Merge updates from master

24 files changed, 505 insertions, 21 deletions

diff --git a/dev-lang/python/python-2.7.18-r1.ebuild b/dev-lang/python/python-2.7.18-r1.ebuild
index 1813838b038b..7d5da0385760 100644
--- a/dev-lang/python/python-2.7.18-r1.ebuild
+++ b/dev-lang/python/python-2.7.18-r1.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sparc x86"
 IUSE="-berkdb bluetooth build elibc_uclibc examples gdbm hardened ipv6 libressl +ncurses +readline sqlite +ssl +threads tk +wide-unicode wininst +xml"
 
 # Do not add a dependency on dev-lang/python to this ebuild.
diff --git a/dev-lang/python/python-3.6.11-r2.ebuild b/dev-lang/python/python-3.6.11-r2.ebuild
index 823fa8cf986f..93e2ecfcb761 100644
--- a/dev-lang/python/python-3.6.11-r2.ebuild
+++ b/dev-lang/python/python-3.6.11-r2.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}/${PYVER}m"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~s390 ~sparc x86"
 IUSE="bluetooth build examples gdbm hardened ipv6 libressl +ncurses +readline sqlite +ssl test +threads tk wininst +xml"
 RESTRICT="!test? ( test )"
 
diff --git a/dev-lang/python/python-3.7.8-r2.ebuild b/dev-lang/python/python-3.7.8-r2.ebuild
index 938eb2e64d64..68f3e937d4f1 100644
--- a/dev-lang/python/python-3.7.8-r2.ebuild
+++ b/dev-lang/python/python-3.7.8-r2.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}/${PYVER}m"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="bluetooth build examples gdbm hardened ipv6 libressl +ncurses +readline sqlite +ssl test tk wininst +xml"
 RESTRICT="!test? ( test )"
 
diff --git a/dev-lang/python/python-3.8.4-r1.ebuild b/dev-lang/python/python-3.8.4-r1.ebuild
index 0a14b28132fb..1662a7425f56 100644
--- a/dev-lang/python/python-3.8.4-r1.ebuild
+++ b/dev-lang/python/python-3.8.4-r1.ebuild
@@ -18,7 +18,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="PSF-2"
 SLOT="${PYVER}"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ppc64 ~riscv ~s390 ~sparc x86"
 IUSE="bluetooth build examples gdbm hardened ipv6 libressl +ncurses +readline sqlite +ssl test tk wininst +xml"
 RESTRICT="!test? ( test )"
 
diff --git a/dev-libs/libzia/libzia-4.21.ebuild b/dev-libs/libzia/libzia-4.21.ebuild
index 8a9ae5b51768..de56605304a1 100644
--- a/dev-libs/libzia/libzia-4.21.ebuild
+++ b/dev-libs/libzia/libzia-4.21.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://tucnak.nagano.cz/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="ftdi"
 
