6 files changed, 217 insertions, 13 deletions
diff --git a/net-vpn/Manifest.gz b/net-vpn/Manifest.gz
index 5e5da43a5908..78c5120e1e48 100644
--- a/net-vpn/Manifest.gz
+++ b/net-vpn/Manifest.gz
diff --git a/net-vpn/tailscale/Manifest b/net-vpn/tailscale/Manifest
index 9fe100df2de7..f0ccfdb7b857 100644
--- a/net-vpn/tailscale/Manifest
+++ b/net-vpn/tailscale/Manifest
@@ -6,5 +6,5 @@ DIST tailscale-1.78.1.tar.gz 3378628 BLAKE2B f8f6dfaf5498eb7a230035373d1b1d501da
 DIST tailscale-1.78.3-deps.tar.xz 265496184 BLAKE2B de585f36dfcb0cca5234df06b7395de7e7f84f74b31c14ded548bbd7202865697646e6108c820f55b7d76758ca284a8c461c1fd715140262208b864608c1ab1b SHA512 c67a62081fba3cb4c61e0eec22915d6bd535173d2936e3214b63af93109dcb38293d0bcc4649f7382772f65d6c5d35fde7b4fb5b9eff28e114f091b858c10175
 DIST tailscale-1.78.3.tar.gz 3378578 BLAKE2B d36d549875e2a20fcff0112636d0dce1a206c66e9f06498959072a4fb5f97bf3b63841f27ebe89aad14d403eb3ac0f3d3835da2d6a4c17dc4d2bfd369d868875 SHA512 555de6801c10cc3d5b61eae3bf01d14f9e7b80f39adc2ab35dc70adea11fecc396ade52423028d584d0a13cfac01f23aea39be641f63a6621bcc4ef11077391c
 EBUILD tailscale-1.78.1.ebuild 1643 BLAKE2B e575cdfa03c8f304492ac0f0f03e570d49a6306caf2889beb8d3c57d22522abb9b32430661e9948834999e7d5708204f33e65719e0c7036e26e130e778ee4fee SHA512 1cd58ea924eec383dd95fc034b63bbfd56087a6135395e825ca9350df8f551023887d88a19ec59ba7e9ff7a08afdb8bd1764f66526c53e15bb075b7d662eee59
-EBUILD tailscale-1.78.3.ebuild 1645 BLAKE2B 0fad80b1cc85a3e4823be4007517122a3466eed46293f95d19430fb0e5ed06a51e9431a375fc0e6b2b0fdd91c3e7fec6026e4efe50ceade32d8aef3bb03cd4eb SHA512 e981ce8932b6398bb7ed984c1ce9266505f29609e195ee74c2acbd9159fbcd6a4518ec13008f1c6adf67ac0bfb3cc8087008b5941228f53012bc1246eaf10e5c
+EBUILD tailscale-1.78.3.ebuild 1644 BLAKE2B 60345f1212f617bb3c19374e0f8c055658b87a04016131766d03d69affc1f18c3462e3aa58a269624aaa56975db1f121f694de7cabf0afa7604d8ab71612a241 SHA512 0b5cba7f6cc8a8e1b399d7194077e74de960f78208f6e5524fe9668d19ba535ec93a15e180378fe62e5c90e9e895e59a0f33144c87c4ceb7b477cd34efeee53e
 MISC metadata.xml 333 BLAKE2B 2ab80664e8a4588d485b0ac9fe9dcd8addcca7bf59e091052db0dd7fb09abf985c81490c795cd2daa97447282885c322fbe6202c8ae0c22e92cd2f2a2b9b02b6 SHA512 fc80f602a7d40a2aea28d1e24b717cf080c77f773578fb3ed8bae40b99f7664c693d486c6e40aa2e83d2256b851d27ca9876417e18ac356ddfec51a90cc049f7
diff --git a/net-vpn/tailscale/tailscale-1.78.3.ebuild b/net-vpn/tailscale/tailscale-1.78.3.ebuild
index d4a71a28913d..182c92339ad8 100644
--- a/net-vpn/tailscale/tailscale-1.78.3.ebuild
+++ b/net-vpn/tailscale/tailscale-1.78.3.ebuild
@@ -1,4 +1,4 @@
-# Copyright 2020-2024 Gentoo Authors
+# Copyright 2020-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -19,7 +19,7 @@ SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-deps.tar.xz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
 
