Merge updates from master

27 files changed, 2 insertions, 1994 deletions

diff --git a/app-crypt/mit-krb5/Manifest b/app-crypt/mit-krb5/Manifest
index 0911382bd22c..4b2ab0c10a3a 100644
--- a/app-crypt/mit-krb5/Manifest
+++ b/app-crypt/mit-krb5/Manifest
@@ -1,5 +1 @@
-DIST krb5-1.16.1.tar.gz 9477480 BLAKE2B 16bdd7d6d03ddbd4b070663c3a7a3d2331d54e8590b24f1dc162be2531bfbbbd65878d426a160c65ffc1ba4751f16bbbd177a8a91c01002fde0e886cc1bd91b9 SHA512 fa4ec14a4ffe690861e2dd7ea39d7698af2058ce181bb733ea891f80279f4dde4bb891adec5ccb0eaddf737306e6ceb1fe3744a2946e6189a7d7d2dd3bc5ba84
-DIST krb5-1.16.2.tar.gz 9652415 BLAKE2B 21c4d56e43476a9b87a4ca9a8b7d0dd5739d3d70731fb4727de5ae248d8638e2016581cd2462f5e2ec7950d9e216aa165199505e581fa10db81ce26062fc097e SHA512 738c071a90e0f38680bb17bdcf950310bc4549f3cb851e1d34de11239ae88178e6ee1a5e5d48c6d3efef544339b07d22dba5347dd763a4266d8d4df7cf47afc9
-DIST krb5-1.16.3.tar.gz 9656985 BLAKE2B 92e6d2b5f27e80f495d7bb3fb64acfb03530156fb8e1a07dbc8d045616fd2ac4be8047d844580e3aa01d5e8b733ceea9024290dcc53b691696201f02a31e3034 SHA512 77da5f8bb19108e158c3df5a17b9141b7cbbae7d01f9f0dca5c504dc4b468953d67a1f4566bed5a062d8ff8e0d80796094dea12d2e45bdda810a1633bb08318d
-DIST krb5-1.16.tar.gz 9474479 BLAKE2B 0c5caa0a0d2308a447d47ab94d7b8dc92a67ad78b3bac1678c3f3ece3905f27feda5a23d28b3c13ebd64d1760726888c759fb19da82ad960c6f84a433b753873 SHA512 7e162467b95dad2b6aaa11686d08a00f1cc4eb08247fca8f0e5a8bcaa5f9f7b42cdf00db69c5c6111bdf9eb8063d53cef3bb207ce5d6a287615ca10b710153f9
 DIST krb5-1.17.tar.gz 8761763 BLAKE2B 76f636836c67e9eefca91c9417118efdcf4437c1220691f43f3d246daf3eabd53b40a30956f0e57703c3fde5d7193b1d86b68becf3ae1c0c803d2462e79d3014 SHA512 7462a578b936bd17f155a362dbb5d388e157a80a096549028be6c55400b11361c7f8a28e424fd5674801873651df4e694d536cae66728b7ae5e840e532358c52
diff --git a/app-crypt/mit-krb5/files/CVE-2018-5729-5730.patch b/app-crypt/mit-krb5/files/CVE-2018-5729-5730.patch
deleted file mode 100644
index 114cfe688e73..000000000000
--- a/app-crypt/mit-krb5/files/CVE-2018-5729-5730.patch
+++ /dev/null
@@ -1,297 +0,0 @@
-diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
-index 2420f2c2be..a59a65e8f6 100644
---- a/src/lib/kadm5/srv/svr_principal.c
-+++ b/src/lib/kadm5/srv/svr_principal.c
-@@ -330,6 +330,13 @@ kadm5_create_principal_3(void *server_handle,
-         return KADM5_BAD_MASK;
-     if((mask & ~ALL_PRINC_MASK))
-         return KADM5_BAD_MASK;
-+    if (mask & KADM5_TL_DATA) {
-+        for (tl_data_tail = entry->tl_data; tl_data_tail != NULL;
-+             tl_data_tail = tl_data_tail->tl_data_next) {
-+            if (tl_data_tail->tl_data_type < 256)
-+                return KADM5_BAD_TL_TYPE;
-+        }
-+    }
- 
-     /*
-      * Check to see if the principal exists
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
-index 535a1f309e..8b8420faa9 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
-@@ -141,7 +141,7 @@ extern int set_ldap_error (krb5_context ctx, int st, int op);
- #define UNSTORE16_INT(ptr, val) (val = load_16_be(ptr))
- #define UNSTORE32_INT(ptr, val) (val = load_32_be(ptr))
- 
--#define  KDB_TL_USER_INFO      0x7ffe
-+#define  KDB_TL_USER_INFO      0xff
- 
- #define KDB_TL_PRINCTYPE          0x01
- #define KDB_TL_PRINCCOUNT         0x02
-diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-index 88a1704950..b7c9212cb2 100644
---- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
-@@ -651,6 +651,107 @@ update_ldap_mod_auth_ind(krb5_context context, krb5_db_entry *entry,
-     return ret;
- }
- 
-+static krb5_error_code
-+check_dn_in_container(krb5_context context, const char *dn,
-+                      char *const *subtrees, unsigned int ntrees)
-+{
-+    unsigned int i;
-+    size_t dnlen = strlen(dn), stlen;
-+
-+    for (i = 0; i < ntrees; i++) {
-+        if (subtrees[i] == NULL || *subtrees[i] == '\0')
-+            return 0;
-+        stlen = strlen(subtrees[i]);
-+        if (dnlen >= stlen &&
-+            strcasecmp(dn + dnlen - stlen, subtrees[i]) == 0 &&
-+            (dnlen == stlen || dn[dnlen - stlen - 1] == ','))
-+            return 0;
-+    }
-+
-+    k5_setmsg(context, EINVAL, _("DN is out of the realm subtree"));
-+    return EINVAL;
-+}
-+
-+static krb5_error_code
-+check_dn_exists(krb5_context context,
-+                krb5_ldap_server_handle *ldap_server_handle,
-+                const char *dn, krb5_boolean nonkrb_only)
-+{
-+    krb5_error_code st = 0, tempst;
-+    krb5_ldap_context *ldap_context = context->dal_handle->db_context;
-+    LDAP *ld = ldap_server_handle->ldap_handle;
-+    LDAPMessage *result = NULL, *ent;
-+    char *attrs[] = { "krbticketpolicyreference", "krbprincipalname", NULL };
-+    char **values;
-+
-+    LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attrs, IGNORE_STATUS);
-+    if (st != LDAP_SUCCESS)
-+        return set_ldap_error(context, st, OP_SEARCH);
-+
-+    ent = ldap_first_entry(ld, result);
-+    CHECK_NULL(ent);
-+
-+    values = ldap_get_values(ld, ent, "krbticketpolicyreference");
-+    if (values != NULL)
-+        ldap_value_free(values);
-+
-+    values = ldap_get_values(ld, ent, "krbprincipalname");
-+    if (values != NULL) {
-+        ldap_value_free(values);
-+        if (nonkrb_only) {
-+            st = EINVAL;
-+            k5_setmsg(context, st, _("ldap object is already kerberized"));
-+            goto cleanup;
-+        }
-+    }
-+
-+cleanup:
-+    ldap_msgfree(result);
-+    return st;
-+}
-+
-+static krb5_error_code
-+validate_xargs(krb5_context context,
-+               krb5_ldap_server_handle *ldap_server_handle,
-+               const xargs_t *xargs, const char *standalone_dn,
-+               char *const *subtrees, unsigned int ntrees)
-+{
-+    krb5_error_code st;
-+
-+    if (xargs->dn != NULL) {
-+        /* The supplied dn must be within a realm container. */
-+        st = check_dn_in_container(context, xargs->dn, subtrees, ntrees);
-+        if (st)
-+            return st;
-+        /* The supplied dn must exist without Kerberos attributes. */
-+        st = check_dn_exists(context, ldap_server_handle, xargs->dn, TRUE);
-+        if (st)
-+            return st;
-+    }
-+
-+    if (xargs->linkdn != NULL) {
-+        /* The supplied linkdn must be within a realm container. */
-+        st = check_dn_in_container(context, xargs->linkdn, subtrees, ntrees);
-+        if (st)
-+            return st;
-+        /* The supplied linkdn must exist. */
-+        st = check_dn_exists(context, ldap_server_handle, xargs->linkdn,
-+                             FALSE);
-+        if (st)
-+            return st;
-+    }
-+
-+    if (xargs->containerdn != NULL && standalone_dn != NULL) {
-+        /* standalone_dn (likely composed using containerdn) must be within a
-+         * container. */
-+        st = check_dn_in_container(context, standalone_dn, subtrees, ntrees);
-+        if (st)
-+            return st;
-+    }
-+
-+    return 0;
-+}
-+
- krb5_error_code
- krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
-                         char **db_args)
-@@ -662,12 +763,12 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
-     LDAPMessage                 *result=NULL, *ent=NULL;
-     char                        **subtreelist = NULL;
-     char                        *user=NULL, *subtree=NULL, *principal_dn=NULL;
--    char                        **values=NULL, *strval[10]={NULL}, errbuf[1024];
-+    char                        *strval[10]={NULL}, errbuf[1024];
-     char                        *filtuser=NULL;
-     struct berval               **bersecretkey=NULL;
-     LDAPMod                     **mods=NULL;
-     krb5_boolean                create_standalone=FALSE;
--    krb5_boolean                krb_identity_exists=FALSE, establish_links=FALSE;
-+    krb5_boolean                establish_links=FALSE;
-     char                        *standalone_principal_dn=NULL;
-     krb5_tl_data                *tl_data=NULL;
-     krb5_key_data               **keys=NULL;
-@@ -860,24 +961,6 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
-      * any of the subtrees
-      */
-     if (xargs.dn_from_kbd == TRUE) {
--        /* make sure the DN falls in the subtree */
--        int              dnlen=0, subtreelen=0;
--        char             *dn=NULL;
--        krb5_boolean     outofsubtree=TRUE;
--
--        if (xargs.dn != NULL) {
--            dn = xargs.dn;
--        } else if (xargs.linkdn != NULL) {
--            dn = xargs.linkdn;
--        } else if (standalone_principal_dn != NULL) {
--            /*
--             * Even though the standalone_principal_dn is constructed
--             * within this function, there is the containerdn input
--             * from the user that can become part of the it.
