diff --git a/app-accessibility/brltty/brltty-6.8.ebuild b/app-accessibility/brltty/brltty-6.8.ebuild
index 277a3b17ff526..0f522e7be883b 100644
--- a/app-accessibility/brltty/brltty-6.8.ebuild
+++ b/app-accessibility/brltty/brltty-6.8.ebuild
@@ -4,8 +4,6 @@
 EAPI=8
 
 FINDLIB_USE="ocaml"
-JAVA_PKG_WANT_SOURCE="1.8"
-JAVA_PKG_WANT_TARGET="1.8"
 LUA_COMPAT=( lua5-4 )
 PYTHON_COMPAT=( python3_{11..14} )
 
diff --git a/app-admin/setools/Manifest b/app-admin/setools/Manifest
index cddf08f12d6b4..bd9b113128bf2 100644
--- a/app-admin/setools/Manifest
+++ b/app-admin/setools/Manifest
@@ -1 +1,2 @@
 DIST setools-4.5.1.tar.bz2 264998 BLAKE2B 479cec6f541c1e7125d641928ba49aee949e538612a478840cec2d70106dcf9f7fa5b8049c9d18c560587670ee624a3a744714667d52b99cff24c51e72026db7 SHA512 1045c223423fcb056ffbc2f93c4dc0ccc6ae078ce7d2acbe3a3c65de19440fe801b5b9f71038cde62bf9851f52d868c845aafbe33691ee531cf9854217e061d8
+DIST setools-4.6.0.tar.bz2 262758 BLAKE2B 0a0c06183575cb440008f11458da01f2a3a2ecfb5874678e800569bff6c5b178551df1ee0e3eea1ba6ead2baf287ddd7ff2b79db6efe0d0db08fe47a57750187 SHA512 2b4b35c2b843de5a4867f9b209b9f69a0c9da4f5c49df38c8056b27790e7198ff373ad6e592ae620b031c3a24e471dbef20d0cdb9c044c6b2db644313a9bab91
diff --git a/app-admin/setools/setools-4.6.0.ebuild b/app-admin/setools/setools-4.6.0.ebuild
new file mode 100644
index 0000000000000..317f66653aae9
--- /dev/null
+++ b/app-admin/setools/setools-4.6.0.ebuild
@@ -0,0 +1,64 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_EXT=1
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit distutils-r1 optfeature
+
+DESCRIPTION="Policy Analysis Tools for SELinux"
+HOMEPAGE="https://github.com/SELinuxProject/setools/wiki"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/setools.git"
+	S="${WORKDIR}/${P}"
+else
+	SRC_URI="https://github.com/SELinuxProject/setools/releases/download/${PV}/${P}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S="${WORKDIR}/${PN}"
+fi
+
+LICENSE="GPL-2 LGPL-2.1"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	${PYTHON_DEPS}
+	>=dev-python/networkx-2.6[${PYTHON_USEDEP}]
+	dev-python/setuptools[${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-3.2:=
+	>=sys-libs/libselinux-3.2:=
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	>=dev-python/cython-0.29.14[${PYTHON_USEDEP}]
+	test? (
+		dev-python/pyqt6[gui,testlib,widgets,${PYTHON_USEDEP}]
+		dev-python/pytest-qt[${PYTHON_USEDEP}]
+		sys-apps/checkpolicy
+	)
+"
+
+distutils_enable_tests pytest
+
+python_prepare_all() {
+	sed -i "s@^lib_dirs = .*@lib_dirs = ['${ROOT:-/}usr/$(get_libdir)']@" "${S}"/setup.py || \
+		die "failed to set lib_dirs"
+
+	distutils-r1_python_prepare_all
+}
+
+python_test() {
+	rm -rf setools || die
+	epytest
+}
+
+pkg_postinst() {
+	optfeature "apol: graphical SELinux policy analysis tool" \
+		"dev-python/pyqt6[gui,widgets]" "dev-python/pygraphviz"
+}
diff --git a/app-crypt/dieharder/dieharder-3.31.1-r5.ebuild b/app-crypt/dieharder/dieharder-3.31.1-r5.ebuild
new file mode 100644
index 0000000000000..60e14e50c70b0
--- /dev/null
+++ b/app-crypt/dieharder/dieharder-3.31.1-r5.ebuild
@@ -0,0 +1,58 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit autotools flag-o-matic
+
+DESCRIPTION="An advanced suite for testing the randomness of RNGs"
+HOMEPAGE="https://www.phy.duke.edu/~rgb/General/dieharder.php"
+SRC_URI="https://www.phy.duke.edu/~rgb/General/${PN}/${P}.tgz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+IUSE="doc"
+RESTRICT="test" # Way too long
+
+RDEPEND="sci-libs/gsl:="
+DEPEND="${RDEPEND}"
+BDEPEND=" doc? ( dev-tex/latex2html )"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-build.patch
+	"${FILESDIR}"/${P}-urandom-64bit.patch
+	"${FILESDIR}"/${P}-cross-compile.patch
+	"${FILESDIR}"/${P}-fix_shuffle.patch
+)
+
+src_prepare() {
+	default
+	eautoreconf
+}
+
+src_configure() {
+	append-flags -fcommon
+	default
+}
+
+src_compile() {
+	default
+	use doc && emake -C manual
+}
+
+src_install() {
+	if use doc; then
+		DOCS=( ChangeLog manual/dieharder.pdf manual/dieharder.ps )
+		HTML_DOCS=( dieharder.html )
+	fi
+
+	default
+
+	docinto dieharder
+	dodoc dieharder/{NOTES,README}
+	docinto libdieharder
+	dodoc libdieharder/{NOTES,README}
+
+	find "${ED}" -name '*.la' -delete || die
+}
diff --git a/app-crypt/dieharder/files/dieharder-3.31.1-fix_shuffle.patch b/app-crypt/dieharder/files/dieharder-3.31.1-fix_shuffle.patch
new file mode 100644
index 0000000000000..fed9eda32802a
--- /dev/null
+++ b/app-crypt/dieharder/files/dieharder-3.31.1-fix_shuffle.patch
@@ -0,0 +1,13 @@
+see https://bugs.gentoo.org/962932
+let automake handle build ordering w/ SUBDIRS
+dieharder_LDADD is already well defined in dieharder/Makefile.am
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -74,7 +74,6 @@ SPEC = $(PROJECT).spec
+ # presume the simplest of dependencies and remake if includes change
+ # for example.
+ #========================================================================
+-all: $(LIBTIME) $(PROGTIME) $(INCTIME)
+ 
+ # This is not, actually, a particularly useful toplevel target.  To
+ # work correctly it also would require a full parsing of all
diff --git a/app-text/aspell/aspell-0.60.8.2.ebuild b/app-text/aspell/aspell-0.60.8.2.ebuild
index 97919f6699281..54e3c63933acb 100644
--- a/app-text/aspell/aspell-0.60.8.2.ebuild
+++ b/app-text/aspell/aspell-0.60.8.2.ebuild
@@ -14,7 +14,7 @@ S="${WORKDIR}/${MY_P}"
 
 LICENSE="LGPL-2.1"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
 IUSE="nls unicode"
 