 RDEPEND="dev-libs/glib:2
diff --git a/games-fps/urbanterror/Manifest b/games-fps/urbanterror/Manifest
index 2fe3e1ecd711..247eede61620 100644
--- a/games-fps/urbanterror/Manifest
+++ b/games-fps/urbanterror/Manifest
@@ -1 +1 @@
-DIST urbanterror-4.3.4_p20180708.tar.gz 6177724 BLAKE2B 36439a1facc83a6151f0f6f28351bd56c196822832abbbab885312a216593b65a359187560c962caf2923b69f5519b17fe901a88c03f61ac576b6998a51ab227 SHA512 97c36d9ebcb4b915d077bb944808f45e88e0f544e6d0261f1e97e5a4bb33f3fd4120cf73d9463ea8da16848e4acb18218afe4042f00d9f759e7481b3e7aecd58
+DIST urbanterror-4.3.4_p20200519.tar.gz 6188257 BLAKE2B 931bc1c1f5b29dfc57c104400a5ea35fc2741ec1e2187ddd33e77a55aeb1580ec7dd21aa9670f0c94ee033b869ce2e6be05e9342e87d1a9707b9874f59c5cf06 SHA512 f555586cbef8c0baa70baaa0de4ef380c72c98990940cec2b1050201c6878f7ababfb2ef44c37766519f25990badcb12c89c61aa7a7b123c44cc151ac0ef8d56
diff --git a/games-fps/urbanterror/urbanterror-4.3.4_p20180708.ebuild b/games-fps/urbanterror/urbanterror-4.3.4_p20200519.ebuild
index 2eed0405afcc..902878edb277 100644
--- a/games-fps/urbanterror/urbanterror-4.3.4_p20180708.ebuild
+++ b/games-fps/urbanterror/urbanterror-4.3.4_p20200519.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2018 Gentoo Authors
+# Copyright 1999-2020 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="7"
@@ -13,7 +13,7 @@ if [[ ${PV} == *9999 ]]; then
 	EGIT_REPO_URI="https://github.com/mickael9/ioq3.git"
 	EGIT_BRANCH="urt"
 else
-	COMMIT_ID="167cb6b611ad27f30787a2fe204a7c65ec1fa18e"
+	COMMIT_ID="58d8e9942101e0ca28a434b92e1d45d42eb2bd9a"
 	SRC_URI="https://github.com/mickael9/ioq3/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz"
 	S="${WORKDIR}/ioq3-${COMMIT_ID}"
 	KEYWORDS="~amd64 ~x86"
diff --git a/media-libs/freeimage/files/freeimage-3.18.0-CVE-2019-12211-CVE-2019-12213.patch b/media-libs/freeimage/files/freeimage-3.18.0-CVE-2019-12211-CVE-2019-12213.patch
new file mode 100644
index 000000000000..fc861854509c
--- /dev/null
+++ b/media-libs/freeimage/files/freeimage-3.18.0-CVE-2019-12211-CVE-2019-12213.patch
@@ -0,0 +1,193 @@
+commit 1826164f90d97b7207247ad268fd2622cd1c6717
+Author: drolon <drolon@f6e0daa0-2725-47c6-9c0b-5e6e9cdd0720>
+Date:   Mon Nov 11 05:45:27 2019 +0000
+
+    improved TIFF plugin when working with malicious images
+    
+    git-svn-id: https://svn.code.sf.net/p/freeimage/svn@1825 f6e0daa0-2725-47c6-9c0b-5e6e9cdd0720
+
+diff --git a/Source/FreeImage/PluginTIFF.cpp b/Source/FreeImage/PluginTIFF.cpp
+index f85c2201..a8053196 100644
+--- a/Source/FreeImage/PluginTIFF.cpp
++++ b/Source/FreeImage/PluginTIFF.cpp
+@@ -122,9 +122,14 @@ static void ReadThumbnail(FreeImageIO *io, fi_handle handle, void *data, TIFF *t
+ static int s_format_id;
+ 
+ typedef struct {
++	//! FreeImage IO functions
+     FreeImageIO *io;
++	//! FreeImage handle
+ 	fi_handle handle;
++	//! LibTIFF handle
+ 	TIFF *tif;
++	//! Count the number of thumbnails already read (used to avoid recursion on loading)
++	unsigned thumbnailCount;
+ } fi_TIFFIO;
+ 
+ // ----------------------------------------------------------
+@@ -184,10 +189,8 @@ Open a TIFF file descriptor for reading or writing
+ */
+ TIFF *
+ TIFFFdOpen(thandle_t handle, const char *name, const char *mode) {
+-	TIFF *tif;
+-	
+ 	// Open the file; the callback will set everything up
+-	tif = TIFFClientOpen(name, mode, handle,
++	TIFF *tif = TIFFClientOpen(name, mode, handle,
+ 	    _tiffReadProc, _tiffWriteProc, _tiffSeekProc, _tiffCloseProc,
+ 	    _tiffSizeProc, _tiffMapProc, _tiffUnmapProc);
+ 
+@@ -460,12 +463,10 @@ CreateImageType(BOOL header_only, FREE_IMAGE_TYPE fit, int width, int height, ui
+ 			}
+ 			
+ 		}
+-		else {
+-
+-			dib = FreeImage_AllocateHeader(header_only, width, height, MIN(bpp, 32), FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
++		else if (bpp <= 32) {
++			dib = FreeImage_AllocateHeader(header_only, width, height, bpp, FI_RGBA_RED_MASK, FI_RGBA_GREEN_MASK, FI_RGBA_BLUE_MASK);
+ 		}
+ 
+-
+ 	} else {
+ 		// other bitmap types
+ 		
+@@ -1067,9 +1068,12 @@ static void * DLL_CALLCONV
+ Open(FreeImageIO *io, fi_handle handle, BOOL read) {
+ 	// wrapper for TIFF I/O
+ 	fi_TIFFIO *fio = (fi_TIFFIO*)malloc(sizeof(fi_TIFFIO));
+-	if(!fio) return NULL;
++	if (!fio) {