--             */
--            dn = standalone_principal_dn;
--        }
--
-         /* Get the current subtree list if we haven't already done so. */
-         if (subtreelist == NULL) {
-             st = krb5_get_subtree_info(ldap_context, &subtreelist, &ntrees);
-@@ -885,81 +968,10 @@ krb5_ldap_put_principal(krb5_context context, krb5_db_entry *entry,
-                 goto cleanup;
-         }
- 
--        for (tre=0; tre<ntrees; ++tre) {
--            if (subtreelist[tre] == NULL || strlen(subtreelist[tre]) == 0) {
--                outofsubtree = FALSE;
--                break;
--            } else {
--                dnlen = strlen (dn);
--                subtreelen = strlen(subtreelist[tre]);
--                if ((dnlen >= subtreelen) && (strcasecmp((dn + dnlen - subtreelen), subtreelist[tre]) == 0)) {
--                    outofsubtree = FALSE;
--                    break;
--                }
--            }
--        }
--
--        if (outofsubtree == TRUE) {
--            st = EINVAL;
--            k5_setmsg(context, st, _("DN is out of the realm subtree"));
-+        st = validate_xargs(context, ldap_server_handle, &xargs,
-+                            standalone_principal_dn, subtreelist, ntrees);
-+        if (st)
-             goto cleanup;
--        }
--
--        /*
--         * dn value will be set either by dn, linkdn or the standalone_principal_dn
--         * In the first 2 cases, the dn should be existing and in the last case we
--         * are supposed to create the ldap object. so the below should not be
--         * executed for the last case.
--         */
--
--        if (standalone_principal_dn == NULL) {
--            /*
--             * If the ldap object is missing, this results in an error.
--             */
--
--            /*
--             * Search for krbprincipalname attribute here.
--             * This is to find if a kerberos identity is already present
--             * on the ldap object, in which case adding a kerberos identity
--             * on the ldap object should result in an error.
--             */
--            char  *attributes[]={"krbticketpolicyreference", "krbprincipalname", NULL};
--
--            ldap_msgfree(result);
--            result = NULL;
--            LDAP_SEARCH_1(dn, LDAP_SCOPE_BASE, 0, attributes, IGNORE_STATUS);
--            if (st == LDAP_SUCCESS) {
--                ent = ldap_first_entry(ld, result);
--                if (ent != NULL) {
--                    if ((values=ldap_get_values(ld, ent, "krbticketpolicyreference")) != NULL) {
--                        ldap_value_free(values);
--                    }
--
--                    if ((values=ldap_get_values(ld, ent, "krbprincipalname")) != NULL) {
--                        krb_identity_exists = TRUE;
--                        ldap_value_free(values);
--                    }
--                }
--            } else {
--                st = set_ldap_error(context, st, OP_SEARCH);
--                goto cleanup;
--            }
--        }
--    }
--
--    /*
--     * If xargs.dn is set then the request is to add a
--     * kerberos principal on a ldap object, but if
--     * there is one already on the ldap object this
--     * should result in an error.
--     */
--
--    if (xargs.dn != NULL && krb_identity_exists == TRUE) {
--        st = EINVAL;
--        snprintf(errbuf, sizeof(errbuf),
--                 _("ldap object is already kerberized"));
--        k5_setmsg(context, st, "%s", errbuf);
--        goto cleanup;
-     }
- 
-     if (xargs.linkdn != NULL) {
-diff --git a/src/tests/t_kdb.py b/src/tests/t_kdb.py
-index 217f2cdc3b..6e563b1032 100755
---- a/src/tests/t_kdb.py
-+++ b/src/tests/t_kdb.py
-@@ -203,6 +203,12 @@ def ldap_add(dn, objectclass, attrs=[]):
- # in the test LDAP server.
- realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=krb5', 'princ1'],
-           expected_code=1, expected_msg='DN is out of the realm subtree')
-+# Check that the DN container check is a hierarchy test, not a simple
-+# suffix match (CVE-2018-5730).  We expect this operation to fail
-+# either way (because "xcn" isn't a valid DN tag) but the container
-+# check should happen before the DN is parsed.
-+realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=xcn=t1,cn=krb5', 'princ1'],
-+          expected_code=1, expected_msg='DN is out of the realm subtree')
- realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'princ1'])
- realm.run([kadminl, 'getprinc', 'princ1'], expected_msg='Principal: princ1')
- realm.run([kadminl, 'ank', '-randkey', '-x', 'dn=cn=t2,cn=krb5', 'again'],
-@@ -226,6 +232,11 @@ def ldap_add(dn, objectclass, attrs=[]):
-            'princ3'])
- realm.run([kadminl, 'modprinc', '-x', 'containerdn=cn=t2,cn=krb5', 'princ3'],
-           expected_code=1, expected_msg='containerdn option not supported')
-+# Verify that containerdn is checked when linkdn is also supplied
-+# (CVE-2018-5730).
-+realm.run([kadminl, 'ank', '-randkey', '-x', 'containerdn=cn=krb5',
-+           '-x', 'linkdn=cn=t2,cn=krb5', 'princ4'], expected_code=1,
-+          expected_msg='DN is out of the realm subtree')
- 
- # Create and modify a ticket policy.
- kldaputil(['create_policy', '-maxtktlife', '3hour', '-maxrenewlife', '6hour',
diff --git a/app-crypt/mit-krb5/files/mit-krb5-1.16.3-libressl.patch b/app-crypt/mit-krb5/files/mit-krb5-1.16.3-libressl.patch
deleted file mode 100644
index 7a655fb9a1d8..000000000000
--- a/app-crypt/mit-krb5/files/mit-krb5-1.16.3-libressl.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From 58263cbf3106f4c9c9a2252794093014a2f9c01f Mon Sep 17 00:00:00 2001
-From: Stefan Strogin <stefan.strogin@gmail.com>
-Date: Thu, 25 Apr 2019 03:48:10 +0300
-Subject: [PATCH] Fix build for LibreSSL 2.9.x
-
-asn1_mac.h is removed from LibreSSL 2.9.0, but static_ASN1_*() methods
-are not defined. Define them.
-
-Upstream-Status: Pending
-[Needs to be amended if
-https://github.com/libressl-portable/openbsd/pull/109 is accepted]
-Signed-off-by: Stefan Strogin <stefan.strogin@gmail.com>
----
- .../preauth/pkinit/pkinit_crypto_openssl.c    | 13 ++++++++----
- .../preauth/pkinit/pkinit_crypto_openssl.h    | 20 ++++++++++++++++++-
- 2 files changed, 28 insertions(+), 5 deletions(-)
-
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-index 2064eb7bd..81d5d3cf2 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -188,14 +188,16 @@ pkinit_pkcs11_code_to_text(int err);
-     (*_x509_pp) = PKCS7_cert_from_signer_info(_p7,_si)
- #endif
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 
--/* 1.1 standardizes constructor and destructor names, renaming
-- * EVP_MD_CTX_{create,destroy} and deprecating ASN1_STRING_data. */
-+/* 1.1 (and LibreSSL 2.7) standardizes constructor and destructor names,
-+ * renaming EVP_MD_CTX_{create,destroy} and deprecating ASN1_STRING_data. */
- 
-+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x2070000fL
- #define EVP_MD_CTX_new EVP_MD_CTX_create
- #define EVP_MD_CTX_free EVP_MD_CTX_destroy
- #define ASN1_STRING_get0_data ASN1_STRING_data
-+#endif
- 
- /* 1.1 makes many handle types opaque and adds accessors.  Add compatibility
-  * versions of the new accessors we use for pre-1.1. */
-@@ -203,6 +205,7 @@ pkinit_pkcs11_code_to_text(int err);
- #define OBJ_get0_data(o) ((o)->data)
- #define OBJ_length(o) ((o)->length)
- 
-+#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x2070000fL
- #define DH_set0_pqg compat_dh_set0_pqg
- static int compat_dh_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
- {
-@@ -235,6 +238,7 @@ static void compat_dh_get0_key(const DH *dh, const BIGNUM **pub,
-     if (priv != NULL)
-         *priv = dh->priv_key;
- }
-+#endif /* LIBRESSL_VERSION_NUMBER */
- 
- /* Return true if the cert c includes a key usage which doesn't include u.