 # All available language app-dicts/aspell-* packages.
diff --git a/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-bool-confusion.patch b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-bool-confusion.patch
new file mode 100644
index 0000000000000..875c366bfdd8d
--- /dev/null
+++ b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-bool-confusion.patch
@@ -0,0 +1,44 @@
+https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=795c4a6db646
+Bug: https://bugs.gentoo.org/964040
+
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Wed, 26 Nov 2025 15:31:57 +0000
+Subject: Bug 708608: Fix confusion caused by modern C having a boolean type
+
+Because C99 and later have a proper, built-in boolean type, rather than a
+typedef of an underlying integer type, the check for whether we're rendering
+an image into a pattern accumulator was yielding an unexpected result.
+
+The default dev_spec_op method returns an "undefined" error when queried with the
+gxdso_in_pattern_accumulator op, that is, a negative integer. When "bool" was
+simply a typdefed integer value, that was fine, and the following lines
+checked for and handled that.
+
+With an actual boolean type, false == 0, and true == !false, so any value other
+than 0 became true.
+
+That then changed the decision on whether to gridfit images, meaning the user
+space to device space rounding was handled differently. That then caused a
+scanline of the image to be repeated.
+
+The value is now assigned based on a conditional, so it correctly assigns a
+true/false value.
+---
+ base/gxipixel.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/base/gxipixel.c b/base/gxipixel.c
+index 768a93114..cb3ff36a6 100644
+--- a/base/gxipixel.c
++++ b/base/gxipixel.c
+@@ -319,9 +319,7 @@ gx_image_enum_begin(gx_device * dev, const gs_gstate * pgs,
+      */
+ 
+     /* Ask the device if we are in a pattern accumulator */
+-    in_pattern_accumulator = (dev_proc(dev, dev_spec_op)(dev, gxdso_in_pattern_accumulator, NULL, 0));
+-    if (in_pattern_accumulator < 0)
+-        in_pattern_accumulator = 0;
++    in_pattern_accumulator = ((dev_proc(dev, dev_spec_op)(dev, gxdso_in_pattern_accumulator, NULL, 0)) > 0);
+ 
+     /* Figure out if we are orthogonal */
+     if (mat.xy == 0 && mat.yx == 0)
diff --git a/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-gcc-14.patch b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-gcc-14.patch
new file mode 100644
index 0000000000000..1a4c226111d4f
--- /dev/null
+++ b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-gcc-14.patch
@@ -0,0 +1,14 @@
+https://bugs.ghostscript.com/show_bug.cgi?id=708608#c4
+Bug: https://bugs.gentoo.org/971915
+
+--- a/base/stdpre.h
++++ b/base/stdpre.h
+@@ -343,7 +343,7 @@ typedef signed char schar;
+  */
+ 
+ /* C23 has bool as a builtin type. */
+-#if !defined(__cplusplus) && (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 202311L)
++#if !defined(__cplusplus) && (!defined(__STDC_VERSION__) || __STDC_VERSION__ < 202000L)
+ #ifdef __BEOS__
+ typedef unsigned char bool;
+ #else
diff --git a/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-stdint.patch b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-stdint.patch
new file mode 100644
index 0000000000000..40e86c4c3e9f3
--- /dev/null
+++ b/app-text/ghostscript-gpl/files/ghostscript-gpl-10.06.0-stdint.patch
@@ -0,0 +1,110 @@
+diff -rup ghostscript-10.06.0/base/gsalloc.c ghostscript-10.06.0-fix/base/gsalloc.c
+--- ghostscript-10.06.0/base/gsalloc.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/base/gsalloc.c	2026-04-02 20:49:47.663907312 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* Standard memory allocator */
++#include <stdint.h>
+ #include "gx.h"
+ #include "memory_.h"
+ #include "gserrors.h"
+diff -rup ghostscript-10.06.0/base/gsmchunk.c ghostscript-10.06.0-fix/base/gsmchunk.c
+--- ghostscript-10.06.0/base/gsmchunk.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/base/gsmchunk.c	2026-04-02 20:36:07.054944826 +0200
+@@ -21,6 +21,7 @@
+  * a top-down semi-splaying access scheme on lookups and
+  * insertions. */
+ 
++#include <stdint.h>
+ #include "memory_.h"
+ #include "gx.h"
+ #include "gsstruct.h"
+diff -rup ghostscript-10.06.0/base/gsmisc.c ghostscript-10.06.0-fix/base/gsmisc.c
+--- ghostscript-10.06.0/base/gsmisc.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/base/gsmisc.c	2026-04-02 20:35:38.579157437 +0200
+@@ -35,6 +35,7 @@ orig_sqrt(double x)
+ }
+ 
+ /* Here is the real #include section. */
++#include <stdint.h>
+ #include "ctype_.h"
+ #include "malloc_.h"
+ #include "math_.h"
+diff -rup ghostscript-10.06.0/base/gxblend.h ghostscript-10.06.0-fix/base/gxblend.h
+--- ghostscript-10.06.0/base/gxblend.h	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/base/gxblend.h	2026-04-02 20:33:39.431037868 +0200
+@@ -18,6 +18,7 @@
+ #ifndef gxblend_INCLUDED
+ #  define gxblend_INCLUDED
+ 
++#include <stdint.h>
+ #include "gxcindex.h"
+ #include "gxcvalue.h"
+ #include "gxfrac.h"
+diff -rup ghostscript-10.06.0/base/gxclmem.c ghostscript-10.06.0-fix/base/gxclmem.c
+--- ghostscript-10.06.0/base/gxclmem.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/base/gxclmem.c	2026-04-02 20:36:39.973691086 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* RAM-based command list implementation */
++#include <stdint.h>
+ #include "memory_.h"
+ #include "gx.h"
+ #include "gserrors.h"
+diff -rup ghostscript-10.06.0/psi/idebug.c ghostscript-10.06.0-fix/psi/idebug.c
+--- ghostscript-10.06.0/psi/idebug.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/psi/idebug.c	2026-04-02 20:37:46.665170371 +0200
+@@ -18,6 +18,7 @@
+ /* This file must always be compiled with DEBUG set. */
+ #undef DEBUG
+ #define DEBUG
++#include <stdint.h>
+ #include "string_.h"
+ #include "ghost.h"
+ #include "gxalloc.h"		/* for procs for getting struct type */
+diff -rup ghostscript-10.06.0/psi/idict.c ghostscript-10.06.0-fix/psi/idict.c
+--- ghostscript-10.06.0/psi/idict.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/psi/idict.c	2026-04-02 20:37:22.277362728 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* Dictionary implementation */
++#include <stdint.h>
+ #include "math_.h"		/* for frexp */
+ #include "string_.h"		/* for strlen */
+ #include "ghost.h"
+diff -rup ghostscript-10.06.0/psi/idstack.c ghostscript-10.06.0-fix/psi/idstack.c
+--- ghostscript-10.06.0/psi/idstack.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/psi/idstack.c	2026-04-02 20:38:40.001719693 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* Implementation of dictionary stacks */
++#include <stdint.h>
+ #include "ghost.h"
+ #include "idict.h"
+ #include "idictdef.h"
+diff -rup ghostscript-10.06.0/psi/interp.c ghostscript-10.06.0-fix/psi/interp.c
+--- ghostscript-10.06.0/psi/interp.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/psi/interp.c	2026-04-02 20:39:06.601472602 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* Ghostscript language interpreter */
++#include <stdint.h>
+ #include "memory_.h"
+ #include "string_.h"
+ #include "ghost.h"
+diff -rup ghostscript-10.06.0/psi/iutil.c ghostscript-10.06.0-fix/psi/iutil.c
+--- ghostscript-10.06.0/psi/iutil.c	2025-09-09 11:36:39.000000000 +0200
++++ ghostscript-10.06.0-fix/psi/iutil.c	2026-04-02 20:38:35.765759042 +0200
+@@ -15,6 +15,7 @@
+ 
+ 
+ /* Utilities for Ghostscript interpreter */
++#include <stdint.h>
+ #include "math_.h"		/* for fabs */
+ #include "memory_.h"
+ #include "string_.h"
diff --git a/app-text/ghostscript-gpl/ghostscript-gpl-10.06.0-r1.ebuild b/app-text/ghostscript-gpl/ghostscript-gpl-10.06.0-r1.ebuild
new file mode 100644
index 0000000000000..1345771160e3c
--- /dev/null
+++ b/app-text/ghostscript-gpl/ghostscript-gpl-10.06.0-r1.ebuild
@@ -0,0 +1,216 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit autotools flag-o-matic toolchain-funcs
+
+MY_PN=${PN/-gpl}
+MY_P="${MY_PN}-${PV/_}"
+PVM=$(ver_cut 1-2)
+PVM_S=$(ver_rs 1-2 "")
+
+# Use https://gitweb.gentoo.org/proj/codec/ghostscript-gpl-patches.git/ for patches
+# See 'index' branch for README
+MY_PATCHSET="ghostscript-gpl-10.04.0-patches.tar.xz"
+
+DESCRIPTION="Interpreter for the PostScript language and PDF"
+HOMEPAGE="https://ghostscript.com/ https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/"
+SRC_URI="https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${PVM_S}/${MY_P}.tar.xz"
+if [[ -n "${MY_PATCHSET}" ]] ; then
+	SRC_URI+=" https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCHSET}"
+fi
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="AGPL-3 CPL-1.0"
+SLOT="0/$(ver_cut 1-2)"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="cups cpu_flags_arm_neon dbus gtk l10n_de static-libs unicode X"
+
+LANGS="ja ko zh-CN zh-TW"
+for X in ${LANGS} ; do
+	IUSE="${IUSE} l10n_${X}"
+done
+
+DEPEND="
+	app-text/libpaper:=
+	media-libs/fontconfig
+	>=media-libs/freetype-2.4.9:2=
+	>=media-libs/jbig2dec-0.19:=
+	>=media-libs/lcms-2.6:2
+	>=media-libs/libpng-1.6.2:=
+	media-libs/libjpeg-turbo:=
+	>=media-libs/openjpeg-2.1.0:2=
+	>=media-libs/tiff-4.0.1:=
+	>=virtual/zlib-1.2.7:=
+	cups? ( >=net-print/cups-1.3.8 )
+	dbus? ( sys-apps/dbus )
+	gtk? ( x11-libs/gtk+:3 )
+	unicode? ( net-dns/libidn:= )
+	X? ( x11-libs/libXt x11-libs/libXext )
+"
+BDEPEND="virtual/pkgconfig"
+# bug #844115 for newer poppler-data dep
+RDEPEND="
+	${DEPEND}
+	>=app-text/poppler-data-0.4.11-r2
+	>=media-fonts/urw-fonts-2.4.9
+	l10n_ja? ( media-fonts/kochi-substitute )
+	l10n_ko? ( media-fonts/baekmuk-fonts )
+	l10n_zh-CN? ( media-fonts/arphicfonts )
+	l10n_zh-TW? ( media-fonts/arphicfonts )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-10.03.1-arm64-neon-tesseract.patch
+	"${FILESDIR}"/${PN}-10.06.0-tesseract-fPIC.patch
+	"${FILESDIR}"/${PN}-10.06.0-32-bit.patch
+	"${FILESDIR}"/${PN}-10.06.0-arm-brotli.patch
+	"${FILESDIR}"/${PN}-10.06.0-bool-confusion.patch
+	"${FILESDIR}"/${PN}-10.06.0-gcc-14.patch
+	"${FILESDIR}"/${PN}-10.06.0-stdint.patch
+)
+
+src_prepare() {
+	if [[ -n ${MY_PATCHSET} ]] ; then
+		# apply various patches, many borrowed from Fedora
+		# https://src.fedoraproject.org/rpms/ghostscript
+		# and Debian
+		# https://salsa.debian.org/printing-team/ghostscript/-/tree/debian/latest/debian/patches
+		eapply "${WORKDIR}"/${MY_PATCHSET%%.tar*}
+	fi
+
+	default
+
+	# Remove internal copies of various libraries
+	rm -r cups/libs || die
+	rm -r freetype || die
+	rm -r jbig2dec || die
+	rm -r jpeg || die
+	rm -r lcms2mt || die
+	rm -r libpng || die
+	rm -r tiff || die
+	rm -r zlib || die
+	rm -r openjpeg || die
+	# Remove internal CMaps (CMaps from poppler-data are used instead)
+	rm -r Resource/CMap || die
+
+	if ! use gtk ; then
+		sed -e "s:\$(GSSOX)::" \
+			-e "s:.*\$(GSSOX_XENAME)$::" \
+			-i base/unix-dll.mak || die "sed failed"
+	fi
+
+	# Force the include dirs to a neutral location.
+	sed -e "/^ZLIBDIR=/s:=.*:=${T}:" \
+		-i configure.ac || die
+	# Some files depend on zlib.h directly.  Redirect them. #573248
+	# Also make sure to not define OPJ_STATIC to avoid linker errors due to
+	# hidden symbols (https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203327#c1)
+	sed -e '/^zlib_h/s:=.*:=:' \
+		-e 's|-DOPJ_STATIC ||' \
+		-i base/lib.mak || die
+
+	# Search path fix
+	# put LDFLAGS after BINDIR, bug #383447
+	sed -e "s:\$\(gsdatadir\)/lib:@datarootdir@/ghostscript/${PV}/$(get_libdir):" \
+		-e "s:exdir=.*:exdir=@datarootdir@/doc/${PF}/examples:" \
+		-e "s:docdir=.*:docdir=@datarootdir@/doc/${PF}/html:" \
+		-e "s:GS_DOCDIR=.*:GS_DOCDIR=@datarootdir@/doc/${PF}/html:" \
+		-e 's:-L$(BINDIR):& $(LDFLAGS):g' \
+		-i Makefile.in base/*.mak || die "sed failed"
+
+	# Remove incorrect symlink, bug 590384
+	rm ijs/ltmain.sh || die
+	eautoreconf
+
+	cd ijs || die
+	eautoreconf
+}
+
+src_configure() {
+	# Unsupported upstream, bug #884841
+	filter-lto
+
+	# bug #899952
+	append-lfs-flags
+
+	local FONTPATH
+	for path in \
+		"${EPREFIX}"/usr/share/fonts/urw-fonts \
+		"${EPREFIX}"/usr/share/fonts/Type1 \
+		"${EPREFIX}"/usr/share/fonts
+	do
+		FONTPATH="${FONTPATH}${FONTPATH:+:}${EPREFIX}${path}"
+	done
+
+	# Do not add --enable-dynamic here, it's not supported fully upstream
+	# https://bugs.ghostscript.com/show_bug.cgi?id=705895
+	# bug #884707
+	#
+	# leptonica and tesseract are bundled but modified upstream, like in
+	# mujs/mupdf.
+	#
+	# There is --without-local-brotli but it wants a non-existent -lbrotli.
+	# Fixed in https://bugs.ghostscript.com/show_bug.cgi?id=708832 for next
+	# release.
+	PKGCONFIG=$(type -P $(tc-getPKG_CONFIG)) econf \
+		--enable-freetype \
+		--enable-fontconfig \
+		--enable-openjpeg \
+		--disable-compile-inits \
+		--with-drivers=ALL \
+		--with-fontpath="${FONTPATH}" \
+		--with-ijs \
+		--with-jbig2dec \
+		--with-libpaper \
+		--with-system-libtiff \
+		$(use_enable cups) \
+		$(use_enable dbus) \
+		$(use_enable gtk) \
+		$(use_enable cpu_flags_arm_neon neon) \
+		$(use_with cups pdftoraster) \
+		$(use_with unicode libidn) \
+		$(use_with X x) \
+		DARWIN_LDFLAGS_SO_PREFIX="${EPREFIX}/usr/lib/" \
+		CFLAGS="${CFLAGS} -std=gnu17" \
+		CXXFLAGS="${CXXFLAGS} -std=gnu++17"
+
+	pushd "${S}/ijs" >/dev/null || die
+	econf \
+		--enable-shared \
+		$(use_enable static-libs static) \
+		CFLAGS="${CFLAGS} -std=gnu17" \
+		CXXFLAGS="${CXXFLAGS} -std=gnu++17"
+	popd >/dev/null || die
+}
+
+src_compile() {
+	# Build system passes CFLAGS to C++ compiler, so force CFLAGS and CXXFLAGS:
+	# bugs #943857, #945826
+	emake so all CFLAGS="${CFLAGS} -std=gnu17" CXXFLAGS="${CXXFLAGS} -std=gnu++17"
+	emake -C ijs CFLAGS="${CFLAGS} -std=gnu17" CXXFLAGS="${CXXFLAGS} -std=gnu++17"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install-so install
+
+	# move gsc to gs, bug #343447
+	# gsc collides with gambit, bug #253064
+	mv -f "${ED}"/usr/bin/{gsc,gs} || die
+
+	cd "${S}/ijs" || die
+	emake DESTDIR="${D}" install
+
+	# Sometimes the upstream versioning deviates from the tarball(!)
+	# bug #844115#c32
+	local my_gs_version=$(find "${ED}"/usr/share/ghostscript/ -maxdepth 1 -mindepth 1 -type d || die)
+	my_gs_version=${my_gs_version##*/}
+
+	# Install the CMaps from poppler-data properly, bug #409361
+	dosym -r /usr/share/poppler/cMaps /usr/share/ghostscript/${my_gs_version}/Resource/CMap
+
+	if ! use static-libs; then
+		find "${ED}" -name '*.la' -delete || die
+	fi
+}
diff --git a/dev-libs/libical/libical-3.0.20-r2.ebuild b/dev-libs/libical/libical-3.0.20-r2.ebuild
index c2d4c6fd57bc7..ae68b437df14f 100644
--- a/dev-libs/libical/libical-3.0.20-r2.ebuild
+++ b/dev-libs/libical/libical-3.0.20-r2.ebuild
@@ -1,11 +1,11 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..14} )
+PYTHON_COMPAT=( python3_{11..14} )
 VALA_USE_DEPEND="vapigen"
-inherit cmake python-any-r1 vala
+inherit cmake dot-a python-any-r1 toolchain-funcs vala
 
