14 files changed, 463 insertions, 145 deletions
diff --git a/app-crypt/Manifest.gz b/app-crypt/Manifest.gz
index 5acc3e415e13..841cb5918509 100644
--- a/app-crypt/Manifest.gz
+++ b/app-crypt/Manifest.gz
diff --git a/app-crypt/certbot/Manifest b/app-crypt/certbot/Manifest
index 3897de323916..d9bb39e7f382 100644
--- a/app-crypt/certbot/Manifest
+++ b/app-crypt/certbot/Manifest
@@ -5,6 +5,7 @@ DIST certbot-3.0.1.gh.tar.gz 2325233 BLAKE2B 247505fb500c829de875aa0886f27727de4
 DIST certbot-3.1.0.gh.tar.gz 2299990 BLAKE2B 596f11d4ebb161ee6ba67f4f150a77e081399f11f4e4652923c94297661149c9cb889afc51b46b6111847820823d90edc3a7f1e14c451122f88e6e777bf48795 SHA512 efd0b0c1540a6e3b631fa80eac65c9e8b31b1e5e1242f56d3723ca7e1b1b2121dfe1bf8e122fe9a9b994460553f1fa085b11d1369b3160f5c51c939b2cccd638
 DIST certbot-3.2.0.gh.tar.gz 2309823 BLAKE2B 30ff3f40dc4d7724ad7b9a5eaf48f15fa579d49902dd23d21d8b2d36a4371da05f8c9417b0b2bf49a12565ba9dec180a9d805f22e0e8d1342ae5ea64b43d5219 SHA512 8fc3753dcdc954e143da31a0308269b99abadcdefc008c54c2cabac14a3bf99e757f1007349806a7dabf4a8fe19fd3a365ddea85c1dbeb3b453ae91503ea2288
 DIST certbot-3.3.0.gh.tar.gz 2312043 BLAKE2B c7525be3116badf8de8de068d5f6a7daf79630c72bf338c58bf770478f8d827d8de2d9eb15b4c44fcd6e23c1357344cbb8529eed95359d305a0b77043e1adccc SHA512 8cc8939dc37c8c354e673110a63335322e16745c63a562e896f3ee1429ca70ebbb22920984e7aafa7c38e10fa0fa17e458d206799eb36c86280590c606aeed19
+DIST certbot-4.0.0.gh.tar.gz 2309431 BLAKE2B ddf38b29fe0db9a0434291b85c11f40b89411ae2261951390d542a694996ce89e11100b4a37832271737be55d8c114150bfc56782dc0be673a5d23ada8d91933 SHA512 a34c65c603a5e07ac95143168d651b7d76c3d9403b39b12201d74a23ddbd42019062cb2c0819faae82f2691462324538f1d4db6cdb44c82eddeb4782c0bd86f9
 EBUILD certbot-2.10.0.ebuild 1528 BLAKE2B 34449bcf95187bed02f610a3ab4b5252e241b48385705c53bcf6afa140a4a5d7c216b50f0d2910d32b9f2dec37de298b29cc4106bcb91cf914938c2634725625 SHA512 c52d34a393a7788ae9062a752e3205218301a6b84b6716ebece6cc3b4568197b841cec020f14b71c66cc7790e1076b833bf286f950aeaf80015159e9187493fe
 EBUILD certbot-2.11.0-r3.ebuild 1532 BLAKE2B cbb39b14012b2e7575bf75535536c2c006b25ddb458eeeca91a0536e55a2ddd8f4661a19d9bad4b6d460eae5ee36f80fc10336e5ea879cc10eacb750b13ca8de SHA512 4d11ee2ca9aa12139d677a35382fc60ff6226fe594ded11e5256afb5d769ac2db25bb854959b78521e5b50a1266133f5004b8ef63586593c3673fdb2208e29f8
 EBUILD certbot-2.11.0.ebuild 1528 BLAKE2B 34449bcf95187bed02f610a3ab4b5252e241b48385705c53bcf6afa140a4a5d7c216b50f0d2910d32b9f2dec37de298b29cc4106bcb91cf914938c2634725625 SHA512 c52d34a393a7788ae9062a752e3205218301a6b84b6716ebece6cc3b4568197b841cec020f14b71c66cc7790e1076b833bf286f950aeaf80015159e9187493fe
@@ -14,5 +15,6 @@ EBUILD certbot-3.1.0.ebuild 1572 BLAKE2B 92f7bef4a2b4eaa3251d20fd44b33544687acd4
 EBUILD certbot-3.2.0-r102.ebuild 7640 BLAKE2B b13e2e0ec0dec9d67fae17fd9ee01ab6390f694cc4b2990b96bfa387f8cb50aa6f0d4eff11d1c7a58f429e51c820c5f5b4fcf7869f0f42fe3b619815245a7abc SHA512 3001aa585e75e3a2dab59e1001e2b2740c486809bcaa09aa18c361120891c37c67365a41d7b628e21a0bf357544cf21fe930b9c1a0fc39cdd9e13cf0500ba123
 EBUILD certbot-3.2.0.ebuild 1572 BLAKE2B f70a02b18dfe12e3768ee98be8392c6d9d753dcb5a69f37aa488634748c7bf685abb6a5ffcbb8330f5b82808d6b9fcf7146c129c3b637134418710d9f65b9fac SHA512 4f0815c0a793bce1d2870480069dd67bcee5795638bb5b5cbf61334a019ea0cb31135df4f57c2488e67d23d928190f1f2d7d9ea6a54e59a8ec975eb46161b372
 EBUILD certbot-3.3.0-r2.ebuild 7428 BLAKE2B b4a2d16af5851faee75b1f71ea0d69427ff059a2424117d76eba0336e1a36ed03e703a363a6b619247e65ce3089b4a314df253f2ecfc6ec03ee2b40284132c9b SHA512 32872ea02cef79aa7d1602294833ecf46d25c2f5d50e88de60bc67ad8e101537733eeab773397bf79d39dc8268ad6a1ed69f3a078c658d1e15464f032db09fbc
-EBUILD certbot-9999.ebuild 7614 BLAKE2B 15525f15fea0e257e7946f0518a5575f9e916ce4ed0dfb0d65ca5dc693e33b3304767c5cde8d6461ef73d7b26a267f87fd33d54bc3f89dae9c9d9b761fbf1dac SHA512 72ceea09578a21e1ea7bb15943f998b46404ac5f07b451461fb7b68d04851a2d6aea45e547bd0ae2aff64cb8b169033b457e234cb2fe688f5674d88d560a2f70
+EBUILD certbot-4.0.0-r1.ebuild 4700 BLAKE2B e66d07b211c7a81f729cc4d10fd40921ce6cfd677161a0171a900ccd59e2f9e5fc0e0ececf8e7dcd0cf0deb43abaad35218006ee10e2cfe23685b1eeecbb0871 SHA512 2ad367142312eb3e354e6a1b79f8b84036622932f677b84e57e52bd68c62f2007553b4cdae0c9f3402993fda236ac1b8c7b327586a87a75da4b6cb9432959989