-  * Define using direct member access for pre-1.1. */
-@@ -3040,7 +3044,8 @@ cleanup:
-     return retval;
- }
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || \
-+  LIBRESSL_VERSION_NUMBER >= 0x2090000fL
- 
- /*
-  * We need to decode DomainParameters from RFC 3279 section 2.3.3.  We would
-diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
-index 7411348fa..ac91408c4 100644
---- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
-+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
-@@ -46,7 +46,25 @@
- #include <openssl/asn1.h>
- #include <openssl/pem.h>
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || \
-+  LIBRESSL_VERSION_NUMBER >= 0x2090000fL
-+
-+#ifndef static_ASN1_SEQUENCE_END_name
-+#define static_ASN1_ITEM_start(itname) \
-+	static const ASN1_ITEM itname##_it = {
-+#define static_ASN1_SEQUENCE_END_name(stname, tname) \
-+	;\
-+	static_ASN1_ITEM_start(tname) \
-+		ASN1_ITYPE_SEQUENCE,\
-+		V_ASN1_SEQUENCE,\
-+		tname##_seq_tt,\
-+		sizeof(tname##_seq_tt) / sizeof(ASN1_TEMPLATE),\
-+		NULL,\
-+		sizeof(stname),\
-+		#stname \
-+	ASN1_ITEM_end(tname)
-+#endif /* !defined(static_ASN1_SEQUENCE_END_name) */
-+
- #include <openssl/asn1t.h>
- #else
- #include <openssl/asn1_mac.h>
--- 
-2.21.0
-
diff --git a/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS.patch b/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS.patch
deleted file mode 100644
index 8490e629a377..000000000000
--- a/app-crypt/mit-krb5/files/mit-krb5-config_LDFLAGS.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-Bug #448778
---- a/src/build-tools/krb5-config.in	2012-12-18 02:47:04.000000000 +0000
-+++ b/src/build-tools/krb5-config.in	2012-12-28 07:13:16.582693363 +0000
-@@ -217,7 +217,7 @@
- 	    -e 's#\$(PROG_RPATH)#'$libdir'#' \
- 	    -e 's#\$(PROG_LIBPATH)#'$libdirarg'#' \
- 	    -e 's#\$(RPATH_FLAG)#'"$RPATH_FLAG"'#' \
--	    -e 's#\$(LDFLAGS)#'"$LDFLAGS"'#' \
-+	    -e 's#\$(LDFLAGS)##' \
- 	    -e 's#\$(PTHREAD_CFLAGS)#'"$PTHREAD_CFLAGS"'#' \
- 	    -e 's#\$(CFLAGS)##'`
- 
diff --git a/app-crypt/mit-krb5/files/mit-krb5-libressl-version-check.patch b/app-crypt/mit-krb5/files/mit-krb5-libressl-version-check.patch
deleted file mode 100644
index 5c979cfd1ef7..000000000000
--- a/app-crypt/mit-krb5/files/mit-krb5-libressl-version-check.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-+++ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -191,7 +191,7 @@ pkinit_pkcs11_code_to_text(int err);
-     (*_x509_pp) = PKCS7_cert_from_signer_info(_p7,_si)
- #endif
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 
- /* 1.1 standardizes constructor and destructor names, renaming
-  * EVP_MD_CTX_{create,destroy} and deprecating ASN1_STRING_data. */
-@@ -3059,7 +3059,7 @@ cleanup:
-     return retval;
- }
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- 
- /*
-  * We need to decode DomainParameters from RFC 3279 section 2.3.3.  We would
---- src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
-+++ src/plugins/preauth/pkinit/pkinit_crypto_openssl.h
-@@ -46,7 +46,7 @@
- #include <openssl/asn1.h>
- #include <openssl/pem.h>
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- #include <openssl/asn1t.h>
- #else
- #include <openssl/asn1_mac.h>
diff --git a/app-crypt/mit-krb5/mit-krb5-1.16-r2.ebuild b/app-crypt/mit-krb5/mit-krb5-1.16-r2.ebuild
deleted file mode 100644
index 1953c395599b..000000000000
--- a/app-crypt/mit-krb5/mit-krb5-1.16-r2.ebuild
+++ /dev/null
@@ -1,154 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-PYTHON_COMPAT=( python2_7 )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd versionator
-
-MY_P="${P/mit-}"
-P_DIR=$(get_version_component_range 1-2)
-DESCRIPTION="MIT Kerberos V"
-HOMEPAGE="https://web.mit.edu/kerberos/www/"
-SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
-
-LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 s390 ~sh sparc x86"
-IUSE="doc +keyutils libressl nls openldap +pkinit selinux +threads test xinetd"
-
-# Test suite require network access
-RESTRICT="test"
-
-CDEPEND="
-	!!app-crypt/heimdal
-	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
-	|| (
-		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
-	)
-	keyutils? ( >=sys-apps/keyutils-1.5.8[${MULTILIB_USEDEP}] )
-	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
-	pkinit? (
-		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-		libressl? ( dev-libs/libressl[${MULTILIB_USEDEP}] )
-	)
-	xinetd? ( sys-apps/xinetd )"
-DEPEND="${CDEPEND}
-	${PYTHON_DEPS}
-	virtual/yacc
-	doc? ( virtual/latex-base )
-	test? (
-		${PYTHON_DEPS}
-		dev-lang/tcl:0
-		dev-util/dejagnu
-	)"
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-kerberos )"
-
-S=${WORKDIR}/${MY_P}/src
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/krb5-config
-)
-
-src_prepare() {
-	eapply -p2 "${FILESDIR}/CVE-2018-5729-5730.patch"
-	eapply "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
-	eapply -p2 "${FILESDIR}/${PN}-config_LDFLAGS.patch"
-	eapply "${FILESDIR}/${PN}-libressl-version-check.patch"
-
-	# Make sure we always use the system copies.
-	rm -rf util/{et,ss,verto}
-	sed -i 's:^[[:space:]]*util/verto$::' configure.in || die
-
-	eapply_user
-	eautoreconf
-}
-
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use keyutils || export ac_cv_header_keyutils_h=no
-	ECONF_SOURCE=${S} \
-	WARN_CFLAGS="set" \
-	econf \
-		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
-		$(use_enable nls) \
-		$(use_enable pkinit) \
-		$(use_enable threads thread-support) \
-		--without-hesiod \
-		--enable-shared \
-		--with-system-et \
-		--with-system-ss \
-		--enable-dns-for-realm \
-		--enable-kdc-lookaside-cache \
-		--with-system-verto \
-		--disable-rpath
-}
-
-multilib_src_compile() {
-	emake -j1
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && emake -j1 check
-}
-
-multilib_src_install() {
-	emake \
-		DESTDIR="${D}" \
-		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
-		install
-}
-
-multilib_src_install_all() {
-	# default database dir
-	keepdir /var/lib/krb5kdc
-
-	cd ..
-	dodoc README
-
-	if use doc; then
-		dodoc -r doc/html
-		docinto pdf
-		dodoc doc/pdf/*.pdf
-	fi
-
-	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
-	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
-	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
-	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
-	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
-	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
-
-	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
-
-	insinto /etc
-	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
-	insinto /var/lib/krb5kdc
-	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
-
-	if use openldap ; then
-		insinto /etc/openldap/schema
-		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}/kpropd.xinetd" kpropd
-	fi
-}
diff --git a/app-crypt/mit-krb5/mit-krb5-1.16.1.ebuild b/app-crypt/mit-krb5/mit-krb5-1.16.1.ebuild
deleted file mode 100644
index 6e6edde5000f..000000000000
--- a/app-crypt/mit-krb5/mit-krb5-1.16.1.ebuild
+++ /dev/null
@@ -1,153 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-PYTHON_COMPAT=( python2_7 )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd versionator
-
-MY_P="${P/mit-}"
-P_DIR=$(get_version_component_range 1-2)
-DESCRIPTION="MIT Kerberos V"
-HOMEPAGE="https://web.mit.edu/kerberos/www/"
-SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
-
-LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
-IUSE="doc +keyutils libressl nls openldap +pkinit selinux +threads test xinetd"
-
-# Test suite require network access
-RESTRICT="test"
-
-CDEPEND="
-	!!app-crypt/heimdal
-	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
-	|| (
-		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
-	)
-	keyutils? ( >=sys-apps/keyutils-1.5.8[${MULTILIB_USEDEP}] )
-	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
-	pkinit? (
-		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-		libressl? ( dev-libs/libressl[${MULTILIB_USEDEP}] )
-	)
-	xinetd? ( sys-apps/xinetd )"
-DEPEND="${CDEPEND}
-	${PYTHON_DEPS}
-	virtual/yacc
-	doc? ( virtual/latex-base )
-	test? (
-		${PYTHON_DEPS}
-		dev-lang/tcl:0
-		dev-util/dejagnu
-	)"
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-kerberos )"
-
-S=${WORKDIR}/${MY_P}/src
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/krb5-config
-)
-
-src_prepare() {
-	eapply "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
-	eapply -p2 "${FILESDIR}/${PN}-config_LDFLAGS.patch"
-	eapply "${FILESDIR}/${PN}-libressl-version-check.patch"
-
-	# Make sure we always use the system copies.
-	rm -rf util/{et,ss,verto}
-	sed -i 's:^[[:space:]]*util/verto$::' configure.in || die
-
-	eapply_user
-	eautoreconf
-}
-
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use keyutils || export ac_cv_header_keyutils_h=no
-	ECONF_SOURCE=${S} \
-	WARN_CFLAGS="set" \
-	econf \
-		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
-		$(use_enable nls) \
-		$(use_enable pkinit) \
-		$(use_enable threads thread-support) \
-		--without-hesiod \
-		--enable-shared \
-		--with-system-et \
-		--with-system-ss \
-		--enable-dns-for-realm \
-		--enable-kdc-lookaside-cache \
-		--with-system-verto \
-		--disable-rpath
-}
-
-multilib_src_compile() {
-	emake -j1
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && emake -j1 check
-}
-
-multilib_src_install() {
-	emake \
-		DESTDIR="${D}" \
-		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
-		install
-}
-
-multilib_src_install_all() {
-	# default database dir
-	keepdir /var/lib/krb5kdc
-
-	cd ..
-	dodoc README
-
-	if use doc; then
-		dodoc -r doc/html
-		docinto pdf
-		dodoc doc/pdf/*.pdf
-	fi
-
-	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
-	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
-	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
-	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
-	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
-	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
-
-	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
-
-	insinto /etc
-	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
-	insinto /var/lib/krb5kdc
-	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
-
-	if use openldap ; then
-		insinto /etc/openldap/schema
-		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}/kpropd.xinetd" kpropd
-	fi
-}
diff --git a/app-crypt/mit-krb5/mit-krb5-1.16.2.ebuild b/app-crypt/mit-krb5/mit-krb5-1.16.2.ebuild
deleted file mode 100644
index 75bb0cdbf0b0..000000000000
--- a/app-crypt/mit-krb5/mit-krb5-1.16.2.ebuild
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 1999-2018 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python2_7 )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd
-
-MY_P="${P/mit-}"
-P_DIR=$(ver_cut 1-2)
-DESCRIPTION="MIT Kerberos V"
-HOMEPAGE="https://web.mit.edu/kerberos/www/"
-SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
-
-LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
-IUSE="cpu_flags_x86_aes doc +keyutils libressl nls openldap +pkinit selinux +threads test xinetd"
-
-# Test suite require network access
-RESTRICT="test"
-
-CDEPEND="
-	!!app-crypt/heimdal
-	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
-	|| (
-		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
-	)
-	keyutils? ( >=sys-apps/keyutils-1.5.8[${MULTILIB_USEDEP}] )
-	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
-	pkinit? (
-		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-		libressl? ( dev-libs/libressl[${MULTILIB_USEDEP}] )
-	)
-	xinetd? ( sys-apps/xinetd )
-	"
-DEPEND="${CDEPEND}
-	${PYTHON_DEPS}
-	virtual/yacc
-	cpu_flags_x86_aes? (
-		amd64? ( dev-lang/yasm )
-		x86? ( dev-lang/yasm )
-	)
-	doc? ( virtual/latex-base )
-	test? (
-		${PYTHON_DEPS}
-		dev-lang/tcl:0
-		dev-util/dejagnu
-		dev-util/cmocka
-	)"
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-kerberos )"
-
-S=${WORKDIR}/${MY_P}/src
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/krb5-config
-)
-
-src_prepare() {
-	eapply "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
-	eapply -p2 "${FILESDIR}/${PN}-config_LDFLAGS.patch"
-	eapply "${FILESDIR}/${PN}-libressl-version-check.patch"
-
-	# Make sure we always use the system copies.
-	rm -rf util/{et,ss,verto}
-	sed -i 's:^[[:space:]]*util/verto$::' configure.in || die
-
-	eapply_user
-	eautoreconf
-}
-
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use keyutils || export ac_cv_header_keyutils_h=no
-	ECONF_SOURCE=${S} \
-	WARN_CFLAGS="set" \
-	econf \
-		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
-		$(use_enable nls) \
-		$(use_enable pkinit) \
-		$(use_enable threads thread-support) \
-		--without-hesiod \
-		--enable-shared \
-		--with-system-et \
-		--with-system-ss \
-		--enable-dns-for-realm \
-		--enable-kdc-lookaside-cache \
-		--with-system-verto \
-		--disable-rpath
-}
-
-multilib_src_compile() {
-	emake -j1
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && emake -j1 check
-}
-
-multilib_src_install() {
-	emake \
-		DESTDIR="${D}" \
-		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
-		install
-}
-
-multilib_src_install_all() {
-	# default database dir
-	keepdir /var/lib/krb5kdc
-
-	rmdir "${ED}"/var/lib/{run/krb5kdc,run}
-
-	cd ..