++		return NULL;
++	}
+ 	fio->io = io;
+ 	fio->handle = handle;
++	fio->thumbnailCount = 0;
+ 
+ 	if (read) {
+ 		fio->tif = TIFFFdOpen((thandle_t)fio, "", "r");
+@@ -1125,6 +1129,27 @@ check for uncommon bitspersample values (e.g. 10, 12, ...)
+ */
+ static BOOL 
+ IsValidBitsPerSample(uint16 photometric, uint16 bitspersample, uint16 samplesperpixel) {
++	// get the pixel depth in bits
++	const uint16 pixel_depth = bitspersample * samplesperpixel;
++
++	// check for a supported pixel depth
++	switch (pixel_depth) {
++		case 1:
++		case 4:
++		case 8:
++		case 16:
++		case 24:
++		case 32:
++		case 48:
++		case 64:
++		case 96:
++		case 128:
++			// OK, go on
++			break;
++		default:
++			// unsupported pixel depth
++			return FALSE;
++	}
+ 
+ 	switch(bitspersample) {
+ 		case 1:
+@@ -1165,6 +1190,8 @@ IsValidBitsPerSample(uint16 photometric, uint16 bitspersample, uint16 samplesper
+ 		default:
+ 			return FALSE;
+ 	}
++	
++	return FALSE;
+ }
+ 
+ static TIFFLoadMethod  
+@@ -1254,16 +1281,31 @@ Read embedded thumbnail
+ static void 
+ ReadThumbnail(FreeImageIO *io, fi_handle handle, void *data, TIFF *tiff, FIBITMAP *dib) {
+ 	FIBITMAP* thumbnail = NULL;
++
++	fi_TIFFIO *fio = (fi_TIFFIO*)data;
++
++	/*
++	Thumbnail loading can cause recursions because of the way 
++	functions TIFFLastDirectory and TIFFSetSubDirectory are working.
++	We use here a hack to count the number of times the ReadThumbnail function was called. 
++	We only allow one call, check for this
++	*/
++	if (fio->thumbnailCount > 0) {
++		return;
++	}
++	else {
++		// update the thumbnail count (used to avoid recursion)
++		fio->thumbnailCount++;
++	}
+ 	
+ 	// read exif thumbnail (IFD 1) ...
+ 	
+-	/*
+-	// this code can cause unwanted recursion causing an overflow, it is thus disabled until we have a better solution
+-	// do we really need to read a thumbnail from the Exif segment ? knowing that TIFF store the thumbnail in the subIFD ...
+-	// 
+ 	toff_t exif_offset = 0;
+ 	if(TIFFGetField(tiff, TIFFTAG_EXIFIFD, &exif_offset)) {
+ 		
++		// this code can cause unwanted recursion causing an overflow, because of the way TIFFLastDirectory work
++		// => this is checked using 
++
+ 		if(!TIFFLastDirectory(tiff)) {
+ 			// save current position
+ 			const long tell_pos = io->tell_proc(handle);
+@@ -1273,15 +1315,15 @@ ReadThumbnail(FreeImageIO *io, fi_handle handle, void *data, TIFF *tiff, FIBITMA
+ 			int page = 1;
+ 			int flags = TIFF_DEFAULT;
+ 			thumbnail = Load(io, handle, page, flags, data);
++
+ 			// store the thumbnail (remember to release it before return)
+ 			FreeImage_SetThumbnail(dib, thumbnail);
+-			
++		
+ 			// restore current position
+ 			io->seek_proc(handle, tell_pos, SEEK_SET);
+ 			TIFFSetDirectory(tiff, cur_dir);
+ 		}
+ 	}
+-	*/
+ 	
+ 	// ... or read the first subIFD
+ 	
+@@ -1297,12 +1339,15 @@ ReadThumbnail(FreeImageIO *io, fi_handle handle, void *data, TIFF *tiff, FIBITMA
+ 				// save current position
+ 				const long tell_pos = io->tell_proc(handle);
+ 				const uint16 cur_dir = TIFFCurrentDirectory(tiff);
++
++				// this code can cause unwanted recursion causing an overflow, because of the way TIFFSetSubDirectory work
+ 				
+ 				if(TIFFSetSubDirectory(tiff, subIFD_offsets[0])) {
+ 					// load the thumbnail
+ 					int page = -1; 
+ 					int flags = TIFF_DEFAULT;
+ 					thumbnail = Load(io, handle, page, flags, data);
++
+ 					// store the thumbnail (remember to release it before return)
+ 					FreeImage_SetThumbnail(dib, thumbnail);
+ 				}
+@@ -2058,7 +2103,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
+ 				}
+ 
+ 				// calculate src line and dst pitch
+-				int dst_pitch = FreeImage_GetPitch(dib);
++				unsigned dst_pitch = FreeImage_GetPitch(dib);
+ 				uint32 tileRowSize = (uint32)TIFFTileRowSize(tif);
+ 				uint32 imageRowSize = (uint32)TIFFScanlineSize(tif);
+ 
+@@ -2088,7 +2133,7 @@ Load(FreeImageIO *io, fi_handle handle, int page, int flags, void *data) {
+ 						BYTE *src_bits = tileBuffer;
+ 						BYTE *dst_bits = bits + rowSize;
+ 						for(int k = 0; k < nrows; k++) {
+-							memcpy(dst_bits, src_bits, src_line);
++							memcpy(dst_bits, src_bits, MIN(dst_pitch, src_line));
+ 							src_bits += tileRowSize;