 DESCRIPTION="Implementation of basic iCAL protocols"
 HOMEPAGE="https://github.com/libical/libical"
@@ -43,6 +43,13 @@ BDEPEND="
 	)
 	vala? ( $(vala_depend) )
 "
+# to build native ical-glib-src-generator w/ cross-compile
+BDEPEND+="
+	glib? (
+		dev-libs/glib:2
+		dev-libs/libxml2:2
+	)
+"
 
 DOCS=(
 	AUTHORS README.md ReleaseNotes.txt TEST THANKS TODO
@@ -68,6 +75,39 @@ src_prepare() {
 }
 
 src_configure() {
+	if tc-is-cross-compiler && use glib; then
+		einfo "Building the native ical-glib-src-generator..."
+
+		BUILD_NATIVE="${WORKDIR}/${P}_build_native"
+		GENERATOR_BIN_DIR="${BUILD_NATIVE}/src/libical-glib/libexec/libical"
+
+		local mycmakeargs=(
+			-DCMAKE_DISABLE_FIND_PACKAGE_BerkeleyDB=ON
+			-DICAL_BUILD_DOCS=OFF
+			-DLIBICAL_BUILD_EXAMPLES=OFF
+			-DGOBJECT_INTROSPECTION=OFF
+			-DLIBICAL_BUILD_TESTING=OFF
+			-DICAL_GLIB_VAPI=OFF
+			-DICAL_GLIB=ON
+		)
+
+		BUILD_DIR="${BUILD_NATIVE}" tc-env_build cmake_src_configure
+
+		# configure for CHOST requires a cmake...
+		local native_gen=$(
+			find "${BUILD_NATIVE}" -type f -name IcalGlibSrcGenerator.cmake -print
+		)
+		# ... and a valid path. This empty file is fine for now.
+		mkdir -p "${GENERATOR_BIN_DIR}" || die
+		touch "${GENERATOR_BIN_DIR}"/ical-glib-src-generator || die
+	fi
+
+	use static-libs && lto-guarantee-fat
+
+	# fix gtk-doc, see https://bugs.gentoo.org/777090
+	# to check w/ 4.0 and migration to gi-docgen
+	export LD="$(tc-getCC)"
+
 	local mycmakeargs=(
 		-DCMAKE_DISABLE_FIND_PACKAGE_BerkeleyDB=ON
 		-DICAL_BUILD_DOCS=$(usex doc)
@@ -78,6 +118,13 @@ src_configure() {
 		-DLIBICAL_BUILD_TESTING=$(usex test)
 		-DICAL_GLIB_VAPI=$(usex vala)
 	)
+
+	if tc-is-cross-compiler && use glib; then
+		mycmakeargs+=(
+			-DIMPORT_ICAL_GLIB_SRC_GENERATOR="${native_gen}"
+		)
+	fi
+
 	if use vala; then
 		mycmakeargs+=(
 			-DVALAC="${VALAC}"
@@ -88,6 +135,12 @@ src_configure() {
 }
 
 src_compile() {
+	# build the native ical-glib-src-generator and place it where it's expected
+	if tc-is-cross-compiler && use glib; then
+		BUILD_DIR="${BUILD_NATIVE}" tc-env_build cmake_build ical-glib-src-generator
+		ln -sfT "${BUILD_NATIVE}"/bin/ical-glib-src-generator "${GENERATOR_BIN_DIR}"/ical-glib-src-generator || die
+	fi
+
 	cmake_src_compile
 
 	if use doc; then
@@ -112,4 +165,6 @@ src_install() {
 		rm examples/CMakeLists.txt || die
 		dodoc -r examples
 	fi
+
+	use static-libs && strip-lto-bytecode
 }
diff --git a/dev-libs/libmodbus/libmodbus-3.1.12.ebuild b/dev-libs/libmodbus/libmodbus-3.1.12.ebuild
index e0e422d547c91..8a7bb80307b51 100644
--- a/dev-libs/libmodbus/libmodbus-3.1.12.ebuild
+++ b/dev-libs/libmodbus/libmodbus-3.1.12.ebuild
@@ -11,7 +11,7 @@ SRC_URI="https://github.com/stephane/${PN}/releases/download/v${PV}/${P}.tar.gz"
 
 LICENSE="LGPL-3"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~ppc ~ppc64 ~riscv ~x86"
 IUSE="static-libs test"
 # Tests fail at least when run via the ebuild w/ a timeout assertion being hit
 # See https://github.com/stephane/libmodbus/issues/791 and https://github.com/stephane/libmodbus/pull/794
diff --git a/dev-libs/tree-sitter/Manifest b/dev-libs/tree-sitter/Manifest
index dc75ae4652d8e..9c6bb8f38a6bf 100644
--- a/dev-libs/tree-sitter/Manifest
+++ b/dev-libs/tree-sitter/Manifest
@@ -6,3 +6,4 @@ DIST tree-sitter-0.26.3.tar.gz 900789 BLAKE2B 8532bd460f3fd4e1cec9daecc45fcc8563
 DIST tree-sitter-0.26.5.tar.gz 905701 BLAKE2B 3771c0b31704f6182ae10c2629566984883a9bfcfc914e40a3d30889eb3ef30f19213a45e9732b067042893dd89e27b51b8f5fa50f2d7d8cec81aeb8666ebece SHA512 c8ffa86caf5841208dd2c987c6437111c7514635ebc76e910deb38ba64252caa99ae8453f1acd8af8e167cc2c7fe7194d481cd53533802601b331c60d20f2a49
 DIST tree-sitter-0.26.6.tar.gz 906770 BLAKE2B c6fcbc901f86795d6e5de5e22d4b7f34425f1f25ff9134de27baa0a68d917c376accd4a7a9d33faaee4e82e4dd7440085a06b55d5f57e5fe9756c195147867d5 SHA512 33ce5617ac53e276cccc8fa34e3a6b3e29a5bd572b381da4a7d6d78cbb7485d85120be8c0e25e02d3fbae4c36793b02bcfd788a2cdfe73f026742b184e16d572
 DIST tree-sitter-0.26.7.tar.gz 907267 BLAKE2B 7e734913ab81e700192c8d829b136300d5507da2f0cd1e3b059df81202fcd8da76884e605bda48a13d4f4317f335d1cb2cdb1aa60fbcfcce021280106512e3ff SHA512 0060809339744be4b3b24bae8115d2793dc113618ab1a79c347456f5b8341b15d2026e7b62d2e4e3c5226c8bf85a089221133457a80bfdd0413cd82bf7c4a172
+DIST tree-sitter-0.26.8.tar.gz 908286 BLAKE2B 92da23e47a25b618cf1645204455377f0cc16f5070f59356b53b088e41a0e7175f79ba3ee582388c462a188d2084b47ab21f40b0ae8ec4872c4098a2c8b4f6f3 SHA512 a5786e8235bceec2b4e8ed5ba035f143a3eabb587d33fa5d97c5e9e7a16c52b57dda72201b56c737ce3819b2d7cf53bef8852944d7a6a6ff85ea24a84fcb0042
diff --git a/dev-libs/tree-sitter/tree-sitter-0.26.8.ebuild b/dev-libs/tree-sitter/tree-sitter-0.26.8.ebuild
new file mode 100644
index 0000000000000..3abf2d9fb7d4f
--- /dev/null
+++ b/dev-libs/tree-sitter/tree-sitter-0.26.8.ebuild
@@ -0,0 +1,28 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit cmake optfeature
+
+DESCRIPTION="Tree-sitter is a parser generator tool and an incremental parsing library"
+HOMEPAGE="https://tree-sitter.github.io/"
+
+if [[ ${PV} == *9999* ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
+else
+	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+fi
+
+LICENSE="MIT"
+# ABI is not stable. Revisit after tree-sitter-1.0.
+# https://bugs.gentoo.org/930039
+# https://github.com/tree-sitter/tree-sitter/pull/3302
+SLOT="0/${PV}"
+RESTRICT="test" # tests are for CLI and not the lib
+
+pkg_postinst() {
+	optfeature "building and testing grammars" dev-util/tree-sitter-cli
+}
diff --git a/dev-libs/tree-sitter/tree-sitter-9999.ebuild b/dev-libs/tree-sitter/tree-sitter-9999.ebuild
index 424dd8528a1d1..3abf2d9fb7d4f 100644
--- a/dev-libs/tree-sitter/tree-sitter-9999.ebuild
+++ b/dev-libs/tree-sitter/tree-sitter-9999.ebuild
@@ -2,17 +2,18 @@
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
-inherit optfeature toolchain-funcs
+
+inherit cmake optfeature
 
 DESCRIPTION="Tree-sitter is a parser generator tool and an incremental parsing library"
-HOMEPAGE="https://github.com/tree-sitter/tree-sitter"
+HOMEPAGE="https://tree-sitter.github.io/"
 
 if [[ ${PV} == *9999* ]]; then
 	inherit git-r3
 	EGIT_REPO_URI="https://github.com/${PN}/${PN}"
 else
 	SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/v${PV}.tar.gz -> ${P}.tar.gz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x64-macos"
 fi
 
 LICENSE="MIT"
@@ -22,29 +23,6 @@ LICENSE="MIT"
 SLOT="0/${PV}"
 RESTRICT="test" # tests are for CLI and not the lib
 