-	dodoc README
-
-	if use doc; then
-		dodoc -r doc/html
-		docinto pdf
-		dodoc doc/pdf/*.pdf
-	fi
-
-	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
-	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
-	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
-	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
-	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
-	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
-
-	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
-
-	insinto /etc
-	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
-	insinto /var/lib/krb5kdc
-	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
-
-	if use openldap ; then
-		insinto /etc/openldap/schema
-		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}/kpropd.xinetd" kpropd
-	fi
-}
diff --git a/app-crypt/mit-krb5/mit-krb5-1.16.3.ebuild b/app-crypt/mit-krb5/mit-krb5-1.16.3.ebuild
deleted file mode 100644
index 9d8b99116396..000000000000
--- a/app-crypt/mit-krb5/mit-krb5-1.16.3.ebuild
+++ /dev/null
@@ -1,161 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-PYTHON_COMPAT=( python2_7 )
-inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd
-
-MY_P="${P/mit-}"
-P_DIR=$(ver_cut 1-2)
-DESCRIPTION="MIT Kerberos V"
-HOMEPAGE="https://web.mit.edu/kerberos/www/"
-SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
-
-LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86"
-IUSE="cpu_flags_x86_aes doc +keyutils libressl nls openldap +pkinit selinux +threads test xinetd"
-
-# Test suite require network access
-#RESTRICT="test"
-
-CDEPEND="
-	!!app-crypt/heimdal
-	>=sys-libs/e2fsprogs-libs-1.42.9[${MULTILIB_USEDEP}]
-	|| (
-		>=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}]
-		>=dev-libs/libverto-0.2.5[tevent,${MULTILIB_USEDEP}]
-	)
-	keyutils? ( >=sys-apps/keyutils-1.5.8[${MULTILIB_USEDEP}] )
-	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
-	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
-	pkinit? (
-		!libressl? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
-		libressl? ( dev-libs/libressl:0=[${MULTILIB_USEDEP}] )
-	)
-	xinetd? ( sys-apps/xinetd )
-	"
-DEPEND="${CDEPEND}
-	${PYTHON_DEPS}
-	virtual/yacc
-	cpu_flags_x86_aes? (
-		amd64? ( dev-lang/yasm )
-		x86? ( dev-lang/yasm )
-	)
-	doc? ( virtual/latex-base )
-	test? (
-		${PYTHON_DEPS}
-		dev-lang/tcl:0
-		dev-util/dejagnu
-		dev-util/cmocka
-	)"
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-kerberos )"
-
-S=${WORKDIR}/${MY_P}/src
-
-MULTILIB_CHOST_TOOLS=(
-	/usr/bin/krb5-config
-)
-
-src_prepare() {
-	eapply "${FILESDIR}/${PN}-1.12_warn_cflags.patch"
-	eapply -p2 "${FILESDIR}/${PN}-config_LDFLAGS.patch"
-	eapply -p2 "${FILESDIR}/${P}-libressl.patch"
-
-	# Make sure we always use the system copies.
-	rm -rf util/{et,ss,verto}
-	sed -i 's:^[[:space:]]*util/verto$::' configure.in || die
-
-	eapply_user
-	eautoreconf
-}
-
-src_configure() {
-	# QA
-	append-flags -fno-strict-aliasing
-	append-flags -fno-strict-overflow
-
-	multilib-minimal_src_configure
-}
-
-multilib_src_configure() {
-	use keyutils || export ac_cv_header_keyutils_h=no
-	ECONF_SOURCE=${S} \
-	WARN_CFLAGS="set" \
-	econf \
-		$(use_with openldap ldap) \
-		"$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \
-		$(use_enable nls) \
-		$(use_enable pkinit) \
-		$(use_enable threads thread-support) \
-		--without-hesiod \
-		--enable-shared \
-		--with-system-et \
-		--with-system-ss \
-		--enable-dns-for-realm \
-		--enable-kdc-lookaside-cache \
-		--with-system-verto \
-		--disable-rpath
-}
-
-multilib_src_compile() {
-	emake -j1
-}
-
-multilib_src_test() {
-	multilib_is_native_abi && emake -j1 check
-}
-
-multilib_src_install() {
-	emake \
-		DESTDIR="${D}" \
-		EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \
-		install
-}
-
-multilib_src_install_all() {
-	# default database dir
-	keepdir /var/lib/krb5kdc
-
-	rmdir "${ED}"/var/lib/{run/krb5kdc,run}
-
-	cd ..
-	dodoc README
-
-	if use doc; then
-		dodoc -r doc/html
-		docinto pdf
-		dodoc doc/pdf/*.pdf
-	fi
-
-	newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind
-	newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc
-	newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd
-	newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind
-	newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc
-	newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd
-
-	systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service"
-	systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket
-
-	insinto /etc
-	newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example
-	insinto /var/lib/krb5kdc
-	newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example
-
-	if use openldap ; then
-		insinto /etc/openldap/schema
-		doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"
-	fi
-
-	if use xinetd ; then
-		insinto /etc/xinetd.d
-		newins "${FILESDIR}/kpropd.xinetd" kpropd
-	fi
-}
diff --git a/media-libs/mesa/Manifest b/media-libs/mesa/Manifest
index dbf972b76f10..6cd19c9a24ca 100644
--- a/media-libs/mesa/Manifest
+++ b/media-libs/mesa/Manifest
@@ -1,3 +1,2 @@
-DIST mesa-19.0.8.tar.xz 11967592 BLAKE2B 91a46b67bdb8cb3ab4c7337be7c2b0dc6ab5ec8cc126afc2d8af8d056bff0392a5b443c26304bf4c68472eb6ba16d29ca248c1fc0c0f2dd6af03d3e10d3ec1b3 SHA512 fbddc3a74f223564343027380af776b3fa5d63fe1af4e34121273235d1c6eced96439f601eb19bf658eb927aff3965b520f0329fcbd4650f3112167303e1746d
 DIST mesa-19.1.7.tar.xz 10941152 BLAKE2B 6be14ddac404668bdd8b7b8756388019c3610ac41b65a7723a419b97b7eccbca666ad6d904f4cde186c4b171e056636a8a6a5727e30963c8fa177d7861bd6cfb SHA512 0865b5f91e5daa00e1da2b3d8b65fe5d2ff6332372bf8fec7d671d05d8d64ec5a7abea1858cdfc506c76b7226d2bea0af3426565f156b796d8e0f949ea33dc15
 DIST mesa-19.2.0.tar.xz 11464180 BLAKE2B f2f260e9efb928532501ff4f1c0137621f954991ef6d30fbdc61c28fb95e3ddb9e81276d345bc7bff6871e603dcbb29073b788427d0dea565dfa9b7f8b88966d SHA512 7278bbfba9c29fe91d1959ff1a48422e917db85287460523d12ae8c6d7f49f76e9636bf4c0d8d7d89e5569b3c67135f1b23b8f6c9d52d39413d8ec22e3bb40f0
diff --git a/media-libs/mesa/mesa-19.0.8.ebuild b/media-libs/mesa/mesa-19.0.8.ebuild
deleted file mode 100644
index 67340d9d392b..000000000000
--- a/media-libs/mesa/mesa-19.0.8.ebuild
+++ /dev/null
@@ -1,525 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-PYTHON_COMPAT=( python3_5 python3_6 python3_7 )
-
-inherit llvm meson multilib-minimal pax-utils python-any-r1
-
-OPENGL_DIR="xorg-x11"
-
-MY_P="${P/_/-}"
-
-DESCRIPTION="OpenGL-like graphic library for Linux"
-HOMEPAGE="https://www.mesa3d.org/ https://mesa.freedesktop.org/"
-
-if [[ ${PV} == 9999 ]]; then
-	EGIT_REPO_URI="https://gitlab.freedesktop.org/mesa/mesa.git"
-	EXPERIMENTAL="true"
-	inherit git-r3
-else
-	SRC_URI="https://mesa.freedesktop.org/archive/${MY_P}.tar.xz"
-	KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 s390 ~sh sparc x86 ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~sparc-solaris ~x64-solaris ~x86-solaris"
-fi
-
-LICENSE="MIT"
-SLOT="0"
-RESTRICT="
-	!test? ( test )
-"
-
-RADEON_CARDS="r100 r200 r300 r600 radeon radeonsi"
-VIDEO_CARDS="${RADEON_CARDS} freedreno i915 i965 imx intel nouveau vc4 virgl vivante vmware"
-for card in ${VIDEO_CARDS}; do
-	IUSE_VIDEO_CARDS+=" video_cards_${card}"
-done
-
-IUSE="${IUSE_VIDEO_CARDS}
-	+classic d3d9 debug +dri3 +egl +gallium +gbm gles1 +gles2 +libglvnd +llvm
-	lm-sensors opencl osmesa pax_kernel pic selinux test unwind vaapi valgrind
-	vdpau vulkan wayland xa xvmc"
-
-REQUIRED_USE="
-	d3d9?   ( dri3 || ( video_cards_r300 video_cards_r600 video_cards_radeonsi video_cards_nouveau video_cards_vmware ) )
-	gles1?  ( egl )
-	gles2?  ( egl )
-	vulkan? ( dri3
-			  || ( video_cards_i965 video_cards_radeonsi )
-			  video_cards_radeonsi? ( llvm ) )