+EBUILD certbot-9999.ebuild 4700 BLAKE2B e66d07b211c7a81f729cc4d10fd40921ce6cfd677161a0171a900ccd59e2f9e5fc0e0ececf8e7dcd0cf0deb43abaad35218006ee10e2cfe23685b1eeecbb0871 SHA512 2ad367142312eb3e354e6a1b79f8b84036622932f677b84e57e52bd68c62f2007553b4cdae0c9f3402993fda236ac1b8c7b327586a87a75da4b6cb9432959989
 MISC metadata.xml 1792 BLAKE2B c89e58193a94a26c3128ab8b15282a3c9c301a9c32fb64309c54a57361b01f63e707b4582e724244f85213187e7f0b57af380d3ef0e99ad6dbae9d684848b9ca SHA512 a3420355c14f6772a426d5ef63551883ea2c5754b83261c011601cbcc35ba65cbd444021eb613682030e82e35eb52013bf7cffb7502607605bb7bc6a84b37fdd
diff --git a/app-crypt/certbot/certbot-4.0.0-r1.ebuild b/app-crypt/certbot/certbot-4.0.0-r1.ebuild
new file mode 100644
index 000000000000..83fd24c753d4
--- /dev/null
+++ b/app-crypt/certbot/certbot-4.0.0-r1.ebuild
@@ -0,0 +1,188 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit distutils-r1
+
+if [[ "${PV}" == *9999 ]]; then
+	inherit git-r3
+
+	EGIT_REPO_URI="https://github.com/certbot/certbot.git"
+	EGIT_SUBMODULES=()
+	EGIT_CHECKOUT_DIR="${WORKDIR}/${P}"
+else
+	SRC_URI="
+		https://github.com/certbot/certbot/archive/v${PV}.tar.gz
+			-> ${P}.gh.tar.gz
+	"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+fi
+
+DESCRIPTION="Let’s Encrypt client to automate deployment of X.509 certificates"
+HOMEPAGE="
+	https://github.com/certbot/certbot
+	https://pypi.org/project/certbot/
+	https://letsencrypt.org/
+"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+
+# acme required for certbot, and then required for modules
+CERTBOT_BASE=(acme certbot)
+# List of "subpackages" from tools/_release.sh (without acme which is already above)
+CERTBOT_MODULES_EXTRA=(
+	apache
+	#dns-cloudflare # Requires missing packages, already in GURU
+	#dns-digitalocean # Requires missing packages, already in GURU
+	dns-dnsimple
+	dns-dnsmadeeasy
+	dns-gehirn
+	dns-google
+	dns-linode
+	dns-luadns
+	dns-nsone
+	dns-ovh
+	dns-rfc2136
+	dns-route53
+	dns-sakuracloud
+	nginx
+)
+
+IUSE="selinux"
+for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
+	IUSE+=" certbot-${module}"
+done
+
+BDEPEND="
+	test? (
+		dev-python/pytest[${PYTHON_USEDEP}]
+		dev-python/typing-extensions[${PYTHON_USEDEP}]
+	)
+"
+
+# See each setup.py for dependencies
+# Also discard the previous related packages
+# except their transition step
+RDEPEND="
+	!<app-crypt/acme-3.2.0-r100
+	!<app-crypt/certbot-apache-3.2.0-r100
+	!<app-crypt/certbot-dns-desec-3.2.0-r100
+	!<app-crypt/certbot-dns-dnsimple-3.2.0-r100
+	!<app-crypt/certbot-dns-nsone-3.2.0-r100
+	!<app-crypt/certbot-dns-rfc2136-3.2.0-r100
+	!<app-crypt/certbot-nginx-3.2.0-r100
+
+	dev-python/chardet[${PYTHON_USEDEP}]
+	>=dev-python/configargparse-1.5.3[${PYTHON_USEDEP}]
+	>=dev-python/configobj-5.0.6[${PYTHON_USEDEP}]
+	>=dev-python/cryptography-43.0.0[${PYTHON_USEDEP}]
+	>=dev-python/distro-1.0.1[${PYTHON_USEDEP}]
+	>=dev-python/josepy-2.0.0[${PYTHON_USEDEP}]
+	>=dev-python/parsedatetime-2.4[${PYTHON_USEDEP}]
+	>=dev-python/pyopenssl-25.0.0[${PYTHON_USEDEP}]
+	dev-python/pyrfc3339[${PYTHON_USEDEP}]
+	>=dev-python/pytz-2019.3[${PYTHON_USEDEP}]
+	>=dev-python/requests-2.20.0[${PYTHON_USEDEP}]
+	certbot-apache? (
+		dev-python/python-augeas[${PYTHON_USEDEP}]
+	)
+	certbot-dns-dnsimple? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-dnsmadeeasy? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-gehirn? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-google? (
+		>=dev-python/google-api-python-client-1.6.5[${PYTHON_USEDEP}]
+		>=dev-python/google-auth-2.16.0[${PYTHON_USEDEP}]
+	)
+	certbot-dns-linode? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-luadns? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-nsone? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-ovh? (
+		>=dev-python/dns-lexicon-3.15.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-rfc2136? (
+		>=dev-python/dnspython-2.6.1[${PYTHON_USEDEP}]
+	)
+	certbot-dns-route53? (
+		>=dev-python/boto3-1.15.15[${PYTHON_USEDEP}]
+	)
+	certbot-dns-sakuracloud? (
+		>=dev-python/dns-lexicon-3.14.1[${PYTHON_USEDEP}]
+	)
+	certbot-nginx? (
+		>=dev-python/pyopenssl-25.0.0[${PYTHON_USEDEP}]
+		>=dev-python/pyparsing-2.4.7[${PYTHON_USEDEP}]
+	)
+	selinux? ( sec-policy/selinux-certbot )
+"
+# RDEPEND+="
+#	!<app-crypt/certbot-dns-cloudflare-3.2.0-r100
+#
+# 	>=dev-python/requests-toolbelt-0.3.0[${PYTHON_USEDEP}] # @TODO is still necessary?
