6 files changed, 718 insertions, 0 deletions
diff --git a/sys-libs/Manifest.gz b/sys-libs/Manifest.gz
index b7da93a759c8..bdab457918a9 100644
--- a/sys-libs/Manifest.gz
+++ b/sys-libs/Manifest.gz
diff --git a/sys-libs/musl/Manifest b/sys-libs/musl/Manifest
index f97c532e8ab8..8a6c5c4af337 100644
--- a/sys-libs/musl/Manifest
+++ b/sys-libs/musl/Manifest
@@ -1,6 +1,7 @@
 AUX ldconfig.in-r3 3093 BLAKE2B 146374fe711c660a61e4a23f89ae066e78b8bca6884719c058981069ab92833d7f660b7bd78e7c8b86112944706823f0260d7c63f19d64960f27f44b4e95a6a3 SHA512 ba021cf7d52c001d6ef9a54a91de93240cd7eef9f7a6d7a48ae0c58f934aaea6796979ce80e1cfa9bdc6008023108f3c226440360f8e3134fc23f7fdac0e55b1
 AUX musl-1.2.4-arm64-crti-alignment.patch 847 BLAKE2B 4f652b924fd9b7a396d21cf8fef0d618c23ce14ea662290850e9a8ed78ac6303f674ac978f74e86f8671df75a7749ee54bbbe11278ae283892d1157e540a86d8 SHA512 77d6a4798a71d3593621bb8d3177b288f04bc0e5a4b2a6b91e8ad73e8a96279a4ae18344df77fafb97228931d6e6306b4b0c2adba8dded6449b7bb2565041d31
 AUX musl-1.2.4-elfutils-0.190-relr.patch 2930 BLAKE2B 81bcc8932eb4ffb7cf0ae5707866d755c731e67bdcfa71e097f48ee3f13ab75fc96645bfc76e376cda700d81fbb6f7e47f83b06964ded9ea173c262965e4cb04 SHA512 47a24912f5dc16e21a0692c8f0b323dec815867dca7d65f97740a0ad2623c42cd0711e0b69609f24774db8cb26518e2ee5577b4a89d36cc2b053ba7b879cb2f8
+AUX musl-iconv-out-of-bound-fix.patch 2765 BLAKE2B 9f35fc8d34b84a8a12fe1a6d166ecf7bf0ae1175d52bda845e0f3aea96cf191cf97e50f415b5d39700b0ff718462a265bd4b70b9f3a21dfae37fc0b8a2bf25b5 SHA512 4094d2ae9fa27e2f117e0341628c3e7607404d7ff49e504e0a6f56cb689983b62fe99aff46772ceb3b5f07b1f13015c126445c00a218926fe03bdf8da6545fd1
 AUX musl-sched.h-reduce-namespace-conflicts.patch 2470 BLAKE2B 838a6f9bbb447a1b50566cff781f211ab68efaa0ed5d293cb1715936981411ac0db1a9cddb327dc47b8b37ccfaf7e96ac76c6f1328e98c0334a8f585af787a6e SHA512 c488d1035ae40c7cda01e91f90c4d47ed4afd3f4754e5476185bc7e6f19823c0f2ba01e4720763f08073fa102c31cb731d3db27b9ef27bddd5761157c8b07b71
 AUX stack_chk_fail_local.c 1798 BLAKE2B 380bcbb920bd40a5185246621ba93716f27d61cd0077cd796ff267e10c534c9cc64982b2a66c89b61395dc93d67dae77e8c59908f65f2903f16016180cf94bbb SHA512 bb0bdd7f205d57771920c7ea898c1f84a55d6f90ddd1f8203bfeed98d13ccefa6f68d5fd1c0761321b2732ca928ca81b425e3fe8321c936d1316dea6f1930091
 DIST getconf.c 11614 BLAKE2B ba49a573fc16d51780a0b0b81fbf7b64a1142f1dbad203c9609a59b6b07e7404f676c415383ae88c0aede95694821f6ee381bffd93cc3330501e17dc07d122bd SHA512 0d80f37b34a35e3d14b012257c50862dfeb9d2c81139ea2dfa101d981d093b009b9fa450ba27a708ac59377a48626971dfc58e20a3799084a65777a0c32cbc7d
@@ -12,9 +13,12 @@ DIST musl-1.2.4.tar.gz.asc 490 BLAKE2B 2133cff9ae2c8f69213fb72a256533d0686fd1180
 DIST musl-1.2.5.tar.gz 1080786 BLAKE2B 6065dc1e01874d1b96abe714147dcc0b41ca702ca9e9c44e85864185dab0b6d085a692745db0822c94a79325e1a91dad60c52f467717d9323b2b3c6ad0a17545 SHA512 7bb7f7833923cd69c7a1a9b8a5f1784bfd5289663eb6061dcd43d583e45987df8a68a1be05d75cc1c88a3f5b610653d1a70f4a9cff4d8f7fd41ae73ee058c17c