 CONFIG_CHECK="~TUN"
 
diff --git a/net-vpn/tor/Manifest b/net-vpn/tor/Manifest
index 830472b7025e..3674d9059273 100644
--- a/net-vpn/tor/Manifest
+++ b/net-vpn/tor/Manifest
@@ -11,6 +11,7 @@ DIST tor-0.4.8.13.tar.gz 9912610 BLAKE2B b55b29b5b2d4aa391f8d9d22657833647064af3
 DIST tor-0.4.8.13.tar.gz.sha256sum 86 BLAKE2B 8e2fce0973e9798c3396fc4c070afe5d4ecf42368aa35e7ee13737c7a0b1c6a45c628605ec1879c9c923380bfb1b9d401b2527cf5bb3768630ac526b22d0be18 SHA512 b059030226b70224c10dabb3517c1d33419d138505b2f339f3a921844e921bed0056a4836559789d74b10fe552897c12716d956dae46474634bb814ab19211f0
 DIST tor-0.4.8.13.tar.gz.sha256sum.asc 716 BLAKE2B 8f708838cc4b642168b689e9ce9bd8daca513db308d86a4d0193edaee8ad47cb52bb0b5af9236da302b9cce542f2dd52a5c86130cd30b5320560e58b7f71fb9c SHA512 879ee66396cd1a751980686c79b03cf85ae19828255b0e0058540d72d0d365aa82778f009824cab310403bda98c968fac956905a9cb8f6877b960897e0476dd0
 EBUILD tor-0.4.8.12-r1.ebuild 4713 BLAKE2B 1320cc00cab15b86d63645ca2ef80d224346e02eae654cc84a1ab3d939f06ea4a603a06a8f9f1217be81908cc52d3951c8378f7b724ae1535aff3a2fbdf369ec SHA512 96ca832249cadf1af659237b73cc714c989189fe337189632e970f57fbe0cb520a163881cd74eba17bd3a07e138dea94fe8cea70ae4c181cce4f26a883f1e028
+EBUILD tor-0.4.8.13-r1.ebuild 4764 BLAKE2B 5230ccda629991e70895f1d0ee9b541ea4d0c43d513a458bf68bd075346716c52823b84ced3d40ba323494bebb7bde10cda8348efb07248d75e3528dcb4743c8 SHA512 6d90869607d967d06dece6a475c436d5d15f49168774773973c50eda5ca9500669d23587bed8ccce4706d733deefe32b15e29f90bbbe312fbd38a9d99df8fbb8
 EBUILD tor-0.4.8.13.ebuild 4713 BLAKE2B 1320cc00cab15b86d63645ca2ef80d224346e02eae654cc84a1ab3d939f06ea4a603a06a8f9f1217be81908cc52d3951c8378f7b724ae1535aff3a2fbdf369ec SHA512 96ca832249cadf1af659237b73cc714c989189fe337189632e970f57fbe0cb520a163881cd74eba17bd3a07e138dea94fe8cea70ae4c181cce4f26a883f1e028
-EBUILD tor-9999.ebuild 4719 BLAKE2B 71096a316d1c79d193ab7af927996c2007009eb6d035a43751eaec1c8a35ca9bce7cea0880d61d840c4528ef95ab3e5db8acb1735f8de33114c14d6d2268d432 SHA512 e1f59d2889fe7f8db9495a5c3debe1fe48281336a474e757391a56ddffc530ee2a30672b3cfe0f7aaceb8477cc8b3e6e311327ec14d7620bf94c6cc19b2e85b3
+EBUILD tor-9999.ebuild 4764 BLAKE2B 5230ccda629991e70895f1d0ee9b541ea4d0c43d513a458bf68bd075346716c52823b84ced3d40ba323494bebb7bde10cda8348efb07248d75e3528dcb4743c8 SHA512 6d90869607d967d06dece6a475c436d5d15f49168774773973c50eda5ca9500669d23587bed8ccce4706d733deefe32b15e29f90bbbe312fbd38a9d99df8fbb8
 MISC metadata.xml 645 BLAKE2B a7f450c6cfb9a605f7021cbe533ec64ff0926c9877bef7aace8ce1770a8ec552255b5c54ac80035646c3515d7d0b778100573897068d0905a56f7b860c8de21b SHA512 e5724033912b73ab8abe1b47e74578c8fe4bf6e341b8e7d7434d69071508cd1f35d97f4c7ade9787ae0ded6660cf0a5477d3c7462ed13832693bfd6205f0f0f1
