summaryrefslogtreecommitdiff
path: root/app-forensics
diff options
context:
space:
mode:
Diffstat (limited to 'app-forensics')
-rw-r--r--app-forensics/afflib/Manifest11
-rw-r--r--app-forensics/afflib/afflib-3.7.4.ebuild65
-rw-r--r--app-forensics/afflib/afflib-3.7.7.ebuild65
-rw-r--r--app-forensics/afflib/afflib-3.7.8.ebuild69
-rw-r--r--app-forensics/afflib/files/afflib-3.6.12-pyaff-header.patch13
-rw-r--r--app-forensics/afflib/files/afflib-3.7.1-python-module.patch14
-rw-r--r--app-forensics/afflib/metadata.xml13
-rw-r--r--app-forensics/afl/Manifest11
-rw-r--r--app-forensics/afl/afl-2.35b.ebuild40
-rw-r--r--app-forensics/afl/afl-2.39b.ebuild40
-rw-r--r--app-forensics/afl/afl-2.46b.ebuild40
-rw-r--r--app-forensics/afl/afl-2.51b.ebuild40
-rw-r--r--app-forensics/afl/metadata.xml7
-rw-r--r--app-forensics/aide/Manifest11
-rw-r--r--app-forensics/aide/aide-0.16.ebuild141
-rw-r--r--app-forensics/aide/files/aide-0.16-add-missing-include.patch24
-rw-r--r--app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch23
-rw-r--r--app-forensics/aide/files/aide-0.16-fix-acl-configure-option.patch23
-rw-r--r--app-forensics/aide/files/aide.conf115
-rw-r--r--app-forensics/aide/files/aide.cron192
-rw-r--r--app-forensics/aide/files/aideinit145
-rw-r--r--app-forensics/aide/metadata.xml19
-rw-r--r--app-forensics/air/Manifest5
-rw-r--r--app-forensics/air/air-2.0.0-r1.ebuild51
-rw-r--r--app-forensics/air/metadata.xml8
-rw-r--r--app-forensics/autopsy/Manifest5
-rw-r--r--app-forensics/autopsy/autopsy-2.24-r1.ebuild60
-rw-r--r--app-forensics/autopsy/metadata.xml8
-rw-r--r--app-forensics/chkrootkit/Manifest10
-rw-r--r--app-forensics/chkrootkit/chkrootkit-0.50.ebuild52
-rw-r--r--app-forensics/chkrootkit/chkrootkit-0.51.ebuild57
-rw-r--r--app-forensics/chkrootkit/files/chkrootkit.cron6
-rw-r--r--app-forensics/chkrootkit/metadata.xml8
-rw-r--r--app-forensics/cmospwd/Manifest5
-rw-r--r--app-forensics/cmospwd/cmospwd-5.1.ebuild25
-rw-r--r--app-forensics/cmospwd/metadata.xml23
-rw-r--r--app-forensics/dfxml/Manifest4
-rw-r--r--app-forensics/dfxml/dfxml-20170921-r1.ebuild33
-rw-r--r--app-forensics/dfxml/dfxml-99999999.ebuild28
-rw-r--r--app-forensics/dfxml/metadata.xml7
-rw-r--r--app-forensics/examiner/Manifest6
-rw-r--r--app-forensics/examiner/examiner-0.5-r2.ebuild38
-rw-r--r--app-forensics/examiner/files/examiner-0.5-perl.patch38
-rw-r--r--app-forensics/examiner/metadata.xml5
-rw-r--r--app-forensics/foremost/Manifest10
-rw-r--r--app-forensics/foremost/files/foremost-1.4-config-location.patch12
-rw-r--r--app-forensics/foremost/files/foremost-1.5.7-format-security.patch22
-rw-r--r--app-forensics/foremost/foremost-0.69.ebuild23
-rw-r--r--app-forensics/foremost/foremost-1.5.7-r2.ebuild35
-rw-r--r--app-forensics/foremost/foremost-1.5.7-r3.ebuild37
-rw-r--r--app-forensics/foremost/metadata.xml10
-rw-r--r--app-forensics/galleta/Manifest5
-rw-r--r--app-forensics/galleta/galleta-20040505_p1.ebuild25
-rw-r--r--app-forensics/galleta/metadata.xml8
-rw-r--r--app-forensics/honggfuzz/Manifest8
-rw-r--r--app-forensics/honggfuzz/files/honggfuzz-1.0-no-error.patch7
-rw-r--r--app-forensics/honggfuzz/files/honggfuzz-1.1-binutils-2.29.patch11
-rw-r--r--app-forensics/honggfuzz/honggfuzz-1.0.ebuild43
-rw-r--r--app-forensics/honggfuzz/honggfuzz-1.1.ebuild46
-rw-r--r--app-forensics/honggfuzz/metadata.xml11
-rw-r--r--app-forensics/libbfio/Manifest9
-rw-r--r--app-forensics/libbfio/libbfio-0.0.20120425_alpha.ebuild27
-rw-r--r--app-forensics/libbfio/libbfio-0.0.20130609_alpha.ebuild23
-rw-r--r--app-forensics/libbfio/libbfio-0.0.20130721.ebuild23
-rw-r--r--app-forensics/libbfio/metadata.xml11
-rw-r--r--app-forensics/libewf/Manifest7
-rw-r--r--app-forensics/libewf/libewf-20130416.ebuild53
-rw-r--r--app-forensics/libewf/libewf-20140608.ebuild52
-rw-r--r--app-forensics/libewf/metadata.xml15
-rw-r--r--app-forensics/lynis/Manifest6
-rw-r--r--app-forensics/lynis/files/lynis.cron-new3
-rw-r--r--app-forensics/lynis/lynis-2.5.2.ebuild55
-rw-r--r--app-forensics/lynis/metadata.xml5
-rw-r--r--app-forensics/mac-robber/Manifest5
-rw-r--r--app-forensics/mac-robber/mac-robber-1.02.ebuild28
-rw-r--r--app-forensics/mac-robber/metadata.xml23
-rw-r--r--app-forensics/magicrescue/Manifest7
-rw-r--r--app-forensics/magicrescue/files/magicrescue-1.1.9-ldflags.patch50
-rw-r--r--app-forensics/magicrescue/files/magicrescue-1.1.9-makefile.patch52
-rw-r--r--app-forensics/magicrescue/magicrescue-1.1.9.ebuild29
-rw-r--r--app-forensics/magicrescue/metadata.xml13
-rw-r--r--app-forensics/memdump/Manifest6
-rw-r--r--app-forensics/memdump/files/memdump-1.01-linux3.patch24
-rw-r--r--app-forensics/memdump/memdump-1.01.ebuild46
-rw-r--r--app-forensics/memdump/metadata.xml5
-rw-r--r--app-forensics/metadata.xml41
-rw-r--r--app-forensics/openscap/Manifest10
-rw-r--r--app-forensics/openscap/metadata.xml22
-rw-r--r--app-forensics/openscap/openscap-1.2.13.ebuild138
-rw-r--r--app-forensics/openscap/openscap-1.2.14.ebuild138
-rw-r--r--app-forensics/openscap/openscap-1.2.5.ebuild138
-rw-r--r--app-forensics/openscap/openscap-9999.ebuild161
-rw-r--r--app-forensics/ovaldi/Manifest13
-rw-r--r--app-forensics/ovaldi/files/disable-acl.patch23
-rw-r--r--app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch84
-rw-r--r--app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch11
-rw-r--r--app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch283
-rw-r--r--app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch23
-rw-r--r--app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch31
-rw-r--r--app-forensics/ovaldi/metadata.xml16
-rw-r--r--app-forensics/ovaldi/ovaldi-5.10.1.4.ebuild94
-rw-r--r--app-forensics/ovaldi/ovaldi-5.10.1.7.ebuild93
-rw-r--r--app-forensics/pasco/Manifest6
-rw-r--r--app-forensics/pasco/metadata.xml8
-rw-r--r--app-forensics/pasco/pasco-20040505_p1-r1.ebuild26
-rw-r--r--app-forensics/pasco/pasco-20040505_p1.ebuild24
-rw-r--r--app-forensics/quickfuzz/Manifest8
-rw-r--r--app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-derive-2.6.patch21
-rw-r--r--app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-directory-1.3.patch9
-rw-r--r--app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-ghc-8.0.2_rc1.patch8
-rw-r--r--app-forensics/quickfuzz/metadata.xml23
-rw-r--r--app-forensics/quickfuzz/quickfuzz-0.1_p20160920.ebuild151
-rw-r--r--app-forensics/quickfuzz/quickfuzz-9999.ebuild174
-rw-r--r--app-forensics/radamsa/Manifest4
-rw-r--r--app-forensics/radamsa/metadata.xml11
-rw-r--r--app-forensics/radamsa/radamsa-0.5-r1.ebuild29
-rw-r--r--app-forensics/rdd/Manifest6
-rw-r--r--app-forensics/rdd/files/rdd-3.0.4-sandbox-fix.patch25
-rw-r--r--app-forensics/rdd/metadata.xml15
-rw-r--r--app-forensics/rdd/rdd-3.0.4-r1.ebuild50
-rw-r--r--app-forensics/rifiuti/Manifest5
-rw-r--r--app-forensics/rifiuti/metadata.xml8
-rw-r--r--app-forensics/rifiuti/rifiuti-20040505_p1.ebuild24
-rw-r--r--app-forensics/rkhunter/Manifest10
-rw-r--r--app-forensics/rkhunter/files/rkhunter-1.3.cron133
-rw-r--r--app-forensics/rkhunter/files/rkhunter-1.4.2.conf.patch38
-rw-r--r--app-forensics/rkhunter/files/rkhunter.bash-completion87
-rw-r--r--app-forensics/rkhunter/metadata.xml8
-rw-r--r--app-forensics/rkhunter/rkhunter-1.4.2.ebuild64
-rw-r--r--app-forensics/rkhunter/rkhunter-1.4.4.ebuild65
-rw-r--r--app-forensics/scalpel/Manifest5
-rw-r--r--app-forensics/scalpel/metadata.xml15
-rw-r--r--app-forensics/scalpel/scalpel-2.0.ebuild31
-rw-r--r--app-forensics/sleuthkit/Manifest19
-rw-r--r--app-forensics/sleuthkit/files/sleuthkit-3.2.3-tools-shared-libs.patch55
-rw-r--r--app-forensics/sleuthkit/files/sleuthkit-4.0.0-system-sqlite.patch34
-rw-r--r--app-forensics/sleuthkit/files/sleuthkit-4.1.0-system-sqlite.patch34
-rw-r--r--app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch55
-rw-r--r--app-forensics/sleuthkit/files/sleuthkit-4.4.2-c89-fix.patch29
-rw-r--r--app-forensics/sleuthkit/metadata.xml16
-rw-r--r--app-forensics/sleuthkit/sleuthkit-4.0.2.ebuild39
-rw-r--r--app-forensics/sleuthkit/sleuthkit-4.1.0.ebuild38
-rw-r--r--app-forensics/sleuthkit/sleuthkit-4.1.2.ebuild38
-rw-r--r--app-forensics/sleuthkit/sleuthkit-4.1.3.ebuild38
-rw-r--r--app-forensics/sleuthkit/sleuthkit-4.4.2.ebuild175
-rw-r--r--app-forensics/unhide/Manifest7
-rw-r--r--app-forensics/unhide/metadata.xml11
-rw-r--r--app-forensics/unhide/unhide-20121229.ebuild38
-rw-r--r--app-forensics/unhide/unhide-20130526.ebuild35
-rw-r--r--app-forensics/volatility/Manifest7
-rw-r--r--app-forensics/volatility/metadata.xml8
-rw-r--r--app-forensics/volatility/volatility-2.4.1.ebuild32
-rw-r--r--app-forensics/volatility/volatility-2.6.ebuild35
-rw-r--r--app-forensics/yasat/Manifest14
-rw-r--r--app-forensics/yasat/files/yasat-700-remove-absent-tests.patch14
-rw-r--r--app-forensics/yasat/metadata.xml16
-rw-r--r--app-forensics/yasat/yasat-526.ebuild23
-rw-r--r--app-forensics/yasat/yasat-700.ebuild29
-rw-r--r--app-forensics/yasat/yasat-755.ebuild25
-rw-r--r--app-forensics/yasat/yasat-839.ebuild25
-rw-r--r--app-forensics/yasat/yasat-848.ebuild25
-rw-r--r--app-forensics/zzuf/Manifest8
-rw-r--r--app-forensics/zzuf/metadata.xml11
-rw-r--r--app-forensics/zzuf/zzuf-0.13-r1.ebuild46
-rw-r--r--app-forensics/zzuf/zzuf-0.15.ebuild25
165 files changed, 5907 insertions, 0 deletions
diff --git a/app-forensics/afflib/Manifest b/app-forensics/afflib/Manifest
new file mode 100644
index 000000000000..0ed46e0d50ea
--- /dev/null
+++ b/app-forensics/afflib/Manifest
@@ -0,0 +1,11 @@
+AUX afflib-3.6.12-pyaff-header.patch 330 SHA256 6a45c593a5c8875e78ee8411bec34eb473f70aab46ba6f8f6bb20db7e884d0c9 SHA512 9d57dd60bfe933961a5df4e4be2e8bee1bca0971bbb364c7c3888bc9b54ca7073e03864d30e4401abba3fff7ff5f7435b5219299f8f781d0fbbf065bfa9c800e WHIRLPOOL 920405a9838a725aeba82dae85595b9bb8714d4e1cc0fd4bdcbdd940ebffed2914d53a98b608347981e85fb0f394da065a546799edb36157394a3b20760eca2d
+AUX afflib-3.7.1-python-module.patch 540 SHA256 2b8bfdffb8e12f324465eb2ded2ef9243810480ca05cb3dc0192228993a24fce SHA512 3309977b2b1bd716d244e76e1ab6c270dc91e7b8e9e32bbfb11f017df6e08de47f11aaf4fa91cd79153c54cad7ada09d001197da3460105dcf017d6647b39974 WHIRLPOOL 4b8662cd812a8f0b3b908dcacf4d126a1a26ebeafec7d7860fbbb4338f2672bf66ea31c86cec947b7350522bec4963524824808cc744a31825e61b0996783509
+DIST afflib-3.7.4.tar.gz 569346 SHA256 74934ae60a76616442f1d593bdeb93dd6aa105b5dc8cee7e8e5d7529a77f46c0 SHA512 58791388a05d614dd5f219a74173de2ff0938a1f93b21e2dd0731aca52ea544ba60cc4325f0d284937467ce600a4302b7a2f724d84710ecc7f12db1a22a8e41c WHIRLPOOL db8d5f48aecc55bd4ee0e6f45552e37e6aa1621674d93a448ae5a5a6b3bba1ae9c40d8aac2211b6e27bf1ba72e1c998b9bb01e6c24298ef4287d7a117db9d820
+DIST afflib-3.7.7.tar.gz 518933 SHA256 049acb8b430fc354de0ae8b8c2043c221a213bcb17259eb099e1d5523a9697bf SHA512 8698d66ab84601e5dcd64fcedf2087d5a8227895ed4009d314958eb223c56e0e59aa3e76d57f854a911f79194ae9c1ffc8af8e686310752744b43030c9e84e80 WHIRLPOOL bd3eb26aca379953b0b2d432cace22f84838a32e2f915a47e1a5d14e48ef133ab0aa40cf5de1c0656248181989bf2aa04ccb741a6e63bf7cdce34b101ef44641
+DIST afflib-3.7.8.tar.gz 518399 SHA256 1ffcf2e087a0f4396d5054f0171c69d44f15aa023aa787aafa7bb57d849f1db9 SHA512 a547ea459c479ccba1b4805bcbbac6f670abdccf8fe6685406d0662483a2b643652e3798e6396ecb24cfeea9bf711f636aeebb64794637ee54e7dbb62c0bdbb7 WHIRLPOOL b0fd9fd0e1d6c5b0900ff42883b4c243639df46dfd860c4767bdce128c0282d29b7f79b133b54dccd88a7c9cd67345590669a24031e7db6ca73bd48faabd43cc
+EBUILD afflib-3.7.4.ebuild 1546 SHA256 010658ac7f13d33a3b070c9c3a77410d3d4c1766a28753f08c684deeb65c9af4 SHA512 9d54519b593ef0f5aee8f8d7c1774b965883ad726751ba6ee82c181762bf584a8fec8f94c32f9ec6fbd41c1437e3e9879d520ae108f285426f2a562d977b912b WHIRLPOOL c5377492f223ab2b7e00d99fc764260ef5725b0e4ecb8832732156f1a93a26b15c113a80c951caf7355d7146b674dbda73a1a60340ef229e1e041daf773fa261
+EBUILD afflib-3.7.7.ebuild 1548 SHA256 8a45a79c771ec2e8a2d8b3564c226a91cc49e5d47371eb38ed6a3c2c4142e325 SHA512 e5bb79ca2cc973f3ecb35473fad200e03b5b7ccec8d8d653b3d336a8c41f93adfe05101304c48b8882f0d28355707c15d2fc564aa00021d1cfe68f02beaea0a8 WHIRLPOOL bef1c52d6211f71f029be61cb049d63dfe860f658e35f25af8f1d3ff0302de8c6d87c7a4510c9b05e1956532297561e1a5ab52e8320c6cbf4cc84144a6985ac2
+EBUILD afflib-3.7.8.ebuild 1530 SHA256 1ca813ccf89a731e8b739eacb0219bc4fb435c5f982df126759120bd8e348e1d SHA512 75f5af879d32f7628ee2a44b848c5a449d2c79fe15628a9afd6f32ad77bf1e976e23d5a4eb70324d5f76d47dccdb95cd45111ccda3524f9489d2119bb302abfd WHIRLPOOL c9fb4ae54e212cf6b68d61614eb7056b650be32125fc2d0bf6e493214965607508af3cbe85d0ec0671b2c9b178ed3dfb94329c5e21c9a1d21753af1ef3fbfa98
+MISC ChangeLog 3183 SHA256 0271a00fe2416ea5ffa346ac7de9a821467cd6f84b2c64ad0bfd1c5c320d4d0d SHA512 bac14e4f85d733539bc16cfe650bd853e64171f2d71ec6067f68a62978c7111552380ac717bf6c3ef0d28e60b2000eb64b824e71fd9f37713352ca31761512e5 WHIRLPOOL 5ec8bdd6b05ac4d07bd15052310d73f1e648791a7e4520a16b7d86f45df3f03dbbfe892c7f72a5c6ffbc82d216d2e9831eedb718389cb24aa4f79992e559fc0e
+MISC ChangeLog-2015 6829 SHA256 5e98022ea94725b0dff2afdbc8f98d6b7d058c86102d0a0d8bf6caf57a155c37 SHA512 75158619850d1aa5018ae30104cdb052cabed813e7900ed7ba53128da8b1bd6aaca58e43e7b9aa9b44fc073e1438b18cfa83dd3a0ef413e295b67ba83dba6848 WHIRLPOOL 79715cb5562c24b5e006189be48e49f72b6c8ec9a10078c18ea3f5c4732e6e8878aefbbb40363f9333dc9d7fe79e953d43ca31af4b37180d3a197a7b48d2ccf7
+MISC metadata.xml 429 SHA256 2ef9cd8cc6ab6dcec513528f44e1b04c5ffbcd04c8560c24681c9a6b1dd9ca3f SHA512 172d0b4a9759b0bd5153e1cecf1a2c1b3f0927528fbc76941fe19c77f6960455628af22823c81b156b8575cacfe58d525950bafcdb31aca752752274ec989191 WHIRLPOOL 7218350d7ca395622c521f79d82a109237d1388dfc55da934e78043f2c75a742489a2ec2e23e977102d1ad6a02be1d2cf5a3ea065cf010fd8652646ca6917fc6
diff --git a/app-forensics/afflib/afflib-3.7.4.ebuild b/app-forensics/afflib/afflib-3.7.4.ebuild
new file mode 100644
index 000000000000..12a389924076
--- /dev/null
+++ b/app-forensics/afflib/afflib-3.7.4.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+PYTHON_COMPAT=( python2_7 )
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_PRUNE_LIBTOOL_FILES=modules
+
+inherit autotools-utils python-single-r1
+
+MY_PN=AFFLIBv3
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Library that implements the AFF image standard"
+HOMEPAGE="https://github.com/simsong/AFFLIBv3/"
+SRC_URI="https://github.com/simsong/${MY_PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="amd64 ~arm hppa ppc x86 ~x64-macos"
+IUSE="fuse ncurses python qemu readline s3 static-libs threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="dev-libs/expat
+ dev-libs/openssl:0
+ sys-libs/zlib
+ fuse? ( sys-fs/fuse )
+ ncurses? ( sys-libs/ncurses )
+ python? ( ${PYTHON_DEPS} )
+ readline? ( sys-libs/readline:0 )
+ s3? ( net-misc/curl )"
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-3.7.1-python-module.patch
+ "${FILESDIR}"/${PN}-3.6.12-pyaff-header.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+ use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+ sed -i '/FLAGS/s: -g::' configure.ac || die
+ sed -i '/-static/d' tools/Makefile.am || die
+
+ autotools-utils_src_prepare
+}
+
+src_configure() {
+ # Hacks for automagic dependencies
+ use ncurses || export ac_cv_lib_ncurses_initscr=no
+ use readline || export ac_cv_lib_readline_readline=no
+
+ local myeconfargs=(
+ $(use_enable fuse)
+ $(use_enable python)
+ $(use_enable qemu)
+ $(use_enable s3)
+ $(use_enable threads threading)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/afflib/afflib-3.7.7.ebuild b/app-forensics/afflib/afflib-3.7.7.ebuild
new file mode 100644
index 000000000000..be3eebc542c3
--- /dev/null
+++ b/app-forensics/afflib/afflib-3.7.7.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+PYTHON_COMPAT=( python2_7 )
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_PRUNE_LIBTOOL_FILES=modules
+
+inherit autotools-utils python-single-r1
+
+MY_PN=AFFLIBv3
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Library that implements the AFF image standard"
+HOMEPAGE="https://github.com/sshock/AFFLIBv3/"
+SRC_URI="https://github.com/sshock/${MY_PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~hppa ~ppc ~x86 ~x64-macos"
+IUSE="fuse ncurses python qemu readline s3 static-libs threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="dev-libs/expat
+ dev-libs/openssl:0
+ sys-libs/zlib
+ fuse? ( sys-fs/fuse )
+ ncurses? ( sys-libs/ncurses )
+ python? ( ${PYTHON_DEPS} )
+ readline? ( sys-libs/readline:0 )
+ s3? ( net-misc/curl )"
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-3.7.1-python-module.patch
+ "${FILESDIR}"/${PN}-3.6.12-pyaff-header.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+ use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+ sed -i '/FLAGS/s: -g::' configure.ac || die
+ sed -i '/-static/d' tools/Makefile.am || die
+
+ autotools-utils_src_prepare
+}
+
+src_configure() {
+ # Hacks for automagic dependencies
+ use ncurses || export ac_cv_lib_ncurses_initscr=no
+ use readline || export ac_cv_lib_readline_readline=no
+
+ local myeconfargs=(
+ $(use_enable fuse)
+ $(use_enable python)
+ $(use_enable qemu)
+ $(use_enable s3)
+ $(use_enable threads threading)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/afflib/afflib-3.7.8.ebuild b/app-forensics/afflib/afflib-3.7.8.ebuild
new file mode 100644
index 000000000000..0a4795a67809
--- /dev/null
+++ b/app-forensics/afflib/afflib-3.7.8.ebuild
@@ -0,0 +1,69 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+PYTHON_COMPAT=( python2_7 )
+
+inherit autotools eutils python-single-r1
+
+MY_PN=AFFLIBv3
+MY_P=${MY_PN}-${PV}
+
+DESCRIPTION="Library that implements the AFF image standard"
+HOMEPAGE="https://github.com/sshock/AFFLIBv3/"
+SRC_URI="https://github.com/sshock/${MY_PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~hppa ~ppc ~x86 ~x64-macos"
+IUSE="fuse ncurses python qemu readline s3 static-libs threads"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="dev-libs/expat
+ dev-libs/openssl:0=
+ sys-libs/zlib
+ fuse? ( sys-fs/fuse )
+ ncurses? ( sys-libs/ncurses:0= )
+ python? ( ${PYTHON_DEPS} )
+ readline? ( sys-libs/readline:0= )
+ s3? ( net-misc/curl )"
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-3.7.1-python-module.patch
+ "${FILESDIR}"/${PN}-3.6.12-pyaff-header.patch
+)
+
+S=${WORKDIR}/${MY_P}
+
+pkg_setup() {
+ use python && python-single-r1_pkg_setup
+}
+
+src_prepare() {
+ sed -i '/FLAGS/s: -g::' configure.ac || die
+
+ default
+ eautoreconf
+}
+
+src_configure() {
+ # Hacks for automagic dependencies
+ use ncurses || export ac_cv_lib_ncurses_initscr=no
+ use readline || export ac_cv_lib_readline_readline=no
+
+ local myeconfargs=(
+ $(use_enable fuse)
+ $(use_enable python)
+ $(use_enable qemu)
+ $(use_enable s3)
+ $(use_enable static-libs static)
+ $(use_enable threads threading)
+ )
+ econf "${myeconfargs[@]}"
+}
+
+src_install() {
+ default
+ prune_libtool_files --modules
+}
diff --git a/app-forensics/afflib/files/afflib-3.6.12-pyaff-header.patch b/app-forensics/afflib/files/afflib-3.6.12-pyaff-header.patch
new file mode 100644
index 000000000000..496b02d25035
--- /dev/null
+++ b/app-forensics/afflib/files/afflib-3.6.12-pyaff-header.patch
@@ -0,0 +1,13 @@
+Fix include location based on the include directories passed via CFLAGS.
+
+--- afflib-3.6.12/pyaff/pyaff.c.orig
++++ afflib-3.6.12/pyaff/pyaff.c
+@@ -21,7 +21,7 @@
+ ****************************************************/
+
+ #include "Python.h"
+-#include "lib/afflib.h"
++#include "afflib.h"
+
+ #include <string.h>
+ #include <stdlib.h>
diff --git a/app-forensics/afflib/files/afflib-3.7.1-python-module.patch b/app-forensics/afflib/files/afflib-3.7.1-python-module.patch
new file mode 100644
index 000000000000..d89509f2f7ea
--- /dev/null
+++ b/app-forensics/afflib/files/afflib-3.7.1-python-module.patch
@@ -0,0 +1,14 @@
+--- afflib-3.7.1/pyaff/Makefile.am
++++ afflib-3.7.1/pyaff/Makefile.am
+@@ -7,8 +7,8 @@
+ pyexec_LTLIBRARIES = pyaff.la
+
+ pyaff_la_SOURCES = pyaff.c
+-pyaff_la_LIBADD = ../lib/libafflib.la
++pyaff_la_LIBADD = @top_builddir@/lib/libafflib.la
+ pyaff_la_CPPFLAGS = $(PYTHON_CPPFLAGS)
+-pyaff_la_CFLAGS = -fno-strict-aliasing
+-pyaff_la_LDFLAGS = -module -avoid-version $(PYTHON_LDFLAGS)
++pyaff_la_CFLAGS = $(AM_CFLAGS) -shared -fno-strict-aliasing
++pyaff_la_LDFLAGS = -module -avoid-version -shared $(PYTHON_LDFLAGS)
+ endif
diff --git a/app-forensics/afflib/metadata.xml b/app-forensics/afflib/metadata.xml
new file mode 100644
index 000000000000..b171833f8f85
--- /dev/null
+++ b/app-forensics/afflib/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <use>
+ <flag name="fuse">Enable extra fuse thingies</flag>
+ <flag name="qemu">Enable qemu stuff</flag>
+ <flag name="s3">Enable support for Amazon S3</flag>
+ </use>
+ <upstream>
+ <remote-id type="github">simsong/AFFLIBv3</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/afl/Manifest b/app-forensics/afl/Manifest
new file mode 100644
index 000000000000..fe0fc1090046
--- /dev/null
+++ b/app-forensics/afl/Manifest
@@ -0,0 +1,11 @@
+DIST afl-2.35b.tgz 829515 SHA256 596167527ad7a69cf06dc8143a051eb8b2ee04f159447a3086f6e60ae460bcea SHA512 77f286d0008055770812b7429a671caed54adb2355cd88e1cbdd13f9e739763f46ed6f3e25ddfbe7aa2679e0a71c9b1af9767d1c367df1778338fcf260bc38c5 WHIRLPOOL b2935a18f5f03b4c1da04365412d76d6ff9d2ddc0d9dd1fea0a5866fb632b1033c3f03f4229f36d45a6ec406410b1c522bf5198bbce2ca6478dffdc433dde422
+DIST afl-2.39b.tgz 830897 SHA256 968eceae4d013eee62bc8f2fdddbb7060b92e03a0175153b0285ec7f5c78f141 SHA512 0df37fc8dea65d4130bc0fc8aaa23525bde4832c7202efb78ebe740d661546adee575b48fb94d851ef26293ca28a6ff818ab1dfd643c8e688aceb520e11229d0 WHIRLPOOL 3972c7718c35f545e6faadf763bbbd4bb57d1412ba2ec729832db9c636290bc8d67dfb5b8bfd67e3dff7f27b247b8ecd264245b75593a44c3298f0ca947cbb1a
+DIST afl-2.46b.tgz 834265 SHA256 268e2aec75f1bdd37d0d3dad70bbb80c32bce85152faf8f4f62e0c812e5d5d77 SHA512 01e150f05a023277f6fbf165f1ee0799f9a330efae562d67725cf87b456f4104e086162796634fcfdd7c68aa33a38ef7df9ac5931f8893c14364d270b864d059 WHIRLPOOL 9815f239d84a9bfa1418f523fbe5eca1a6f7bc0453ecfbc3397f7cefa4dff28a1beab259aa5c722e44f1e1b8915808e47f5d79a605e8de8f6c4e3b5da0d183c3
+DIST afl-2.51b.tgz 835611 SHA256 d435b94b35b844ea0bacbdb8516d2d5adffc2a4f4a5aad78785c5d2a5495bb97 SHA512 fd67cf44b7336175041c2efa42b122e91f887f4a293618a59ea1e145ef47b9c0fab9fc274e4b94499c523bec950ff5a704050c3f4260e890ad97774c365a358c WHIRLPOOL 1bf84c4855bcd2e28a1c9a50a7c154f355b024356dec0d9490ccc0b501f2b2b2ff0ecd24fc8d6a48b097f6a4f96573792554741e2945460a4560811ac2a7b609
+EBUILD afl-2.35b.ebuild 972 SHA256 adfe9190d00a536c1ad07ade0d37c77d95d58d45b7c29d0ebad927c147a267d1 SHA512 42cba2e4f010d2b5441e792eee792d0208f644b0fbfd9c26f82a623550bbd7fb9e3ce4ec61df7f00c761ee9f759167e19be979144a85778020cda14cab66b8aa WHIRLPOOL df4416bd6864eee9186d8dbcee772c6f7b0565fd6499e88ee8cbbbfff85901c968dfa80f0ad42fb3bd6691d391aaec4610ecd6fc0594367fae306c50d6f49b6c
+EBUILD afl-2.39b.ebuild 972 SHA256 ea71a82e31b13d31b0394a50ea29d463731358cac1f8d3d090b3bfcfcfc58c1b SHA512 366bbdfb0c8f16f0543a2eb1ed62c95d1427cb5437928e8a8bc6ee0bbbb8e15c0912c55dfea2d774b6bbce64acff705995f8abb06ca0b5edd1d8a2cd1a192da7 WHIRLPOOL a06a80fe83f867a5857689dcaabb3edf2595c95fe9ebc9650933a86568a2425a8fa85a96ed998653335174a927bf4a3f58308618c33e7ce7b66f1b10fa19644a
+EBUILD afl-2.46b.ebuild 979 SHA256 8238186c5ed290280bfdaa04d7db21c88d5b44b206191b969fc3d620c992bd18 SHA512 e581343d6ee6253e1b69969e4ac0cf13537191fac7e17a6cd11d386f8501af8ff94b8e4114e40c24f43d5b2b27e77c00f5c0e04b209bdc5ccfddd18db3246d11 WHIRLPOOL 201056a34a9c4d8d8a8502e7e0391b38153b3f63e3192219a474eeba88a9efce185e15691cb376726f10c4c5963beb6e2f63c54f567a809da9775331fcacff68
+EBUILD afl-2.51b.ebuild 979 SHA256 41be8ea4cee8b333722a41b7784a7805fe6ad42fd22cf238ebe41c405a9ba83b SHA512 55f9d1166dcecb9d2178ad80b52719d88416224ac2f0b3ad6be4aa65f54c258c18d76d1c55ccfff4f6eefa0d6d7dd4a01980565ab8cc24c1aac50ab026a377b6 WHIRLPOOL a200d8249b45eedd50f075b488ff4e36b0d959943d0503615c16230caff065ba44d8855393f499b4062c96b8a72862819f902a6c3d440d692080d3afb647b965
+MISC ChangeLog 3430 SHA256 6c559e819be3831fd4dda24d01f5e9a4b233766c9f5c590120eb94fbdc6ec1a2 SHA512 5dc394c0b1a60eaf9c02d14aada3c9fca4cad83f21d845bdac2b38eed566794b95b676ac98da2f064ac5777d267f6c7dd0aaad0e5d838dd93e88d4dc652134a6 WHIRLPOOL f4c52159f5a46c7ad25751f849a09757eb78dfafd6fb84227be6cb5cd495f98c7b71fff9aae1c3a980c8fdbe60ce0868e270e9c0da05b1458ff49f7ba5e6556b
+MISC ChangeLog-2015 1277 SHA256 5027750df573124d66c4b3caf7edfe7c45cd3e1eec8f4a6be3f1bea039256549 SHA512 b17a001d4988091a1219ac98f4e34928e2705fabf90fa8a1820e44eab27e257d9f5c599d9248bdfd43ef7599c0fc34907bc8eb85e578b40df36f6f2a51aba4e2 WHIRLPOOL dac05cbd732ab39c317b41660b100b1dba240e776dba0f097796fecec4b865064e863353ae9d38ebad949bb943456655acf2a57dd5ec30d14d55c72ea35fb4e3
+MISC metadata.xml 220 SHA256 49e2069f4751ed7f79a433d3b76bc345fcb099ac35f7b1b87b5d6764003c9586 SHA512 d9edbf422ea6f698d0b8de45ce3855e0d0f410d0f346ee85da825ad9f720fdaa367b7790027de2c7cc7ea70d51074eec76ca72ff6528be1ef490e0dcef2c640c WHIRLPOOL 4323fd2e46066082a73ed45401225ec2eba26ac29054bb573afa55f1b5753b020fc280453b03becf0a63dc3c0f9904e4d5c559a1afa68eb0d85b05fcf62174c2
diff --git a/app-forensics/afl/afl-2.35b.ebuild b/app-forensics/afl/afl-2.35b.ebuild
new file mode 100644
index 000000000000..41231e22e27f
--- /dev/null
+++ b/app-forensics/afl/afl-2.35b.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit multilib toolchain-funcs flag-o-matic
+
+DESCRIPTION="american fuzzy lop - compile-time instrumentation fuzzer"
+HOMEPAGE="http://lcamtuf.coredump.cx/afl/"
+SRC_URI="http://lcamtuf.coredump.cx/afl/releases/${P}.tgz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+DEPEND="sys-devel/gcc:*
+ sys-devel/clang"
+RDEPEND="${DEPEND}"
+QA_PREBUILT="/usr/share/afl/testcases/others/elf/small_exec.elf"
+
+src_compile() {
+ emake CC="$(tc-getCC)" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+ CC="clang" CXX="clang++" strip-unsupported-flags
+ cd llvm_mode
+ emake \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+}
+
+src_install() {
+ emake DESTDIR="${D}" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}" \
+ install
+}
diff --git a/app-forensics/afl/afl-2.39b.ebuild b/app-forensics/afl/afl-2.39b.ebuild
new file mode 100644
index 000000000000..f73c7f3967fd
--- /dev/null
+++ b/app-forensics/afl/afl-2.39b.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit multilib toolchain-funcs flag-o-matic
+
+DESCRIPTION="american fuzzy lop - compile-time instrumentation fuzzer"
+HOMEPAGE="http://lcamtuf.coredump.cx/afl/"
+SRC_URI="http://lcamtuf.coredump.cx/afl/releases/${P}.tgz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+DEPEND="sys-devel/gcc:*
+ sys-devel/clang"
+RDEPEND="${DEPEND}"
+QA_PREBUILT="/usr/share/afl/testcases/others/elf/small_exec.elf"
+
+src_compile() {
+ emake CC="$(tc-getCC)" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+ CC="clang" CXX="clang++" strip-unsupported-flags
+ cd llvm_mode
+ emake \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+}
+
+src_install() {
+ emake DESTDIR="${D}" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}" \
+ install
+}
diff --git a/app-forensics/afl/afl-2.46b.ebuild b/app-forensics/afl/afl-2.46b.ebuild
new file mode 100644
index 000000000000..89db69a2e44f
--- /dev/null
+++ b/app-forensics/afl/afl-2.46b.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit multilib toolchain-funcs flag-o-matic
+
+DESCRIPTION="american fuzzy lop - compile-time instrumentation fuzzer"
+HOMEPAGE="http://lcamtuf.coredump.cx/afl/"
+SRC_URI="http://lcamtuf.coredump.cx/afl/releases/${P}.tgz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+DEPEND="sys-devel/gcc:*
+ sys-devel/clang"
+RDEPEND="${DEPEND}"
+QA_PREBUILT="/usr/share/afl/testcases/others/elf/small_exec.elf"
+
+src_compile() {
+ emake CC="$(tc-getCC)" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+ CC="clang" CXX="clang++" strip-unsupported-flags
+ cd llvm_mode || die
+ emake \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+}
+
+src_install() {
+ emake DESTDIR="${D}" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}" \
+ install
+}
diff --git a/app-forensics/afl/afl-2.51b.ebuild b/app-forensics/afl/afl-2.51b.ebuild
new file mode 100644
index 000000000000..f78cf33093a2
--- /dev/null
+++ b/app-forensics/afl/afl-2.51b.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit multilib toolchain-funcs flag-o-matic
+
+DESCRIPTION="american fuzzy lop - compile-time instrumentation fuzzer"
+HOMEPAGE="http://lcamtuf.coredump.cx/afl/"
+SRC_URI="http://lcamtuf.coredump.cx/afl/releases/${P}.tgz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+DEPEND="sys-devel/gcc:*
+ sys-devel/clang"
+RDEPEND="${DEPEND}"
+QA_PREBUILT="/usr/share/afl/testcases/others/elf/small_exec.elf"
+
+src_compile() {
+ emake CC="$(tc-getCC)" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+ CC="clang" CXX="clang++" strip-unsupported-flags
+ cd llvm_mode || die
+ emake \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}"
+}
+
+src_install() {
+ emake DESTDIR="${D}" \
+ PREFIX="/usr" \
+ HELPER_PATH="/usr/$(get_libdir)/afl" \
+ DOC_PATH="/usr/share/doc/${PF}" \
+ install
+}
diff --git a/app-forensics/afl/metadata.xml b/app-forensics/afl/metadata.xml
new file mode 100644
index 000000000000..38ce6c17a3f2
--- /dev/null
+++ b/app-forensics/afl/metadata.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>hanno@gentoo.org</email>
+ </maintainer>
+</pkgmetadata>
diff --git a/app-forensics/aide/Manifest b/app-forensics/aide/Manifest
new file mode 100644
index 000000000000..9079b903a4bf
--- /dev/null
+++ b/app-forensics/aide/Manifest
@@ -0,0 +1,11 @@
+AUX aide-0.16-add-missing-include.patch 512 SHA256 1d42d7568b4a46478554bf9830359542208ba27c9f04b615dec31da2ffdcd1f6 SHA512 084be3c787a19f57bf140cd809df61edfd16a8798a1344adeee0aba0f4207c1e4a9c47c4c6d7606650e20cc202747208c0f0c00c21c0b68e1b739fb9d269da68 WHIRLPOOL 6a24037fdaa4dc2b216a213c2f3380060ca216cc9d705fc3e2c0b4c92f3f5ea9bff3e6e4a51ed8109608004ca037a07d9b973745cf4b58cf1a9a5e1263598071
+AUX aide-0.16-fix-LIBS-LDFLAGS-mixing.patch 874 SHA256 2ee350938116bc25a5cd8539035e0dd06323cb7cb51c3e93f3c1d72f0d7d6c08 SHA512 930967c1c7be54d10beb26e4281083a0f7cf500a5f161cf2af6c0a7b377e9bce092942a3a88c6cbb080e3eab500ec8a7bec1ff295f774ef70146240837961a8f WHIRLPOOL 8c4f20abf6d4b589b7f35a17329c111a58fa60ba1926ddc5a621369d17b1ad04a1781091f623489a0fa61ac9a206f631f602bd8040278e001b1c7fa6084df2a1
+AUX aide-0.16-fix-acl-configure-option.patch 728 SHA256 4a9c34863299028f952ee0a118c6b6cca59273e1217682471fcab8f60e2f0f1e SHA512 65b93cd01ebfe6696e35872bc012126794e5e1e5756c2ce041d9a914722806f6079274b0fbb64bc795488f530c33106deba204ee2982a5a8d485b7cd88382497 WHIRLPOOL 9918813e797fbe4d3b2de999c0b68f8da83ce0723af8e262e7e4eecebc72e55dd512e1e115512c29d5b8255a16a4558d83702e9d7e5b1a3d16e5933a192e2dc7
+AUX aide.conf 2713 SHA256 093c6397a4e26ab24127684eb8f9bb223ee5f2c2f9720e54c8ad8b425d52ba49 SHA512 cf6c17ab40b0bf9a0fb21ce015c6c35a8f7a595fdeb7d67e793424ed5243660a56cb33c1169038f4b116463cb055a48232f33db8ed497181be4e084449632b28 WHIRLPOOL 6526447bb7037dcf6e21b9bde649aa38f25590103e9546e323d246758ff332663996309c01727a3edd88214ef047d9b88d1bea4acbeb54f5cbd948b716162228
+AUX aide.cron 5997 SHA256 f4874c85d808c9f1726421c5f1146c4aa6a6bf831f61962c8265d5e7272f4558 SHA512 0931c1b9185e0b9a563c3589858b0ba20716344f29d6d1fc7226498f3c744af1d3c3fd72824f101f9b3e08710f443c9fdad312e28c0bcb93665d1dcb076f4b47 WHIRLPOOL 0eab354620d184c947076db26c6f83ca7ef13eb77b8f41603b26864c7644b6a96b4a23090b156e7c8680e736b2beffb2038030af51c497a5cc853daede92f1db
+AUX aideinit 2949 SHA256 1b4a01b8f50eb0b9217df55686ccd103ea92fca3892fe3a6a0364f83cae3548f SHA512 a6bce52432251458b977fb363d5801206c273fb9404c55f7bcb82b9d5a65aa19d1660d61d457c9af87f1a8fada95e2f8203489b1876b2b2a259e6374e15cdc57 WHIRLPOOL ef6237e12ed06c0a121ce96d5e0d4f4aea339f70907c2e4091cab988969a489a961bfbdd61cbcf6c2e7f90936d8cac39ea04e5fc8a75ac9e35c9608f443992c0
+DIST aide-0.16.tar.gz 391009 SHA256 a81c53a131c4fd130b169b3a26ac35386a2f6e1e014f12807524cc273ed97345 SHA512 29ad97756e3e2fb21dc332ed03b494a1c73e621266f8622ec80bdba23092a38ee975b97f3cff2330e4c16e64e2f672259eea9291ca706a4009e7399b4e14e6a7 WHIRLPOOL d9ecba06d8367ed2ef622ee6b3ccf6a0ed37bad52548063c5c153bd31b856ed8a3379e6057cc1d4aebd29473ded71e9190c8c17dbeaa65eec3365be1d43d5f46
+EBUILD aide-0.16.ebuild 3664 SHA256 b5502339c66ad5f3d3cc62ce4f9e3439ebe8a81ee75aa6dfa11c8326c46284a9 SHA512 703646999c5c5d4826bb71da4ba0c1f60d6877b3a58d024396b1c2795b9cabf1c537a47b6c0492350f136785684e2e848d37ed087087ee4042b9ec8c9f00c552 WHIRLPOOL 3d8945386ae80b4f06febfb2a63454fec0b0593f1cb0688e32fe372f00f90a61a6cd1443c673e26c9932f818b8d2e17a87360c246ca8e690d96218f426596757
+MISC ChangeLog 3787 SHA256 1941d2d94157d549e77bfa9e4fe2fdf11b98366be2932faba96f2d0775dbc80d SHA512 41f9be7269af6ff34f30147cd59efcdca69a5d765513034c88d895590b51d5de529b059851253aa1b2005cd18f8581b3aee6341df38edb7c394fda21fc362745 WHIRLPOOL 0097cc928acf07a30a180cafe2825a89847995cac4e67afc7ed4491b660e08f5092d55cf9d1b36eece8ffb5270cf084da43e2774e983a4297989f5b253c5bb12
+MISC ChangeLog-2015 12383 SHA256 211a2bd2eb42e132c16d3557996ad9298bf5e8fe99991bbdc51d25d44f61b362 SHA512 38af0d8fdd593f30b1f47b3f4051451f5db42f3b4cc9d104482aed79fb0ef2cf1b748c7bedf95b8f0e814ac65e3ff7291e19b1251daf074b7f3956e8a01a4884 WHIRLPOOL 899403ca9ff993d1c1ae8faa2ce5d830f88fcb000d4db7874d020b311154db5960b7d424fb7ed1123f119ae623d9020de76faf80bae70ba69264a9cef1a56c84
+MISC metadata.xml 631 SHA256 edbabddc6d1e2ec3e2cdf7ff08a956eaafc489e2fd9e56e9de8c0dd65a25134c SHA512 9f6eb547a55e72d2b75d3145282127abfdc737c68526995e628b98f2dd7930732eff9dbc492ddd4425e4090e8449a89c585b563618415d05dee6777273c5d4f6 WHIRLPOOL 0c8f6878559cb9412e64bc82f13ef0f761d579367aac102e9aa2071c1ef810900217fd392e3a738a2639bf1409e194c8c909c4ebf97b1b4affa6bb2565b4498f
diff --git a/app-forensics/aide/aide-0.16.ebuild b/app-forensics/aide/aide-0.16.ebuild
new file mode 100644
index 000000000000..cebc5fea7321
--- /dev/null
+++ b/app-forensics/aide/aide-0.16.ebuild
@@ -0,0 +1,141 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit autotools readme.gentoo-r1
+
+DESCRIPTION="AIDE (Advanced Intrusion Detection Environment) is a file integrity checker"
+HOMEPAGE="http://aide.sourceforge.net/"
+SRC_URI="mirror://sourceforge/aide/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE="acl audit curl e2fs mhash postgres prelink selinux static xattr zlib"
+
+COMMON_DEPEND="
+ !mhash? (
+ dev-libs/libgcrypt:0=
+ dev-libs/libgpg-error
+ )
+ mhash? ( app-crypt/mhash )
+ dev-libs/libpcre
+ acl? ( virtual/acl )
+ audit? ( sys-process/audit )
+ curl? ( net-misc/curl )
+ e2fs? ( sys-fs/e2fsprogs )
+ postgres? ( dev-db/postgresql:= )
+ prelink? ( dev-libs/elfutils )
+ selinux? ( sys-libs/libselinux )
+ xattr? ( sys-apps/attr )
+ zlib? ( sys-libs/zlib )
+"
+RDEPEND="
+ !static? ( ${COMMON_DEPEND} )
+ prelink? ( sys-devel/prelink )
+ selinux? ( sec-policy/selinux-aide )
+"
+DEPEND="${COMMON_DEPEND}
+ sys-devel/bison
+ sys-devel/flex
+ virtual/pkgconfig
+ static? (
+ !mhash? (
+ dev-libs/libgcrypt:0[static-libs]
+ dev-libs/libgpg-error[static-libs]
+ )
+ mhash? ( app-crypt/mhash[static-libs] )
+ dev-libs/libpcre[static-libs]
+ acl? ( virtual/acl[static-libs] )
+ e2fs? ( sys-fs/e2fsprogs[static-libs] )
+ prelink? ( dev-libs/elfutils[static-libs] )
+ selinux? ( sys-libs/libselinux[static-libs] )
+ xattr? ( sys-apps/attr[static-libs] )
+ zlib? ( sys-libs/zlib[static-libs] )
+ )
+"
+
+REQUIRED_USE="
+ postgres? ( !mhash )
+ static? ( !audit !curl !postgres )
+"
+
+HTML_DOCS=( doc/manual.html )
+
+DISABLE_AUTOFORMATTING=1
+DOC_CONTENTS="
+Example configuration file was installed at '${EPREFIX}/etc/aide/aide.conf'.
+Please edit it to meet your needs. Refer to aide.conf(5) manual page
+for more information.