-PATCHES=(
-	"${FILESDIR}/${PN}-0.26.3-no-static.patch"
-)
-
-src_prepare() {
-	default
-	tc-export CC
-}
-
-src_compile() {
-	emake \
-		PREFIX="${EPREFIX}/usr" \
-		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		STRIP="" # bug 930020
-}
-
-src_install() {
-	emake DESTDIR="${D}" \
-		  PREFIX="${EPREFIX}/usr" \
-		  LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
-		  install
-}
-
 pkg_postinst() {
 	optfeature "building and testing grammars" dev-util/tree-sitter-cli
 }
diff --git a/dev-lua/busted/busted-2.3.0.ebuild b/dev-lua/busted/busted-2.3.0.ebuild
index 457c1b0d05f39..15b3d850be2a3 100644
--- a/dev-lua/busted/busted-2.3.0.ebuild
+++ b/dev-lua/busted/busted-2.3.0.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/lunarmodules/${PN}/archive/refs/tags/v${PV}.tar.gz -
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 arm arm64 ~hppa ppc ppc64 ~riscv ~sparc x86"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="test"
diff --git a/dev-lua/lua-zlib/lua-zlib-1.4.ebuild b/dev-lua/lua-zlib/lua-zlib-1.4.ebuild
index a5536719287f7..2f18f36eab88b 100644
--- a/dev-lua/lua-zlib/lua-zlib-1.4.ebuild
+++ b/dev-lua/lua-zlib/lua-zlib-1.4.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/brimworks/${PN}/archive/v${PV}.tar.gz -> ${P}.tar.gz
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 
 RDEPEND="
diff --git a/dev-lua/luafilesystem/luafilesystem-1.9.0.ebuild b/dev-lua/luafilesystem/luafilesystem-1.9.0.ebuild
index b9b6ab17277b6..ee2b050c1bc23 100644
--- a/dev-lua/luafilesystem/luafilesystem-1.9.0.ebuild
+++ b/dev-lua/luafilesystem/luafilesystem-1.9.0.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
diff --git a/dev-lua/luajson/luajson-1.3.4-r1.ebuild b/dev-lua/luajson/luajson-1.3.4-r1.ebuild
index 9e4a2854d31e1..030bf72226f10 100644
--- a/dev-lua/luajson/luajson-1.3.4-r1.ebuild
+++ b/dev-lua/luajson/luajson-1.3.4-r1.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -13,7 +13,7 @@ SRC_URI="https://github.com/harningt/${PN}/archive/${PV}.tar.gz -> ${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
 
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 
diff --git a/dev-lua/luarocks/luarocks-3.13.0.ebuild b/dev-lua/luarocks/luarocks-3.13.0.ebuild
index 7c98c5c07f19f..c3f338b22fdb6 100644
--- a/dev-lua/luarocks/luarocks-3.13.0.ebuild
+++ b/dev-lua/luarocks/luarocks-3.13.0.ebuild
@@ -13,7 +13,7 @@ SRC_URI="https://luarocks.org/releases/${P}.tar.gz"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="test"
diff --git a/dev-lua/luasystem/luasystem-0.7.0.ebuild b/dev-lua/luasystem/luasystem-0.7.0.ebuild
index b3af83118fe2e..71099a53e2b6f 100644
--- a/dev-lua/luasystem/luasystem-0.7.0.ebuild
+++ b/dev-lua/luasystem/luasystem-0.7.0.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${PN}-${MY_PV}"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
diff --git a/dev-lua/mpack/mpack-1.0.13.ebuild b/dev-lua/mpack/mpack-1.0.13.ebuild
index 8ab5eb36daf0b..f4fd93a01ab94 100644
--- a/dev-lua/mpack/mpack-1.0.13.ebuild
+++ b/dev-lua/mpack/mpack-1.0.13.ebuild
@@ -16,7 +16,7 @@ S="${WORKDIR}/${MY_PN}-${PV}"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~x64-macos"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86 ~x64-macos"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
diff --git a/dev-lua/penlight/penlight-1.15.0.ebuild b/dev-lua/penlight/penlight-1.15.0.ebuild
index bfb4f1480ab68..27b0736f4d430 100644
--- a/dev-lua/penlight/penlight-1.15.0.ebuild
+++ b/dev-lua/penlight/penlight-1.15.0.ebuild
@@ -15,7 +15,7 @@ S="${WORKDIR}/${MY_PN}-${PV}"
 
 LICENSE="MIT"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="amd64 arm arm64 ~hppa ppc ppc64 ~riscv ~sparc x86"
 IUSE="test"
 REQUIRED_USE="${LUA_REQUIRED_USE}"
 RESTRICT="!test? ( test )"
diff --git a/dev-util/tree-sitter-cli/Manifest b/dev-util/tree-sitter-cli/Manifest
index fc8d9455a7d8d..6a4e624dabfa4 100644
--- a/dev-util/tree-sitter-cli/Manifest
+++ b/dev-util/tree-sitter-cli/Manifest
@@ -7,6 +7,6 @@ DIST tree-sitter-0.25.8-crates.tar.xz 22421992 BLAKE2B 3e3d262a6b4244615a0b6f9c0
 DIST tree-sitter-0.25.8.tar.gz 857462 BLAKE2B aa3f0d9056544bb6ef1127723563449c7672e06b5289e1596f2c1b5826905c578830c7e6c3bc58a91e388d647a5a5629e71f5f0af2a431e73c3be4f93ce5b6f4 SHA512 0d26d0699f61fa27b5adbc298ff53f8e0f5b9f2f1b216744200f6f50cff777c9c5a5a5b92304a4d1889fccd9d8a6dd6b7d4947bac907a91850322281f754ea53
 DIST tree-sitter-0.26.6-crates.tar.xz 21055636 BLAKE2B 08086f1456718f0a1b722b1c3878cfc7f267be536f94a474b10e02178f315ec9d93d6755c002fa8df0f0bf0eb5a6149be53f207575937f54e59669efda5bed31 SHA512 14ecb7f0e7494c38ab166209df4ad4e61f3e614232db0098fa742dc66e9a47951118a64eb8712581a3528f6ac9b681f9058a4723712ce635b6eea96fc06b1c47
 DIST tree-sitter-0.26.6.tar.gz 906770 BLAKE2B c6fcbc901f86795d6e5de5e22d4b7f34425f1f25ff9134de27baa0a68d917c376accd4a7a9d33faaee4e82e4dd7440085a06b55d5f57e5fe9756c195147867d5 SHA512 33ce5617ac53e276cccc8fa34e3a6b3e29a5bd572b381da4a7d6d78cbb7485d85120be8c0e25e02d3fbae4c36793b02bcfd788a2cdfe73f026742b184e16d572
-DIST tree-sitter-0.26.7-crates.tar.xz 21055636 BLAKE2B 08086f1456718f0a1b722b1c3878cfc7f267be536f94a474b10e02178f315ec9d93d6755c002fa8df0f0bf0eb5a6149be53f207575937f54e59669efda5bed31 SHA512 14ecb7f0e7494c38ab166209df4ad4e61f3e614232db0098fa742dc66e9a47951118a64eb8712581a3528f6ac9b681f9058a4723712ce635b6eea96fc06b1c47
-DIST tree-sitter-0.26.7.tar.gz 907267 BLAKE2B 7e734913ab81e700192c8d829b136300d5507da2f0cd1e3b059df81202fcd8da76884e605bda48a13d4f4317f335d1cb2cdb1aa60fbcfcce021280106512e3ff SHA512 0060809339744be4b3b24bae8115d2793dc113618ab1a79c347456f5b8341b15d2026e7b62d2e4e3c5226c8bf85a089221133457a80bfdd0413cd82bf7c4a172
+DIST tree-sitter-0.26.8-crates.tar.xz 21055636 BLAKE2B 08086f1456718f0a1b722b1c3878cfc7f267be536f94a474b10e02178f315ec9d93d6755c002fa8df0f0bf0eb5a6149be53f207575937f54e59669efda5bed31 SHA512 14ecb7f0e7494c38ab166209df4ad4e61f3e614232db0098fa742dc66e9a47951118a64eb8712581a3528f6ac9b681f9058a4723712ce635b6eea96fc06b1c47
+DIST tree-sitter-0.26.8.tar.gz 908286 BLAKE2B 92da23e47a25b618cf1645204455377f0cc16f5070f59356b53b088e41a0e7175f79ba3ee582388c462a188d2084b47ab21f40b0ae8ec4872c4098a2c8b4f6f3 SHA512 a5786e8235bceec2b4e8ed5ba035f143a3eabb587d33fa5d97c5e9e7a16c52b57dda72201b56c737ce3819b2d7cf53bef8852944d7a6a6ff85ea24a84fcb0042
 DIST tree-sitter-cli-0.24.3-crates.tar.xz 18883756 BLAKE2B 5a35f3c32ff53b123f2d6fceeddc93bc621ac024d26b26292a7bca7370c8a6f26292c318bebf6716924ac90123d3809c4e66afb7bcb53b531fb641cb6a686bbc SHA512 5f0670cf5c102ac4982c1c6e5a77aea39fc02a3db24eb8151d335bcac0c51cac7193fd882f17f7740465830dfe708cc88cb4a7a58047a49df15e26b2fa96b2f6
diff --git a/dev-util/tree-sitter-cli/tree-sitter-cli-0.26.7.ebuild b/dev-util/tree-sitter-cli/tree-sitter-cli-0.26.8.ebuild
similarity index 73%
rename from dev-util/tree-sitter-cli/tree-sitter-cli-0.26.7.ebuild
rename to dev-util/tree-sitter-cli/tree-sitter-cli-0.26.8.ebuild
index fdd27fe5aacb9..d1812b0c6107b 100644
--- a/dev-util/tree-sitter-cli/tree-sitter-cli-0.26.7.ebuild
+++ b/dev-util/tree-sitter-cli/tree-sitter-cli-0.26.8.ebuild
@@ -6,15 +6,13 @@ EAPI=8
 CRATES=""
 RUST_MIN_VER="1.88.0"
 
-LLVM_COMPAT=( {19..22} )
-
-inherit cargo llvm-r2
+inherit cargo
 
 MY_PN="${PN/-cli}"
 MY_P=${MY_PN}-${PV}
 
 DESCRIPTION="Command-line tool for creating and testing tree-sitter grammars"
-HOMEPAGE="https://github.com/tree-sitter/tree-sitter"
+HOMEPAGE="https://tree-sitter.github.io/"
 SRC_URI="
 	https://github.com/${MY_PN}/${MY_PN}/archive/refs/tags/v${PV}.tar.gz -> ${MY_P}.tar.gz
 	https://github.com/gentoo-crate-dist/${MY_PN}/releases/download/v${PV}/${MY_P}-crates.tar.xz
@@ -28,16 +26,13 @@ LICENSE+="
 	MIT Unicode-3.0 ZLIB
 "
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~sparc ~x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
 
 # Test seems to require files (grammar definitions) that we don't have.
 RESTRICT="test"
 
-BDEPEND="$(llvm_gen_dep 'llvm-core/clang:${LLVM_SLOT}')"
-
 QA_FLAGS_IGNORED="usr/bin/${MY_PN}"
 