+# 	certbot-dns-cloudflare? (
+# 		# Available in GURU
+# 		>=dev-python/cloudflare-2.19[${PYTHON_USEDEP}]
+# 		<dev-python/cloudflare-2.20[${PYTHON_USEDEP}]
+# 	)
+# 	certbot-dns-digitalocean? (
+# 		# Available in GURU
+# 		>=dev-python/digitalocean-1.11[${PYTHON_USEDEP}]
+# 	)
+# "
+
+distutils_enable_tests pytest
+
+certbot_dirs=()
+
+my_certbot_dirs_listing() {
+	local base module
+	for base in "${CERTBOT_BASE[@]}"; do
+		certbot_dirs+=("${base}")
+	done
+	for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
+		use "certbot-${module}" \
+			&& certbot_dirs+=("certbot-${module}")
+	done
+}
+
+src_prepare() {
+	default
+
+	my_certbot_dirs_listing
+}
+
+python_compile() {
+	local dir
+	for dir in "${certbot_dirs[@]}"; do
+		pushd "${dir}" > /dev/null || die
+
+		distutils-r1_python_compile
+		# Delete previous build directory to avoid collision.
+		rm -rf "${BUILD_DIR}/build"
+
+		popd > /dev/null || die
+	done
+}
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# Change for pytest rootdir is required.
+	cd "${BUILD_DIR}/install$(python_get_sitedir)" || die
+	epytest
+}
diff --git a/app-crypt/certbot/certbot-9999.ebuild b/app-crypt/certbot/certbot-9999.ebuild
index 2811f5dc7b47..83fd24c753d4 100644
--- a/app-crypt/certbot/certbot-9999.ebuild
+++ b/app-crypt/certbot/certbot-9999.ebuild
@@ -19,11 +19,7 @@ else
 		https://github.com/certbot/certbot/archive/v${PV}.tar.gz
 			-> ${P}.gh.tar.gz
 	"
-	#KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
-	# Only for amd64, arm64 and x86 because of dev-python/python-augeas
-	#KEYWORDS="~amd64 ~arm64 ~x86"
-	# Only for amd64 and x86 because of dev-python/dns-lexicon
-	KEYWORDS="~amd64 ~x86"
+	KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
 fi
 
 DESCRIPTION="Let’s Encrypt client to automate deployment of X.509 certificates"
@@ -86,8 +82,7 @@ RDEPEND="
 	>=dev-python/configobj-5.0.6[${PYTHON_USEDEP}]
 	>=dev-python/cryptography-43.0.0[${PYTHON_USEDEP}]
 	>=dev-python/distro-1.0.1[${PYTHON_USEDEP}]
-	>=dev-python/josepy-1.13.0[${PYTHON_USEDEP}]
-	<dev-python/josepy-2[${PYTHON_USEDEP}]
+	>=dev-python/josepy-2.0.0[${PYTHON_USEDEP}]
 	>=dev-python/parsedatetime-2.4[${PYTHON_USEDEP}]
 	>=dev-python/pyopenssl-25.0.0[${PYTHON_USEDEP}]
 	dev-python/pyrfc3339[${PYTHON_USEDEP}]
@@ -151,18 +146,12 @@ RDEPEND="
 # 	)
 # "
 
-# Note: "docs" is not an actual directory under "S", they are actually
-# under each modules, see python_compile_all redefinition, but keep
-# this instruction enabled for dependency configuration.