-	wayland? ( egl gbm )
-	video_cards_freedreno?  ( gallium )
-	video_cards_intel?  ( classic )
-	video_cards_i915?   ( || ( classic gallium ) )
-	video_cards_i965?   ( classic )
-	video_cards_imx?    ( gallium video_cards_vivante )
-	video_cards_nouveau? ( || ( classic gallium ) )
-	video_cards_radeon? ( || ( classic gallium )
-						  gallium? ( x86? ( llvm ) amd64? ( llvm ) ) )
-	video_cards_r100?   ( classic )
-	video_cards_r200?   ( classic )
-	video_cards_r300?   ( gallium x86? ( llvm ) amd64? ( llvm ) )
-	video_cards_r600?   ( gallium )
-	video_cards_radeonsi?   ( gallium llvm )
-	video_cards_vc4? ( gallium )
-	video_cards_virgl? ( gallium )
-	video_cards_vivante? ( gallium gbm )
-	video_cards_vmware? ( gallium )
-"
-
-LIBDRM_DEPSTRING=">=x11-libs/libdrm-2.4.97"
-RDEPEND="
-	!app-eselect/eselect-mesa
-	>=dev-libs/expat-2.1.0-r3:=[${MULTILIB_USEDEP}]
-	>=sys-libs/zlib-1.2.8[${MULTILIB_USEDEP}]
-	>=x11-libs/libX11-1.6.2:=[${MULTILIB_USEDEP}]
-	>=x11-libs/libxshmfence-1.1:=[${MULTILIB_USEDEP}]
-	>=x11-libs/libXdamage-1.1.4-r1:=[${MULTILIB_USEDEP}]
-	>=x11-libs/libXext-1.3.2:=[${MULTILIB_USEDEP}]
-	>=x11-libs/libXxf86vm-1.1.3:=[${MULTILIB_USEDEP}]
-	>=x11-libs/libxcb-1.13:=[${MULTILIB_USEDEP}]
-	x11-libs/libXfixes:=[${MULTILIB_USEDEP}]
-	libglvnd? (
-		media-libs/libglvnd[${MULTILIB_USEDEP}]
-		!app-eselect/eselect-opengl
-	)
-	!libglvnd? (
-		>=app-eselect/eselect-opengl-1.3.0
-	)
-	gallium? (
-		unwind? ( sys-libs/libunwind[${MULTILIB_USEDEP}] )
-		llvm? (
-			video_cards_radeonsi? (
-				virtual/libelf:0=[${MULTILIB_USEDEP}]
-			)
-			video_cards_r600? (
-				virtual/libelf:0=[${MULTILIB_USEDEP}]
-			)
-			video_cards_radeon? (
-				virtual/libelf:0=[${MULTILIB_USEDEP}]
-			)
-		)
-		lm-sensors? ( sys-apps/lm-sensors:=[${MULTILIB_USEDEP}] )
-		opencl? (
-					dev-libs/ocl-icd[khronos-headers,${MULTILIB_USEDEP}]
-					dev-libs/libclc
-					virtual/libelf:0=[${MULTILIB_USEDEP}]
-				)
-		vaapi? (
-			>=x11-libs/libva-1.7.3:=[${MULTILIB_USEDEP}]
-			video_cards_nouveau? ( !<=x11-libs/libva-vdpau-driver-0.7.4-r3 )
-		)
-		vdpau? ( >=x11-libs/libvdpau-1.1:=[${MULTILIB_USEDEP}] )
-		xvmc? ( >=x11-libs/libXvMC-1.0.8:=[${MULTILIB_USEDEP}] )
-	)
-	wayland? (
-		>=dev-libs/wayland-1.15.0:=[${MULTILIB_USEDEP}]
-		>=dev-libs/wayland-protocols-1.8
-	)
-	${LIBDRM_DEPSTRING}[video_cards_freedreno?,video_cards_nouveau?,video_cards_vc4?,video_cards_vivante?,video_cards_vmware?,${MULTILIB_USEDEP}]
-
-	video_cards_intel? (
-		!video_cards_i965? ( ${LIBDRM_DEPSTRING}[video_cards_intel] )
-	)
-	video_cards_i915? ( ${LIBDRM_DEPSTRING}[video_cards_intel] )
-"
-for card in ${RADEON_CARDS}; do
-	RDEPEND="${RDEPEND}
-		video_cards_${card}? ( ${LIBDRM_DEPSTRING}[video_cards_radeon] )
-	"
-done
-RDEPEND="${RDEPEND}
-	video_cards_radeonsi? ( ${LIBDRM_DEPSTRING}[video_cards_amdgpu] )
-"
-
-# Please keep the LLVM dependency block separate. Since LLVM is slotted,
-# we need to *really* make sure we're not pulling one than more slot
-# simultaneously.
-#
-# How to use it:
-# 1. List all the working slots (with min versions) in ||, newest first.
-# 2. Update the := to specify *max* version, e.g. < 9.
-# 3. Specify LLVM_MAX_SLOT, e.g. 8.
-LLVM_MAX_SLOT="8"
-LLVM_DEPSTR="
-	|| (
-		sys-devel/llvm:8[${MULTILIB_USEDEP}]
-		sys-devel/llvm:7[${MULTILIB_USEDEP}]
-	)
-	<sys-devel/llvm-9:=[${MULTILIB_USEDEP}]
-"
-LLVM_DEPSTR_AMDGPU=${LLVM_DEPSTR//]/,llvm_targets_AMDGPU(-)]}
-CLANG_DEPSTR=${LLVM_DEPSTR//llvm/clang}
-CLANG_DEPSTR_AMDGPU=${CLANG_DEPSTR//]/,llvm_targets_AMDGPU(-)]}
-RDEPEND="${RDEPEND}
-	llvm? (
-		opencl? (
-			video_cards_r600? (
-				${CLANG_DEPSTR_AMDGPU}
-			)
-			!video_cards_r600? (
-				video_cards_radeonsi? (
-					${CLANG_DEPSTR_AMDGPU}
-				)
-			)
-			!video_cards_r600? (
-				!video_cards_radeonsi? (
-					video_cards_radeon? (
-						${CLANG_DEPSTR_AMDGPU}
-					)
-				)
-			)
-			!video_cards_r600? (
-				!video_cards_radeon? (
-					!video_cards_radeonsi? (
-						${CLANG_DEPSTR}
-					)
-				)
-			)
-		)
-		!opencl? (
-			video_cards_r600? (
-				${LLVM_DEPSTR_AMDGPU}
-			)
-			!video_cards_r600? (
-				video_cards_radeonsi? (
-					${LLVM_DEPSTR_AMDGPU}
-				)
-			)
-			!video_cards_r600? (
-				!video_cards_radeonsi? (
-					video_cards_radeon? (
-						${LLVM_DEPSTR_AMDGPU}
-					)
-				)
-			)
-			!video_cards_r600? (
-				!video_cards_radeon? (
-					!video_cards_radeonsi? (
-						${LLVM_DEPSTR}
-					)
-				)
-			)
-		)
-	)
-"
-unset {LLVM,CLANG}_DEPSTR{,_AMDGPU}
-
-DEPEND="${RDEPEND}
-	${PYTHON_DEPS}
-	opencl? (
-		>=sys-devel/gcc-4.6
-	)
-	sys-devel/bison
-	sys-devel/flex
-	sys-devel/gettext
-	virtual/pkgconfig
-	valgrind? ( dev-util/valgrind )
-	x11-base/xorg-proto
-	x11-libs/libXrandr[${MULTILIB_USEDEP}]
-	$(python_gen_any_dep ">=dev-python/mako-0.8.0[\${PYTHON_USEDEP}]")
-"
-
-S="${WORKDIR}/${MY_P}"
-EGIT_CHECKOUT_DIR=${S}
-
-QA_WX_LOAD="
-x86? (
-	!pic? (
-		usr/lib*/libglapi.so.0.0.0
-		usr/lib*/libGLESv1_CM.so.1.0.0
-		usr/lib*/libGLESv2.so.2.0.0
-		usr/lib*/libGL.so.1.2.0
-		usr/lib*/libOSMesa.so.8.0.0
-	)
-)"
-
-llvm_check_deps() {
-	local flags=${MULTILIB_USEDEP}
-	if use video_cards_r600 || use video_cards_radeon || use video_cards_radeonsi
-	then
-		flags+=",llvm_targets_AMDGPU(-)"
-	fi
-
-	if use opencl; then
-		has_version "sys-devel/clang:${LLVM_SLOT}[${flags}]" || return 1
-	fi
-	has_version "sys-devel/llvm:${LLVM_SLOT}[${flags}]"
-}
-
-pkg_pretend() {
-	if use opencl; then
-		if ! use video_cards_r600 &&
-		   ! use video_cards_radeonsi; then
-			ewarn "Ignoring USE=opencl     since VIDEO_CARDS does not contain r600 or radeonsi"
-		fi
-	fi
-
-	if use vaapi; then
-		if ! use video_cards_r600 &&
-		   ! use video_cards_radeonsi &&
-		   ! use video_cards_nouveau; then
-			ewarn "Ignoring USE=vaapi      since VIDEO_CARDS does not contain r600, radeonsi, or nouveau"
-		fi
-	fi
-
-	if use vdpau; then
-		if ! use video_cards_r300 &&
-		   ! use video_cards_r600 &&
-		   ! use video_cards_radeonsi &&
-		   ! use video_cards_nouveau; then
-			ewarn "Ignoring USE=vdpau      since VIDEO_CARDS does not contain r300, r600, radeonsi, or nouveau"
-		fi
-	fi
-
-	if use xa; then
-		if ! use video_cards_freedreno &&
-		   ! use video_cards_nouveau &&
-		   ! use video_cards_vmware; then
-			ewarn "Ignoring USE=xa         since VIDEO_CARDS does not contain freedreno, nouveau, or vmware"
-		fi
-	fi
-
-	if use xvmc; then
-		if ! use video_cards_r600 &&
-		   ! use video_cards_nouveau; then
-			ewarn "Ignoring USE=xvmc       since VIDEO_CARDS does not contain r600 or nouveau"
-		fi
-	fi
-
-	if ! use gallium; then
-		use lm-sensors && ewarn "Ignoring USE=lm-sensors since USE does not contain gallium"
-		use llvm       && ewarn "Ignoring USE=llvm       since USE does not contain gallium"
-		use opencl     && ewarn "Ignoring USE=opencl     since USE does not contain gallium"
-		use vaapi      && ewarn "Ignoring USE=vaapi      since USE does not contain gallium"
-		use vdpau      && ewarn "Ignoring USE=vdpau      since USE does not contain gallium"
-		use unwind     && ewarn "Ignoring USE=unwind     since USE does not contain gallium"
-		use xa         && ewarn "Ignoring USE=xa         since USE does not contain gallium"
-		use xvmc       && ewarn "Ignoring USE=xvmc       since USE does not contain gallium"
-	fi
-
-	if ! use llvm; then
-		use opencl     && ewarn "Ignoring USE=opencl     since USE does not contain llvm"
-	fi
-}
-
-python_check_deps() {
-	has_version --host-root ">=dev-python/mako-0.8.0[${PYTHON_USEDEP}]"
-}
-
-pkg_setup() {
-	# warning message for bug 459306
-	if use llvm && has_version sys-devel/llvm[!debug=]; then
-		ewarn "Mismatch between debug USE flags in media-libs/mesa and sys-devel/llvm"
-		ewarn "detected! This can cause problems. For details, see bug 459306."