+ 							dst_bits -= dst_pitch;
+ 						}
diff --git a/media-libs/freeimage/freeimage-3.18.0-r2.ebuild b/media-libs/freeimage/freeimage-3.18.0-r2.ebuild
new file mode 100644
index 000000000000..3e551b4b3492
--- /dev/null
+++ b/media-libs/freeimage/freeimage-3.18.0-r2.ebuild
@@ -0,0 +1,119 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit eutils toolchain-funcs
+
+MY_PN=FreeImage
+MY_PV=${PV//.}
+MY_P=${MY_PN}${MY_PV}
+
+DESCRIPTION="Image library supporting many formats"
+HOMEPAGE="https://freeimage.sourceforge.io/"
+SRC_URI="mirror://sourceforge/${PN}/${MY_P}.zip
+	mirror://sourceforge/${PN}/${MY_P}.pdf"
+
+LICENSE="|| ( GPL-2 FIPL-1.0 )"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~x86 ~amd64-linux ~x86-linux"
+IUSE="jpeg jpeg2k mng openexr png raw static-libs tiff webp"
+
+# The tiff/ilmbase isn't a typo.  The TIFF plugin cheats and
+# uses code from it to handle 16bit<->float conversions.
+RDEPEND="
+	sys-libs/zlib
+	jpeg? ( virtual/jpeg:0 )
+	jpeg2k? ( media-libs/openjpeg:2= )
+	mng? ( media-libs/libmng:= )
+	openexr? ( media-libs/openexr:= )
+	png? ( media-libs/libpng:0= )
+	raw? ( media-libs/libraw:= )
+	tiff? (
+		media-libs/ilmbase:=
+		media-libs/tiff:0
+	)
+	webp? ( media-libs/libwebp:= )"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	app-arch/unzip
+	virtual/pkgconfig"
+
+S=${WORKDIR}/${MY_PN}
+
+DOCS=( "${DISTDIR}"/${MY_P}.pdf README.linux Whatsnew.txt )
+PATCHES=(
+	"${FILESDIR}"/${PN}-3.18.0-unbundling.patch
+	"${FILESDIR}"/${PN}-3.18.0-remove-jpeg-transform.patch
+	"${FILESDIR}"/${PN}-3.18.0-rename-jpeg_read_icc_profile.patch
+	"${FILESDIR}"/${PN}-3.18.0-disable-plugin-G3.patch
+	"${FILESDIR}"/${PN}-3.18.0-raw.patch
+	"${FILESDIR}"/${PN}-3.18.0-libjpeg9.patch
+	"${FILESDIR}"/${PN}-3.18.0-CVE-2019-12211-CVE-2019-12213.patch
+)
+
+src_prepare() {
+	pushd Source >/dev/null || die
+	cp LibJPEG/{transupp.c,transupp.h,jinclude.h} . || die
+	cp LibTIFF4/{tiffiop,tif_dir}.h . || die
+	rm -rf LibPNG LibMNG LibOpenJPEG ZLib OpenEXR LibRawLite LibTIFF4 LibJPEG LibWebP LibJXR || die
+	popd >/dev/null || die
+
+	edos2unix Makefile.{gnu,fip,srcs} fipMakefile.srcs */*.h */*/*.cpp
+	sed -i \
+		-e "s:/./:/:g" \
+		-e "s: ./: :g" \
+		-e 's: Source: \\\n\tSource:g' \
+		-e 's: Wrapper: \\\n\tWrapper:g' \
+		-e 's: Examples: \\\n\tExamples:g' \
+		-e 's: TestAPI: \\\n\tTestAPI:g' \
+		-e 's: -ISource: \\\n\t-ISource:g' \
+		-e 's: -IWrapper: \\\n\t-IWrapper:g' \
+		-e 's:INCLS:\nINCLS:g' \
+		Makefile.srcs fipMakefile.srcs || die
+	sed -i \
+		-e "/LibJPEG/d" \
+		-e "/LibJXR/d" \
+		-e "/LibPNG/d" \
+		-e "/LibTIFF/d" \
+		-e "/Source\/ZLib/d" \
+		-e "/LibOpenJPEG/d" \
+		-e "/OpenEXR/d" \
+		-e "/LibRawLite/d" \
+		-e "/LibMNG/d" \
+		-e "/LibWebP/d" \
+		-e "/LibJXR/d" \
+		Makefile.srcs fipMakefile.srcs || die
+
+	default
+}
+
+foreach_make() {
+	local m
+	for m in Makefile.{gnu,fip} ; do
+		emake -f ${m} \
+			USE_EXR=$(usex openexr) \
+			USE_JPEG=$(usex jpeg) \
+			USE_JPEG2K=$(usex jpeg2k) \
+			USE_MNG=$(usex mng) \
+			USE_PNG=$(usex png) \
+			USE_TIFF=$(usex tiff) \
+			USE_RAW=$(usex raw) \
+			USE_WEBP=$(usex webp) \
+			$(usex static-libs '' STATICLIB=) \
+			"$@"
+	done
+}
+
+src_compile() {
+	tc-export AR PKG_CONFIG
+	foreach_make \
+		CXX="$(tc-getCXX) -fPIC" \
+		CC="$(tc-getCC) -fPIC" \
+		${MY_PN}
+}
+
+src_install() {
+	foreach_make install DESTDIR="${ED}" INSTALLDIR="${ED}"/usr/$(get_libdir)
+	einstalldocs
+}
diff --git a/media-radio/fldigi/fldigi-4.1.12.ebuild b/media-radio/fldigi/fldigi-4.1.12.ebuild
index e3fa1740429b..2ce4f991e275 100644
--- a/media-radio/fldigi/fldigi-4.1.12.ebuild
+++ b/media-radio/fldigi/fldigi-4.1.12.ebuild
@@ -9,7 +9,7 @@ SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-3"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="hamlib nls pulseaudio"
 IUSE_CPU_FLAGS=" sse sse2 sse3"
 IUSE+=" ${IUSE_CPU_FLAGS// / cpu_flags_x86_}"
diff --git a/media-radio/flrig/flrig-1.3.50.ebuild b/media-radio/flrig/flrig-1.3.50.ebuild
index 4b7a44b607b5..8b174faaddca 100644
--- a/media-radio/flrig/flrig-1.3.50.ebuild
+++ b/media-radio/flrig/flrig-1.3.50.ebuild
@@ -10,7 +10,7 @@ SRC_URI="mirror://sourceforge/fldigi/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="nls"
 