 DIST musl-1.2.5.tar.gz.asc 490 BLAKE2B f0d91b20aa7729449bd02a60adf17e8287904ed5971851a34b15f500011137ddc3f338d24712ff0481f1d6f9a749d87014a82b26a3bd9de660ddbf29678a8777 SHA512 c8aebf05b14abbd33ff568ca17ddd8b29e6f53cbb1cb85e00b64f15516ffc46a7a064c996a7bb1c9681a361a4921204ac58e4a1cfd7bd3ad60d7f2b0151d9229
 DIST musl-getent-93a08815f8598db442d8b766b463d0150ed8e2ab.c 11656 BLAKE2B 1b7bf7102a1eb91a8cb881ed8ca65eb8eed911dd50238e97dc2952d89d4c6ebed6bfd046a2b38776c550b2872ab54ced8cb452fcc2ad56e5616f722debda761f SHA512 7f5b9d934d82deb5f8b23e16169a5d9b99ccab3a4708df06a95d685e1b24a3a3e69b3dcf4942f2f66c12a3d4bf0c5827e2ee2e8c4d7b1997359fccc2ac212dee
+EBUILD musl-1.2.3-r10.ebuild 6117 BLAKE2B 69679bf250df5728bdf1f5d48c5fb9af954af3ac94ee30181d806a9ab4b05a41773090dee0a634a22793e5f749215c65334fca16fdc29fb2cb221d31dd82d10b SHA512 689a64bc835561975c5dab0dfd541a71e9714ed125f3d93bb1d6c1b729ae15f8d7e542c31e64edee35ecbb63fad36bc7d1631ab41f69ecf3b06704a604382fc9
 EBUILD musl-1.2.3-r9.ebuild 6061 BLAKE2B bc236cfc3b66d8cb5837c8ff1009e4743add90a38e842dff9b1ed076ddf679a4be43e09945f2e0433e7a273ce865b40f43bc6884178b4efe25f4d194175c057c SHA512 5fb1ad4fc56df814ef8e68a33b75fd4688501114eacd890db95588aee1255dd11bd383d2320e3323c184d77b9b57b90428c6dcd6284e28d5738db856002500b0
 EBUILD musl-1.2.4-r1.ebuild 5775 BLAKE2B 9831268faa34fa420480de2fa4961b374fe02c5bcd188afdfebc82eabfd3fc9e5fdfedd99ad9addd97ac5e8788dd16797781a1b8278455da9ae72f548eaba546 SHA512 9fd54b47ac25547e4dcf8de9ac27ac11ad05f7278a3d0b1d6a9b7977d80e8feef606413e2930c27f7bfec48d9340818f0f46e99b0dabfe78f0f6b0f7eb63dad4
 EBUILD musl-1.2.4-r3.ebuild 5893 BLAKE2B 31702d4b07ea6d39a0c7d48995d9b6d95c447b0b7640463c78701777dbbd8c170af5ebd927c7dfd5d9be2e4652640c64c2eb7444a6245a5b54ba10458c5299e4 SHA512 1ce01807e3fec77a6b732900760a810654f7a4122dd66109038f7570a422339270488c0cc7eba2e421dd7dfe99cf25ff2175ab53a00d38ff218f23dbcf167296
+EBUILD musl-1.2.4-r4.ebuild 5949 BLAKE2B 1fdaf4c7e9cc1ed5d59ca2915aad19c71698c86474ea7c2639d0024676faec5db4d4c88620aceb4a4d8c4a6385c1addea9ee9814c9400e55ac95dc9e05c4df3a SHA512 a7583e66e7f3790a8f90815d52a4c8c527f1a4789dfd1db87e61d07b4ea96dd47cf03017887686452af847523077e38f70d241a1131be79a6dc164b7457d9c32
 EBUILD musl-1.2.5-r2.ebuild 5868 BLAKE2B 88316a9821c84cebba28d874f4a77d1f59f4a3e00a31ae608cd690a85ea190bc9ef00f91ebe41936d364b8cca7aa1d01827495c6f6ef466def7392f2e9bf4791 SHA512 857b595a38cb9c90ef88e499fcfa0a28b3f669d67804c3ea3f7340eba5793c14a9625fe4d0ee6076763b1aa367970da89a978ec668382e7183b462a2e96dd6ab
+EBUILD musl-1.2.5-r3.ebuild 5923 BLAKE2B 268fe160d9159f39967bac8c1c1d931e6348112bad2b480f21c78ecf20420a337613f23aebb8a3b6c3b1abcb11ad82e7c457c4fe143ee4ed18a3411255c59ec8 SHA512 b3041941634cd1686c7037ddcef31bc6e02da8b6a3be811da57a7b8f2be4682d416437838657021897bca4ac7c68d0d9b8346cd3cf70ed1ce4d0b73d6ae96ffa