-	fi
-
-	if use llvm; then
-		llvm_pkg_setup
-	fi
-	python-any-r1_pkg_setup
-}
-
-multilib_src_configure() {
-	local emesonargs=()
-
-	if use classic; then
-		# Intel code
-		dri_driver_enable video_cards_i915 i915
-		dri_driver_enable video_cards_i965 i965
-		if ! use video_cards_i915 && \
-			! use video_cards_i965; then
-			dri_driver_enable video_cards_intel i915 i965
-		fi
-
-		# Nouveau code
-		dri_driver_enable video_cards_nouveau nouveau
-
-		# ATI code
-		dri_driver_enable video_cards_r100 r100
-		dri_driver_enable video_cards_r200 r200
-		if ! use video_cards_r100 && \
-			! use video_cards_r200; then
-			dri_driver_enable video_cards_radeon r100 r200
-		fi
-	fi
-
-	emesonargs+=( -Dplatforms=x11,surfaceless$(use wayland && echo ",wayland")$(use gbm && echo ",drm") )
-
-	if use gallium; then
-		emesonargs+=(
-			$(meson_use llvm)
-			$(meson_use lm-sensors lmsensors)
-			$(meson_use unwind libunwind)
-		)
-
-		if use video_cards_r300 ||
-		   use video_cards_r600 ||
-		   use video_cards_radeonsi ||
-		   use video_cards_nouveau ||
-		   use video_cards_vmware; then
-			emesonargs+=($(meson_use d3d9 gallium-nine))
-		else
-			emesonargs+=(-Dgallium-nine=false)
-		fi
-
-		if use video_cards_r600 ||
-		   use video_cards_radeonsi ||
-		   use video_cards_nouveau; then
-			emesonargs+=($(meson_use vaapi gallium-va))
-			use vaapi && emesonargs+=( -Dva-libs-path="${EPREFIX}"/usr/$(get_libdir)/va/drivers )
-		else
-			emesonargs+=(-Dgallium-va=false)
-		fi
-
-		if use video_cards_r300 ||
-		   use video_cards_r600 ||
-		   use video_cards_radeonsi ||
-		   use video_cards_nouveau; then
-			emesonargs+=($(meson_use vdpau gallium-vdpau))
-		else
-			emesonargs+=(-Dgallium-vdpau=false)
-		fi
-
-		if use video_cards_freedreno ||
-		   use video_cards_nouveau ||
-		   use video_cards_vmware; then
-			emesonargs+=($(meson_use xa gallium-xa))
-		else
-			emesonargs+=(-Dgallium-xa=false)
-		fi
-
-		if use video_cards_r600 ||
-		   use video_cards_nouveau; then
-			emesonargs+=($(meson_use xvmc gallium-xvmc))
-		else
-			emesonargs+=(-Dgallium-xvmc=false)
-		fi
-
-		gallium_enable video_cards_vc4 vc4
-		gallium_enable video_cards_vivante etnaviv
-		gallium_enable video_cards_vmware svga
-		gallium_enable video_cards_nouveau nouveau
-		gallium_enable video_cards_imx imx
-
-		# Only one i915 driver (classic vs gallium). Default to classic.
-		if ! use classic; then
-			gallium_enable video_cards_i915 i915
-			if ! use video_cards_i915 && \
-				! use video_cards_i965; then
-				gallium_enable video_cards_intel i915
-			fi
-		fi
-
-		gallium_enable video_cards_r300 r300
-		gallium_enable video_cards_r600 r600
-		gallium_enable video_cards_radeonsi radeonsi
-		if ! use video_cards_r300 && \
-			! use video_cards_r600; then
-			gallium_enable video_cards_radeon r300 r600
-		fi
-
-		gallium_enable video_cards_freedreno freedreno
-		gallium_enable video_cards_virgl virgl
-
-		# opencl stuff
-		emesonargs+=(
-			-Dgallium-opencl="$(usex opencl icd disabled)"
-		)
-	fi
-
-	if use vulkan; then
-		vulkan_enable video_cards_i965 intel
-		vulkan_enable video_cards_radeonsi amd
-	fi
-
-	# x86 hardened pax_kernel needs glx-rts, bug 240956
-	if [[ ${ABI} == x86 ]]; then
-		emesonargs+=( $(meson_use pax_kernel glx-read-only-text) )
-	fi
-
-	# on abi_x86_32 hardened we need to have asm disable
-	if [[ ${ABI} == x86* ]] && use pic; then
-		emesonargs+=( -Dasm=false )
-	fi
-
-	if use gallium; then
-		gallium_enable -- swrast
-		emesonargs+=( -Dosmesa=$(usex osmesa gallium none) )
-	else
-		dri_driver_enable -- swrast
-		emesonargs+=( -Dosmesa=$(usex osmesa classic none) )
-	fi
-
-	driver_list() {
-		local drivers="$(sort -u <<< "${1// /$'\n'}")"
-		echo "${drivers//$'\n'/,}"
-	}
-
-	emesonargs+=(
-		$(meson_use test build-tests)
-		-Dglx=dri
-		-Dshared-glapi=true
-		$(meson_use dri3)
-		$(meson_use egl)
-		$(meson_use gbm)
-		$(meson_use gles1)
-		$(meson_use gles2)
-		$(meson_use libglvnd glvnd)
-		$(meson_use selinux)
-		-Dvalgrind=$(usex valgrind auto false)
-		-Ddri-drivers=$(driver_list "${DRI_DRIVERS[*]}")
-		-Dgallium-drivers=$(driver_list "${GALLIUM_DRIVERS[*]}")
-		-Dvulkan-drivers=$(driver_list "${VULKAN_DRIVERS[*]}")
-		--buildtype $(usex debug debug plain)
-		-Db_ndebug=$(usex debug false true)
-	)
-	meson_src_configure
-}
-
-multilib_src_compile() {
-	meson_src_compile
-}
-
-multilib_src_install() {
-	meson_src_install
-
-	use libglvnd && rm -f "${D}"/usr/$(get_libdir)/libGLESv{1_CM,2}.so*
-}
-
-multilib_src_install_all() {
-	einstalldocs
-}
-
-multilib_src_test() {
-	meson test -v -C "${BUILD_DIR}" -t 100
-}
-
-pkg_postinst() {
-	# Switch to the xorg implementation.
-	echo
-	eselect opengl set --use-old ${OPENGL_DIR}
-}
-
-# $1 - VIDEO_CARDS flag (check skipped for "--")
-# other args - names of DRI drivers to enable
-dri_driver_enable() {
-	if [[ $1 == -- ]] || use $1; then
-		shift
-		DRI_DRIVERS+=("$@")
-	fi
-}
-
-gallium_enable() {
-	if [[ $1 == -- ]] || use $1; then
-		shift
-		GALLIUM_DRIVERS+=("$@")
-	fi
-}
-
-vulkan_enable() {
-	if [[ $1 == -- ]] || use $1; then
-		shift
-		VULKAN_DRIVERS+=("$@")
-	fi
-}
diff --git a/media-libs/waffle/Manifest b/media-libs/waffle/Manifest
index 32f21dcd3360..0b0146e39dc5 100644
--- a/media-libs/waffle/Manifest
+++ b/media-libs/waffle/Manifest
@@ -1,2 +1 @@
-DIST waffle-1.5.2.tar.xz 179284 BLAKE2B 40befb3e4463605e303b404677268d4758f6a43f5d83bee5e74222e2e2bf949f51444c0df68291ef0edc76be313363eca3e59e642b0356451c10703e66d96e56 SHA512 04f90f70421c88418d1d98175b552de9e036ea36b6c870a6c968c7fcc2d4cb2fa4ce08b0adcdd50f4853a7503558eae7a05ef75b292cf85d3c9796e7b342ca62
 DIST waffle-1.6.0.tar.xz 224400 BLAKE2B 458add99b346bd75dc757243b9e7db6ac269fb2c1e488333d921c640e10efd182e51e8a5e0312d334593033936adf047fc2339d21e675654d89d66edfb8922b3 SHA512 c8796ab8adf968df2c5c88e2941c83955fe41e87eb2b75b6a5cc61b0d0c06eaa44df2f255f573a51816036dc8bc3ec63f3fb51ccfb7efbfe83cdd50b3f1be13f
diff --git a/media-libs/waffle/waffle-1.5.2.ebuild b/media-libs/waffle/waffle-1.5.2.ebuild
deleted file mode 100644
index 2be51a342803..000000000000
--- a/media-libs/waffle/waffle-1.5.2.ebuild
+++ /dev/null
@@ -1,54 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-if [[ ${PV} = *9999* ]]; then
-	EGIT_REPO_URI="https://github.com/waffle-gl/${PN}.git"
-	GIT_ECLASS="git-r3"
-else
-	SRC_URI="https://people.freedesktop.org/~chadversary/${PN}/files/release/${P}/${P}.tar.xz"
-	KEYWORDS="amd64 arm ~ppc ~ppc64 x86"
-fi
-inherit cmake-multilib ${GIT_ECLASS}
-
-DESCRIPTION="Library that allows selection of GL API and of window system at runtime"
-HOMEPAGE="https://people.freedesktop.org/~chadversary/waffle/"
-
-LICENSE="BSD-2"
-SLOT="0"
-IUSE="doc egl gbm test wayland"
-
-RDEPEND="
-	>=media-libs/mesa-9.1.6[egl?,gbm?,${MULTILIB_USEDEP}]
-	>=virtual/opengl-7.0-r1[${MULTILIB_USEDEP}]
-	>=x11-libs/libX11-1.6.2[${MULTILIB_USEDEP}]
-	>=x11-libs/libxcb-1.9.1[${MULTILIB_USEDEP}]
-	gbm? ( >=virtual/libudev-208:=[${MULTILIB_USEDEP}] )
-	wayland? ( >=dev-libs/wayland-1.0.6[${MULTILIB_USEDEP}] )
-"
-DEPEND="${RDEPEND}
-	>=x11-base/xcb-proto-1.8-r3[${MULTILIB_USEDEP}]
-	doc? (
-		dev-libs/libxslt
-		app-text/docbook-xml-dtd:4.2
-	)
-"
-
-src_configure() {
-	local mycmakeargs=(
-		-Dwaffle_has_glx=ON
-		-Dwaffle_build_examples=OFF
-		-Dwaffle_build_manpages=$(usex doc )
-		-Dwaffle_has_x11_egl=$(usex egl)
-		-Dwaffle_has_gbm=$(usex gbm)
-		-Dwaffle_build_tests=$(usex test)