+
+A helper script, aideinit, was installed and can be used to make AIDE
+management easier. Please run 'aideinit --help' for more information.
+"
+
+PATCHES=(
+ "${FILESDIR}/${P}-add-missing-include.patch"
+ "${FILESDIR}/${P}-fix-LIBS-LDFLAGS-mixing.patch"
+ "${FILESDIR}/${P}-fix-acl-configure-option.patch"
+)
+
+src_prepare() {
+ default_src_prepare
+ sed -i -e 's| -Werror||g' configure.ac || die
+ eautoreconf
+}
+
+src_configure() {
+ local myeconfargs=(
+ --sysconfdir="${EPREFIX}/etc/${PN}"
+ --with-confighmactype="sha512" # Override default weak MD5 hash.
+ --with-dbhmackey="sha512" # Override default weak MD5 hash.
+ # Disable broken l10n support: https://sourceforge.net/p/aide/bugs/98/
+ # This doesn't affect anything because there are no localizations yet.
+ --without-locale
+ $(use_enable static)
+ $(use_with zlib)
+ $(use_with curl)
+ $(use_with acl posix-acl)
+ $(use_with selinux)
+ $(use_with prelink prelink "${EPREFIX}/usr/sbin/prelink")
+ $(use_with xattr)
+ $(use_with e2fs e2fsattrs)
+ $(use_with mhash mhash)
+ $(use_with !mhash gcrypt)
+ $(use_with postgres psql)
+ $(use_with audit)
+ )
+ econf "${myeconfargs[@]}"
+}
+
+src_install() {
+ default_src_install
+ readme.gentoo_create_doc
+
+ insinto /etc/${PN}
+ doins "${FILESDIR}"/aide.conf
+
+ dosbin "${FILESDIR}"/aideinit
+ dodoc "${FILESDIR}"/aide.cron
+
+ keepdir /var/{lib,log}/${PN}
+}
+
+pkg_postinst() {
+ readme.gentoo_print_elog
+
+ if use postgres; then
+ elog
+ elog "Due to a bad assumption by aide, you must issue the following"
+ elog "command after the database initialization (aide --init ...):"
+ elog
+ elog 'psql -c "update pg_index set indisunique=false from pg_class \\ '
+ elog " where pg_class.relname='TABLE_pkey' and \ "
+ elog ' pg_class.oid=pg_index.indexrelid" -h HOSTNAME -p PORT DBASE USER'
+ elog
+ elog "where TABLE, HOSTNAME, PORT, DBASE, and USER are the same as"
+ elog "in your aide.conf."
+ elog
+ fi
+}
diff --git a/app-forensics/aide/files/aide-0.16-add-missing-include.patch b/app-forensics/aide/files/aide-0.16-add-missing-include.patch
new file mode 100644
index 000000000000..75f0403c968e
--- /dev/null
+++ b/app-forensics/aide/files/aide-0.16-add-missing-include.patch
@@ -0,0 +1,24 @@
+commit 1cbb888d55388d6bb88141c946bd6993b3e9872f
+Author: Ilya Tumaykin <itumaykin@gmail.com>
+Date: Tue May 23 17:24:29 2017 +0300
+
+db: add missing include
+
+url_fclose() function used in this file is defined in fopen.h.
+See https://sourceforge.net/p/aide/bugs/99/
+
+diff --git a/src/db.c b/src/db.c
+index dd133d4..858240d 100644
+--- a/src/db.c
++++ b/src/db.c
+@@ -28,6 +28,10 @@
+ #include "db_disk.h"
+ #include "md.h"
+
++#ifdef WITH_CURL
++#include "fopen.h"
++#endif
++
+ #ifdef WITH_PSQL
+ #include "db_sql.h"
+ #endif
diff --git a/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch b/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch
new file mode 100644
index 000000000000..453abe5f1eae
--- /dev/null
+++ b/app-forensics/aide/files/aide-0.16-fix-LIBS-LDFLAGS-mixing.patch
@@ -0,0 +1,23 @@
+commit 6da37687ba7cf259ac19cae2e1c16115b6848143
+Author: Ilya Tumaykin <itumaykin@gmail.com>
+Date: Thu May 25 13:34:55 2017 +0300
+
+build: fix incorrect LIBS/LDFLAGS mixing
+
+Otherwise build with LDFLAGS='-Wl,--as-needed' and curl support fails.
+See https://bugs.gentoo.org/show_bug.cgi?id=271326
+and https://sourceforge.net/p/aide/bugs/96/
+
+diff --git a/configure.ac b/configure.ac
+index 3598ebe..0c5cb0c 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -713,7 +713,7 @@ if test x$with_curl = xyes; then
+ AC_CHECK_HEADERS(curl/curl.h,,
+ [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])])
+ CFLAGS="$CFLAGS $CURL_CFLAGS"
+- LDFLAGS="$LDFLAGS $CURL_LIBS"
++ LIBS="$LIBS $CURL_LIBS"
+ AC_CHECK_LIB(curl,curl_easy_init,havecurl=yes,
+ [AC_MSG_ERROR([You don't have curl properly installed. Install it or try --without-curl.])]
+ )
diff --git a/app-forensics/aide/files/aide-0.16-fix-acl-configure-option.patch b/app-forensics/aide/files/aide-0.16-fix-acl-configure-option.patch
new file mode 100644
index 000000000000..a989e379039c
--- /dev/null
+++ b/app-forensics/aide/files/aide-0.16-fix-acl-configure-option.patch
@@ -0,0 +1,23 @@
+commit 3d9746bccbb50809e4c3de90ab5145a17af39aeb
+Author: Ilya Tumaykin <itumaykin@gmail.com>
+Date: Thu May 25 14:38:02 2017 +0300
+
+build: respect user choice for posix-acl configure option
+
+Otherwise acl support is enabled automagically, which is bad.
+See https://wiki.gentoo.org/wiki/Project:Quality_Assurance/Automagic_dependencies
+and https://sourceforge.net/p/aide/bugs/97/
+
+diff --git a/configure.ac b/configure.ac
+index 3598ebe..c45bbee 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -450,7 +450,7 @@ AC_MSG_CHECKING(for posix-acl-support)
+ AC_ARG_WITH([posix-acl],
+ [AC_HELP_STRING([--with-posix-acl],
+ [use POSIX ACLs (no checking)])],
+- [],
++ [with_posix_acl_support="$withval"],
+ [with_posix_acl_support=no]
+ )
+
diff --git a/app-forensics/aide/files/aide.conf b/app-forensics/aide/files/aide.conf
new file mode 100644
index 000000000000..cef1813db9f8
--- /dev/null
+++ b/app-forensics/aide/files/aide.conf
@@ -0,0 +1,115 @@
+# AIDE conf
+
+database=file:/var/lib/aide/aide.db
+database_out=file:/var/lib/aide/aide.db.new
+
+# Change this to "no" or remove it to not gzip output
+# (only useful on systems with few CPU cycles to spare)
+gzip_dbout=yes
+
+# Here are all the things we can check - these are the default rules
+#
+#p: permissions
+#i: inode
+#n: number of links
+#u: user
+#g: group
+#s: size
+#b: block count
+#m: mtime
+#a: atime
+#c: ctime
+#S: check for growing size
+#md5: md5 checksum
+#sha1: sha1 checksum
+#rmd160: rmd160 checksum
+#tiger: tiger checksum
+#R: p+i+n+u+g+s+m+c+md5
+#L: p+i+n+u+g
+#E: Empty group
+#>: Growing logfile p+u+g+i+n+S
+#haval: haval checksum
+#gost: gost checksum
+#crc32: crc32 checksum
+
+# Defines formerly set here have been moved to /etc/default/aide.
+
+# Custom rules
+Binlib = p+i+n+u+g+s+b+m+c+md5+sha1
+ConfFiles = p+i+n+u+g+s+b+m+c+md5+sha1
+Logs = p+i+n+u+g+S
+Devices = p+i+n+u+g+s+b+c+md5+sha1
+Databases = p+n+u+g
+StaticDir = p+i+n+u+g
+ManPages = p+i+n+u+g+s+b+m+c+md5+sha1
+
+# Next decide what directories/files you want in the database
+
+# Kernel, system map, etc.
+=/boot$ Binlib
+# Binaries
+/bin Binlib
+/sbin Binlib
+/usr/bin Binlib
+/usr/sbin Binlib
+/usr/local/bin Binlib
+/usr/local/sbin Binlib
+#/usr/games Binlib
+# Libraries
+/lib Binlib
+/usr/lib Binlib
+/usr/local/lib Binlib
+# Log files
+=/var/log$ StaticDir
+#!/var/log/ksymoops
+/var/log/aide/aide.log(.[0-9])?(.gz)? Databases
+/var/log/aide/error.log(.[0-9])?(.gz)? Databases
+#/var/log/setuid.changes(.[0-9])?(.gz)? Databases
+!/var/log/aide
+/var/log Logs
+# Devices
+!/dev/pts
+# If you get spurious warnings about being unable to mmap() /dev/cpu/mtrr,
+# you may uncomment this to get rid of them. They're harmless but sometimes
+# annoying.
+#!/dev/cpu/mtrr
+#!/dev/xconsole
+/dev Devices
+# Other miscellaneous files
+/var/run$ StaticDir
+!/var/run
+# Test only the directory when dealing with /proc
+/proc$ StaticDir
+!/proc
+
+# You can look through these examples to get further ideas
+
+# MD5 sum files - especially useful with debsums -g
+#/var/lib/dpkg/info/([^\.]+).md5sums u+g+s+m+md5+sha1
+
+# Check crontabs
+#/var/spool/anacron/cron.daily Databases
+#/var/spool/anacron/cron.monthly Databases
+#/var/spool/anacron/cron.weekly Databases
+#/var/spool/cron Databases
+#/var/spool/cron/crontabs Databases
+
+# manpages can be trojaned, especially depending on *roff implementation
+#/usr/man ManPages
+#/usr/share/man ManPages
+#/usr/local/man ManPages
+
+# docs
+#/usr/doc ManPages
+#/usr/share/doc ManPages
+
+# check users' home directories
+#/home Binlib
+
+# check sources for modifications
+#/usr/src L
+#/usr/local/src L
+
+# Check headers for same
+#/usr/include L
+#/usr/local/include L
diff --git a/app-forensics/aide/files/aide.cron b/app-forensics/aide/files/aide.cron
new file mode 100644
index 000000000000..c28b78f8e9db
--- /dev/null
+++ b/app-forensics/aide/files/aide.cron
@@ -0,0 +1,192 @@
+#!/bin/bash
+# Modified: Benjamin Smee
+# Date: Fri Sep 10 11:35:41 BST 2004
+
+# This is the email address reports get mailed to
+MAILTO=root@localhost
+
+# Set this to suppress mailings when there's nothing to report
+QUIETREPORTS=1
+
+# This parameter defines which aide command to run from the cron script.
+# Sensible values are "update" and "check".
+# Default is "check", ensuring backwards compatibility.
+# Since "update" does not take any longer, it is recommended to use "update",
+# so that a new database is created every day. The new database needs to be
+# manually copied over the current one, though.
+COMMAND=update
+
+# This parameter defines how many lines to return per e-mail. Output longer
+# than this value will be truncated in the e-mail sent out.
+LINES=1000
+
+# This parameter gives a grep regular expression. If given, all output lines
+# that _don't_ match the regexp are listed first in the script's output. This
+# allows to easily remove noise from the aide report.
+NOISE="(/var/cache/|/var/lib/|/var/tmp)"
+PATH="/bin:/usr/bin:/sbin:/usr/sbin"
+LOGDIR="/var/log/aide"
+LOGFILE="aide.log"
+CONFFILE="/etc/aide/aide.conf"
+ERRORLOG="aide_error.log"
+MAILLOG="aide_mail.log"
+ERRORTMP=`tempfile --directory "/tmp" --prefix "$ERRORLOG"`
+
+[ -f /usr/bin/aide ] || exit 0
+
+DATABASE=`grep "^database=file:/" $CONFFILE | head -n 1 | cut --delimiter=: --fields=2`
+FQDN=`hostname -f`
+DATE=`date +"at %Y-%m-%d %H:%M"`
+
+# default values
+
+DATABASE="${DATABASE:-/var/lib/aide/aide.db}"
+
+AIDEARGS="-V4"
+
+if [ ! -f $DATABASE ]; then
+ /usr/sbin/sendmail $MAILTO <<EOF
+Subject: Daily AIDE report for $FQDN
+From: root@${FQDN}
+To: ${MAILTO}
+Fatal error: The AIDE database does not exist!
+This may mean you haven't created it, or it may mean that someone has removed it.
+EOF
+ exit 0
+fi
+
+# Removed so no deps on debianutils - strerror
+#[ -f "$LOGDIR/$LOGFILE" ] && savelog -j -t -g adm -m 640 -u root -c 7 "$LOGDIR/$LOGFILE" > /dev/null
+#[ -f "$LOGDIR/$ERRORLOG" ] && savelog -j -t -g adm -m 640 -u root -c 7 "$LOGDIR/$ERRORLOG" > /dev/null
+
+aide $AIDEARGS --$COMMAND >"$LOGDIR/$LOGFILE" 2>"$ERRORTMP"
+RETVAL=$?
+
+if [ -n "$QUIETREPORTS" ] && [ $QUIETREPORTS -a \! -s $LOGDIR/$LOGFILE -a \! -s $ERRORTMP ]; then
+ # Bail now because there was no output and QUIETREPORTS is set
+ exit 0
+fi
+
+MAILTMP=`tempfile --directory "/tmp" --prefix "$MAILLOG"`
+
+(cat << EOF
+This is an automated report generated by the Advanced Intrusion Detection
+Environment on $FQDN ${DATE}.
+
+EOF
+
+# include error log in daily report e-mail
+
+if [ "$RETVAL" != "0" ]; then
+ cat > "$LOGDIR/$ERRORLOG" << EOF
+
+*****************************************************************************
+* aide returned a non-zero exit value *
+*****************************************************************************
+
+EOF
+ echo "exit value is: $RETVAL" >> "$LOGDIR/$ERRORLOG"
+else
+ touch "$LOGDIR/$ERRORLOG"
+fi
+< "$ERRORTMP" cat >> "$LOGDIR/$ERRORLOG"
+rm -f "$ERRORTMP"
+
+if [ -s "$LOGDIR/$ERRORLOG" ]; then
+ errorlines=`wc -l "$LOGDIR/$ERRORLOG" | awk '{ print $1 }'`
+ if [ ${errorlines:=0} -gt $LINES ]; then
+ cat << EOF
+
+****************************************************************************
+* aide has returned many errors. *
+* the error log output has been truncated in this mail *
+****************************************************************************
+
+EOF
+ echo "Error output is $errorlines lines, truncated to $LINES."
+ head -$LINES "$LOGDIR/$ERRORLOG"
+ echo "The full output can be found in $LOGDIR/$ERRORLOG."
+ else
+ echo "Errors produced ($errorlines lines):"
+ cat "$LOGDIR/$ERRORLOG"
+ fi
+else
+ echo "AIDE produced no errors."
+fi
+
+# include de-noised log
+
+if [ -n "$NOISE" ]; then
+ NOISETMP=`tempfile --directory "/tmp" --prefix "aidenoise"`
+ NOISETMP2=`tempfile --directory "/tmp" --prefix "aidenoise"`
+ sed -n '1,/^Detailed information about changes:/p' "$LOGDIR/$LOGFILE" | \
+ grep '^\(changed\|removed\|added\):' | \
+ grep -v "^added: THERE WERE ALSO [0-9]\+ FILES ADDED UNDER THIS DIRECTORY" > $NOISETMP2
+
+ if [ -n "$NOISE" ]; then
+ < $NOISETMP2 grep -v "^\(changed\|removed\|added\):$NOISE" > $NOISETMP
+ rm -f $NOISETMP2
+ echo "De-Noised output removes everything matching $NOISE."
+ else
+ mv $NOISETMP2 $NOISETMP
+ echo "No noise expression was given."
+ fi
+
+ if [ -s "$NOISETMP" ]; then
+ loglines=`< $NOISETMP wc -l | awk '{ print $1 }'`
+ if [ ${loglines:=0} -gt $LINES ]; then
+ cat << EOF
+
+****************************************************************************
+* aide has returned long output which has been truncated in this mail *
+****************************************************************************
+
+EOF
+ echo "De-Noised output is $loglines lines, truncated to $LINES."
+ < $NOISETMP head -$LINES
+ echo "The full output can be found in $LOGDIR/$LOGFILE."
+ else
+ echo "De-Noised output of the daily AIDE run ($loglines lines):"
+ cat $NOISETMP
+ fi
+ else
+ echo "AIDE detected no changes after removing noise."
+ fi
+ rm -f $NOISETMP
+ echo "============================================================================"
+fi
+
+# include non-de-noised log
+
+if [ -s "$LOGDIR/$LOGFILE" ]; then
+ loglines=`wc -l "$LOGDIR/$LOGFILE" | awk '{ print $1 }'`
+ if [ ${loglines:=0} -gt $LINES ]; then
+ cat << EOF
+
+****************************************************************************
+* aide has returned long output which has been truncated in this mail *
+****************************************************************************
+
+EOF
+ echo "Output is $loglines lines, truncated to $LINES."
+ head -$LINES "$LOGDIR/$LOGFILE"
+ echo "The full output can be found in $LOGDIR/$LOGFILE."
+ else
+ echo "Output of the daily AIDE run ($loglines lines):"
+ cat "$LOGDIR/$LOGFILE"
+ fi
+else
+ echo "AIDE detected no changes."
+fi
+) > ${MAILTMP}
+
+(
+cat <<EOF
+Subject: Daily AIDE report for $FQDN
+From: root@${FQDN}
+To: ${MAILTO}
+EOF
+cat ${MAILTMP}
+) | /usr/sbin/sendmail $MAILTO
+
+rm -f "$MAILTMP"
diff --git a/app-forensics/aide/files/aideinit b/app-forensics/aide/files/aideinit
new file mode 100644
index 000000000000..6a3c60c37837
--- /dev/null
+++ b/app-forensics/aide/files/aideinit
@@ -0,0 +1,145 @@
+#!/bin/sh
+# Copyright 2003 Mike Markley <mike@markley.org>
+# This script is free for any purpose whatseoever so long as the above
+# copyright notice remains in place.
+#
+# Modified for Gentoo: Benjamin Smee
+# Date: Fri Sep 10 11:36:04 BST 2004
+
+# This is the email address reports get mailed to
+MAILTO=root@localhost
+
+# Defaults
+#MAILTO="${MAILTO:-root}"
+
+# Options
+opt_f=0
+opt_y=0
+opt_c=0
+opt_b=0
+config="/etc/aide/aide.conf"
+
+aideinit_usage() {
+ echo "Usage: $0 [options] -- [aide options]"
+ echo " -y|--yes Overwrite output file"
+ echo " -f|--force Force overwrite of database"
+ echo " -c|--config Specify alternate config file"
+ echo " -o|--output Specify alternate output file"
+ echo " -d|--database Specify alternate database file"
+ echo " -b|--background Run in the background"
+}
+
+while [ -n "$1" ]; do
+ case "$1" in
+ -h|--help)
+ aideinit_usage
+ exit 0
+ ;;
+ -f|--force)
+ opt_f=1
+ shift
+ ;;
+ -y|--yes)
+ opt_y=1
+ shift
+ ;;
+ -b|--background)
+ opt_b=1
+ shift
+ ;;
+ -o|--output)
+ shift
+ [ -z "$1" ] && aideinit_usage && exit 1
+ outfile=$1
+ shift
+ ;;
+ -d|--database)
+ shift
+ [ -z "$1" ] && aideinit_usage && exit 1
+ dbfile=$1
+ shift
+ ;;
+ -c|--config)
+ opt_c=1
+ shift
+ [ -z "$1" ] && aideinit_usage && exit 1
+ config=$1
+ shift
+ ;;
+ --)
+ shift
+ break 2
+ ;;
+ *)
+ echo "Unknown option $1 (use -- to delimit aideinit and aide options)"
+ exit
+ ;;
+ esac
+done
+
+if [ ! -f "$config" ]; then
+ echo "$0: $config: file not found"
+ exit 1
+fi
+
+if [ -z "$outfile" ]; then
+ outfile=`egrep "database_out=file:" $config | cut -d: -f2`
+ [ -z "$outfile" ] && outfile="/var/lib/aide/aide.db.new"
+fi
+if [ -z "$dbfile" ]; then
+ dbfile=`egrep "database=file:" $config | cut -d: -f2`
+ [ -z "$dbfile" ] && dbfile="/var/lib/aide/aide.db"
+fi
+
+if [ -f $outfile ]; then
+ if [ $opt_y -eq 0 ]; then
+ echo -n "Overwrite existing $outfile [Yn]? "
+ read yn
+ case "$yn" in
+ [Nn]*)
+ exit 0
+ ;;
+ esac
+ fi
+fi
+
+extraflags=""
+
+if [ $opt_c -eq 1 ]; then
+ extraflags="$extraflags --config $config"
+fi
+
+if [ $opt_b -eq 1 ]; then
+ (aide --init $extraflags $@ >/var/log/aide/aideinit.log 2>/var/log/aide/aideinit.errors
+ if [ -f "$dbfile" -a $opt_f -eq 0 ]; then
+ echo "$dbfile exists and -f was not specified" >> /var/log/aide/aideinit.errors
+ fi
+ lines=`wc -l /var/log/aide/aideinit.errors | awk '{ print $1 }'`
+ if [ "$lines" -gt 0 ]; then
+ (echo "AIDE init errors:"; cat /var/log/aide/aideinit.errors) | /bin/mail -s "AIDE initialization problem" $MAILTO
+ else
+ cp -f $outfile $dbfile
+ fi) &
+ exit 0
+fi
+
+echo "Running aide --init..."
+aide --init $extraflags $@
+
+return=$?
+if [ $return -ne 0 ]; then
+ echo "Something didn't quite go right; see $outfile for details" >&2
+ exit $return
+fi
+
+if [ -f "$dbfile" -a $opt_f -eq 0 ]; then
+ echo -n "Overwrite $dbfile [yN]? "
+ read yn
+ case "$yn" in
+ [yY]*)
+ cp -f $outfile $dbfile
+ ;;
+ esac
+else
+ cp -f $outfile $dbfile
+fi
diff --git a/app-forensics/aide/metadata.xml b/app-forensics/aide/metadata.xml
new file mode 100644
index 000000000000..a03a8cb8d7a2
--- /dev/null
+++ b/app-forensics/aide/metadata.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>itumaykin+gentoo@gmail.com</email>
+ <name>Coacher</name>
+ </maintainer>
+ <maintainer type="project">
+ <email>proxy-maint@gentoo.org</email>
+ <name>Proxy Maintainers</name>
+ </maintainer>
+ <use>
+ <flag name="e2fs">Enable support for checking file attributes on ext2/ext3/ext4 filesystems</flag>
+ <flag name="prelink">Bypass prelinking when calculating checksums</flag>
+ </use>
+ <upstream>
+ <remote-id type="sourceforge">aide</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/air/Manifest b/app-forensics/air/Manifest
new file mode 100644
index 000000000000..47c4d5091369
--- /dev/null
+++ b/app-forensics/air/Manifest
@@ -0,0 +1,5 @@
+DIST air-2.0.0.tar.gz 82881 SHA256 4bfabeee1086e0a115c71ca3eaff3bf71976a6bc79bc92ff2478126d1243ad7f SHA512 3b22b0b2f07fd5bf89b576bb1d96d9bc372534f2063e99c7a9c4931fd927b0cc5c3fe832f0c0d51ceb95fe242fd0d3e4fe6bf59339dd2971b6afcd00106ea92c WHIRLPOOL 89c1cfd7d722897c899bbf10ca0ac1f39a0f8c0edf098bdb7fda315f83ff537f2c57fe3c760a05062f254152a76105f253b84da78c8090cc4a2ef16e52716c45
+EBUILD air-2.0.0-r1.ebuild 1412 SHA256 24c2732106f0cca8cd8d45252fbf9d692427ff1e84ba76217310c5fde174bc14 SHA512 ebdf9d91b8dfcc1f729c972670e75a070bfd8c1ac1b130603a2a6e0f0085142162729110b8afc24101ad1dffe23c529654b148c868130508bda528cc6a3a8d08 WHIRLPOOL 11198c74d8f956c9efe954686f66e24732087400532d3ccb0dfce1a006ef7b7a6bf7ed883a6068347eba049b354750a965f00ca2cf08a8ba15a7fd553daed899
+MISC ChangeLog 2798 SHA256 8cc9c4f5af42bb637f17e290ca0753b49cfa77212ffe5526cc0384d8714aedc1 SHA512 e57d022de2840da09ec02c4835e08815b400d76ffcf2cf18f01aa9048de4db4ceedc585f5177376fd405fe6381935ec0a450102897de8756aac1ab2c1c00285d WHIRLPOOL 58e02c1494877ec413d141881704a71412df2966fcb63bd318345124c9671dc705e739f760eb1f07836d39a57b380906c897bd16f566b582b3ff69d6d3aa4996
+MISC ChangeLog-2015 1624 SHA256 b7894b4f9f1837a83d7de553bb47aa3c3e3797b265826abc0b319b64cf5b6cca SHA512 536fee3ed923a9be29a2bf5f03f960d47afc7e7b4c80e8857f90230bfb82f02e6c584ff0e93289a998e0ad3ab0ca3ad5eb6ef76d62d4556698da8c9658bb60c5 WHIRLPOOL 0a99ca8ea8de3758f35b943dd92e2fc5ce3bd2a80b22fdd47e5d59444cb3be1bc7560db737fd11b32e7244f65a8214e7024c29ff4496b2b9a82454bd1e292801
+MISC metadata.xml 247 SHA256 08ebc954aa8d318cb7e06033f5948efcb2f67fd5a76eb28b8694691b38ab70d8 SHA512 0600ce65cfd7da1e2c9a816788c17df8761eda2ebc979d32a6ea5959eff6e8abed700c4e0e73debbce1af3603a521a106f0fa0e6d159baba27d23deb9412161d WHIRLPOOL 7e1e9f61986f6bb0ce548c27c60a5c0e317b9cc6c61edc8c3519251acc821811ffe19e18f89c236d9f24a10b506fb3074ffb7b3c345239f52521ccd459ba2aa0
diff --git a/app-forensics/air/air-2.0.0-r1.ebuild b/app-forensics/air/air-2.0.0-r1.ebuild
new file mode 100644
index 000000000000..6e26ed7c1ab4
--- /dev/null
+++ b/app-forensics/air/air-2.0.0-r1.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="4"
+
+DESCRIPTION="A GUI front-end to dd/dc3dd"
+HOMEPAGE="http://air-imager.sourceforge.net/"
+SRC_URI="mirror://sourceforge/air-imager/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+IUSE="crypt"
+
+# coreutils are needed for /usr/bin/split binary
+COMMON_DEPEND="userland_GNU? ( sys-apps/coreutils )"
+
+DEPEND="${COMMON_DEPEND}
+ >=dev-perl/Tk-804.27.0
+ userland_GNU? ( app-arch/sharutils )"
+
+# TODO: air can utilize dc3dd, but it is not in portage ATM
+RDEPEND="${COMMON_DEPEND}
+ app-arch/mt-st
+ net-analyzer/netcat
+ crypt? ( net-analyzer/cryptcat )"
+
+src_install() {
+ export PERLTK_VER=`perl -e 'use Tk;print "$Tk::VERSION";'`
+
+ env INTERACTIVE=no INSTALL_DIR="${D}/usr" TEMP_DIR="${T}" \
+ FINAL_INSTALL_DIR=/usr \
+ ./install-${P} \
+ || die "failed to install - please attach ${T}/air-install.log to a bug report at https://bugs.gentoo.org"
+
+ dodoc README
+
+ dodoc "${T}/air-install.log"
+
+ fowners root:users /usr/share/air/logs
+ fperms ug+rwx /usr/share/air/logs
+ fperms a+x /usr/bin/air
+
+ mkfifo "${D}usr/share/air/air-fifo" || die "pipe creation failed"
+ fperms ug+rw /usr/share/air/air-fifo
+ fowners root:users /usr/share/air/air-fifo
+}
+
+pkg_postinst() {
+ elog "The author, steve@unixgurus.com, would appreciate an email of the install file /usr/share/doc/${PF}/air-install.log"
+}
diff --git a/app-forensics/air/metadata.xml b/app-forensics/air/metadata.xml
new file mode 100644
index 000000000000..1cc558b0dc3f
--- /dev/null
+++ b/app-forensics/air/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">air-imager</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/autopsy/Manifest b/app-forensics/autopsy/Manifest
new file mode 100644
index 000000000000..9825e56d0f2b
--- /dev/null
+++ b/app-forensics/autopsy/Manifest
@@ -0,0 +1,5 @@
+DIST autopsy-2.24.tar.gz 387873 SHA256 ab787f519942783d43a561d12be0554587f11f22bc55ab79d34d8da703edc09e SHA512 09cd337c2c6e095c533cba449684b36e4a926cbe5736be6da4f644e733525069984550b5b76a902a32d797ac311218a2ec88626603f1dd4381d52f3f94d3cedb WHIRLPOOL 3dbc39cf3a16920f6816b7a0bf50939624d8d4ce455342ba3e6114a3993ffa3df2518612c96c885cad93f59d574994c46056cf8e686d389aebb2005d0d8bc9c7
+EBUILD autopsy-2.24-r1.ebuild 1348 SHA256 3052e348ff22289549b75ddf107ac916778e95855850231a6ca9d3b79f20995e SHA512 62b44121c7adda0e379c284e2d3915c9c2f94d19aa501b85979896ac681772dac42ea10a599145838fcf2926ba12458a58e4060eee7b8ab255667299f472df90 WHIRLPOOL 723ce51a7365d5d69d981bb11a97a5645356dd347446b2d8faa6fec40469e039127d2e02ca6b20a6599b01935fa3ff525b8cd540958d85ea1768942ad4dd6d59
+MISC ChangeLog 2436 SHA256 583f5a605883bb686df1221cd61b2ac6f5b172ae1dd770aa199cb7c7e0b31656 SHA512 281085230a9817f2127239b53605a8451a15f62850c957aa0887e306c70a286a28f5da28f57eb85d75a87ba6803bac363516ac20bd4e1060d590dbbd9fa0d4c4 WHIRLPOOL 013effd060087e1534e5e43f61d6636409c35a6cd27f6ae880f45bad0a5a55adec7a24a509b30481c27cec92d09bd5fd7a39db24d3a7e1cf6a498ceaa949fa44
+MISC ChangeLog-2015 5133 SHA256 3ea147b1c136b9b867b39e44f6ccf94536c9d1830ea2362586fe098b4581c487 SHA512 c7a68aa254bf3d0a3facd565e104fe8fe032c98889ae9a17381c700b88e360fdfb16f17ba9e535acda06d9c9af60fa177a761439eb17ce12f3d18daead6f650f WHIRLPOOL 905265350e60a8b6f4e042f524ddfbf63b29e057708dacbff0f502b4caa749ea0b2ba1d7dad6d262c444ef8a5e93de4d2bf17dc1f89e9c210a4a6b6db9b89c7d
+MISC metadata.xml 244 SHA256 ee4bf5169af53da93f989dc266a7d61ba7b597805908a860b138d68525729fbb SHA512 4fc4a70fe6ed1036680005b53b6871d77a909c482a9187e903336b15ac77905cd6bd2a6f28db3edf2adffbc377906822287a320a409ed4d6cc1743de823e08fb WHIRLPOOL f52d1853b410a0f31f30983ae4ad1f077bc6fa67949932a1b6643a5909579213cf2872723bdfdfb21b1ef787d42f2b53d73e542ba9444fae17febe691b5372a6
diff --git a/app-forensics/autopsy/autopsy-2.24-r1.ebuild b/app-forensics/autopsy/autopsy-2.24-r1.ebuild
new file mode 100644
index 000000000000..c5a3d53c2aa1
--- /dev/null
+++ b/app-forensics/autopsy/autopsy-2.24-r1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+DESCRIPTION="A graphical interface to the digital forensic analysis tools in The Sleuth Kit"
+HOMEPAGE="http://www.sleuthkit.org/autopsy/"
+SRC_URI="mirror://sourceforge/autopsy/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~hppa ppc x86"
+IUSE=""
+
+# Runtime depend on grep and file deliberate
+RDEPEND=">=dev-lang/perl-5.8.0
+ >=app-forensics/sleuthkit-3.0.0
+ sys-apps/grep
+ sys-apps/file"
+DEPEND=""
+
+src_configure() {
+ ./configure 2>&1 >/dev/null <<-EOF
+ n
+ /tmp
+ EOF
+
+ cat <<-EOF > autopsy
+ #!/usr/bin/perl -wT
+ use lib '/usr/lib/autopsy/';
+ use lib '/usr/lib/autopsy/lib/';
+ EOF
+ cat base/autopsy.base >> autopsy
+
+ sed -i 's:conf.pl:/etc/autopsy.pl:' $(grep -lr conf\.pl ./)
+ sed -i "s:INSTALLDIR = .*:INSTALLDIR = \'/usr/lib/autopsy\';:" conf.pl
+}
+
+src_compile() { :; }
+
+src_install() {
+ insinto /usr/lib/autopsy
+ doins autopsy
+ doins global.css
+ insinto /usr/lib/autopsy/help
+ doins help/*
+ insinto /usr/lib/autopsy/lib
+ doins lib/*
+ insinto /usr/lib/autopsy/pict
+ doins pict/*
+ insinto /etc
+ newins conf.pl autopsy.pl
+
+ dodir /usr/bin
+ dosym /usr/lib/autopsy/autopsy /usr/bin/autopsy
+ fperms +x /usr/lib/autopsy/autopsy
+
+ doman $(find man/ -type f)
+ dodoc CHANGES.txt README* TODO.txt docs/sleuthkit-informer*.txt
+}
diff --git a/app-forensics/autopsy/metadata.xml b/app-forensics/autopsy/metadata.xml
new file mode 100644
index 000000000000..93a26a3f58d2
--- /dev/null
+++ b/app-forensics/autopsy/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">autopsy</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/chkrootkit/Manifest b/app-forensics/chkrootkit/Manifest
new file mode 100644
index 000000000000..25111387114e
--- /dev/null
+++ b/app-forensics/chkrootkit/Manifest
@@ -0,0 +1,10 @@
+AUX chkrootkit.cron 78 SHA256 3dfcff479e3b9e1cd79c6a65e0e668750dec0a88b09715d4fdf163c692a22412 SHA512 6839f3372d28673ee436349a107dc33b77cfd676fd16cda1ccfc5211514e840593d0f106e4e0a9331c4b658860992a9169f3a7cdd75c835a780a41097e7bd758 WHIRLPOOL 8814e849f2a1744a1d78a33e4c55521d350c1b38d3ac741d876546c36c3d208fc071df1d19354725dd20bff24bbd2ba7982b975ad2e8a254000da4962d00e163
+DIST chkrootkit-0.50-gentoo.diff.bz2 5010 SHA256 0b29ad086d0c75df6a0826bc8fd9046d5b1086173652af77f01991f367032779 SHA512 067a0a33fad2389a7ef942f76a63bed6c206d08576a77fd758ae171960804fb74d3164bc6eb582f5d8b722e9e863dc4380f5632940bc9a8c1821b46ed1062a50 WHIRLPOOL 4bc08be7be6d566bb2f52ece6c9010967c107696ce924461a4032947f66e848183921232f3f1a971cf6f932cbaad7ac9ce18af765837e3e69f7c0a57b39ceaed
+DIST chkrootkit-0.50.tar.gz 38616 SHA256 9548fc922b0cb8ddf055faff4a4887f140a31c45f2f5e3aa64aad91ecfa56cc7 SHA512 9f26fd34e85b58b13dedc5f38a889ae258bb2c0f1ff40e99c149e23f93890e956f94204b1bb2241584454e99168c53b583f52777083454237f3ba343424dba1c WHIRLPOOL d6c6afe6a14e5a9a0331202b894ed5c3e43855e15605cc9a6cbf69dbd09f180754ee587cf4eba88cb0ceb4d7fcd9924f4f02110154450fd06e992fc1710b91d8
+DIST chkrootkit-0.51-gentoo.diff.xz 4708 SHA256 150ea7a343d93382be286ea649be2b6a0784be98da1757b86a30fe1ed1ee06f0 SHA512 13dca9c272d85d35d736e14896058612f62e1781aac034f06882fe63d956f074a3c67bf308c104f0080323bb127ba01373967b2c28481741d17d83310fe52dd0 WHIRLPOOL fa7a33fbca05f778ad2cc3694f93e04ee6b24f822f03e79ef0bb7c33049a447aac389ade66edecc8d6f79301c225573e50c465ca075a23e5c44904f817f97f10
+DIST chkrootkit-0.51.tar 174080 SHA256 d262b6c0292399c409a5d70f5a5646c76f5612c3bf416e4e21ba6cdecf9ae7c5 SHA512 adef6823d069b32305605d0eaa3d3701c6a87900646d9509cebe0fd8a2fec0523595d0dcb4576b32245e7638388d3b43858dbc42be68de9971ac8461fcfdeb34 WHIRLPOOL 9a379c73ced0eb5cf679cd99514d41b85a685b9cf54c23d7c682f5020b49d35c7bd79c01d0b029420dfaddd3a1de4a8765832879bc8ba9525f9dce30e9274e6c
+EBUILD chkrootkit-0.50.ebuild 1237 SHA256 7c14f5d862908bde29b20896419ee70e4047cb743920d10955f0696adc50ff56 SHA512 9700c79624724a90d50949f31e19f76c03168b8abf512281f5f8d7f4aaa3984053b764f03280fb5c9cda1adc360c156cd1ffba8799976d57e815bd60c4cf215a WHIRLPOOL 140cca6c3f4d3de2f61215062c81008fbcc75e800053f5250a1fc353bb1d393decd9ce52a5b3c0d21e7ec2b6c797368c12988500a4956273e3c3e725610bb127
+EBUILD chkrootkit-0.51.ebuild 1336 SHA256 cbe0c3250cd7c9c03fa37daebfa3eab1af67825d122e8844e2be20b134c262fa SHA512 9e41364caf66facb0c100e39d40d97fb835a01d72c9d5d3ec5bdaf399dd8beec4a6334b0303eca23dbc3f23e552422c8eef53995762f0700d7df20fd69254ca9 WHIRLPOOL 0b7b9d7a84f92eaabce0764f30f1bfdc6333e6ff646e730f18046b34855e953b8fa3c31b319986b8b7c129a33453ccf450cc2606024e05a406d0a896933c89fa
+MISC ChangeLog 5086 SHA256 822eb35bbc3ccc9a9a06144d43bc5da07ea521e94506fd9dc6c67c44930b556e SHA512 1bd974b36b98bbbbc61362a759589adc6cecc94bf74c7f77a57bbfffd5c1f3ae59de67354d88930b1ca68f2c1633fce825816d08848695d2df52cb2d1a9bd286 WHIRLPOOL 47610e56d66d1267e92cbdfa89995f8287e3e34154d3e135960a68f412d0490392f13f4a102f859a2dcb35385d022c2f1daef20c840030be22b173816b1fdf68
+MISC ChangeLog-2015 15278 SHA256 01598bae28a1fd2249b7ea2e533fb74f8397200360cd94cc6a5e3b0213089635 SHA512 27270622a7fa4346f756226095cf41503d005d8b460f5e7315859fd66a37fbc0f290c4e2df093b1024f64d5af22581bbed7de3eaaafd1ef8a491b41e7fe73739 WHIRLPOOL 037d90b3cf55a0051746e30140b3590a93f867fe8eb0c7830ae7f513041152ac5f7867ca1e563adbdd9180bf3b788d94c5d7e07115e1cec3613ada13957a2dfd
+MISC metadata.xml 254 SHA256 84dee6d499237b0393493e8d049d84146405d89060b6512e895753e89664d2f5 SHA512 f0b5ba232a76e933dd34a7e3e7fa04e627de0201610166f4758c5ccf888f509815b5cc39f5373b87a413496318f507bf28599ec0995d32bde98a7c65287d39bb WHIRLPOOL 238d9cd39184428fdc656826bfd21b581c2aa931ae17cddeb7082b3c5f1d859a8187abba047344e32125cc6de557099ff1a0a6e4d69720cd6e004325dfac6775
diff --git a/app-forensics/chkrootkit/chkrootkit-0.50.ebuild b/app-forensics/chkrootkit/chkrootkit-0.50.ebuild
new file mode 100644
index 000000000000..5c44abd63000
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.50.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Tool to locally check for signs of a rootkit"
+HOMEPAGE="http://www.chkrootkit.org/"
+SRC_URI="ftp://ftp.pangeia.com.br/pub/seg/pac/${P}.tar.gz
+ https://dev.gentoo.org/~xmw/${P}-gentoo.diff.bz2"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="alpha amd64 arm ~hppa ia64 ~mips ppc ppc64 ~s390 ~sh sparc x86"
+IUSE="+cron"
+
+RDEPEND="cron? ( virtual/cron )"
+
+src_prepare() {
+ epatch "${WORKDIR}"/${P}-gentoo.diff
+ sed -e 's:/var/adm/:/var/log/:g' \
+ -i chklastlog.c || die
+}
+
+src_compile() {
+ emake CC="$(tc-getCC)" STRIP=true sense
+}
+
+src_install() {
+ dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc strings-static
+ dodoc ACKNOWLEDGMENTS README*
+
+ if use cron ; then
+ exeinto /etc/cron.weekly
+ newexe "${FILESDIR}"/${PN}.cron ${PN}
+ fi
+}
+
+pkg_postinst() {
+ if use cron ; then
+ elog
+ elog "Edit /etc/cron.weekly/chkrootkit to activate chkrootkit!"
+ elog
+ fi
+
+ elog
+ elog "Some applications, such as portsentry, will cause chkrootkit"
+ elog "to produce false positives. Read the chkrootkit FAQ at"
+ elog "http://www.chkrootkit.org/ for more information."
+ elog
+}
diff --git a/app-forensics/chkrootkit/chkrootkit-0.51.ebuild b/app-forensics/chkrootkit/chkrootkit-0.51.ebuild
new file mode 100644
index 000000000000..c869d9e7709e
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.51.ebuild
@@ -0,0 +1,57 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Tool to locally check for signs of a rootkit"
+HOMEPAGE="http://www.chkrootkit.org/"
+# Upstream named their *uncompressed* tarball .tar.gz (*sigh*)
+SRC_URI="ftp://ftp.pangeia.com.br/pub/seg/pac/${P}.tar.gz -> ${P}.tar
+ https://dev.gentoo.org/~polynomial-c/${P}-gentoo.diff.xz"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="alpha ~amd64 arm ~hppa ia64 ~mips ppc ppc64 ~s390 ~sh ~sparc ~x86"
+IUSE="+cron"
+
+RDEPEND="cron? ( virtual/cron )"
+
+PATCHES=(
+ "${WORKDIR}"/${P}-gentoo.diff
+)
+
+src_prepare() {
+ default
+ sed -e 's:/var/adm/:/var/log/:g' \
+ -i chklastlog.c || die
+}
+
+src_compile() {
+ emake CC="$(tc-getCC)" STRIP=true sense
+}
+
+src_install() {
+ dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc strings-static
+ dodoc ACKNOWLEDGMENTS README*
+
+ if use cron ; then
+ exeinto /etc/cron.weekly
+ newexe "${FILESDIR}"/${PN}.cron ${PN}
+ fi
+}
+
+pkg_postinst() {
+ if use cron ; then
+ elog
+ elog "Edit /etc/cron.weekly/chkrootkit to activate chkrootkit!"
+ elog
+ fi
+
+ elog
+ elog "Some applications, such as portsentry, will cause chkrootkit"
+ elog "to produce false positives. Read the chkrootkit FAQ at"
+ elog "http://www.chkrootkit.org/ for more information."
+ elog
+}
diff --git a/app-forensics/chkrootkit/files/chkrootkit.cron b/app-forensics/chkrootkit/files/chkrootkit.cron
new file mode 100644
index 000000000000..9f7eb17b13b1
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit.cron
@@ -0,0 +1,6 @@
+#!/bin/sh
+#
+# uncomment this to make it work
+#
+
+#exec /usr/sbin/chkrootkit -q
diff --git a/app-forensics/chkrootkit/metadata.xml b/app-forensics/chkrootkit/metadata.xml
new file mode 100644
index 000000000000..e02dd379868e
--- /dev/null
+++ b/app-forensics/chkrootkit/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <use>
+ <flag name="cron">Install cron script for weekly rootkit scans</flag>
+ </use>
+</pkgmetadata>
diff --git a/app-forensics/cmospwd/Manifest b/app-forensics/cmospwd/Manifest
new file mode 100644
index 000000000000..f9134a7b6b9c
--- /dev/null
+++ b/app-forensics/cmospwd/Manifest
@@ -0,0 +1,5 @@
+DIST cmospwd-5.1.tar.bz2 36792 SHA256 f296d2979794b0a6b726b80afc92e4d059c65dc2612a4b09377c168833d862f4 SHA512 eb76bbab2e686b54421556c5228b90a35c2883d59b31815ab04494df8e2d03e7193abdd83c4a7fa5915abdff1f189eb69bd29fc02ea9d84565ea8767e2c455a8 WHIRLPOOL 36cc687951d0bb2fd329b70984936aca0ca024b208418643af88e24d737cadb7810c7676db21274942e0f11662beb1e4e2a3fe981fbe0adc5986817ea44beda3
+EBUILD cmospwd-5.1.ebuild 523 SHA256 29efbeb8000127e70b2e06b57ef4aebe2a07377e2cb6e29647926541f8df0d28 SHA512 5ec19956ad8ba47f5c9e1b9444bf15cb0573a92f04b32fa9efe853bf77591a077f63c286509d527190f6e2ecf2334155b5362b8bdfe4e2db16b0199b5a9c3d5d WHIRLPOOL 46fd39928fc2fcf60d3925cb9da9d0e8eba91ba146cc75962619e432764237ae03bda57aea95561976efd2d0e845e7c8ab4610e56d3824894365973d43d3764b
+MISC ChangeLog 2428 SHA256 f697d9e7824879973d1a99de54e5088f3c5fdcb53f0d46170f1dc6fe39f5c4de SHA512 6bd695993613dc1047d44cacccfda91217824313d5e8c1a589a2a72a3fbdb1fd42c4b3b352b39f45e68d6bb81acb9004cdc6bea271b0b33e83de8059b493266c WHIRLPOOL 8c1124134973040eef7f994b758771e9a94d5a9a65cda9182908ed9217021640fbbd1e28f1a20e706349b7080edcfa76cb23850e5393a9314ee2fe5d2dbbd997
+MISC ChangeLog-2015 2430 SHA256 8734d852404e4730de55c72eded4ed3274f4429a5bebd31ba3e3a661ac25f83a SHA512 741c54aa3bff037ab8bcd23aca2e9e05e7721b0c689c85668fc50f516c7add87d3ab6b1bf759092f634ad36c99f8332c457c498a50df6a6bc2a8abf0443bcf25 WHIRLPOOL bab6fd8b5ed5618944faa3033fc1c312e8d9a76f20496ee8efd32942dc88bdab18f8dc6447ccea5af6be3bcbe61e77e74d3011d7c2e35de6223aac29406a93b3
+MISC metadata.xml 676 SHA256 08cffcab9932b881452374c05db47f8200fad2e2423497715d8cf592d17c9efc SHA512 7fe99d46ce3dbd12d818f057cff609b2c5ee7d5cfda2a1cc4c7df072d0ea51592f9d1e38775c64384dcb6a9291468dbf6e8fbd5cc7f274372cc2d863e25a98dd WHIRLPOOL 8f30f56aec87ae8a690ff26760991fa7a16cdab0c2c0f129d0af0e66631535ef01d0df912b7edc1cf203bf8b2fecffa60fb102032b50821279e87f81f807445c
diff --git a/app-forensics/cmospwd/cmospwd-5.1.ebuild b/app-forensics/cmospwd/cmospwd-5.1.ebuild
new file mode 100644
index 000000000000..1fbc8925130b
--- /dev/null
+++ b/app-forensics/cmospwd/cmospwd-5.1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2011 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit toolchain-funcs
+
+DESCRIPTION="CmosPwd decrypts password stored in cmos used to access BIOS SETUP"
+HOMEPAGE="http://www.cgsecurity.org/wiki/CmosPwd"
+SRC_URI="http://www.cgsecurity.org/${P}.tar.bz2"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 x86"
+IUSE=""
+
+src_compile() {
+ cd src
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} cmospwd.c -o cmospwd || die
+}
+
+src_install() {
+ dosbin src/cmospwd
+ dodoc cmospwd.txt
+}
diff --git a/app-forensics/cmospwd/metadata.xml b/app-forensics/cmospwd/metadata.xml
new file mode 100644
index 000000000000..b3084fc2451f
--- /dev/null
+++ b/app-forensics/cmospwd/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <longdescription>
+ CmosPwd decrypts password stored in cmos used to access BIOS SETUP.