 EBUILD musl-9999.ebuild 5745 BLAKE2B 6aa474780470f516baaad52d2d6cd01a4bca6ba9f5278b734c571cf4f74024eeaa3fa4f991a354f8cc1fd159ab3cbc589fae1a24e036cede7f42e24a44dc7aa2 SHA512 80d9fa556ba779f1de8f0b3713ec10887e54f8062183278def72fc947f48ec46e31da790cba237d150bd058af238ade656b74470d1b5824bc2161fee47f4fe25
 MISC metadata.xml 559 BLAKE2B 8b1093a5278f716b8e21467b325e373a790f54c8ab71b92adc4c87dd569a92b20e08009372065f0f27ced39e3361c9e5e5a2e1bff271753d280439fabbddd3a4 SHA512 a35c13ea32ac8f26984bdb0d70d28a4285f34e32a2b0b17ad98fe3f357fb46c87a1e853377630d4da58fd5953de3fdeb02ee89181394e1815f5e0bbba4cd9f92
diff --git a/sys-libs/musl/files/musl-iconv-out-of-bound-fix.patch b/sys-libs/musl/files/musl-iconv-out-of-bound-fix.patch
new file mode 100644
index 000000000000..762b4e34c160
--- /dev/null
+++ b/sys-libs/musl/files/musl-iconv-out-of-bound-fix.patch
@@ -0,0 +1,76 @@
+>From e5adcd97b5196e29991b524237381a0202a60659 Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Sun, 9 Feb 2025 10:07:19 -0500
+Subject: [PATCH] iconv: fix erroneous input validation in EUC-KR decoder
+
+as a result of incorrect bounds checking on the lead byte being
+decoded, certain invalid inputs which should produce an encoding
+error, such as "\xc8\x41", instead produced out-of-bounds loads from
+the ksc table.
+
+in a worst case, the loaded value may not be a valid unicode scalar
+value, in which case, if the output encoding was UTF-8, wctomb would
+return (size_t)-1, causing an overflow in the output pointer and
+remaining buffer size which could clobber memory outside of the output
+buffer.
+
+bug report was submitted in private by Nick Wellnhofer on account of
+potential security implications.
+---
+ src/locale/iconv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/locale/iconv.c b/src/locale/iconv.c
+index 9605c8e9..008c93f0 100644
+--- a/src/locale/iconv.c
++++ b/src/locale/iconv.c
+@@ -502,7 +502,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
+ 			if (c >= 93 || d >= 94) {
+ 				c += (0xa1-0x81);
+ 				d += 0xa1;
+-				if (c >= 93 || c>=0xc6-0x81 && d>0x52)
++				if (c > 0xc6-0x81 || c==0xc6-0x81 && d>0x52)
+ 					goto ilseq;
+ 				if (d-'A'<26) d = d-'A';
+ 				else if (d-'a'<26) d = d-'a'+26;
+-- 
+2.21.0
+
+>From c47ad25ea3b484e10326f933e927c0bc8cded3da Mon Sep 17 00:00:00 2001
+From: Rich Felker <dalias@aerifal.cx>
+Date: Wed, 12 Feb 2025 17:06:30 -0500
+Subject: [PATCH] iconv: harden UTF-8 output code path against input decoder
+ bugs
+
+the UTF-8 output code was written assuming an invariant that iconv's
+decoders only emit valid Unicode Scalar Values which wctomb can encode
+successfully, thereby always returning a value between 1 and 4.
+
+if this invariant is not satisfied, wctomb returns (size_t)-1, and the
+subsequent adjustments to the output buffer pointer and remaining
+output byte count overflow, moving the output position backwards,
+potentially past the beginning of the buffer, without storing any
+bytes.