-		-Dwaffle_has_wayland=$(usex wayland)
-	)
-
-	cmake-multilib_src_configure
-}
-
-src_test() {
-	emake -C "${CMAKE_BUILD_DIR}" check
-}
diff --git a/media-libs/waffle/waffle-1.6.0.ebuild b/media-libs/waffle/waffle-1.6.0.ebuild
index ccfc41d0c8ca..c1eb3cfd333e 100644
--- a/media-libs/waffle/waffle-1.6.0.ebuild
+++ b/media-libs/waffle/waffle-1.6.0.ebuild
@@ -65,5 +65,5 @@ multilib_src_test() {
 multilib_src_install() {
 	meson_src_install
 
-	rm -rf ${D}/usr/share/doc/waffle1
+	rm -rf "${D}"/usr/share/doc/waffle1
 }
diff --git a/media-libs/waffle/waffle-9999.ebuild b/media-libs/waffle/waffle-9999.ebuild
index a7c32a6cf596..56a48b843787 100644
--- a/media-libs/waffle/waffle-9999.ebuild
+++ b/media-libs/waffle/waffle-9999.ebuild
@@ -65,5 +65,5 @@ multilib_src_test() {
 multilib_src_install() {
 	meson_src_install
 
-	rm -rf ${D}/usr/share/doc/waffle1
+	rm -rf "${D}"/usr/share/doc/waffle1
 }
diff --git a/net-libs/libtirpc/Manifest b/net-libs/libtirpc/Manifest
index 96612140117d..ee8d1d01072a 100644
--- a/net-libs/libtirpc/Manifest
+++ b/net-libs/libtirpc/Manifest
@@ -1,4 +1,2 @@
-DIST libtirpc-1.0.2.tar.bz2 509601 BLAKE2B 7ccf23ca200e2027a66a3105d9b3d0612ac66a08498931f66526a291be6ddef8e7df533af4d44a0e4a1178edd6d51ae39ca50c2536b9b1be7179e7f17cfd165e SHA512 6c819019a8e81d8263d3c509b2eee59ba1ef092222c5a0a8d28f004c711afa252097eca7e6b0b919b2d780883dfd9ee7a363df4cee7fd2c9159a065257637cec
-DIST libtirpc-1.0.3.tar.bz2 509831 BLAKE2B 3f908471b3e10f88329793db2c832754b9bb838d115235d7c25256da883960de8d8c94a6941fc9c2a3cc4dca9a77c32b5cb85bb347cc182e5a6255636b79b06e SHA512 1f1cf7dd6f30ddddc919e4caf6db926f1d532f78d5a93e8aaa2acde6b046be0650c4c46549da0ffd5fa7fb9e550af1a871ed6e02ededf504c6667d2e82eba2cc
 DIST libtirpc-1.1.4.tar.bz2 510924 BLAKE2B 1780f9bb0543583c01b60bda681add0ec2f8718eda4ce4653883c772466178e37d0a3fb47004109f81de470129458561fac4f109f45154c64b6fb729f0212c90 SHA512 392f391f9fc1bd68d81dc44e4058831a64b32790b5c8c37338b0ab416fad2ae4d16389e632596734dba09780347918cc65c6f134e0c1afd09e81ec250785ed23
 DIST libtirpc-glibc-nfs.tar.xz 8948 BLAKE2B 7316623d9f2b6928e296137fe2bf6794b208d549c2ffba9e4a35b47f7b04bf023798a09f38c02d039debf6adc466d7689cf3c8274d71a22eaff08729642c0a28 SHA512 90255bf0a27af16164e0710dd940778609925d473f4343093ff19d98cc4f23023788bf4edf0178eae1961afc0ba8b69b273de95b7d7e2afdb706701d8ba6f7ba
diff --git a/net-libs/libtirpc/files/libtirpc-1.0.2-bzero-to-memset.patch b/net-libs/libtirpc/files/libtirpc-1.0.2-bzero-to-memset.patch
deleted file mode 100644
index 64b516ed8262..000000000000
--- a/net-libs/libtirpc/files/libtirpc-1.0.2-bzero-to-memset.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-diff -Naurp libtirpc-1.0.2.orig/src/auth_time.c libtirpc-1.0.2/src/auth_time.c
---- libtirpc-1.0.2.orig/src/auth_time.c	2017-07-05 11:02:23.000000000 -0400
-+++ libtirpc-1.0.2/src/auth_time.c	2017-07-30 17:46:39.481420880 -0400
-@@ -317,7 +317,7 @@ __rpc_get_time_offset(td, srv, thost, ua
- 	sprintf(ipuaddr, "%d.%d.%d.%d.0.111", a1, a2, a3, a4);
- 	useua = &ipuaddr[0];
- 
--	bzero((char *)&sin, sizeof(sin));
-+	memset((char *)&sin, 0, sizeof(sin));
- 	if (uaddr_to_sockaddr(useua, &sin)) {
- 		msg("unable to translate uaddr to sockaddr.");
- 		if (needfree)
-diff -Naurp libtirpc-1.0.2.orig/src/des_impl.c libtirpc-1.0.2/src/des_impl.c
---- libtirpc-1.0.2.orig/src/des_impl.c	2017-07-05 11:02:23.000000000 -0400
-+++ libtirpc-1.0.2/src/des_impl.c	2017-07-30 17:46:49.581420807 -0400
-@@ -588,7 +588,7 @@ _des_crypt (char *buf, unsigned len, str
-     }
-   tin0 = tin1 = tout0 = tout1 = xor0 = xor1 = 0;
-   tbuf[0] = tbuf[1] = 0;
--  __bzero (schedule, sizeof (schedule));
-+  memset (schedule, 0, sizeof (schedule));
- 
-   return (1);
- }
-diff -Naurp libtirpc-1.0.2.orig/src/svc_auth_des.c libtirpc-1.0.2/src/svc_auth_des.c
---- libtirpc-1.0.2.orig/src/svc_auth_des.c	2017-07-05 11:02:23.000000000 -0400
-+++ libtirpc-1.0.2/src/svc_auth_des.c	2017-07-30 17:46:58.771420741 -0400
-@@ -356,7 +356,7 @@ cache_init()
- 
- 	authdes_cache = (struct cache_entry *)
- 		mem_alloc(sizeof(struct cache_entry) * AUTHDES_CACHESZ);	
--	bzero((char *)authdes_cache, 
-+	memset((char *)authdes_cache, 0,
- 		sizeof(struct cache_entry) * AUTHDES_CACHESZ);
- 
- 	authdes_lru = (short *)mem_alloc(sizeof(short) * AUTHDES_CACHESZ);
diff --git a/net-libs/libtirpc/files/libtirpc-1.0.2-exports.patch b/net-libs/libtirpc/files/libtirpc-1.0.2-exports.patch
deleted file mode 100644
index 174f4e3471f8..000000000000
--- a/net-libs/libtirpc/files/libtirpc-1.0.2-exports.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-See
-https://bugs.alpinelinux.org/issues/7041
-https://git.alpinelinux.org/cgit/aports/commit/?id=9edb53cea056101c4963a04b747bf102de23f919
-(just hit this myself when building libnsl)
-... dilfridge
-
---- a/src/libtirpc.map
-+++ b/src/libtirpc.map
-@@ -298,7 +298,7 @@
-     key_gendes;
-     key_get_conv;
-     key_setsecret;
--    key_secret_is_set;
-+    key_secretkey_is_set;
-     key_setnet;
-     netname2host;
-     netname2user;
diff --git a/net-libs/libtirpc/files/libtirpc-1.0.2-glibc-2.26.patch b/net-libs/libtirpc/files/libtirpc-1.0.2-glibc-2.26.patch
deleted file mode 100644
index 6d583e6149d0..000000000000
--- a/net-libs/libtirpc/files/libtirpc-1.0.2-glibc-2.26.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/xdr_sizeof.c b/src/xdr_sizeof.c
-index d23fbd1..79d6707 100644
---- a/src/xdr_sizeof.c
-+++ b/src/xdr_sizeof.c
-@@ -39,6 +39,7 @@
- #include <rpc/xdr.h>
- #include <sys/types.h>
- #include <stdlib.h>
-+#include <stdint.h>
- #include "un-namespace.h"
- 
- /* ARGSUSED */
diff --git a/net-libs/libtirpc/libtirpc-1.0.2-r1.ebuild b/net-libs/libtirpc/libtirpc-1.0.2-r1.ebuild
deleted file mode 100644
index 36dc12d642f8..000000000000
--- a/net-libs/libtirpc/libtirpc-1.0.2-r1.ebuild
+++ /dev/null
@@ -1,65 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit autotools multilib-minimal toolchain-funcs eutils usr-ldscript
-
-DESCRIPTION="Transport Independent RPC library (SunRPC replacement)"
-HOMEPAGE="https://sourceforge.net/projects/libtirpc/"
-SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2
-	mirror://gentoo/${PN}-glibc-nfs.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0/3" # subslot matches SONAME major
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~amd64-linux ~x86-linux"
-IUSE="ipv6 kerberos static-libs"
-
-RDEPEND="kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}
-	elibc_musl? ( sys-libs/queue-standalone )
-	app-arch/xz-utils
-	>=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-1.0.2-bcopy-to-memmove.patch"
-	"${FILESDIR}/${PN}-1.0.2-bzero-to-memset.patch"
-	"${FILESDIR}/${PN}-1.0.2-glibc-2.26.patch"
-	"${FILESDIR}/${PN}-1.0.2-exports.patch"
-)
-
-src_prepare() {
-	cp -r "${WORKDIR}"/tirpc "${S}"/ || die
-	epatch "${PATCHES[@]}"
-	epatch_user
-	eautoreconf
-}
-
-multilib_src_configure() {
-	ECONF_SOURCE=${S} \
-	econf \
-		$(use_enable ipv6) \
-		$(use_enable kerberos gssapi) \
-		$(use_enable static-libs static)
-}
-
-multilib_src_install() {
-	default
-
-	# libtirpc replaces rpc support in glibc, so we need it in /
-	gen_usr_ldscript -a tirpc
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	insinto /etc
-	doins doc/netconfig
-
-	insinto /usr/include/tirpc
-	doins -r "${WORKDIR}"/tirpc/*
-
-	# makes sure that the linking order for nfs-utils is proper, as
-	# libtool would inject a libgssglue dependency in the list.