 DOCS=(AUTHORS ChangeLog README)
diff --git a/media-radio/tlf/tlf-1.4.1.ebuild b/media-radio/tlf/tlf-1.4.1.ebuild
index fd4052ea4724..23bc6b749b8e 100644
--- a/media-radio/tlf/tlf-1.4.1.ebuild
+++ b/media-radio/tlf/tlf-1.4.1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://nongnu/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="test"
 
 RESTRICT="!test? ( test )"
diff --git a/media-radio/tucnak/tucnak-4.21.ebuild b/media-radio/tucnak/tucnak-4.21.ebuild
index f0c5f9931e94..8490a3d7874c 100644
--- a/media-radio/tucnak/tucnak-4.21.ebuild
+++ b/media-radio/tucnak/tucnak-4.21.ebuild
@@ -10,7 +10,7 @@ SRC_URI="http://tucnak.nagano.cz/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="alsa fftw gpm hamlib suid"
 
 RDEPEND="dev-libs/glib:2
diff --git a/media-radio/unixcw/unixcw-3.5.1-r1.ebuild b/media-radio/unixcw/unixcw-3.5.1-r1.ebuild
index 695691829a19..7391c5ffa589 100644
--- a/media-radio/unixcw/unixcw-3.5.1-r1.ebuild
+++ b/media-radio/unixcw/unixcw-3.5.1-r1.ebuild
@@ -11,7 +11,7 @@ SRC_URI="mirror://sourceforge/${PN}/${P}.tar.gz"
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ppc x86"
+KEYWORDS="~alpha amd64 ppc x86"
 IUSE="alsa ncurses pulseaudio suid test qt5"
 RESTRICT="!test? ( test )"
 
diff --git a/media-radio/xastir/xastir-2.1.6.ebuild b/media-radio/xastir/xastir-2.1.6.ebuild
index f001b459c47a..1da0b5592d83 100644
--- a/media-radio/xastir/xastir-2.1.6.ebuild
+++ b/media-radio/xastir/xastir-2.1.6.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/Xastir/Xastir/archive/Release-${PV}.tar.gz
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE="geotiff +graphicsmagick"
 