-distutils_enable_sphinx docs \
-	dev-python/sphinx-rtd-theme
 distutils_enable_tests pytest
 
-src_prepare() {
-	local S_BACKUP="${S}"
+certbot_dirs=()
 
-	local certbot_dirs=()
-	local base module dir
+my_certbot_dirs_listing() {
+	local base module
 	for base in "${CERTBOT_BASE[@]}"; do
 		certbot_dirs+=("${base}")
 	done
@@ -170,142 +159,30 @@ src_prepare() {
 		use "certbot-${module}" \
 			&& certbot_dirs+=("certbot-${module}")
 	done
-
-	for dir in "${certbot_dirs[@]}"; do
-		S="${WORKDIR}/${P}/${dir}"
-		pushd "${S}" > /dev/null || die
-		distutils-r1_src_prepare
-		popd > /dev/null || die
-	done
-
-	# Restore S
-	S="${S_BACKUP}"
 }
 
-src_configure() {
-	local S_BACKUP="${S}"
-
-	local certbot_dirs=()
-	local base module dir
-	for base in "${CERTBOT_BASE[@]}"; do
-		certbot_dirs+=("${base}")
-	done
-	for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
-		use "certbot-${module}" \
-			&& certbot_dirs+=("certbot-${module}")
-	done
-
-	for dir in "${certbot_dirs[@]}"; do
-		S="${WORKDIR}/${P}/${dir}"
-		pushd "${S}" > /dev/null || die
-		distutils-r1_src_configure
-		popd > /dev/null || die
-	done
+src_prepare() {
+	default
 
-	# Restore S
-	S="${S_BACKUP}"
+	my_certbot_dirs_listing
 }
 
-src_compile() {
-	# Used for building documentation
-	# Stores temporary modules docs in each subdirectories, will be used for HTML_DOCS
-	local temp_docs="${T}/docs"
-	use doc && {
-		mkdir "${temp_docs}" || die
-	}
-
-	local S_BACKUP="${S}"
+python_compile() {
+	local dir
+	for dir in "${certbot_dirs[@]}"; do
+		pushd "${dir}" > /dev/null || die
 
-	local certbot_dirs=()
-	local base module dir
-	for base in "${CERTBOT_BASE[@]}"; do
-		certbot_dirs+=("${base}")
-	done
-	for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
-		use "certbot-${module}" \
-			&& certbot_dirs+=("certbot-${module}")
-	done
+		distutils-r1_python_compile
+		# Delete previous build directory to avoid collision.
+		rm -rf "${BUILD_DIR}/build"
 
-	for dir in "${certbot_dirs[@]}"; do
-		S="${WORKDIR}/${P}/${dir}"
-		pushd "${S}" > /dev/null || die
-		distutils-r1_src_compile
 		popd > /dev/null || die
 	done
-
-	# Restore S
-	S="${S_BACKUP}"
-
-	use doc && {
-		# Replace HTML_DOCS with one single entry to avoid merging
-		HTML_DOCS=( "${temp_docs}" )
-	}
-}
-
-python_compile_all() {
-	# There is no documentation in certbot-apache or certbot-nginx.
-	if [[ "${dir}" = "certbot-apache" ]] || [[ "${dir}" = "certbot-nginx" ]]; then
-		return
-	fi
-
-	# Used to build documentation
-	use doc && {
-		sphinx_compile_all
-
-		# Subdirectory "_build/html" from build_sphinx in eclass/python-utils-r1.eclass
-		mv "${_DISTUTILS_SPHINX_SUBDIR}/_build/html" "${temp_docs}/${dir}" || die
-	}
 }
 
 python_test() {
 	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	# Change for pytest rootdir is required.
+	cd "${BUILD_DIR}/install$(python_get_sitedir)" || die
 	epytest
 }
-
-src_test() {
-	local S_BACKUP="${S}"
-
-	local certbot_dirs=()
-	local base module dir
-	for base in "${CERTBOT_BASE[@]}"; do
-		certbot_dirs+=("${base}")
-	done
-	for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
-		use "certbot-${module}" \
-			&& certbot_dirs+=("certbot-${module}")
-	done
-
-	for dir in "${certbot_dirs[@]}"; do
-		S="${WORKDIR}/${P}/${dir}"
-		pushd "${S}" > /dev/null || die
-		distutils-r1_src_test
-		popd > /dev/null || die
-	done
-
-	# Restore S
-	S="${S_BACKUP}"
-}
-
-src_install() {
-	local S_BACKUP="${S}"
-
-	local certbot_dirs=()
-	local base module dir
-	for base in "${CERTBOT_BASE[@]}"; do
-		certbot_dirs+=("${base}")
-	done
-	for module in "${CERTBOT_MODULES_EXTRA[@]}"; do
-		use "certbot-${module}" \
-			&& certbot_dirs+=("certbot-${module}")
-	done
-
-	for dir in "${certbot_dirs[@]}"; do
-		S="${WORKDIR}/${P}/${dir}"
-		pushd "${S}" > /dev/null || die
-		distutils-r1_src_install
-		popd > /dev/null || die
-	done
-
-	# Restore S
-	S="${S_BACKUP}"
-}
diff --git a/app-crypt/lego/Manifest b/app-crypt/lego/Manifest