+
+ Works with the following BIOSes
+ - ACER/IBM BIOS
+ - AMI BIOS
+ - AMI WinBIOS 2.5
+ - Award 4.5x/4.6x/6.0
+ - Compaq (1992)
+ - Compaq (New version)
+ - IBM (PS/2, Activa, Thinkpad)
+ - Packard Bell
+ - Phoenix 1.00.09.AC0 (1994), a486 1.03, 1.04, 1.10 A03, 4.05 rev 1.02.943, 4.06 rev 1.13.1107
+ - Phoenix 4 release 6 (User)
+ - Gateway Solo - Phoenix 4.0 release 6
+ - Toshiba
+ - Zenith AMI
+ </longdescription>
+</pkgmetadata>
diff --git a/app-forensics/dfxml/Manifest b/app-forensics/dfxml/Manifest
new file mode 100644
index 000000000000..61a62b134bc9
--- /dev/null
+++ b/app-forensics/dfxml/Manifest
@@ -0,0 +1,4 @@
+DIST dfxml-20170921.tar.gz 163616 SHA256 f24bd6c149d07f9ed1089fc25afdab2451f6615e57d5f25529e8d2a59989bc18 SHA512 0885947aaf8efe639c13324413ef0cca49750027b48b434f226fb9fbfba494e84e245da879dc0d77b46bddc27798f7f5df12590fce47b096683034bbc61280e1 WHIRLPOOL b693966c0da1b228415b1416cd3a7a3c25212d0c29839054739aa3fb821a9b429166d8be3e1c58bdcacdacc25fc2c9664e3aadc8aa40c060ec11fc7ca865145d
+EBUILD dfxml-20170921-r1.ebuild 555 SHA256 272194b55463f9086e9b0c7bd54b12cd151b00da6f37a43ce0f31e275730f29e SHA512 3384ca43efe1ee71aa3b0a929529fb7f6a47039c59a071aaafbd88315e42b028fb9b7761bbcf1148dc5febe5c2709bfc2a5ba4a7a2008311e8f1d01eb91d65bb WHIRLPOOL a413a00dcf67f35d12dfa3ed137b1fc30f39eddf08145e678cdfac85329708709a5388dbf1f5d0098b88848cc836bf0de7a51aeb6f93a7210ea9281ae5558818
+EBUILD dfxml-99999999.ebuild 404 SHA256 255da51e93c1a33e89504ca538a534fcbd41a2316e8470ef63d69b6778090996 SHA512 21a708c18dea5c7b3fa2ab13a2d3a8fea19242b0c696a7aed796c25be6948ffba8e3eaaa0ff824a8b2581f09e8960e6a49640aa2566dd1ff0f600e5db71ee2ac WHIRLPOOL eeb805576666d6b8b00cb202f2ee921562385e675c97b83002f8b42b22ebf15d7314e3711cd83306c40f4b3ff7a3eded7faf907da7a2c3487a8d5e5773b9cb19
+MISC metadata.xml 214 SHA256 37f251a604d2d29785adab3452bf5bc84f69290acb51437b7645deba4160acc1 SHA512 7a44c566c4d93dfca459487b5ccf51b49f02d11f56e766442953c12db49cf45fdf6aa12089e0a52b6942ea7adadcc90fc7814fc02f6ada5a0e91831e1a44149e WHIRLPOOL d4efb83e38518d851a423974ab7d8c966bdee171d7a78c66cc44321c793e8a91e32b54602aed90d34150728df47c6c2da86f085e6f470e74788dd40e9a04c282
diff --git a/app-forensics/dfxml/dfxml-20170921-r1.ebuild b/app-forensics/dfxml/dfxml-20170921-r1.ebuild
new file mode 100644
index 000000000000..d291bbf43c4d
--- /dev/null
+++ b/app-forensics/dfxml/dfxml-20170921-r1.ebuild
@@ -0,0 +1,33 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools
+
+DESCRIPTION="Digital Forensics XML"
+HOMEPAGE="https://github.com/simsong/dfxml"
+SRC_URI="https://api.github.com/repos/simsong/${PN}/tarball/7d11eaa7da8d31f588ce8aecb4b4f5e7e8169ba6 -> ${P}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS="~amd64"
+
+DEPEND="
+ dev-libs/expat
+"
+RDEPEND="
+ ${DEPEND}
+"
+
+S=${WORKDIR}/${P}/src
+
+src_unpack() {
+ unpack ${A}
+ mv simsong-dfxml-* ${P} || die
+}
+
+src_prepare() {
+ default
+
+ eautoreconf
+}
diff --git a/app-forensics/dfxml/dfxml-99999999.ebuild b/app-forensics/dfxml/dfxml-99999999.ebuild
new file mode 100644
index 000000000000..2acea0ac8a0b
--- /dev/null
+++ b/app-forensics/dfxml/dfxml-99999999.ebuild
@@ -0,0 +1,28 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+inherit autotools git-r3
+
+DESCRIPTION="Digital Forensics XML"
+HOMEPAGE="https://github.com/simsong/dfxml"
+EGIT_REPO_URI="${HOMEPAGE}"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS=""
+
+DEPEND="
+ dev-libs/expat
+"
+RDEPEND="
+ ${DEPEND}
+"
+
+S=${WORKDIR}/${P}/src
+
+src_prepare() {
+ default
+
+ eautoreconf
+}
diff --git a/app-forensics/dfxml/metadata.xml b/app-forensics/dfxml/metadata.xml
new file mode 100644
index 000000000000..825589988b40
--- /dev/null
+++ b/app-forensics/dfxml/metadata.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<maintainer type="project">
+<email>netmon@gentoo.org</email>
+</maintainer>
+</pkgmetadata>
diff --git a/app-forensics/examiner/Manifest b/app-forensics/examiner/Manifest
new file mode 100644
index 000000000000..500005cbece5
--- /dev/null
+++ b/app-forensics/examiner/Manifest
@@ -0,0 +1,6 @@
+AUX examiner-0.5-perl.patch 793 SHA256 aae5d630081e542856ee5e36fd8cfc34bd2b04200ae392091dfd40f38b0c239a SHA512 a7b5055fbf37a114f6116a85419cc21d4792d78dd1a32abf0f6b6819187404bbcf7473ca1cce067da2fb7334e23131e268c948c8f7ea3c9d58d0f8ab97ebd951 WHIRLPOOL fa3314edcf0494c2e38a72538f819d9cf569dbd23582268490d73cab64047250958372e5ece4beb01baf520e56a2f40ceab76cc9bf1416727eae5b4174a725f2
+DIST examiner-0.5.tar.gz 34286 SHA256 720695f6b816eadb02a2a714f47ff6218a137f5116c5dc3c227fb6c198669cba SHA512 d10866f654e19e1c69e28488e39828026af65201fadb56cbed01a7fbab51069fe93476c6108927d042322ac8d15bb249f911acc412aad94985b4030c6c7e6d6b WHIRLPOOL aa238536d94dbbef9b8b5b8cc51d3d2c35beaa08d9134c3a14b33c23583e1cf662d0b359e23238ba298a93e09504abec06714b19466391f9623e613b16d7517a
+EBUILD examiner-0.5-r2.ebuild 876 SHA256 fb856b5bed9b1fe4bd8a2f6d3e065d20ea55232d07a5edc75c14bea929d0bb7d SHA512 765251c3fb18b98d354fb28fdac7bd2fd1e90fc4d9f795ec23dfaaf8fee7cb24c72ab01f977f661c3903a41c48160871812e444b5e26c7334e2b17c7782f59a2 WHIRLPOOL 9593673d5b38a5da7600619d705ddffae9503c108cfe455d4f36177b6bd5abda2df9919bb02e5734a33e91753cdcc329f38ced47ede062691b7ab2682c568648
+MISC ChangeLog 2469 SHA256 05893b4d3446041a49fa4a9e6cb3029c1a5f09d79a8a7ead8b111763d9a11760 SHA512 017e100797d546c9ce48cf6cf1b4ee0886ac0400f70f3dd1c03641f2e467db1ef6e3e47020e713f9b5c9e4488b6a621bad06aa1d542646e94a16b35cde518d3e WHIRLPOOL 405afff3b2d1cb8bee7627b048c5253283e3c97e0c10bf277b4dfb3b8541041f9eed7fcf2bf6762eebf8bb0804daf7ad1e5784e6635958f99298b9e22260bec4
+MISC ChangeLog-2015 2088 SHA256 8ed3c91c06ff7b5ec9c4b47dddd4cfc9c7cbd4b8508779bc61883f6647930516 SHA512 66c6d52f85684ebc553e785dcc016b2b352d4bfc9cb8cfc68980a527b1d789d40b7988af2d4f5084ce1a6bf53a7abee20b53903268cb3cacd63d174d8c25be1c WHIRLPOOL 08a3a985982ef7c03553a82fdbd5af3533035d9651f40f0b7805f8c712266940eeaa7c8116ab975b475936fb823d4c98256a99665e868b08ea53801a364c212b
+MISC metadata.xml 167 SHA256 5fe493e76bba84455c54b3a46adfae5a1bfe01c764ef0d9e5f6d3e8a1d142188 SHA512 7c8decb24ee3a850e38186cf3c7f8933a28017426806870ad6ef9ceb2533be147a2681fc789b535a81cb528af8c29d90d3006e4f250aee23bd7dea4561294e33 WHIRLPOOL dc6c3dfc7fd7f0d76c97f0786cb76a55b8564f8437f96d4ccebf985817b9f6dcc4c61830aa5df80d725e4a54b281ea2e03d6b0859214af081112cba15025e64b
diff --git a/app-forensics/examiner/examiner-0.5-r2.ebuild b/app-forensics/examiner/examiner-0.5-r2.ebuild
new file mode 100644
index 000000000000..f5aaa67ee8e3
--- /dev/null
+++ b/app-forensics/examiner/examiner-0.5-r2.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="4"
+
+inherit eutils
+
+DESCRIPTION="Utilizes the objdump command to disassemble and comment foreign binaries"
+HOMEPAGE="http://www.academicunderground.org/examiner/"
+SRC_URI="http://www.academicunderground.org/examiner/${P}.tar.gz"
+SLOT="0"
+LICENSE="GPL-2"
+KEYWORDS="amd64 ppc x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="dev-lang/perl"
+
+src_prepare() {
+ # Do not install docs through Makefile wrt bug #241256
+ sed -i -e '/$(DOC)/d' Makefile || die 'sed failed'
+ epatch "${FILESDIR}"/${P}-perl.patch
+}
+
+src_compile() { :; }
+
+src_install() {
+ dodir /usr/bin /usr/share/${PN} /usr/share/man/man1
+
+ emake \
+ MAN="${D}/usr/share/man/man1" \
+ BIN="${D}/usr/bin" \
+ SHARE="${D}/usr/share/examiner" \
+ install
+
+ dodoc docs/{README*,BUGS,CHANGELOG,TODO,TUTORIAL}
+ dodoc -r utils
+}
diff --git a/app-forensics/examiner/files/examiner-0.5-perl.patch b/app-forensics/examiner/files/examiner-0.5-perl.patch
new file mode 100644
index 000000000000..ee24bfd9c079
--- /dev/null
+++ b/app-forensics/examiner/files/examiner-0.5-perl.patch
@@ -0,0 +1,38 @@
+--- ./os/linux/examiner_hashes.pl.orig 2005-05-22 10:39:56.000000000 +1000
++++ ./os/linux/examiner_hashes.pl 2005-05-22 10:40:11.000000000 +1000
+@@ -1,6 +1,6 @@
+ $loaded_library=1;
+
+-syscalls = (
++$syscalls = (
+ 1 => "exit",
+ 2 => "fork",
+ 3 => "read",
+@@ -240,7 +240,7 @@
+ 237 => "fremovexattr",
+ );
+
+-socketcall = (
++$socketcall = (
+ 1 => "SOCKET",
+ 2 => "BIND",
+ 3 => "CONNECT",
+--- os/bsd/examiner_hashes.pl.orig 2005-05-22 10:45:39.000000000 +1000
++++ os/bsd/examiner_hashes.pl 2005-05-22 10:45:58.000000000 +1000
+@@ -1,6 +1,6 @@
+ $loaded_library=1;
+
+-syscalls = (
++$syscalls = (
+ 1 => "exit",
+ 2 => "fork",
+ 3 => "read",
+@@ -186,7 +186,7 @@
+ 281 => "MAXSYSCALL",
+ );
+
+-socketcall = (
++$socketcall = (
+ 1 => "SOCKET",
+ 2 => "BIND",
+ 3 => "CONNECT",
diff --git a/app-forensics/examiner/metadata.xml b/app-forensics/examiner/metadata.xml
new file mode 100644
index 000000000000..7a38bb900964
--- /dev/null
+++ b/app-forensics/examiner/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+</pkgmetadata>
diff --git a/app-forensics/foremost/Manifest b/app-forensics/foremost/Manifest
new file mode 100644
index 000000000000..f2deffb5a9e0
--- /dev/null
+++ b/app-forensics/foremost/Manifest
@@ -0,0 +1,10 @@
+AUX foremost-1.4-config-location.patch 462 SHA256 43052e257b77f410e9c3594827612c6cc4805f5758d70e87a225856ca04d2932 SHA512 7b6dcc18cba4676ef4d54b87c9c31747754ecbebd9424340b2dd059495c9c6cec11513307fff802a336a99bc07c4bcd2ffcfad1c77ccdc49277ef7e40e30029e WHIRLPOOL 542c831ec2c76f6b19cd3128c21cd38ec4e822e5a5277278b75239cdef9f54c75796b1323eab7eff87cc9313386e5302e5bbe585f980edac023752c6438ee789
+AUX foremost-1.5.7-format-security.patch 680 SHA256 5e28cbc516e0b4ce959ec9ed42c35c55e9d6ad9d1eceb19bbf39ec81b885e5f2 SHA512 1c28ed1fceedec728a5060b195214fd3ec3b0fa529e87f7421ee72d73f71ecc0d48a69a5b5ff4c6179dd65781552fbd272437134498ec865bd5c620375b6f85b WHIRLPOOL 0987d9acda8a0f68e60fbca77dd50fc6756765e05af21f9270641410add430cb332010ef3f024c073ff7f50836e03023c83ce1ea1dc450445f01a819624022a9
+DIST foremost-0.69.tar.gz 27719 SHA256 de807aaf2ffb71d9d7ec296f66781aa5e426d2ae186a100a00ceedb0cd30ae03 SHA512 3d25e62995f7da0e47ffbd9b90ac2d1a6a870ae0e310eb46b8332e914372008c44abe6ef504f875de60d22cfdfac439e53ec65d7cae255d4a989ee9cfa1020b6 WHIRLPOOL 6435cb6fcdb89add7179910a707a52d89052db67daae58a18b754c6983420bdfcbb00219eb4d3e0684c290b0d9976a71c5a216f56a55fa93963ce91e83fcf6c0
+DIST foremost-1.5.7.tar.gz 52352 SHA256 502054ef212e3d90b292e99c7f7ac91f89f024720cd5a7e7680c3d1901ef5f34 SHA512 8827c29d52496783be26374f3943eb26a154d842f34e50fb489f87b3a5045bf85f1e44d7d8d8b12b2355ba3fe4b06a0db979cc22c0f431593c5976001eb931ab WHIRLPOOL 85224ce66845d01560810da3522d74d19ade08ac516b48ccac86892749e26c3bf464fe82abf30fd65f8d85b0712ba10d4c807084359c594e059a06752899b941
+EBUILD foremost-0.69.ebuild 588 SHA256 fe69fe6a9c939efa2a58036c1fabce3b48ec4c1aba8cac913c1f6645ba16a2f0 SHA512 9cdab48fdd07a34c81e891eefa22e14154c11937fe49a36a46ab5e087f138ef368dcb333d8660efb45ac1fdf962f497d340edf069934b850d26bebf542850d5c WHIRLPOOL b3ae8e2ab8d3bcdb15a92febfa4e1e594b777b6c87e82bc7fc9cb1d85e20f0ee9088026c81a4be5a5f46df5ce116a8b19ed63259b17f1e0c403b3f401d270580
+EBUILD foremost-1.5.7-r2.ebuild 847 SHA256 9d13e4196e7b7f22e5bb825dee1f8bd58e1563abc0eb5b57817b7d2aaad6d1d5 SHA512 470fc501414f9a6144910af890f9d7f6aa5f948e16b2a3dc3328c54d85490e82a94416f747b7b6c12ab6a00951405938e90a242fc52912fb5d766b071a76b28f WHIRLPOOL 25ad3ac3ed0798072075bb1216adfdf135337d7be1a13addc351ffba16f6e88795c4d43f8272b1107a225bd303eca5a579aca3eff2b5d3fa662b625fc73af8f7
+EBUILD foremost-1.5.7-r3.ebuild 890 SHA256 5771e4ea740aac58796bfb1ac1e1a7d8ab592b44a6ee834af02e844f608b5f3c SHA512 78967f04824c614d2830bbd0f3eef392ddc59e6cc0c634011bcfa9a12116f47f8a6b04b3b1586122572a89682ae739ff124fde07731b1dd4eb279a070effb496 WHIRLPOOL c04019cb9ca7cfec524fc6d15487a0c0017985fcb195730f7b6be55e842a90ef6c1d2448327ccfc90250b7f3c5db5a34b74ea2a614e1913c12c42c8f912ac3db
+MISC ChangeLog 3191 SHA256 021598bc680ab1ae264960ad092991607b54b8656dd7f1a739656a907d3ce3bf SHA512 2b8834b5759b9b3bfdf20e8db2261e3ec7c62cd4a82d6f071d4e139f459a75cbaf44008e3cde996cc4966a8cb9c8ac2d9828e32b42624c550b56eeb5709eb2d2 WHIRLPOOL 37a015d1606ee8709c32d2164a10fb02ada2636b3fbf0566a8a5bd9f83fa481484dbc83b38f675b9a595783c7ac35ef1aba7164afec72e5c10626de33df7e6c1
+MISC ChangeLog-2015 4693 SHA256 b86c90ddc9d2768aac9c5f90b667563783bc195cd908e688df7af44451d50b39 SHA512 3fb7a92ebd4cb540e5e2739430743930999ad671a30e54f0467b063640a31411ae2c8fc7df3d40a4b5aa0a8df826bcd08d93f3efe2a1e772f7b698961e44a861 WHIRLPOOL 9cbe2a6160e437fe602c6038fcb5fda115dfeb20c296a364e12ab1398880f20579a67e4fc070cb5eef96c8c8675b5b74768bbf449f208815d90d375cb47109fc
+MISC metadata.xml 303 SHA256 69eb222d81e08cf7744a61cb973798b647bbc96ca098475c1444dd1950e9f890 SHA512 165c108232c3a65d3fbeb0fb2f612c7c4c4c16a57e4b3e280c4ef40d6a586b56df437454283ff5b52fa3a0880d9643682493b3d75cac01170edab53bb5f1ce52 WHIRLPOOL d0c71fb5201e83cee3cfc7e13ea4cf7ed22c5f97eab7aa1e168059f44771822577f43e4fb376ced2f8a7172f83f990378787c3739e7d0af6142a96852e8df467
diff --git a/app-forensics/foremost/files/foremost-1.4-config-location.patch b/app-forensics/foremost/files/foremost-1.4-config-location.patch
new file mode 100644
index 000000000000..95372e1af9c0
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.4-config-location.patch
@@ -0,0 +1,12 @@
+diff -uNr foremost-1.4.orig/config.c foremost-1.4/config.c
+--- foremost-1.4.orig/config.c 2006-08-31 17:50:47.000000000 +0100
++++ foremost-1.4/config.c 2006-08-31 17:51:09.000000000 +0100
+@@ -288,7 +288,7 @@
+ #ifdef __WIN32
+ set_config_file(s, "/Program Files/foremost/foremost.conf");
+ #else
+- set_config_file(s, "/usr/local/etc/foremost.conf");
++ set_config_file(s, "/etc/foremost.conf");
+ #endif
+ if ((f = fopen(get_config_file(s), "r")) == NULL)
+ {
diff --git a/app-forensics/foremost/files/foremost-1.5.7-format-security.patch b/app-forensics/foremost/files/foremost-1.5.7-format-security.patch
new file mode 100644
index 000000000000..32d1a4d3c7f6
--- /dev/null
+++ b/app-forensics/foremost/files/foremost-1.5.7-format-security.patch
@@ -0,0 +1,22 @@
+diff --git a/extract.c b/extract.c
+index 30bdf54..9639117 100755
+--- a/extract.c
++++ b/extract.c
+@@ -2110,7 +2110,6 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ int i = 0;
+ time_t compile_time = 0;
+ struct tm *ret_time;
+- char comment[32];
+ char ascii_time[32];
+
+ if (buflen < 100)
+@@ -2145,8 +2144,7 @@ unsigned char *extract_exe(f_state *s, u_int64_t c_offset, unsigned char *founda
+ ret_time->tm_sec);
+ chop(ascii_time);
+
+- sprintf(comment, ascii_time);
+- strcat(needle->comment, comment);
++ strcat(needle->comment, ascii_time);
+ exe_char = htos(&foundat[22], FOREMOST_LITTLE_ENDIAN);
+ if (exe_char & 0x2000)
+ {
diff --git a/app-forensics/foremost/foremost-0.69.ebuild b/app-forensics/foremost/foremost-0.69.ebuild
new file mode 100644
index 000000000000..e24f7fa122b3
--- /dev/null
+++ b/app-forensics/foremost/foremost-0.69.ebuild
@@ -0,0 +1,23 @@
+# Copyright 1999-2009 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+inherit toolchain-funcs
+
+DESCRIPTION="A console program to recover files based on their headers and footers"
+HOMEPAGE="http://foremost.sourceforge.net/"
+SRC_URI="http://foremost.sourceforge.net/pkg/${P}.tar.gz"
+
+KEYWORDS="~amd64 ppc x86"
+IUSE=""
+LICENSE="public-domain"
+SLOT="0"
+
+src_compile() {
+ emake CC_OPTS="${CFLAGS}" CC="$(tc-getCC)" || die "emake failed"
+}
+
+src_install() {
+ dobin foremost || die "dobin failed"
+ doman foremost.1
+ dodoc foremost.conf README CHANGES TODO
+}
diff --git a/app-forensics/foremost/foremost-1.5.7-r2.ebuild b/app-forensics/foremost/foremost-1.5.7-r2.ebuild
new file mode 100644
index 000000000000..5bb7b1464fb3
--- /dev/null
+++ b/app-forensics/foremost/foremost-1.5.7-r2.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2015 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="A console program to recover files based on their headers and footers"
+HOMEPAGE="http://foremost.sourceforge.net/"
+#SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+# starting to hate sf.net ...
+SRC_URI="http://foremost.sourceforge.net/pkg/${P}.tar.gz"
+
+KEYWORDS="amd64 ppc x86"
+IUSE=""
+LICENSE="public-domain"
+SLOT="0"
+
+src_prepare() {
+ epatch "${FILESDIR}/${PN}-1.4-config-location.patch"
+ epatch "${FILESDIR}/${PN}-1.5.7-format-security.patch"
+}
+
+src_compile() {
+ emake RAW_FLAGS="${CFLAGS} -Wall ${LDFLAGS}" RAW_CC="$(tc-getCC) -DVERSION=\\\"${PV}\\\"" \
+ CONF=/etc
+}
+
+src_install() {
+ dobin foremost
+ doman foremost.8.gz
+ insinto /etc
+ doins foremost.conf
+ dodoc README CHANGES
+}
diff --git a/app-forensics/foremost/foremost-1.5.7-r3.ebuild b/app-forensics/foremost/foremost-1.5.7-r3.ebuild
new file mode 100644
index 000000000000..69d67a469d2d
--- /dev/null
+++ b/app-forensics/foremost/foremost-1.5.7-r3.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="A console program to recover files based on their headers and footers"
+HOMEPAGE="http://foremost.sourceforge.net/"
+#SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+# starting to hate sf.net ...
+SRC_URI="http://foremost.sourceforge.net/pkg/${P}.tar.gz"
+
+KEYWORDS="~amd64 ~ppc ~x86"
+IUSE=""
+LICENSE="public-domain"
+SLOT="0"
+
+src_prepare() {
+ epatch "${FILESDIR}/${PN}-1.4-config-location.patch"
+ epatch "${FILESDIR}/${PN}-1.5.7-format-security.patch"
+ default_src_prepare
+}
+
+src_compile() {
+ emake RAW_FLAGS="${CFLAGS} -Wall ${LDFLAGS}" RAW_CC="$(tc-getCC) -DVERSION=\\\"${PV}\\\"" \
+ CONF=/etc
+}
+
+src_install() {
+ dobin foremost
+ gunzip foremost.8.gz
+ doman foremost.8
+ insinto /etc
+ doins foremost.conf
+ dodoc README CHANGES
+}
diff --git a/app-forensics/foremost/metadata.xml b/app-forensics/foremost/metadata.xml
new file mode 100644
index 000000000000..b06edf62c087
--- /dev/null
+++ b/app-forensics/foremost/metadata.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>ikelos@gentoo.org</email>
+ </maintainer>
+ <upstream>
+ <remote-id type="sourceforge">foremost</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/galleta/Manifest b/app-forensics/galleta/Manifest
new file mode 100644
index 000000000000..ab494218ebc6
--- /dev/null
+++ b/app-forensics/galleta/Manifest
@@ -0,0 +1,5 @@
+DIST galleta_20040505_1.tar.gz 2813 SHA256 87abe3c8354921cbf28eb471d9466ea4b3c144ce18096e1eab465596e9fe6d04 SHA512 7c420a413371cd9d7d818941026bc6981c8a749b8d3c97a9f0fc867116f9e642a06ad2832ded6de08780ed24885c2de7e8b655400569cb7ae56844161308dc3d WHIRLPOOL d6bb0fb8a003b0826de5d84f7a3db335170e5525cbceeec24055ef22df837549d0a22caea23473d1282ea887aab0d0ed6f989eba126d0e3b266284a91ddb88fc
+EBUILD galleta-20040505_p1.ebuild 544 SHA256 36f8c53f4a799c2c42387332c27d85967194a0243b6cb13e5167b9c828de2841 SHA512 087290ad60531da7dc39a221cc969ea75722124dbc15ee8e79ec327ef0c6c024b513ed697e3d1973aadfff6ff5c09bd0653bf4c9e34a829c5dbf3025cd7d73c3 WHIRLPOOL 4f1e3bba4b7e4bef520a98fc430b55642d7df0b6327f12369fd4eb66567b0b02192be1f00ff88fed9a953cc7677878450c2e4ac0dd089f5d2f0988510e7f7629
+MISC ChangeLog 2562 SHA256 fa82fedf338ee847964a16d9d58c4a2bd94aff11e8276cf23bbb656c6285d8dd SHA512 d22ecdca0f5cf518b8a99cb7e77cbe139aede756146329d5a719e53e0bfdab3a002ccb83824fa782db46109a5cdad019b39b84065b510c070a3f06508fe52854 WHIRLPOOL ffebd0f898894f5a7d8157d28ccd8555f032ba22cafbc480d28a8c625e31118fa79685e0e21a76f589a8c15ff5efc1d39cc14d2181500c5458f4f76a8585373a
+MISC ChangeLog-2015 1220 SHA256 72398c4f5d05078ee5565dfe86075f404920d33bca9df477153be97b1beb92fe SHA512 b5744d590985803f953588d68770fb1ed002144d846b57f3cea83726a0778042d55edc4e08342a7b173a707f50e4b5611822b48cdd503d3d91c54faa710a0133 WHIRLPOOL 2744000dab53d43b6801637a8bf2ef851e7fb66ed30074ac6a8da71dfee6b3c9fcb8578386605fbaea847c9fbe44c35d1d6b20a4d0d59db043b538d6e5c370ae
+MISC metadata.xml 243 SHA256 37f6c5093bdbce6a933f15351b291dfa7109c51abc4d30e917181f384abed3c6 SHA512 4e97cd2b4cea4fe6059d375cd29eb5e97c8a40581126a624d1c7a48e2e9092472bc0f4e4f61a95a73121aa183995706b8111757e5dcb3d0bf0458e33029aeda1 WHIRLPOOL 59c9e1d5a2284cc406aa3f4469b5876f22f50b3842fbb8eb8e3092aab7d75c2d04da2d11ecaf30246bf0ca8915411f22ab9f8f29b8d6fa669df393f7889a33ac
diff --git a/app-forensics/galleta/galleta-20040505_p1.ebuild b/app-forensics/galleta/galleta-20040505_p1.ebuild
new file mode 100644
index 000000000000..890ad5ab0d30
--- /dev/null
+++ b/app-forensics/galleta/galleta-20040505_p1.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+inherit toolchain-funcs
+
+MY_P=${PN}_${PV/_p/_}
+DESCRIPTION="IE Cookie Parser"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="mirror://sourceforge/odessa/${MY_P}.tar.gz"
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+IUSE=""
+
+S=${WORKDIR}/${MY_P}
+
+src_compile() {
+ cd src
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} -o galleta galleta.c -lm -lc || die "failed to compile"
+}
+
+src_install() {
+ dodoc Readme.txt
+ dobin src/galleta
+}
diff --git a/app-forensics/galleta/metadata.xml b/app-forensics/galleta/metadata.xml
new file mode 100644
index 000000000000..aa3597556ef2
--- /dev/null
+++ b/app-forensics/galleta/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">odessa</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/honggfuzz/Manifest b/app-forensics/honggfuzz/Manifest
new file mode 100644
index 000000000000..8b21c3f5bf54
--- /dev/null
+++ b/app-forensics/honggfuzz/Manifest
@@ -0,0 +1,8 @@
+AUX honggfuzz-1.0-no-error.patch 310 SHA256 94a7e6b1af29a86678537b956eba62818c9a5a6194258cfd63c2fed1b593f6e2 SHA512 88d25aa085da317b2aae99180252f242fb0ff32750b8f6e860f01efa8f9baf57286251bf73f28f7eefd847100f52d40dcb67745d018ce07b1f9d5b28a3882a06 WHIRLPOOL 5a6233f47a1401fe8738dceaf736bb0cd5f50fa4164a3efa19bfd89308d92d5dfd0da8ed28bc5dd0e2cc82493f082a0326cf7731fd59bdc25e4da5124c035ab5
+AUX honggfuzz-1.1-binutils-2.29.patch 569 SHA256 d378c20bb8df0ed91d7c1f225d1560b875b6d49239cd5ce75b7aa09869bf6e2c SHA512 c86927faf45e345fd56ff0eaaebadaaff41f020f853df8c791dc04b7f00890d3bdfe173cd0e78d5293c0eeba88f0626585c611f40d9a5cd49e705135922e59fb WHIRLPOOL 3fc474ca6f39545c585badfc807e9b57fe309793d0b026cfbb7fa0ede157858d9390dc05a90b15ebb2b7c2ef5f8e2ff827d70b0c150e19339e5c6c2ce8415e9b
+DIST honggfuzz-1.0.tar.gz 11705394 SHA256 922af667c2699be4e2a39cb7d2cd6324b9cb27d4817b073b48d43a580074fd4d SHA512 c31a8a252b4a57c7da632bf3ff55a0fe8b5f777bfe5196cd09b2a016bf7ac48413587e3b515d1a7c2a074adc3d8d83f9bfd49cabd881542184b16cf8acd41356 WHIRLPOOL cd9e9222cf622a410d49662f84a62d0cb737fe3cddcb58dec83e19d14d7de75e24a0a23b537f7a5d78520ac6d9438198166e86814aa7c083dad5802df35bd29b
+DIST honggfuzz-1.1.tar.gz 11705217 SHA256 e1ddbffc3240b2601c7e997d759c6a89ea69fe619bf59d1d9a58f11205934ee4 SHA512 dad1e763b1a74607995548b7c8a81b930286fc1d403f10fa2e88b165948fb323370233a9969eb972020cfa8782bc8aecd59c905a8ff63f18b0e50fe5b289bcf5 WHIRLPOOL c090c071904fadfbd6c794e0f4445c2b0efc66a5cf4eb6a2ec3427014ae0298a46c4c9cdbcef1bae5d2e1b383a384a98c6d64ca64a5d3c4a127b776cad09cf1b
+EBUILD honggfuzz-1.0.ebuild 705 SHA256 253a87e9c1f6ccf0258c8b5a16d0845e7629edd206a0c87332268f52359380e4 SHA512 f6201627d7376a5ef7e2d1df5da7cd41ffc6cc016859c2fa02367def069805124a31ffa14a37ee0f475cd0f22505367a26667a053443c665fbe5904dc46e158a WHIRLPOOL 6c14085cacbcbb175dea566f89ece80b5ce57ffc37e998cd3e3cfb6ef725d58d4f17fb773e442b782953907755e70a3cbdc962bffbc3c7c4c931d537d148279e
+EBUILD honggfuzz-1.1.ebuild 791 SHA256 9176858b21e0b5dc8198fdd232514484b834ab6ad7825d0851d17047cf5fcc42 SHA512 ac4032175f6bcca3b681690c51fe916d965f75594794824862e6691bbdea8a84532af4385d66975ba46cfce885123d2329e5134b8ef4c6083b919856f7f3de03 WHIRLPOOL a8a461a76a4602c4b221094bde56d440203fb3a8eee5333567da49fbbcaebd6745ade38581517493652ef25185a22d3d3e8a8ccf9f3adc35bf8d47b018cea2c5
+MISC ChangeLog 1232 SHA256 5000777dd1c4c2a651ed0d2a14384fd2940debf43c88c086befa06c1fc76548e SHA512 5704e3c9b5b939563d88079f732b3ab828d24889e1b6429ec559c6bb37cace7e06d14615def1ccd0ba73d0c238649489b06b205d9409236cd8a8752b7a22fb21 WHIRLPOOL 6456550fddd8bae510a50a40bd32029cf416c5242f196f4baa9daaebe5935352b844ac6b26e8d07d94ab325340eb6140292347605c1aaac34948ec8ec04b876b
+MISC metadata.xml 332 SHA256 df2ef3baee63ecda6fe4d07ab39732863910875121f0d0636ff48f63b229c26d SHA512 1f75a39cce6995d550344225849dafb3a980df19cc6afd10025e58e6c08086a27a67173ff435c084660970cb4ed18183914afeba712dc461d7fd55f83f9e679d WHIRLPOOL 9f02ef07482e6bce86c3f12c599027e2b77695788321717767514aa3dd326ef50f9e1dc71e1adafe22799e53852e22d0fcf98df535abdb97969bee1290578d09
diff --git a/app-forensics/honggfuzz/files/honggfuzz-1.0-no-error.patch b/app-forensics/honggfuzz/files/honggfuzz-1.0-no-error.patch
new file mode 100644
index 000000000000..c7d7f48af54f
--- /dev/null
+++ b/app-forensics/honggfuzz/files/honggfuzz-1.0-no-error.patch
@@ -0,0 +1,7 @@
+diff --git a/Makefile b/Makefile
+index 378df7d..75a6b71 100644
+--- a/Makefile
++++ b/Makefile
+@@ -30 +30 @@ CC_SRCS := display.c log.c util.c files.c hfuzz_cc/hfuzz-clang.c
+-COMMON_CFLAGS := -D_GNU_SOURCE -Wall -Werror -Wframe-larger-than=131072
++COMMON_CFLAGS := -D_GNU_SOURCE -Wall -Wframe-larger-than=131072
diff --git a/app-forensics/honggfuzz/files/honggfuzz-1.1-binutils-2.29.patch b/app-forensics/honggfuzz/files/honggfuzz-1.1-binutils-2.29.patch
new file mode 100644
index 000000000000..31a57784ed8f
--- /dev/null
+++ b/app-forensics/honggfuzz/files/honggfuzz-1.1-binutils-2.29.patch
@@ -0,0 +1,11 @@
+Adapt to binutils-2.29 API change caused by
+https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=003ca0fd22863aaf1a9811c8a35a0133a2d27fb1
+diff --git a/linux/bfd.c b/linux/bfd.c
+index bcd247f..e9e16ab 100644
+--- a/linux/bfd.c
++++ b/linux/bfd.c
+@@ -163,3 +163,3 @@ void arch_bfdDisasm(pid_t pid, uint8_t * mem, size_t size, char *instr)
+
+- disassembler_ftype disassemble = disassembler(bfdh);
++ disassembler_ftype disassemble = disassembler(bfd_get_arch(bfdh), bfd_little_endian(bfdh), bfd_get_mach(bfdh), bfdh);
+ if (disassemble == NULL) {
diff --git a/app-forensics/honggfuzz/honggfuzz-1.0.ebuild b/app-forensics/honggfuzz/honggfuzz-1.0.ebuild
new file mode 100644
index 000000000000..b87a2be35620
--- /dev/null
+++ b/app-forensics/honggfuzz/honggfuzz-1.0.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs
+
+DESCRIPTION="A general purpose fuzzer with feedback support"
+HOMEPAGE="http://google.github.io/honggfuzz/"
+SRC_URI="https://github.com/google/honggfuzz/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+RDEPEND="
+ sys-libs/binutils-libs:=
+ sys-libs/libunwind
+"
+
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-1.0-no-error.patch
+)
+
+DOCS=(
+ CHANGELOG
+ COPYING
+ CONTRIBUTING
+ README.md
+)
+
+src_compile() {
+ CC="$(tc-getCC)" CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" emake
+}
+
+src_install() {
+ dobin ${PN}
+
+ einstalldocs
+}
diff --git a/app-forensics/honggfuzz/honggfuzz-1.1.ebuild b/app-forensics/honggfuzz/honggfuzz-1.1.ebuild
new file mode 100644
index 000000000000..eb072b67c9bf
--- /dev/null
+++ b/app-forensics/honggfuzz/honggfuzz-1.1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs
+
+DESCRIPTION="A general purpose fuzzer with feedback support"
+HOMEPAGE="http://google.github.io/honggfuzz/"
+SRC_URI="https://github.com/google/honggfuzz/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+IUSE=""
+
+RDEPEND="
+ sys-libs/binutils-libs:=
+ sys-libs/libunwind
+"
+
+DEPEND="${RDEPEND}"
+
+DOCS=(
+ CHANGELOG
+ COPYING
+ CONTRIBUTING
+ README.md
+)
+
+src_prepare() {
+ default
+ if has_version ">=sys-libs/binutils-libs-2.29"; then
+ eapply "${FILESDIR}"/${PN}-1.1-binutils-2.29.patch
+ fi
+}
+
+src_compile() {
+ CC="$(tc-getCC)" CFLAGS="${CFLAGS}" LDFLAGS="${LDFLAGS}" emake
+}
+
+src_install() {
+ dobin ${PN}
+
+ einstalldocs
+}
diff --git a/app-forensics/honggfuzz/metadata.xml b/app-forensics/honggfuzz/metadata.xml
new file mode 100644
index 000000000000..06de019661a3
--- /dev/null
+++ b/app-forensics/honggfuzz/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>slyfox@gentoo.org</email>
+ <name>Sergei Trofimovich</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="github">google/honggfuzz</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/libbfio/Manifest b/app-forensics/libbfio/Manifest
new file mode 100644
index 000000000000..6afd35250cd2
--- /dev/null
+++ b/app-forensics/libbfio/Manifest
@@ -0,0 +1,9 @@
+DIST libbfio-alpha-20120425.tar.gz 1569560 SHA256 5b645f9a1da7dc96fcb0ca778c7a5c9f4bcefa95bbdda0786883007cd1497070 SHA512 058d5018202c404d789531f308b66d9e72924f4ce9d6365477c84a327a3fe2a4efb9cd0cc173f29dbf2d18cf366772e5577ffea6d0953b752865cbdf4da48c20 WHIRLPOOL 76adf2d5baaa27d86eb5024d9a1e2394323809f8f1f5fa4e3e72f703ccbadf8f81c4778b0ddfec1aa935d81133a5cea279ed33e36b1569ed1f89948a6fa5eca7
+DIST libbfio-alpha-20130609.tar.gz 1858612 SHA256 bf90af77d6894ff91d9973c33c0a5a63accea454b9e601275c7c52f578203dd4 SHA512 b2f46c7631aa8dca63d6e915c69ba6136f0f777f138708c4751e24f3e96a2399721182ce281e032b617b17ce631876cefb8ef686b9bd1cb866f9f1033d1dd18b WHIRLPOOL 438f9c48d2da78649bb9a0a5d12f5d66a2b695dd5816bc5bd5e063f02df171abd05c46e16db70da664de830202f988ca4c009e1cd747365a834728a60e414d52
+DIST libbfio-alpha-20130721.tar.gz 1899281 SHA256 153a31fde7b6e5af1ba991acf32ddb59ff1c11e390e6b4eb3b46da708f1313c1 SHA512 9a9e8f913e145d5dcf5ee94351b4023a8d35492f5c9c3863f4caf0850e45f1b9c79ee3ec7e0565f85f91d11ff25d134f2c770b176e3e1888b78c984fe4b8c2a8 WHIRLPOOL b4e9c66d2d2753aaaf2ac0719f5a9f4f874a46aa9f5c75d523a6c33a2571827c628840b868083e6ff440d55f88c64e99fab6574fd8d1adea16063e34afd7612c
+EBUILD libbfio-0.0.20120425_alpha.ebuild 638 SHA256 cafceb87bf2139a838b9a52bc592700acfcd68bfe42a67c98d649a49f51609c0 SHA512 5b9ff0d42ee53c739ee5ff1b1fb66d4ab24368a7170adc9a9973251aca4b38cff6190892792f0a61d32aeed7528fbfed607f0079ecfa223ef52e3640763d92ef WHIRLPOOL fa7723476f5e3c9bd2d31355d2250f2692e0bbf18093ecf7eff9d2212f9b8a5fa68d09f280c9bd824d28b26ff2a66013f443893ec30809b99bb3d9b754a99b29
+EBUILD libbfio-0.0.20130609_alpha.ebuild 556 SHA256 c0c61ef878c96738e0a4251909adcd85d04998f2077f05246b1219b7bdded3ab SHA512 feb4ce707c61ac367eaf30a223956a98420444daedf8de0de19ef44777f80a60222ca7830b7e7c46a5a583ca1614e6d65dbd1a1ddeb6228da142877f85d9b15a WHIRLPOOL 6c6d2ae32d85fe13bfb24acb88de7180f3969636f1e0b9a833da20f2077f772b775076ae519b87943a366e4e718232f9e9e7621ae468920cc08cbd3bc4449209
+EBUILD libbfio-0.0.20130721.ebuild 562 SHA256 e9e6eb41cf47016a2967fe7f378cfc5a6962349c87d120dec0de753f080dc130 SHA512 c58ab7f759b7f7a27ddae80080577140a7a1437a5083cb58a414cb32b2ca5f219810d69d53946c858a636dd54c89a2a507c143ab6f74bc39c5a81ba4fcf6752b WHIRLPOOL 3864b59da4c7722eb3cac798f146d6a350354573f1425cef20986adbf88b0429e11f4d72d1a60e0b151608498b578f6483dec5fdececdbe91a41852b0102e375
+MISC ChangeLog 2983 SHA256 1a8dd7d3d4c2c302645a3801755fc22acdfce1fe97d77219aed2da5b6c7312ed SHA512 929424872daef97fba41e3d6048abfc2d0c64c6c11d0872a9dbf98f54107f887653cd0a2762079fede361c601c40fc9f54b83da9b2babc3402c1608daaffb347 WHIRLPOOL 534926d6bc94a0c9712ef77afc38a7cb122743def5e74b4d45fcb890001497a0c9eae768194f00cf07a732bc6d5f52e8d93468d8c5daf6117ebd8312e0223138
+MISC ChangeLog-2015 1408 SHA256 5e68bcc09195dfee7edf9061bebe6fb908f0108edd20257869b9af537e09f923 SHA512 955509c86cc3371bb817711ec1a5915da83abf3df12aab3937bd266946a103d1765c3fb546a8940c60b178aacdd8b0387741396aa1ed3eb60565b428c1e38367 WHIRLPOOL f264243f968f12f77a19f37bae09aaa9ec05c8b770e8b8162a2b3022500b2dd1a94ea82be56d31ada66b23d6cf48183a7705164425abec5f7d13ef3a632a6af8
+MISC metadata.xml 326 SHA256 9c7f5a4018b834869cdd55e29eeae8b053cd27e74a4964b5f5515e12df37712a SHA512 2f935a0d6929bde1f27ca2704bc6e93b8947c88824826bee971ff765f205f664f2c235743b37f1e4b078b809577701755c6dbf1875eec9f3d5d91f579e3428e1 WHIRLPOOL 83898ee38d47a87da36d8f4e02107841f6d8b67c5d9dd122bf7da238c8092fdf9d8f8ecedc6fe814b9dab06838eb1d8bd8b22c3e7b65d766e46885895f0b969d
diff --git a/app-forensics/libbfio/libbfio-0.0.20120425_alpha.ebuild b/app-forensics/libbfio/libbfio-0.0.20120425_alpha.ebuild
new file mode 100644
index 000000000000..a69e104313cd
--- /dev/null
+++ b/app-forensics/libbfio/libbfio-0.0.20120425_alpha.ebuild
@@ -0,0 +1,27 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit versionator
+
+MY_DATE="$(get_version_component_range 3)"
+
+DESCRIPTION="Library for providing a basic file input/output abstraction layer"
+HOMEPAGE="https://github.com/libyal/libbfio"
+SRC_URI="http://dev.pentoo.ch/~zero/distfiles/${PN}-alpha-${MY_DATE}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="unicode"
+
+S="${WORKDIR}/${PN}-${MY_DATE}"
+
+src_configure() {
+ econf $(use_enable unicode wide-character-type)
+}
+
+src_install() {
+ emake install DESTDIR="${D}" || die "Failed to install"
+}
diff --git a/app-forensics/libbfio/libbfio-0.0.20130609_alpha.ebuild b/app-forensics/libbfio/libbfio-0.0.20130609_alpha.ebuild
new file mode 100644
index 000000000000..b8464cda1fc2
--- /dev/null
+++ b/app-forensics/libbfio/libbfio-0.0.20130609_alpha.ebuild
@@ -0,0 +1,23 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit versionator
+
+MY_DATE="$(get_version_component_range 3)"
+
+DESCRIPTION="Library for providing a basic file input/output abstraction layer"
+HOMEPAGE="https://github.com/libyal/libbfio"
+SRC_URI="http://dev.pentoo.ch/~zero/distfiles/${PN}-alpha-${MY_DATE}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+IUSE="unicode"
+
+S="${WORKDIR}/${PN}-${MY_DATE}"
+
+src_configure() {
+ econf $(use_enable unicode wide-character-type)
+}
diff --git a/app-forensics/libbfio/libbfio-0.0.20130721.ebuild b/app-forensics/libbfio/libbfio-0.0.20130721.ebuild
new file mode 100644
index 000000000000..a0cf6d2a23b1
--- /dev/null
+++ b/app-forensics/libbfio/libbfio-0.0.20130721.ebuild
@@ -0,0 +1,23 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit versionator
+
+MY_DATE="$(get_version_component_range 3)"
+
+DESCRIPTION="Library for providing a basic file input/output abstraction layer"
+HOMEPAGE="https://github.com/libyal/libbfio"
+SRC_URI="http://dev.pentoo.ch/~zero/distfiles/${PN}-alpha-${MY_DATE}.tar.gz"
+
+LICENSE="LGPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="unicode"
+
+S="${WORKDIR}/${PN}-${MY_DATE}"
+
+src_configure() {
+ econf $(use_enable unicode wide-character-type)
+}
diff --git a/app-forensics/libbfio/metadata.xml b/app-forensics/libbfio/metadata.xml
new file mode 100644
index 000000000000..e1bfc9e31b23
--- /dev/null
+++ b/app-forensics/libbfio/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>zerochaos@gentoo.org</email>
+ <name>Rick Farina</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="github">libyal/libbfio</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/libewf/Manifest b/app-forensics/libewf/Manifest
new file mode 100644
index 000000000000..ff5ef2e8e251
--- /dev/null
+++ b/app-forensics/libewf/Manifest
@@ -0,0 +1,7 @@
+DIST libewf-20130416.tar.gz 1968288 SHA256 e0f14071665b24a8077a24f4cafbf092ad5ac1859f49994dc4e843e747ba7a89 SHA512 e84e920dfe6e5a313bc165b1796ab9681c5b42fdefc7120b4f1c0f4e42b220d8192e03df2707051cf16f4cc991facdfdbd39042dcfb645ac7a27b549e02bd96e WHIRLPOOL 2afb81706899881d5191fec53409d2445e4ca7c485738eb638ef26eea602a4bf71da1ae56d986c49630dc13b1d287cf9c070c473ed72df0e2e0e8c86b4dffe06
+DIST libewf-20140608.tar.gz 2129518 SHA256 d14030ce6122727935fbd676d0876808da1e112721f3cb108564a4d9bf73da71 SHA512 f77f01e3452027bff71e644708744e0774e1e397c70e2ebd687983730f03ffb01b26fec782bec79971e149caac5029484f3d9073c3a8042df951bfc542fe2436 WHIRLPOOL ab643847cbce6ad9b8de33a82e5ecb27a05f45f55a831e33827eeae010126fa061f9fc0186457bf48f2b6cf1e481b88bfa9f156dab0f46cd40954c1eb25bd477
+EBUILD libewf-20130416.ebuild 1385 SHA256 7ef2c8dca3b9d83dd98ba805209a5483cacffdb93289484d88fa49f0526e7315 SHA512 86624b6b04152ef9080967fd9acfd65827dc592a5fe2d5f94423c2eab2e280e5f809ffadebecd74b47d404b77debefcc3589df4c20bc3662e0e13c8f661337a7 WHIRLPOOL a3d3159c9c25a5c4ef52d36fd3f5e5bd86329d0d1c3451414375313e98002f7341604761d428a8b6dbe258a787fc3212ea0d1b2e251309fc5dba1c146fd51065
+EBUILD libewf-20140608.ebuild 1345 SHA256 a59600fdf83cd7e38ee359fd706cc4ad79709c518e1c94312b534c912771e039 SHA512 befedbe1643d99dfaf3a026ca2091557f6edbfaa784731b11a4bd31901d11527f5b44092394813955d473806893d8a22d1fe4a5aa08daec05d411c0f760374b8 WHIRLPOOL aac378f3db9f637ea8bfe5fd83d1729959054fb21454205c16cdcb9edb82bacdd19f817c114164fad20ce95657a76d2d740fb630b90678147281a6314bcd7526
+MISC ChangeLog 3881 SHA256 9dc73519ed8634d20801656656484effca5f32d4de887ff84a01f4aeacb4a95e SHA512 8e3b899e97fa2b01afb2cbfd8c56af32e3628335fc932c56a32f6dbfaf3ae55a69858c52dccd61af93138e927c569cffcc0b31618608b119399332157ceb0cc0 WHIRLPOOL f7c9a992422c550eeab2939f1392fe773f7dc63161c7616801f3cd40549fce3d9058c3ee4cf553611ad99adbaaa9a3f0976d6dcce2e7f0b115d0b9fe4582fdb3
+MISC ChangeLog-2015 7632 SHA256 58d50afedcbc2747a4ee6a64d982c7c85b20f85a531f129bde6d526144232d10 SHA512 e0cfa20879608fb9e7ae8a20a4d5c1e0ce273c000e6f98d05b2ea103d1840f513064d617a14dbe5c0e9c57e2beaff7b6ea023cc1b97bcda8e13c30df63e2c08e WHIRLPOOL ca1ffda7c9640acdd3e3cc40c56f12bf91d80f3dcfbc86949bb37c7e4fdd0311d5eedbdaf7507cb8ee0c102c7c863a8408f312d551c5ee7ba473712d2ca01498
+MISC metadata.xml 558 SHA256 c8254d4f749eabceac98859d8f0356ec9420a420e7db4784deeaa34081979ebc SHA512 bc1d1da35f777a5c48a03120e432b7ec09f3ae827118782db7861640f23a190ca32b464fb28e219b2494da23bf036199c8ea2cd43c56896fd068fa6cabab9ef4 WHIRLPOOL 2824f4bef878d5d196dbf667e257ea8e46415c5974314f929637184345846a409426e25de7d96ed6648fd0992804ad464e52347dabb0129f14b738259fb496c2
diff --git a/app-forensics/libewf/libewf-20130416.ebuild b/app-forensics/libewf/libewf-20130416.ebuild
new file mode 100644
index 000000000000..e9b3505509dc
--- /dev/null
+++ b/app-forensics/libewf/libewf-20130416.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit autotools-utils
+
+DESCRIPTION="Implementation of the EWF (SMART and EnCase) image format"
+HOMEPAGE="https://github.com/libyal/libewf"
+SRC_URI="https://libewf.googlecode.com/files/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0/2"
+KEYWORDS="amd64 hppa ppc x86"
+# upstream bug #2597171, pyewf has implicit declarations
+#IUSE="debug python rawio unicode"
+IUSE="debug ewf +fuse rawio +ssl static-libs +uuid unicode zlib"
+
+DEPEND="
+ sys-libs/zlib
+ fuse? ( sys-fs/fuse )
+ uuid? ( sys-apps/util-linux )
+ ssl? ( dev-libs/openssl )
+ zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+DOCS=( AUTHORS ChangeLog NEWS README documents/header.txt documents/header2.txt )
+
+src_configure() {
+ local myeconfargs=(
+ $(use_enable debug debug-output)
+ $(use_enable debug verbose-output)
+ $(use_enable ewf v1-api)
+ $(use_enable rawio low-level-functions)
+ $(use_enable unicode wide-character-type)
+ $(use_with zlib)
+ # autodetects bzip2 but does not use
+ --without-bzip2
+ #if we don't force disable this then it fails to build against new libbfio
+ --without-libbfio
+ $(use_with ssl openssl)
+ $(use_with uuid libuuid)
+ $(use_with fuse libfuse)
+ )
+ autotools-utils_src_configure
+}
+
+src_install() {
+ autotools-utils_src_install
+ doman manuals/*.1 manuals/*.3
+}
diff --git a/app-forensics/libewf/libewf-20140608.ebuild b/app-forensics/libewf/libewf-20140608.ebuild
new file mode 100644
index 000000000000..ffa753972dd0
--- /dev/null
+++ b/app-forensics/libewf/libewf-20140608.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit autotools-utils
+
+DESCRIPTION="Implementation of the EWF (SMART and EnCase) image format"
+HOMEPAGE="https://github.com/libyal/libewf"
+SRC_URI="https://googledrive.com/host/0B3fBvzttpiiSMTdoaVExWWNsRjg/${P}.tar.gz"
+
+LICENSE="BSD"
+SLOT="0/2"
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+# upstream bug #2597171, pyewf has implicit declarations
+#IUSE="debug python unicode"
+IUSE="bfio debug ewf +fuse +ssl static-libs +uuid unicode zlib"
+
+DEPEND="
+ sys-libs/zlib
+ bfio? ( =app-forensics/libbfio-0.0.20120425_alpha )
+ fuse? ( sys-fs/fuse )
+ uuid? ( sys-apps/util-linux )
+ ssl? ( dev-libs/openssl )
+ zlib? ( sys-libs/zlib )"
+RDEPEND="${DEPEND}"
+
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+DOCS=( AUTHORS ChangeLog NEWS README documents/header.txt documents/header2.txt )
+
+src_configure() {
+ local myeconfargs=(
+ $(use_enable debug debug-output)
+ $(use_enable debug verbose-output)
+ $(use_enable ewf v1-api)
+ $(use_enable unicode wide-character-type)
+ $(use_with zlib)
+ # autodetects bzip2 but does not use
+ --without-bzip2
+ $(use_with bfio libbfio)
+ $(use_with ssl openssl)
+ $(use_with uuid libuuid)
+ $(use_with fuse libfuse)
+ )
+ autotools-utils_src_configure
+}
+
+src_install() {
+ autotools-utils_src_install
+ doman manuals/*.1 manuals/*.3
+}
diff --git a/app-forensics/libewf/metadata.xml b/app-forensics/libewf/metadata.xml
new file mode 100644
index 000000000000..a4f3a69c3044
--- /dev/null
+++ b/app-forensics/libewf/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <use>
+ <flag name="bfio">Enables libbfio for chaining file in file handling</flag>
+ <flag name="rawio">Enables raw IO handling</flag>
+ <flag name="ewf">Enables the v1 API</flag>
+ <flag name="fuse">Enable fuse support for ewfmount</flag>
+ <flag name="uuid">Enable UUID support in the ewftools</flag>
+ </use>
+ <upstream>
+ <remote-id type="github">libyal/libewf</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/lynis/Manifest b/app-forensics/lynis/Manifest
new file mode 100644
index 000000000000..bc633aa5e8e0
--- /dev/null
+++ b/app-forensics/lynis/Manifest
@@ -0,0 +1,6 @@
+AUX lynis.cron-new 70 SHA256 852f547d4c2aeb5d592b627f5456868eff97c26aede8fbfd7c996f9be5feb394 SHA512 f90592c9adb6617b367c22912ceb984cca9a64c1bfa092efb50f5f9df48b07f61c7e990b969f3871161d92ff28bdb131175d46b334947980b7ead49dd6ff70c7 WHIRLPOOL e7f9b0d32083b91b6f93b53edb39145bbb1e4302facffc5725e68dc1ed5e00cee2a26297d80ea6eefd0f6a237d9b2c9965d2dbfb062a8dd71e9f9a5dc512b234
+DIST lynis-2.5.2.tar.gz 264098 SHA256 6b4dc74ec0faa009fc5d34f8ab85895e53c6f4f02bc160377905dcb95b0585a1 SHA512 dc9b994190f5a6102baaf1c4d226ee90980a32908c009a9f68bb9e716e0ba04063d51f3cca98b9538f6b30224097470ca3d484b667f2af73b922c0b239f4bdae WHIRLPOOL 6d4bfa2171b671932f39e006aa3ee249f0a1e3014266ea0152193217a0780630fbe89c886353142216eac8e8396ebde4ba8428377f0b06d22e897876e2ac27f6
+EBUILD lynis-2.5.2.ebuild 994 SHA256 004373c1a85a79946b8aee73b62051d3cfaacebb70b955f4be6ed21f0dd97f53 SHA512 daf0f55780cc0ac58c294de1fa47a9449d923bc45ecb4927cbd734a2dab010dcbf23433bc1c558de68c886622c00e25c5eb3d50104b78c2e39f1af850d065ae8 WHIRLPOOL 913b45d8fd61732c4f30133f1086835e8165e408f57d4bd4c85cb36b486b7dab75966636dbb9b40cb409c46829a9fd8426d17678e433430b209c60fe1c96f412
+MISC ChangeLog 2547 SHA256 1d97561614cf1e50eabb174e0c07dd8e05e1f6570b7ce7a60f46110aa3aecd65 SHA512 a8523ea4eea28b65cf8a148b091124a51b15f857f41cdd0f4737e4264d0e3c1faee6646ce2974325292e4b084322cde79b823c2919ed83507e9e98440c123ef0 WHIRLPOOL b0a47efce25a8f9baf85d02b691e80bee753c063cbdea1f85713485c856a0caf3e4e788bd447ac3c3f5720069a629a0cffbc8f003f9643872fc50665eb1fe6c4
+MISC ChangeLog-2015 8482 SHA256 eec7998996dce92320d9cab8dd5c21fd5b5b41bb08eed57d80132a66b4d81389 SHA512 8b4d3f78e82e76b8f547d49f60b1e8cd3463c3bdfdf838443d7b4c6eb39a28e5558473ca5fd23f2d27db576a7abc9087303a520825ee0bf50d2092fde3774616 WHIRLPOOL 43751d7c600f47456bac507e69917cca29ab384ef7b601dcfe34ed47197bf2062d3e429ea1b1949173e05cbadd5b43bc3af410519f5680db3bf60db80637358e
+MISC metadata.xml 167 SHA256 5fe493e76bba84455c54b3a46adfae5a1bfe01c764ef0d9e5f6d3e8a1d142188 SHA512 7c8decb24ee3a850e38186cf3c7f8933a28017426806870ad6ef9ceb2533be147a2681fc789b535a81cb528af8c29d90d3006e4f250aee23bd7dea4561294e33 WHIRLPOOL dc6c3dfc7fd7f0d76c97f0786cb76a55b8564f8437f96d4ccebf985817b9f6dcc4c61830aa5df80d725e4a54b281ea2e03d6b0859214af081112cba15025e64b
diff --git a/app-forensics/lynis/files/lynis.cron-new b/app-forensics/lynis/files/lynis.cron-new
new file mode 100644
index 000000000000..15a39f1ca235
--- /dev/null
+++ b/app-forensics/lynis/files/lynis.cron-new
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+/usr/sbin/lynis --checkall --auditor "automated" --cronjob
diff --git a/app-forensics/lynis/lynis-2.5.2.ebuild b/app-forensics/lynis/lynis-2.5.2.ebuild
new file mode 100644
index 000000000000..80b80fe374ab
--- /dev/null
+++ b/app-forensics/lynis/lynis-2.5.2.ebuild
@@ -0,0 +1,55 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit eutils bash-completion-r1
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="https://cisofy.com/lynis/"
+SRC_URI="https://cisofy.com/files/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="app-shells/bash"
+
+S="${WORKDIR}/${PN}"
+
+src_prepare() {
+ # Bug 507438
+ epatch_user
+}
+
+src_install() {
+ doman lynis.8
+ dodoc FAQ README
+ newdoc CHANGELOG.md CHANGELOG
+
+ # Remove the old one during the next stabilize progress
+ exeinto /etc/cron.daily
+ newexe "${FILESDIR}"/lynis.cron-new lynis
+
+ dobashcomp extras/bash_completion.d/lynis
+
+ # stricter default perms - bug 507436
+ diropts -m0700
+ insopts -m0600
+
+ insinto /usr/share/${PN}
+ doins -r db/ include/ plugins/
+
+ dosbin lynis
+
+ insinto /etc/${PN}
+ doins default.prf
+}
+
+pkg_postinst() {
+ einfo
+ einfo "A cron script has been installed to ${ROOT}etc/cron.daily/lynis."
