sys-auth/ykclient/ykclient-2.15.ebuild
index cec75e52208d..e119df25b795 100644
--- a/sys-auth/ykclient/ykclient-2.15.ebuild
+++ b/sys-auth/ykclient/ykclient-2.15.ebuild
@@ -1,19 +1,26 @@
-# Copyright 1999-2016 Gentoo Foundation
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=6
+EAPI=7
 
 DESCRIPTION="Yubico C client library"
 SRC_URI="http://opensource.yubico.com/yubico-c-client/releases/${P}.tar.gz"
 HOMEPAGE="https://github.com/Yubico/yubico-c-client"
 
-KEYWORDS="~amd64 ~x86"
-SLOT="0"
 LICENSE="BSD-2"
-IUSE="static-libs"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+# Tests require an active network connection, we don't want to run them
+RESTRICT="test"
 
-RDEPEND=">=net-misc/curl-7.21.1"
+RDEPEND="net-misc/curl"
 DEPEND="${RDEPEND}"
 
-# Tests require an active network connection, we don't want to run them
-RESTRICT="test"
+src_configure() {
+	econf --disable-static
+}
+
+src_install() {
+	default
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/sys-auth/ykpers/Manifest b/sys-auth/ykpers/Manifest
index f2fa2cb25e02..871f991c3404 100644
--- a/sys-auth/ykpers/Manifest
+++ b/sys-auth/ykpers/Manifest
@@ -2,6 +2,6 @@ AUX ykpers-1.20.0-fix-gcc10-fno-common.patch 308 BLAKE2B 720da4ac3f20c4512987b47
 AUX ykpers-1.20.0-json-boolean.patch 3572 BLAKE2B 684b9dab508b8d100d4e9237d833cb9160c33314a4076476b9342858844627acccc8f7025da0f22524251ca4541feceededd0f663e03810e53935ea809d1e556 SHA512 a8bc7ae71d0a05476688abfaea070ca7dc2eaa68e033524d4a1b2b6240eec2932d867e9eeaa248874a04f254618cd79bf9ebaa17421938b0c2e62502bf90c055
 DIST ykpers-1.19.3.tar.gz 127789 BLAKE2B 8dfc2751be92e69fcf98f5dc75d87eb170a4f70ff13faa321a85d4a04e27818823acbf02284ba23cb78ea758111513457ced4cdaa6961621a91f68b059eff378 SHA512 436c9807e488f7b324b892da7bfc7ea93e2b746cc3ae075822e9e8bfe478ef8e61c194127e5d4f50f6c1d9512292640d033464cceb6b8a18069411ff7993cc52
 DIST ykpers-1.20.0.tar.gz 127975 BLAKE2B 8753332be4df3eeb6ef0489782037fca12883a263d5697cfaee901763e4698ca5415953da1c2f8b3512de041c1e78735c03a5e6ea2101c71ada36d4e6d5d3d2d SHA512 a38b26700793f0a801e5f5889bbbce4a3f728d22aaecf8d0890f1b5135e67bed16a78b7a36dbc323c5d296901f6dd420fa658a982492a0cd9f0bbf95a5fbc823
-EBUILD ykpers-1.19.3-r1.ebuild 1077 BLAKE2B c80749b2db997e79112cec9dee3b6ad3e838ed30febc099d79180f1e2a9057edd200b705a1421b2f6e378be8a514c0a3e04cb809f2f795e00a88a95447d9fdce SHA512 b114d2b8f472da3dfebb2f5b5de9ca69a73dbe32abe9b5f62fd694a5d5755f80493d30d741d2ddcaa06d9235263c6fcc5abff54c94b3fd407a5d9f71ca1fa78f
-EBUILD ykpers-1.20.0.ebuild 1205 BLAKE2B 31c69e04b0070bb1f1621a946ab820f73baca1de718954040e6446ea91fc2cebd18ecefbbd9a60b825bcb0f1752b8caf5c3605ee6e7abbac72d56def78ed0d7a SHA512 e4fa0e96375ef1d69702d36dc73e6ca3df664971e64375d9772282e919992e2bbc965ce853d018e9a3563bb0d5316c397e0ee6458789934d41fe4ad653f8b5db
-MISC metadata.xml 632 BLAKE2B b03dff691e31f6d0ff188f1e10156140f0b9d5a91993be3be01f291e5edb75a0e8776a550ad3a66ac0244c402bbb40aa9e7948307d498d05d5c8d6b9b1997c4a SHA512 1cb1ba38e29077530438a94c0a2c4e6724abc4b8e3f946466d141497495b6f316094c5f6d2313e260b163c979f65a777570de03a7630c2908a085ce5da34580b
+EBUILD ykpers-1.19.3-r1.ebuild 961 BLAKE2B 926746c8d9a486eae15351d271bfeda1eae5945c24365909e430cea880665248da9758746a1c211fa783bb0518abac1acc46dbb88c5230370d9cfaf15c76bef8 SHA512 2e65fbf8d150306e841803e97ada7c5f9728d722ba075b3796d503d2f31c26a8c367c3754db046b05daab03d1502d1be889919bae0b5340b5cea71ecebe8868f
+EBUILD ykpers-1.20.0.ebuild 1089 BLAKE2B 306ae3a6de0b2d26022f7a4f98a11830045e173ca61e1e3a47fca4d25065961f90fa1bfd415dfb43f2a3aed90725a2792f0d1a62b70ec51d44253e2968751331 SHA512 bfe7a8f56c8b31e6ede3150bf9c8107434ec6e7e3ed92a532bad464e4b84fd1338d786023bc1374e4613711354f2590435c5b59abff9ffc85252718bc661a397
+MISC metadata.xml 436 BLAKE2B e54949a975addf81f97f326d23af8a432cbd9f821044e0a6802960b7bd47ed77bd4c7a4f6ae9fcf0c461c2e2cfbd6a0aca1c2cd6308cd5268841d9edfa665f9c SHA512 44e6feaec793268e30cf95824f96807f5353ad12699f35f691d1ccf09a3a3894d9ae540afcb5da4ecddd82373d526a3e72732d9cc46ec866341f025f7366fa36
diff --git a/sys-auth/ykpers/metadata.xml b/sys-auth/ykpers/metadata.xml
index 46e7a0ccd48e..0263462089b8 100644
--- a/sys-auth/ykpers/metadata.xml
+++ b/sys-auth/ykpers/metadata.xml
@@ -9,10 +9,4 @@
     <remote-id type="github">Yubico/yubikey-personalization</remote-id>
     <bugs-to>https://github.com/Yubico/yubikey-personalization/issues</bugs-to>
   </upstream>
-  <use>
-    <flag name="consolekit">
-      Use <pkg>sys-auth/consolekit</pkg> and <pkg>virtual/udev</pkg>
-      to allow access to the YubiKey HID device to the console user.
-    </flag>
-  </use>
 </pkgmetadata>
diff --git a/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild b/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild
index fbbae20cc15f..88bc388c29c8 100644
--- a/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild
+++ b/sys-auth/ykpers/ykpers-1.19.3-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2019 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -12,7 +12,7 @@ HOMEPAGE="https://github.com/Yubico/yubikey-personalization"
 KEYWORDS="amd64 x86"
 SLOT="0"
 LICENSE="BSD-2"
-IUSE="consolekit static-libs"
+IUSE="static-libs"
 
 DEPEND="
 	dev-libs/json-c:=
@@ -21,9 +21,7 @@ DEPEND="
 BDEPEND="
 	app-text/asciidoc
 	virtual/pkgconfig"
-RDEPEND="${DEPEND}
-	consolekit? ( sys-auth/consolekit[acl] )
-"
+RDEPEND="${DEPEND}"
 
 S="${WORKDIR}/yubikey-personalization-${PV}"
 