+---
+ src/locale/iconv.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/locale/iconv.c b/src/locale/iconv.c
+index 008c93f0..52178950 100644
+--- a/src/locale/iconv.c
++++ b/src/locale/iconv.c
+@@ -545,6 +545,10 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
+ 				if (*outb < k) goto toobig;
+ 				memcpy(*out, tmp, k);
+ 			} else k = wctomb_utf8(*out, c);
++			/* This failure condition should be unreachable, but
++			 * is included to prevent decoder bugs from translating
++			 * into advancement outside the output buffer range. */
++			if (k>4) goto ilseq;
+ 			*out += k;
+ 			*outb -= k;
+ 			break;
+-- 
+2.21.0
+
+
diff --git a/sys-libs/musl/musl-1.2.3-r10.ebuild b/sys-libs/musl/musl-1.2.3-r10.ebuild
new file mode 100644
index 000000000000..16d5a3221886
--- /dev/null
+++ b/sys-libs/musl/musl-1.2.3-r10.ebuild
@@ -0,0 +1,219 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit eapi8-dosym flag-o-matic toolchain-funcs prefix
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="https://git.musl-libc.org/git/musl"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/musl.asc
+	inherit verify-sig
+
+	SRC_URI="https://musl.libc.org/releases/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://musl.libc.org/releases/${P}.tar.gz.asc )"
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~mips ~ppc ~ppc64 ~riscv ~x86"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-musl )"
+fi
+GETENT_COMMIT="93a08815f8598db442d8b766b463d0150ed8e2ab"
+GETENT_FILE="musl-getent-${GETENT_COMMIT}.c"
+SRC_URI+="
+	https://dev.gentoo.org/~blueness/musl-misc/getconf.c
+	https://gitlab.alpinelinux.org/alpine/aports/-/raw/${GETENT_COMMIT}/main/musl/getent.c -> ${GETENT_FILE}
+	https://dev.gentoo.org/~blueness/musl-misc/iconv.c
+"
+
+export CBUILD=${CBUILD:-${CHOST}}
+export CTARGET=${CTARGET:-${CHOST}}
+if [[ ${CTARGET} == ${CHOST} ]] ; then
+	if [[ ${CATEGORY} == cross-* ]] ; then
+		export CTARGET=${CATEGORY#cross-}
+	fi
+fi
+
+DESCRIPTION="Light, fast and simple C library focused on standards-conformance and safety"
+HOMEPAGE="https://musl.libc.org"
+
+LICENSE="MIT LGPL-2 GPL-2"
+SLOT="0"
+IUSE="crypt headers-only split-usr"
+
+QA_SONAME="usr/lib/libc.so"
+QA_DT_NEEDED="usr/lib/libc.so"
+# bug #830213
+QA_PRESTRIPPED="usr/lib/crtn.o"
+
+# We want crypt on by default for this as sys-libs/libxcrypt isn't (yet?)
+# built as part as crossdev. Also, elide the blockers when in cross-*,
+# as it doesn't make sense to block the normal CBUILD libxcrypt at all
+# there when we're installing into /usr/${CHOST} anyway.
+if [[ ${CATEGORY} == cross-* ]] ; then
+	IUSE="${IUSE/crypt/+crypt}"
+else
+	RDEPEND="crypt? ( !sys-libs/libxcrypt[system] )"
+	PDEPEND="!crypt? ( sys-libs/libxcrypt[system] )"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-sched.h-reduce-namespace-conflicts.patch
+	"${FILESDIR}"/${PN}-iconv-out-of-bound-fix.patch
+)
+
+is_crosscompile() {
+	[[ ${CHOST} != ${CTARGET} ]]
+}
+
+just_headers() {
+	use headers-only && is_crosscompile
+}
+
+pkg_setup() {
+	if [ ${CTARGET} == ${CHOST} ] ; then
+		case ${CHOST} in
+		*-musl*) ;;
+		*) die "Use sys-devel/crossdev to build a musl toolchain" ;;
+		esac
+	fi
+
+	# fix for #667126, copied from glibc ebuild
+	# make sure host make.conf doesn't pollute us
+	if is_crosscompile || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# We only verify the release; not the additional (fixed, safe) files
+		# we download.
+		# (Seem to get IPC error on verifying in cross?)
+		! is_crosscompile && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.gz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	mkdir "${WORKDIR}"/misc || die
+	cp "${DISTDIR}"/getconf.c "${WORKDIR}"/misc/getconf.c || die
+	cp "${DISTDIR}/${GETENT_FILE}" "${WORKDIR}"/misc/getent.c || die
+	cp "${DISTDIR}"/iconv.c "${WORKDIR}"/misc/iconv.c || die
+}
+
+src_configure() {
+	strip-flags && filter-lto # Prevent issues caused by aggressive optimizations & bug #877343
+	tc-getCC ${CTARGET}
+
+	just_headers && export CC=true
+
+	local sysroot
+	is_crosscompile && sysroot=/usr/${CTARGET}
+	./configure \
+		--target=${CTARGET} \
+		--prefix="${EPREFIX}${sysroot}/usr" \
+		--syslibdir="${EPREFIX}${sysroot}/lib" \
+		--disable-gcc-wrapper || die
+}
+
+src_compile() {
+	emake obj/include/bits/alltypes.h
+	just_headers && return 0
+
+	emake
+	if [[ ${CATEGORY} != cross-* ]] ; then
+		emake -C "${T}" getconf getent iconv \
+			CC="$(tc-getCC)" \
+			CFLAGS="${CFLAGS}" \
+			CPPFLAGS="${CPPFLAGS}" \
+			LDFLAGS="${LDFLAGS}" \
+			VPATH="${WORKDIR}/misc"
+	fi
+
+	$(tc-getCC) ${CFLAGS} -c -o libssp_nonshared.o  "${FILESDIR}"/stack_chk_fail_local.c || die
+	$(tc-getAR) -rcs libssp_nonshared.a libssp_nonshared.o || die
+}
+
+src_install() {
+	local target="install"
+	just_headers && target="install-headers"
+	emake DESTDIR="${D}" ${target}
+	just_headers && return 0
+
+	# musl provides ldd via a sym link to its ld.so
+	local sysroot=
+	is_crosscompile && sysroot=/usr/${CTARGET}
+	local ldso=$(basename "${ED}${sysroot}"/lib/ld-musl-*)
+	dosym8 -r "${sysroot}/lib/${ldso}" "${sysroot}/usr/bin/ldd"
+
+	if ! use crypt ; then
+		# Allow sys-libs/libxcrypt[system] to provide it instead
+		rm "${ED}${sysroot}/usr/include/crypt.h" || die
+		rm "${ED}${sysroot}"/usr/*/libcrypt.a || die
+	fi
+
+	if [[ ${CATEGORY} != cross-* ]] ; then
+		# Fish out of config:
+		#   ARCH = ...