+ einfo
+}
diff --git a/app-forensics/lynis/metadata.xml b/app-forensics/lynis/metadata.xml
new file mode 100644
index 000000000000..7a38bb900964
--- /dev/null
+++ b/app-forensics/lynis/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+</pkgmetadata>
diff --git a/app-forensics/mac-robber/Manifest b/app-forensics/mac-robber/Manifest
new file mode 100644
index 000000000000..8b9f7cdc7b9c
--- /dev/null
+++ b/app-forensics/mac-robber/Manifest
@@ -0,0 +1,5 @@
+DIST mac-robber-1.02.tar.gz 11708 SHA256 5895d332ec8d87e15f21441c61545b7f68830a2ee2c967d381773bd08504806d SHA512 5330f766eb08aa766ca3f430684e0a40ecf29b7230a582c30a36bbaaa481d52c2a8519fa04e82762f09259ada9e77466c1430aebdff22615a511d519916d54a7 WHIRLPOOL e289325435b654c67874888d9cf08b07a2bc412610ffefaaf4fbd90da0060f42f131c215479463cc7f004a3d2d27af5fdbbbf05ac8d7f67f3fc3396874713c99
+EBUILD mac-robber-1.02.ebuild 603 SHA256 8ecf238498063a176e67e70267cebf73ad3a562427b411c8adbc8d2b99e5360d SHA512 4f75912d8df1d080cd1aa2b48f85b440709e80681223ea67dcd49b5112f6bad8fbaa128094f5f314b7232679e782c94126a807f6578f617fca486ea07141ee3b WHIRLPOOL 4792f561c20e223c97475aef071fd4ecd695079c05bf3587e7cdbf99be05e4e78ea18b482f51906599cf726e10e9c69c787babf2e55bd63377540bf072000ea5
+MISC ChangeLog 2439 SHA256 6691cebefa0e8f125f28ccca5a332d0ea39a435b088785379b31cdf1b1df3516 SHA512 d891335166a6a2d3a6b19a9ea9028a52b770b0b4a3fb3cd258b5f043f5ee82a6eaa2f6c86d18f00b069149a6e456568bc10549e30edd1a38b8dbf5f8a4c9dc23 WHIRLPOOL 05d4e68d290b997cd87692a951914be9d83555b77b17739cdf20d31f5e9713fe3fc351c3926172acf116fd10b607b1080a53742dae3897fee3d9461516c881a1
+MISC ChangeLog-2015 1352 SHA256 6635234a110c00cea03f455e31c06c9737d4d705bb53e5a794609a842d34feb8 SHA512 7d6ddb285f03aa9afe4aa243d20b212b9df6941272c167b48159f579085761ec8143c5d55cedc1b522dabbb2e94c938e14bec36c6fc681de09bd5a7186828f8a WHIRLPOOL a7f350ead190bda1d1db37b92793667c6addcd5c54482ae4ae43b8d0b75ab5ce6c42177a757218e614a33e44e80f36f60829dfae248f831f26eb6ea351bcd0cc
+MISC metadata.xml 1423 SHA256 8a59fea5dfa16fb42baa6897bdd2ed167a63fa5059b1c4be0d3f1c78251ed398 SHA512 3af947bce0415529c1e0af7d8362db0a7ab53d685294c6dba69868acdf920b8199a19dbd0a9272c12bd97e6aaac1da78a5a537064793859858727286e8270dfb WHIRLPOOL a17ab14c5ce0918bfbfb353eb47638b2efb57c08e0a2bb5e87a8fc1e11133d185073c6407a80546fbc3bd444525fad5602694c49b7701690dd307d0d01ff41ad
diff --git a/app-forensics/mac-robber/mac-robber-1.02.ebuild b/app-forensics/mac-robber/mac-robber-1.02.ebuild
new file mode 100644
index 000000000000..90645ef09d5d
--- /dev/null
+++ b/app-forensics/mac-robber/mac-robber-1.02.ebuild
@@ -0,0 +1,28 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit toolchain-funcs
+
+DESCRIPTION="mac-robber is a digital forensics and incident response tool that collects data"
+HOMEPAGE="http://www.sleuthkit.org/mac-robber/index.php"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+IUSE=""
+
+src_prepare() {
+ sed -i -e 's:$(GCC_CFLAGS):\0 $(LDFLAGS):' Makefile || die
+}
+
+src_compile() {
+ emake CC="$(tc-getCC)" GCC_OPT="${CFLAGS}"
+}
+
+src_install() {
+ dobin mac-robber
+ dodoc CHANGES README
+}
diff --git a/app-forensics/mac-robber/metadata.xml b/app-forensics/mac-robber/metadata.xml
new file mode 100644
index 000000000000..2ce6a4b5d677
--- /dev/null
+++ b/app-forensics/mac-robber/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <longdescription>
+mac-robber is a digital forensics and incident response tool that collects data from allocated files in a mounted file system.
+The data can be used by the mactime tool in The Sleuth Kit to make a timeline of file activity. The mac-robber tool is based on
+the grave-robber tool from TCT and is written in C instead of Perl.
+
+mac-robber requires that the file system be mounted by the operating system, unlike the tools in The Sleuth Kit that process the
+file system themselves. Therefore, mac-robber will not collect data from deleted files or files that have been hidden by
+rootkits. mac-robber will also modify the Access times on directories that are mounted with write permissions.
+
+
+"What is mac-robber good for then", you ask? mac-robber is useful when dealing with a file system that is not supported by The
+Sleuth Kit or other forensic tools. mac-robber is very basic C and should compile on any UNIX system. Therefore, you can run
+mac-robber on an obscure, suspect UNIX file system that has been mounted read-only on a trusted system. I have also used
+mac-robber during investigations of common UNIX systems such as AIX.
+</longdescription>
+ <upstream>
+ <remote-id type="sourceforge">mac-robber</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/magicrescue/Manifest b/app-forensics/magicrescue/Manifest
new file mode 100644
index 000000000000..dca94c87fad5
--- /dev/null
+++ b/app-forensics/magicrescue/Manifest
@@ -0,0 +1,7 @@
+AUX magicrescue-1.1.9-ldflags.patch 1759 SHA256 b9bf83344918530498f4d849c303128c9dc005721ab6bf0b3acc70b62e6f8b31 SHA512 989630cfe2a6b9fcf94c39f648bf0ee2babf804f0f13f099491e282c971c312ee9e7533064f16366a71e97d9c7a5e3ffdce9294417380f73860f1e4876ffc0b6 WHIRLPOOL cda9f8d604d732c6304fe829e71f371c9892febd4fe4f464f2c9c6e252fdbfbdd1a15f941be2f9ba87ef13cc48bb8b475b18ecc37d4467a02f8c5edeba888cbd
+AUX magicrescue-1.1.9-makefile.patch 1809 SHA256 15e3012c920be7d40a6b41d480bd144992a56c44a162758d0ea282474b35b7bc SHA512 2bad3112e0c46cb0d5767ebbd32848b718bb07224f800e13715ed671e03a108a041876f599e921c7c02f81467e878146162f64d99138c1194317c82b740c1dc9 WHIRLPOOL 8ede38f7e780882885e8639b92689540d9ca2271af8e55f09458a062666b1f4623a500ed9a085ba0a3e2e6724b6b14026f00799ef9a67e8190f5777724ae0cec
+DIST magicrescue-1.1.9.tar.gz 92621 SHA256 a920b174efd664afe9760a43700588c9c5e6182cb13d7421e07ab613bceeb3c7 SHA512 3c0b97357f0d354dcf53045bbdf2ce81c451ae20c451d2d72dc8b2dbcc480cf48ab436494c0cca20c99f32c938c525074a561cbc779a580a648c674c150a7cc2 WHIRLPOOL 3aa09237ac22ab1235d87a271f3b819faab2fa46ef7280676cd35625b1e9e342dee8bf71308c22e3d8cc1ba2e901894ce9919a20687350e079d4b333d188d908
+EBUILD magicrescue-1.1.9.ebuild 665 SHA256 868831f88cf07328212913b55229719e21578c440fa8ab88d2699d2b5f682667 SHA512 d73c4c655201f6746092ac776c45d7e06bf3b73c92e7706e270dd2e89d529411045a26e1037d978a142032b6d3c40f1f7cffcdef330116e93d78d0f441c72606 WHIRLPOOL eafa2a6b6ebeb220cf1fabcada5f42bbab52c8eeef90e81603dedab99cdf99e335b841ed54cb1f02fd900b21963de83faa1eada81fc28ad9fba6bfc555d1c7d8
+MISC ChangeLog 2529 SHA256 f80138825fae201d3c262c19e82f0114afc02d078c8ff7308f7d015766c2a9f7 SHA512 08bea7f3e6d592f6f5e19a3b2fdaf4989c6a02f134900b2f50e6cd8c17bd697fe25be87a8adedd0579e2838e7a280ae90c95291af232be67e1e6dadc50d50f5c WHIRLPOOL ac8f3e2e5339ee2796745b6f99133c848128ff6b76a87556b60000c542aedd47f09e398057d18f6d053b0c7e490641b9d05ccf333a2b141de785c2d501fec04b
+MISC ChangeLog-2015 3416 SHA256 c4b58be26360dcc6266f3d7255038088f037031ec72c0b452ce8143ba3d4b3cb SHA512 721dc34617dc8b7327a1238cde4bddc70595b37885b69d83f54d9eb21f6abed598fc20e14b16eb2f9e73a31878f986d88305664551c67727d716e7d721c50995 WHIRLPOOL 50fefd66afc208256051a0a7f4360847c37ffafd791673e7f475b55f44dc0af7ce6520028a1ab835bad7c477dbcaa81c9143ee9de0d46f6a8406b33a156b2ba7
+MISC metadata.xml 749 SHA256 10bc130f2104e5655045aeb647bff9fcf37991710b8e3352fca8c17b1cd5b682 SHA512 6aed4f9d6a8cb9e5b3d5998eac7770a8bd8e806af2bff41016a6d9cc3d1a1dbbd38c9d7518be3f5e930a41b562417c479725f572880e77eb75603ac152f67dc3 WHIRLPOOL 67a0c9e43711c90513b2a94fdb0978cf134473aad5e777058a830113468ad971258537abd2c5f8e2ce976ab7e64fcb38b226e6522336e37174099b62ea102b4f
diff --git a/app-forensics/magicrescue/files/magicrescue-1.1.9-ldflags.patch b/app-forensics/magicrescue/files/magicrescue-1.1.9-ldflags.patch
new file mode 100644
index 000000000000..96818c3d58ed
--- /dev/null
+++ b/app-forensics/magicrescue/files/magicrescue-1.1.9-ldflags.patch
@@ -0,0 +1,50 @@
+diff -Naurd magicrescue-1.1.9/Makefile.in magicrescue-1.1.9.new//Makefile.in
+--- magicrescue-1.1.9/Makefile.in 2008-06-27 00:24:06.000000000 +0400
++++ magicrescue-1.1.9.new//Makefile.in 2012-05-13 07:57:59.000000000 +0400
+@@ -21,7 +21,7 @@
+ $(CC) -o $@ $(LDFLAGS) $(MAGICRESCUE_OBJS)
+
+ dupemap: $(DUPEMAP_OBJS)
+- $(CC) -o $@ $(LDFLAGS) $(DBM_LDFLAGS) $(DUPEMAP_OBJS)
++ $(CC) -o $@ $(LDFLAGS) $(DUPEMAP_OBJS) $(DBM_LDFLAGS)
+
+ tools/inputseek: $(INPUTSEEK_OBJS)
+ $(CC) -o $@ $(LDFLAGS) $(INPUTSEEK_OBJS)
+diff -Naurd magicrescue-1.1.9/config.d/50dbm magicrescue-1.1.9.new//config.d/50dbm
+--- magicrescue-1.1.9/config.d/50dbm 2008-06-27 00:24:05.000000000 +0400
++++ magicrescue-1.1.9.new//config.d/50dbm 2012-05-13 07:56:16.000000000 +0400
+@@ -14,18 +14,14 @@
+ flag="`echo $flag|sed 's/./-l&/'`"
+ echo "trying to link with flags [$flag]" >&5
+
+- bak_LDFLAGS="$LDFLAGS"
+- LDFLAGS="$LDFLAGS $flag"
++ LIBS="$flag"
+ if conftest_link; then
+ # we found it!
+- LDFLAGS="$bak_LDFLAGS"
+ DBM_LDFLAGS="$flag"
+ env_vars="$env_vars DBM_LDFLAGS"
+ echo "#define $dbmdef" >> config.h
+ echo "#define HAVE_NDBM" >> config.h
+ return 0
+- else
+- LDFLAGS="$bak_LDFLAGS"
+ fi
+ done
+
+diff -Naurd magicrescue-1.1.9/configure magicrescue-1.1.9.new//configure
+--- magicrescue-1.1.9/configure 2008-06-27 00:24:06.000000000 +0400
++++ magicrescue-1.1.9.new//configure 2012-05-13 07:56:16.000000000 +0400
+@@ -63,9 +63,9 @@
+ }
+
+ conftest_link() {
+- echo "$CC -o conftest $LDFLAGS conftest.o" >&5
++ echo "$CC -o conftest $LDFLAGS conftest.o $LIBS" >&5
+ echo >&5
+- $CC -o conftest $LDFLAGS conftest.o >&5 2>&5 \
++ $CC -o conftest $LDFLAGS conftest.o $LIBS >&5 2>&5 \
+ && [ -x conftest ] && ./conftest 2>&5
+ }
+
diff --git a/app-forensics/magicrescue/files/magicrescue-1.1.9-makefile.patch b/app-forensics/magicrescue/files/magicrescue-1.1.9-makefile.patch
new file mode 100644
index 000000000000..3f57b1303c6e
--- /dev/null
+++ b/app-forensics/magicrescue/files/magicrescue-1.1.9-makefile.patch
@@ -0,0 +1,52 @@
+--- magicrescue-1.1.9/Makefile.in.orig
++++ magicrescue-1.1.9/Makefile.in
+@@ -57,34 +57,31 @@
+ maintainer-clean: distclean docs-clean
+
+ install: all
+- [ -d $(PREFIX) ]
++ mkdir -p $(DESTDIR)$(PREFIX)/share/magicrescue/tools \
++ $(DESTDIR)$(PREFIX)/share/magicrescue/recipes \
++ $(DESTDIR)$(PREFIX)/share/man/man1 \
++ $(DESTDIR)$(PREFIX)/bin
+
+- mkdir -p $(PREFIX)/share/magicrescue/tools \
+- $(PREFIX)/share/magicrescue/recipes \
+- $(PREFIX)/man/man1 \
+- $(PREFIX)/bin
+-
+- cp magicrescue$(EXE) dupemap$(EXE) magicsort $(PREFIX)/bin/
+- cp recipes/* $(PREFIX)/share/magicrescue/recipes/
+- cp $(DOCS) $(PREFIX)/man/man1
++ cp magicrescue$(EXE) dupemap$(EXE) magicsort $(DESTDIR)$(PREFIX)/bin
++ cp recipes/* $(DESTDIR)$(PREFIX)/share/magicrescue/recipes/
++ cp $(DOCS) $(DESTDIR)$(PREFIX)/share/man/man1
+
+ for f in tools/*; do \
+ if [ -x "$$f" ]; then \
+- cp -f "$$f" $(PREFIX)/share/magicrescue/tools/; \
++ cp -f "$$f" $(DESTDIR)$(PREFIX)/share/magicrescue/tools/; \
+ fi; \
+ done
+
+ uninstall:
+- [ -d $(PREFIX) ]
+- rm -f $(PREFIX)/bin/magicrescue$(EXE)
+- rm -f $(PREFIX)/bin/dupemap$(EXE)
+- rm -f $(PREFIX)/bin/magicsort
++ rm -f $(DESTDIR)$(PREFIX)/bin/magicrescue$(EXE)
++ rm -f $(DESTDIR)$(PREFIX)/bin/dupemap$(EXE)
++ rm -f $(DESTDIR)$(PREFIX)/bin/magicsort
+ for f in $(DOCS); do \
+- rm -f "$(PREFIX)/man/man1/`basename $$f`"; \
++ rm -f "$(DESTDIR)$(PREFIX)/share/man/man1/`basename $$f`"; \
+ done
+- rm -rf $(PREFIX)/share/magicrescue/tools
+- rm -rf $(PREFIX)/share/magicrescue/recipes
+- -rmdir $(PREFIX)/share/magicrescue
++ rm -rf $(DESTDIR)$(PREFIX)/share/magicrescue/tools
++ rm -rf $(DESTDIR)$(PREFIX)/share/magicrescue/recipes
++ -rmdir $(DESTDIR)$(PREFIX)/share/magicrescue
+
+ .PHONY: all clean distclean docs-clean maintainer-clean install uninstall docs
+
diff --git a/app-forensics/magicrescue/magicrescue-1.1.9.ebuild b/app-forensics/magicrescue/magicrescue-1.1.9.ebuild
new file mode 100644
index 000000000000..20850ae7df70
--- /dev/null
+++ b/app-forensics/magicrescue/magicrescue-1.1.9.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Find deleted files in block devices"
+HOMEPAGE="http://www.itu.dk/people/jobr/magicrescue/"
+SRC_URI="http://www.itu.dk/people/jobr/magicrescue/release/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="amd64 ~ppc x86"
+IUSE=""
+
+DEPEND="|| ( sys-libs/gdbm sys-libs/db )"
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+ epatch "${FILESDIR}"/${P}-makefile.patch
+ epatch "${FILESDIR}"/${P}-ldflags.patch
+ tc-export CC
+}
+
+src_configure() {
+ # Not autotools, just looks like it sometimes
+ ./configure --prefix=/usr || die
+}
diff --git a/app-forensics/magicrescue/metadata.xml b/app-forensics/magicrescue/metadata.xml
new file mode 100644
index 000000000000..74b8ea10f77a
--- /dev/null
+++ b/app-forensics/magicrescue/metadata.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+<!-- maintainer-needed -->
+<longdescription>
+Magic Rescue scans a block device for file types it knows how to recover and calls an external program to extract them. It looks
+at "magic bytes" in file contents, so it can be used both as an undelete utility and for recovering a corrupted drive or
+partition. As long as the file data is there, it will find it.
+
+It works on any file system, but on very fragmented file systems it can only recover the first chunk of each file. Practical
+experience (this program was not written for fun) shows, however, that chunks of 30-50MB are not uncommon.
+</longdescription>
+</pkgmetadata>
diff --git a/app-forensics/memdump/Manifest b/app-forensics/memdump/Manifest
new file mode 100644
index 000000000000..395423c0a164
--- /dev/null
+++ b/app-forensics/memdump/Manifest
@@ -0,0 +1,6 @@
+AUX memdump-1.01-linux3.patch 651 SHA256 8a98257ebfd24774ae1fd0fb507f607cf5461baa39c8ca291bb23f334919d793 SHA512 c0fefcbc53926173d8811714706a0e2a89ba9e1b954d9350c84244cfcfc65db55704e5ad62c7c4fad0c0c6ca080c665c6a466591596ef86d09dfea4bcc2ad157 WHIRLPOOL 973a21801be9d958522eb927892598399c0302d37695dac1327b50d57a02de69f0863606f01f7e4df166f8a47ebd5bf35ec3adff7140b4ef648d5e87032a2fa0
+DIST memdump-1.01.tar.gz 12713 SHA256 76de8ff167d0779d6c3b2f2f52ca9d1cc22af179c51e976fe6e3b9a5d1e5799f SHA512 46d013f812b0a5807c7ba38d6c3940e105057ba8e64b4f45b75a0800cab212d164caf881efbc1958d5c5c239236fdcb61f6fe093886ff3e28bc0b70791aaee3e WHIRLPOOL ae6e44d186a03b3b869473ec12a0bf1869d1e187c4e51092f370462ccdd1f20c5fa717ffcede808c04651444f8f1ed90515480d3400e6fd4c73d8bf9e73da5e7
+EBUILD memdump-1.01.ebuild 872 SHA256 8daae3565cfc5f3a89cf33f2388eddd92ef555c3c5bf278058b36b234092005a SHA512 df77ceb00557b1cd7ee37e809c21d7f642f1d9522e04e25503c3380a90bdab4508a1662bb3487e65a03a534d266713b80bf2eb62763211a20efc5d5d0cc324ca WHIRLPOOL 95ec1720cfcbc3256e3eafd380544665a959e6dc3e1b749a07aeac3fd179bcb7b7b822d0bba0f20ea87ddb4f5d17e2e83ca828ea400fa0ba830e80859affffd2
+MISC ChangeLog 2464 SHA256 7002a1a61fe84e17df263c7477e52e6ea9a2c80bd0eacbda031e8dd38b1f974e SHA512 644d9021ad6893f83759bf530315b84234c3517a82c618f18c7ad46c17102b1f0848f48611922e95b469e005e927b2fa3d21ab62b347287fa50bbd8ad805c636 WHIRLPOOL 72a4844300228dc47387117241c31210904ae6248d4ded79ec1f8f5c067ea5638b6321161e065ed0de12725eb106ef1900de8ef911d26d3a68d8866a02427593
+MISC ChangeLog-2015 2173 SHA256 cdbb48fd2ee69f0ab5e8d1dd1086a8025caa817ebed11f3f539201982d8c7d8f SHA512 d663be6d32ab82e322116f7e5c637a15991317fe5a3e13f8a12d1b64a7758322070c074b1e32e5f8052b723346dfc4b6698e7bf84923dc3810e335069fedf943 WHIRLPOOL 211f84861acb38ee8479be1d53d8ac26d7326657d92d90e86c01d6c35e689658844be5e3a96d842ce2d9540eab2637991d63118b7782e940ec37632e809d8f97
+MISC metadata.xml 167 SHA256 5fe493e76bba84455c54b3a46adfae5a1bfe01c764ef0d9e5f6d3e8a1d142188 SHA512 7c8decb24ee3a850e38186cf3c7f8933a28017426806870ad6ef9ceb2533be147a2681fc789b535a81cb528af8c29d90d3006e4f250aee23bd7dea4561294e33 WHIRLPOOL dc6c3dfc7fd7f0d76c97f0786cb76a55b8564f8437f96d4ccebf985817b9f6dcc4c61830aa5df80d725e4a54b281ea2e03d6b0859214af081112cba15025e64b
diff --git a/app-forensics/memdump/files/memdump-1.01-linux3.patch b/app-forensics/memdump/files/memdump-1.01-linux3.patch
new file mode 100644
index 000000000000..55563c4e077a
--- /dev/null
+++ b/app-forensics/memdump/files/memdump-1.01-linux3.patch
@@ -0,0 +1,24 @@
+--- memdump-1.01.orig/makedefs
++++ memdump-1.01/makedefs
+@@ -30,9 +30,7 @@
+ SunOS.5*) DEFS="-DSUNOS5 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ RANLIB=":"
+ ;;
+- Linux.2.4*) DEFS="-DLINUX2 -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+- ;;
+- Linux.2*) DEFS="-DLINUX2"
++ Linux.*) DEFS="-DLINUX -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64"
+ ;;
+ *) echo unsupported system: $SYSTEM.$RELEASE 1>&2; exit 1
+ ;;
+--- memdump-1.01.orig/memdump.c
++++ memdump-1.01/memdump.c
+@@ -118,7 +118,7 @@
+ #define SUPPORTED
+ #endif
+
+-#ifdef LINUX2
++#ifdef LINUX
+ #include <paths.h>
+ #define GETPAGESIZE getpagesize
+ #define SUPPORTED
diff --git a/app-forensics/memdump/memdump-1.01.ebuild b/app-forensics/memdump/memdump-1.01.ebuild
new file mode 100644
index 000000000000..efa73c2f97fd
--- /dev/null
+++ b/app-forensics/memdump/memdump-1.01.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit toolchain-funcs eutils
+
+DESCRIPTION="Simple memory dumper for UNIX-Like systems"
+HOMEPAGE="http://www.porcupine.org/forensics"
+SRC_URI="http://www.porcupine.org/forensics/${P}.tar.gz"
+
+LICENSE="IBM"
+SLOT="0"
+KEYWORDS="amd64 ppc x86"
+IUSE=""
+
+src_prepare() {
+ sed -i -e 's:$(CFLAGS):\0 $(LDFLAGS):' Makefile || die
+ epatch "${FILESDIR}"/${P}-linux3.patch
+}
+
+src_compile() {
+ emake CC="$(tc-getCC)" XFLAGS="${CFLAGS}" OPT= DEBUG=
+}
+
+src_test() {
+ if [[ ${EUID} -ne 0 ]];
+ then
+ einfo "Cannot test with FEATURES=userpriv"
+ elif [ -x /bin/wc ];
+ then
+ einfo "testing"
+ if [ "`./memdump -s 344 | wc -c`" = "344" ];
+ then
+ einfo "passed test"
+ else
+ die "failed test"
+ fi
+ fi
+}
+
+src_install() {
+ dosbin memdump
+ dodoc README
+ doman memdump.1
+}
diff --git a/app-forensics/memdump/metadata.xml b/app-forensics/memdump/metadata.xml
new file mode 100644
index 000000000000..7a38bb900964
--- /dev/null
+++ b/app-forensics/memdump/metadata.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+</pkgmetadata>
diff --git a/app-forensics/metadata.xml b/app-forensics/metadata.xml
new file mode 100644
index 000000000000..c0d98da0e1f3
--- /dev/null
+++ b/app-forensics/metadata.xml
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<catmetadata>
+ <longdescription lang="en">
+ The app-forensics category contains software which helps detect and
+ analyse security breaches.
+ </longdescription>
+ <longdescription lang="de">
+ Die Kategorie app-forensics enthält Programme welche beim Erkennen
+ und Analysieren von Sicherheitsbrüchen helfen.
+ </longdescription>
+ <longdescription lang="es">
+ La categoría app-forensics contiene programas para ayudar a detectar
+ y analizar problemas de seguridad.
+ </longdescription>
+ <longdescription lang="ja">
+ app-forensicsカテゴリには安全保侵犯を捜し当てると取調べる
+ ソフトウェアが含まれます。
+ </longdescription>
+ <longdescription lang="nl">
+ De app-forensics categorie bevat applicaties voor het detecteren en
+ analyseren van inbreuken op de veiligheid van het systeem.
+ </longdescription>
+ <longdescription lang="vi">
+ Nhóm app-forensics chứa các phần mềm hỗ trợ dò tìm,
+ phân tích các lỗ hổng bảo mật.
+ </longdescription>
+ <longdescription lang="it">
+ La categoria app-forensics contiene programmi che aiutono a trovare
+ ed analizzare problemi di sicurezza.
+ </longdescription>
+ <longdescription lang="pt">
+ A categoria app-forensics contém programas que ajudam a detectar
+ e analisar problemas de segurança.
+ </longdescription>
+ <longdescription lang="pl">
+ Kategoria app-forensics zawiera oprogramowanie ułatwiające
+ przeprowadzanie audytu bezpieczeństwa systemu.
+ </longdescription>
+</catmetadata>
+
diff --git a/app-forensics/openscap/Manifest b/app-forensics/openscap/Manifest
new file mode 100644
index 000000000000..d741b8b6397c
--- /dev/null
+++ b/app-forensics/openscap/Manifest
@@ -0,0 +1,10 @@
+DIST openscap-1.2.13.tar.gz 15874074 SHA256 eeaa37a48b71b0cd455a94f40f01aea0572a846a9ea2722f7f5d2fbbc949ec5c SHA512 393b426f3278ab9438439df9a077b95b29bba66dfc2c799b7b40c2bf3980cf619aa1efc27225785ec780aa75926af6751b10fdb0b8d561c8056bf9a9a087792a WHIRLPOOL c49b039f5f05c333ddc0089d7aa0ee6d617af726ca8fbd68316ff6c6e3302eaff36cc527c71c9383934f4143e3c889817c1b5c0b2d783f4652be7b84045c3304
+DIST openscap-1.2.14.tar.gz 15980085 SHA256 99100549029c65cf6ad2425ec7f3b189ffb833ad12012e7086e177768f241f33 SHA512 0e408b2dd58b8b424a27f5c852c6dc8c596fdb201e45cc5f762a1998e00511040762df4e55cdfd93dac4c820c28935acdf3942e96227dfa4f4363d682a2da7da WHIRLPOOL d2c4777f00f5c487b2ce1166fa49d878a2a7da2eadcde92c96c243b5447025151d0751e29dc8ae357af10dca6c57a553d9b8ce48f51c08f6be2b19e1a9b03cba
+DIST openscap-1.2.5.tar.gz 14513153 SHA256 7e0c56c108ff3042fd6a6650a808553de15e4dfc7ccc9fcdd6a839de827c47ed SHA512 abeafafeaedd60ca08b52b981f83d458bc972894fc466d7cff29170b578a023f314bd330d7c812d838e09cad567ddc5daafa7e46e4b9a0db76451114d98d17ca WHIRLPOOL 703c6467aa19384f6c50bf0cb465ad2a21c724892e8d7db1f1439992dff939933ff4c48d049bddfddd97599618aee0b27c51596e2f84778707257092273897db
+EBUILD openscap-1.2.13.ebuild 4286 SHA256 eb1f671cd2a9536958f3cf1778c842a25075ebf6a683c126f359fd45466aa1d3 SHA512 7afdb887a8525c6cc159d3fb13409992461d17b1c39ffaff88d2d25ca7b2b357b374f0fac4741e2a5d462f52bedaa6cf207ebadc917ff84ed40ec94769feebd1 WHIRLPOOL 2b26613b749d93694e6cbee54981184bf9e66f54f13a8c6bb1055a1bef47163871855dacf6549c3b577eceebc895abbfbf2ae5e5cec0ede49566288caab40547
+EBUILD openscap-1.2.14.ebuild 4286 SHA256 eb1f671cd2a9536958f3cf1778c842a25075ebf6a683c126f359fd45466aa1d3 SHA512 7afdb887a8525c6cc159d3fb13409992461d17b1c39ffaff88d2d25ca7b2b357b374f0fac4741e2a5d462f52bedaa6cf207ebadc917ff84ed40ec94769feebd1 WHIRLPOOL 2b26613b749d93694e6cbee54981184bf9e66f54f13a8c6bb1055a1bef47163871855dacf6549c3b577eceebc895abbfbf2ae5e5cec0ede49566288caab40547
+EBUILD openscap-1.2.5.ebuild 4269 SHA256 09ca5ce0a792cd6347abfbe73388dd593db0fe46aae2dfbb27e2d1f24c3b16b9 SHA512 271741cfe0a503f05c4fc1b93af2d517fb91f5c6a8c455d3bfccba79e2d63b9613282c127f225041e761be7db5130e40740960feb423fd8a1a1a0f5b7c5ce487 WHIRLPOOL 2bda1c987e3c5f66c26d5cf01d918f92beb4add5378e8ec3d2c0e690d2a7e076b6a5cc8b5ab9b7e1ef92f6df0c88764c04c236664be088776d70b67987a582dd
+EBUILD openscap-9999.ebuild 4676 SHA256 9d89967e25ab642d7a4094675d19b04c498897c87e57c502bdabea9cac668e3a SHA512 26cd58bc350b66849fe79691f62220b316f3ff39550e5d6eab3be883b6c7059ae7cc04ee5f425a0c220568bb91cbad278aca455ee2fdae87562ba699ebc82c3e WHIRLPOOL 6c832c342e2da44b5d800331f2daee5a7416416a34e31ac25e7862dd1e94d110bf7243bffa4792e22b5a4220d0caf0315bf47b71ff439ab800dad4b506288f9f
+MISC ChangeLog 3276 SHA256 c3da8cdf755cc16919f3232df0a249b8a9927cb902f5b9580fc2cbc566be209c SHA512 4eafd090987f96e25a5940cbc640590ca8fbf462e0e25bd1a360503c2f3b894ca1dd4b5cb2e19fb1769e9b80b82311d427da8f9b46191b32c6f1d8411f71bd16 WHIRLPOOL 33fbc617d55cd8a3c0c6f4d1e22fbf97001f1e40ac0e3eeb86040f165ee8653cb8d0975d56a73fc51d506953586b605cd08ef5310d8749e9be1f3824c8a1b44a
+MISC ChangeLog-2015 6936 SHA256 c9e46a16a9ee91920b327cb29206828f76bd452cc37a6e4eefce61cb3db2550e SHA512 6e5a04d108605a94c3e27b2825afcec8bd3c44f6aab96c17229028d554b0e942c386656bcb1bfe7e2aa53b02ecbd347fb9da6d35f7d6f556f3af9142352cce1e WHIRLPOOL c912d58c9da17d975b5925fb683511ffc7f744f0ca1ef829c9a4e3c14756485cedd657764fcd07d9eadb678a8d693059d24b4b3c216b74e2f65e56fab707bf6e
+MISC metadata.xml 793 SHA256 d362f5af5f643ece760ea65c28b293174763c2879378bde2602bec31d4ecd467 SHA512 0c650d7df0cf925773486d6ccfedfc1f23fff71036708e6b653dbb2dc0aa00090cc3caf20ee65596c09a43a82453a454f40f5beed8b5988a37380fcee2f4f93b WHIRLPOOL e6c174c6bf2872b9ccfda0a6918947e698581c89684e0ebdc1428d555611815496ec5c5d4b8be894b966d7aafc64a6a221f60b4cf49dff97d6ff05ad586ecfd5
diff --git a/app-forensics/openscap/metadata.xml b/app-forensics/openscap/metadata.xml
new file mode 100644
index 000000000000..44620eebd9c2
--- /dev/null
+++ b/app-forensics/openscap/metadata.xml
@@ -0,0 +1,22 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>clabbe.montjoie@gmail.com</email>
+ <name>LABBE Corentin (Montjoie)</name>
+ </maintainer>
+ <maintainer type="project">
+ <email>proxy-maint@gentoo.org</email>
+ <name>Proxy Maintainers</name>
+ </maintainer>
+ <use>
+ <flag name="gconf">Build the gconf independant probes</flag>
+ <flag name="nss">Prefer NSS over libgcrypt as the crypto engine</flag>
+ <flag name="rpm">Compiles the RPM probes</flag>
+ <flag name="sce">Enables Script Check Engine (SCE) support</flag>
+ <flag name="sql">Build the sql independant probes</flag>
+ </use>
+ <upstream>
+ <remote-id type="github">OpenSCAP/openscap</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/openscap/openscap-1.2.13.ebuild b/app-forensics/openscap/openscap-1.2.13.ebuild
new file mode 100644
index 000000000000..d2b7aa583d7a
--- /dev/null
+++ b/app-forensics/openscap/openscap-1.2.13.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit bash-completion-r1 eutils multilib python-single-r1
+
+DESCRIPTION="Framework which enables integration with Security Content Automation Protocol"
+HOMEPAGE="http://www.open-scap.org/"
+SRC_URI="https://github.com/OpenSCAP/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="acl caps debug doc gconf ldap nss pcre perl python rpm selinux sce sql test xattr"
+RESTRICT="test"
+
+RDEPEND="!nss? ( dev-libs/libgcrypt:0 )
+ nss? ( dev-libs/nss )
+ acl? ( virtual/acl )
+ caps? ( sys-libs/libcap )
+ gconf? ( gnome-base/gconf )
+ ldap? ( net-nds/openldap )
+ pcre? ( dev-libs/libpcre )
+ rpm? ( >=app-arch/rpm-4.9 )
+ sql? ( dev-db/opendbx )
+ xattr? ( sys-apps/attr )
+ dev-libs/libpcre
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-misc/curl
+ ${PYTHON_DEPS}"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ perl? ( dev-lang/swig )
+ python? ( dev-lang/swig )
+ test? (
+ app-arch/unzip
+ dev-perl/XML-XPath
+ net-misc/ipcalc
+ sys-apps/grep )"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+src_prepare() {
+# uncoment for debugging test
+# sed -i 's,set -e,&;set -x,' tests/API/XCCDF/unittests/test_remediate_simple.sh || die
+# sed -i 's,^ bash, LC_ALL=C bash,' tests/probes/process/test_probes_process.sh || die
+
+ sed -i 's/uname -p/uname -m/' tests/probes/uname/test_probes_uname.xml.sh || die
+
+ #probe runlevel for non-centos/redhat/fedora is not implemented
+ sed -i 's,.*runlevel_test.*,echo "runlevel test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,probecheck "runlevel,probecheck "runlevellllll,' tests/probes/runlevel/test_probes_runlevel.sh || die
+
+ #According to comment of theses tests, we must modify it. For the moment disable it
+ sed -i 's,.*linux-def_inetlisteningservers_test,#&,' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*ind-def_environmentvariable_test,#&,' tests/mitre/test_mitre.sh || die
+
+ # theses tests are hardcoded for checking hald process...,
+ # but no good solution for the moment, disabling them with a fake echo
+ # because encased in a if then
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process_test.xml || die
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process58_test.xml || die
+ sed -i 's,.*process_test.*,echo "process test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*process58_test.*,echo "process58 test bypassed",' tests/mitre/test_mitre.sh || die
+
+ #This test fail
+ sed -i 's,.*generate report: xccdf,#&,' tests/API/XCCDF/unittests/all.sh || die
+
+ if ! use rpm ; then
+ sed -i 's,probe_rpminfo_req_deps_ok=yes,probe_rpminfo_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpminfo_opt_deps_ok=yes,probe_rpminfo_opt_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_req_deps_ok=yes,probe_rpmverify_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_opt_deps_ok=yes,probe_rpmverify_opt_deps_ok=no,' configure || die
+ sed -i 's,^probe_rpm.*_deps_missing=,&disabled_by_USE_flag,' configure || die
+ sed -i 's,.*rpm.*,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use selinux ; then
+ einfo "Disabling SELinux probes"
+ sed -i 's,.*selinux.*, echo "SELinux test bypassed",' tests/mitre/test_mitre.sh || die
+ #process58 need selinux
+ sed -i 's,.*process58,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use ldap; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,ldap.h,ldapp.h,g' configure || die
+ fi
+
+ epatch_user
+}
+
+src_configure() {
+ python_setup
+ local myconf
+ if use debug ; then
+ myconf+=" --enable-debug"
+ fi
+ if use python ; then
+ myconf+=" --enable-python"
+ else
+ myconf+=" --enable-python=no"
+ fi
+ if use perl ; then
+ myconf+=" --enable-perl"
+ fi
+ if use nss ; then
+ myconf+=" --with-crypto=nss3"
+ else
+ myconf+=" --with-crypto=gcrypt"
+ fi
+ if use sce ; then
+ myconf+=" --enable-sce"
+ else
+ myconf+=" --enable-sce=no"
+ fi
+ econf ${myconf}
+}
+
+src_compile() {
+ emake
+ if use doc ; then
+ cd docs && doxygen Doxyfile || die
+ fi
+}
+
+src_install() {
+ emake install DESTDIR="${D}"
+ prune_libtool_files --all
+ if use doc ; then
+ dohtml -r docs/html/.