new file mode 100644
index 000000000000..8cd3ebde4ab2
--- /dev/null
+++ b/app-crypt/lego/Manifest
@@ -0,0 +1,6 @@
+DIST lego-4.22.2-deps.tar.xz 7963988 BLAKE2B 279adf06311ee0769acb7e8681da09fef75456f8ade9d45f0daaa031920fcb2198fd0cab5a37e04332fccfb30e195fcfc1e66f80644861a6a3d502fa650264c5 SHA512 24e9cdf1afe65845a6c7846e71f92532b3e7dad304f9ea4b04afb0f65d8842c67036578fa453ce6a9cd6835be97e86412a52d31fa958bf8b3645e6d3297137b8
+DIST lego-4.22.2-docs.tar.gz 10722353 BLAKE2B 24dea7d335646d12c55e23e030a81767618da9c32a09e464d7fad0e91f914eaed4508c1d1a771725c9ea0e2eedb8cddc2e5cd6b0e2bb31c7d1ee89791d342ed9 SHA512 1b998ee4153e5621b7c53e9dc4941c6749c916c6c92d2dfe8e2373f6ee7ad86dd2d13c1ef1d227a464a182ec7c35484d524778e8e6dc4531941eccc2b6304c22
+DIST lego-4.22.2.tar.gz 804158 BLAKE2B a75a327988d46ed8715a3c28c34a5de1c9de607b396b3179645a7b4a0dd83aa408bad10df4e64cc5d402ddf8653d17c034019c4d4f162fb9a252d83013278314 SHA512 a69c15e65753ba428635804a0f47d708c13beab3cbd888cc6d9b80fc13ee0614c4a4e948b43972d201f95969171db4443b81672ad93b7a681b96af11f9250db1
+EBUILD lego-4.22.2.ebuild 2059 BLAKE2B f85a465e42894af4f0b68db3438d2fb9f6ae2bd6eb4d92a33bda91de4809086a8b6c5701455d87f04d39008006dd79065474007c7cf1c7e17af0c477e1344682 SHA512 1e958d23aae1a609b2c5eb5fc8bab4fe4651b7769f9921880a1357ce815d3308021a554be1cb7321200ef078591b2d0d85005aa6ebd9c4743c6933e120a980ab
+EBUILD lego-9999.ebuild 2052 BLAKE2B 4909201a234a33b24f799b61b7b9260e768f90e4a4bbbe3b722fcd969cedf8b20f9c5d50a56de5fd6cfc48a80442cc8aa724a7199c2110d4e64e286f438c3b9c SHA512 4d203f4f26c76a0806d74ca7140a099ed111677556b63101242a3aa9f68b939e7b9a25a089751179ca853feddeea2f2a5e334e0ae26438c1d9d1567cd74de6a7
+MISC metadata.xml 561 BLAKE2B f4cfb6d9647b87b5b4ed5215acabae401439a372d759184d948b9570ba4e0dda039825cf8c3034654136b2719ada3d7d3e4ebaf5367dc4c818a93f3548e2b3e5 SHA512 340180b660545dbb9a583af86ec9b13eb7b2493bc56a86ff0d81b7ca7f1bf3152c86207bfa7b79d02448560eedd5da346d793b69e215c5b3fd5bb2b4925d317b
diff --git a/app-crypt/lego/lego-4.22.2.ebuild b/app-crypt/lego/lego-4.22.2.ebuild
new file mode 100644
index 000000000000..1d6164d31809
--- /dev/null
+++ b/app-crypt/lego/lego-4.22.2.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Let's Encrypt/ACME client (like certbot or acme.sh) and library written in Go"
+HOMEPAGE="https://github.com/go-acme/lego/"
+
+DOCUMENTATION_COMMIT=f1411f1b397b637903fd2e62769d50b3974b97ec
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/go-acme/lego.git"
+else
+	SRC_URI="
+	https://github.com/go-acme/lego/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/rahilarious/gentoo-distfiles/releases/download/${P}/deps.tar.xz -> ${P}-deps.tar.xz
+	https://github.com/go-acme/lego/archive/${DOCUMENTATION_COMMIT}.tar.gz -> ${P}-docs.tar.gz
+"
+	KEYWORDS="~amd64 ~arm64"
+fi
+
+# main
+LICENSE="MIT"
+# deps
+LICENSE+=" Apache-2.0 BSD-2 BSD ISC MPL-2.0"
+SLOT="0"
+
+# some tests require network access otherwise get following error
+# expected: "zoneee: unexpected status code: [status code: 401] body: Unauthorized"
+# actual  : "zoneee: could not find zone for domain \"prefix.example.com\" (_acme-challenge.prefix.example.com.): could not find the start of authority for _acme-challenge.prefix.example.com.: read udp 10.0.0.1:54729->10.0.0.1:53: read: connection refused"
+PROPERTIES="test_network"
+RESTRICT="test"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		EGIT_BRANCH="gh-pages"
+		EGIT_CHECKOUT_DIR="${WORKDIR}/${PN}-${DOCUMENTATION_COMMIT}"
+		git-r3_src_unpack
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+	find ../"${PN}"-"${DOCUMENTATION_COMMIT}"/ -type f -not -name '*.html' -delete || die
+}
+
+src_compile() {
+	export CGO_ENABLED=0
+
+	local VERSION
+	if [[ ${PV} == 9999* ]]; then
+		VERSION="$(git rev-parse HEAD)" || die
+	else
+		VERSION="${PV}"
+		ln -sv ../vendor ./ || die
+	fi
+
+	ego build -trimpath -ldflags "-X main.version=${VERSION}" -o dist/"${PN}" ./cmd/lego/
+}
+
+src_test() {
+	ego test -v -cover ./...