 DEPEND=">=x11-libs/motif-2.3:0
diff --git a/net-analyzer/zabbix/zabbix-4.0.22.ebuild b/net-analyzer/zabbix/zabbix-4.0.22.ebuild
index 844a2e68741e..53b0392d99ff 100644
--- a/net-analyzer/zabbix/zabbix-4.0.22.ebuild
+++ b/net-analyzer/zabbix/zabbix-4.0.22.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://cdn.zabbix.com/${PN}/sources/stable/4.0/${P}.tar.gz"
 LICENSE="GPL-2"
 SLOT="0"
 WEBAPP_MANUAL_SLOT="yes"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="~amd64 x86"
 IUSE="+agent java curl frontend ipv6 xmpp ldap libxml2 mysql openipmi oracle +postgres proxy server ssh ssl snmp sqlite odbc static"
 REQUIRED_USE="|| ( agent frontend proxy server )
 	proxy? ( ^^ ( mysql oracle postgres sqlite odbc ) )
diff --git a/net-analyzer/zabbix/zabbix-4.4.10.ebuild b/net-analyzer/zabbix/zabbix-4.4.10.ebuild
index 3d4726270762..7ef580a10731 100644
--- a/net-analyzer/zabbix/zabbix-4.4.10.ebuild
+++ b/net-analyzer/zabbix/zabbix-4.4.10.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://cdn.zabbix.com/${PN}/sources/stable/4.4/${P}.tar.gz"
 LICENSE="GPL-2"
 SLOT="0"
 WEBAPP_MANUAL_SLOT="yes"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="~amd64 x86"
 IUSE="+agent java curl frontend ipv6 ldap libxml2 mysql openipmi oracle +postgres proxy server ssh ssl snmp sqlite odbc static"
 REQUIRED_USE="|| ( agent frontend proxy server )
 	proxy? ( ^^ ( mysql oracle postgres sqlite odbc ) )
diff --git a/net-analyzer/zabbix/zabbix-5.0.2.ebuild b/net-analyzer/zabbix/zabbix-5.0.2.ebuild
index e393d4a24eba..0918dc7c5b0f 100644
--- a/net-analyzer/zabbix/zabbix-5.0.2.ebuild
+++ b/net-analyzer/zabbix/zabbix-5.0.2.ebuild
@@ -15,7 +15,7 @@ SRC_URI="https://cdn.zabbix.com/${PN}/sources/stable/$(ver_cut 1-2)/${P}.tar.gz"
 LICENSE="GPL-2"
 SLOT="0"
 WEBAPP_MANUAL_SLOT="yes"
-KEYWORDS="~amd64 ~x86"
+KEYWORDS="~amd64 x86"
 IUSE="+agent java curl frontend ipv6 ldap libxml2 mysql openipmi oracle +postgres proxy server ssh ssl snmp sqlite odbc static"
 REQUIRED_USE="|| ( agent frontend proxy server )
 	proxy? ( ^^ ( mysql oracle postgres sqlite odbc ) )
diff --git a/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.44.ebuild b/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.44.ebuild
index fb95b87cdf9a..a0456c6a5fc3 100644
--- a/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.44.ebuild
+++ b/net-dns/dnscrypt-proxy/dnscrypt-proxy-2.0.44.ebuild
@@ -12,7 +12,7 @@ if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://${EGO_PN}.git"
 else
 	SRC_URI="https://${EGO_PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~amd64 arm arm64 ~ppc64 ~x86"
+	KEYWORDS="amd64 arm arm64 ~ppc64 ~x86"
 fi
 