@@ -47,9 +45,6 @@ src_install() {
 	default
 
 	udev_dorules 69-yubikey.rules
-	if use consolekit ; then
-		udev_dorules 70-yubikey.rules
-	fi
 
 	find "${D}" -name '*.la' -delete || die
 }
diff --git a/sys-auth/ykpers/ykpers-1.20.0.ebuild b/sys-auth/ykpers/ykpers-1.20.0.ebuild
index e864d1dbc2b8..d2134a082324 100644
--- a/sys-auth/ykpers/ykpers-1.20.0.ebuild
+++ b/sys-auth/ykpers/ykpers-1.20.0.ebuild
@@ -12,7 +12,7 @@ HOMEPAGE="https://github.com/Yubico/yubikey-personalization"
 KEYWORDS="amd64 ~arm64 ~ppc64 x86"
 SLOT="0"
 LICENSE="BSD-2"
-IUSE="consolekit static-libs"
+IUSE="static-libs"
 
 DEPEND="
 	dev-libs/json-c:=
@@ -21,9 +21,7 @@ DEPEND="
 BDEPEND="
 	app-text/asciidoc
 	virtual/pkgconfig"
-RDEPEND="${DEPEND}
-	consolekit? ( sys-auth/consolekit[acl] )
-"
+RDEPEND="${DEPEND}"
 
 S="${WORKDIR}/yubikey-personalization-${PV}"
 PATCHES=(
@@ -51,9 +49,6 @@ src_install() {
 	default
 
 	udev_dorules 69-yubikey.rules
-	if use consolekit ; then
-		udev_dorules 70-yubikey.rules
-	fi
 