+}
+
+src_install() {
+	# primary program
+	dobin dist/"${PN}"
+
+	# docs
+	einstalldocs
+	dodoc -r ../"${PN}"-"${DOCUMENTATION_COMMIT}"/*
+}
diff --git a/app-crypt/lego/lego-9999.ebuild b/app-crypt/lego/lego-9999.ebuild
new file mode 100644
index 000000000000..e80722f65cd1
--- /dev/null
+++ b/app-crypt/lego/lego-9999.ebuild
@@ -0,0 +1,79 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Let's Encrypt/ACME client (like certbot or acme.sh) and library written in Go"
+HOMEPAGE="https://github.com/go-acme/lego/"
+
+DOCUMENTATION_COMMIT=f1411f1b397b637903fd2e62769d50b3974b97ec
+
+if [[ ${PV} == 9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/go-acme/lego.git"
+else
+	SRC_URI="
+	https://github.com/go-acme/lego/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://github.com/rahilarious/gentoo-distfiles/releases/download/${P}/deps.tar.xz -> ${P}-deps.tar.xz
+	https://github.com/go-acme/lego/archive/${DOCUMENTATION_COMMIT}.tar.gz -> ${P}-docs.tar.gz
+"
+	KEYWORDS="~amd64"
+fi
+
+# main
+LICENSE="MIT"
+# deps
+LICENSE+=" Apache-2.0 BSD-2 BSD ISC MPL-2.0"
+SLOT="0"
+
+# some tests require network access otherwise get following error
+# expected: "zoneee: unexpected status code: [status code: 401] body: Unauthorized"
+# actual  : "zoneee: could not find zone for domain \"prefix.example.com\" (_acme-challenge.prefix.example.com.): could not find the start of authority for _acme-challenge.prefix.example.com.: read udp 10.0.0.1:54729->10.0.0.1:53: read: connection refused"
+PROPERTIES="test_network"
+RESTRICT="test"
+
+src_unpack() {
+	if [[ ${PV} == 9999* ]]; then
+		git-r3_src_unpack
+		go-module_live_vendor
+		EGIT_BRANCH="gh-pages"
+		EGIT_CHECKOUT_DIR="${WORKDIR}/${PN}-${DOCUMENTATION_COMMIT}"
+		git-r3_src_unpack
+	else
+		default
+	fi
+}
+
+src_prepare() {
+	default
+	find ../"${PN}"-"${DOCUMENTATION_COMMIT}"/ -type f -not -name '*.html' -delete || die
+}
+
+src_compile() {
+	export CGO_ENABLED=0
+
+	local VERSION
+	if [[ ${PV} == 9999* ]]; then
+		VERSION="$(git rev-parse HEAD)" || die
+	else
+		VERSION="${PV}"
+		ln -sv ../vendor ./ || die
+	fi
+
+	ego build -trimpath -ldflags "-X main.version=${VERSION}" -o dist/"${PN}" ./cmd/lego/
+}
+
+src_test() {
+	ego test -v -cover ./...
+}
+
+src_install() {
+	# primary program
+	dobin dist/"${PN}"
+
+	# docs
+	einstalldocs
+	dodoc -r ../"${PN}"-"${DOCUMENTATION_COMMIT}"/*
+}
diff --git a/app-crypt/lego/metadata.xml b/app-crypt/lego/metadata.xml
new file mode 100644
index 000000000000..a150df1868ae
--- /dev/null
+++ b/app-crypt/lego/metadata.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>me@rahil.rocks</email>
+		<name>Rahil Bhimjiani</name>
+	</maintainer>
+	<maintainer type="project" proxied="proxy">
+		<email>proxy-maint@gentoo.org</email>
+		<name>Proxy Maintainers</name>
+	</maintainer>
+	<upstream>
+		<remote-id type="github">go-acme/lego</remote-id>
+		<bugs-to>https://github.com/go-acme/lego/issues</bugs-to>
+		<doc>https://go-acme.github.io/lego/</doc>
+	</upstream>
+</pkgmetadata>
diff --git a/app-crypt/sequoia-chameleon-gnupg/Manifest b/app-crypt/sequoia-chameleon-gnupg/Manifest
index 5eff8f823a79..8f893e907bc3 100644
--- a/app-crypt/sequoia-chameleon-gnupg/Manifest
+++ b/app-crypt/sequoia-chameleon-gnupg/Manifest
@@ -401,5 +401,5 @@ DIST zeroize-1.8.1.crate 20029 BLAKE2B 092eba034cd35ec47290020e0c2b213177ff5dbe1
 DIST zerovec-0.10.4.crate 126398 BLAKE2B b078784d6f178bbb9de1c3c1b6c7ef996f00bdd7dfd2924bda921e62f3e09e953fbf50f8d0da99ac6ff6d134f146253846f5663549dcf8df08eaf34b9d4016b3 SHA512 db12bba1d7476ddead92e6dfcdcc30e2e0defff4f263a740244eabee265a2cab265473a663d3dc3210f48e113b66d951da496dfab7965ce1bc792e5f2db422a0
 DIST zerovec-derive-0.10.3.crate 19438 BLAKE2B 9f7df8a4e4a0b62ab25aed967b26509db4bcc5d5b10b3bd73305099a4c49a60be8921484ced1a34d9b7ae30ffa5abe789686f432416a8f1cfc07de1db1dff594 SHA512 caefbffeb35265db9f74933bf07109d57f0da48156cafd4f330af78a5c7eb9ab0831a80789ad4fb119875ebc6cfd7e3de68c9984b77dca5151f9be41f1ae6e09
 EBUILD sequoia-chameleon-gnupg-0.11.2.ebuild 9027 BLAKE2B 87367b7517c3e2b464bd1d8b2a56411efcf17659e5c041d6539597ae7c57638888e4764010f35a0cae443f0299fd4847833a0bc408442b47efe1229f3ab20b3d SHA512 d112cb686053a113157fbc8f6074ee3bf8947ca79cbc44b7d4766a0782c463f3018d7535aa6c336ae5a781db03fb3477cf3f7f0fc99a9da6edf1345f0196aed1
-EBUILD sequoia-chameleon-gnupg-0.12.0.ebuild 1840 BLAKE2B d6b675d67d9e702d4ea59784ca18d521a375d310e1df5ce8ebe2fb239c1d3febd750a68d3b61f686483eea96ba60e5086dab183d953e08c4b82f9d0833e1fa84 SHA512 3e597dd4043fa595aa55f6319cc38a05a1c820f651ff39c3d57c54fcbb32e3937bc6e826d53e910d0688c607a16573273f157b292bf181284b73738deeccd12d
+EBUILD sequoia-chameleon-gnupg-0.12.0.ebuild 1839 BLAKE2B d210481112e7fb7d07542a7f74fec999131a9867ceff36ebe08f4cb1640c1092ae9dd51d3fbd2ab3ef3f83b3af834a523f117d6be8a8bfc38747d830679ab783 SHA512 a0b5f9633856bcb43d07ebb24bcf999f49b9047e65551350d34a1e5dd49f2b02466e11cf85da3b54f187a6c970e8b79c6b8b3b8392e5b277eb2eedbbfdd566df
 MISC metadata.xml 447 BLAKE2B a876bb1a6e3290305705c7b732d4225f658687095bcba12285f3c3e258177ffe9dd3ba0cd4e3b309dcb6e076906a8d568f9af1d932870ee1a4d471b9989a07cf SHA512 7d2d5e66179740cc71a73bc918c20ce0e022053841f60a1b8bbe71b9ef7df64457c39d2113e98043eaadc435953475823c0d8945e59f2ba3700b505680953afe
diff --git a/app-crypt/sequoia-chameleon-gnupg/sequoia-chameleon-gnupg-0.12.0.ebuild b/app-crypt/sequoia-chameleon-gnupg/sequoia-chameleon-gnupg-0.12.0.ebuild
index 64708cbd128a..775bcbed05ba 100644
--- a/app-crypt/sequoia-chameleon-gnupg/sequoia-chameleon-gnupg-0.12.0.ebuild
+++ b/app-crypt/sequoia-chameleon-gnupg/sequoia-chameleon-gnupg-0.12.0.ebuild
@@ -30,7 +30,7 @@ LICENSE+="
 	|| ( GPL-2 GPL-3 LGPL-3 )
 "
 SLOT="0"
-KEYWORDS="~amd64 ~arm64"
+KEYWORDS="amd64 ~arm64"
