From f4e014b0a59fc646c647233c31f00fcd1fb907d6 Mon Sep 17 00:00:00 2001
From: Sam James <sam@gentoo.org>
Date: Sun, 6 Sep 2026 21:09:17 +0100
Subject: [PATCH] net-misc/wget: rename USE=cookie-check -> USE=psl,
 default-enable it

Rename USE=cookie-check -> USE=psl to match net-misc/curl, and enable
it by default. It is enabled by default by upstream too.

net-libs/libpsl is tiny and this avoids a class of security bugs
with cookies.

Bug: https://bugs.gentoo.org/919325
Signed-off-by: Sam James <sam@gentoo.org>
---
 net-misc/wget/metadata.xml          |   1 +
 net-misc/wget/wget-1.25.0-r3.ebuild | 129 ++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)
 create mode 100644 net-misc/wget/wget-1.25.0-r3.ebuild

diff --git a/net-misc/wget/metadata.xml b/net-misc/wget/metadata.xml
index e9c33acfd5b11..79e6d50863683 100644
--- a/net-misc/wget/metadata.xml
+++ b/net-misc/wget/metadata.xml
@@ -10,6 +10,7 @@
 		<flag name="libproxy">Support for automatic proxy configuration management through <pkg>net-libs/libproxy</pkg>.</flag>
 		<flag name="metalink">Enable support for <pkg>media-libs/libmetalink</pkg></flag>
 		<flag name="ntlm">Enable support for NTLM (Windows-based) authorization</flag>
+		<flag name="psl">Enable Public Suffix List (PSL) support</flag>
 		<flag name="uuid">Generate UUIDs for the WARC (Web ARChive file format) using libuuid; otherwise use a simple RNG (random number generator)</flag>
 	</use>
 	<upstream>
diff --git a/net-misc/wget/wget-1.25.0-r3.ebuild b/net-misc/wget/wget-1.25.0-r3.ebuild
new file mode 100644
index 0000000000000..480d67fc52745
--- /dev/null
+++ b/net-misc/wget/wget-1.25.0-r3.ebuild
@@ -0,0 +1,129 @@
+# Copyright 1999-2026 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{12..14} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/wget.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs unpacker verify-sig
+
+DESCRIPTION="Network utility to retrieve files from the WWW"
+HOMEPAGE="https://www.gnu.org/software/wget/"
+SRC_URI="mirror://gnu/wget/${P}.tar.lz"
+SRC_URI+=" verify-sig? ( mirror://gnu/wget/${P}.tar.lz.sig )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="debug gnutls idn libproxy metalink nls ntlm pcre +psl +ssl static test uuid zlib"
+REQUIRED_USE="
+	ntlm? ( !gnutls ssl )
+	gnutls? ( ssl )
+	static? ( !libproxy )
+"
+RESTRICT="!test? ( test )"
+
+# * Force a newer libidn2 to avoid libunistring deps. #bug #612498
+# * Metalink can use gpgme automagically (so let's always depend on it)
+# for signed metalink resources.
+LIB_DEPEND="
+	idn? ( >=net-dns/libidn2-0.14:=[static-libs(-)] )
+	libproxy? ( net-libs/libproxy )
+	metalink? (
+		app-crypt/gpgme:=[static-libs(-)]
+		media-libs/libmetalink[static-libs(-)]
+	)
+	pcre? ( dev-libs/libpcre2[static-libs(-)] )
+	psl? ( net-libs/libpsl[static-libs(-)] )
+	ssl? (
+		gnutls? ( net-libs/gnutls:=[static-libs(-)] )
+		!gnutls? ( dev-libs/openssl:=[static-libs(-)] )
+	)
+	uuid? ( sys-apps/util-linux[static-libs(-)] )
+	zlib? ( virtual/zlib:=[static-libs(-)] )
+"
+RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs(-)]} )"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	$(unpacker_src_uri_depends)
+	app-arch/xz-utils
+	dev-lang/perl
+	sys-apps/texinfo
+	virtual/pkgconfig
+	nls? ( sys-devel/gettext )
+	test? (
+		${PYTHON_DEPS}
+		>=dev-perl/HTTP-Daemon-6.60.0
+		dev-perl/HTTP-Message
+		dev-perl/IO-Socket-SSL
+	)
+	verify-sig? ( >=sec-keys/openpgp-keys-wget-20241111 )
+"
+
+DOCS=( AUTHORS MAILING-LIST NEWS README )
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN alignof static_assert fpurge )
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.25.0-openssl-4.patch
+)
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_unpack() {
+	use verify-sig && verify-sig_verify_detached "${DISTDIR}"/${P}.tar.lz{,.sig}
+	unpacker ${P}.tar.lz
+}
+
+src_prepare() {
+	default
+	sed -i -e "s:/usr/local/etc:${EPREFIX}/etc:g" doc/{sample.wgetrc,wget.texi} || die
+}
+
+src_configure() {
+	# fix compilation on Solaris, we need filio.h for FIONBIO as used in
+	# the included gnutls -- force ioctl.h to include this header
+	[[ ${CHOST} == *-solaris* ]] && append-cppflags -DBSD_COMP=1
+
+	if use static ; then
+		append-ldflags -static
+		tc-export PKG_CONFIG
+		PKG_CONFIG+=" --static"
+	fi
+
+	# There is no flag that controls this.  libunistring-prefix only
+	# controls the search path (which is why we turn it off below).
+	# Further, libunistring is only needed w/older libidn2 installs,
+	# and since we force the latest, we can force off libunistring. # bug #612498
+	local myeconfargs=(
+		ac_cv_libunistring=no
+		--disable-assert
+		--disable-pcre
+		--disable-rpath
+		--without-included-libunistring
+		--without-libunistring-prefix
+		--enable-ipv6
+		$(use_enable debug)
+		$(use_enable idn iri)
+		$(use_enable nls)
+		$(use_enable ntlm)
+		$(use_enable pcre pcre2)
+		$(use_enable ssl digest)
+		$(use_enable ssl opie)
+		$(use_with psl libpsl)
+		$(use_enable idn iri)
+		$(use_enable libproxy)
+		$(use_with metalink)
+		$(use_with ssl ssl $(usex gnutls gnutls openssl))
+		$(use_with uuid libuuid)
+		$(use_with zlib)
+	)
+
+	econf "${myeconfargs[@]}"
+}