-pkg_setup() {
-	llvm-r2_pkg_setup
-	rust_pkg_setup
+src_configure() {
+	cargo_src_configure --no-default-features
 }
diff --git a/net-ftp/pure-ftpd/pure-ftpd-1.0.53.ebuild b/net-ftp/pure-ftpd/pure-ftpd-1.0.53.ebuild
index 2a2915282e739..87162746a1527 100644
--- a/net-ftp/pure-ftpd/pure-ftpd-1.0.53.ebuild
+++ b/net-ftp/pure-ftpd/pure-ftpd-1.0.53.ebuild
@@ -12,7 +12,7 @@ if [[ "${PV}" == 9999 ]] ; then
 	EGIT_REPO_URI="https://github.com/jedisct1/pure-ftpd.git"
 else
 	SRC_URI="https://download.pureftpd.org/pub/${PN}/releases/${P}.tar.bz2"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
+	KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~riscv ~sparc ~x86"
 fi
 
 LICENSE="BSD GPL-2"
diff --git a/net-misc/tinyssh/Manifest b/net-misc/tinyssh/Manifest
index a059c3db7fc43..76663e6db9bf5 100644
--- a/net-misc/tinyssh/Manifest
+++ b/net-misc/tinyssh/Manifest
@@ -1,2 +1,2 @@
-DIST tinyssh-20250501.tar.gz 421567 BLAKE2B acffcb249e09686fcc9364bdc617f9bbb27c98c1e4c25ed7859711cb9b25be35eff29d8afcd372eab884ec307f2c8ae51596e5782a237ae97b20fbb7e9010f44 SHA512 c303bfa1781d668a86ca05d5c5fe2b028e4b99ba864700283c5bff1bec1050d95ed2b942e8d0eb1bd62fd6e06dc0ad0c404e83e589a67f6e6997b500b857d805
 DIST tinyssh-20260301.tar.gz 421650 BLAKE2B 646dcd8c552c1c6b81b8cd985ccd269142fc12daaea726f75beeda2e48b5ba4b939f39827d9f88828c188df93e5d3ed4748aa318b8c45f3e6c787196ea4f1f43 SHA512 09a84783fcc9cfa35491396d98a67cb38f88dfcc534a708f00b13549cd2ac98f27e56d3b42a418cd89164afef969deeae7a52ced075b450cfea8d500d21e0d4f
+DIST tinyssh-20260401.tar.gz 421859 BLAKE2B cdc6eb2ae16d8156ecab74321f7c591b329799ed4104d11367d7ed587d7c28982451c283063f9ba4c38c6b551301fd5ac6f0b14efc673e95d418a350427bb681 SHA512 be8d2fc6b5c660eb4ab5113dbb81199204f754dd654f1943d79bc71f1169cd6e8654094522df9f25c70c7506aa31cb601694d2e8564f6f12392931c9a21ce7d3
diff --git a/net-misc/tinyssh/tinyssh-20250501.ebuild b/net-misc/tinyssh/tinyssh-20260401.ebuild
similarity index 97%
rename from net-misc/tinyssh/tinyssh-20250501.ebuild
rename to net-misc/tinyssh/tinyssh-20260401.ebuild
index 3ff059060c0b7..44ee48761bd42 100644
--- a/net-misc/tinyssh/tinyssh-20250501.ebuild
+++ b/net-misc/tinyssh/tinyssh-20260401.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
diff --git a/net-misc/wol/wol-0.7.1-r5.ebuild b/net-misc/wol/wol-0.7.1-r5.ebuild
index 4a4d9139ad4fc..5d847224e455a 100644
--- a/net-misc/wol/wol-0.7.1-r5.ebuild
+++ b/net-misc/wol/wol-0.7.1-r5.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2025 Gentoo Authors
+# Copyright 1999-2026 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -11,7 +11,7 @@ SRC_URI="https://downloads.sourceforge.net/ahh/${P}.tar.gz"
 
 LICENSE="GPL-2+"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
+KEYWORDS="amd64 ~arm ~arm64 ~hppa ~ppc ~ppc64 ~sparc ~x86"
 IUSE="nls"
 