 # Still some issue to do with columns?
 RESTRICT="test"
 
diff --git a/app-crypt/sequoia-sqv/Manifest b/app-crypt/sequoia-sqv/Manifest
index 767e86419837..cba2fb6ff886 100644
--- a/app-crypt/sequoia-sqv/Manifest
+++ b/app-crypt/sequoia-sqv/Manifest
@@ -246,5 +246,5 @@ DIST xxhash-rust-0.8.10.crate 20066 BLAKE2B 5fca80ff05e00d5f78c2655093a963b08a16
 DIST zeroize-1.7.0.crate 19039 BLAKE2B 2f94a5025f409bd2b96a456d2f78a34c6b05b5554abe7ef3fad2a55a8fcff8a6a1b971be660aa4c2954ab7d6e89bebc431036e349edef74711292f9f64b1dbae SHA512 9d31e3e76e8c861309a3579c21f6da5fd6b056c7d7a350427445a1a832e8827204804783f7f9b808acaa2148efef883d9078bf84943b1db55526bba5bf5a2756
 DIST zeroize_derive-1.4.2.crate 11141 BLAKE2B a40add656369a3a40d5b5f3397a77a1e9f803d4b8ae5b7d51c9f2ebb332a289b3c1ea528655806a26998e081a1cc9f4b07828664542de8d8d2619faf079d25c5 SHA512 d6966b024ce5e265c93e7056659ccbb97bbf6baa30f759fd96dc4391a6487426637f61f0a2713b6160019d778cf7d8ff1f25bb33d6c4f4585b990baae418b226
 EBUILD sequoia-sqv-1.2.1-r1.ebuild 6199 BLAKE2B 526d91d0a0e5c314b6e736485ff252eb6cdddd7160c8d284a24fcf1c65f79cede0aec8d0b0eebd828656af1cf365ac9a145f1347ee3c92c7259435f2c7c6d904 SHA512 f13a3529fb7b81e94e3374ae4b1d864dddc17053569ec47d32a5bcc4eb9450dcbcd5a1d6e0005efc6ebe88491c4ac1629267ff2ec1b5b497ee525fedd82b16d3
-EBUILD sequoia-sqv-1.3.0.ebuild 1721 BLAKE2B 436ae274f1a2ac5f0ae11c3a23f5b1165c66c99b6f4e7de504a31054bd97e1a292ed7134fee648369e6e2205f1456a9022692d603d76c584077a2f2945c96cd6 SHA512 b437184c6336532070781d89a6f1e29a95492a13498b5288c8bce54a77f34494e86315029a2c506d48142753f781f2b1648481fca25aeafa8b87d5291c037f91
+EBUILD sequoia-sqv-1.3.0.ebuild 1720 BLAKE2B cd8d8fccdf1886ca8f846d1743c4cebef5fee8bcfd45ea22c16170055efc9a3fa17217f19959f164ac279cb4ab05e2cfd99915a2170b8b5c4b8f9d5f31f13033 SHA512 608e91ebddaa4046effcf63eceb2828bc31aaf2df55db4a38d8d343a917f308f91906ad72fa6a5a721413ca3bfec46c1ccc75b33e34f18f4054e5b430e6c02e9
 MISC metadata.xml 435 BLAKE2B 0d2b4ad9f546657d9736088eb9deea2622976a78128476013fad90173d2c0e837df89a527e597fc70108e38289dd74b55417a1edb01430a5393d24c7c5142a1d SHA512 c230769f501b0abe786f94d36cb6583bf8c85ef957fab89db4258fe773473b8940748029fa158ffe17e1db02f2c6ee8a2481ffebfb5b0d3e4e86a1a2ebcad99d
diff --git a/app-crypt/sequoia-sqv/sequoia-sqv-1.3.0.ebuild b/app-crypt/sequoia-sqv/sequoia-sqv-1.3.0.ebuild
index cd8a99b4781b..4d6c25108f7d 100644
--- a/app-crypt/sequoia-sqv/sequoia-sqv-1.3.0.ebuild
+++ b/app-crypt/sequoia-sqv/sequoia-sqv-1.3.0.ebuild
@@ -27,7 +27,7 @@ LICENSE+="
 	|| ( GPL-2 GPL-3 LGPL-3 )
 "
 SLOT="0"
-KEYWORDS="~amd64 ~ppc64"
+KEYWORDS="amd64 ~ppc64"
 
 QA_FLAGS_IGNORED="usr/bin/sqv"
 
diff --git a/app-crypt/xca/Manifest b/app-crypt/xca/Manifest
index 03ddea7885b0..9f91c59e1e3f 100644
--- a/app-crypt/xca/Manifest
+++ b/app-crypt/xca/Manifest
@@ -1,4 +1,6 @@
 AUX xca-2.8.0-man-page.patch 1026 BLAKE2B aeb83c424de6ef2c6e26ef9f612e0bc2d465a400c058a753cfad7a3d292a7c624dd1ddfd4a868361673ecc51ff70b27339775f74a402e4cfa19fa75c6e0a2131 SHA512 553a84ff4dfb2b5b3c71010673a21cfcf2d56f929f5c96f156ab44ddff2a39567d72cea65e1af728ef43b75ba29a76a514fca189e886bea23260b56fe541583e