+		#   SUBARCH = ...
+		# and print $(ARCH)$(SUBARCH).
+		local arch=$(awk '{ k[$1] = $3 } END { printf("%s%s", k["ARCH"], k["SUBARCH"]); }' config.mak)
+
+		# The musl build system seems to create a symlink:
+		# ${D}/lib/ld-musl-${arch}.so.1 -> /usr/lib/libc.so.1 (absolute)
+		# During cross or within prefix, there's no guarantee that the host is
+		# using musl so that file may not exist. Use a relative symlink within
+		# ${D} instead.
+		rm "${ED}"/lib/ld-musl-${arch}.so.1 || die
+		if use split-usr; then
+			dosym ../usr/lib/libc.so /lib/ld-musl-${arch}.so.1
+			# If it's still a dead symlink, OK, we really do need to abort.
+			[[ -e "${ED}"/lib/ld-musl-${arch}.so.1 ]] || die
+		else
+			dosym libc.so /usr/lib/ld-musl-${arch}.so.1
+			[[ -e "${ED}"/usr/lib/ld-musl-${arch}.so.1 ]] || die
+		fi
+
+		cp "${FILESDIR}"/ldconfig.in-r3 "${T}"/ldconfig.in || die
+		sed -e "s|@@ARCH@@|${arch}|" "${T}"/ldconfig.in > "${T}"/ldconfig || die
+		eprefixify "${T}"/ldconfig
+		into /
+		dosbin "${T}"/ldconfig
+		into /usr
+		dobin "${T}"/getconf
+		dobin "${T}"/getent
+		dobin "${T}"/iconv
+		newenvd - "00musl" <<-EOF
+		# 00musl autogenerated by sys-libs/musl ebuild; DO NOT EDIT.
+		LDPATH="include ld.so.conf.d/*.conf"
+		EOF
+	fi
+
+	if is_crosscompile ; then
+		into /usr/${CTARGET}
+		dolib.a libssp_nonshared.a
+	else
+		dolib.a libssp_nonshared.a
+	fi
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+}
+
+pkg_postinst() {
+	is_crosscompile && return 0
+
+	[ -n "${ROOT}" ] && return 0
+
+	ldconfig || die
+}
diff --git a/sys-libs/musl/musl-1.2.4-r4.ebuild b/sys-libs/musl/musl-1.2.4-r4.ebuild
new file mode 100644
index 000000000000..79f9d494100f
--- /dev/null
+++ b/sys-libs/musl/musl-1.2.4-r4.ebuild
@@ -0,0 +1,209 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit crossdev flag-o-matic toolchain-funcs prefix
+if [[ ${PV} == "9999" ]] ; then
+	EGIT_REPO_URI="https://git.musl-libc.org/git/musl"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/musl.asc
+	inherit verify-sig
+
+	SRC_URI="https://musl.libc.org/releases/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://musl.libc.org/releases/${P}.tar.gz.asc )"
+	KEYWORDS="-* ~amd64 ~arm ~arm64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~x86"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-musl )"
+fi
+GETENT_COMMIT="93a08815f8598db442d8b766b463d0150ed8e2ab"
+GETENT_FILE="musl-getent-${GETENT_COMMIT}.c"
+SRC_URI+="
+	https://dev.gentoo.org/~blueness/musl-misc/getconf.c
+	https://gitlab.alpinelinux.org/alpine/aports/-/raw/${GETENT_COMMIT}/main/musl/getent.c -> ${GETENT_FILE}
+	https://dev.gentoo.org/~blueness/musl-misc/iconv.c
+"
+
+DESCRIPTION="Light, fast and simple C library focused on standards-conformance and safety"
+HOMEPAGE="https://musl.libc.org"
+
+LICENSE="MIT LGPL-2 GPL-2"
+SLOT="0"
+IUSE="crypt headers-only split-usr"
+
+QA_SONAME="usr/lib/libc.so"
+QA_DT_NEEDED="usr/lib/libc.so"
+# bug #830213
+QA_PRESTRIPPED="usr/lib/crtn.o"
+
+# We want crypt on by default for this as sys-libs/libxcrypt isn't (yet?)