 PATCHES=(
diff --git a/sys-apps/checkpolicy/Manifest b/sys-apps/checkpolicy/Manifest
index db09f8de07435..b246d54b3878d 100644
--- a/sys-apps/checkpolicy/Manifest
+++ b/sys-apps/checkpolicy/Manifest
@@ -1 +1,2 @@
 DIST checkpolicy-3.8.1.tar.gz 76246 BLAKE2B 19933bc46dfa9cdca6996ac49da2054aec5a4a565d0f71d69c2f05be725b73c7b355019c083bb7624b574d091cb61a123d55b0a904d561a59336059d0d2216c1 SHA512 279f4ebcaf8a62dca5c09c46989c76c34c83f3925b49e64c4a055f1b60795d7c732fbae272975eef654ec02a352b35a2eb8390d55c99789dffdf982ded7b210f
+DIST checkpolicy-3.9.tar.gz 77103 BLAKE2B 1f0b1e14e361cb98c13735831914da6d178abdada429892f98e2ef8b3a4c15232874b74b16d3205cb327f13674a15b55c489e127c7596bcd89f1acba9953a130 SHA512 719d3e903488e63d50951adffe42e21dac4f8693246285014d0c9431d5d69a912d9937885b2bd35f9cfd7f0c0ac3252bbef9be196367a573a0a768c98abff89d
diff --git a/sys-apps/checkpolicy/checkpolicy-3.9.ebuild b/sys-apps/checkpolicy/checkpolicy-3.9.ebuild
new file mode 100644
index 0000000000000..88ebb99484bb0
--- /dev/null
+++ b/sys-apps/checkpolicy/checkpolicy-3.9.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux policy compiler"
+HOMEPAGE="http://userspace.selinuxproject.org"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="debug"
+
+RDEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]"
+DEPEND="${RDEPEND}"
+BDEPEND="sys-devel/flex
+	sys-devel/bison"
+
+src_compile() {
+	emake \
+		CC="$(tc-getCC)" \
+		YACC="bison -y" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)"
+}
+
+src_install() {
+	default
+
+	if use debug; then
+		dobin "${S}/test/dismod"
+		dobin "${S}/test/dispol"
+	fi
+}
+
+pkg_postinst() {
+	if ! tc-is-cross-compiler; then
+		einfo "This checkpolicy can compile version `checkpolicy -V | cut -f 1 -d ' '` policy."
+	fi
+}
diff --git a/sys-apps/mcstrans/Manifest b/sys-apps/mcstrans/Manifest
index 87e1b094ba7ca..3566e0e41af4a 100644
--- a/sys-apps/mcstrans/Manifest
+++ b/sys-apps/mcstrans/Manifest
@@ -1,3 +1,4 @@
 DIST mcstrans-3.6.tar.gz 42199 BLAKE2B 0f1b4ed212994037b062c42887e2629ae7374e0cbbd79692588ce164440eafddc6d7ab15d58f6064d68781a5a8fd614c9cfa734c4dbe1d3fea1dbb0f8191ddc1 SHA512 2c01a70741675faa41e8a9243f3cf08b558e568d7ae343874ff9c269473ba2748d42e0b45871d82d6c9b01bf71547835d547683f1aa5a8cf626708c7c69569fc
 DIST mcstrans-3.7.tar.gz 42501 BLAKE2B b1112a5098a6681ade55e9fada8b0e4629bda8ff4334242b570bc042113204374bd2ca72face7fd7bc0958981a3c39284fa953a02e0860c4101e966f77f7e49a SHA512 51483ce4fd0b0a4bcba0d52eb418aa56104732888782f32c27a855c167cdb267de22eeb414ad8c6b2e733620c3e59db39646136c97f7bcb8901ce12fed44583a
 DIST mcstrans-3.8.1.tar.gz 42511 BLAKE2B 15a79c6229a373e6bbabadd31b8bf21534a44402d42740662619f2578fb2712b884a7ba76d452ca5dd86afdd7642941076f68604641e002dd7051ad6480ae375 SHA512 45db573106667b424aba01dd9feae854ce7672a852b73de0e5c3fd5e9a9cdd61fc1a630ee0b4ffd6191c63b4c24ce258846af2205b336d6fca6ba27d5cc7ac56
+DIST mcstrans-3.9.tar.gz 42577 BLAKE2B d07f4f61c3e8a9df74e00ba7ef5bf39e3d17661bf8ae88055dbc341dd825894d148cdc644d5169de5c0196a57791b475ec725b43a0302272ddcf99e304acc2fb SHA512 dd062de4061a57072b45520e4b765bf7ac99f2ab316982ea3f08a45ca3340d1af36bb5f09112ced3d461bcfffbd06db1b0f6c2659e4a8d2ec259c8a231e3da0e
diff --git a/sys-apps/mcstrans/mcstrans-3.9.ebuild b/sys-apps/mcstrans/mcstrans-3.9.ebuild
new file mode 100644
index 0000000000000..4e079fa29d5c3
--- /dev/null
+++ b/sys-apps/mcstrans/mcstrans-3.9.ebuild
@@ -0,0 +1,51 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux context translation to human readable names"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+DEPEND=">=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=sys-libs/libselinux-${PV}:=
+	dev-libs/libpcre2:=
+	>=sys-libs/libcap-1.10-r10:="
+
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+}
+
+src_compile() {
+	tc-export CC
+	default
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+
+	rm -rf "${D}/etc/rc.d" || die
+
+	newinitd "${FILESDIR}/mcstransd.init" mcstransd
+}
diff --git a/sys-apps/policycoreutils/Manifest b/sys-apps/policycoreutils/Manifest
index 55f9dc6a76109..7d0e59797ae94 100644
--- a/sys-apps/policycoreutils/Manifest
+++ b/sys-apps/policycoreutils/Manifest
@@ -1,2 +1,3 @@
 DIST policycoreutils-3.8.1.tar.gz 758726 BLAKE2B cda4c6a967a156874d6adcadbda546d8cf30d19622e0bec85ade88eccf730e4dd143eb7b07678826e1284aaa2fe316c24f828d28f422e15694d38d4e06035b78 SHA512 e14df87d163eec46a57bb7496db77090bd310554b2af1b68c66d9ef2f160bc4ac17305fb889a5415489baeabfd47946c0e37e6ad4dd14e392529c802ad06290b
+DIST policycoreutils-3.9.tar.gz 759386 BLAKE2B 63aaebd2592bd10a4460ff9665a1f69abead9a70196ffa5aec4086fead0bc2959e3f73dc6cbc23ce539f982798275dbe633e843cd4ec1e48ad4fcde73bcd3d94 SHA512 ebd5b39c4761443787c0c27a62e6d1de6d61189cd5bbe90af9dad0ded530666d2feabcf786487366b2b15b5a3e655fe534f7bea87a4aa9293298a5177fbd35be
 DIST policycoreutils-extra-1.37.tar.bz2 8809 BLAKE2B a7f6122c2e27f54b018174e962bd7f4c14af04e09bbb5300bde6967ea7f2dc5cd03b5787919a4e7f5288bcbc6747922962b5bd3b588ab1e3a035fbff4910d8f5 SHA512 0a85cd7cf279256b5e1927f9dfdd89626a1c8b77b0aeb62b496e7e8d1dccbaa315e39f9308fb2df7270f0bc1c10787b19990e7365cad74b47b61e30394c8b23f
diff --git a/sys-apps/policycoreutils/policycoreutils-3.9.ebuild b/sys-apps/policycoreutils/policycoreutils-3.9.ebuild
new file mode 100644
index 0000000000000..f1f35e1339a85
--- /dev/null
+++ b/sys-apps/policycoreutils/policycoreutils-3.9.ebuild
@@ -0,0 +1,168 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{11..14} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit python-r1 toolchain-funcs bash-completion-r1
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+EXTRAS_VER="1.37"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	SRC_URI="https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	S1="${WORKDIR}/${P}/${PN}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
+		https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S1="${WORKDIR}/${MY_P}"
+	S2="${WORKDIR}/policycoreutils-extra"
+	S="${S1}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="audit pam split-usr"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+DEPEND=">=sys-libs/libselinux-${PV}:=[python,${PYTHON_USEDEP}]
+	>=sys-libs/libsemanage-${PV}:=[python(+),${PYTHON_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=
+	sys-libs/libcap-ng:=
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	audit? ( >=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}] )
+	pam? ( sys-libs/pam:= )
+	${PYTHON_DEPS}"
+
+# Avoid dependency loop in the cross-compile case, bug #755173
+# (Still exists in native)
+BDEPEND="sys-devel/gettext"
+
+# pax-utils for scanelf used by rlpkg
+RDEPEND="${DEPEND}
+	app-misc/pax-utils"
+
+PDEPEND="sys-apps/semodule-utils
+	sys-apps/selinux-python"
+
+src_unpack() {
+	# Override default one because we need the SRC_URI ones even in case of 9999 ebuilds
+	default
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+	fi
+}
+
+src_prepare() {
+	S="${S1}"
+	cd "${S}" || die "Failed to switch to ${S}"
+	if [[ ${PV} != 9999 ]] ; then
+		# If needed for live ebuilds please use /etc/portage/patches
+		eapply "${FILESDIR}/policycoreutils-3.1-0001-newrole-not-suid.patch"
+	fi
+
+	# rlpkg is more useful than fixfiles
+	sed -i -e '/^all/s/fixfiles//' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 1 failed"
+	sed -i -e '/fixfiles/d' "${S}/scripts/Makefile" \
+		|| die "fixfiles sed 2 failed"
+
+	eapply_user
+
+	sed -i 's/-Werror//g' "${S1}"/*/Makefile || die "Failed to remove Werror"
+
+	python_copy_sources
+	# Our extra code is outside the regular directory, so set it to the extra
+	# directory. We really should optimize this as it is ugly, but the extra
+	# code is needed for Gentoo at the same time that policycoreutils is present
+	# (so we cannot use an additional package for now).
+	S="${S2}"
+	python_copy_sources
+}
+
+src_compile() {
+	building() {
+		emake -C "${BUILD_DIR}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)"
+	}
+	S="${S1}" # Regular policycoreutils
+	python_foreach_impl building
+	S="${S2}" # Extra set
+	python_foreach_impl building
+}
+
+src_install() {
+	# Python scripts are present in many places. There are no extension modules.
+	installation-policycoreutils() {
+		einfo "Installing policycoreutils"
+		emake -C "${BUILD_DIR}" DESTDIR="${D}" \
+			AUDIT_LOG_PRIVS="y" \
+			AUDITH="$(usex audit y n)" \
+			PAMH="$(usex pam y n)" \
+			SESANDBOX="n" \
+			CC="$(tc-getCC)" \
+			LIBDIR="\$(PREFIX)/$(get_libdir)" \
+			install
+		python_optimize
+	}
+
+	installation-extras() {
+		einfo "Installing policycoreutils-extra"
+		emake -C "${BUILD_DIR}" \
+			DESTDIR="${D}" \
+			install
+		python_optimize
+	}
+
+	S="${S1}" # policycoreutils
+	python_foreach_impl installation-policycoreutils
+	S="${S2}" # extras
+	python_foreach_impl installation-extras
+	S="${S1}" # back for later
+
+	# remove redhat-style init script
+	rm -fR "${D}/etc/rc.d" || die
+
+	# compatibility symlinks
+	if use split-usr; then
+		dosym ../../sbin/setfiles /usr/sbin/setfiles
+	else
+		# remove sestatus symlink
+		rm -f "${D}"/usr/sbin/sestatus || die
+	fi
+
+	bashcomp_alias setsebool getsebool
+
+	# location for policy definitions
+	dodir /var/lib/selinux
+	keepdir /var/lib/selinux
+
+	# Set version-specific scripts
+	for pyscript in rlpkg; do
+	  python_replicate_script "${ED}/usr/sbin/${pyscript}"
+	done
+}
+
+pkg_postinst() {
+	for POLICY_TYPE in ${POLICY_TYPES} ; do
+		# There have been some changes to the policy store, rebuilding now.
+		# https://marc.info/?l=selinux&m=143757277819717&w=2
+		einfo "Rebuilding store ${POLICY_TYPE} in '${ROOT:-/}' (without re-loading)."
+		semodule -p "${ROOT:-/}" -s "${POLICY_TYPE}" -n -B || die "Failed to rebuild policy store ${POLICY_TYPE}"
+	done
+}
diff --git a/sys-apps/restorecond/Manifest b/sys-apps/restorecond/Manifest
index 57acdf393eb05..7fd6673090312 100644
--- a/sys-apps/restorecond/Manifest
+++ b/sys-apps/restorecond/Manifest
@@ -1,3 +1,4 @@
 DIST restorecond-3.6.tar.gz 18020 BLAKE2B 306b4a7c9990c0b2f229cc7963dbd0481df5f9fbecd709b37d254839177fc604f6f85ac19235209f4fbb12d9186f01dd71a11f98deca5d01bd70c415240ddf5a SHA512 e21fa23bfea488f2bddd01b4bab353f22863e09247078e47db9852995d7a0153aee6483cbeaaaf033b482b60f80affad0b6a3e829f935c3901c034a7efb1ebef
 DIST restorecond-3.7.tar.gz 18072 BLAKE2B 3f352345fa169a438fd6dc073d329c68aca67b3c49d100b1dc619ae40eae3764fa07327306ec0f1232450433e27908493711cc6aec20ebb60f2b66dbceed0cb8 SHA512 6b0ed20a5d6654281cae78a337254558a2170040f09c1f7ba023b40cf2a5b33b36d6f3c57d9e32d55523fbe78a8b212c0de377ce201778e2211aa37dc0b2b936
 DIST restorecond-3.8.1.tar.gz 18113 BLAKE2B 53fc139e4389ef2b7ec4bd0217662f30ae53dc2da4bb623b6c4c23e754267493fb8d1a47591f8afd8ebd270117311e22aa1789066a7918ca8ee10524a3d94031 SHA512 6cf664cccb3097ec2458d560e2622fc5c35c005f57461bd46858c887e2c4ed69301f4dca6d061115e0636dec0815498163cc975ea3c46b3001977e95c39e2fab