 DESCRIPTION="A flexible DNS proxy, with support for encrypted DNS protocols"
diff --git a/net-irc/unrealircd/Manifest b/net-irc/unrealircd/Manifest
index 6c7c0f474ffc..1ad050d01a3f 100644
--- a/net-irc/unrealircd/Manifest
+++ b/net-irc/unrealircd/Manifest
@@ -1,2 +1,3 @@
 DIST unrealircd-4.2.4.1.tar.gz 6090725 BLAKE2B 817a7c2a13a495944676d08ed90b36f6795fe43ee171efc6661980e6da9a8cc8d98c4fb0eb8221ac6af85ab1a9b5578a2e992d7b41696434430e58918bc30145 SHA512 752573c4af1f92a10739bb2b0cdaade1948207b46d28ae5177e1dfd6b0663044bc22dce5ffe8549882cd70325e3ef7e3296182fffbb84e08d59dbbdd6551a686
 DIST unrealircd-5.0.5.1.tar.gz 4957950 BLAKE2B 7e92f941662cec0a202589aecf372578e568559360761e17735d4637785ff737ec24c07593b666dd830b0fc1f36293a700693134c34ad32095839a73e7368677 SHA512 57272afa9b758c71522730a5a5a45819731271c02b25f6e0b9da30671d38ecfbc1adc0e91eef9dc4c1d67b2e1fa4fc9a09377152f2b0e3e97e8f7fe4f144288b
+DIST unrealircd-5.0.6.tar.gz 4975195 BLAKE2B 3ba459e0ec932e9f240825ba9f1fa40e300fe7958f999de86d5653f2e6e4940be8b8da9c885c97bd738abefef601d61da6c4e6c7199c7052d29a74fcf5048828 SHA512 7532e9ab2e039f21796ae813881aec9d34b502ab64efc4323c938232c8901ce882dbcce497ad93df270e4b5fa2e9633c0971f2a6b3213ad458756aea92aa1612
diff --git a/net-irc/unrealircd/unrealircd-5.0.6.ebuild b/net-irc/unrealircd/unrealircd-5.0.6.ebuild
new file mode 100644
index 000000000000..d2f7a8a96ec9
--- /dev/null
+++ b/net-irc/unrealircd/unrealircd-5.0.6.ebuild
@@ -0,0 +1,171 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+SSL_CERT_MANDATORY=1
+inherit ssl-cert systemd
+
+DESCRIPTION="An advanced Internet Relay Chat daemon"
+HOMEPAGE="https://www.unrealircd.org/"
+SRC_URI="https://www.unrealircd.org/downloads/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~amd64 ~ppc ~x86 ~amd64-linux"
+IUSE="class-nofakelag curl libressl +operoverride operoverride-verify +prefixaq showlistmodes"
+
+RDEPEND="
+	acct-group/unrealircd
+	acct-user/unrealircd
+	>=app-crypt/argon2-20171227-r1:=
+	dev-libs/libpcre2
+	>=net-dns/c-ares-1.7:=
+	!libressl? ( dev-libs/openssl:0= )
+	libressl? ( dev-libs/libressl:= )
+	curl? ( net-misc/curl[adns] )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig"
+
+DOCS=( doc/{Authors,Donation,RELEASE-NOTES.md,tao.of.irc,technical/,translations.txt} )
+
+src_prepare() {
+	# QA check against bundled pkgs
+	rm -r extras || die
+
+	# building third-party modules (which we don't do) cause a sandbox violation
+	# bug 704444
+	echo "" > src/buildmod || die
+
+	if use class-nofakelag; then
+		sed -i -e 's:#undef\( FAKELAG_CONFIGURABLE\):#define\1:' include/config.h || die
+	fi
+
+	eapply_user
+}
+
+src_configure() {
+	# Default value for privatelibdir adds a build path to -Wl,-rpath.
+	econf \
+		--with-bindir="${EPREFIX}"/usr/bin \
+		--with-cachedir="${EPREFIX}"/var/lib/${PN} \
+		--with-confdir="${EPREFIX}"/etc/${PN} \
+		--with-datadir="${EPREFIX}"/var/lib/${PN} \
+		--with-docdir="${EPREFIX}"/usr/share/doc/${PF} \
+		--with-logdir="${EPREFIX}"/var/log/${PN} \
+		--with-modulesdir="${EPREFIX}"/usr/"$(get_libdir)"/${PN}/modules \
+		--without-privatelibdir \
+		--with-pidfile="${EPREFIX}"/run/${PN}/ircd.pid \
+		--with-tmpdir="${EPREFIX}"/var/lib/${PN}/tmp \
+		--with-maxconnections=1024 \
+		--with-nick-history=2000 \
+		--with-permissions=0640 \
+		--with-system-argon2 \
+		--with-system-cares \
+		--with-system-pcre2 \
+		--enable-dynamic-linking \
+		--enable-ssl="${EPREFIX}"/usr \
+		$(use_enable curl libcurl "${EPREFIX}"/usr) \
+		$(use_enable prefixaq) \
+		$(use_with showlistmodes) \
+		$(use_with !operoverride no-operoverride) \
+		$(use_with operoverride-verify)
+}
+
+src_install() {
+	keepdir /var/log/${PN}
+	keepdir /var/lib/${PN}/tmp
+
+	newbin src/ircd ${PN}
+
+	(
+		cd src/modules || die
+		for subdir in $(find . -type d -print); do
+			if [[ -n $(shopt -s nullglob; echo ${subdir}/*.so) ]]; then
+				exeinto /usr/$(get_libdir)/${PN}/modules/"${subdir}"
+				doexe "${subdir}"/*.so
+			fi
+		done
+	)
+
+	insinto /etc/${PN}
+	# Purposefully omitting the examples/ and ssl/ subdirectories. ssl
+	# is redundant with app-misc/ca-certificates and examples will all
+	# be in docs anyway.
+	doins -r doc/conf/{aliases,help}
+	doins doc/conf/*.conf
+	newins doc/conf/examples/example.conf ${PN}.conf
+	keepdir /etc/${PN}/tls
+
+	einstalldocs
+
+	newinitd "${FILESDIR}"/${PN}.initd-r2 ${PN}
+	newconfd "${FILESDIR}"/${PN}.confd-r3 ${PN}
+
+	# config should be read-only
+	fperms -R 0640 /etc/${PN}
+	fperms 0750 /etc/${PN}{,/aliases,/help}
+	fperms 0750 /etc/${PN}/tls
+	# state is editable but not owned by unrealircd directly
+	fperms 0770 /var/log/${PN}
+	fperms 0770 /var/lib/${PN}{,/tmp}
+	fowners -R root:unrealircd /{etc,var/{lib,log}}/${PN}
+
+	# By default looks in /etc/unrealircd/ssl/curl-ca-bundle.crt. Fix
+	# that to look for ca-certificates-provided file instead. %s is
+	# CONFDIR. #618066
+	dosym ../../ssl/certs/ca-certificates.crt /etc/${PN}/tls/curl-ca-bundle.crt
+
+	insinto $(systemd_get_systemunitdir)
+	doins "${FILESDIR}"/${PN}.service
+}
+
+pkg_postinst() {
+	# Move docert call from src_install() to install_cert in pkg_postinst for
+	# bug #201682
+	if [[ ! -f "${EROOT}"/etc/${PN}/tls/server.cert.key ]]; then
+		if [[ -f "${EROOT}"/etc/${PN}/ssl/server.cert.key ]]; then
+			ewarn "The location ${PN} looks for SSL certificates has changed"
+			ewarn "from ${EROOT}/etc/${PN}/ssl to ${EROOT}/etc/${PN}/tls."
+			ewarn "Please move your existing certificates."
+		else
+			(
+				umask 0037
+				install_cert /etc/${PN}/tls/server.cert
+				chown unrealircd "${EROOT}"/etc/${PN}/tls/server.cert.*
+				ln -snf server.cert.key "${EROOT}"/etc/${PN}/tls/server.key.pem
+			)
+		fi
+	fi
+
+	local unrealircd_conf="${EROOT}"/etc/${PN}/${PN}.conf
+	# Fix up the default cloak keys.
+	if grep -qe '"and another one";$' "${unrealircd_conf}" && grep -qe '"aoAr1HnR6gl3sJ7hVz4Zb7x4YwpW";$' "${unrealircd_conf}"; then
+		ebegin "Generating cloak-keys"
+		local keys=(
+			$(su ${PN} -s /bin/sh -c "${PN} -k 2>&1 | tail -n 3")
+		)
+		[[ -n ${keys[0]} || -n ${keys[1]} || -n ${keys[2]} ]]
+		eend $?
+
+		ebegin "Substituting cloak-keys into ${unrealircd_conf}"
+		sed -i \
+			-e '/cloak-keys/ {
+n
+s/"aoAr1HnR6gl3sJ7hVz4Zb7x4YwpW";/"'"${keys[0]}"'";/
+n
+s/"and another one";/"'"${keys[1]}"'";/
+n
+s/"and another one";/"'"${keys[2]}"'";/
+}' \
+			"${unrealircd_conf}"
+		eend $?
+	fi
+
+	elog "UnrealIRCd will not run until you've set up /etc/unrealircd/unrealircd.conf"
+	elog
+	elog "You can also configure ${PN} start at boot with rc-update(1)."
+	elog "It is recommended to run unrealircd as an unprivileged user."
+	elog "The provided init.d script does this for you."
+}
diff --git a/net-misc/asterisk/asterisk-13.34.0.ebuild b/net-misc/asterisk/asterisk-13.34.0.ebuild
index 0697a07c910d..264b63f4f165 100644
--- a/net-misc/asterisk/asterisk-13.34.0.ebuild
+++ b/net-misc/asterisk/asterisk-13.34.0.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.asterisk.org/pub/telephony/asterisk/releases/${P}.tar
 	https://downloads.uls.co.za/gentoo/asterisk/gentoo-asterisk-patchset-4.08.tar.bz2"
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~ppc ~ppc64 ~x86"
+KEYWORDS="amd64 ~ppc ~ppc64 x86"
 