 	find "${D}" -name '*.la' -delete || die
 }
diff --git a/sys-auth/yubico-piv-tool/Manifest b/sys-auth/yubico-piv-tool/Manifest
index f1e91679807a..bc2eb314ccba 100644
--- a/sys-auth/yubico-piv-tool/Manifest
+++ b/sys-auth/yubico-piv-tool/Manifest
@@ -1,8 +1,7 @@
 AUX yubico-piv-tool-2.1.1-install-man-page.patch 1288 BLAKE2B 00f00f10310f0aaa5a53596bc71bc332cbdbcf2060d03c1aa6eede7872dd3b2f129c7fe37a844a4a7fa50eef468e9fd99f34c9e219a71dbae37eef9dbacc1884 SHA512 df4a2a902014fd5da7d8870dce6bcf46c41b2bfd910ca9bec9429b685d6c02335efe923cd7ab4199dd8bc8f70bec5b14d7c9adb021f926e6ac549c28739d739e
+AUX yubico-piv-tool-2.1.1-no-Werror.patch 453 BLAKE2B 80e024475d4c5c648154a0cb7950b2bf02bfe0048d9213e04aa60e9898a17cc4332bb8aa2fec273d341a99939cf209ef8fa70868d6beba836d2080e779681cdc SHA512 14c535a05cb597698bf230fafed11dcf4f2165f3daddb647f31848ad0505ee7a266bd2f6120fd2a57d4301fdf974c8af690a9e0eed51806517175082013701f4
 AUX yubico-piv-tool-2.1.1-tests-optional.patch 881 BLAKE2B 02821ac155a75a213567958d33e5f9b25838c1b1ea9dc65efda223ee397643d2d6479b5e5bd5867dfaf057d64bdebf1f1379d2187e4f9fbca1fb4fa97133d0fa SHA512 f694e2d9e882cdb04728a3fc1f857c9c5c388ed439d6efbb385fa96414c8241ce918f7a2bbbe0ac2c94fbf3b2981fc68de4c7a999822a14068c8f43bd21de43d
 AUX yubico-piv-tool-2.1.1-ykcs11-threads.patch 1168 BLAKE2B ec91a73c7ad6c9ddd2e6250536b89f01d1778a79bc8df823e896323053dac8fe23c6b23a84b526da61146204df3cbc7889cae3ffc9a0414626e6ddb3b0806051 SHA512 d48787ff5de1ed5ff80fbf2f65308ea0c174500e32b55033508284aa05b0674f013479aaed5697a8f1207f821e7fdbf99cc206830725c023aa3a349fa0792172
 DIST yubico-piv-tool-2.1.1.tar.gz 1302573 BLAKE2B da4419b7074930f7d264f21a12973511d350e687d0487b93d25a528f4a79d5df44dbbdde34ef7cd0d14507ba1a00f776fcd7eaf503f2253d8ee8da3e9a68010f SHA512 14d880088f7624f600c6badb6504c4c71ef29ff82e9c29bd837013e62273c6b198ca581705cc7fb9f3c0c13334767ea7b340fb033ce99fb60fb0478281affc9f
-EBUILD yubico-piv-tool-2.1.1-r1.ebuild 1172 BLAKE2B 4bcc8d5c4b8f44f333566b3ce5621edaded3dc75dd84f23b8a582aad053af04587de62bcbdbb1a93c06f8e1f0c7073e366c1d4b6f10d87f09d0df61ad4bdcceb SHA512 6949de3e602cf6ac2b1af1a0cb89b30e583eb491cdc3646bb6ac0f4d48acf3f26fd109aca5a3a2a63b508505c757e0718239157f015ab01597051d3bfaadc944
-EBUILD yubico-piv-tool-2.1.1-r2.ebuild 1238 BLAKE2B c3857b1f545fdee689f150d68c4c7fdae0713dc4ff54a951e6252ba13394e387b435c8bdb5b4996f53d6a1b960eae0e74a3d795b0d8099d9ca5cba428eb610d8 SHA512 2b288cf8982c334dac610fade490ad0e236a89c4e702b56f0ddecead50c2d5ea5979cfd99c5b66b8a1082c78582c041d96613d64efab71ef2640e291d74b9f33
-EBUILD yubico-piv-tool-2.1.1.ebuild 895 BLAKE2B e522a33a6c819787dc3d3c846991e54ca8aecfb10e8b6f654421964913887e4c2118dbd5d1934bbe554381b0f834512906f7c70826a6a2fd8c83bfe8ade67740 SHA512 fb1a0ddb6769f9fb83187a00aa8b14ee0fed7dc556932d91a9ddcd2eb2a4a75310ea886a68b549cd1fd5d93452f9d1926c4a0f33e55d019a282cbfb13e05b6ea