+DIST restorecond-3.9.tar.gz 18128 BLAKE2B ad4d50fef9cfab6b77fdc5d334426c3de9513e1730013c1b8248b42b836e2bcfb219876f3278063cf5f595e81369ab18268b9e5876a6220be2879f27ed96a0bd SHA512 0876a4322bd36aeea1b1457e5e59edc040d9a1696a047ed1a297849cd091770a649ac087d7a440276cd18551991b58b6677952b9057eac97b723542c05238aa5
diff --git a/sys-apps/restorecond/restorecond-3.9.ebuild b/sys-apps/restorecond/restorecond-3.9.ebuild
new file mode 100644
index 0000000000000..2c892709ee4be
--- /dev/null
+++ b/sys-apps/restorecond/restorecond-3.9.ebuild
@@ -0,0 +1,53 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit systemd toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+DESCRIPTION="Daemon to watch for creation and set default SELinux fcontexts"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+LICENSE="GPL-2"
+SLOT="0"
+
+DEPEND="dev-libs/glib:2
+	>=sys-libs/libsepol-${PV}:=
+	>=sys-libs/libselinux-${PV}:="
+
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+
+	sed -i 's/-Werror//g' "${S}"/Makefile || die "Failed to remove Werror"
+}
+
+src_compile() {
+	tc-export CC
+	default
+}
+
+src_install() {
+	emake DESTDIR="${D}" \
+		SYSTEMDSYSTEMUNITDIR="$(systemd_get_systemunitdir)" \
+		SYSTEMDUSERUNITDIR=$(systemd_get_userunitdir) \
+		install
+
+	rm -rf "${D}/etc/rc.d" || die
+
+	newinitd "${FILESDIR}/restorecond.init" restorecond
+}
diff --git a/sys-apps/secilc/Manifest b/sys-apps/secilc/Manifest
index 12732d81570e2..a8f0b83ef9ccb 100644
--- a/sys-apps/secilc/Manifest
+++ b/sys-apps/secilc/Manifest
@@ -1 +1,2 @@
 DIST secilc-3.8.1.tar.gz 185758 BLAKE2B 9223df76774f2ba3d1283e70054741caac3497bf4db317ad25fe9f6d6e79659a6d681d9ac0da522beeaf6162cd2a315634ae040ac6ac4b686bcee14340f71959 SHA512 43f9b86d4b10b90dc201c76aee8ad7a89bc7b487a77cb373ed5db7e9efcca88eed9d5ae62e605fd3b2688384580afdca19aa84597c19cb78afcedff6b7e4c33a
+DIST secilc-3.9.tar.gz 185969 BLAKE2B 28377c9a5620a006fec0bbd24b09c7d8f28f1ba471f39ba14ee47f661a2b50c630c0f0c0b20ab5d65a2b4131fe2050321d67899b14364b04f2bd7e9d0e57c0fb SHA512 fec6476de2ced123aa6a4af228386e8a977b8d70516c4a38c09ce7f66617fa16f504ea45104dde137cf72653a31ba5a34a8614bcd4dfbf256321d28218e4c0cd
diff --git a/sys-apps/secilc/secilc-3.9.ebuild b/sys-apps/secilc/secilc-3.9.ebuild
new file mode 100644
index 0000000000000..be1421993f1d2
--- /dev/null
+++ b/sys-apps/secilc/secilc-3.9.ebuild
@@ -0,0 +1,37 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+inherit toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux Common Intermediate Language (CIL) Compiler"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+DEPEND=">=sys-libs/libsepol-${PV}"
+RDEPEND="${DEPEND}"
+BDEPEND="app-text/xmlto"
+
+# tests are not meant to be run outside of the
+# full SELinux userland repo
+RESTRICT="test"
+
+src_compile() {
+	tc-export CC
+	default
+}
diff --git a/sys-apps/selinux-python/Manifest b/sys-apps/selinux-python/Manifest
index 4583aae05dd7a..9c868564ab425 100644
--- a/sys-apps/selinux-python/Manifest
+++ b/sys-apps/selinux-python/Manifest
@@ -1,2 +1,3 @@
 DIST selinux-python-3.7.tar.gz 3652377 BLAKE2B 59fd7cab0034c175f42f6120ba665701945adcbd4e8af97a0dc2a1c79688a596b199528886ceea079a3f7a969258611fb660449d313d9e893de381293e786381 SHA512 036bc1f0e64cbbaade592dc7899a92765a0bac426140d7d3960f73bad6eb5f95d79d91e0f0e1604f88a991ebf59c4c90ccaaa4158f5dc4d3275ca2aed1673b09
 DIST selinux-python-3.8.1.tar.gz 3652823 BLAKE2B dde6081f55d646a6993083a000524b4ce834718f7cd555c8be88574f227f3d8ed24f390dc4568f3f66c1f3643a606779b6350ad28dfbfe2a1bd9d5a6798c37e0 SHA512 bad791411cff373cf749302d44205495a9d100ca6140ea895cb87a85f5d0b0cfaaf4b7418fca661fb3233d14951755d1c2d85961c731243c92622fdfb343734a
+DIST selinux-python-3.9.tar.gz 3652691 BLAKE2B b1e66ef4199cf22e811924c9626248217eea3745154aa8925f1713aa4a0e1edfb5c15c35ce1c3da14797c7c1d3929220f0411b973efd5b27aa893ad62c35dcca SHA512 e63f6628acdd82ea7a4ef3339429de70b3bd958051e82f4efb13ad3ab65560f482f4852052d4b91c5767a60a51305206b8c1dd3b724d815bca1b7a5d3b97214e
diff --git a/sys-apps/selinux-python/selinux-python-3.9.ebuild b/sys-apps/selinux-python/selinux-python-3.9.ebuild
new file mode 100644
index 0000000000000..65daa23faab6c
--- /dev/null
+++ b/sys-apps/selinux-python/selinux-python-3.9.ebuild
@@ -0,0 +1,142 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{11..14} )
+PYTHON_REQ_USE="xml(+)"
+
+inherit distutils-r1 toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux core utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN#selinux-}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+IUSE="test"
+RESTRICT="!test? ( test )"
+
+RDEPEND=">=sys-libs/libselinux-${PV}:=[python]
+	>=sys-libs/libsemanage-${PV}:=[python(+)]
+	>=sys-libs/libsepol-${PV}:=[static-libs(+)]
+	>=app-admin/setools-4.2.0[${PYTHON_USEDEP}]
+	>=sys-process/audit-1.5.1[python,${PYTHON_USEDEP}]"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		sec-policy/selinux-base
+		>=sys-apps/secilc-${PV}
+	)"
+
+PATCHES=(
+	"${FILESDIR}"/selinux-python-3.8.1-no-pip.patch
+)
+
+src_prepare() {
+	default
+
+	sed -e 's/-Werror//g' -i "${S}"/*/Makefile || die "Failed to remove Werror"
+
+	pushd sepolicy >/dev/null || die
+	# To avoid default
+	DISTUTILS_OPTIONAL=1 distutils-r1_src_prepare
+	popd >/dev/null || die
+}
+
+python_compile() {
+	distutils-r1_python_compile
+	emake -C "${S}" \
+		CC="$(tc-getCC)" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)"
+}
+
+src_compile() {
+	pushd sepolicy >/dev/null || die
+	distutils-r1_src_compile
+	popd >/dev/null || die
+}
+
+python_test() {
+	# The different subprojects have some interproject dependencies:
+	# - audit2allow depens on sepolgen
+	# - chcat depends on semanage
+	# and maybe others.
+	# Add all the modules of the individual subprojects to the
+	# PYTHONPATH, so they get actually found and used. In
+	# particular, already installed versions on the system are not
+	# used.
+	for dir in audit2allow chcat semanage sepolgen/src sepolicy ; do
+		PYTHONPATH="${S}/${dir}:${PYTHONPATH}"
+	done
+	PYTHONPATH=${PYTHONPATH} emake -C "${S}" test
+}
+
+src_test() {
+	pushd sepolicy >/dev/null || die
+	distutils-r1_src_test
+	popd >/dev/null || die
+}
+
+python_install() {
+	distutils-r1_python_install
+	emake -C "${S}" \
+		DESTDIR="${D}" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		install
+
+	# Install over previously installed scripts to ensure proper python support
+	python_doscript "${S}"/audit2allow/audit2allow
+	python_doscript "${S}"/audit2allow/sepolgen-ifgen
+	python_doscript "${S}"/chcat/chcat
+	python_newscript "${S}"/sepolicy/sepolicy.py sepolicy
+
+	python_scriptinto /usr/sbin
+	python_doscript "${S}"/semanage/semanage
+
+	# set _PYTHON_SCRIPTROOT to the implicit default for the next python target, bug #967869
+	python_scriptinto /usr/bin
+
+	python_optimize
+}
+
+python_install_all() {
+	# Create sepolgen.conf with different devel location definition
+	mkdir -p "${D}"/etc/selinux || die "Failed to create selinux directory";
+	if [[ -f /etc/selinux/config ]];
+	then
+		local selinuxtype=$(awk -F'=' '/^SELINUXTYPE/ {print $2}' /etc/selinux/config);
+		echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+			> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+	else
+		local selinuxtype="${POLICY_TYPES%% *}";
+		if [[ -n "${selinuxtype}" ]];
+		then
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/${selinuxtype}/include:/usr/share/selinux/${selinuxtype}" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		else
+			echo "SELINUX_DEVEL_PATH=/usr/share/selinux/strict/include:/usr/share/selinux/strict" \
+				> "${D}"/etc/selinux/sepolgen.conf || die "Failed to generate sepolgen"
+		fi
+	fi
+}
+
+src_install() {
+	pushd sepolicy >/dev/null || die
+	distutils-r1_src_install
+	popd >/dev/null || die
+}
diff --git a/sys-apps/semodule-utils/Manifest b/sys-apps/semodule-utils/Manifest
index d46e534a740c5..0ccffc9b3a710 100644
--- a/sys-apps/semodule-utils/Manifest
+++ b/sys-apps/semodule-utils/Manifest
@@ -1,3 +1,4 @@
 DIST semodule-utils-3.6.tar.gz 12844 BLAKE2B e5e7501c412649f471e89cc89569d6c51421e0b46f172f243ce778bbe3a2c658ef9a92e3f3e1e07fb3358e25f63e004b6bd4b56619472fbcae8cb5b916d54170 SHA512 16b58bbafcaef9a2e8e34a20d0e1e4024a9044024de8fa3137c5ba1b9af600afac51c15ccb648dd6bff77747c047f4c9feafeea07c19b1eb14955acc92697a48
 DIST semodule-utils-3.7.tar.gz 12896 BLAKE2B 7487c74585e281f6c44e9977efb85e89bf01d93285c6cc6593dd876e948cc385ec9f11b52f3fc182b2bac3621bcc89c53fc217c41b1a01d586274139b0a40fa6 SHA512 133f76ddff0cc4121e59560f4167e15288cc7f6172a39b49ea631803f6e3365fef95166a55498fa2e036de85466e37bb6ec164ef60855eef8c888c9b384b0120
 DIST semodule-utils-3.8.1.tar.gz 12892 BLAKE2B b134dcd6bec0c543c22aba091c25568bca4fee1567538bac719103c7a2d825cbba8540d58cf1891d82f77b0b981e6e6448e9fc270f39c2afa9d9df83c1660b13 SHA512 e2d379192daf660aabe97d6565b8c6575d7ec6daf59505e1546c0a78a289c0bc533ed81494652503e003cdd61cec6dc72155b3077ed092a6b428a9fc2cd564fa
+DIST semodule-utils-3.9.tar.gz 12892 BLAKE2B bf8cbc3d4f8b19625f8c5b367cb5f2657346c8e6487ead58d9354d481bc7f174909701f3fc0d7115623181a91883f998a16fe59c4750e3ce173bf363552b11ad SHA512 169176f5c1b5a0d4a09c4aa3903a15baca4241f5a46c1380ebdd0bea6970b274f2885e5582e832a1be6e35bb1227291449e57d5fffc316e1aa4c2585fb9e1f4e
diff --git a/sys-apps/semodule-utils/semodule-utils-3.9.ebuild b/sys-apps/semodule-utils/semodule-utils-3.9.ebuild
new file mode 100644
index 0000000000000..6226ee61a66b7
--- /dev/null
+++ b/sys-apps/semodule-utils/semodule-utils-3.9.ebuild
@@ -0,0 +1,42 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit toolchain-funcs
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux policy module utilities"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == *9999 ]] ; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0"
+
+DEPEND=">=sys-libs/libsepol-${PV}:="
+RDEPEND="${DEPEND}"
+
+src_prepare() {
+	default
+
+	sed -i 's/-Werror//g' "${S}"/*/Makefile || die "Failed to remove Werror"
+}
+
+src_compile() {
+	emake CC="$(tc-getCC)"
+}
+
+src_install() {
+	emake DESTDIR="${D}" install
+}
diff --git a/sys-libs/libselinux/Manifest b/sys-libs/libselinux/Manifest
index 0e9339f38b2ab..f8ba0227221d2 100644
--- a/sys-libs/libselinux/Manifest
+++ b/sys-libs/libselinux/Manifest
@@ -1 +1,2 @@
 DIST libselinux-3.8.1.tar.gz 204411 BLAKE2B f0508b3cf9c0fa2c315cab7b8048980a5a40188411ffd7790c5272e643742de073f0a8da44086e558c1b65ccb55e65cd559aad95e8da3cbfefd6adc9a5e09214 SHA512 646a31dff3b670a530adb9fc2fdc3ca9fe34a58e67e0fac52cc33bc7a01fa63c175987ef254c6c3bc7299cef137bc6f258dc378f4d70ae5c0fa0ece3bef42ab4
+DIST libselinux-3.9.tar.gz 205334 BLAKE2B 01ed24734ce72f7c1bbe866ef0482ca05d7ef6c7702764706c12ea76ca2eef575f4d7cab11c91f7a5ec9c56bc563edc7c5a171f3ae7ff8e5091b3697bcf82bf4 SHA512 a91942e7d16673396610d969f2471173989995a048edacf6076f6df3200a0d541a1c9932a7632d70aa7c728de7e7d3c62712e5aab6c0b763826e7ffef808cadb