+ dodoc -r docs/examples/.
+ fi
+ dobashcomp "${D}"/etc/bash_completion.d/oscap
+ rm -rf "${D}"/etc/bash_completion.d || die
+}
diff --git a/app-forensics/openscap/openscap-1.2.14.ebuild b/app-forensics/openscap/openscap-1.2.14.ebuild
new file mode 100644
index 000000000000..d2b7aa583d7a
--- /dev/null
+++ b/app-forensics/openscap/openscap-1.2.14.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit bash-completion-r1 eutils multilib python-single-r1
+
+DESCRIPTION="Framework which enables integration with Security Content Automation Protocol"
+HOMEPAGE="http://www.open-scap.org/"
+SRC_URI="https://github.com/OpenSCAP/${PN}/releases/download/${PV}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="acl caps debug doc gconf ldap nss pcre perl python rpm selinux sce sql test xattr"
+RESTRICT="test"
+
+RDEPEND="!nss? ( dev-libs/libgcrypt:0 )
+ nss? ( dev-libs/nss )
+ acl? ( virtual/acl )
+ caps? ( sys-libs/libcap )
+ gconf? ( gnome-base/gconf )
+ ldap? ( net-nds/openldap )
+ pcre? ( dev-libs/libpcre )
+ rpm? ( >=app-arch/rpm-4.9 )
+ sql? ( dev-db/opendbx )
+ xattr? ( sys-apps/attr )
+ dev-libs/libpcre
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-misc/curl
+ ${PYTHON_DEPS}"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ perl? ( dev-lang/swig )
+ python? ( dev-lang/swig )
+ test? (
+ app-arch/unzip
+ dev-perl/XML-XPath
+ net-misc/ipcalc
+ sys-apps/grep )"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+src_prepare() {
+# uncoment for debugging test
+# sed -i 's,set -e,&;set -x,' tests/API/XCCDF/unittests/test_remediate_simple.sh || die
+# sed -i 's,^ bash, LC_ALL=C bash,' tests/probes/process/test_probes_process.sh || die
+
+ sed -i 's/uname -p/uname -m/' tests/probes/uname/test_probes_uname.xml.sh || die
+
+ #probe runlevel for non-centos/redhat/fedora is not implemented
+ sed -i 's,.*runlevel_test.*,echo "runlevel test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,probecheck "runlevel,probecheck "runlevellllll,' tests/probes/runlevel/test_probes_runlevel.sh || die
+
+ #According to comment of theses tests, we must modify it. For the moment disable it
+ sed -i 's,.*linux-def_inetlisteningservers_test,#&,' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*ind-def_environmentvariable_test,#&,' tests/mitre/test_mitre.sh || die
+
+ # theses tests are hardcoded for checking hald process...,
+ # but no good solution for the moment, disabling them with a fake echo
+ # because encased in a if then
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process_test.xml || die
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process58_test.xml || die
+ sed -i 's,.*process_test.*,echo "process test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*process58_test.*,echo "process58 test bypassed",' tests/mitre/test_mitre.sh || die
+
+ #This test fail
+ sed -i 's,.*generate report: xccdf,#&,' tests/API/XCCDF/unittests/all.sh || die
+
+ if ! use rpm ; then
+ sed -i 's,probe_rpminfo_req_deps_ok=yes,probe_rpminfo_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpminfo_opt_deps_ok=yes,probe_rpminfo_opt_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_req_deps_ok=yes,probe_rpmverify_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_opt_deps_ok=yes,probe_rpmverify_opt_deps_ok=no,' configure || die
+ sed -i 's,^probe_rpm.*_deps_missing=,&disabled_by_USE_flag,' configure || die
+ sed -i 's,.*rpm.*,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use selinux ; then
+ einfo "Disabling SELinux probes"
+ sed -i 's,.*selinux.*, echo "SELinux test bypassed",' tests/mitre/test_mitre.sh || die
+ #process58 need selinux
+ sed -i 's,.*process58,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use ldap; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,ldap.h,ldapp.h,g' configure || die
+ fi
+
+ epatch_user
+}
+
+src_configure() {
+ python_setup
+ local myconf
+ if use debug ; then
+ myconf+=" --enable-debug"
+ fi
+ if use python ; then
+ myconf+=" --enable-python"
+ else
+ myconf+=" --enable-python=no"
+ fi
+ if use perl ; then
+ myconf+=" --enable-perl"
+ fi
+ if use nss ; then
+ myconf+=" --with-crypto=nss3"
+ else
+ myconf+=" --with-crypto=gcrypt"
+ fi
+ if use sce ; then
+ myconf+=" --enable-sce"
+ else
+ myconf+=" --enable-sce=no"
+ fi
+ econf ${myconf}
+}
+
+src_compile() {
+ emake
+ if use doc ; then
+ cd docs && doxygen Doxyfile || die
+ fi
+}
+
+src_install() {
+ emake install DESTDIR="${D}"
+ prune_libtool_files --all
+ if use doc ; then
+ dohtml -r docs/html/.
+ dodoc -r docs/examples/.
+ fi
+ dobashcomp "${D}"/etc/bash_completion.d/oscap
+ rm -rf "${D}"/etc/bash_completion.d || die
+}
diff --git a/app-forensics/openscap/openscap-1.2.5.ebuild b/app-forensics/openscap/openscap-1.2.5.ebuild
new file mode 100644
index 000000000000..444292acf604
--- /dev/null
+++ b/app-forensics/openscap/openscap-1.2.5.ebuild
@@ -0,0 +1,138 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit bash-completion-r1 eutils multilib python-single-r1
+
+DESCRIPTION="Framework which enables integration with Security Content Automation Protocol"
+HOMEPAGE="http://www.open-scap.org/"
+SRC_URI="https://fedorahosted.org/releases/o/p/${PN}/${P}.tar.gz"
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="acl caps debug doc gconf ldap nss pcre perl python rpm selinux sce sql test xattr"
+RESTRICT="test"
+
+RDEPEND="!nss? ( dev-libs/libgcrypt:0 )
+ nss? ( dev-libs/nss )
+ acl? ( virtual/acl )
+ caps? ( sys-libs/libcap )
+ gconf? ( gnome-base/gconf )
+ ldap? ( net-nds/openldap )
+ pcre? ( dev-libs/libpcre )
+ rpm? ( >=app-arch/rpm-4.9 )
+ sql? ( dev-db/opendbx )
+ xattr? ( sys-apps/attr )
+ dev-libs/libpcre
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-misc/curl
+ ${PYTHON_DEPS}"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ perl? ( dev-lang/swig )
+ python? ( dev-lang/swig )
+ test? (
+ app-arch/unzip
+ dev-perl/XML-XPath
+ net-misc/ipcalc
+ sys-apps/grep )"
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+src_prepare() {
+# uncoment for debugging test
+# sed -i 's,set -e,&;set -x,' tests/API/XCCDF/unittests/test_remediate_simple.sh || die
+# sed -i 's,^ bash, LC_ALL=C bash,' tests/probes/process/test_probes_process.sh || die
+
+ sed -i 's/uname -p/uname -m/' tests/probes/uname/test_probes_uname.xml.sh || die
+
+ #probe runlevel for non-centos/redhat/fedora is not implemented
+ sed -i 's,.*runlevel_test.*,echo "runlevel test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,probecheck "runlevel,probecheck "runlevellllll,' tests/probes/runlevel/test_probes_runlevel.sh || die
+
+ #According to comment of theses tests, we must modify it. For the moment disable it
+ sed -i 's,.*linux-def_inetlisteningservers_test,#&,' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*ind-def_environmentvariable_test,#&,' tests/mitre/test_mitre.sh || die
+
+ # theses tests are hardcoded for checking hald process...,
+ # but no good solution for the moment, disabling them with a fake echo
+ # because encased in a if then
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process_test.xml || die
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process58_test.xml || die
+ sed -i 's,.*process_test.*,echo "process test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*process58_test.*,echo "process58 test bypassed",' tests/mitre/test_mitre.sh || die
+
+ #This test fail
+ sed -i 's,.*generate report: xccdf,#&,' tests/API/XCCDF/unittests/all.sh || die
+
+ if ! use rpm ; then
+ sed -i 's,probe_rpminfo_req_deps_ok=yes,probe_rpminfo_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpminfo_opt_deps_ok=yes,probe_rpminfo_opt_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_req_deps_ok=yes,probe_rpmverify_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_opt_deps_ok=yes,probe_rpmverify_opt_deps_ok=no,' configure || die
+ sed -i 's,^probe_rpm.*_deps_missing=,&disabled_by_USE_flag,' configure || die
+ sed -i 's,.*rpm.*,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use selinux ; then
+ einfo "Disabling SELinux probes"
+ sed -i 's,.*selinux.*, echo "SELinux test bypassed",' tests/mitre/test_mitre.sh || die
+ #process58 need selinux
+ sed -i 's,.*process58,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use ldap; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,ldap.h,ldapp.h,g' configure || die
+ fi
+
+ epatch_user
+}
+
+src_configure() {
+ python_setup
+ local myconf
+ if use debug ; then
+ myconf+=" --enable-debug"
+ fi
+ if use python ; then
+ myconf+=" --enable-python"
+ else
+ myconf+=" --enable-python=no"
+ fi
+ if use perl ; then
+ myconf+=" --enable-perl"
+ fi
+ if use nss ; then
+ myconf+=" --with-crypto=nss3"
+ else
+ myconf+=" --with-crypto=gcrypt"
+ fi
+ if use sce ; then
+ myconf+=" --enable-sce"
+ else
+ myconf+=" --enable-sce=no"
+ fi
+ econf ${myconf}
+}
+
+src_compile() {
+ emake
+ if use doc ; then
+ cd docs && doxygen Doxyfile || die
+ fi
+}
+
+src_install() {
+ emake install DESTDIR="${D}"
+ prune_libtool_files --all
+ if use doc ; then
+ dohtml -r docs/html/.
+ dodoc docs/examples/.
+ fi
+ dobashcomp "${D}"/etc/bash_completion.d/oscap
+ rm -rf "${D}"/etc/bash_completion.d || die
+}
diff --git a/app-forensics/openscap/openscap-9999.ebuild b/app-forensics/openscap/openscap-9999.ebuild
new file mode 100644
index 000000000000..1e401b6d8705
--- /dev/null
+++ b/app-forensics/openscap/openscap-9999.ebuild
@@ -0,0 +1,161 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+
+inherit bash-completion-r1 eutils multilib python-single-r1
+
+DESCRIPTION="Framework which enables integration with Security Content Automation Protocol"
+HOMEPAGE="http://www.open-scap.org/"
+if [[ "${PV}" != "9999" ]];
+then
+ SRC_URI="https://fedorahosted.org/releases/o/p/${PN}/${P}.tar.gz"
+ KEYWORDS="~amd64 ~x86"
+else
+ inherit git-2 autotools
+ EGIT_REPO_URI="git://git.fedorahosted.org/git/openscap.git"
+ EGIT_SOURCEDIR="${WORKDIR}/openscap"
+ KEYWORDS=""
+ S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="LGPL-2.1+"
+SLOT="0"
+IUSE="acl caps debug doc gconf ldap nss pcre perl python rpm selinux sce sql test xattr"
+#RESTRICT="test"
+
+RDEPEND="!nss? ( dev-libs/libgcrypt:0 )
+ nss? ( dev-libs/nss )
+ acl? ( virtual/acl )
+ caps? ( sys-libs/libcap )
+ gconf? ( gnome-base/gconf )
+ ldap? ( net-nds/openldap )
+ pcre? ( dev-libs/libpcre )
+ rpm? ( >=app-arch/rpm-4.9 )
+ sql? ( dev-db/opendbx )
+ xattr? ( sys-apps/attr )
+ dev-libs/libpcre
+ dev-libs/libxml2
+ dev-libs/libxslt
+ net-misc/curl
+ ${PYTHON_DEPS}"
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )
+ perl? ( dev-lang/swig )
+ python? ( dev-lang/swig )
+ test? (
+ app-arch/unzip
+ dev-perl/XML-XPath
+ net-misc/ipcalc
+ sys-apps/grep )"
+
+src_unpack() {
+ if [[ "${PV}" == "9999" ]];
+ then
+ git-2_src_unpack
+ fi
+}
+
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+src_prepare() {
+# uncoment for debugging test
+# sed -i 's,set -e,&;set -x,' tests/API/XCCDF/unittests/test_remediate_simple.sh || die
+
+ sed -i 's/uname -p/uname -m/' tests/probes/uname/test_probes_uname.xml.sh || die
+
+ #probe runlevel for non-centos/redhat/fedora is not implemented
+ sed -i 's,.*runlevel_test.*,echo "runlevel test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,probecheck "runlevel,probecheck "runlevellllll,' tests/probes/runlevel/test_probes_runlevel.sh || die
+
+ #According to comment of theses tests, we must modify it. For the moment disable it
+ sed -i 's,.*linux-def_inetlisteningservers_test,#&,' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*ind-def_environmentvariable_test,#&,' tests/mitre/test_mitre.sh || die
+
+ # theses tests are hardcoded for checking hald process...,
+ # but no good solution for the moment, disabling them with a fake echo
+ # because encased in a if then
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process_test.xml || die
+# sed -i 's,ha.d,/sbin/udevd --daemon,g' tests/mitre/unix-def_process58_test.xml || die
+ sed -i 's,.*process_test.*,echo "process test bypassed",' tests/mitre/test_mitre.sh || die
+ sed -i 's,.*process58_test.*,echo "process58 test bypassed",' tests/mitre/test_mitre.sh || die
+
+ #This test fail
+ sed -i 's,.*generate report: xccdf,#&,' tests/API/XCCDF/unittests/all.sh || die
+
+ if [[ "${PV}" == "9999" ]];
+ then
+ # fix automake failure about missing 'config/config.rpath'
+ touch config/config.rpath
+ eautoreconf
+ fi
+
+ if ! use rpm ; then
+ sed -i 's,probe_rpminfo_req_deps_ok=yes,probe_rpminfo_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpminfo_opt_deps_ok=yes,probe_rpminfo_opt_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_req_deps_ok=yes,probe_rpmverify_req_deps_ok=no,' configure || die
+ sed -i 's,probe_rpmverify_opt_deps_ok=yes,probe_rpmverify_opt_deps_ok=no,' configure || die
+ sed -i 's,^probe_rpm.*_deps_missing=,&disabled_by_USE_flag,' configure || die
+ sed -i 's,.*rpm.*,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use selinux ; then
+ einfo "Disabling SELinux probes"
+ sed -i 's,.*selinux.*, echo "SELinux test bypassed",' tests/mitre/test_mitre.sh || die
+ #process58 need selinux
+ sed -i 's,.*process58,#&,' tests/mitre/test_mitre.sh || die
+ fi
+ if ! use ldap; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,ldap.h,ldapp.h,g' configure || die
+ fi
+
+ epatch_user
+}
+
+src_configure() {
+ python_setup
+ local myconf
+ if use debug ; then
+ myconf+=" --enable-debug"
+ fi
+ if use python ; then
+ myconf+=" --enable-python"
+ else
+ myconf+=" --enable-python=no"
+ fi
+ if use perl ; then
+ myconf+=" --enable-perl"
+ fi
+ if use nss ; then
+ myconf+=" --with-crypto=nss3"
+ else
+ myconf+=" --with-crypto=gcrypt"
+ fi
+ if use sce ; then
+ myconf+=" --enable-sce"
+ else
+ myconf+=" --enable-sce=no"
+ fi
+ econf ${myconf}
+}
+
+src_compile() {
+ emake
+ if use doc ; then
+ einfo "Building HTML documentation using Doxygen (which will take a while)"
+ cd docs && doxygen Doxyfile || die
+ fi
+}
+
+src_install() {
+ emake install DESTDIR="${D}"
+ prune_libtool_files --all
+ if use doc ; then
+ dohtml -r docs/html/.
+ dodoc docs/examples/.
+ fi
+ dobashcomp "${D}"/etc/bash_completion.d/oscap
+ rm -rf "${D}"/etc/bash_completion.d || die
+}
diff --git a/app-forensics/ovaldi/Manifest b/app-forensics/ovaldi/Manifest
new file mode 100644
index 000000000000..f6087530de90
--- /dev/null
+++ b/app-forensics/ovaldi/Manifest
@@ -0,0 +1,13 @@
+AUX disable-acl.patch 1407 SHA256 7b47e1dce90e8fd75598a36b4a9edf40ff6614c1a8e48f44c15e41e04be7aa51 SHA512 7df8444f33bc23baf6327fc7fa6fe40329fffd71185ab663f192921bab00d93e360c5ea539318554e42c63da5dbef781ece84e795b46a7ac65dcb694ebb47a35 WHIRLPOOL 43a7a0c76d2c62347b4b942347b2eeee4393466ee695e307e9328174fcfd6b6cf1be57be922fe2e1557a519e6f549796cb6a90e3f6152ee005866789e9037426
+AUX ovaldi-5.10.1.4-disable-selinux-probes.patch 3928 SHA256 5f473d56e7fb93b093b2e1b484d2b7b03ceea2b4e6014cd9a1ebc6a31aebd0f5 SHA512 e9d6f2bab3fd5d6fbb2b6bc6dc881bfb22c873c8856dc9da7c01d2992f74479177d82529df84b186da285aed8d943919b9bbbe59d7d1e0788c42351a3f895217 WHIRLPOOL fd74b7336132fc2296bb280c91428177847001beef8ed86005ac8be8da650a9f62e10164dc3dc7325a6535eb588e36dd5925d60503a7e922475927190b15cd82
+AUX ovaldi-5.10.1.4-strnicmp.patch 292 SHA256 aa4a1f23df2fd4b8ed0456a23948cc597d0573eb1e9881f8a8f229b8778f6a54 SHA512 498ce005a56cbe16377653a25da783e96fc7871cb114d19e3695579263403ecb3a917abe637965bc6ee62dd36e927ad564c83d253b3a6467651e9ad57f9bf1f1 WHIRLPOOL 9f6859f543749c45d98e5fbfbe45a7e5fa341e590a705afe2b7f477f76fa569e0b220b8f0af6d5fd2bdde0183a3f6ce8be93aca3ffe2bfee852da95ec9dcd556
+AUX ovaldi-5.10.1.4-xerces3.patch 13354 SHA256 2ca9f980072333e320cdd5ffb55ccc78e033d1c98746292855439b56b8d42c7f SHA512 4f31d9b7fdbd31fb3228da1d3c637ff8a205395754fd9a27375a33b18d954bfb29b7365e7134e7ae8c93e867dba980f5a18255872d6c64e03f449b32349d2a99 WHIRLPOOL 271b28e3281ef027e41d649507d44c7d8c485de9d75a47c1447550b71a8d13f1dc5da5ded387200094fbbd743361d52635be210e01d5346036d1f844a5057629
+AUX ovaldi-5.10.1.7-disable-acl.patch 1231 SHA256 3f3d7febccaa70baaff3d09990998e85a7214f1b938ef9bcc8dcb70b8c7628ce SHA512 e71a2899b0eb0a9abd6ba2a3a00ef67d6480597defa3390cfd4706e801aa6383c7a6ff5e02e4472b5a707bab35f398b6b9d00377adbd82673b6cf5c9961370a8 WHIRLPOOL 96af23de5321ff8d96c3c89516948d8ed51502c9afa08b4e76b37b1d02e5403977f2cf31a8632e3b6976a44c5f12e62c0252895ca34cc0f87e6ef6b80951c2f3
+AUX ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch 834 SHA256 c64bc28d35461916b0b28a1f56f85ae41a2b76125f39f29bfea0311dec26528b SHA512 f05a797252a2006384f450afd2c0c2b8cd894abc2409b21a3df9cec57af39ff81dc2b007b0e3c460e3ce85855a1b37fe18b5a4b79408969019332300d0c1ed47 WHIRLPOOL 94886d3d84d0a223c0a1047a8c712ed49ecc0e7812d576b99d5e428c57c08bda323e751665d3ed5a5db0539dbb18d53aea9b0bf112edefc7f7998f0d37272a6c
+DIST ovaldi-5.10.1.4-src.tar.bz2 14868251 SHA256 92a22ad75ecdb02abb155e520cf249cc0f737c52b17380b1d58caf410f8c2560 SHA512 d7926a7416fe90013e203b333390e33d51c3eb0caa6ebba69dd593791a8377ac38f5db72fcff2d1ab2dd39a0f5d1b0d2a0d08f906d3e26740288532a27debb47 WHIRLPOOL b9e9142f3d51818c6fbdd12d036176a435bb7af4a75b39bd6bbaee9c542718f9058401ccdfb053a84bac97dfb9b5ba0acdbcf98c4085f6198ad51e94d6ea9d25
+DIST ovaldi-5.10.1.7-src.tar.bz2 20391784 SHA256 daf8061307d5f945b3fda683af2b4407ad7dea345a3c0b2d669f0fd72b9c27ad SHA512 22c373436889b03ffb5d479bd322703bbd8b5b335f116a3b38a3d206ddaaf3115961ab89597c3907b6e5d745eb302a042c135c73cde0eaae10e51f5d6e3e55ec WHIRLPOOL e7a4924eeefb0d1296504adfd6dfcbdeebf0bd9f560bbc94f8c981999e3ec7278f4cffc34e0b698d04d82d3f7ae63f58ad1828b812dbee2bdc7bdd9cedb14b3d
+EBUILD ovaldi-5.10.1.4.ebuild 2979 SHA256 49cd63cf0120f8f9c599b9c25a2561c20c1c2bafb577e9ee996de0f547108d6d SHA512 3cbd6a919cc0285edefec12a41ae85b10104a8c1d49c419fdb95740489982726a551c8539cae7e63101ed6634cc07508176c65fb7aa0cf73d7253211695200f4 WHIRLPOOL 4b08de54dc065ad5e2fcd5d8a90dda42513d9e050b79f36d33cc292940a29e4d793b4b8c5a16de696be81fc1084067d69c6de7035ad3804c5b97b0d69d667090
+EBUILD ovaldi-5.10.1.7.ebuild 2922 SHA256 6d7d66ecce5a582c862c8f7d4a0625509189cbdd7d532eee8e3789931e0b79fe SHA512 842842162b4b0e051c18dd8e90adec3dd01e8afb5bc755e2fa1272f81ef1df058491f1c5ed86bc6f88dc970e004a2906c183b4b68d075c2fd1ab69d5454b010e WHIRLPOOL ac99a3205fb7fe1b642325615ae7274825b52d0761e9ab287a3a387212f25c18b633a43ceba8e0124e1f023ed4c20f3b43bd483f18acc6d8ecff54e66c7eb7de
+MISC ChangeLog 3310 SHA256 4069812227522da9cf22f8e1340151fc07d1b11de2e589aad63efbaf006cd7a6 SHA512 6e12c4f3038bb468d0c21548881c219e5d2756101aa2385e20eb7d462f463c3dae0f3939136faf5e4fe496cc5b9d64a5e8af7aa5f183b98db82c59e55181c682 WHIRLPOOL 78abd7c6fb9398ec4da6b86a048b48aa5f884dbe08a765d121a08bbc078e40c0d73445fab2ce4207f00e260e752b95cef410afe53c3824f82722c79e7ac6667b
+MISC ChangeLog-2015 2140 SHA256 8f642b555d388455df80620a525d362d2dfa637f42ce4c21faeb191c4ff587ad SHA512 e3b3bbcf1f185fa4b93bcc52f9db7370e59fdf20b443fa0d628b1ca9b02a589011bbaacc9242cbd995e052e33663d7886643c002833c9dc67cc80cd7e4a774e9 WHIRLPOOL 44b5ab5f132d94120c201ddd1f120f58fa38dbc0766824998a4e290cdc5260da183d17af837ac1ae8b8e85b05e05c1e6e88db02e175717574835b3c7b747245b
+MISC metadata.xml 521 SHA256 a7ce370f320bb8a14757b7a5d9dac6fdcf055b4d5bcf5b6711a864f927a937af SHA512 dee5923b60ffefc8733bf3eca5f547aec7494744e088f120e9408d3e5b28fb013dc414756b191348454dc0436aab6cc1b71f0c697a8f5c33c2b16d1681c32209 WHIRLPOOL 529d2a0ee8bca14384cec367bfed162885ab00c4c182b0bd1a485af5dae471cc2cf37a27b429ee19c26150357544b69cb58299fc67ba5681f5109fd83a700685
diff --git a/app-forensics/ovaldi/files/disable-acl.patch b/app-forensics/ovaldi/files/disable-acl.patch
new file mode 100644
index 000000000000..49ea42c80558
--- /dev/null
+++ b/app-forensics/ovaldi/files/disable-acl.patch
@@ -0,0 +1,23 @@
+--- src/probes/unix/FileProbe.cpp.old 2013-01-14 16:28:33.000000000 +0100
++++ src/probes/unix/FileProbe.cpp 2013-01-14 16:30:33.000000000 +0100
+@@ -427,19 +427,8 @@
+ 5) If a file doesn't have an ACL, or it matches the standard UNIX permissions, the value will be 'false' (this is covered by acl_extended_file() - thank you openscap)
+ 6) If a file has an ACL, the value will be 'true'.
+ */
+-
+- int hasExtendedAcl = acl_extended_file(filePath.c_str());
+- if(hasExtendedAcl > -1){ // behavior 4, 5, and 6
+- item->AppendElement(new ItemEntity("has_extended_acl",Common::ToString(hasExtendedAcl),OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_EXISTS,0));
+- }else{
+- if(errno == EOPNOTSUPP){ // behavior 3
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_DOES_NOT_EXIST,0));
+- }else{ // behavior 2
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_ERROR,0));
+- item->AppendMessage(new OvalMessage(string("Error reading ACL data: ") + strerror(errno)));
+- }
+- }
+
++ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
+ # else
+ // behavior 1
+ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch
new file mode 100644
index 000000000000..b9d02d763c61
--- /dev/null
+++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-disable-selinux-probes.patch
@@ -0,0 +1,84 @@
+--- src/probes/unix/Process58Probe.cpp.old 2013-01-14 16:05:18.000000000 +0100
++++ src/probes/unix/Process58Probe.cpp 2013-01-14 16:06:16.000000000 +0100
+@@ -29,8 +29,8 @@
+ //****************************************************************************************//
+
+ #ifdef LINUX
+-# include <selinux/selinux.h>
+-# include <selinux/context.h>
++/*# include <selinux/selinux.h>
++# include <selinux/context.h>*/
+ # include <sys/capability.h>
+ # include <SecurityContextGuard.h>
+ #endif
+@@ -328,7 +328,7 @@
+ pid_t sessionId;
+ uid_t loginuid;
+ uint64_t effCap, *effCapp=&effCap;
+- string selinuxDomainLabel;
++/* string selinuxDomainLabel;*/
+
+ Process58Probe::ProcStatus statStatus, statusStatus, ttyStatus, loginuidStatus;
+
+@@ -423,10 +423,10 @@
+ }
+
+ // this one doesn't require reading anything in /proc
+- if (!RetrieveSelinuxDomainLabel(pid, &selinuxDomainLabel, &errMsg)) {
++/* if (!RetrieveSelinuxDomainLabel(pid, &selinuxDomainLabel, &errMsg)) {
+ item->AppendMessage(new OvalMessage(errMsg, OvalEnum::LEVEL_ERROR));
+ item->SetStatus(OvalEnum::STATUS_ERROR);
+- }
++ }*/
+
+ // The Linux start time is represented as the number of jiffies (1/100 sec)
+ // that the application was started after the last system reboot. To get an
+@@ -522,10 +522,10 @@
+ // aren't any.
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_ERROR));
+
+- if (selinuxDomainLabel.empty())
++/* if (selinuxDomainLabel.empty())
+ item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_ERROR));
+ else
+- item->AppendElement(new ItemEntity("selinux_domain_label", selinuxDomainLabel));
++ item->AppendElement(new ItemEntity("selinux_domain_label", selinuxDomainLabel));*/
+
+ if (statStatus == PROC_OK)
+ item->AppendElement(new ItemEntity("session_id", Common::ToString(sessionId), OvalEnum::DATATYPE_INTEGER));
+@@ -740,7 +740,7 @@
+ capMap[capEnum]));
+ }
+ }
+-
++/*
+ bool Process58Probe::RetrieveSelinuxDomainLabel(pid_t pid, string *label, string *err) {
+ security_context_t sctx;
+ int ec = getpidcon(pid, &sctx);
+@@ -763,7 +763,7 @@
+ *label = tmp;
+ return true;
+ }
+-
++*/
+ #elif defined SUNOS
+
+ void Process58Probe::GetPSInfo(string command, string pidStr, ItemVector* items) {
+@@ -830,7 +830,7 @@
+ item->AppendElement(new ItemEntity("exec_shield", "", OvalEnum::DATATYPE_BOOLEAN, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("loginuid", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
+- item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
++/* item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));*/
+ item->AppendElement(new ItemEntity("session_id", Common::ToString(info.pr_sid), OvalEnum::DATATYPE_INTEGER));
+
+ items->push_back(item);
+@@ -988,7 +988,7 @@
+ item->AppendElement(new ItemEntity("exec_shield", "", OvalEnum::DATATYPE_BOOLEAN, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("loginuid", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+ item->AppendElement(new ItemEntity("posix_capability", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
+- item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));
++/* item->AppendElement(new ItemEntity("selinux_domain_label", "", OvalEnum::DATATYPE_STRING, OvalEnum::STATUS_NOT_COLLECTED));*/
+ item->AppendElement(new ItemEntity("session_id", "", OvalEnum::DATATYPE_INTEGER, OvalEnum::STATUS_NOT_COLLECTED));
+
+ items->push_back(item);
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch
new file mode 100644
index 000000000000..fc127efd3cdb
--- /dev/null
+++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-strnicmp.patch
@@ -0,0 +1,11 @@
+--- src/Main.h.old 2010-10-22 14:59:13.000000000 +0200
++++ src/Main.h 2010-10-22 14:59:38.000000000 +0200
+@@ -38,7 +38,7 @@
+ #endif
+
+ #ifdef LINUX
+-# define STRNICMP strnicmp
++# define STRNICMP strncasecmp
+ #elif defined SUNOS
+ # define STRNICMP strncasecmp
+ #elif defined DARWIN
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch
new file mode 100644
index 000000000000..9350029312c4
--- /dev/null
+++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.4-xerces3.patch
@@ -0,0 +1,283 @@
+--- src/XmlProcessor.h.old 2011-08-18 14:35:41.608703233 +0200
++++ src/XmlProcessor.h 2011-08-18 14:39:21.835597094 +0200
+@@ -38,14 +38,17 @@
+ #include <string>
+
+ // required xerces includes
+-#include <xercesc/dom/DOMBuilder.hpp>
+ #include <xercesc/dom/DOMDocument.hpp>
+ #include <xercesc/dom/DOMErrorHandler.hpp>
+ #include <xercesc/dom/DOMError.hpp>
+
+ // for entity resolver
+-#include <xercesc/dom/DOMEntityResolver.hpp>
+-#include <xercesc/dom/DOMInputSource.hpp>
++
++#include <xercesc/dom/DOMImplementationRegistry.hpp>
++#include <xercesc/dom/DOMLSParser.hpp>
++#include <xercesc/sax/EntityResolver.hpp>
++#include <xercesc/sax/InputSource.hpp>
++#include <xercesc/sax2/SAX2XMLReader.hpp>
+
+ #include "Exception.h"
+
+@@ -53,12 +56,14 @@
+ This class extends the default DOMEntityResolver and implments the resolve entity method
+ to support
+ */
+-class DataDirResolver : public xercesc::DOMEntityResolver {
++class DataDirResolver : public xercesc::EntityResolver {
+ public:
+ /**
+ *
+ */
+- xercesc::DOMInputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI);
++// xercesc::DOMInputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI);
++ xercesc::InputSource *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId);
++ xercesc::DOMLSInput *resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI);
+ };
+
+ /**
+@@ -144,7 +149,7 @@
+ * owns the documents it builds. Users must manually destroy
+ * those documents.
+ */
+- xercesc::DOMBuilder *parserWithCallerAdoption;
++ xercesc::DOMLSParser *parserWithCallerAdoption;
+
+ /**
+ * This parser doesn't have user-adoption switched on, so it
+@@ -156,7 +161,7 @@
+ * appear to ever be switched off. So to make sure this isn't
+ * leaking memory, I have created separate parsers.
+ */
+- xercesc::DOMBuilder *parser;
++ xercesc::DOMLSParser *parser;
+
+ /** The entity resolver for both parsers. */
+ DataDirResolver resolver;
+--- src/probes/independent/XmlFileContentProbe.cpp.old 2010-10-22 14:49:22.000000000 +0200
++++ src/probes/independent/XmlFileContentProbe.cpp 2010-10-22 14:51:39.000000000 +0200
+@@ -419,12 +419,24 @@
+ return new DummyEntityResolver::DoNothingBinInputStream();
+ }
+
++#if XERCES_VERSION_MAJOR < 3
+ unsigned int DummyEntityResolver::DoNothingBinInputStream::curPos() const
++#else
++const XMLCh* DummyEntityResolver::DoNothingBinInputStream::getContentType() const
++{
++ return NULL;
++}
++XMLFilePos DummyEntityResolver::DoNothingBinInputStream::curPos() const
++#endif
+ {
+ return 0;
+ }
+
++#if XERCES_VERSION_MAJOR < 3
+ unsigned int DummyEntityResolver::DoNothingBinInputStream::readBytes(XMLByte *const /*toFill*/, const unsigned int /*maxToRead*/)
++#else
++XMLSize_t DummyEntityResolver::DoNothingBinInputStream::readBytes(XMLByte *const toFill, XMLSize_t maxToRead)
++#endif
+ {
+ return 0;
+ }
+--- src/probes/independent/XmlFileContentProbe.h.old 2010-10-22 14:55:47.000000000 +0200
++++ src/probes/independent/XmlFileContentProbe.h 2010-10-22 14:57:00.000000000 +0200
+@@ -134,8 +134,14 @@
+ class DoNothingBinInputStream : public BinInputStream
+ {
+ public:
++#if XERCES_VERSION_MAJOR < 3
+ virtual unsigned int curPos() const;
+ virtual unsigned int readBytes(XMLByte *const toFill, const unsigned int maxToRead);
++#else
++ virtual XMLFilePos curPos() const;
++ virtual const XMLCh* getContentType() const;
++ virtual XMLSize_t readBytes(XMLByte *const toFill, XMLSize_t maxToRead);
++#endif
+ };
+ };
+
+--- src/XmlCommon.cpp.old
++++ src/XmlCommon.cpp
+@@ -546,7 +546,11 @@ void XmlCommon::AddSchemaLocation(XERCES_CPP_NAMESPACE_QUALIFIER DOMDocument *do
+ string XmlCommon::GetNamespace(DOMElement *element) {
+
+ string xmlns = "";
++#if XERCES_VERSION_MAJOR < 3
+ xmlns = XmlCommon::ToString(element->getTypeInfo()->getNamespace());
++#else
++ xmlns = XmlCommon::ToString(element->getSchemaTypeInfo()->getTypeNamespace());
++#endif
+ if (xmlns.compare("") == 0) {
+ xmlns = "";
+ }
+--- src/XmlProcessor.cpp.old 2013-01-14 15:16:14.000000000 +0100
++++ src/XmlProcessor.cpp 2013-01-14 15:19:20.000000000 +0100
+@@ -35,7 +35,6 @@
+ // for dom Writer
+ #include <xercesc/dom/DOMImplementation.hpp>
+ #include <xercesc/dom/DOMImplementationLS.hpp>
+-#include <xercesc/dom/DOMWriter.hpp>
+ #include <xercesc/framework/StdOutFormatTarget.hpp>
+ #include <xercesc/framework/LocalFileFormatTarget.hpp>
+ #include <xercesc/util/XMLUni.hpp>
+@@ -50,11 +49,26 @@
+ using namespace std;
+ using namespace xercesc;
+
++#if XERCES_VERSION_MAJOR < 3
++#define SetParameter(serializer,n,v) if (serializer->canSetFeature(n,v)) serializer->setFeature(n,v)
++#else
++#define SetParameter(serializer,n,v) if (serializer->getDomConfig()->canSetParameter(n,v)) serializer->getDomConfig()->setParameter(n,v)
++#endif
++
+ //****************************************************************************************//
+ // DataDirResolver Class //
+ //****************************************************************************************//
+-
++#if XERCES_VERSION_MAJOR < 3
+ DOMInputSource* DataDirResolver::resolveEntity (const XMLCh *const /*publicId*/, const XMLCh *const systemId, const XMLCh *const /*baseURI*/) {
++#else
++InputSource* DataDirResolver::resolveEntity(const XMLCh* publicId, const XMLCh* systemId)
++{
++ return NULL;
++ //return DataDirResolver::resolveEntity (publicId, systemId, NULL);
++}
++
++DOMLSInput* DataDirResolver::resolveEntity (const XMLCh *const publicId, const XMLCh *const systemId, const XMLCh *const baseURI) {
++#endif
+ string path = "";
+ size_t last;
+ string schemapath = Common::GetSchemaPath();
+@@ -127,7 +141,7 @@
+ parserWithCallerAdoption = makeParser(schemaLocation);
+ // add one extra feature on this parser to prevent it from
+ // taking ownership of its documents.
+- parserWithCallerAdoption->setFeature(XMLUni::fgXercesUserAdoptsDOMDocument, true);
++ SetParameter(parserWithCallerAdoption, XMLUni::fgXercesUserAdoptsDOMDocument, true);
+
+ } catch (const XMLException& toCatch) {
+ string errMsg = "Error: An error occured durring initialization of the xml utilities:\n";
+@@ -156,32 +170,40 @@
+ XMLPlatformUtils::Terminate();
+ }
+
+-DOMBuilder *XmlProcessor::makeParser(const string &schemaLocation) {
++DOMLSParser *XmlProcessor::makeParser(const string &schemaLocation) {
+ // Instantiate the DOM parser.
+ static const XMLCh gLS[] = { chLatin_L, chLatin_S, chNull };
+ DOMImplementation *impl = DOMImplementationRegistry::getDOMImplementation(gLS);
+
+- DOMBuilder *parser = ((DOMImplementationLS*)impl)->createDOMBuilder(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#if XERCES_VERSION_MAJOR < 3
++ DOMLSParser *parser = ((DOMImplementationLS*)impl)->createDOMLSParser(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#else
++ DOMLSParser *parser = ((DOMImplementationLS*)impl)->createLSParser(DOMImplementationLS::MODE_SYNCHRONOUS, 0);
++#endif
+
+ ///////////////////////////////////////////////////////
+ // Set features on the builder
+ ///////////////////////////////////////////////////////
+
+- parser->setFeature(XMLUni::fgDOMComments, false); // Discard Comment nodes in the document.
+- parser->setFeature(XMLUni::fgDOMDatatypeNormalization, true); // Let the validation process do its datatype normalization that is defined in the used schema language.
+- parser->setFeature(XMLUni::fgDOMNamespaces, true); // Perform Namespace processing
+- parser->setFeature(XMLUni::fgDOMValidation, true); // Report all validation errors.
+- parser->setFeature(XMLUni::fgXercesSchema, true); // Enable the parser's schema support.
+- parser->setFeature(XMLUni::fgXercesSchemaFullChecking, true); // Enable full schema constraint checking, including checking which may be time-consuming or memory intensive. Currently, particle unique attribution constraint checking and particle derivation restriction checking are controlled by this option.
+- parser->setFeature(XMLUni::fgXercesValidationErrorAsFatal, true); // The parser will treat validation error as fatal and will exit
+- parser->setFeature(XMLUni::fgXercesDOMHasPSVIInfo, true); // Enable storing of PSVI information in element and attribute nodes.
++ SetParameter(parser, XMLUni::fgDOMComments, false); // Discard Comment nodes in the document.
++ SetParameter(parser, XMLUni::fgDOMDatatypeNormalization, true); // Let the validation process do its datatype normalization that is defined in the used schema language.
++ SetParameter(parser, XMLUni::fgDOMNamespaces, true); // Perform Namespace processing
++ SetParameter(parser, XMLUni::fgDOMValidate, true); // Report all validation errors.
++ SetParameter(parser, XMLUni::fgXercesSchema, true); // Enable the parser's schema support.
++ SetParameter(parser, XMLUni::fgXercesSchemaFullChecking, true); // Enable full schema constraint checking, including checking which may be time-consuming or memory intensive. Currently, particle unique attribution constraint checking and particle derivation restriction checking are controlled by this option.
++ SetParameter(parser, XMLUni::fgXercesValidationErrorAsFatal, true); // The parser will treat validation error as fatal and will exit
++ SetParameter(parser, XMLUni::fgXercesDOMHasPSVIInfo, true); // Enable storing of PSVI information in element and attribute nodes.
+
+ ///////////////////////////////////////////////////////
+ //****************************************************************************************//
+ // The following code was added to handle air-gap operation //
+ //****************************************************************************************//
+ /* Look for XML schemas in local directory instead of Internet */
++#if XERCES_VERSION_MAJOR < 3
+ parser->setEntityResolver (&resolver);
++#else
++ parser->getDomConfig()->setParameter(XMLUni::fgXercesEntityResolver, &resolver);
++#endif
+ //****************************************************************************************//
+ // End of air-gap code //
+ //****************************************************************************************//
+@@ -189,7 +211,11 @@
+ ///////////////////////////////////////////////////////
+ // Add an Error Handler
+ ///////////////////////////////////////////////////////
++#if XERCES_VERSION_MAJOR < 3
+ parser->setErrorHandler(&errHandler);
++#else
++ parser->getDomConfig()->setParameter(XMLUni::fgDOMErrorHandler, &errHandler);
++#endif
+
+ // Fix a schema location if possible, so instance documents don't
+ // have to set the schemaLocation attribute. And if they do, this
+@@ -197,7 +223,7 @@
+ // overriding of the value in instance documents.
+ if (!schemaLocation.empty()) {
+ XMLCh *schemaLocationCstr = XMLString::transcode(schemaLocation.c_str());
+- parser->setProperty(XMLUni::fgXercesSchemaExternalSchemaLocation, schemaLocationCstr);
++ SetParameter(parser, XMLUni::fgXercesSchemaExternalSchemaLocation, schemaLocationCstr);
+ XMLString::release(&schemaLocationCstr);
+ }
+
+@@ -279,23 +305,19 @@
+ XMLCh tempStr[100];
+ XMLString::transcode("LS", tempStr, 99);
+ DOMImplementation *impl = DOMImplementationRegistry::getDOMImplementation(tempStr);
++#if XERCES_VERSION_MAJOR < 3
+ DOMWriter *theSerializer = ((DOMImplementationLS*)impl)->createDOMWriter();
++#else
++ DOMLSSerializer *theSerializer = ((DOMImplementationLS*)impl)->createLSSerializer();
++#endif
+
+- // set feature if the serializer supports the feature/mode
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTSplitCdataSections, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTSplitCdataSections, true);
+
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true);
+-
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTFormatPrettyPrint, true))
+- theSerializer->setFeature(XMLUni::fgDOMWRTFormatPrettyPrint, true);
+-
+- if (theSerializer->canSetFeature(XMLUni::fgDOMWRTBOM, false))
+- theSerializer->setFeature(XMLUni::fgDOMWRTBOM, false);
+-
+- //if (theSerializer->canSetFeature(XMLUni::fgDOMWRTDiscardDefaultContent, true))
+- // theSerializer->setFeature(XMLUni::fgDOMWRTBOM, true);
++ // set feature if the serializer supports the feature/mode
++ SetParameter(theSerializer, XMLUni::fgDOMWRTSplitCdataSections, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTDiscardDefaultContent, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTFormatPrettyPrint, true);
++ SetParameter(theSerializer, XMLUni::fgDOMWRTBOM, false);
++ //SetParameter(theSerializer, XMLUni::fgDOMWRTBOM, true);
+
+ //
+ // Plug in a format target to receive the resultant
+@@ -313,7 +335,13 @@
+ //
+ // do the serialization through DOMWriter::writeNode();
+ //
++#if XERCES_VERSION_MAJOR < 3
+ theSerializer->writeNode(myFormTarget, *doc);
++#else
++ DOMLSOutput *output = ((DOMImplementationLS*)impl)->createLSOutput();
++ output->setByteStream(myFormTarget);
++ theSerializer->write(doc, output);
++#endif
+
+ theSerializer->release();
+ delete myFormTarget;
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch
new file mode 100644
index 000000000000..6d6fbf60178e
--- /dev/null
+++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable-acl.patch
@@ -0,0 +1,23 @@
+--- src/probes/unix/FileProbe.cpp.old 2014-10-08 09:15:37.000000000 +0200
++++ src/probes/unix/FileProbe.cpp 2014-10-08 09:15:55.000000000 +0200
+@@ -386,18 +386,8 @@
+ 6) If a file has an ACL, the value will be 'true'.
+ */
+
+- int hasExtendedAcl = acl_extended_file(filePath.c_str());
+- if(hasExtendedAcl > -1){ // behavior 4, 5, and 6
+- item->AppendElement(new ItemEntity("has_extended_acl",Common::ToString(hasExtendedAcl),OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_EXISTS,0));
+- }else{
+- if(errno == EOPNOTSUPP){ // behavior 3
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_DOES_NOT_EXIST,0));
+- }else{ // behavior 2
+- item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_ERROR,0));
+- item->AppendMessage(new OvalMessage(string("Error reading ACL data: ") + strerror(errno)));
+- }
+- }
+-
++ // behavior 1
++ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
+ # else
+ // behavior 1
+ item->AppendElement(new ItemEntity("has_extended_acl","",OvalEnum::DATATYPE_BOOLEAN,OvalEnum::STATUS_NOT_COLLECTED,0));
diff --git a/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch
new file mode 100644
index 000000000000..11d369022b03
--- /dev/null
+++ b/app-forensics/ovaldi/files/ovaldi-5.10.1.7-disable_RetrieveSelinuxDomainLabel.patch
@@ -0,0 +1,31 @@
+--- src/probes/unix/Process58Probe.cpp.old 2014-10-08 08:56:37.000000000 +0200
++++ src/probes/unix/Process58Probe.cpp 2014-10-08 08:57:58.000000000 +0200
+@@ -743,26 +743,8 @@
+ }
+
+ bool Process58Probe::RetrieveSelinuxDomainLabel(pid_t pid, string *label, string *err) {
+- security_context_t sctx;
+- int ec = getpidcon(pid, &sctx);
+- if (ec == -1) {
+- // getpidcon man page doesn't say errno is set... so we can't get a
+- // reason for the error.