+EBUILD yubico-piv-tool-2.1.1-r2.ebuild 1299 BLAKE2B 7de823f32fadb2fbd5a2e4d54045aad3e6cc57f5080859dad40b5097a137aeeae803ddd5066a7c74ff1537cb3a215f68c9559a63ef7488937d4436e8ac6b6017 SHA512 23e1c093dad527fc434678cb6cacfeb4bd1f0c94efd24e8e1a1ed45c19c1ed5d12a3d8847473f1109136377acef25898375a7df5615e4b6181c28c490892aec3
 MISC metadata.xml 332 BLAKE2B cab42a159a3cd0da5f66dbbd7e542f4fbae2deb966a20e7392baa575ce00b65b40db1846abb69baced17c6feb6f9e3d565620ed5476735cfaa121b0a2b81dc22 SHA512 892f4b9d170c5bd2679a1777215d7b88249bd4347c918499b762aa9ad0132b7b15d847180e4d27527d5cead6a4f8e23a7a4d3dc89752bda3852a99782129c257
diff --git a/sys-auth/yubico-piv-tool/files/yubico-piv-tool-2.1.1-no-Werror.patch b/sys-auth/yubico-piv-tool/files/yubico-piv-tool-2.1.1-no-Werror.patch
new file mode 100644
index 000000000000..a177395bc751
--- /dev/null
+++ b/sys-auth/yubico-piv-tool/files/yubico-piv-tool-2.1.1-no-Werror.patch
@@ -0,0 +1,11 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -97,7 +97,7 @@
+     find_package (PkgConfig REQUIRED)
+ 
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -w") # -g -O2
+-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Werror")
++    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wwrite-strings")
+     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-prototypes")
diff --git a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r1.ebuild b/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r1.ebuild
deleted file mode 100644
index 07beb0c0d0d4..000000000000
--- a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r1.ebuild
+++ /dev/null
@@ -1,52 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit cmake
-
-DESCRIPTION="Command line tool for the YubiKey PIV application"
-SRC_URI="https://github.com/Yubico/yubico-piv-tool/archive/yubico-piv-tool-${PV}.tar.gz"
-HOMEPAGE="https://developers.yubico.com/yubico-piv-tool/ https://github.com/Yubico/yubico-piv-tool"
-
-LICENSE="BSD-2"
-SLOT="0/1"
-KEYWORDS="~amd64"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	dev-libs/openssl:0=[-bindist]
-	sys-apps/pcsc-lite
-"
-DEPEND="${RDEPEND}
-	dev-util/gengetopt
-	sys-apps/help2man
-	virtual/pkgconfig
-	test? ( dev-libs/check )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.1-install-man-page.patch
-	"${FILESDIR}"/${PN}-2.1.1-tests-optional.patch
-	"${FILESDIR}"/${PN}-2.1.1-ykcs11-threads.patch
-)
-
-S="${WORKDIR}/${PN}-${P}"
-
-src_configure() {
-	local mycmakeargs=(
-		-DBUILD_STATIC_LIB=OFF
-		-DBUILD_TESTING=$(usex test)
-	)
-	cmake_src_configure
-}
-
-src_install() {
-	cmake_src_install
-
-	echo "module: ${EPREFIX}/usr/$(get_libdir)/libykcs11.so" > ${PN}.module \
-		|| die "Failed to generate p11-kit module configuration"
-	insinto /usr/share/p11-kit/modules
-	doins ${PN}.module
-}
diff --git a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r2.ebuild b/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r2.ebuild
index a7a762e6a8df..38068c17a3e7 100644
--- a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r2.ebuild
+++ b/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1-r2.ebuild
@@ -5,13 +5,13 @@ EAPI=7
 