+# built as part as crossdev. Also, elide the blockers when in cross-*,
+# as it doesn't make sense to block the normal CBUILD libxcrypt at all
+# there when we're installing into /usr/${CHOST} anyway.
+if is_crosspkg ; then
+	IUSE="${IUSE/crypt/+crypt}"
+else
+	RDEPEND="crypt? ( !sys-libs/libxcrypt[system] )"
+	PDEPEND="!crypt? ( sys-libs/libxcrypt[system] )"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${P}-elfutils-0.190-relr.patch
+	"${FILESDIR}"/${PN}-1.2.4-arm64-crti-alignment.patch
+	"${FILESDIR}"/${PN}-sched.h-reduce-namespace-conflicts.patch
+	"${FILESDIR}"/${PN}-iconv-out-of-bound-fix.patch
+)
+
+just_headers() {
+	use headers-only && target_is_not_host
+}
+
+pkg_setup() {
+	if [[ ${CTARGET} == ${CHOST} ]] ; then
+		case ${CHOST} in
+		*-musl*) ;;
+		*) die "Use sys-devel/crossdev to build a musl toolchain" ;;
+		esac
+	fi
+
+	# fix for #667126, copied from glibc ebuild
+	# make sure host make.conf doesn't pollute us
+	if target_is_not_host || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# We only verify the release; not the additional (fixed, safe) files
+		# we download.
+		# (Seem to get IPC error on verifying in cross?)
+		! target_is_not_host && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.gz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	mkdir "${WORKDIR}"/misc || die
+	cp "${DISTDIR}"/getconf.c "${WORKDIR}"/misc/getconf.c || die
+	cp "${DISTDIR}/${GETENT_FILE}" "${WORKDIR}"/misc/getent.c || die
+	cp "${DISTDIR}"/iconv.c "${WORKDIR}"/misc/iconv.c || die
+}
+
+src_configure() {
+	strip-flags && filter-lto # Prevent issues caused by aggressive optimizations & bug #877343
+	tc-getCC ${CTARGET}
+
+	just_headers && export CC=true
+
+	local sysroot
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	./configure \
+		--target=${CTARGET} \
+		--prefix="${EPREFIX}${sysroot}/usr" \
+		--syslibdir="${EPREFIX}${sysroot}/lib" \
+		--disable-gcc-wrapper || die
+}
+
+src_compile() {
+	emake obj/include/bits/alltypes.h
+	just_headers && return 0
+
+	emake
+	if ! is_crosspkg ; then
+		emake -C "${T}" getconf getent iconv \
+			CC="$(tc-getCC)" \
+			CFLAGS="${CFLAGS}" \
+			CPPFLAGS="${CPPFLAGS}" \
+			LDFLAGS="${LDFLAGS}" \
+			VPATH="${WORKDIR}/misc"
+	fi
+
+	$(tc-getCC) ${CFLAGS} -c -o libssp_nonshared.o  "${FILESDIR}"/stack_chk_fail_local.c || die
+	$(tc-getAR) -rcs libssp_nonshared.a libssp_nonshared.o || die
+}
+
+src_install() {
+	local target="install"
+	just_headers && target="install-headers"
+	emake DESTDIR="${D}" ${target}
+	just_headers && return 0
+
+	# musl provides ldd via a sym link to its ld.so
+	local sysroot=
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	local ldso=$(basename "${ED}${sysroot}"/lib/ld-musl-*)
+	dosym -r "${sysroot}/lib/${ldso}" "${sysroot}/usr/bin/ldd"
+
+	if ! use crypt ; then
+		# Allow sys-libs/libxcrypt[system] to provide it instead
+		rm "${ED}${sysroot}/usr/include/crypt.h" || die
+		rm "${ED}${sysroot}"/usr/*/libcrypt.a || die
+	fi
+
+	if ! is_crosspkg ; then
+		# Fish out of config:
+		#   ARCH = ...
+		#   SUBARCH = ...
+		# and print $(ARCH)$(SUBARCH).
+		local arch=$(awk '{ k[$1] = $3 } END { printf("%s%s", k["ARCH"], k["SUBARCH"]); }' config.mak)
+
+		# The musl build system seems to create a symlink:
+		# ${D}/lib/ld-musl-${arch}.so.1 -> /usr/lib/libc.so.1 (absolute)
+		# During cross or within prefix, there's no guarantee that the host is
+		# using musl so that file may not exist. Use a relative symlink within
+		# ${D} instead.
+		rm "${ED}"/lib/ld-musl-${arch}.so.1 || die
+		if use split-usr; then
+			dosym ../usr/lib/libc.so /lib/ld-musl-${arch}.so.1
+			# If it's still a dead symlink, OK, we really do need to abort.