diff --git a/net-vpn/tor/tor-0.4.8.13-r1.ebuild b/net-vpn/tor/tor-0.4.8.13-r1.ebuild
new file mode 100644
index 000000000000..4fc537113317
--- /dev/null
+++ b/net-vpn/tor/tor-0.4.8.13-r1.ebuild
@@ -0,0 +1,199 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{10..13} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/torproject.org.asc
+inherit edo python-any-r1 readme.gentoo-r1 systemd verify-sig
+
+MY_PV="$(ver_rs 4 -)"
+MY_PF="${PN}-${MY_PV}"
+DESCRIPTION="Anonymizing overlay network for TCP"
+HOMEPAGE="https://www.torproject.org/ https://gitlab.torproject.org/tpo/core/tor/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://gitlab.torproject.org/tpo/core/tor"
+	inherit autotools git-r3
+else
+	SRC_URI="
+		https://www.torproject.org/dist/${MY_PF}.tar.gz
+		https://archive.torproject.org/tor-package-archive/${MY_PF}.tar.gz
+		verify-sig? (
+			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum
+			https://dist.torproject.org/${MY_PF}.tar.gz.sha256sum.asc
+		)
+	"
+
+	S="${WORKDIR}/${MY_PF}"
+
+	if [[ ${PV} != *_alpha* && ${PV} != *_beta* && ${PV} != *_rc* ]]; then
+		KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86 ~ppc-macos"
+	fi
+
+	BDEPEND="verify-sig? ( >=sec-keys/openpgp-keys-tor-20230727 )"
+fi
+
+# BSD in general, but for PoW, needs --enable-gpl (GPL-3 per --version)
+# We also already had GPL-2 listed here for the init script, but obviously
+# that's different from the actual binary.
+LICENSE="BSD GPL-2 GPL-3"
+SLOT="0"
+IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=dev-libs/libevent-2.1.12-r1:=[ssl]
+	dev-libs/openssl:=[-bindist(-)]
+	sys-libs/zlib
+	caps? ( sys-libs/libcap )
+	man? ( app-text/asciidoc )
+	lzma? ( app-arch/xz-utils )
+	scrypt? ( app-crypt/libscrypt )
+	seccomp? ( >=sys-libs/libseccomp-2.4.1 )
+	systemd? ( sys-apps/systemd:= )
+	zstd? ( app-arch/zstd:= )
+"
+DEPEND="
+	${RDEPEND}
+	test? (
+		${DEPEND}
+		${PYTHON_DEPS}
+	)
+"
+RDEPEND+="
+	acct-user/tor
+	acct-group/tor
+	selinux? ( sec-policy/selinux-tor )
+"
+BDEPEND="
+	acct-user/tor
+	acct-group/tor
+"
+
+DOCS=()
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-0.2.7.4-torrc.sample.patch
+)
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# test correctly fails because -lnacl fails if not available
+	# https://bugs.gentoo.org/900092
+	crypto_scalarmult_curve25519
+)
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	else
+		if use verify-sig; then
+			cd "${DISTDIR}" || die
+			verify-sig_verify_detached ${MY_PF}.tar.gz.sha256sum{,.asc}
+			verify-sig_verify_unsigned_checksums \
+				${MY_PF}.tar.gz.sha256sum sha256 ${MY_PF}.tar.gz
+			cd "${WORKDIR}" || die
+		fi
+
+		default
+	fi
+}
+
+src_prepare() {
+	default
+
+	# Running shellcheck automagically isn't useful for ebuild testing.