 inherit cmake
 
-DESCRIPTION="Command line tool for the YubiKey PIV application"
+DESCRIPTION="Command-line tool and p11-kit module for the YubiKey PIV application"
 SRC_URI="https://github.com/Yubico/yubico-piv-tool/archive/yubico-piv-tool-${PV}.tar.gz"
 HOMEPAGE="https://developers.yubico.com/yubico-piv-tool/ https://github.com/Yubico/yubico-piv-tool"
 
 LICENSE="BSD-2"
 SLOT="0/1"
-KEYWORDS="~amd64"
+KEYWORDS="amd64"
 IUSE="libressl test"
 
 RESTRICT="!test? ( test )"
@@ -27,6 +27,7 @@ BDEPEND="dev-util/gengetopt
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-2.1.1-install-man-page.patch
+	"${FILESDIR}"/${PN}-2.1.1-no-Werror.patch
 	"${FILESDIR}"/${PN}-2.1.1-tests-optional.patch
 	"${FILESDIR}"/${PN}-2.1.1-ykcs11-threads.patch
 )
diff --git a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1.ebuild b/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1.ebuild
deleted file mode 100644
index e250affc1b84..000000000000
--- a/sys-auth/yubico-piv-tool/yubico-piv-tool-2.1.1.ebuild
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit cmake
-
-DESCRIPTION="Command line tool for the YubiKey PIV application"
-SRC_URI="https://github.com/Yubico/yubico-piv-tool/archive/yubico-piv-tool-${PV}.tar.gz"
-HOMEPAGE="https://developers.yubico.com/yubico-piv-tool/ https://github.com/Yubico/yubico-piv-tool"
-
-LICENSE="BSD-2"
-SLOT="0/1"
-KEYWORDS="~amd64"
-IUSE="test"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	dev-libs/openssl:0=[-bindist]
-	sys-apps/pcsc-lite
-"
-DEPEND="${RDEPEND}
-	dev-util/gengetopt
-	sys-apps/help2man
-	virtual/pkgconfig
-	test? ( dev-libs/check )
-"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-2.1.1-install-man-page.patch
-	"${FILESDIR}"/${PN}-2.1.1-tests-optional.patch
-)
-
-S="${WORKDIR}/${PN}-${P}"
-
-src_configure() {
-	local mycmakeargs=(
-		-DBUILD_STATIC_LIB=OFF
-		-DBUILD_TESTING=$(usex test)
-	)
-	cmake_src_configure
-}