+- *err = "getpidcon() failed";
+- return false;
+- }
+-
+- SecurityContextGuard scg(sctx);
+- ContextGuard cg(sctx);
+-
+- const char *tmp = context_type_get(cg);
+- if (!tmp) {
+- *err = string("context_get_type(")+sctx+"): "+strerror(errno);
+- return false;
+- }
+-
+- *label = tmp;
+- return true;
++ *err = string("context_get_type(NotImplmented)");
++ return false;
+ }
+
+ #elif defined SUNOS
diff --git a/app-forensics/ovaldi/metadata.xml b/app-forensics/ovaldi/metadata.xml
new file mode 100644
index 000000000000..eefcf17b60e9
--- /dev/null
+++ b/app-forensics/ovaldi/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>clabbe.montjoie@gmail.com</email>
+ <name>LABBE Corentin</name>
+ <description>Upstream and Maintainer. Assign bugs to him</description>
+ </maintainer>
+ <maintainer type="project">
+ <email>proxy-maint@gentoo.org</email>
+ <name>Proxy Maintainers</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="sourceforge">ovaldi</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/ovaldi/ovaldi-5.10.1.4.ebuild b/app-forensics/ovaldi/ovaldi-5.10.1.4.ebuild
new file mode 100644
index 000000000000..c23af38bfe53
--- /dev/null
+++ b/app-forensics/ovaldi/ovaldi-5.10.1.4.ebuild
@@ -0,0 +1,94 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Free implementation of OVAL"
+HOMEPAGE="http://oval.mitre.org/language/interpreter.html"
+SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.bz2"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="acl ldap selinux"
+
+CDEPEND="dev-libs/libgcrypt:0
+ dev-libs/libpcre
+ dev-libs/xalan-c
+ dev-libs/xerces-c
+ sys-apps/util-linux
+ sys-libs/libcap
+ acl? ( sys-apps/acl )
+ ldap? ( net-nds/openldap )"
+DEPEND="${CDEPEND}
+ sys-apps/sed"
+RDEPEND="${CDEPEND}
+ selinux? ( sys-libs/libselinux )"
+
+S="${WORKDIR}/${P}-src"
+
+src_prepare() {
+ #Ovaldi do not support xerces 3, but portage have only that
+ epatch "${FILESDIR}"/${P}-xerces3.patch
+ sed -i 's,xercesc::DOMBuilder,xercesc::DOMLSParser,' src/XmlProcessor.h || die
+ sed -i 's,DOMBuilder,DOMLSParser,' src/XmlProcessor.cpp || die
+
+ epatch "${FILESDIR}"/${P}-strnicmp.patch
+
+ if ! use ldap ; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,.*ldap,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*LDAP,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's/-lldap//' project/linux/Makefile || die
+ sed -i 's/-llber//' project/linux/Makefile || die
+ sed -i 's/.*LDAPProbe.h.*//' src/linux/ProbeFactory.h || die
+ rm src/probes/independent/LDAPProbe.{cpp,h} || die
+ fi
+
+ if ! use acl ; then
+ sed -i 's,.*libacl,//&,' src/probes/unix/FileProbe.h || die
+ epatch "${FILESDIR}"/disable-acl.patch
+ sed -i 's, -lacl , ,' project/linux/Makefile || die
+ fi
+
+ einfo "Disabling rpm probes"
+ sed -i 's/^PACKAGE_RPM/#PACKAGE_RPM/' project/linux/Makefile || die
+
+ # same thing for dpkg, but package dpkg is not sufficient, needs app-arch/apt-pkg that is not on tree
+ einfo "Disabling dpkg probes"
+ sed -i 's/^PACKAGE_DPKG/#PACKAGE_DPKG/' project/linux/Makefile || die
+
+ #Disabling SELinux support
+ if ! use selinux ; then
+ rm src/probes/linux/SelinuxSecurityContextProbe.cpp || die
+ rm src/probes/linux/SelinuxBooleanProbe.cpp || die
+ rm src/probes/linux/SelinuxBooleanProbe.h || die
+ epatch "${FILESDIR}"/${P}-disable-selinux-probes.patch
+ sed -i 's,.*selinux.*,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*Selinux.*,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*selinux.*,//&,' src/linux/ProbeFactory.h || die
+ sed -i 's,.*Selinux.*,//&,' src/linux/ProbeFactory.h || die
+ sed -i 's,.*SecurityContextGuard.h.*,//&,' src/probes/unix/Process58Probe.cpp || die
+ rm src/linux/SecurityContextGuard.h || die
+ sed -i 's, -lselinux,,' project/linux/Makefile || die
+ fi
+ # respect CXXFLAGS and CXX
+ sed -i -e '/^CPPFLAGS/s/$(INCDIRS)/$(CXXFLAGS) \0/' project/linux/Makefile || die
+ tc-export CXX
+}
+
+src_compile () {
+ emake -C project/linux
+}
+
+src_install () {
+ # no make install in Makefile
+ dosbin project/linux/Release/ovaldi project/linux/ovaldi.sh
+ dodir /var/log/${PN}
+ insinto /usr/share/${PN}
+ doins xml/*
+ dodoc docs/{README.txt,version.txt}
+ doman docs/ovaldi.1
+}
diff --git a/app-forensics/ovaldi/ovaldi-5.10.1.7.ebuild b/app-forensics/ovaldi/ovaldi-5.10.1.7.ebuild
new file mode 100644
index 000000000000..b97ac916849f
--- /dev/null
+++ b/app-forensics/ovaldi/ovaldi-5.10.1.7.ebuild
@@ -0,0 +1,93 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Free implementation of OVAL"
+HOMEPAGE="http://oval.mitre.org/language/interpreter.html"
+SRC_URI="mirror://sourceforge/${PN}/${P}-src.tar.bz2"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="acl ldap selinux"
+
+CDEPEND="dev-libs/libgcrypt:0
+ dev-libs/libpcre
+ dev-libs/xalan-c
+ dev-libs/xerces-c
+ sys-apps/util-linux
+ sys-libs/libcap
+ acl? ( sys-apps/acl )
+ ldap? ( net-nds/openldap )"
+DEPEND="${CDEPEND}
+ sys-apps/sed"
+RDEPEND="${CDEPEND}
+ selinux? ( sys-libs/libselinux )"
+
+S="${WORKDIR}/${P}-src"
+
+src_prepare() {
+ if ! use ldap ; then
+ einfo "Disabling LDAP probes"
+ sed -i 's,.*ldap,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*LDAP,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's/-lldap//' project/linux/Makefile || die
+ sed -i 's/-llber//' project/linux/Makefile || die
+ sed -i 's/.*LDAPProbe.h.*//' src/linux/ProbeFactory.h || die
+ rm src/probes/independent/LDAPProbe.{cpp,h} || die
+ fi
+
+ if ! use acl ; then
+ sed -i 's,.*libacl,//&,' src/probes/unix/FileProbe.h || die
+ epatch "${FILESDIR}"/${P}-disable-acl.patch
+ sed -i 's, -lacl , ,' project/linux/Makefile || die
+ fi
+
+ einfo "Disabling rpm probes"
+ sed -i 's/^PACKAGE_RPM/#PACKAGE_RPM/' project/linux/Makefile || die
+
+ # same thing for dpkg, but package dpkg is not sufficient, needs app-arch/apt-pkg that is not on tree
+ einfo "Disabling dpkg probes"
+ sed -i 's/^PACKAGE_DPKG/#PACKAGE_DPKG/' project/linux/Makefile || die
+
+ #Disabling SELinux support
+ if ! use selinux ; then
+ rm src/probes/linux/SelinuxSecurityContextProbe.cpp || die
+ rm src/probes/linux/SelinuxBooleanProbe.cpp || die
+ rm src/probes/linux/SelinuxBooleanProbe.h || die
+ epatch "${FILESDIR}"/${P}-disable_RetrieveSelinuxDomainLabel.patch
+ sed -i 's,.*selinux.*,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*Selinux.*,//&,' src/linux/ProbeFactory.cpp || die
+ sed -i 's,.*selinux.*.h.*,//&,' src/probes/unix/Process58Probe.cpp || die
+ sed -i 's,.*SecurityContextGuard.h.*,//&,' src/probes/unix/Process58Probe.cpp || die
+ sed -i 's, -lselinux,,' project/linux/Makefile || die
+ fi
+
+ # missing header for realloc and free
+ sed -i 's,#include <unistd.h>,&\n#include <stdlib.h>,' src/linux/NetworkInterfaces.cpp || die
+ sed -i 's,#include <unistd.h>,&\n#include <stdlib.h>,' src/linux/SystemInfo.cpp || die
+
+ # respect CXXFLAGS and CXX
+ sed -i -e '/^CPPFLAGS/s/$(INCDIRS)/$(CXXFLAGS) \0/' project/linux/Makefile || die
+
+ # no such library on linux
+ sed -i 's,-lxalanMsg,,' project/linux/Makefile || die
+ tc-export CXX
+}
+
+src_compile () {
+ emake -C project/linux
+}
+
+src_install () {
+ # no make install in Makefile
+ dosbin project/linux/Release/ovaldi project/linux/ovaldi.sh
+ dodir /var/log/${PN}
+ insinto /usr/share/${PN}
+ doins xml/*
+ dodoc docs/{README.txt,version.txt}
+ doman docs/ovaldi.1
+}
diff --git a/app-forensics/pasco/Manifest b/app-forensics/pasco/Manifest
new file mode 100644
index 000000000000..c3a1c0cef406
--- /dev/null
+++ b/app-forensics/pasco/Manifest
@@ -0,0 +1,6 @@
+DIST pasco_20040505_1.tar.gz 4032 SHA256 a3b8ee7be960571410bc564ecc93067755a28650fb35bfb559a4aeb6af6f6868 SHA512 fd3c1b31618a64ea9a381c68971800a511f8c826a26ca0f554bd6c69f4992312c0c34adf7067da97ff6d7c11b7ed8a64401435fa9ceb218e165cf83a3b6083db WHIRLPOOL 8c853c78e0a47bf4424da8b381ccfdc8091949969d95488a798434c86d70aa057cc385e16ea3b5075b354a790b6e8a7e4448c5ca7f9bcd74e88aa019f7cb0499
+EBUILD pasco-20040505_p1-r1.ebuild 526 SHA256 1c557c937f6322199c3cdf0c1f97b04406f0a678c859bf1705fb65ccad6b0a02 SHA512 0411ef2a14440671572a9798c764869c40f8908cc3c563de5fc7704c18330fec461567d41a2e86e1f5776d3209b4a00376652294edb9f52d6e4706e130169275 WHIRLPOOL a16dd42d3188919fc41ea7a84852b787d996d3d5d22cfffecb37d2342cec7480f1b8f35c4d3a0c3f85d5b55a1b0ac04e318e8113c6cb716402741e534350c13a
+EBUILD pasco-20040505_p1.ebuild 522 SHA256 01e5dfa8d77fb8c4bb479e3476ac701cb5dcf92a097742f6c0509b06a966b95d SHA512 afdf323921cdfdcf965342ba1fd227a5b6b234161dd91586a99f2fee03ffccffeefd9730c82a88459856b80470f09f3255c47e2b709e7fab9af7bb08ac194b04 WHIRLPOOL ef1a586daef328fc64eae062455d1b93f09e7e66129d032ab299ecf9efc6bb1045762b76d4723a02ab4de538855138051b32372a10f0293c2e6e12193ba701e9
+MISC ChangeLog 2651 SHA256 bb466a85756bce628876eedfefb90597cae34c4d08ee6332fb7c36d6b1f48682 SHA512 6f6fc53955fb65bcef32a1820a5c3b9296416b831a3b853f381532b6b00ad2670fa4664b66f3e746c8c8d94a90033e9fb251ff00ac577d4c23c10661539ea24d WHIRLPOOL 0446c620cd80c1c48e4e35da600bd714404c1bd80abaf3131ff12b7144d96930f0d4cce7f70ffedf49ae7d97211f6ae32208865a4d3d65fbe10aad282c0b301b
+MISC ChangeLog-2015 1339 SHA256 0dfa85f8d5604c80453aeb55e26f5109aee0670b3282152810a217715d52c6e0 SHA512 b8002d2586de5815a45531ea63f8566f3c1aededad5067e5c9bb2c802735f711a76f9138cb625b8789dc13dba9c59bd099a811b8744f56e16c0159969712bb4f WHIRLPOOL 581cb6e7b59ee26acf6bf40461171ff0413cb9b48aeaae0029e43f579ac33e5c1b65daa0f6366e56c6336647bc95f6c87015214f8d8e1b3eb64d123305c5ecce
+MISC metadata.xml 243 SHA256 37f6c5093bdbce6a933f15351b291dfa7109c51abc4d30e917181f384abed3c6 SHA512 4e97cd2b4cea4fe6059d375cd29eb5e97c8a40581126a624d1c7a48e2e9092472bc0f4e4f61a95a73121aa183995706b8111757e5dcb3d0bf0458e33029aeda1 WHIRLPOOL 59c9e1d5a2284cc406aa3f4469b5876f22f50b3842fbb8eb8e3092aab7d75c2d04da2d11ecaf30246bf0ca8915411f22ab9f8f29b8d6fa669df393f7889a33ac
diff --git a/app-forensics/pasco/metadata.xml b/app-forensics/pasco/metadata.xml
new file mode 100644
index 000000000000..aa3597556ef2
--- /dev/null
+++ b/app-forensics/pasco/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">odessa</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/pasco/pasco-20040505_p1-r1.ebuild b/app-forensics/pasco/pasco-20040505_p1-r1.ebuild
new file mode 100644
index 000000000000..a924a60da63e
--- /dev/null
+++ b/app-forensics/pasco/pasco-20040505_p1-r1.ebuild
@@ -0,0 +1,26 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit toolchain-funcs
+
+MY_P=${PN}_${PV/_p/_}
+
+DESCRIPTION="IE Activity Parser"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="mirror://sourceforge/odessa/${MY_P}.tar.gz"
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86"
+IUSE=""
+
+S="${WORKDIR}/${MY_P}/src"
+
+src_compile() {
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} -o ${PN} ${PN}.c -lm -lc || die "failed to compile"
+}
+
+src_install() {
+ dobin ${PN}
+}
diff --git a/app-forensics/pasco/pasco-20040505_p1.ebuild b/app-forensics/pasco/pasco-20040505_p1.ebuild
new file mode 100644
index 000000000000..99f64ec6b6fb
--- /dev/null
+++ b/app-forensics/pasco/pasco-20040505_p1.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+inherit toolchain-funcs
+
+MY_P=${PN}_${PV/_p/_}
+DESCRIPTION="IE Activity Parser"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="mirror://sourceforge/odessa/${MY_P}.tar.gz"
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+IUSE=""
+
+S=${WORKDIR}/${MY_P}
+
+src_compile() {
+ cd src
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} -o pasco pasco.c -lm -lc || die "failed to compile"
+}
+
+src_install() {
+ dobin src/pasco
+}
diff --git a/app-forensics/quickfuzz/Manifest b/app-forensics/quickfuzz/Manifest
new file mode 100644
index 000000000000..763f33b46394
--- /dev/null
+++ b/app-forensics/quickfuzz/Manifest
@@ -0,0 +1,8 @@
+AUX quickfuzz-0.1_p20160920-derive-2.6.patch 663 SHA256 4df070290c76890c3981b07f1befe40fa5342933f6afe99fc4c1f48924c82af5 SHA512 c604134457566e226d0254451988c848cb10d5ec5a8ea6ae5387ad7813eadacc31fbf72e1072ec57ff650c813d0656a7bbdabb65c1e69d125cbd858258baff72 WHIRLPOOL b758f407b1fec1b9f1d0131b35e48a7e6099cbf887289d0edd8d3277ba32619958ede7f57670418ee07ea5d7e2be9f743526e9beb0ca7d707d325d07682eac9c
+AUX quickfuzz-0.1_p20160920-directory-1.3.patch 267 SHA256 882647f1fcea623095b5a21cb2bd9335148cb13278d9d3274a83f5822676c1ab SHA512 cd1cbe40b93c324caf8a687742ffb8fc9e5caab4dbfc18a3292d392e6b8fa74b30c3f9ef40342047c9cf8cca29de11ffa1121b6dbed3ec0495fd5706a8e6a0c5 WHIRLPOOL 4bb017d69f73129e00517b5745d0b24d17e8a3ec3a1ad6fda1f3ff6fccbc907121a110833a60944d313a84247b2358fc4b51ef248b218c61de0561a231c4a0c4
+AUX quickfuzz-0.1_p20160920-ghc-8.0.2_rc1.patch 250 SHA256 d7eea96e36b9f54d14db2b7f1129871c450e8ad4a4ec33bf33fecc3999d16d9c SHA512 f1eab2915fc5175b35b6f4d92ed9a04d215058b5f131f43f9b584d80613a2cf59a701688433871c9a165dfdce21577e9c6ebbbaba5b0bcd4a6a1b13ff789a3ca WHIRLPOOL f67c2c3dab9d3586cdb2ca7205174403d5fa1bf30117c385e436ea85df47c34cf6bcfc7bd7176d30fc1e66b9b8df9c640ddc0eb3749044be56a039aebbf1a7c2
+DIST quickfuzz-0.1_p20160920.tar.gz 1073894 SHA256 141d50c58f104ff9a35c649a7fa21fb18b4501a81bed1e56551067af8f7fedb7 SHA512 52068c35cef580e4719f1b7128ae069a80581f176adc4a2abbbdfc7fc48849e4ff1c228d342b7eaddc780e5b50eabb285b398c334753fca0dc70d3d3ec9f55f8 WHIRLPOOL a60fadaeb3e5e1ac8664865ea797dafe539e053370a30973a0ab785ee3401d6c5d5e40ecdef7cf85a1842f190bc0f7770cf9f0f1ef8c659444ad815e878d634a
+EBUILD quickfuzz-0.1_p20160920.ebuild 4188 SHA256 72d38e51216a280e1a90851fc0a4e9bc6a040a3a772531a5994b268a07d80d35 SHA512 d49800f4b9bb9a527af576f5b1d3e5485b52a1ac9cba167ffef623eea7f74c654c1e8cdaf76cad4e31633ba2fcbfb1bae6fbf1df1ac6ab0ae7681c63bbd8a79c WHIRLPOOL a54003b18230d88b49434d7efdece2f8c576d5b3e1f4f6ed5d6ab1145e359056cf93307658be49829056852e3054bb2f5e4443352a8b0a563440b8cf064f2609
+EBUILD quickfuzz-9999.ebuild 4726 SHA256 69365b6c10ae989a010e74a43246824c6e48e3a979273608125d5ea05ab9ef02 SHA512 cd8523998adee21241edbc8aa3db85530d76cfd19f25ba6987c83da12f38889b8edd26dd4fc25c0ff6b6fed5ed70aa1c467838c828138b343f37e116ffc95940 WHIRLPOOL f9d3c842ffdfc459ece0c78a09c0ad2bd9eed8de2b6085a1f8ee64897c052deebfe76bd19d5e4428c8a9720b9b794840280659172d67013f32675b91b7da43cd
+MISC ChangeLog 2988 SHA256 9422f375638e3d7d50e2d7be07f6050c1507474c22dc351f2369065ccef3bbf9 SHA512 e455e0bff07d6297bc7d1facc4bddd6fc843b14b1db4125be9a867b420dd955cade2923cf150f6ac25cd9ac5876c8d63339ef852b7b76b93c2963ffdad4a0a39 WHIRLPOOL f3353dd0c0cc9aeb64fc39a8a9cccef90f077653a12a32f5c0b6278cbe9d9de962fac70f7cd1e9c5e079f49872fadb4cab33ac4195dba639cde8e050445e14fa
+MISC metadata.xml 805 SHA256 7f05a960ffc599ef6d029c19c20e96cdf506ed94db72e69a43e985286478ed8d SHA512 c0546197822adc83a8339312fcbf88d3f81effe6689508d4b1bbe34c42a91b407be5539713599ba087985d6780db4788f328a7f7a3d4925fe7d4ca03ec115989 WHIRLPOOL 83bf15c6097e654a16530a8517d6d4abcdab83b00e69c42fca40b1448dbf2b2f1e2eba02b3de7d93d88dab2e63acc457a3d2c2da089cf2aa2e980366a254fbf8
diff --git a/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-derive-2.6.patch b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-derive-2.6.patch
new file mode 100644
index 000000000000..6e0f25636b6a
--- /dev/null
+++ b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-derive-2.6.patch
@@ -0,0 +1,21 @@
+diff --git a/src/DeriveShow.hs b/src/DeriveShow.hs
+index c11dd03..40cc205 100644
+--- a/src/DeriveShow.hs
++++ b/src/DeriveShow.hs
+@@ -1,5 +1,5 @@
+ {-# LANGUAGE TemplateHaskell #-}
++{-# LANGUAGE StandaloneDeriving #-}
+ module DeriveShow where
+
+-import Data.Derive.Show
+ import Data.DeriveTH
+@@ -12,3 +12,2 @@ isArbInsName = isinsName ''Show
+ devShow :: Name -> Q [Dec]
+-devShow = megaderive (derive makeShow) isArbInsName
+-
++devShow = megaderive (\n -> [d| deriving instance Show $(return (ConT n)) |]) isArbInsName
+--- a/QuickFuzz.cabal
++++ b/QuickFuzz.cabal
+@@ -75,0 +75,1 @@ executable QuickFuzz
++ default-extensions: StandaloneDeriving
+
diff --git a/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-directory-1.3.patch b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-directory-1.3.patch
new file mode 100644
index 000000000000..34e92089b53f
--- /dev/null
+++ b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-directory-1.3.patch
@@ -0,0 +1,9 @@
+diff --git a/src/Check.hs b/src/Check.hs
+index b38a56a..246bf24 100644
+--- a/src/Check.hs
++++ b/src/Check.hs
+@@ -23,3 +23,3 @@ import System.Posix.Env
+ import System.Exit
+-import System.Directory
++import System.Directory hiding (getFileSize)
+ import System.IO.Unsafe
diff --git a/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-ghc-8.0.2_rc1.patch b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-ghc-8.0.2_rc1.patch
new file mode 100644
index 000000000000..0e8abbd9d796
--- /dev/null
+++ b/app-forensics/quickfuzz/files/quickfuzz-0.1_p20160920-ghc-8.0.2_rc1.patch
@@ -0,0 +1,8 @@
+diff --git a/src/Midi.hs b/src/Midi.hs
+index 2b7a359..8c4eacc 100644
+--- a/src/Midi.hs
++++ b/src/Midi.hs
+@@ -1,2 +1,2 @@
+-{-# LANGUAGE TemplateHaskell, FlexibleInstances#-}
++{-# LANGUAGE TemplateHaskell, FlexibleInstances, OverlappingInstances #-}
+
diff --git a/app-forensics/quickfuzz/metadata.xml b/app-forensics/quickfuzz/metadata.xml
new file mode 100644
index 000000000000..1e1e29136406
--- /dev/null
+++ b/app-forensics/quickfuzz/metadata.xml
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="project">
+ <email>haskell@gentoo.org</email>
+ <name>Gentoo Haskell</name>
+ </maintainer>
+ <use>
+ <flag name='archs'>support archive formats</flag>
+ <flag name='codes'>support cource code formats</flag>
+ <flag name='docs'>support document formats</flag>
+ <flag name='imgs'>support image formats</flag>
+ <flag name='media'>support media formats</flag>
+ <flag name='net'>support networking formats</flag>
+ <flag name='pki'>support PKI formats</flag>
+ </use>
+ <longdescription>
+ An experimental grammar fuzzer in Haskell using QuickCheck.
+ </longdescription>
+ <upstream>
+ <remote-id type="github">CIFASIS/QuickFuzz</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/quickfuzz/quickfuzz-0.1_p20160920.ebuild b/app-forensics/quickfuzz/quickfuzz-0.1_p20160920.ebuild
new file mode 100644
index 000000000000..b16b564b392b
--- /dev/null
+++ b/app-forensics/quickfuzz/quickfuzz-0.1_p20160920.ebuild
@@ -0,0 +1,151 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+# ebuild generated by hackport 0.5.9999
+
+CABAL_FEATURES="bin"
+inherit haskell-cabal
+
+MY_PN="QuickFuzz"
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="An experimental grammar fuzzer in Haskell using QuickCheck"
+HOMEPAGE="http://quickfuzz.org/"
+SRC_URI="https://dev.gentoo.org/~slyfox/distfiles/${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE="archs codes docs imgs media net pki"
+
+RDEPEND="dev-haskell/abstract-par:=
+ dev-haskell/argparser:=
+ dev-haskell/derive:=
+ dev-haskell/linear:=
+ dev-haskell/monad-par:=
+ dev-haskell/mtl:=
+ dev-haskell/parallel-io:=
+ dev-haskell/primitive:=
+ dev-haskell/process-extras:=
+ dev-haskell/quickcheck:2=
+ dev-haskell/quickcheck-unicode:=
+ dev-haskell/random:=
+ dev-haskell/split:=
+ dev-haskell/text:=
+ dev-haskell/vector:=
+ dev-haskell/wl-pprint:=
+ >=dev-lang/ghc-7.8.2:=
+ archs? ( dev-haskell/base16-bytestring:=
+ >=dev-haskell/tar-0.5:=
+ dev-haskell/zip-archive:= )
+ !archs? ( net? ( dev-haskell/base16-bytestring:= ) )
+ codes? ( dev-haskell/haxml:=
+ dev-haskell/json:=
+ dev-haskell/language-bash:=
+ dev-haskell/language-css:=
+ dev-haskell/language-dot:=
+ dev-haskell/language-ecmascript:=
+ dev-haskell/language-glsl:=
+ dev-haskell/language-lua:=
+ dev-haskell/language-python:=
+ dev-haskell/shell-escape:=
+ dev-haskell/uniplate:= )
+ docs? ( app-text/pandoc:=
+ dev-haskell/data-default:=
+ dev-haskell/hcg-minus:=
+ dev-haskell/hps:=
+ dev-haskell/icalendar:=
+ dev-haskell/pandoc-types:= )
+ imgs? ( dev-haskell/ac-ppm:=
+ dev-haskell/memory:=
+ dev-haskell/attoparsec:=
+ dev-haskell/lens:=
+ dev-haskell/scientific:=
+ dev-haskell/thyme:=
+ dev-haskell/xml:=
+ >=dev-haskell/zlib-0.6:= )
+ !imgs? ( archs? ( >=dev-haskell/zlib-0.6:= ) )
+ media? ( dev-haskell/hcodecs:=
+ dev-haskell/hunit:=
+ dev-haskell/mtl:=
+ dev-haskell/old-locale:=
+ dev-haskell/random:=
+ dev-haskell/idiii:=
+ dev-haskell/bitwise:=
+ dev-haskell/monad-loops:=
+ dev-haskell/mtl:=
+ dev-haskell/wavy:= )
+ net? ( dev-haskell/concurrent-extra:=
+ dev-haskell/dns:=
+ dev-haskell/http:=
+ dev-haskell/iproute:=
+ dev-haskell/network:=
+ dev-haskell/network-uri:=
+ dev-haskell/unbounded-delays:= )
+ pki? ( dev-haskell/hourglass:=
+ dev-haskell/asn1-types:=
+ dev-haskell/asn1-parse:=
+ dev-haskell/cryptonite:=
+ dev-haskell/hourglass:=
+ dev-haskell/memory:= )
+"
+DEPEND="${RDEPEND}
+ >=dev-haskell/cabal-1.18.1.3
+"
+
+PATCHES=(
+ "${FILESDIR}"/${P}-ghc-8.0.2_rc1.patch
+ "${FILESDIR}"/${P}-directory-1.3.patch
+ "${FILESDIR}"/${P}-derive-2.6.patch
+)
+
+# $1 - target tarball name (not including extension)
+make_snapshot() {
+ ln -s "${S}" "${WORKDIR}"/"$1" || die
+ tar \
+ --dereference \
+ --directory="${WORKDIR}" \
+ --exclude="$1"/bundled/Juicy.Pixels/tests \
+ -zcvvf \
+ "${WORKDIR}"/"$1".tar.gz "$1"/ || die
+}
+
+# As of 2016-09-10 QuickFuzz forks a few hackage packages
+# without renames:
+# - asn1-encoding: stabilised handling of corrupterd data
+# - hogg: more functions are exported directly
+# - juicypixels: more functions and modules are exported,
+# unsafe functions are changed to safe
+# - svg-tree: upstream, build agains patched juicypixels
+# - x509: stabilised handling of corrupterd data
+# - megadeth: not a fork but has no releases
+# - ttasm: cabalised, renamed module
+
+src_prepare() {
+ default
+
+ # inline dependencies of bundled dependencies
+ cabal_chdeps \
+ 'JuicyPixels' 'memory' \
+ 'asn1-encoding' 'hourglass' \
+ 'hogg' 'array' \
+ 'megadeth' 'base' \
+ 'svg-tree' 'attoparsec, lens, scientific, thyme' \
+ 'ttasm' 'bitwise, mtl, monad-loops' \
+ 'x509' 'asn1-parse, cryptonite, hourglass, memory' \
+ \
+ 'hs-source-dirs: src' 'hs-source-dirs: src, bundled/Juicy.Pixels/src, bundled/hogg, bundled/hs-asn1-encoding, bundled/hs-certificate-x509, bundled/megadeth, bundled/svg-tree/src, bundled/ttasm'
+}
+
+src_configure() {
+ haskell-cabal_src_configure \
+ $(cabal_flag archs archs) \
+ $(cabal_flag codes codes) \
+ $(cabal_flag docs docs) \
+ $(cabal_flag imgs imgs) \
+ $(cabal_flag media media) \
+ $(cabal_flag net net) \
+ $(cabal_flag pki pki)
+}
diff --git a/app-forensics/quickfuzz/quickfuzz-9999.ebuild b/app-forensics/quickfuzz/quickfuzz-9999.ebuild
new file mode 100644
index 000000000000..41734df6f0ce
--- /dev/null
+++ b/app-forensics/quickfuzz/quickfuzz-9999.ebuild
@@ -0,0 +1,174 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+# ebuild generated by hackport 0.5.9999
+
+CABAL_FEATURES="bin"
+inherit git-r3 haskell-cabal
+
+MY_PN="QuickFuzz"
+MY_P="${MY_PN}-${PV}"
+
+DESCRIPTION="An experimental grammar fuzzer in Haskell using QuickCheck"
+HOMEPAGE="http://quickfuzz.org/"
+EGIT_REPO_URI="https://github.com/CIFASIS/QuickFuzz.git"
+
+LICENSE="GPL-3"
+SLOT="0"
+IUSE="archs codes docs imgs media net pki"
+
+RDEPEND="dev-haskell/abstract-par:=
+ dev-haskell/argparser:=
+ dev-haskell/derive:=
+ dev-haskell/linear:=
+ dev-haskell/monad-par:=
+ dev-haskell/mtl:=
+ dev-haskell/parallel-io:=
+ dev-haskell/primitive:=
+ dev-haskell/process-extras:=
+ dev-haskell/quickcheck:2=
+ dev-haskell/quickcheck-unicode:=
+ dev-haskell/random:=
+ dev-haskell/split:=
+ dev-haskell/text:=
+ dev-haskell/vector:=
+ dev-haskell/wl-pprint:=
+ >=dev-lang/ghc-7.8.2:=
+ archs? ( dev-haskell/base16-bytestring:=
+ >=dev-haskell/tar-0.5:=
+ dev-haskell/zip-archive:= )
+ !archs? ( net? ( dev-haskell/base16-bytestring:= ) )
+ codes? ( dev-haskell/haxml:=
+ dev-haskell/json:=
+ dev-haskell/language-bash:=
+ dev-haskell/language-css:=
+ dev-haskell/language-dot:=
+ dev-haskell/language-ecmascript:=
+ dev-haskell/language-glsl:=
+ dev-haskell/language-lua:=
+ dev-haskell/language-python:=
+ dev-haskell/shell-escape:=
+ dev-haskell/uniplate:= )
+ docs? ( app-text/pandoc:=
+ dev-haskell/data-default:=
+ dev-haskell/hcg-minus:=
+ dev-haskell/hps:=
+ dev-haskell/icalendar:=
+ dev-haskell/pandoc-types:= )
+ imgs? ( dev-haskell/ac-ppm:=
+ dev-haskell/memory:=
+ dev-haskell/attoparsec:=
+ dev-haskell/lens:=
+ dev-haskell/scientific:=
+ dev-haskell/thyme:=
+ dev-haskell/xml:=
+ >=dev-haskell/zlib-0.6:= )
+ !imgs? ( archs? ( >=dev-haskell/zlib-0.6:= ) )
+ media? ( dev-haskell/hcodecs:=
+ dev-haskell/hunit:=
+ dev-haskell/mtl:=
+ dev-haskell/old-locale:=
+ dev-haskell/random:=
+ dev-haskell/idiii:=
+ dev-haskell/bitwise:=
+ dev-haskell/monad-loops:=
+ dev-haskell/mtl:=
+ dev-haskell/wavy:= )
+ net? ( dev-haskell/concurrent-extra:=
+ dev-haskell/dns:=
+ dev-haskell/http:=
+ dev-haskell/iproute:=
+ dev-haskell/network:=
+ dev-haskell/network-uri:=
+ dev-haskell/unbounded-delays:= )
+ pki? ( dev-haskell/hourglass:=
+ dev-haskell/asn1-types:=
+ dev-haskell/asn1-parse:=
+ dev-haskell/cryptonite:=
+ dev-haskell/hourglass:=
+ dev-haskell/memory:= )
+"
+DEPEND="${RDEPEND}
+ >=dev-haskell/cabal-1.18.1.3
+"
+
+# $1 - target tarball name (not including extension)
+make_snapshot() {
+ ln -s "${S}" "${WORKDIR}"/"$1" || die
+ tar \
+ --dereference \
+ --directory="${WORKDIR}" \
+ --exclude="$1"/bundled/Juicy.Pixels/tests \
+ -zcvvf \
+ "${WORKDIR}"/"$1".tar.gz "$1"/ || die
+}
+
+# As of 2016-09-10 QuickFuzz forks a few hackage packages
+# without renames:
+# - asn1-encoding: stabilised handling of corrupterd data
+# - hogg: more functions are exported directly
+# - juicypixels: more functions and modules are exported,
+# unsafe functions are changed to safe
+# - svg-tree: upstream, build agains patched juicypixels
+# - x509: stabilised handling of corrupterd data
+# - megadeth: not a fork but has no releases
+# - ttasm: cabalised, renamed module
+
+src_unpack() {
+ git-r3_src_unpack
+
+ cd "${S}"
+
+ local forked_repos=(
+ Juicy.Pixels
+ hogg
+ hs-asn1-encoding
+ hs-certificate-x509
+ ttasm
+
+ # not exactly fork. just unreleased upstream library
+ megadeth
+ )
+ local repo_name
+ local repo_subdir=${S}/bundled
+
+ mkdir "${repo_subdir}/" || die
+ for repo_name in "${forked_repos[@]}"; do
+ git-r3_fetch https://github.com/CIFASIS/${repo_name}.git
+ git-r3_checkout https://github.com/CIFASIS/${repo_name}.git "${repo_subdir}/${repo_name}"
+ done
+
+ git-r3_fetch https://github.com/Twinside/svg-tree.git
+ git-r3_checkout https://github.com/Twinside/svg-tree.git "${repo_subdir}/svg-tree"
+
+ make_snapshot quickfuzz-0.1_p$(date "+%Y%m%d")
+}
+
+src_prepare() {
+ default
+
+ # inline dependencies of bundled dependencies
+ cabal_chdeps \
+ 'JuicyPixels' 'memory' \
+ 'asn1-encoding' 'hourglass' \
+ 'hogg' 'array' \
+ 'megadeth' 'base' \
+ 'svg-tree' 'attoparsec, lens, scientific, thyme' \
+ 'ttasm' 'bitwise, mtl, monad-loops' \
+ 'x509' 'asn1-parse, cryptonite, hourglass, memory' \
+ \
+ 'hs-source-dirs: src' 'hs-source-dirs: src, bundled/Juicy.Pixels/src, bundled/hogg, bundled/hs-asn1-encoding, bundled/hs-certificate-x509, bundled/megadeth, bundled/svg-tree/src, bundled/ttasm'
+}
+
+src_configure() {
+ haskell-cabal_src_configure \
+ $(cabal_flag archs archs) \
+ $(cabal_flag codes codes) \
+ $(cabal_flag docs docs) \
+ $(cabal_flag imgs imgs) \
+ $(cabal_flag media media) \
+ $(cabal_flag net net) \
+ $(cabal_flag pki pki)
+}
diff --git a/app-forensics/radamsa/Manifest b/app-forensics/radamsa/Manifest
new file mode 100644
index 000000000000..a0eeb14a4ceb
--- /dev/null
+++ b/app-forensics/radamsa/Manifest
@@ -0,0 +1,4 @@
+DIST radamsa-0.5.tar.gz 168177 SHA256 e21a86aa6dca7e4619085fc60fb664d0a1bd067ca6ebfbcb16ab2d57c8854cb4 SHA512 d48f61ea7c0703d7fdf68ab32894e93d774e8f2893642a81046b8210d7d433f4be8930d7d79317ddb0882cf54b06505c541827b925f30b861ae8205e300fed80 WHIRLPOOL 322c497e8f07ac77e2ffaade0badf980ba7673af5508eb0ab3b12de15afc71ae69e89281531283c95392ea9557b10eb130623e8e44b463752ef8d5d36ecf7ce9
+EBUILD radamsa-0.5-r1.ebuild 573 SHA256 1f2d6bfc1037fc831b547f10844a7e3e60b30693bd4d75b80f765bd6d553f930 SHA512 828be07f71aee3e1eda112c9dc5a48203cc94751b5bd11dc13c930867ddbe223262e9ce23a01cb6ba644b0a2eeac3fbd6fa7c19baf49677ad1583e98ab069990 WHIRLPOOL cec5739b3514389758a179c56f87d1fe76814edc101772f8d3dc7d1cab60ddf3a3426668cdeff89829bf5bfb9e6f10288011f3c458ca4e89df1bd7839cf2c00a
+MISC ChangeLog 525 SHA256 3f4817fe24746b11b276580c4e5b3954c04b9a00b440f4be9732b7a9adca64b4 SHA512 5da6eb8694bdba588b96adf8f81c999d8c5c7a81d09bebef165724c9b70042b3534d439e282c57f1c55802eb89d8d91eb90b6718fdb8d9e6fd428c403d44cecd WHIRLPOOL aa12616a890e562c6098e4869bc2a2a17868450a0e8a633af8bf6584aa050336cdc1119c23732c76f37fe7782cce556868653e9be40cafa214503aa2042ca468
+MISC metadata.xml 327 SHA256 0567d3b039a8807e552de87945f7fc674b16030c2cbb077a1068f0413da10993 SHA512 459a403d22b5a66bbf83ea2214d2b070eff87f2008f237a9c62338748dacebaf90d50defa0d8471ad77eb4369fd817280c528fb3fee3153ef508cb84971f3ef9 WHIRLPOOL 6cff4d245d4d9b579ed06b6543b66f1579be621cdb9950c664ddd4bc82dc73ef0cd085854967eac36de410ed803d7bc7083a152aa63fbc6061bb8bf696161f6b
diff --git a/app-forensics/radamsa/metadata.xml b/app-forensics/radamsa/metadata.xml
new file mode 100644
index 000000000000..093dde4f8e7d
--- /dev/null
+++ b/app-forensics/radamsa/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>slyfox@gentoo.org</email>
+ <name>Sergei Trofimovich</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="github">aoh/radamsa</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/radamsa/radamsa-0.5-r1.ebuild b/app-forensics/radamsa/radamsa-0.5-r1.ebuild
new file mode 100644
index 000000000000..89a3a070b6ae
--- /dev/null
+++ b/app-forensics/radamsa/radamsa-0.5-r1.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit toolchain-funcs
+
+DESCRIPTION="A general purpose fuzzer"
+HOMEPAGE="https://github.com/aoh/radamsa"
+SRC_URI="https://github.com/aoh/radamsa/releases/download/v${PV}/${P}.tar.gz"
+
+LICENSE="MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+RESTRICT=test # needs an owl-lisp
+
+DOCS=( LICENCE NEWS README.md )
+
+src_compile() {
+ emake CC="$(tc-getCC)" CFLAGS="${CFLAGS}"
+}
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+
+ einstalldocs
+}
diff --git a/app-forensics/rdd/Manifest b/app-forensics/rdd/Manifest
new file mode 100644
index 000000000000..b6df0c94062e
--- /dev/null
+++ b/app-forensics/rdd/Manifest
@@ -0,0 +1,6 @@
+AUX rdd-3.0.4-sandbox-fix.patch 927 SHA256 8623bd54242fa5faf21b0d6cab74d92353cd9736f87d3bf11da782a57f647ca0 SHA512 5debe10d288d807049aea18d8f1a827ca3704bfe30bb8be59c1c0225b080e3387ee1c1d4f9b73c4e4c8d5362a9029fd5016655734ec739f78884a8d96c9829c9 WHIRLPOOL 0f05f3a8847e6ddd4cefca2a0fdcf395c671e65b99216f03d6a0b813eb2b3804240d9d581ebb4c26809bea71b48e8a61d7ddec36a4b12cc093a0aa139874489d
+DIST rdd-3.0.4.tar.gz 5896942 SHA256 13e20e91dbc029a4a4f0713c1a049c94378083a1f3469ef0006e301484040685 SHA512 8f4536cfd8d1f4bb841a40d163b922698e27f02b8aa9f525c265e4c2ebf94bf5e61f8ea8452fca00d5a5ab7977bc24b64288b6442c8076692b045ed9936ba86f WHIRLPOOL 25a5b8032aa6c317d55f83ad745e1c0436aac12655726ce4a1938900bcd34c7cb92d6410159b490800bf8b850658573f3999a15b261539597820aa5360e4ecb3
+EBUILD rdd-3.0.4-r1.ebuild 1053 SHA256 506085bfd48d7189789d19fcfb957067baf80d2589e60d1fe59ce2edbd18cf24 SHA512 644b373d0f8ec238e46e83e5cf4a085c4891e30b79a2d762bc41f087046785d66b255ae05b1402eb4a5c1bf7f2126f2b5875996e74b66e556489b6bff7cbe3b4 WHIRLPOOL cf83d99e90745673eabc7d39f6277b8abce140af8606f40786176c5872036a9d433f075612d737c1a72ca66b1f5077bca589223bc47953e8df3918c2f19de5b1
+MISC ChangeLog 2462 SHA256 e36c79204558fe494f98eb58ba53eef3b42cd7cb3534e0e36eeea7c7ca24530b SHA512 c3ed7901bb7f2a60f62c0dc40da57d9729fbde556b3a7e84454239641dc6feccb50d3954a17edea9d9a80e362f62bb03a7a557dcfd4a8f209b9d8304cc7db7c7 WHIRLPOOL b6aaade6af91f788eaced83a858208aad575e52c2dfa63c981ece39b49d6dea35150872a077323bf6212adc82903d3ac7b76cdbb5506f9cb4c732c58365bed3f
+MISC ChangeLog-2015 1424 SHA256 2f16800b7d00e710d1eab77ef74b7d46889363833c305cba0159644337333f88 SHA512 10e29336295d77d7307caaa5d06f348b37f4979472df412b4a3d087247dcb8a385e60b660e45245126ce7ca2e20dd2ed54c02768489ec52df2a0e61cf84d3c30 WHIRLPOOL 561166b04a60f3dae9fed96c250a03542c3660101c316e2e43f7d4f559aa7b4010f8fbe1b76084242122fc69eb86987463b857b06d8c280fc200fcd3d032a76e
+MISC metadata.xml 428 SHA256 209b4c343b83857b6259f06e1b375a26908f6fab7d0aefdb98f63a995f1d4966 SHA512 ea9b44bd7ae0e61247d08efbe67df82ece8243c8fcc05a21866c232b28a6f6bbea7aee9756dac2c42622e43e86983ba8f170f359376aa37726682a6e46bd7cd0 WHIRLPOOL 209d622a709d3dbe6b3c1898f3c3fdc93f1ecebc908cd6fb685919de80a8f10fb39599b187d3dd7477e6de9edae20612164a66c2f91f0a5daf60336d3d00c4bd
diff --git a/app-forensics/rdd/files/rdd-3.0.4-sandbox-fix.patch b/app-forensics/rdd/files/rdd-3.0.4-sandbox-fix.patch
new file mode 100644
index 000000000000..b7188030fba5
--- /dev/null
+++ b/app-forensics/rdd/files/rdd-3.0.4-sandbox-fix.patch
@@ -0,0 +1,25 @@
+diff -Naur rdd-3.0.4-orig/src/Makefile.am rdd-3.0.4/src/Makefile.am
+--- rdd-3.0.4-orig/src/Makefile.am 2013-07-26 11:27:50.288696066 -0400
++++ rdd-3.0.4/src/Makefile.am 2013-07-26 12:14:51.601771619 -0400
+@@ -83,14 +83,15 @@
+ rdd-verify.1
+
+ install-exec-local:
+- $(INSTALL) $(srcdir)/rddi.py $(bindir)/rddi
+- $(INSTALL) $(srcdir)/plot-entropy.py $(bindir)/plot-entropy
+- $(INSTALL) $(srcdir)/plot-md5.py $(bindir)/plot-md5
++ $(INSTALL) -d $(DESTDIR)$(bindir)
++ $(INSTALL) $(srcdir)/rddi.py $(DESTDIR)$(bindir)/rddi
++ $(INSTALL) $(srcdir)/plot-entropy.py $(DESTDIR)$(bindir)/plot-entropy
++ $(INSTALL) $(srcdir)/plot-md5.py $(DESTDIR)$(bindir)/plot-md5
+
+ uninstall-local:
+- rm -f $(bindir)/rddi
+- rm -f $(bindir)/plot-entropy
+- rm -f $(bindir)/plot-md5
++ rm -f $(DESTDIR)$(bindir)/rddi
++ rm -f $(DESTDIR)$(bindir)/plot-entropy
++ rm -f $(DESTDIR)$(bindir)/plot-md5
+
+ DISTCLEANFILES= Makefile.in
+
diff --git a/app-forensics/rdd/metadata.xml b/app-forensics/rdd/metadata.xml
new file mode 100644
index 000000000000..938e2392c2bd
--- /dev/null
+++ b/app-forensics/rdd/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>patrick@gentoo.org</email>
+ <name>Patrick Lauer</name>
+ </maintainer>
+ <maintainer type="person">
+ <email>zerochaos@gentoo.org</email>
+ <name>Rick Farina</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="sourceforge">rdd</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/rdd/rdd-3.0.4-r1.ebuild b/app-forensics/rdd/rdd-3.0.4-r1.ebuild
new file mode 100644
index 000000000000..58ac352f6f78
--- /dev/null
+++ b/app-forensics/rdd/rdd-3.0.4-r1.ebuild
@@ -0,0 +1,50 @@
+# Copyright 1999-2013 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit autotools eutils
+
+# no worky
+RESTRICT="test"
+
+DESCRIPTION="Rdd is a forensic copy program"
+HOMEPAGE="http://www.sf.net/projects/rdd"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+KEYWORDS="~x86 ~amd64"
+IUSE="debug doc"
+LICENSE="BSD"
+SLOT="0"
+
+RDEPEND="app-forensics/libewf
+ x11-libs/gtk+:2
+ gnome-base/libglade:2.0"
+
+DEPEND="${RDEPEND}
+ doc? ( app-doc/doxygen )"
+
+src_prepare() {
+ epatch "${FILESDIR}/rdd-3.0.4-sandbox-fix.patch"
+ sed -i 's/AM_PATH_GTK_2_0//' configure.ac || die
+ AT_M4DIR=m4 eautoreconf
+}
+
+src_configure() {
+ #doxygen-html fails but the docs are prebuilt so we don't need to enable them
+ econf --disable-doxygen-html \
+ $(use_enable debug tracing) \
+ $(use_enable doc doxygen-doc)
+}
+
+src_compile() {
+ emake -j1
+}
+
+src_install() {
+ emake install DESTDIR="${D}"
+ dobin src/rddi.py
+ dosym rdd-copy /usr/bin/rdd
+ #this causes a warning about not being recursive, no clue why
+ dohtml -r doxygen-doc/html/*
+}
diff --git a/app-forensics/rifiuti/Manifest b/app-forensics/rifiuti/Manifest
new file mode 100644
index 000000000000..afbdcc4a0415
--- /dev/null
+++ b/app-forensics/rifiuti/Manifest
@@ -0,0 +1,5 @@
+DIST rifiuti_20040505_1.tar.gz 2823 SHA256 3694cf6811c7be96412934ee1f378cf74003472d1a62dc642e2229f4ad5073cc SHA512 9d7e77c3eb74b97fedd66c0cac9c1960d3de0f284fcdee81c1e523eb9898cc9758194d7913b1bd7e0bc82eae4eeed656b7b3c699bcdd536325604d17c41da6de WHIRLPOOL 791e3ebee6a9e125da17a6a9180ff3ef7ad81b3339f039031c6b57a8a37339c230d5e721326d4e956945013e6ca359e55fadf0ea35ba9d3a949e8461e3d09bce
+EBUILD rifiuti-20040505_p1.ebuild 530 SHA256 f20869c0efa34420032823685847afb6d0296850f230fca59e300259436b1907 SHA512 3c5ac3c072e1ed5924495539f90983be9d66c007fe42b5c018e6abca0ef94a1a413fa8a294638f86299556b5f3e93f3a73cf292c9a8c6dad75b1cf1d6f4abf7b WHIRLPOOL c797a1881c4c629c5e255f1f5bb26856fd2ce14115e9844d4cc6bc4fa7dd170e509ff4b976d1aba53937524a525a80fc1a1a9db4416e3c577f5e798f2af97d2e
+MISC ChangeLog 2562 SHA256 37f67aa34d4dfaf84acf886de4dd51d56581ddd47ca00671fb5b1dbe212d1d64 SHA512 ed870822671ab69e46e521cacc2d6e7ac7107561cc38b8ef919e2d832fd8e563fddf872556d02a144f20543d93c878f85b2191724e682e9df79c2abf713dab3f WHIRLPOOL 6fa5965864ac969f0212f48e37d78bd93d23809a8c19e249434aa22f071b8d58a882d288ecf4472d147b467b6ec10b30c64db020813fc4be1e509bf99a9284b4
+MISC ChangeLog-2015 1214 SHA256 3092441eda63473e1e173b35374b2a964592002554c23a57ab4f89bc234e9228 SHA512 60f67e626bb5053dd1ae5c23e79706261da507a4d145b8701d0845c4973d716a8e02bc7a1b7ec75c8470c6cf5c5228f5f86197432d31642692260bcac8324251 WHIRLPOOL 783c5cea52d17b0fc7107d312d11ae763b8d2ec8bad2cf7f35be5d5edea118ef042b86c7113873baa109550cd186331434c70567859376b76133a4a93505e344
+MISC metadata.xml 243 SHA256 37f6c5093bdbce6a933f15351b291dfa7109c51abc4d30e917181f384abed3c6 SHA512 4e97cd2b4cea4fe6059d375cd29eb5e97c8a40581126a624d1c7a48e2e9092472bc0f4e4f61a95a73121aa183995706b8111757e5dcb3d0bf0458e33029aeda1 WHIRLPOOL 59c9e1d5a2284cc406aa3f4469b5876f22f50b3842fbb8eb8e3092aab7d75c2d04da2d11ecaf30246bf0ca8915411f22ab9f8f29b8d6fa669df393f7889a33ac
diff --git a/app-forensics/rifiuti/metadata.xml b/app-forensics/rifiuti/metadata.xml
new file mode 100644
index 000000000000..aa3597556ef2
--- /dev/null
+++ b/app-forensics/rifiuti/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">odessa</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/rifiuti/rifiuti-20040505_p1.ebuild b/app-forensics/rifiuti/rifiuti-20040505_p1.ebuild
new file mode 100644
index 000000000000..f1e9f1a4f25f
--- /dev/null
+++ b/app-forensics/rifiuti/rifiuti-20040505_p1.ebuild
@@ -0,0 +1,24 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+inherit toolchain-funcs
+
+MY_P=${PN}_${PV/_p/_}
+DESCRIPTION="Recycle Bin Analyzer"
+HOMEPAGE="https://sourceforge.net/projects/odessa/"
+SRC_URI="mirror://sourceforge/odessa/${MY_P}.tar.gz"
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc x86"
+IUSE=""
+
+S=${WORKDIR}/${MY_P}
+
+src_compile() {
+ cd src
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} -o rifiuti rifiuti.c -lm -lc || die "failed to compile"
+}
+
+src_install() {
+ dobin src/rifiuti
+}
diff --git a/app-forensics/rkhunter/Manifest b/app-forensics/rkhunter/Manifest
new file mode 100644
index 000000000000..79e7945512b0
--- /dev/null
+++ b/app-forensics/rkhunter/Manifest
@@ -0,0 +1,10 @@
+AUX rkhunter-1.3.cron 3927 SHA256 525b2680a025eb612600aadb52047718ecfd198b012ab938da150c143cc374e0 SHA512 a99eb535c12b6715031aa367ba0ae70ed1761a03b74c57d173512006e466ef56bfc7ffb15364d4f36d39597277a8cf3b35e7286462bfd6ec9d44877dd1653d4d WHIRLPOOL de51ce8cd50ad27504ba40911bf8a422b3c59239f5bccb99d9d8e86a52672e2086b9d17d6966d7848e82d14cd6fa75bea7964472f3b9a0f1983ec6ddcc40898f
+AUX rkhunter-1.4.2.conf.patch 1250 SHA256 ce828b367b04286e5ca9b564455bfadbb9cdfe01dfb0d6601f45adb49265142c SHA512 654887bea5d3b7388c11c9a59d3d924d763268c3552bee82a0bcf9b5077803eaa0cf16b7346aeaac44e817bfdd30e5d74abd10d12eb07f0bc1a97c57b850aefe WHIRLPOOL ccac3d0bd526a48b303ef6ca71ab8bbeb2f177d7fe6788b6b8bd194e7436e4afcbc9db3e016f1af50cc6b29a390b9407121e14e908a024eb01086d955b238c47
+AUX rkhunter.bash-completion 2499 SHA256 cdd08c1e6b79d2875d88c35d0c0bf9d85d84b4a1b21b97eb208883466d1efd39 SHA512 8fba540f5425169810b8baaf2e801638e3286aa93a69d4a96f5916e3bc9b632edaef6b509b8ca58f8047a7c7d4bb4bf348ad7923e855edce3dd0432725a944e7 WHIRLPOOL af6dbc3d95201b149604161986dd68b9551dc8f300e833e904624fb45adf27df74bdf504975d135142fd4065afb86d323569e73e129178c69dc442faa536f537
+DIST rkhunter-1.4.2.tar.gz 277707 SHA256 789cc84a21faf669da81e648eead2e62654cfbe0b2d927119d8b1e55b22b65c3 SHA512 a4e45caaaf5b8262619ebb890784c75c4e30db4c6c0eba305f86d419142b4796c95bc55fe8846dce8d58bc7636bdb365a4a8c41707f64d4d81373687c5a3b0d4 WHIRLPOOL 911ed8e37e112516adba3afb63e3d4862d061ea35cd4b8becea455922d6b2a744f4b8e7cf92685cff29c3192c594dfc58ba3c194f371dd4d95530bd4c09c5d84
+DIST rkhunter-1.4.4.tar.gz 297626 SHA256 a8807c83f9f325312df05aa215fa75ad697c7a16163175363c2066baa26dda77 SHA512 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e WHIRLPOOL 92c92a693443c978aa7f49944e84075b116c8c4295ff8e9ad54e2bee8242299aaea2d591a9a184dc484b73b33f61210c8b87cfdcea4f2437e386f633ba12f2cb
+EBUILD rkhunter-1.4.2.ebuild 1411 SHA256 d02e361bcd6e16ec86e351a307156b7c779bb8d684129791beeeef5771b77492 SHA512 e4b2f70f6417f3a44d918ab310460dd45f7fae760458f7b9804752a79beffabea832dd195c85efeb8e31d1b71d7196b1df70a8cdc5a562d0a4ef575888820ada WHIRLPOOL 7d68ff0ed6c3684ef6aca2d05d6b0089d250fccf3aefb3c0b8c1b1784b522da9d4a26f5d611191cd6c1c7a65a093ce85688925c712dcb178068cf88598c8a992
+EBUILD rkhunter-1.4.4.ebuild 1433 SHA256 92ffcc0f04d6b1a7971aa49ddea6258543d2e8f2cfebcdf1568a3d60237b66b5 SHA512 b35bcfd29d9a8e7f5054975d777cd0b52c251d80df5fb38ec81000b6d6b4f12c6cd81433e4bcf0761a67442dba90049d6f35c3ba8f43e51bfeaed535605184c7 WHIRLPOOL 50edb2fffdcf011b23e12838b78a6ecf8bc6e280c7d2d90f724287c70d6141feedb7c2d2ca50a3d4a732615cda70cdc3941b4ebebec3d6e8103b1e347eae54ad
+MISC ChangeLog 3011 SHA256 8ac2848c498d2656567cd8d425cbdc5d9149106db88b00202d01d708e498cf2c SHA512 aa8d505e1dff2cd6a4c259d2fca2bd46f9c33638c06b6251260f9cbe733e44b2cd9244648d66f843a22db006aead75fd4c7fb79cdf0e90357778ee5f1bff8654 WHIRLPOOL 644ae4cef603bc9bf2e4870d797d3189a101bf5d5622cc53aabeba263bbaf158ed19e52d96206cbac19f0e8d8f2e1f92789dc2775f5ded9e085084f9d3896162
+MISC ChangeLog-2015 17596 SHA256 10217ae7177bd40896f0e8bbbcf74d0178e2431434aed2423bee2157c5b87e25 SHA512 c4a26dabfddaad9216e06cfa792acfa4c0c9fd78ba2a9d5a14e89a96670e5a98d04df035a5f71bdb50733e8598360371f36176e45a5b58b5bcaf0d552858eb49 WHIRLPOOL f72b3bde48a002ea7691fd29493a23d1e4cc03fdbe6a67b381f0f656cee36b5dcc624574f6faca05831cc25aa22eaeaf7ee2cd327496201a010dc23720a5b2b8
+MISC metadata.xml 250 SHA256 b7958445feebc53822c26943827589ae43981f57398e4907fd2f2b176f34b17b SHA512 ab31238a72b35a1f33056cf1736628bbf367fc20f4dc93735d11617ed668f295567e1865844d727e666de07c56d84f8b5cfd1eec41c91cd836789a420ea2dda9 WHIRLPOOL da0de8660e95e8b3f4482d30d1895cdf4f10e89a4d514dbfabfaf3fd1720dd653b41f5daade271242340eab2f51beaf15a53ed0828a3acce6e37ad6e4d624bae
diff --git a/app-forensics/rkhunter/files/rkhunter-1.3.cron b/app-forensics/rkhunter/files/rkhunter-1.3.cron
new file mode 100644
index 000000000000..468667cf9d94
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter-1.3.cron
@@ -0,0 +1,133 @@
+#!/bin/bash
+# original author: Aaron Walker <ka0ttic@gentoo.org>
+
+########################## Begin Configuration ###############################
+
+# Default options - more options may be added depending on the
+# configuration variables you set below
+# --cronjob implies -c, --nocolor, --sk
+RKHUNTER_OPTS="--cronjob --summary"
+
+# Set this to 'yes' to enable ; this script does nothing otherwise
+ENABLE=no
+
+# Automatically update rkhunter's dat files prior to running?