+	echo "exit 0" > scripts/maint/checkShellScripts.sh || die
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	use doc && DOCS+=( README.md ChangeLog ReleaseNotes doc/HACKING )
+
+	export ac_cv_lib_cap_cap_init=$(usex caps)
+	export tor_cv_PYTHON="${EPYTHON}"
+
+	local myeconfargs=(
+		--localstatedir="${EPREFIX}/var"
+		--disable-all-bugs-are-fatal
+		--enable-system-torrc
+		--disable-android
+		--disable-coverage
+		--disable-html-manual
+		--disable-libfuzzer
+		--enable-missing-doc-warnings
+		--disable-module-dirauth
+		--enable-pic
+		--disable-restart-debugging
+
+		# Unless someone asks & has a compelling reason, just always
+		# build in GPL mode for pow, given we don't want yet another USE
+		# flag combination to have to test just for the sake of it.
+		# (PoW requires GPL.)
+		--enable-gpl
+		--enable-module-pow
+
+		$(use_enable man asciidoc)
+		$(use_enable man manpage)
+		$(use_enable lzma)
+		$(use_enable scrypt libscrypt)
+		$(use_enable seccomp)
+		$(use_enable server module-relay)
+		$(use_enable systemd)
+		$(use_enable tor-hardening gcc-hardening)
+		$(use_enable tor-hardening linker-hardening)
+		$(use_enable test unittests)
+		$(use_enable zstd)
+	)
+
+	econf "${myeconfargs[@]}"
+}
+
+src_test() {
+	local skip_tests=(
+		# Fails in sandbox
+		:sandbox/open_filename
+		:sandbox/openat_filename
+	)
+
+	if use arm ; then
+		skip_tests+=(
+			# bug #920905
+			# https://gitlab.torproject.org/tpo/core/tor/-/issues/40912
+			:sandbox/opendir_dirname
+			:sandbox/openat_filename
+			:sandbox/chmod_filename
+			:sandbox/chown_filename
+			:sandbox/rename_filename
+		)
+	fi
+
+	# The makefile runs these by parallel by chunking them with a script
+	# but that means we lose verbosity and can't skip individual tests easily
+	# either.
+	edo ./src/test/test --verbose "${skip_tests[@]}"
+}
+
+src_install() {
+	default
+	readme.gentoo_create_doc
+
+	newconfd "${FILESDIR}"/tor.confd tor
+	newinitd "${FILESDIR}"/tor.initd-r9 tor
+	systemd_dounit "${FILESDIR}"/tor.service
+
+	keepdir /var/lib/tor
+
+	fperms 750 /var/lib/tor
+	fowners tor:tor /var/lib/tor
+
+	insinto /etc/tor/
+	newins "${FILESDIR}"/torrc-r2 torrc
+}
diff --git a/net-vpn/tor/tor-9999.ebuild b/net-vpn/tor/tor-9999.ebuild
index 22759b502bcd..4fc537113317 100644
--- a/net-vpn/tor/tor-9999.ebuild
+++ b/net-vpn/tor/tor-9999.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -42,9 +42,7 @@ SLOT="0"
 IUSE="caps doc lzma +man scrypt seccomp selinux +server systemd tor-hardening test zstd"
 RESTRICT="!test? ( test )"
 
-DEPEND="
-	acct-user/tor
-	acct-group/tor
+RDEPEND="
 	>=dev-libs/libevent-2.1.12-r1:=[ssl]
 	dev-libs/openssl:=[-bindist(-)]
 	sys-libs/zlib
@@ -56,16 +54,22 @@ DEPEND="
 	systemd? ( sys-apps/systemd:= )
 	zstd? ( app-arch/zstd:= )
 "
-RDEPEND="
-	${DEPEND}
-	selinux? ( sec-policy/selinux-tor )
-"
-DEPEND+="
+DEPEND="
+	${RDEPEND}
 	test? (
 		${DEPEND}
 		${PYTHON_DEPS}
 	)
 "
+RDEPEND+="
+	acct-user/tor
+	acct-group/tor
+	selinux? ( sec-policy/selinux-tor )
+"
+BDEPEND="
+	acct-user/tor
+	acct-group/tor
+"
 
 DOCS=()