 IUSE_VOICEMAIL_STORAGE="
 	+voicemail_storage_file
diff --git a/sys-apps/portage/portage-2.3.103.ebuild b/sys-apps/portage/portage-2.3.103.ebuild
index e4f0bcdc9c45..83fc2c571e24 100644
--- a/sys-apps/portage/portage-2.3.103.ebuild
+++ b/sys-apps/portage/portage-2.3.103.ebuild
@@ -13,7 +13,7 @@ DESCRIPTION="Portage is the package management and distribution system for Gento
 HOMEPAGE="https://wiki.gentoo.org/wiki/Project:Portage"
 
 LICENSE="GPL-2"
-KEYWORDS="~alpha amd64 ~arm arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv s390 sparc x86"
 SLOT="0"
 IUSE="apidoc build doc gentoo-dev +ipc +native-extensions +rsync-verify selinux xattr"
 
diff --git a/x11-misc/kdocker/kdocker-5.3.ebuild b/x11-misc/kdocker/kdocker-5.3.ebuild
index 82d27817c1f9..67fc17c6af22 100644
--- a/x11-misc/kdocker/kdocker-5.3.ebuild
+++ b/x11-misc/kdocker/kdocker-5.3.ebuild
@@ -12,7 +12,7 @@ SRC_URI="https://github.com/user-none/KDocker/archive/${PV}.tar.gz -> ${MY_P}.ta
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 x86"
+KEYWORDS="amd64 x86"
 IUSE=""
 
 DEPEND="