+			[[ -e "${ED}"/lib/ld-musl-${arch}.so.1 ]] || die
+		else
+			dosym libc.so /usr/lib/ld-musl-${arch}.so.1
+			[[ -e "${ED}"/usr/lib/ld-musl-${arch}.so.1 ]] || die
+		fi
+
+		cp "${FILESDIR}"/ldconfig.in-r3 "${T}"/ldconfig.in || die
+		sed -e "s|@@ARCH@@|${arch}|" "${T}"/ldconfig.in > "${T}"/ldconfig || die
+		eprefixify "${T}"/ldconfig
+		into /
+		dosbin "${T}"/ldconfig
+		into /usr
+		dobin "${T}"/getconf
+		dobin "${T}"/getent
+		dobin "${T}"/iconv
+		newenvd - "00musl" <<-EOF
+		# 00musl autogenerated by sys-libs/musl ebuild; DO NOT EDIT.
+		LDPATH="include ld.so.conf.d/*.conf"
+		EOF
+	fi
+
+	if target_is_not_host ; then
+		into /usr/${CTARGET}
+		dolib.a libssp_nonshared.a
+	else
+		dolib.a libssp_nonshared.a
+	fi
+}
+
+pkg_preinst() {
+	# nothing to do if just installing headers
+	just_headers && return
+
+	# prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+}
+
+pkg_postinst() {
+	target_is_not_host && return 0
+
+	[ -n "${ROOT}" ] && return 0
+
+	ldconfig || die
+}
diff --git a/sys-libs/musl/musl-1.2.5-r3.ebuild b/sys-libs/musl/musl-1.2.5-r3.ebuild
new file mode 100644
index 000000000000..3542edd7d83d
--- /dev/null
+++ b/sys-libs/musl/musl-1.2.5-r3.ebuild
@@ -0,0 +1,210 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit crossdev flag-o-matic toolchain-funcs prefix
+
+DESCRIPTION="Light, fast and, simple C library focused on standards-conformance and safety"
+HOMEPAGE="https://musl.libc.org"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.musl-libc.org/git/musl"
+	inherit git-r3
+else
+	VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/musl.asc
+	inherit verify-sig
+
+	SRC_URI="https://musl.libc.org/releases/${P}.tar.gz"
+	SRC_URI+=" verify-sig? ( https://musl.libc.org/releases/${P}.tar.gz.asc )"
+	KEYWORDS="-* amd64 ~arm ~arm64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~x86"
+
+	BDEPEND="verify-sig? ( sec-keys/openpgp-keys-musl )"
+fi
+
+GETENT_COMMIT="93a08815f8598db442d8b766b463d0150ed8e2ab"
+GETENT_FILE="musl-getent-${GETENT_COMMIT}.c"
+SRC_URI+="
+	https://dev.gentoo.org/~blueness/musl-misc/getconf.c
+	https://gitlab.alpinelinux.org/alpine/aports/-/raw/${GETENT_COMMIT}/main/musl/getent.c -> ${GETENT_FILE}
+	https://dev.gentoo.org/~blueness/musl-misc/iconv.c
+"
+
+LICENSE="MIT LGPL-2 GPL-2"
+SLOT="0"
+IUSE="crypt headers-only split-usr"
+
+QA_SONAME="usr/lib/libc.so"
+QA_DT_NEEDED="usr/lib/libc.so"
+# bug #830213
+QA_PRESTRIPPED="usr/lib/crtn.o"
+
+# We want crypt on by default for this as sys-libs/libxcrypt isn't (yet?)
+# built as part as crossdev. Also, elide the blockers when in cross-*,
+# as it doesn't make sense to block the normal CBUILD libxcrypt at all
+# there when we're installing into /usr/${CHOST} anyway.
+if is_crosspkg ; then
+	IUSE="${IUSE/crypt/+crypt}"
+else
+	RDEPEND="crypt? ( !sys-libs/libxcrypt[system] )"
+	PDEPEND="!crypt? ( sys-libs/libxcrypt[system] )"
+fi
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.2.4-arm64-crti-alignment.patch
+	"${FILESDIR}"/${PN}-sched.h-reduce-namespace-conflicts.patch
+	"${FILESDIR}"/${PN}-iconv-out-of-bound-fix.patch
+)
+
+just_headers() {
+	use headers-only && target_is_not_host
+}
+
+pkg_setup() {
+	if [[ ${CTARGET} == ${CHOST} ]] ; then
+		case ${CHOST} in
+			*-musl*) ;;
+			*) die "Use sys-devel/crossdev to build a musl toolchain" ;;
+		esac
+	fi
+
+	# Fix for bug #667126, copied from glibc ebuild:
+	# make sure host make.conf doesn't pollute us
+	if target_is_not_host || tc-is-cross-compiler ; then
+		CHOST=${CTARGET} strip-unsupported-flags
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	elif use verify-sig ; then
+		# We only verify the release; not the additional (fixed, safe) files
+		# we download.
+		# (Seem to get IPC error on verifying in cross?)