diff --git a/sys-libs/libselinux/libselinux-3.9.ebuild b/sys-libs/libselinux/libselinux-3.9.ebuild
new file mode 100644
index 0000000000000..1bee80e94c690
--- /dev/null
+++ b/sys-libs/libselinux/libselinux-3.9.ebuild
@@ -0,0 +1,167 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+DISTUTILS_EXT=1
+PYTHON_COMPAT=( python3_{11..14} )
+USE_RUBY="ruby32 ruby33"
+
+# No, I am not calling ruby-ng
+inherit distutils-r1 toolchain-funcs multilib-minimal
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux userland library"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="public-domain"
+SLOT="0"
+IUSE="python ruby static-libs ruby_targets_ruby32 ruby_targets_ruby33"
+REQUIRED_USE="python? ( ${PYTHON_REQUIRED_USE} )"
+
+RDEPEND="dev-libs/libpcre2:=[static-libs?,${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP},static-libs(+)]
+	python? ( ${PYTHON_DEPS} )
+	ruby? (
+		ruby_targets_ruby32? ( dev-lang/ruby:3.2 )
+		ruby_targets_ruby33? ( dev-lang/ruby:3.3 )
+	)
+	elibc_musl? ( sys-libs/fts-standalone )"
+DEPEND="${RDEPEND}"
+BDEPEND="virtual/pkgconfig
+	python? (
+		>=dev-lang/swig-2.0.9
+		dev-python/pip[${PYTHON_USEDEP}]
+)
+	ruby? ( >=dev-lang/swig-2.0.9 )"
+
+src_prepare() {
+	eapply_user
+
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	tc-export AR CC PKG_CONFIG RANLIB
+
+	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
+
+	emake \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		SHLIBDIR="/$(get_libdir)" \
+		LDFLAGS="-fPIC ${LDFLAGS} -pthread" \
+		USE_PCRE2=y \
+		USE_LFS=y \
+		FTS_LDLIBS="$(usex elibc_musl '-lfts' '')" \
+		all
+
+	if multilib_is_native_abi; then
+		if use python; then
+			pushd src >/dev/null || die
+			distutils-r1_src_compile
+			popd >/dev/null || die
+		fi
+		if use ruby; then
+			building() {
+				einfo "Calling rubywrap for ${1}"
+				# Clean up .lo file to force rebuild
+				rm -f src/selinuxswig_ruby_wrap.lo || die
+				emake \
+					RUBY=${1} \
+					LDFLAGS="-fPIC ${LDFLAGS} -lpthread" \
+					LIBDIR="\$(PREFIX)/$(get_libdir)" \
+					SHLIBDIR="/$(get_libdir)" \
+					USE_LFS=y \
+					USE_PCRE2=y \
+					FTS_LDLIBS="$(usex elibc_musl '-lfts' '')" \
+					rubywrap
+			}
+			for RUBYTARGET in ${USE_RUBY}; do
+				use ruby_targets_${RUBYTARGET} || continue
+
+				building ${RUBYTARGET}
+			done
+		fi
+	fi
+}
+
+multilib_src_install() {
+	emake DESTDIR="${D}" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		SHLIBDIR="/$(get_libdir)" \
+		USE_LFS=y \
+		USE_PCRE2=y \
+		install
+
+	if multilib_is_native_abi; then
+		if use python; then
+			pushd src >/dev/null || die
+			mv selinux.py __init__.py || die
+			distutils-r1_src_install
+			popd >/dev/null || die
+		fi
+		if use ruby; then
+			installation() {
+				einfo "Calling install-rubywrap for ${1}"
+				# Forcing (re)build here as otherwise the resulting SO file is used for all ruby versions
+				rm src/selinuxswig_ruby_wrap.lo
+				emake DESTDIR="${D}" \
+					LIBDIR="\$(PREFIX)/$(get_libdir)" \
+					SHLIBDIR="/$(get_libdir)" \
+					RUBY=${1} \
+					USE_LFS=y \
+					USE_PCRE2=y \
+					install-rubywrap
+			}
+			for RUBYTARGET in ${USE_RUBY}; do
+				use ruby_targets_${RUBYTARGET} || continue
+
+				installation ${RUBYTARGET}
+			done
+		fi
+	fi
+
+	use static-libs || rm "${ED}"/usr/$(get_libdir)/*.a || die
+}
+
+python_install() {
+	# this installs the C extensions only
+	distutils-r1_python_install
+
+	# now explicitly install the python package
+	python_moduleinto selinux
+	python_domodule __init__.py
+
+	# install the C extension symlink
+	local pycext="$(python -c 'import importlib.machinery;print(importlib.machinery.EXTENSION_SUFFIXES[0])' || die)"
+	dosym -r "$(python_get_sitedir)/selinux/_selinux${pycext}" "$(python_get_sitedir)/_selinux${pycext}"
+}
+
+pkg_postinst() {
+	# Fix bug 473502
+	for POLTYPE in ${POLICY_TYPES};
+	do
+		mkdir -p "${ROOT}/etc/selinux/${POLTYPE}/contexts/files" || die
+		touch "${ROOT}/etc/selinux/${POLTYPE}/contexts/files/file_contexts.local" || die
+		# Fix bug 516608
+		for EXPRFILE in file_contexts file_contexts.homedirs file_contexts.local ; do
+			if [[ -f "${ROOT}/etc/selinux/${POLTYPE}/contexts/files/${EXPRFILE}" ]]; then
+				sefcontext_compile "${ROOT}/etc/selinux/${POLTYPE}/contexts/files/${EXPRFILE}" \
+				|| die "Failed to recompile contexts"
+			fi
+		done
+	done
+}
diff --git a/sys-libs/libsemanage/Manifest b/sys-libs/libsemanage/Manifest
index 632c6a0cf2072..ac2119b1dd386 100644
--- a/sys-libs/libsemanage/Manifest
+++ b/sys-libs/libsemanage/Manifest
@@ -1 +1,2 @@
 DIST libsemanage-3.8.1.tar.gz 184618 BLAKE2B 25816a0dccc9cb4fe2033e548e0e840b5ffbde3771a8a4f6d81223c7c29e3622eb0152050d8f1ba41bd6b9afb0ad9819e9a1fabd9722e01cad57d7fd7a135d5d SHA512 ac3729ba4934a48a33e082af35baa9e25e6806855afb0f0e4e22aa67be201518c3d4933b8cf4dec83e5acbe178301276f51850bb1b16bc13e027a470ac7f1eb5
+DIST libsemanage-3.9.tar.gz 185278 BLAKE2B 8ba8771ec28b12aa9641b2f7d653c48941f52a245c0784c0f87836948babc308ffe882df5154dfeba3c267f91b916165d4fd0b83de302da572c7dea02e819009 SHA512 a859e8d9313c922942a9be0477b387775b19c41bd108f80992112dcd2696701f40a890f5e6fc3087e7bfe69b382a1bcffa3e02c8996a719e763fbe2f6787c61c
diff --git a/sys-libs/libsemanage/libsemanage-3.9.ebuild b/sys-libs/libsemanage/libsemanage-3.9.ebuild
new file mode 100644
index 0000000000000..4ad33f3ae0b95
--- /dev/null
+++ b/sys-libs/libsemanage/libsemanage-3.9.ebuild
@@ -0,0 +1,118 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+PYTHON_COMPAT=( python3_{11..14} )
+
+inherit python-r1 toolchain-funcs multilib-minimal
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux kernel and policy management library"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/2"
+REQUIRED_USE="${PYTHON_REQUIRED_USE}"
+
+RDEPEND="app-arch/bzip2[${MULTILIB_USEDEP}]
+	>=sys-libs/libsepol-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-libs/libselinux-${PV}:=[${MULTILIB_USEDEP}]
+	>=sys-process/audit-2.2.2[${MULTILIB_USEDEP}]
+	${PYTHON_DEPS}"
+DEPEND="${RDEPEND}"
+BDEPEND=">=dev-lang/swig-2.0.4-r1
+	app-alternatives/yacc
+	app-alternatives/lex
+	virtual/pkgconfig"
+
+# tests are not meant to be run outside of the
+# full SELinux userland repo
+RESTRICT="test"
+
+src_prepare() {
+	eapply_user
+
+	cat <<-EOF >> "${S}/src/semanage.conf" || die
+	# Set this to true to save the linked policy.
+	# This is normally only useful for analysis
+	# or debugging of policy.
+	save-linked=false
+
+	# Set this to 0 to disable assertion checking.
+	# This should speed up building the kernel policy
+	# from policy modules, but may leave you open to
+	# dangerous rules which assertion checking
+	# would catch.
+	expand-check=1
+
+	# Modules in the module store can be compressed
+	# with bzip2.  Set this to the bzip2 blocksize
+	# 1-9 when compressing.  The higher the number,
+	# the more memory is traded off for disk space.
+	# Set to 0 to disable bzip2 compression.
+	bzip-blocksize=0
+
+	# Reduce memory usage for bzip2 compression and
+	# decompression of modules in the module store.
+	bzip-small=true
+	EOF
+
+	multilib_copy_sources
+}
+
+multilib_src_compile() {
+	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
+
+	emake \
+		AR="$(tc-getAR)" \
+		CC="$(tc-getCC)" \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		all
+
+	if multilib_is_native_abi; then
+		building_py() {
+			emake \
+				AR="$(tc-getAR)" \
+				CC="$(tc-getCC)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				"$@"
+		}
+		python_foreach_impl building_py swigify
+		python_foreach_impl building_py pywrap
+	fi
+}
+
+multilib_src_install() {
+	emake \
+		LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+		DESTDIR="${ED}" install
+
+	if multilib_is_native_abi; then
+		installation_py() {
+			emake DESTDIR="${ED}" \
+				LIBDIR="${EPREFIX}/usr/$(get_libdir)" \
+				PKG_CONFIG="$(tc-getPKG_CONFIG)" \
+				install-pywrap
+			python_optimize # bug 531638
+		}
+		python_foreach_impl installation_py
+	fi
+}
+
+multiib_src_install_all() {
+	python_setup
+	python_fix_shebang "${ED}"/usr/libexec/selinux/semanage_migrate_store
+}
diff --git a/sys-libs/libsepol/Manifest b/sys-libs/libsepol/Manifest
index e86d0df422163..b201f8e72c37b 100644
--- a/sys-libs/libsepol/Manifest
+++ b/sys-libs/libsepol/Manifest
@@ -1 +1,2 @@
 DIST libsepol-3.8.1.tar.gz 513830 BLAKE2B f1877499a31289af941e36b80c1c25ca2b32205684d958c4a8b04e05006346138046e3f263e73db3889f918e2ff93818f4d6176de5d17669b863c853d04928e0 SHA512 6a66fbbc25f4ca5f58b07d19a70f3f6c233594ea5bc5a9f5d9f008eb03a83cea84ae0f03329f340b95e4f7135981d06cb9e66a7b3ca2f1494a71bbdcb5a01665
+DIST libsepol-3.9.tar.gz 515726 BLAKE2B 646bdb23fa249660208201c1a286eb42da0877cf38c3422afe7dab60d48b05a4db806bc54eb8a5c7f3a5f23eb75b448bac16a76a3c0c9d6368ec1fbcc1e5118b SHA512 9a198fb0b7f4981939e6556ba690892bda77446785c2015cdf4178fa303095186f255dfbebe04e6749a139379718a012349aa7a70fac94a860a3745c0536afe9
diff --git a/sys-libs/libsepol/libsepol-3.9.ebuild b/sys-libs/libsepol/libsepol-3.9.ebuild
new file mode 100644
index 0000000000000..bf077cd2cb0cf
--- /dev/null
+++ b/sys-libs/libsepol/libsepol-3.9.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI="8"
+
+inherit dot-a toolchain-funcs multilib-minimal
+
+MY_PV="${PV//_/-}"
+MY_P="${PN}-${MY_PV}"
+
+DESCRIPTION="SELinux binary policy representation library"
+HOMEPAGE="https://github.com/SELinuxProject/selinux/wiki"
+
+if [[ ${PV} == 9999 ]]; then
+	inherit git-r3
+	EGIT_REPO_URI="https://github.com/SELinuxProject/selinux.git"
+	S="${WORKDIR}/${P}/${PN}"
+else
+	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
+	KEYWORDS="~amd64 ~arm ~arm64 ~mips ~riscv ~x86"
+	S="${WORKDIR}/${MY_P}"
+fi
+
+LICENSE="GPL-2"
+SLOT="0/2"
+IUSE="+static-libs"
+
+# tests are not meant to be run outside of the full SELinux userland repo
+RESTRICT="test"
+
+src_prepare() {
+	eapply_user
+	multilib_copy_sources
+}
+
+my_make() {
+	use static-libs && lto-guarantee-fat
+	emake \
+		PREFIX="${EPREFIX}/usr" \
+		LIBDIR="\$(PREFIX)/$(get_libdir)" \
+		SHLIBDIR="${EPREFIX}/$(get_libdir)" \
+		"${@}"
+}
+
+multilib_src_compile() {
+	tc-export CC AR RANLIB
+
+	local -x CFLAGS="${CFLAGS} -fno-semantic-interposition"
+
+	my_make
+}
+
+multilib_src_install() {
+	my_make DESTDIR="${D}" install
+	if use static-libs; then
+		strip-lto-bytecode
+	else
+		rm "${ED}"/usr/$(get_libdir)/*.a || die
+	fi
+}
diff --git a/x11-apps/bitmap/bitmap-1.1.2.ebuild b/x11-apps/bitmap/bitmap-1.1.2.ebuild
index 60f80611bbc45..99644ab9fe215 100644
--- a/x11-apps/bitmap/bitmap-1.1.2.ebuild
+++ b/x11-apps/bitmap/bitmap-1.1.2.ebuild
@@ -6,7 +6,7 @@ EAPI=8
 inherit xorg-3
 
 DESCRIPTION="X.Org bitmap application"
-KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86"
+KEYWORDS="~alpha amd64 ~arm ~arm64 ~hppa ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc x86"
 
 RDEPEND="
 	x11-libs/libX11