+UPDATE=no
+
+# Set this to 'yes' if you wish the output to be mailed to you
+SEND_EMAIL=no
+
+# NOTE: the following EMAIL_* variables are only relevant if you set the
+# SEND_EMAIL variable to 'yes'
+EMAIL_SUBJECT="${HOSTNAME}: rkhunter output"
+EMAIL_RECIPIENT=root
+EMAIL_CMD="|mail -s \"${EMAIL_SUBJECT}\" ${EMAIL_RECIPIENT}"
+
+# Log rkhunter output?
+LOG=no
+
+# The default log location is /var/log/rkhunter.log. Set this variable if
+# you'd like to use an alternate location.
+#LOGFILE=""
+
+# By default, the log file created by rkhunter is world-readable (0644). If
+# you'd like to modify the permissions afterwards, set this variable. The
+# value of this variable, must be a valid chmod argument such as '0600' or
+# 'u+rw,go-rwx'. See the chmod(1) manual page for more information.
+#LOGFILE_PERMS="0600"
+
+# By default, rkhunter overwrites the previous log. Set this variable
+# to 'yes' if you'd like the log output appended to the logfile, instead
+# of overwriting it.
+SAVE_OLD_LOGS=no
+
+# Set to 1 to recieve only warnings & errors
+# Set to 2 to recieve ALL rkhunter output
+# Set to 3 to recieve rkhunter report
+VERBOSITY=3
+
+########################### End Configuration ################################
+
+# exit immediately, unless enabled
+[[ "${ENABLE}" == "yes" ]] || exit 0
+
+# debug mode? (mainly for my benefit)
+if [[ -n "${1}" ]] && [[ ${1} = "-d" ]] ; then
+ set -o verbose -o xtrace
+fi
+
+[[ -z "${LOGFILE}" ]] && LOGFILE="/var/log/rkhunter.log"
+
+# moved this out of config section since it'll
+# probably never need to be changed
+RKHUNTER_EXEC="/usr/sbin/rkhunter"
+
+# sanity check
+if [[ ! -x "${RKHUNTER_EXEC}" ]] ; then
+ echo "${RKHUNTER_EXEC} does not exist or is not executable!"
+ exit 1
+fi
+
+# we create a few tmp files, so let's at least make
+# them readable/writable by root only
+umask 0077
+
+# all output goes to this temp file
+_tmpout=$(mktemp /tmp/rkhunter.cron.XXXXXX)
+exec > ${_tmpout} 2>&1
+
+# update data files
+if [[ "${UPDATE}" == "yes" ]] ; then
+ # save the output of --update in a tmp file so that it can be mailed
+ # along with the scan output; otherwise the user will get 2 mails
+ ${RKHUNTER_EXEC} --nocolor --update
+fi
+
+# formulate options string according to user configuration
+[[ "${LOG}" == "yes" ]] && \
+ RKHUNTER_OPTS="${RKHUNTER_OPTS} --createlogfile ${LOGFILE}"
+
+case "${VERBOSITY}" in
+ # warnings and errors only
+ 1) RKHUNTER_OPTS="${RKHUNTER_OPTS} --quiet" ;;
+ # default rkhunter output (no extra options)
+# 2) ;;
+ # default to option 3
+ *) ;;
+esac
+
+# save old log
+if [[ "${LOG}" == "yes" && "${SAVE_OLD_LOGS}" == "yes" ]] ; then
+ if [[ -e "${LOGFILE}" ]] ; then
+ _tmpfile=$(mktemp ${LOGFILE}.XXXXXX)
+ mv -f ${LOGFILE} ${_tmpfile}
+ echo -e "--\nrkhunter.cron commencing at: $(date)\n--" >> ${_tmpfile}
+ fi
+fi
+
+# finally, run rkhunter
+CMD="${RKHUNTER_EXEC} ${RKHUNTER_OPTS}"
+eval ${CMD}
+RV=$?
+
+# email output?
+if [[ "${SEND_EMAIL}" == "yes" ]] ; then
+ CMD="cat ${_tmpout} ${EMAIL_CMD}"
+ eval ${CMD}
+fi
+
+# remove temp file
+[[ -n "${_tmpout}" ]] && rm -f ${_tmpout}
+
+[[ "${LOG}" != "yes" ]] && exit ${RV}
+
+# from this point on, we can assume logging is enabled
+
+# append new log to old log and restore
+if [[ -n "${_tmpfile}" ]] ; then
+ cat ${LOGFILE} >> ${_tmpfile}
+ mv ${_tmpfile} ${LOGFILE}
+fi
+
+chmod ${LOGFILE_PERMS:-0644} ${LOGFILE}
+exit ${RV}
diff --git a/app-forensics/rkhunter/files/rkhunter-1.4.2.conf.patch b/app-forensics/rkhunter/files/rkhunter-1.4.2.conf.patch
new file mode 100644
index 000000000000..8fd49ab421da
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter-1.4.2.conf.patch
@@ -0,0 +1,38 @@
+diff -Naur rkhunter-1.4.2/files/rkhunter.conf rkhunter-1.4.2-fixed/files/rkhunter.conf
+--- rkhunter-1.4.2/files/rkhunter.conf 2014-01-25 16:29:51.000000000 -0500
++++ rkhunter-1.4.2-fixed/files/rkhunter.conf 2014-05-27 11:58:11.098750088 -0400
+@@ -72,6 +72,7 @@
+ # to use.
+ #
+
++INSTALLDIR=/usr
+
+ #
+ # If this option is set to '1', it specifies that the mirrors file
+@@ -154,7 +155,7 @@
+ # subsequently commented out or removed, then the program will assume a
+ # default directory beneath the installation directory.
+ #
+-#TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter/tmp
+
+ #
+ # This option specifies the database directory to use.
+@@ -163,7 +164,7 @@
+ # subsequently commented out or removed, then the program will assume a
+ # default directory beneath the installation directory.
+ #
+-#DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+
+ #
+ # This option specifies the script directory to use.
+@@ -171,7 +172,7 @@
+ # The installer program will set the default directory. If this default is
+ # subsequently commented out or removed, then the program will not run.
+ #
+-#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/lib/rkhunter/scripts
+
+ #
+ # This option can be used to modify the command directory list used by rkhunter
diff --git a/app-forensics/rkhunter/files/rkhunter.bash-completion b/app-forensics/rkhunter/files/rkhunter.bash-completion
new file mode 100644
index 000000000000..a28f96f510d1
--- /dev/null
+++ b/app-forensics/rkhunter/files/rkhunter.bash-completion
@@ -0,0 +1,87 @@
+# rkhunter completion
+
+_rkhunter() {
+ local cur prev opts
+ COMPREPLY=()
+ cur=${COMP_WORDS[COMP_CWORD]}
+ prev=${COMP_WORDS[COMP_CWORD-1]}
+ opts="-c --checkall --createlogfile --cronjob --display-logfile -h --help\
+ --nocolors --report-mode --report-warnings-only \
+ --skip-application-check --skip-keypress --quick --quiet --update \
+ --version --versioncheck --bindir --configfile --dbdir --rootdir \
+ --tmpdir --disable-md5-check --disable-passwd-check \
+ --scan-knownbad-files"
+
+ if [[ "${cur}" == -* ]] || [[ ${COMP_CWORD} -eq 1 ]]; then
+ COMPREPLY=($(compgen -W "${opts}" -- "${cur}"))
+ fi
+
+ case "${prev}" in
+ --createlogfile)
+ COMPREPLY=($(compgen -o filenames -A file -W "${opts/--createlogfile}" \
+ -- "${cur}"))
+ ;;
+ --display-logfile)
+ COMPREPLY=($(compgen -W "${opts/--display-logfile}" -- "${cur}"))
+ ;;
+ --*dir)
+ COMPREPLY=($(compgen -o dirnames -A directory -- "${cur}"))
+ ;;
+ --*file)
+ COMPREPLY=($(compgen -o filenames -A file -- "${cur}"))
+ ;;
+ -c|--checkall)
+ COMPREPLY=($(compgen -W "${opts/-c --checkall}" -- "${cur}"))
+ ;;
+ --cronjob)
+ COMPREPLY=($(compgen -W "${opts/--cronjob}" -- "${cur}"))
+ ;;
+ -h|--help)
+ COMPREPLY=($(compgen -W "${opts/-h --help}" -- "${cur}"))
+ ;;
+ --nocolors)
+ COMPREPLY=($(compgen -W "${opts/--nocolors}" -- "${cur}"))
+ ;;
+ --report-mode)
+ COMPREPLY=($(compgen -W "${opts/--report-mode}" -- "${cur}"))
+ ;;
+ --report-warnings-only)
+ COMPREPLY=($(compgen -W "${opts/--report-warnings-only}" -- \
+ "${cur}"))
+ ;;
+ --skip-application-check)
+ COMPREPLY=($(compgen -W "${opts/--skip-application-check}" -- \
+ "${cur}"))
+ ;;
+ --skip-keypress)
+ COMPREPLY=($(compgen -W "${opts/--skip-keypress}" -- "${cur}"))
+ ;;
+ --quick)
+ COMPREPLY=($(compgen -W "${opts/--quick}" -- "${cur}"))
+ ;;
+ --quiet)
+ COMPREPLY=($(compgen -W "${opts/--quiet}" -- "${cur}"))
+ ;;
+ --update)
+ COMPREPLY=($(compgen -W "${opts/--update}" -- "${cur}"))
+ ;;
+ --version)
+ COMPREPLY=($(compgen -W "${opts/--version}" -- "${cur}"))
+ ;;
+ --versioncheck)
+ COMPREPLY=($(compgen -W "${opts/--versioncheck}" -- "${cur}"))
+ ;;
+ --disable-md5-check)
+ COMPREPLY=($(compgen -W "${opts/--disable-md5-check}" -- "${cur}"))
+ ;;
+ --disable-passwd-check)
+ COMPREPLY=($(compgen -W "${opts/--disable-passwd-check}" -- \
+ "${cur}"))
+ ;;
+ --scan-knownbad-files)
+ COMPREPLY=($(compgen -W "${opts/--scan-knownbad-files}" -- \
+ "${cur}"))
+ ;;
+ esac
+}
+complete -F _rkhunter rkhunter
diff --git a/app-forensics/rkhunter/metadata.xml b/app-forensics/rkhunter/metadata.xml
new file mode 100644
index 000000000000..df05a2cbf56a
--- /dev/null
+++ b/app-forensics/rkhunter/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <upstream>
+ <remote-id type="sourceforge">rkhunter</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/rkhunter/rkhunter-1.4.2.ebuild b/app-forensics/rkhunter/rkhunter-1.4.2.ebuild
new file mode 100644
index 000000000000..abaf05c31f4c
--- /dev/null
+++ b/app-forensics/rkhunter/rkhunter-1.4.2.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils bash-completion-r1
+
+DESCRIPTION="Rootkit Hunter scans for known and unknown rootkits, backdoors, and sniffers"
+HOMEPAGE="http://rkhunter.sf.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="alpha amd64 ~mips ppc x86"
+IUSE=""
+
+RDEPEND="
+ app-shells/bash
+ dev-lang/perl
+ sys-process/lsof[rpc]
+ virtual/cron
+ virtual/mailx
+"
+
+S="${WORKDIR}/${P}/files"
+
+src_prepare() {
+ epatch "${FILESDIR}/${P}.conf.patch"
+}
+
+src_install() {
+ # rkhunter requires to be root
+ dosbin ${PN}
+
+ insinto /etc
+ doins ${PN}.conf
+
+ exeinto /usr/lib/${PN}/scripts
+ doexe *.pl
+
+ insinto /var/lib/${PN}/db
+ doins *.dat
+
+ insinto /var/lib/${PN}/db/i18n
+ doins i18n/*
+
+ doman ${PN}.8
+ dodoc ACKNOWLEDGMENTS CHANGELOG FAQ README
+
+ exeinto /etc/cron.daily
+ newexe "${FILESDIR}/${PN}-1.3.cron" ${PN}
+
+ newbashcomp "${FILESDIR}/${PN}.bash-completion" ${PN}
+}
+
+pkg_postinst() {
+ elog "A cron script has been installed to /etc/cron.daily/rkhunter."
+ elog "To enable it, edit /etc/cron.daily/rkhunter and follow the"
+ elog "directions."
+ elog "If you want ${PN} to send mail, you will need to install"
+ elog "virtual/mailx or alter the EMAIL_CMD variable in the"
+ elog "cron script and possibly the MAIL_CMD variable in the"
+ elog "${PN}.conf file to use another mail client."
+}
diff --git a/app-forensics/rkhunter/rkhunter-1.4.4.ebuild b/app-forensics/rkhunter/rkhunter-1.4.4.ebuild
new file mode 100644
index 000000000000..e8eaba4a2a01
--- /dev/null
+++ b/app-forensics/rkhunter/rkhunter-1.4.4.ebuild
@@ -0,0 +1,65 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit bash-completion-r1
+
+DESCRIPTION="Rootkit Hunter scans for known and unknown rootkits, backdoors, and sniffers"
+HOMEPAGE="http://rkhunter.sf.net/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~mips ~ppc ~x86"
+IUSE=""
+
+RDEPEND="
+ app-shells/bash
+ dev-lang/perl
+ sys-process/lsof[rpc]
+ virtual/cron
+ virtual/mailx
+"
+
+S="${WORKDIR}/${P}/files"
+
+src_prepare() {
+ default
+ eapply -p2 "${FILESDIR}/${PN}-1.4.2.conf.patch"
+}
+
+src_install() {
+ # rkhunter requires to be root
+ dosbin ${PN}
+
+ insinto /etc
+ doins ${PN}.conf
+
+ exeinto /usr/lib/${PN}/scripts
+ doexe *.pl
+
+ insinto /var/lib/${PN}/db
+ doins *.dat
+
+ insinto /var/lib/${PN}/db/i18n
+ doins i18n/*
+
+ doman ${PN}.8
+ dodoc ACKNOWLEDGMENTS CHANGELOG FAQ README
+
+ exeinto /etc/cron.daily
+ newexe "${FILESDIR}/${PN}-1.3.cron" ${PN}
+
+ newbashcomp "${FILESDIR}/${PN}.bash-completion" ${PN}
+}
+
+pkg_postinst() {
+ elog "A cron script has been installed to /etc/cron.daily/rkhunter."
+ elog "To enable it, edit /etc/cron.daily/rkhunter and follow the"
+ elog "directions."
+ elog "If you want ${PN} to send mail, you will need to install"
+ elog "virtual/mailx or alter the EMAIL_CMD variable in the"
+ elog "cron script and possibly the MAIL_CMD variable in the"
+ elog "${PN}.conf file to use another mail client."
+}
diff --git a/app-forensics/scalpel/Manifest b/app-forensics/scalpel/Manifest
new file mode 100644
index 000000000000..b8da165d4c73
--- /dev/null
+++ b/app-forensics/scalpel/Manifest
@@ -0,0 +1,5 @@
+DIST scalpel-2.0.tar.gz 1436379 SHA256 164a8a58ad8473c545794e981ca6349f2b4b76107c9553baab10a8a0204267e7 SHA512 7bf8e36f2fd22eb34e0f454c44a3ec3bc4e61dfd44ecda6ae93f0cc41cc3ad2b9fd9604637329bb96274a606812a578c968dd435d9d4a3ac5533613c849d321a WHIRLPOOL 72e5c0d689c8594970815352b8c0140670d38d8bc77f5ae640de5f5718a510675ba72c734672c3274d5eac1fe70f90d160e0760bbeae4429f72e1d173e4720d3
+EBUILD scalpel-2.0.ebuild 610 SHA256 92a7e6b910ce4d781f9b787a606ceb3cafab3c5319168c8d9a5db0081e2ba2d5 SHA512 d077b16affa31d02982f565810cd51cb7fc52300529bb2accf069aae3097df61b8000b5040f9289058647c4855a2d83fe3a0befd3b987326606a0eb2891731cd WHIRLPOOL 30131386caf6d9c64d789fd8680464c43217c6776f85cd212fe058a493b6eb071084ed66a65ec8af00dd38466f517c08ff4623dd628db46a2948e88013da1402
+MISC ChangeLog 2535 SHA256 981a31d9722c49343d4afdff43518200783b25579f4f1c0505e0abce8de753b6 SHA512 955039c5963ae913c210a40875ee0aa5dde7d02d34c7eafa1b31c3cddcbbb2d3759b48d6d409737781e27a8633f06077f49ba70d6c09a28745d0559c4b4cd9d7 WHIRLPOOL 208fe6edc236db28fbb993e3ba44db418027d6e732c6c94fc28128db066e3150715c6761de60108721208cb88a413af30ec6dddf25d23d562b971a66c9103b00
+MISC ChangeLog-2015 352 SHA256 59d5c7bf40cba7e7173b5d292c1553a5a568ad7c39e54e289da4bcdbb56fc317 SHA512 e212b77574d9a0b2505d8be195a71786b44dd3d4770333a4f4fb9f98d88c79b889c2d6732b80b12768896b4bdabe5975470d9396f728c034e975cce3503c0cba WHIRLPOOL 8e17f7b1c63a34993c0a875cd3a0f09fa6be035d932ddef02ba583c7ed801c04ec9a4c8e519b2cc1bab3edaf74d48924b19d2e73128b3c884a0c54df76bda426
+MISC metadata.xml 681 SHA256 3e5b51c1a5ccfe4c6d6019b07220e71ec1e9ff2b0e62ff063f2399ed921641ca SHA512 4b4d72abc4eead9d656d7c341a3390b220f48b40cce01582b3c21fdbdaaff3829905fd6b4d1b930e42ca7be4ab6f9f03ed14f89ce20cf86339578e04a3c8c381 WHIRLPOOL ebe35a6507285572ff0ef50bc41d32fe5706d2bec2beb6429e70b43e3a28b8ab246c8d295ff05e22bb832700ffa8737dbce38af56a33e4323f4ceb5b5e191da8
diff --git a/app-forensics/scalpel/metadata.xml b/app-forensics/scalpel/metadata.xml
new file mode 100644
index 000000000000..579622d691e1
--- /dev/null
+++ b/app-forensics/scalpel/metadata.xml
@@ -0,0 +1,15 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <!-- maintainer-needed -->
+ <longdescription lang="en">
+ Scalpel is a fast file carver that reads a database of header and footer
+ definitions and extracts matching files or data fragments from a set of image
+ files or raw device files. Scalpel is filesystem-independent and will carve
+ files from FATx, NTFS, ext2/3, HFS+, or raw partitions. It is useful for both
+ digital forensics investigation and file recovery.
+ </longdescription>
+ <upstream>
+ <remote-id type="github">sleuthkit/scalpel</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/scalpel/scalpel-2.0.ebuild b/app-forensics/scalpel/scalpel-2.0.ebuild
new file mode 100644
index 000000000000..b09225018fc9
--- /dev/null
+++ b/app-forensics/scalpel/scalpel-2.0.ebuild
@@ -0,0 +1,31 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="A high performance file carver"
+HOMEPAGE="https://github.com/sleuthkit/scalpel"
+SRC_URI="http://www.digitalforensicssolutions.com/Scalpel/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+RDEPEND="dev-libs/tre"
+DEPEND="${RDEPEND}"
+
+DOCS=( Changelog README )
+
+src_prepare() {
+ # Set the default config file location
+ sed -i -e "s:scalpel.conf:/etc/\0:" src/scalpel.h || die "sed failed"
+ default
+}
+
+src_install() {
+ default
+
+ insinto /etc
+ doins scalpel.conf
+}
diff --git a/app-forensics/sleuthkit/Manifest b/app-forensics/sleuthkit/Manifest
new file mode 100644
index 000000000000..231e4455da56
--- /dev/null
+++ b/app-forensics/sleuthkit/Manifest
@@ -0,0 +1,19 @@
+AUX sleuthkit-3.2.3-tools-shared-libs.patch 1685 SHA256 1126fa5b95cfa090426576b5e04a3b1a3814b63f0196f5216157929133ba6ec6 SHA512 675dcfe2eac295c06f1989b82f4fd5bfb2815405892dc2c6013001bd52dfb56fcd8d78eec84ad52a6103fa059ca1f3ca09ed7b6c65004222c4393d645b886d5b WHIRLPOOL 64711182f7eb8cd26e1afd1027c5a4f3da4716ae9f0ed5e3715286b3e0c1cdba2947d7c79e0114510054393c17ad42b14748d591155accf949b5b0515afdb0d3
+AUX sleuthkit-4.0.0-system-sqlite.patch 940 SHA256 1280cfb5b5be8d6896b4fc3f335cbc8b66dd00cf3a52734144918627da0e8f53 SHA512 c73324bc73fa90b657deb634825c846c751913ff39f1613975b633eb6255b207fac3307ee575e0e683d4664b6809f792b8a7d6ef1cb9846f03c2338edc70f0f9 WHIRLPOOL 2c50cb063489117eb9d72b916dcbfcd91abcd18dffc9880b17a871c9672f1f19d7ed5a70bed1d946532a5af0d44c3b1c889b262dc546d49e97eac66549067d86
+AUX sleuthkit-4.1.0-system-sqlite.patch 934 SHA256 133bd70d58787156fd505eef5d1a5fdbda805eeb9a6f76f8b8604e2482fd8d99 SHA512 401c312fb62505aeea23e7f95215580fc7a2a47b5428f762420b3402bb0fb75073ca2b9698378e93de1a0ef8476d258ad74140404b2db67fd2bd0b000245d737 WHIRLPOOL 49d7e0d59e9299ecd1b3bfd7661d25fa24be03b925527ef678a43d9399f2a42c090459a6466ade7c04147628c244baa6b6bbde05580455cb434663d18a71677b
+AUX sleuthkit-4.1.0-tools-shared-libs.patch 1678 SHA256 f1e933531378a3df52461bca839975ad8180339a68ae6aa230ab936d075ad813 SHA512 b559f669837194bed447ac269884ab50e6ea746aba2df799688964245c22814567871f12f96d43ba74016d5c448247b02bef5d7bdfd32fd782ef5e668686238e WHIRLPOOL 53ea2fee5191fbb63f976a20205bbe111f935ed397140fcb8be0069636b36434ac39580f62be910207d2f18d6f852c93991c8067f3a55c09aca89e95dc125932
+AUX sleuthkit-4.4.2-c89-fix.patch 912 SHA256 1f77e6dd1024acd5a3aa0b8166596a89d603681c2ff706d8a424fa0548373e09 SHA512 d2d80561b432a1b5a0e7f94322b03bf24cedb91bf6c6fb145470b3c4f2c6dd98c43935d3a56ae11d1f651589db1ce4fc0d7468e32d5661b2785cf5e13d82609b WHIRLPOOL 136251120d46e0d04fa4af554918433d152a80028340a645a86199b262452642dcb42d8bc2470386c6a296776202d58a42b922616f414c6a25fc5b6a524f0849
+DIST sleuthkit-4.0.2.tar.gz 7577570 SHA256 112f80fbc6a868c18c7a924f756b35c79eed9d0cc8923a4f973646f00e546e62 SHA512 acf1d6006db3e75675eb769034ea78fd78133ac0f83c9caa74ec720c0dd25f95fb1a5df2c652027eeeac53e1fca6a3096b5248db95e3a01ce95e72e779e44f37 WHIRLPOOL 72ba21e2b89c6b06974612041c9374e3f306237312328c375d012197409a02fcaa1abc120189d28a8261cabbbd1d6c37b3b14431c47b008f06d43a7c6d9ea612
+DIST sleuthkit-4.1.0.tar.gz 7974564 SHA256 b410428df2e1b253fa23ce6a299d059d8c2650bf9c602f7b80c0f4ce1368c36a SHA512 1cfa96bd3746c59c92c3e3f07f5f3f0f6896239bcaec012c43958654bb63794ecf9d7bd28bb9b4ab939558f4b27f03cd87f645ea91a8f9cfbb9037df93ef5223 WHIRLPOOL 20856982b77ecbdd1ed3b7c147e4340461830f0238ba7cdc17da3159f5a666df5b3d490760699d25d2896289c811f615ffb4160d163f9917f09e57a37ff26a21
+DIST sleuthkit-4.1.2.tar.gz 7990136 SHA256 58253b35c016083558fb581308f4a3baf884229de89eb84ddbfb977ed56600d3 SHA512 1f64acf42e86adf275bcd86c63c097210a498ac34ce69e64b3c120d86dffae65b5d57ed9618692dd510f637e940a48a60912dd57c8de840bf3a2b4428baabab8 WHIRLPOOL 1298a345416bec11564007c41474010cbddc26289aee025f31ecd2b7069f0d16ca81eeb07a292e38d91d6b34c3a891fad8a2f4b42bfd4df96053469d25dc8c65
+DIST sleuthkit-4.1.3.tar.gz 7952733 SHA256 67f9d2a31a8884d58698d6122fc1a1bfa9bf238582bde2b49228ec9b899f0327 SHA512 66f6ac32da5a21b3505390557ed6cf7bbcfcca69f231e20a7086fd48c5de45a3f064a716837d25eb582d0a89bae3b6ba7e89dcf3159e1cacdb4b5d452d0ce9a2 WHIRLPOOL 34d59163812d5e2b135d6d3a05bc9bed2f2739ab47bd77ed25ee3162eaf7389fec40a7b187745ef65b9596877399884d3081f2f4549fc0c4390382ec247174bc
+DIST sleuthkit-4.4.2.tar.gz 8572974 SHA256 135964463f4b0a58fcd95fdf731881fcd6f2f227eeb8ffac004880c8e4d8dd53 SHA512 970704c0e650b54df49d92f7a5c82d1c8cd37f589bf1a90ba5df6b3cd26a4e3676fbbbf58a176eeb002cdefbd33fb1fc057b11256b4a3cf1b8f782beb618a1de WHIRLPOOL 8f68e2360d8ad82912898f7e07c4620183f4e19a40b5193966815dca7efa139cf00802d54303164e9c2a5364e5af3bfe4da937869deb615760fb70fba4ddce87
+DIST sqlite-jdbc-3.8.11.jar 5131732 SHA256 0e36f2ec132dd67ecaeecc98bb17e5c215a077991e2a068a490d954b1bf2de8d SHA512 5f4705101992e8916e29742c560aef0d01eba9dc0d2d984b75a77e56be3c9fd20b284390fe8f9bb54bf9d1f8528c3413922684c446212ca8961ac731543fb179 WHIRLPOOL e8e34e10821e308dbd16cfecf1a332a60d8b34067f48fdc8adebc07fd1cb578a1f921fe57db4ac02d4fe11699a6a96a06543817027fe173852fda8ff3d625cce
+EBUILD sleuthkit-4.0.2.ebuild 894 SHA256 a5c12f58764e243ddb2072beca811f569a635bd0504edcaf95e2912f1493a13c SHA512 8c91db56a591f0570d9d2ed25857767bbfac0aebe028e13a121e842c2a93837495a6f182038bdf3ca630be779276dd698d6edee2ee971169042e584114ddb148 WHIRLPOOL 8aad35c4743cdf48e6c6cc1723652d8e9f8aa7b24c7d7bb2360774296b241e3af89e7103611426543ac3ea42adbba24f8acf9e4ac8550131707b141f09d897d7
+EBUILD sleuthkit-4.1.0.ebuild 884 SHA256 c5f8ab94f34c41db0651b10c9cc4d57fb078ef2047c1c63430eda177e83753b7 SHA512 2e246a8164b677b854a4f3ee6e60031520a1847804cef0652289235d40cba686183c0f14adff0a8b7a8291738f231b74aeed49a27f24715f3d7374654eda7bb5 WHIRLPOOL 1bf7cf4a27ca2b45093d86511a5af10303aa59d56c7b4ef7444c49b86f8d395c80b01898c1b6bf62a4f0e7f56e16abff9e3e86d6932b878e15124aa23aa1097a
+EBUILD sleuthkit-4.1.2.ebuild 898 SHA256 609665ab6c27ae81472ebac524779691d5f704a1f5332c5ad538b50139b0a51e SHA512 b1e69b3da2b19b389c4dd1017229b9d1ef5301ee0f17dcb40847eff3b480ae0355dfb5423a264ab022fa8c2619915259d992623e334fc0d10e672c5d1911cf41 WHIRLPOOL 68cc8767a458c250ad028107f9f6598c502c6b507fed326e7043b640051c24e338d5361487afd83ad887b58da852ab349be7f19fecd6b250e6a7bd0e760e81c4
+EBUILD sleuthkit-4.1.3.ebuild 898 SHA256 609665ab6c27ae81472ebac524779691d5f704a1f5332c5ad538b50139b0a51e SHA512 b1e69b3da2b19b389c4dd1017229b9d1ef5301ee0f17dcb40847eff3b480ae0355dfb5423a264ab022fa8c2619915259d992623e334fc0d10e672c5d1911cf41 WHIRLPOOL 68cc8767a458c250ad028107f9f6598c502c6b507fed326e7043b640051c24e338d5361487afd83ad887b58da852ab349be7f19fecd6b250e6a7bd0e760e81c4
+EBUILD sleuthkit-4.4.2.ebuild 4234 SHA256 b9bd0b314a07fa1fcc278129c3eb58b82f4a0df2cf22f5794e68c595cb244d8b SHA512 0a725403757e9ac4a25f7b5ca97af308e48cb109269bbdfaa7d8cc708fd9caa9c4f18044d5a39db48ea19eed8a47885f77b2c94801338dc4bdbd30e28f575787 WHIRLPOOL c0acace9269ec9a6ae79e6fa892359e811412ab7219c9ef902f8c8207df8f92c1c2f8f15ee309e4da36d0446b5c1b6f63f0a6b602324ec2b726c609792ccfc1b
+MISC ChangeLog 3220 SHA256 54fea49263491197dda469369b27e519e0f552582ffa54532db2b61f68aabed4 SHA512 90fae34b69900a2fad2297700946fb4eafac9be1d566bb8c89c73df46499103416952643f92e8c6e1ab18eadf370f0cb7296227930566fb3eb56ea44858cc49e WHIRLPOOL d86e6bee495ff046d906d49c2b0c8c503eddd3b50284670f0f2fb69fe0f9cc412ed7a02d63f4dfef7a47642b9558af639b6feb04a77200cba3fbed59945c96ab
+MISC ChangeLog-2015 13171 SHA256 89e82f116ae1a7de32c8210ae55a2e90ece3134546fc12c5fb54cd5fd8e225c3 SHA512 c256d2b2a004c11454b4c57a5363597c966ba980a5f23852372f13eeccc19f5136dd46ecee14488c67ad03fc3f25c8259613c0782c4a63316d3955a0906e853c WHIRLPOOL d6342eba29d00c6c5bfbbff1b1fb188054d26de122597d1d712715e82adbf5e1b3e005bb8a422279bdd2b9a755b95b00226b0bdb30682383698064bb06eeefd6
+MISC metadata.xml 521 SHA256 a5b383c588bf18c2a1cccf840e8a499b5685eb2595c30eb7ae0e15aaec3aa77e SHA512 9d3385a609d94d85d6e519a007d279c8202e795417c3c768ddf4a612e27320c6219e984f96c2e5bfccaa6de2cd616902b21f8e50ebdb26eec920ca1223c01786 WHIRLPOOL 55ccef6e0bcb1818a3dc490feca66996226c728c9e83eed2b20f942f50a8e07eab48378dd17579ce07f62772cbb1030726f9fef16df7746028103a1d9f402d8f
diff --git a/app-forensics/sleuthkit/files/sleuthkit-3.2.3-tools-shared-libs.patch b/app-forensics/sleuthkit/files/sleuthkit-3.2.3-tools-shared-libs.patch
new file mode 100644
index 000000000000..749c67030046
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-3.2.3-tools-shared-libs.patch
@@ -0,0 +1,55 @@
+--- sleuthkit-3.2.3/tools/autotools/Makefile.am
++++ sleuthkit-3.2.3/tools/autotools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk3/libtsk3.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = tsk_recover tsk_loaddb tsk_comparedir tsk_gettimes
+--- sleuthkit-3.2.3/tools/fstools/Makefile.am
++++ sleuthkit-3.2.3/tools/fstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk3/libtsk3.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro fscheck.cpp
+
+ bin_PROGRAMS = blkcalc blkcat blkls blkstat ffind fls fsstat icat ifind ils \
+--- sleuthkit-3.2.3/tools/hashtools/Makefile.am
++++ sleuthkit-3.2.3/tools/hashtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk3/libtsk3.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro md5.c sha1.c
+
+ bin_PROGRAMS = hfind
+--- sleuthkit-3.2.3/tools/imgtools/Makefile.am
++++ sleuthkit-3.2.3/tools/imgtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk3/libtsk3.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = img_cat img_stat
+--- sleuthkit-3.2.3/tools/srchtools/Makefile.am
++++ sleuthkit-3.2.3/tools/srchtools/Makefile.am
+@@ -6,7 +6,6 @@
+
+ sigfind_SOURCES = sigfind.cpp
+ sigfind_LDADD = ../../tsk3/libtsk3.la
+-sigfind_LDFLAGS = -static
+
+ indent:
+ indent *.c *.cpp
+--- sleuthkit-3.2.3/tools/vstools/Makefile.am
++++ sleuthkit-3.2.3/tools/vstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk3/libtsk3.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = mmls mmstat mmcat
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.0.0-system-sqlite.patch b/app-forensics/sleuthkit/files/sleuthkit-4.0.0-system-sqlite.patch
new file mode 100644
index 000000000000..7b98f4dafd2f
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.0.0-system-sqlite.patch
@@ -0,0 +1,34 @@
+--- sleuthkit-4.0.0/tsk3/auto/db_sqlite.cpp
++++ sleuthkit-4.0.0/tsk3/auto/db_sqlite.cpp
+@@ -14,7 +14,7 @@
+ */
+
+ #include "tsk_db_sqlite.h"
+-#include "sqlite3.h"
++#include <sqlite3.h>
+
+ #include <string.h>
+
+--- sleuthkit-4.0.0/tsk3/auto/Makefile.am
++++ sleuthkit-4.0.0/tsk3/auto/Makefile.am
+@@ -3,7 +3,8 @@
+
+ noinst_LTLIBRARIES = libtskauto.la
+ # Note that the .h files are in the top-level Makefile
+-libtskauto_la_SOURCES = auto.cpp tsk_auto_i.h auto_db.cpp sqlite3.c sqlite3.h db_sqlite.cpp tsk_db_sqlite.h case_db.cpp tsk_case_db.h
++libtskauto_la_SOURCES = auto.cpp tsk_auto_i.h auto_db.cpp db_sqlite.cpp tsk_db_sqlite.h case_db.cpp tsk_case_db.h
++libtskauto_la_LIBADD = -lsqlite3
+
+ indent:
+ indent *.cpp *.h
+--- sleuthkit-4.0.0/tsk3/auto/tsk_db_sqlite.h
++++ sleuthkit-4.0.0/tsk3/auto/tsk_db_sqlite.h
+@@ -25,7 +25,7 @@
+ #include <ostream>
+
+
+-#include "sqlite3.h"
++#include <sqlite3.h>
+ #include "tsk_auto_i.h"
+
+ using std::map;
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.1.0-system-sqlite.patch b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-system-sqlite.patch
new file mode 100644
index 000000000000..413357fb5045
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-system-sqlite.patch
@@ -0,0 +1,34 @@
+--- sleuthkit-4.1.0/tsk/auto/db_sqlite.cpp
++++ sleuthkit-4.1.0/tsk/auto/db_sqlite.cpp
+@@ -14,7 +14,7 @@
+ */
+
+ #include "tsk_db_sqlite.h"
+-#include "sqlite3.h"
++#include <sqlite3.h>
+
+ #include <string.h>
+
+--- sleuthkit-4.1.0/tsk/auto/Makefile.am
++++ sleuthkit-4.1.0/tsk/auto/Makefile.am
+@@ -3,7 +3,8 @@
+
+ noinst_LTLIBRARIES = libtskauto.la
+ # Note that the .h files are in the top-level Makefile
+-libtskauto_la_SOURCES = auto.cpp tsk_auto_i.h auto_db.cpp sqlite3.c sqlite3.h db_sqlite.cpp tsk_db_sqlite.h case_db.cpp tsk_case_db.h
++libtskauto_la_SOURCES = auto.cpp tsk_auto_i.h auto_db.cpp db_sqlite.cpp tsk_db_sqlite.h case_db.cpp tsk_case_db.h
++libtskauto_la_LIBADD = -lsqlite3
+
+ indent:
+ indent *.cpp *.h
+--- sleuthkit-4.1.0/tsk/auto/tsk_db_sqlite.h
++++ sleuthkit-4.1.0/tsk/auto/tsk_db_sqlite.h
+@@ -25,7 +25,7 @@
+ #include <ostream>
+
+
+-#include "sqlite3.h"
++#include <sqlite3.h>
+ #include "tsk_auto_i.h"
+
+ using std::map;
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch
new file mode 100644
index 000000000000..efa335068333
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.1.0-tools-shared-libs.patch
@@ -0,0 +1,55 @@
+--- sleuthkit-4.1.0/tools/autotools/Makefile.am
++++ sleuthkit-4.1.0/tools/autotools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = tsk_recover tsk_loaddb tsk_comparedir tsk_gettimes
+--- sleuthkit-4.1.0/tools/fstools/Makefile.am
++++ sleuthkit-4.1.0/tools/fstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro fscheck.cpp
+
+ bin_PROGRAMS = blkcalc blkcat blkls blkstat ffind fls fcat fsstat icat ifind ils \
+--- sleuthkit-4.1.0/tools/hashtools/Makefile.am
++++ sleuthkit-4.1.0/tools/hashtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro md5.c sha1.c
+
+ bin_PROGRAMS = hfind
+--- sleuthkit-4.1.0/tools/imgtools/Makefile.am
++++ sleuthkit-4.1.0/tools/imgtools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = img_cat img_stat
+--- sleuthkit-4.1.0/tools/srchtools/Makefile.am
++++ sleuthkit-4.1.0/tools/srchtools/Makefile.am
+@@ -6,7 +6,6 @@
+
+ sigfind_SOURCES = sigfind.cpp
+ sigfind_LDADD = ../../tsk/libtsk.la
+-sigfind_LDFLAGS = -static
+
+ indent:
+ indent *.c *.cpp
+--- sleuthkit-4.1.0/tools/vstools/Makefile.am
++++ sleuthkit-4.1.0/tools/vstools/Makefile.am
+@@ -1,6 +1,5 @@
+ AM_CPPFLAGS = -I../.. -I$(srcdir)/../.. -Wall
+ LDADD = ../../tsk/libtsk.la
+-LDFLAGS += -static
+ EXTRA_DIST = .indent.pro
+
+ bin_PROGRAMS = mmls mmstat mmcat
diff --git a/app-forensics/sleuthkit/files/sleuthkit-4.4.2-c89-fix.patch b/app-forensics/sleuthkit/files/sleuthkit-4.4.2-c89-fix.patch
new file mode 100644
index 000000000000..5d4f91e98b9d
--- /dev/null
+++ b/app-forensics/sleuthkit/files/sleuthkit-4.4.2-c89-fix.patch
@@ -0,0 +1,29 @@
+From 7caca2f8be471be337f7aea70cd900164bf070eb Mon Sep 17 00:00:00 2001
+From: Gokturk Yuksek <gokturk@gentoo.org>
+Date: Tue, 15 Aug 2017 21:04:24 -0400
+Subject: [PATCH] tsk/img/aff: loop initial declarations are not allowed in C89
+
+Declaring an integer inside a for loop as in for(int i;;) is not
+allowed in C89 and causes a build failure. Fix it by declaring the
+variable just before the for loop.