+		! target_is_not_host && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.gz{,.asc}
+	fi
+
+	default
+}
+
+src_prepare() {
+	default
+
+	mkdir "${WORKDIR}"/misc || die
+	cp "${DISTDIR}"/getconf.c "${WORKDIR}"/misc/getconf.c || die
+	cp "${DISTDIR}/${GETENT_FILE}" "${WORKDIR}"/misc/getent.c || die
+	cp "${DISTDIR}"/iconv.c "${WORKDIR}"/misc/iconv.c || die
+}
+
+src_configure() {
+	strip-flags && filter-lto # Prevent issues caused by aggressive optimizations & bug #877343
+	tc-getCC ${CTARGET}
+
+	just_headers && export CC=true
+
+	local sysroot
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	./configure \
+		--target=${CTARGET} \
+		--prefix="${EPREFIX}${sysroot}/usr" \
+		--syslibdir="${EPREFIX}${sysroot}/lib" \
+		--disable-gcc-wrapper || die
+}
+
+src_compile() {
+	emake obj/include/bits/alltypes.h
+	just_headers && return 0
+
+	emake
+	if ! is_crosspkg ; then
+		emake -C "${T}" getconf getent iconv \
+			CC="$(tc-getCC)" \
+			CFLAGS="${CFLAGS}" \
+			CPPFLAGS="${CPPFLAGS}" \
+			LDFLAGS="${LDFLAGS}" \
+			VPATH="${WORKDIR}/misc"
+	fi
+
+	$(tc-getCC) ${CPPFLAGS} ${CFLAGS} -c -o libssp_nonshared.o "${FILESDIR}"/stack_chk_fail_local.c || die
+	$(tc-getAR) -rcs libssp_nonshared.a libssp_nonshared.o || die
+}
+
+src_install() {
+	local target="install"
+	just_headers && target="install-headers"
+	emake DESTDIR="${D}" ${target}
+	just_headers && return 0
+
+	# musl provides ldd via a sym link to its ld.so
+	local sysroot=
+	target_is_not_host && sysroot=/usr/${CTARGET}
+	local ldso=$(basename "${ED}${sysroot}"/lib/ld-musl-*)
+	dosym -r "${sysroot}/lib/${ldso}" "${sysroot}/usr/bin/ldd"
+
+	if ! use crypt ; then
+		# Allow sys-libs/libxcrypt[system] to provide it instead
+		rm "${ED}${sysroot}/usr/include/crypt.h" || die
+		rm "${ED}${sysroot}"/usr/*/libcrypt.a || die
+	fi
+
+	if ! is_crosspkg ; then
+		# Fish out of config:
+		#   ARCH = ...
+		#   SUBARCH = ...
+		# and print $(ARCH)$(SUBARCH).
+		local arch=$(awk '{ k[$1] = $3 } END { printf("%s%s", k["ARCH"], k["SUBARCH"]); }' config.mak)
+
+		# The musl build system seems to create a symlink:
+		# ${D}/lib/ld-musl-${arch}.so.1 -> /usr/lib/libc.so.1 (absolute)
+		# During cross or within prefix, there's no guarantee that the host is
+		# using musl so that file may not exist. Use a relative symlink within
+		# ${D} instead.
+		rm "${ED}"/lib/ld-musl-${arch}.so.1 || die
+		if use split-usr; then
+			dosym ../usr/lib/libc.so /lib/ld-musl-${arch}.so.1
+			# If it's still a dead symlink, OK, we really do need to abort.
+			[[ -e "${ED}"/lib/ld-musl-${arch}.so.1 ]] || die
+		else
+			dosym libc.so /usr/lib/ld-musl-${arch}.so.1
+			[[ -e "${ED}"/usr/lib/ld-musl-${arch}.so.1 ]] || die
+		fi
+
+		cp "${FILESDIR}"/ldconfig.in-r3 "${T}"/ldconfig.in || die
+		sed -e "s|@@ARCH@@|${arch}|" "${T}"/ldconfig.in > "${T}"/ldconfig || die
+		eprefixify "${T}"/ldconfig
+		into /
+		dosbin "${T}"/ldconfig
+		into /usr
+		dobin "${T}"/getconf
+		dobin "${T}"/getent
+		dobin "${T}"/iconv
+		newenvd - "00musl" <<-EOF
+		# 00musl autogenerated by sys-libs/musl ebuild; DO NOT EDIT.
+		LDPATH="include ld.so.conf.d/*.conf"
+		EOF
+	fi
+
+	if target_is_not_host ; then
+		into /usr/${CTARGET}
+		dolib.a libssp_nonshared.a
+	else
+		dolib.a libssp_nonshared.a
+	fi
+}
+
+pkg_preinst() {
+	# Nothing to do if just installing headers
+	just_headers && return
+
+	# Prepare /etc/ld.so.conf.d/ for files
+	mkdir -p "${EROOT}"/etc/ld.so.conf.d
+}
+
+pkg_postinst() {
+	target_is_not_host && return 0
+
+	[[ -n "${ROOT}" ]] && return 0
+
+	ldconfig || die
+}