 DIST xca-2.8.0.tar.gz 1955684 BLAKE2B 4ba352d023a3c7018cfb89cc6e8d9296c7a2664338ef4a3084339f96d32073065be7ec5d07e35cc9b91371e3d580872fa0d282ae10aa5bb36d0ffefa472c23d9 SHA512 14e880625f086d12cd39e55c1dc5703bdbc7cfcf683cf4706bb3fd0e2d9c2937194d3420f5e9a0a8f8fc22a24a56eaf67dc7c8eae5426e991f6737f0b6bb7a52
+DIST xca-2.9.0.tar.gz 1956908 BLAKE2B 96771a09039e2cfc14eae8bfc6686d3d43079c66872ade91ac2284c51903890cf68e43206c65e8d3bc674adf26af22bafe60f71f1996e210c0bc76c9601fb702 SHA512 7ccd12207b0f365fae371d5a7dbff5284446059aa096692e058f825ddd640d0a8e62e5f96b2c664e616b9716faacc4c3b482866f029692600150e2a787d90a53
 EBUILD xca-2.8.0.ebuild 1322 BLAKE2B 670df5d57c19cd911bbd4d3a2b3f20888a7564a14129870141bc798dfeeafdeec0f1f4cabe42c85fd98a2ed9e0ebf7a6a76c3b8048b8c8ee136bbe01c543dd5a SHA512 28eb5c27f68ea451a615bdd2706b31f791df5fe3cafea07cf5123bc672518889ce908c3ca647bfa3175e527fef3aeb0100bb0eb3fa766de6cfaa691d9383f54d
+EBUILD xca-2.9.0.ebuild 1325 BLAKE2B fb421aa7c96d4c7de1199b5abba45907357f35d2ccedd4e0aac29681975adefb7de7010db1bc389ec4be5a4d3281741b8a542e5a3b15a5f43642e477eeb8b11c SHA512 5650d413c4ed3ab53e42e221bc7496e61f3644a97178ac182d5c2d8b41d405cc4b720b18311d3c211e94df0974a15dbd933ce8eee918d9309b3f61daa0f8e1d3
 MISC metadata.xml 304 BLAKE2B f99e5a2ed991066c1c605ca7bba6669b362e90a96e5a26258caf8d6491f8c5351cc897826bd06dda28ac67cc3813b0fa640b8fe304aeea7ea10b75fa3074d340 SHA512 b8d54115ab45ecc869066e083938a28d075f4436fef33607685e633976843023b3fe4fb65456ba04532f38c4f35b7dc109f68c59c11ad4e73f2332786fee6cf5
diff --git a/app-crypt/xca/xca-2.9.0.ebuild b/app-crypt/xca/xca-2.9.0.ebuild
new file mode 100644
index 000000000000..134c19eae60d
--- /dev/null
+++ b/app-crypt/xca/xca-2.9.0.ebuild
@@ -0,0 +1,68 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit cmake virtualx xdg-utils
+
+DESCRIPTION="A GUI to OpenSSL, RSA public keys, certificates, signing requests etc"
+HOMEPAGE="https://hohnstaedt.de/xca/"
+SRC_URI="https://github.com/chris2511/xca/archive/refs/tags/RELEASE.${PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/xca-RELEASE.${PV}"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86 ~amd64-linux ~x86-linux ~ppc-macos"
+IUSE="doc"
+
+RDEPEND="
+	dev-libs/libltdl:0=
+	dev-qt/qtbase:6[sqlite,widgets]
+	dev-qt/qttools:6[assistant]
+	dev-libs/openssl:*
+	doc? ( app-text/linuxdoc-tools )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	dev-qt/qttools:6[linguist]
+	doc? ( dev-python/sphinx dev-python/sphinxcontrib-htmlhelp dev-python/sphinxcontrib-qthelp )
+"
+
+PATCHES=(
+	"${FILESDIR}/${PN}-2.8.0-man-page.patch"
+)
+
+src_configure() {
+	local mycmakeargs=(
+		-DQTFIXEDVERSION=Qt6
+	)
+	cmake_src_configure
+}
+
+src_compile() {
+	cmake_src_compile
+}
+
+src_test() {
+	virtx default
+}
+
+src_install() {
+	cmake_src_install
+
+	insinto /etc/xca
+	doins misc/*.txt
+
+	dosym xca /usr/bin/xca-console
+}
+
+pkg_postinst() {
+	xdg_icon_cache_update
+	xdg_desktop_database_update
+	xdg_mimeinfo_database_update
+}
+
+pkg_postrm() {
+	xdg_icon_cache_update
+	xdg_desktop_database_update
+	xdg_mimeinfo_database_update
+}