-	use static-libs || prune_libtool_files
-}
diff --git a/net-libs/libtirpc/libtirpc-1.0.3.ebuild b/net-libs/libtirpc/libtirpc-1.0.3.ebuild
deleted file mode 100644
index 5a60e1bb7b01..000000000000
--- a/net-libs/libtirpc/libtirpc-1.0.3.ebuild
+++ /dev/null
@@ -1,63 +0,0 @@
-# Copyright 1999-2019 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools multilib-minimal toolchain-funcs usr-ldscript
-
-DESCRIPTION="Transport Independent RPC library (SunRPC replacement)"
-HOMEPAGE="https://sourceforge.net/projects/libtirpc/"
-SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2
-	mirror://gentoo/${PN}-glibc-nfs.tar.xz"
-
-LICENSE="GPL-2"
-SLOT="0/3" # subslot matches SONAME major
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux"
-IUSE="ipv6 kerberos static-libs"
-
-RDEPEND="kerberos? ( >=virtual/krb5-0-r1[${MULTILIB_USEDEP}] )"
-DEPEND="${RDEPEND}
-	app-arch/xz-utils
-	>=virtual/pkgconfig-0-r1[${MULTILIB_USEDEP}]"
-
-PATCHES=(
-	"${FILESDIR}/${PN}-1.0.2-bcopy-to-memmove.patch"
-)
-
-src_prepare() {
-	cp -r "${WORKDIR}"/tirpc "${S}"/ || die
-	default
-	eautoreconf
-}
-
-multilib_src_configure() {
-	local myeconfargs=(
-		$(use_enable ipv6)
-		$(use_enable kerberos gssapi)
-		$(use_enable static-libs static)
-	)
-	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
-}
-
-multilib_src_install() {
-	default
-
-	# libtirpc replaces rpc support in glibc, so we need it in /
-	gen_usr_ldscript -a tirpc
-}
-
-multilib_src_install_all() {
-	einstalldocs
-
-	insinto /etc
-	doins doc/netconfig
-
-	insinto /usr/include/tirpc
-	doins -r "${WORKDIR}"/tirpc/*
-
-	# makes sure that the linking order for nfs-utils is proper, as
-	# libtool would inject a libgssglue dependency in the list.
-	if ! use static-libs ; then
-		find "${ED}" -name "*.la" -delete || die
-	fi
-}
diff --git a/net-libs/rpcsvc-proto/Manifest b/net-libs/rpcsvc-proto/Manifest
index dc231fa6a219..fa54be5fddd8 100644
--- a/net-libs/rpcsvc-proto/Manifest
+++ b/net-libs/rpcsvc-proto/Manifest
@@ -1,2 +1 @@
-DIST rpcsvc-proto-1.3.1.tar.gz 59174 BLAKE2B d50d958cfad79142d686ae6312cdaa6044f1322bc794dbc95c1b78d088396c5adda292c83d150f3502df859c23d4e370894283ae210e5fe9aa1d0e8ed05553d0 SHA512 d687665ed51fd6fd66ab638813c5020f0c8b8491625b91937ac4b5ee4dd2357eae8e2909394e7651494e7aea77a6279ae907ba6354682ba446de7088b55f54ea
 DIST rpcsvc-proto-1.4.tar.gz 59127 BLAKE2B 484c04d6a0f86d37c0057693771b7fe502166504fc419bce4dd182f76e349cf226307814a2c51b27fa0bc09e270b883cb40ae821f8bd7d7e0c9a120c4962ae34 SHA512 a29d7761ec9cca4d7d7aa6943a243771a6c7f35d303f01af84f390c8395dc5e543fad7ea28fec1be2f6ee8f2853bf22a157ad3b020057040685b6cbce9b09415
diff --git a/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.3.1-old-preprocessor.patch b/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.3.1-old-preprocessor.patch
deleted file mode 100644
index 5d77786a7129..000000000000
--- a/net-libs/rpcsvc-proto/files/rpcsvc-proto-1.3.1-old-preprocessor.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From ce0ed4f45918f9230db435ee3b733090fa4f9620 Mon Sep 17 00:00:00 2001
-From: Florian Weimer <fweimer@redhat.com>
-Date: Tue, 27 Mar 2018 12:08:30 +0200
-Subject: [PATCH] Remove historic _RPC_THREAD_SAFE_ preprocessor conditional
-
-When the code was imported from glibc, the -D_RPC_THREAD_SAFE_
-build flag was missed.
----
- rpcgen/rpc_main.c | 9 ---------
- 1 file changed, 9 deletions(-)
-
-diff --git a/rpcgen/rpc_main.c b/rpcgen/rpc_main.c
-index 94bd818..1b26e52 100644
---- a/rpcgen/rpc_main.c
-+++ b/rpcgen/rpc_main.c
-@@ -1346,15 +1346,6 @@ parseargs (int argc, const char *argv[], struct commandline *cmd)
-   cmd->Scflag = flag['C'];
-   cmd->makefileflag = flag['M'];
- 
--#ifndef _RPC_THREAD_SAFE_
--  if (mtflag || newstyle)
--    {
--      /* glibc doesn't support these flags.  */
--      f_print (stderr,
--	       _("This implementation doesn't support newstyle or MT-safe code!\n"));
--      return (0);
--    }
--#endif
-   if (tirpcflag)
-     {
-       pmflag = inetdflag ? 0 : 1;    /* pmflag or inetdflag is always TRUE */
diff --git a/net-libs/rpcsvc-proto/rpcsvc-proto-1.3.1-r1.ebuild b/net-libs/rpcsvc-proto/rpcsvc-proto-1.3.1-r1.ebuild
deleted file mode 100644
index 8a8003bcc44e..000000000000
--- a/net-libs/rpcsvc-proto/rpcsvc-proto-1.3.1-r1.ebuild
+++ /dev/null
@@ -1,30 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=6
-
-inherit autotools
-
-DESCRIPTION="rpcsvc protocol definitions from glibc"
-HOMEPAGE="https://github.com/thkukuk/rpcsvc-proto"
-SRC_URI="https://github.com/thkukuk/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-SLOT="0"
-LICENSE="LGPL-2.1+ BSD"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86"
-IUSE=""
-
-RDEPEND="!<sys-libs/glibc-2.26"
-
-src_prepare(){
-	default
-	eapply "${FILESDIR}"/${P}-old-preprocessor.patch #650852
-	eautoreconf
-}
-
-src_install(){
-	default
-
-	# provided by sys-fs/quota[rpc]
-	rm "${ED%/}"/usr/include/rpcsvc/rquota.{x,h} || die
-}
diff --git a/net-nds/rpcbind/Manifest b/net-nds/rpcbind/Manifest
index f3285ad88147..1e114d6b58e5 100644
--- a/net-nds/rpcbind/Manifest
+++ b/net-nds/rpcbind/Manifest
@@ -1,2 +1 @@
-DIST rpcbind-0.2.4.tar.bz2 122781 BLAKE2B ac1c374a1081559bf09bc209256daa1bb530d71f0c7fe45cec4c9b87cf110c15251a05dce2cf2b78ffa4d902f817efed30350ad08a23e12a7f219f10fe626aa8 SHA512 f3966a7284e94bdf120a9b3f0dd66efa1fe8761df2313545a031f77b7c06e27d7955d2780469943deb537d34f95c4cf3f30de523ec9fab9f571322d7224b210c
 DIST rpcbind-1.2.5.tar.bz2 123502 BLAKE2B de0d10406aeffd75195c1fa1d0179b2c7c0ba54c3f3ac58ce9d7e9448d1dbe91a296ad69c45dee115e0a739aa9cfec53b750d3a5ca405e16605a92bbb2006859 SHA512 e884c4757950ccead0f9a07f50625a63e6f18f9bfae9fcfffa3e5fa4b7a66c3a99d9fa303061848fe8211509d5456f24ff26e4579af6e161a35522268f3ef3e4
diff --git a/net-nds/rpcbind/files/rpcbind-0.2.4-CVE-2017-8779.patch b/net-nds/rpcbind/files/rpcbind-0.2.4-CVE-2017-8779.patch
deleted file mode 100644
index cef088badc91..000000000000
--- a/net-nds/rpcbind/files/rpcbind-0.2.4-CVE-2017-8779.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/src/rpcb_svc_com.c b/src/rpcb_svc_com.c
-index 5862c26..e11f61b 100644
---- a/src/rpcb_svc_com.c
-+++ b/src/rpcb_svc_com.c
-@@ -48,6 +48,7 @@
- #include <rpc/rpc.h>
- #include <rpc/rpcb_prot.h>
- #include <rpc/svc_dg.h>
-+#include <rpc/rpc_com.h>
- #include <netconfig.h>
- #include <errno.h>
- #include <syslog.h>
-@@ -432,7 +433,7 @@ rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp /*__unused*/,
- static bool_t
- xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
- {
--	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
-+	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), RPC_MAXDATASIZE));
- }
- 
- /*
diff --git a/net-nds/rpcbind/rpcbind-0.2.4-r3.ebuild b/net-nds/rpcbind/rpcbind-0.2.4-r3.ebuild
deleted file mode 100644
index 8431b518c940..000000000000
--- a/net-nds/rpcbind/rpcbind-0.2.4-r3.ebuild
+++ /dev/null
@@ -1,58 +0,0 @@
-# Copyright 1999-2018 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils systemd
-
-if [[ ${PV} == "9999" ]] ; then
-	EGIT_REPO_URI="git://linux-nfs.org/~steved/rpcbind.git"
-	inherit autotools git-r3
-else
-	SRC_URI="mirror://sourceforge/${PN}/${P}.tar.bz2"
-	KEYWORDS="alpha amd64 arm arm64 hppa ia64 ~mips ppc ppc64 s390 sh sparc x86"
-fi
-
-DESCRIPTION="portmap replacement which supports RPC over various protocols"
-HOMEPAGE="https://sourceforge.net/projects/rpcbind/"
-
-LICENSE="BSD"
-SLOT="0"
-IUSE="debug selinux systemd tcpd warmstarts"
-REQUIRED_USE="systemd? ( warmstarts )"
-
-CDEPEND=">=net-libs/libtirpc-1.0:=
-	systemd? ( sys-apps/systemd:= )
-	tcpd? ( sys-apps/tcp-wrappers )"
-DEPEND="${CDEPEND}
-	virtual/pkgconfig"
-RDEPEND="${CDEPEND}
-	selinux? ( sec-policy/selinux-rpcbind )"
-
-PATCHES=(
-	"${FILESDIR}/${P}-CVE-2017-8779.patch"
-)
-
-src_prepare() {
-	[[ ${PV} == "9999" ]] && eautoreconf
-	epatch "${PATCHES[@]}"
-	epatch_user
-}
-
-src_configure() {
-	econf \
-		--bindir="${EPREFIX}"/sbin \
-		--with-statedir="${EPREFIX}"/run/${PN} \
-		--with-rpcuser=root \
-		--with-systemdsystemunitdir=$(usex systemd "$(systemd_get_unitdir)" "no") \
-		$(use_enable tcpd libwrap) \
-		$(use_enable debug) \
-		$(use_enable warmstarts)
-}
-
-src_install() {
-	default
-
-	newinitd "${FILESDIR}"/${PN}.initd ${PN}
-	newconfd "${FILESDIR}"/${PN}.confd ${PN}
-}