+---
+ tsk/img/aff.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tsk/img/aff.c b/tsk/img/aff.c
+index fd9c4ff..a832bfb 100644
+--- a/tsk/img/aff.c
++++ b/tsk/img/aff.c
+@@ -216,7 +216,8 @@ aff_close(TSK_IMG_INFO * img_info)
+ {
+ IMG_AFF_INFO *aff_info = (IMG_AFF_INFO *) img_info;
+ af_close(aff_info->af_file);
+- for (int i = 0; i < img_info->num_img; i++) {
++ int i;
++ for (i = 0; i < img_info->num_img; i++) {
+ if (img_info->images[i])
+ free(img_info->images[i]);
+ }
+--
+2.10.2
+
diff --git a/app-forensics/sleuthkit/metadata.xml b/app-forensics/sleuthkit/metadata.xml
new file mode 100644
index 000000000000..827d72c67584
--- /dev/null
+++ b/app-forensics/sleuthkit/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>gokturk@gentoo.org</email>
+ <name>Göktürk Yüksek</name>
+ </maintainer>
+ <use>
+ <flag name="aff">Enable extra aff formats</flag>
+ <flag name="ewf">Enable libewf support</flag>
+ </use>
+ <upstream>
+ <remote-id type="sourceforge">sleuthkit</remote-id>
+ <remote-id type="github">sleuthkit/sleuthkit</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/sleuthkit/sleuthkit-4.0.2.ebuild b/app-forensics/sleuthkit/sleuthkit-4.0.2.ebuild
new file mode 100644
index 000000000000..8101b681c641
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.0.2.ebuild
@@ -0,0 +1,39 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit autotools-utils
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="http://www.sleuthkit.org/sleuthkit/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2 IBM"
+SLOT="0/9" # subslot = major soname version
+KEYWORDS="amd64 hppa ppc x86"
+IUSE="aff ewf static-libs"
+
+DEPEND="dev-db/sqlite:3
+ ewf? ( app-forensics/libewf )
+ aff? ( app-forensics/afflib )"
+RDEPEND="${DEPEND}
+ dev-perl/Date-Manip"
+
+DOCS=( NEWS.txt README.txt )
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.0.0-system-sqlite.patch
+ "${FILESDIR}"/${PN}-3.2.3-tools-shared-libs.patch
+)
+
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+src_configure() {
+ local myeconfargs=(
+ $(use_with aff afflib)
+ $(use_with ewf libewf)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/sleuthkit/sleuthkit-4.1.0.ebuild b/app-forensics/sleuthkit/sleuthkit-4.1.0.ebuild
new file mode 100644
index 000000000000..eff539597ac7
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.1.0.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+inherit autotools-utils
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="http://www.sleuthkit.org/sleuthkit/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2 IBM"
+SLOT="0/10" # subslot = major soname version
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="aff ewf static-libs"
+
+DEPEND="dev-db/sqlite:3
+ ewf? ( app-forensics/libewf )
+ aff? ( app-forensics/afflib )"
+RDEPEND="${DEPEND}
+ dev-perl/Date-Manip"
+
+DOCS=( NEWS.txt README.txt )
+
+PATCHES=(
+ "${FILESDIR}"/${P}-system-sqlite.patch
+ "${FILESDIR}"/${P}-tools-shared-libs.patch
+)
+
+src_configure() {
+ local myeconfargs=(
+ $(use_with aff afflib)
+ $(use_with ewf libewf)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/sleuthkit/sleuthkit-4.1.2.ebuild b/app-forensics/sleuthkit/sleuthkit-4.1.2.ebuild
new file mode 100644
index 000000000000..0f0908413b13
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.1.2.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+inherit autotools-utils
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="http://www.sleuthkit.org/sleuthkit/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2 IBM"
+SLOT="0/10" # subslot = major soname version
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="aff ewf static-libs"
+
+DEPEND="dev-db/sqlite:3
+ ewf? ( app-forensics/libewf )
+ aff? ( app-forensics/afflib )"
+RDEPEND="${DEPEND}
+ dev-perl/Date-Manip"
+
+DOCS=( NEWS.txt README.txt )
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.1.0-system-sqlite.patch
+ "${FILESDIR}"/${PN}-4.1.0-tools-shared-libs.patch
+)
+
+src_configure() {
+ local myeconfargs=(
+ $(use_with aff afflib)
+ $(use_with ewf libewf)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/sleuthkit/sleuthkit-4.1.3.ebuild b/app-forensics/sleuthkit/sleuthkit-4.1.3.ebuild
new file mode 100644
index 000000000000..0f0908413b13
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.1.3.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+AUTOTOOLS_AUTORECONF=1
+AUTOTOOLS_IN_SOURCE_BUILD=1
+
+inherit autotools-utils
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="http://www.sleuthkit.org/sleuthkit/"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-2 IBM"
+SLOT="0/10" # subslot = major soname version
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="aff ewf static-libs"
+
+DEPEND="dev-db/sqlite:3
+ ewf? ( app-forensics/libewf )
+ aff? ( app-forensics/afflib )"
+RDEPEND="${DEPEND}
+ dev-perl/Date-Manip"
+
+DOCS=( NEWS.txt README.txt )
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.1.0-system-sqlite.patch
+ "${FILESDIR}"/${PN}-4.1.0-tools-shared-libs.patch
+)
+
+src_configure() {
+ local myeconfargs=(
+ $(use_with aff afflib)
+ $(use_with ewf libewf)
+ )
+ autotools-utils_src_configure
+}
diff --git a/app-forensics/sleuthkit/sleuthkit-4.4.2.ebuild b/app-forensics/sleuthkit/sleuthkit-4.4.2.ebuild
new file mode 100644
index 000000000000..adf6fcbf46e3
--- /dev/null
+++ b/app-forensics/sleuthkit/sleuthkit-4.4.2.ebuild
@@ -0,0 +1,175 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+JAVA_PKG_BSFIX_NAME="build.xml build-unix.xml"
+inherit autotools java-pkg-opt-2 java-ant-2
+
+DESCRIPTION="A collection of file system and media management forensic analysis tools"
+HOMEPAGE="https://www.sleuthkit.org/sleuthkit/"
+# TODO: sqlite-jdbc does not exist in the tree, we bundle it for now
+SRC_URI="https://github.com/${PN}/${PN}/releases/download/${P}/${P}.tar.gz
+ java? ( http://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.8.11/sqlite-jdbc-3.8.11.jar )"
+
+LICENSE="CPL-1.0 GPL-2+ IBM java? ( Apache-2.0 )"
+SLOT="0/13" # subslot = major soname version
+KEYWORDS="~amd64 ~hppa ~ppc ~x86"
+IUSE="aff doc ewf java static-libs test +threads zlib"
+
+DEPEND="
+ dev-db/sqlite:3
+ dev-lang/perl:*
+ aff? ( app-forensics/afflib )
+ ewf? ( app-forensics/libewf:= )
+ java? (
+ >=virtual/jdk-1.8:*
+ >=dev-java/c3p0-0.9.5:0
+ >=dev-java/jdbc-postgresql-9.4:0
+ )
+ zlib? ( sys-libs/zlib )
+"
+RDEPEND="${DEPEND}
+ java? ( >=virtual/jre-1.8:= )
+"
+DEPEND="${DEPEND}
+ doc? ( app-doc/doxygen )
+ test? ( >=dev-util/cppunit-1.2.1 )
+"
+
+PATCHES=(
+ "${FILESDIR}"/${PN}-4.1.0-tools-shared-libs.patch
+ "${FILESDIR}"/${PN}-4.4.2-c89-fix.patch
+)
+
+TSK_JAR_DIR="${S}/bindings/java/lib"
+
+src_unpack() {
+ local f
+
+ unpack ${P}.tar.gz
+
+ # Copy the jar files that don't exist in the tree yet
+ if use java; then
+ mkdir "${TSK_JAR_DIR}" || die
+ for f in ${A}; do
+ if [[ ${f} =~ .jar$ ]]; then
+ cp "${DISTDIR}"/"${f}" "${TSK_JAR_DIR}" || die
+ fi
+ done
+ fi
+}
+
+src_prepare() {
+ if use java; then
+ pushd "${S}"/bindings/java &>/dev/null || die
+
+ # Prevent "make install" from installing
+ # jar files under /usr/share/java
+ # We'll use the java eclasses for this
+ sed -e '/^jar_DATA/ d;' -i Makefile.am || die
+
+ # Disable dependency retrieval using ivy
+ # We will handle it ourselves
+ sed -e '/name="compile"/ s/, retrieve-deps//' \
+ -e '/name="dist-/ s/, init-ivy//g' \
+ -i build.xml || die
+
+ # Even if static libs are disabled, the build system looks for
+ # the static library and fails if not present
+ # Disable that check
+ use static-libs || sed -e '/<fail unless="present" message="JNI/ d;' \
+ -i build-unix.xml || die
+
+ java-pkg-opt-2_src_prepare
+
+ popd &>/dev/null || die
+ fi
+
+ # Override the doxygen output directories
+ if use doc; then
+ sed -e "/^OUTPUT_DIRECTORY/ s|=.*$|= ${T}/doc|" \
+ -i tsk/docs/Doxyfile \
+ -i bindings/java/doxygen/Doxyfile || die
+ fi
+
+ # It's safe to call this even after java-pkg-opt-2_src_prepare
+ # because future calls to eapply_user do nothing and return 0
+ default
+
+ eautoreconf
+}
+
+src_configure() {
+ local myeconfargs=(
+ $(use_enable java)
+ $(use_enable static-libs static)
+ $(use_enable threads multithreading)
+ $(use_with aff afflib)
+ $(use_with ewf libewf)
+ $(use_with zlib)
+ )
+
+ if use java; then
+ pushd "${S}"/bindings/java &>/dev/null || die
+ java-ant-2_src_configure
+ popd &>/dev/null || die
+ fi
+
+ econf "${myeconfargs[@]}"
+}
+
+src_compile() {
+ # Create symlinks of jars for the required dependencies
+ if use java; then
+ pushd "${S}"/bindings/java &>/dev/null || die
+
+ java-pkg_jar-from --into "${TSK_JAR_DIR}" c3p0
+ java-pkg_jar-from --into "${TSK_JAR_DIR}" jdbc-postgresql
+
+ popd &>/dev/null || die
+ fi
+
+ # Create the doc output dirs if requested
+ if use doc; then
+ mkdir -p "${T}"/doc/{api-docs,jni-docs} || die
+ fi
+
+ emake all $(usex doc api-docs "")
+}
+
+src_install() {
+ local f
+
+ if use java; then
+ pushd "${S}"/bindings/java &>/dev/null || die
+
+ java-pkg_dojar dist/Tsk_DataModel.jar
+
+ # Install the bundled jar files
+ pushd "${TSK_JAR_DIR}" &>/dev/null || die
+ for f in *; do
+ # Skip the symlinks java-pkg_jar-from created
+ [[ -f ${f} ]] || continue
+
+ # Strip the version numbers as per eclass recommendation
+ [[ ${f} =~ -([0-9].)+.jar$ ]] || continue
+
+ java-pkg_newjar "${f}" "${f/${BASH_REMATCH[0]}/.jar}"
+ done
+ popd &>/dev/null || die
+
+ popd &>/dev/null || die
+ fi
+
+ default
+
+ # It unconditionally builds both api and jni docs
+ # We install conditionally based on the provided use flags
+ if use doc; then
+ dodoc -r "${T}"/doc/api-docs
+ use java && dodoc -r "${T}"/doc/jni-docs
+ fi
+
+ find "${D}" -name '*.la' -delete || die
+}
diff --git a/app-forensics/unhide/Manifest b/app-forensics/unhide/Manifest
new file mode 100644
index 000000000000..6ee6a0ce4299
--- /dev/null
+++ b/app-forensics/unhide/Manifest
@@ -0,0 +1,7 @@
+DIST unhide-20130526.tgz 59625 SHA256 4ef970e0cc1366c19601fd5c98d90c7e7fb868f047115367b819ecfed7740b31 SHA512 0fbe4d8b36171906f81fa35b1bbf91c079920a31244e89a9dad3570d8e2832d2db2f7bd8f7f33aaa66d08e6be0a19c5fb0b8aa418f09154b97279c9279af1223 WHIRLPOOL 1545f1274d885c025bf5d94953c470494fd4b894d9eb93544460a6728ffb000cc072e9ccc7ac39d6f4da96c407e3dacfd93e5c2918812be7484ca9f9ab1b02a3
+DIST unhide_20121229.tgz 54700 SHA256 fa2d1b4a7e9eb8dc987317566fac2c62a6b42e7bbd91f14a69efb26e3dde6b76 SHA512 a0269b0524e5a8c64e34155e4843bc23fa74c0bee1cc684930966fd037b1d897404cfcb9ff062eebde38e3d6e3660bd445609c9cffa5da7600cca92a2f7b83c9 WHIRLPOOL 92fbcc277279bb7ac3290154fd846ad04fcd940ecda5a922660f57a4d80841e282c15537d5ebeb1374c30c2e30274c01de09e46c9936ca2839f7a86fde68af85
+EBUILD unhide-20121229.ebuild 979 SHA256 0891a5a48230e86010f4cb7f01ad2d66c66731b0235ccc2724599b348f372185 SHA512 013a875b7a68b888fd9eea9feafee148f91959dc5c48b53c1b4cbb3e9ab9aa71b99fc662dd037208ebe8f0c612471c942071c6f157f24060662d0e4f0c0c4c24 WHIRLPOOL 1abe189328d6e6cfd78ba5749664196d4cd78bbf4675d500b9fc651ee798c4a7b76ab3787d6f08f93a06d73126ac38861b16a4e9447b230ebe57c940837ed4d7
+EBUILD unhide-20130526.ebuild 941 SHA256 8b4f6272575e296845ae531156d81caa0bd45f06c1e51fccc31ac436052c8e01 SHA512 b3ef9f73ae13e8c45d40b859eedb903411186c06df9f0d7855294b43810f4aed72090bb804e749cf69a0d2e4d0b54024c8882434e4d633ae0a2693206ce77390 WHIRLPOOL ba0d4424e6664c52abcc7ac84a7749ecbe33c0ec6ee6dc20e9e74589c54d314c9c4b03eb40fefb53f1909d429c800189a2078912378460a0f6d58381a8525521
+MISC ChangeLog 2240 SHA256 be0035dcde28f7b63a72a3e3fbc22643f9f4db5525272c297c100961c4add75c SHA512 1f21b932b5c8ad3b6d3dc139a2e59a2170c40f215632744ec20a60735ffcf7860eebb85191e72939a63c5d98c8d66b365eb33a458df730eabc75b39678c21f7a WHIRLPOOL adce06f6396e2c7dd2ea00902c676a898fb09154f0c78a38d1f09654d16fe2443b26b3575aee9bff6bcdaadad1a7dbbe80ccbebf29f21f82a7f4175fc04b3e10
+MISC ChangeLog-2015 851 SHA256 59eb4feb74aab8a607a586c0ea9bc6d6a904715d85c9ee1c77d16d33ef8bd6a2 SHA512 732bf3682925032973b4d0ad82543263ab20223c3b39362f56a621a6f3ad3b5cca974242be3ae1136d643dfca18163c65222f7bda388ed70a651f32ac082bcac WHIRLPOOL 7093adc148a0d8c4ba2236d9193060ae10f76c66b9c4937084dcdecadda670e4d6bca4e1b2010091276ab7dbfbb06ef03894970f006280f84a8c8a3652e3b85e
+MISC metadata.xml 328 SHA256 87808a84d9f43aafc1e7a9f3885d1401564cbe84543fe69472e38b4adf4c0220 SHA512 2b4881641d653d85884bb6c5435f003ebded6ffce04749477f9d0ed6278f7dcaa1756728a9a7057b5463e28887fb7113f1115b5d6c43c6778df1354993020a02 WHIRLPOOL 4e604360b4fada76e6e48c7ea5bf8a7bb0962aa9cf464bd2ec9385b1baf2af10ad1ca48bd671e435690f9960525cd1b2fc8d2159095f623f5f58c322185c2a7f
diff --git a/app-forensics/unhide/metadata.xml b/app-forensics/unhide/metadata.xml
new file mode 100644
index 000000000000..6e481fc28055
--- /dev/null
+++ b/app-forensics/unhide/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>blueness@gentoo.org</email>
+ <name>Anthony G. Basile</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="sourceforge">unhide</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/unhide/unhide-20121229.ebuild b/app-forensics/unhide/unhide-20121229.ebuild
new file mode 100644
index 000000000000..2a55d29a6833
--- /dev/null
+++ b/app-forensics/unhide/unhide-20121229.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="4"
+
+inherit toolchain-funcs
+
+MY_P="${PN}_${PV}"
+S="${WORKDIR}"
+
+DESCRIPTION="A forensic tool to find hidden processes and TCP/UDP ports by rootkits/LKMs"
+HOMEPAGE="http://www.unhide-forensics.info"
+SRC_URI="mirror://sourceforge/${PN}/files/${MY_P}.tgz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="${DEPEND}"
+
+src_compile() {
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static -pthread \
+ unhide-linux*.c unhide-output.c -o unhide
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static \
+ unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp
+}
+
+src_install() {
+ dobin ${PN}
+ dobin ${PN}-tcp
+ dodoc changelog README.txt TODO
+ dodoc changelog README.txt LEEME.txt LISEZ-MOI.TXT NEWS TODO
+ doman man/unhide.8 man/unhide-tcp.8
+ has "fr" ${LINGUAS} && newman man/fr/unhide.8 unhide.fr.8
+ has "es" ${LINGUAS} && newman man/es/unhide.8 unhide.es.8
+}
diff --git a/app-forensics/unhide/unhide-20130526.ebuild b/app-forensics/unhide/unhide-20130526.ebuild
new file mode 100644
index 000000000000..dc6d9605f83e
--- /dev/null
+++ b/app-forensics/unhide/unhide-20130526.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="5"
+
+inherit toolchain-funcs
+
+DESCRIPTION="A forensic tool to find hidden processes and TCP/UDP ports by rootkits/LKMs"
+HOMEPAGE="http://www.unhide-forensics.info"
+SRC_URI="mirror://sourceforge/${PN}/files/${P}.tgz"
+
+LICENSE="GPL-3"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="${DEPEND}"
+
+src_compile() {
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static -pthread \
+ unhide-linux*.c unhide-output.c -o unhide
+ $(tc-getCC) ${CFLAGS} ${LDFLAGS} --static \
+ unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp
+}
+
+src_install() {
+ dobin ${PN}
+ dobin ${PN}-tcp
+ dodoc changelog README.txt TODO
+ dodoc changelog README.txt LEEME.txt LISEZ-MOI.TXT NEWS TODO
+ doman man/unhide.8 man/unhide-tcp.8
+ has "fr" ${LINGUAS} && newman man/fr/unhide.8 unhide.fr.8
+ has "es" ${LINGUAS} && newman man/es/unhide.8 unhide.es.8
+}
diff --git a/app-forensics/volatility/Manifest b/app-forensics/volatility/Manifest
new file mode 100644
index 000000000000..f4a62b1771c3
--- /dev/null
+++ b/app-forensics/volatility/Manifest
@@ -0,0 +1,7 @@
+DIST volatility-2.4.1.tar.gz 2407119 SHA256 43d2946ec9c198a028fc068e8b4add7836ca03482665bacdd31998bc540e5c9c SHA512 cc2db2a17b071a21852bab967c9615df0fce369dac35ffbca8754bc789e218a86fc88bd2042203174308e620e281a24debc7b0a8bacd516a404a9170ea522596 WHIRLPOOL 386adfe0750a8b21656d95fb5a8fb9276b1199e94099e74f66d76cbdc0191de92449b93e708140e94072a136488235fd9f0515b14752bc7c2c97fdf81ec02220
+DIST volatility-2.6.zip 4179806 SHA256 5b73050d72bf94870ffce22843f03d4b0b7764011dec29ef1a0a5b1b46cf9295 SHA512 1c0b86f270188ba48a6a0ff1d7ad70bde500d0f720d7e1b9d76b6b9498368ae3eb29c5b1c7e7dd76ec9480b83b1e484b4130b4ced7458e4e03ca61fe7d13220f WHIRLPOOL b3432b0725f49c132029102d1f7ba099dffc6c4339ccb5bfaf108d3cf67e3ceb7b221b8e00cc641941af189b74991a51c3fb109819ff8abeb9e8414a49cac6f8
+EBUILD volatility-2.4.1.ebuild 824 SHA256 a0af1456e9708c0c3d96af48af441753153339422131c59eb303e6b510e5f760 SHA512 1f07c5c05f43e996bcdda35149cd3459946fca3d3bf30d6c4cd16a40044122b2504d52567000e7a3ba5f024a3b872133b1a1e7f0a0130942693077d937eab35f WHIRLPOOL dacded09d252fdefc938fb7109bebdaa905c0055b6baabd1051bc28e15ccca1b5dc8e4b46bd17c18ae9534ef6efa0c1b919c8760a3c1f84d7d17d7c9b609da32
+EBUILD volatility-2.6.ebuild 851 SHA256 72400be63078bce73c49ada824894926722e71c1d205bc6466e98adbaf2b0f3f SHA512 6029f7da48b31b80d6b7667b28fdd5f0a5fe4c2f490f52edcc66ff297931439fe2287c5819c904c88a0a27f1e0c99e6c7b619cd6164a1d0ff54b7ee2dcebb0da WHIRLPOOL 5c9be11b30268f0e5035f72fc272623ee94d304c1da700eecb0a6a7c6a750d6a738dcd9341bf92acfa393cb88ecd41db90cc77249067409c6d790d8f436f02c6
+MISC ChangeLog 2834 SHA256 d26990ae3eef8557646048462f11fa81c1795617679aab57c2b2e2e53d50dd00 SHA512 8b20e436ef2e73042e90e220f60cd092b950e9ce0110697587e263fa3138a9a9f419476f1da44f024d8cd69e0c8320844f717beda52bc851d93550894beeee09 WHIRLPOOL fa899a14cfa5beb347fa4ddaabf19730994a85b220dc239aafd33cebd121e5ec96c8fa6574f7c76433bdb4c426e90a8b187dfc96c3567849bd054a0604fd665f
+MISC ChangeLog-2015 527 SHA256 05d141e25f6e4cf0852faffd25406da755391445e7403733e54109bce037c70d SHA512 d1da4b0daa1d989357824a3569804cf0ed43ffa131aeaadf91f8d5fc650841d4183636085314b1985165e78581f8d9e4e04cabb1a5ae7ab8aa2ec6617d2daaa7 WHIRLPOOL 21ce66586196fd883cfcb6eb543d2dd33497c3e111fc857d0c04e3e8ff3eb5ed03e76e603687e3f7871d9662570969abbac5cc1e7e5f3843bfd46b1e9331274d
+MISC metadata.xml 266 SHA256 76cc9d0b53488ed4cb6c14c37b32f0d5ee6a337e209f13dcdacdfbc0c8750bba SHA512 4da13e3e2134d06372d9bdc1de80cef972ac5db82e7ee8b3cfe620712610fd863c9037a6b8c84ee7a6c8eb8f0cb52568f040474eddb73a7afa07b5a53f512ac5 WHIRLPOOL 8361293f9fb11196804aafba7dff1ac177d9a5fe90d232ec69186838edd7796fd30f7ed56091753e04a68ac71b32be6c700b402fc1c7cb0774a71ffb90f349a7
diff --git a/app-forensics/volatility/metadata.xml b/app-forensics/volatility/metadata.xml
new file mode 100644
index 000000000000..6dde16e5c4b6
--- /dev/null
+++ b/app-forensics/volatility/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>chithanh@gentoo.org</email>
+ <name>Chí-Thanh Christopher Nguyễn</name>
+ </maintainer>
+</pkgmetadata>
diff --git a/app-forensics/volatility/volatility-2.4.1.ebuild b/app-forensics/volatility/volatility-2.4.1.ebuild
new file mode 100644
index 000000000000..c8a3f592e56d
--- /dev/null
+++ b/app-forensics/volatility/volatility-2.4.1.ebuild
@@ -0,0 +1,32 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+inherit distutils-r1
+
+DESCRIPTION="Framework for analyzing volatile memory"
+HOMEPAGE="http://www.volatilityfoundation.org/"
+#2.4.1 not on mirrors yet
+#SRC_URI="http://downloads.volatilityfoundation.org/releases/${PV}/${P}.tar.gz"
+SRC_URI="mirror://gentoo/${P}.tar.gz"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND=">=dev-libs/distorm64-3[${PYTHON_USEDEP}]
+ dev-libs/libpcre
+ dev-python/pycrypto[${PYTHON_USEDEP}]"
+
+src_install() {
+ distutils-r1_src_install
+ mkdir "${D}/usr/share/${PN}"
+ mv "${D}/usr/contrib/plugins" "${D}/usr/share/${PN}/"
+ rmdir "${D}/usr/contrib"
+ mv "${D}/usr/tools" "${D}/usr/share/${PN}/"
+ dosym vol.py /usr/bin/volatility
+}
diff --git a/app-forensics/volatility/volatility-2.6.ebuild b/app-forensics/volatility/volatility-2.6.ebuild
new file mode 100644
index 000000000000..74668be64645
--- /dev/null
+++ b/app-forensics/volatility/volatility-2.6.ebuild
@@ -0,0 +1,35 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+PYTHON_COMPAT=( python2_7 )
+inherit distutils-r1
+
+DESCRIPTION="Framework for analyzing volatile memory"
+HOMEPAGE="http://www.volatilityfoundation.org/"
+SRC_URI="http://downloads.volatilityfoundation.org/releases/${PV}/${P}.zip"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+S=${WORKDIR}/${PN}-master
+
+DEPEND="app-arch/unzip"
+RDEPEND=">=dev-libs/distorm64-3[${PYTHON_USEDEP}]
+ dev-libs/libpcre
+ || (
+ dev-python/pycryptodome[${PYTHON_USEDEP}]
+ dev-python/pycrypto[${PYTHON_USEDEP}]
+ )"
+
+src_install() {
+ distutils-r1_src_install
+ mkdir "${D}/usr/share/${PN}"
+ mv "${D}/usr/contrib/plugins" "${D}/usr/share/${PN}/"
+ rmdir "${D}/usr/contrib"
+ mv "${D}/usr/tools" "${D}/usr/share/${PN}/"
+ dosym vol.py /usr/bin/volatility
+}
diff --git a/app-forensics/yasat/Manifest b/app-forensics/yasat/Manifest
new file mode 100644
index 000000000000..02923e84a98c
--- /dev/null
+++ b/app-forensics/yasat/Manifest
@@ -0,0 +1,14 @@
+AUX yasat-700-remove-absent-tests.patch 506 SHA256 86812b266279931c4addf4eb3022cafa52d979a62e1b6c523c96f3f38f623d31 SHA512 766b85891a5a866af5a2fd518e13a65dc56184235ac17526b5f32fd9175569d20cc3a6dcea27ad400a65cf99f23346fafa0ed2e368f3f9a2077c23d3d21fae95 WHIRLPOOL 29ce7e6bc67212a63a6884686ddec4c8bd5cea6de93f6da95f3579d996b0143d527b1f59ab2ba531a68d85197c81831e8bcd776eb08043ebf695fa1b2a1bbc4d
+DIST yasat-526.tar.gz 123976 SHA256 a4ff957d59923c7c87fbcde27c894d731a3685b8534be17867d9cdc41974e600 SHA512 8abcc43f49791e7fd4c7755a2d2b20b6b89d5437bf9dfd392867374ecaaddba96d311636b38d4a6ba60f52c342334675bb1f3894b7aeae446ab479b9a319f898 WHIRLPOOL fc84bf86ed5a655129e917be30e24928c7a6afdc53b6bc7481e22e2050bf9612459ffaf681bc19a39bb623c8a7907378fcc358a91b86bbbcf1c269e8a2745796
+DIST yasat-700.tar.gz 137379 SHA256 323c54cadc637fb90b9bcb3869bad5996615dc67a4b3bbf9617569c94fe07ef5 SHA512 5022667810bf70f07181b7177ddf542690d22be3a82e7b0476d8d0d9c01844413ca6c848587dc29ec4c5c4e40c6a5a51781a2e564b19e9674d0ca916807378a5 WHIRLPOOL 5c7ebaf8eeb19d3490fcb5eba00a48029f1f92928b90de738e3b20e5f80999def0b64d53b3d945eabcb8b7af9baf78a9b3773d66e1bcc08e7a4dc8942f3a9b06
+DIST yasat-755.tar.gz 141633 SHA256 14bd57abe26f9cef64897c75ee9d3a4b5df9d3c794ce9fd7f5670bf2f7524590 SHA512 5a2a86c1f828f3fee5b84447ce6607b0dbdd8a16d8425dac910ef1c6f0d606105e851af35eedada46bf6438fb7cdde3f178803d8adf91e86f3bae4ce06151f44 WHIRLPOOL 031178629c574b5886e41c66c79caad74f8548c23180529bd06f8a2f8764ff929aa6eef30e9ab57ed826a75bbe372ad11627e37aaad6cd219621ac157470a2e4
+DIST yasat-839.tar.gz 148015 SHA256 ca14fe274ad53911d4c3d7c38bc0821ea7edaab9d2874522f7fb36c2bcaca3f1 SHA512 daf500a6f71a41d5f29501b0e449b711aea151d39b553c0ec356a8986b58a60ab96553cb9a752b495a455e1072e945c8b70aaf9eea53abac0ada8f26aa0b9181 WHIRLPOOL dc98fd6103aed808a174be5279328767dd22565310e714ea4bac972dafe944d7f884c8b17a7306bffa92a0e85f565603575b34a1b558b62258dd67c11a550ea9
+DIST yasat-848.tar.gz 148261 SHA256 93378a764b142eff67cbfe6516b1743b2d0e8dcbd56b1eb0408a1cb84960f583 SHA512 0bc0e8e1068bee05242b5c7a7cdc8ca976503f696aef2889870ef872546021d0956489cf8d5b304a36be412cf8e5c8cbf4be5aa1cce5df008c5185188e5a99dc WHIRLPOOL e62d7831755fb843fd2d9245ee5daa0ab801752e9d4c9dc7a242c1a169a51cc237164ea810d3e40a3452ffa7739a80133c413947666bc013ce4d5fd2003d5f5e
+EBUILD yasat-526.ebuild 484 SHA256 e462dbe04d2481a4075524916be03065b6bba3f7dbfee7548863df4186d7efe2 SHA512 3fdf812007806e441171d31700626f44bce122b88afc7c36d8c9397116db7ecf87d130d8e5f4c195312e6540620e30da71028c5c5c30f6540e4ef6f3e8135233 WHIRLPOOL f81703bcd7991d5c65772d1700ce8e486c3355fb95a956efcfed3fe6b6e8cac292d19ebe761704fe3378a0cd219cae5fb2badab020a0dd5bc483df5ce3556782
+EBUILD yasat-700.ebuild 565 SHA256 73e8c680d46c226a1fe3eaa8bda69f1036c818ea09d0b66b4cd679ae6bd059fe SHA512 b71485b1cddc66186612ded7c50111d39c88a7d44c1ade3f4677255b1b5cbf1ec0b84cb5c6c1e58cd9ba3b985c620ac0c7ab9bffde1530d7d50b2ad005accb46 WHIRLPOOL ba032998a4f42483ed2b57add5b024fc30c895fb885081f36b6ca3371546abd22d54642d890934771571aa003506be93bd21c138fdd5a7ce205da1f71fb3e712
+EBUILD yasat-755.ebuild 493 SHA256 e64c012545b356de0c505ebe02b08bda969b2c1c207a7d31b8562b9119b83980 SHA512 8bab1fb28f7186345da24999449fe2c2d45208c515c9b76f5bff2e1cfde145b87da895b49b802d28ac9c07926d6db444833b1acb85d60705e20950f7e5f54326 WHIRLPOOL a523e21ab828956148a95307ee16dc8072fd2423291ebd3c09d5a1623005c5a2f87a96f790a2870b9298a96b8942d3e2f9bcd31b6b7d6acc3cfb5b3d7edb1b27
+EBUILD yasat-839.ebuild 493 SHA256 e64c012545b356de0c505ebe02b08bda969b2c1c207a7d31b8562b9119b83980 SHA512 8bab1fb28f7186345da24999449fe2c2d45208c515c9b76f5bff2e1cfde145b87da895b49b802d28ac9c07926d6db444833b1acb85d60705e20950f7e5f54326 WHIRLPOOL a523e21ab828956148a95307ee16dc8072fd2423291ebd3c09d5a1623005c5a2f87a96f790a2870b9298a96b8942d3e2f9bcd31b6b7d6acc3cfb5b3d7edb1b27
+EBUILD yasat-848.ebuild 493 SHA256 e64c012545b356de0c505ebe02b08bda969b2c1c207a7d31b8562b9119b83980 SHA512 8bab1fb28f7186345da24999449fe2c2d45208c515c9b76f5bff2e1cfde145b87da895b49b802d28ac9c07926d6db444833b1acb85d60705e20950f7e5f54326 WHIRLPOOL a523e21ab828956148a95307ee16dc8072fd2423291ebd3c09d5a1623005c5a2f87a96f790a2870b9298a96b8942d3e2f9bcd31b6b7d6acc3cfb5b3d7edb1b27
+MISC ChangeLog 2600 SHA256 481a477bc117025e944362a23ed08673b94a902744bd995ede211ae0b95ba35e SHA512 3e9da895c001ca1a2db424e0eb73156cfdc5befbc9e572beca47b2695cc80af45ed6a26bcb72ccebed7a88e3968f39f57b08cc8a4de39268d38ff4d65a77f4df WHIRLPOOL ce9d9026a6948afc95d88ae88105d54e4977bb03255fbd053e29ab1a19aa0a51e0d960b5919dd41dc78018abd862db3c53cdd4ff292e3a7e09fb0d5aedab020a
+MISC ChangeLog-2015 2427 SHA256 def8c5fc75292a2274162ebb125afafb0d2698041293eda9eccff3c49f56715e SHA512 a30ed94a1a980b834b7136308e5b5584ef942cbf78e4df8d48fd60b37dc896a736f37c2bf8b26d88ca3221d9ac7bc1c49aa6abe06111d11970f6b92c0e9c1308 WHIRLPOOL 4819316037fa8714eb65e262fa1270a2cda1b6969a89cb516242dbee81fe48bb6d1b9e3e234df6edb5d1d391db9059d4d659cd3f1e5bca5f6c7714b972377203
+MISC metadata.xml 520 SHA256 22bf27c6d560098c896f179fe1693fb18ba1ae7fd05b676adfccddb88feccfc3 SHA512 d7314ca36feb63dfeb23c0eb68d26c9c360da76064ba948be8249b5226521028a688d72431778da6523189359ecee9d15f1afb3799d2a60361d716c6e420d8e7 WHIRLPOOL 97fee791dd87e2da34566e80a33844c77d0fb183bfdd0b39e07943985da246d2dcc5e247f9c6f27aa8614acc52794f316e4dc4ce3639ef07a3b779e8f2b894dc
diff --git a/app-forensics/yasat/files/yasat-700-remove-absent-tests.patch b/app-forensics/yasat/files/yasat-700-remove-absent-tests.patch
new file mode 100644
index 000000000000..cffda2f50fa7
--- /dev/null
+++ b/app-forensics/yasat/files/yasat-700-remove-absent-tests.patch
@@ -0,0 +1,14 @@
+--- a/tests/test.test
++++ b/tests/test.test
+@@ -137,7 +137,7 @@
+ qa_test $? 3
+
+ #check_system_cron
+-echo "====== Check a private key ======"
+-check_private_key ./tests/test_rsa.pem 2
+-echo "====== Check a private key protected with password ======"
+-check_private_key ./tests/test_rsa_password.pem 2
++#echo "====== Check a private key ======"
++#check_private_key ./tests/test_rsa.pem 2
++#echo "====== Check a private key protected with password ======"
++#check_private_key ./tests/test_rsa_password.pem 2
diff --git a/app-forensics/yasat/metadata.xml b/app-forensics/yasat/metadata.xml
new file mode 100644
index 000000000000..bcbea064c687
--- /dev/null
+++ b/app-forensics/yasat/metadata.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>clabbe.montjoie@gmail.com</email>
+ <name>LABBE Corentin</name>
+ <description>Upstream and Maintainer. Assign bugs to him</description>
+ </maintainer>
+ <maintainer type="project">
+ <email>proxy-maint@gentoo.org</email>
+ <name>Proxy Maintainers</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="sourceforge">yasat</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/yasat/yasat-526.ebuild b/app-forensics/yasat/yasat-526.ebuild
new file mode 100644
index 000000000000..5afa111fb9f5
--- /dev/null
+++ b/app-forensics/yasat/yasat-526.ebuild
@@ -0,0 +1,23 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="http://yasat.sourceforge.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+IUSE=""
+
+S=${WORKDIR}/${PN}
+
+src_compile() { :; }
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="/usr" SYSCONFDIR="/etc"
+ dodoc README CHANGELOG
+ doman man/yasat.8
+}
diff --git a/app-forensics/yasat/yasat-700.ebuild b/app-forensics/yasat/yasat-700.ebuild
new file mode 100644
index 000000000000..408b1439affd
--- /dev/null
+++ b/app-forensics/yasat/yasat-700.ebuild
@@ -0,0 +1,29 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="http://yasat.sourceforge.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+S=${WORKDIR}/${PN}
+
+src_prepare() {
+ epatch "${FILESDIR}"/${P}-remove-absent-tests.patch
+}
+
+src_compile() { :; }
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="/usr" SYSCONFDIR="/etc"
+
+ dodoc README CHANGELOG
+ doman man/yasat.8
+}
diff --git a/app-forensics/yasat/yasat-755.ebuild b/app-forensics/yasat/yasat-755.ebuild
new file mode 100644
index 000000000000..5474a0034388
--- /dev/null
+++ b/app-forensics/yasat/yasat-755.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="http://yasat.sourceforge.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+S=${WORKDIR}/${PN}
+
+src_compile() { :; }
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="/usr" SYSCONFDIR="/etc"
+
+ dodoc README CHANGELOG
+ doman man/yasat.8
+}
diff --git a/app-forensics/yasat/yasat-839.ebuild b/app-forensics/yasat/yasat-839.ebuild
new file mode 100644
index 000000000000..5474a0034388
--- /dev/null
+++ b/app-forensics/yasat/yasat-839.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="http://yasat.sourceforge.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+S=${WORKDIR}/${PN}
+
+src_compile() { :; }
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="/usr" SYSCONFDIR="/etc"
+
+ dodoc README CHANGELOG
+ doman man/yasat.8
+}
diff --git a/app-forensics/yasat/yasat-848.ebuild b/app-forensics/yasat/yasat-848.ebuild
new file mode 100644
index 000000000000..5474a0034388
--- /dev/null
+++ b/app-forensics/yasat/yasat-848.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2017 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=5
+
+inherit eutils
+
+DESCRIPTION="Security and system auditing tool"
+HOMEPAGE="http://yasat.sourceforge.net"
+SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+
+S=${WORKDIR}/${PN}
+
+src_compile() { :; }
+
+src_install() {
+ emake install DESTDIR="${D}" PREFIX="/usr" SYSCONFDIR="/etc"
+
+ dodoc README CHANGELOG
+ doman man/yasat.8
+}
diff --git a/app-forensics/zzuf/Manifest b/app-forensics/zzuf/Manifest
new file mode 100644
index 000000000000..7d510741f5cf
--- /dev/null
+++ b/app-forensics/zzuf/Manifest
@@ -0,0 +1,8 @@
+DIST zzuf-0.13-zzcat-zzat-rename.patch.bz2 11370 SHA256 33864b8a54fc71464650130c5b2092d969776535f787075119a6750e869d99d3 SHA512 5df3ccc08315c8a983f13294ca3fc38f3b7094a9ba04a46ee7740522ad486318bcf019fec78d60581cb541b5ebdbe1d0751273233d5a54b03f411aef84790529 WHIRLPOOL 87c8561d2eba2626d97600964b7ee8851a1f8a4dc40eda758b5e4854b9149f71b8a26223f36355b707c1e30d559dd1e977292ba2f17d79fa1992a414a573c31d
+DIST zzuf-0.13.tar.gz 461498 SHA256 0842c548522028c3e0d9c9cf7d09f6320b661f33824bb6df19ca209851bdf627 SHA512 e8208dae68b4eee5ebc96775476f616c6822bc9a6a9c753d7f477e9f3e6f527a03e1aec494c2cb8a6666f3159104ea2e221acf8da35efb7d8e357666dbc315ce WHIRLPOOL b4fe880dbd894ee270a847614456536e7d3f615bf3fa01251cbeac863f95704ff766e858fcb037d7e1dcd089acfffb297aea6c8fa01bde4940370288590e8867
+DIST zzuf-0.15.tar.bz2 394859 SHA256 04353d94c68391b3945199f100ab47fc5ff7815db1e92581a600d4175e3a6872 SHA512 7e5b55761c0f75af10920e1ffdde1564022b8d43ce8f59d6b0a27d2c59779ef98dd561cb26f781b8cee09016f08144439770ea2db250874d4bebd2443f592898 WHIRLPOOL 092623a98ced33891e345509eb1fb3880237aac388b7fcb3d0afa32e5439ed43eb5b290d3940ae616f5ee46273ae03368d79653819c65b0c62499edc94808ccd
+EBUILD zzuf-0.13-r1.ebuild 1154 SHA256 df730f862b0139d854be6b03cad6959265dccc484f0fdfab9770ae329d5c2fd5 SHA512 3b5b284dd4056c74a470a1d682f65d79d5768c633d6990b3959c941efb9c5583d4edf677cb60c2cf56863a9f442a67a501a9266af6a36d933c7215df72fb9b7b WHIRLPOOL 349e0951f1c318c0b8357fef747c703641544f346c743ffaf94ac8f9ca7c5078c7c1c3d6e30d89f2c88d828475ed0ee8b2fa17e28240b9536d035b3249da42d3
+EBUILD zzuf-0.15.ebuild 589 SHA256 af96629008ada9ad10a6c6dd2763f8d8716c217644ddc354846e8ee36e34e7c8 SHA512 22d27b4ec9a638dc056483d3bfcd2d6fba4442321f8d80f97dfcf3012cce38cfd5cc30d90464d4375d149dcea8ad6af05049fbcae33e44a8a680db858d92b067 WHIRLPOOL a9f8712d393b442585da249c73ed458cd86878fb53ddc00a1c3302dc9d5b7b80ade21be0e215e52d63252dc53cd0ad2537b54461de8de3bb083685ccc545ed83
+MISC ChangeLog 2734 SHA256 00b37328e1b7a7e4be1b3e024df25fa161fc08494aed891214eb984014e9f714 SHA512 39fc1f444c194791b8b253a3ff5f97bb265e7dabd3dacc077ae5261ddf73bd1c133091fcc6716effb42cd916d8218e66d543dd681c1c8a97a56c011387866ec1 WHIRLPOOL e726c3b5d8887924b555916baac4168861b916247c4be4c53a0b35602c8d0f229931da46fb92db84de1d89b78e154e2bffdc6ddf375fd25b5946b0b75ded5fac
+MISC ChangeLog-2015 1817 SHA256 2bb266a70956de71f2ddfd2020b13f218448025234c3985cb8fe6f57924dbf2b SHA512 5f3ad98a81b746e70ec8727bfd5021dc2ef70b6ec3b432b4b61be8350d9af97581e3ee524cc45040e8d709d6c9b1ec2491899727d500653962e8107abe4ad2ee WHIRLPOOL 8d3d46c3b43dfea926b13776f4f593af8f799a32836326e97920f60ad2175e5a73820daeca096143f7bbbb62518bb9ee8146612cab5b1eae23144e4ceb7e9bef
+MISC metadata.xml 331 SHA256 0cf093a19b4f85fe1e1afeeecf246a3190a2f522cd01f70e8511719c993ffa31 SHA512 f6f336c6acc55f1f7b3f42dac722a370826d57f7792ba3694f1b7f8b0ff2ed97e67368facae98610b9bc1a0880e78f226b9efe6a6e591ec3cf449615f22644fa WHIRLPOOL c5fe7c163e9bdf3b1932cd7e8c4add3fe5c1d2cc876d0b406d7c3a29b04c98521fc825be7c92994c9cd3ff0d6c56b956ee2163a6caa42dc082d7169bf067aee3
diff --git a/app-forensics/zzuf/metadata.xml b/app-forensics/zzuf/metadata.xml
new file mode 100644
index 000000000000..e8a678de174d
--- /dev/null
+++ b/app-forensics/zzuf/metadata.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <maintainer type="person">
+ <email>slyfox@gentoo.org</email>
+ <name>Sergei Trofimovich</name>
+ </maintainer>
+ <upstream>
+ <remote-id type="github">samhocevar/zzuf</remote-id>
+ </upstream>
+</pkgmetadata>
diff --git a/app-forensics/zzuf/zzuf-0.13-r1.ebuild b/app-forensics/zzuf/zzuf-0.13-r1.ebuild
new file mode 100644
index 000000000000..14e3745d20f1
--- /dev/null
+++ b/app-forensics/zzuf/zzuf-0.13-r1.ebuild
@@ -0,0 +1,46 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=4
+
+inherit autotools eutils
+
+DESCRIPTION="Transparent application input fuzzer"
+HOMEPAGE="http://caca.zoy.org/wiki/zzuf"
+SRC_URI="http://caca.zoy.org/files/${PN}/${P}.tar.gz
+ https://dev.gentoo.org/~cardoe/distfiles/${P}-zzcat-zzat-rename.patch.bz2"
+
+LICENSE="WTFPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+IUSE=""
+
+# fails with sandbox enabled
+RESTRICT="test"
+
+DOCS=( AUTHORS ChangeLog NEWS README TODO )
+
+src_prepare() {
+ sed -i -e '/CFLAGS/d' "${S}"/configure.ac \
+ || die "unable to fix the configure.ac"
+ sed -i -e 's:noinst_:check_:' "${S}"/test/Makefile.am \
+ || die "unable to fix unconditional test building"
+
+ epatch "${DISTDIR}"/${P}-zzcat-zzat-rename.patch.bz2
+
+ eautoreconf
+}
+
+src_configure() {
+ # Don't build the static library, as the library is only used for
+ # preloading, so there is no reason to build it statically, unless
+ # you want to use zzuf with a static-linked executable, which I'm
+ # not even sure would be a good idea.
+ econf --disable-static
+}
+
+src_install() {
+ default
+
+ find "${D}" -name '*.la' -delete
+}
diff --git a/app-forensics/zzuf/zzuf-0.15.ebuild b/app-forensics/zzuf/zzuf-0.15.ebuild
new file mode 100644
index 000000000000..189de28bc39c
--- /dev/null
+++ b/app-forensics/zzuf/zzuf-0.15.ebuild
@@ -0,0 +1,25 @@
+# Copyright 1999-2016 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+DESCRIPTION="Transparent application input fuzzer"
+HOMEPAGE="http://caca.zoy.org/wiki/zzuf"
+SRC_URI="https://github.com/samhocevar/zzuf/releases/download/v${PV}/${P}.tar.bz2"
+
+LICENSE="WTFPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~sparc ~x86"
+IUSE=""
+
+# Uses dlopen hack to hijack many libc functions.
+# Fails 2 tests with sandbox enabled: check-zzuf-A-autoinc check-utils
+RESTRICT="test"
+
+DOCS=( AUTHORS COPYING TODO )
+
+src_install() {
+ default
+
+ find "${D}" -name '*.la' -delete
+}