14 files changed, 1695 insertions, 460 deletions
diff --git a/sys-apps/coreutils/Manifest b/sys-apps/coreutils/Manifest
index 9e4b4c1d5cdf..2823060d3567 100644
--- a/sys-apps/coreutils/Manifest
+++ b/sys-apps/coreutils/Manifest
@@ -1,3 +1,8 @@
 DIST coreutils-8.30-patches-01.tar.xz 5788 BLAKE2B a41511ce39ac570cb14b7f12d125eebef92217469a9490808719fa0665f5e5c0adb96fbd02c4bac4d280d1502295669575790a81dbc01afe2ca3a9d384cbefb0 SHA512 b1e1933637de4581d5f8c6ede4e80a012435d13f0cf5550a76ab5bbe9441e3c15ce19ef3f78a7ea3b8368d5e9a3bb17c1207c471d26171b59786f38adeba0454
-DIST coreutils-8.30.tar.xz 5359532 BLAKE2B b66ccd112a6c2c8b90e58ff1c3371e7f5827937035769329885e5bdae197466189f3715720b8f8cf0b5047fe16d6c86984dcee994117c2d3c7b8dbd597027255 SHA512 25bc132c0d89ce71c33e417f04649c9fcfce6c5ef8b19f093b2e9e2851bfde9b5a31e20499d9c427332228ba54b88d445ddb445551e1944bb8f5cbff5ffa4eda
-DIST coreutils-8.31.tar.xz 5410140 BLAKE2B e3ae6be8edbe9df9164b4c9ac8bf14dc23b147fa665f20669e18ac4c6e45ba839dc0dc99e05670eb006d22133475a4a717a5f40b00ebaedfd6e1fbab887674d5 SHA512 ef8941dae845bbf5ae5838bc49e44554a766302930601aada6fa594e8088f0fbad74e481ee392ff89633e68b99e4da3f761fcb5d31ee3b233d540fe2a2d4e1af
+DIST coreutils-8.32.tar.xz 5547836 BLAKE2B 0ad99c176c19ec214fcfd0845523e5362f0151827707c759bd46c0fe8d2501c6ad1c29c5b71266f6525857bc0d56c472db0d7fe29953b6c65e2e6c76bdf3c515 SHA512 1c8f3584efd61b4b02e7ac5db8e103b63cfb2063432caaf1e64cb2dcc56d8c657d1133bbf10bd41468d6a1f31142e6caa81d16ae68fa3e6e84075c253613a145
+DIST coreutils-9.4-patches.tar.xz 6756 BLAKE2B 677454409ccb629fd0efde1e15d8f9c13f208391e63a17816011e84d4ca3fb2a42c2a60853f213ade2a53c821d76fd8924c59388d160c6e7c7fa5755e1db4c68 SHA512 2025c80b5ada92bafb479c678917862be208534becd8b347d335032c6b4cc23c7b7630f15ca7dd3b5d691567cb70f3491753e29441cc54d8700cc3d966a5e743
+DIST coreutils-9.4.tar.xz 5979200 BLAKE2B 83d41c48804c1d470c0e5eed38e692bb6875436dda3f6e2c29784ad6ef563d86e8e066a050e222621b400f78ea4630b1e127d20fc9b76f12096528c42677e35d SHA512 7c55ee23b685a0462bbbd118b04d25278c902604a0dcf3bf4f8bf81faa0500dee5a7813cba6f586d676c98e520cafd420f16479619305e94ea6798d8437561f5
+DIST coreutils-9.4.tar.xz.sig 833 BLAKE2B 870f7eb28e8851f41954820c7f4f4b43a965e6650b303b79541dfdf98ca0cd52fe964d7eec72bea68066452d7ad21a01df5e4db9e5bc4c20bf26d8b416856446 SHA512 9674f783f592c4f3e5c708ff31426ac009bf132fd0005019571bf39c8a1627efb5351c6cecc7faecb1eff8fa2970318666593bffc0eda9c750159e174ef42524
+DIST coreutils-9.5-patches.tar.xz 5912 BLAKE2B 873fbe1a60f8f8034b3d35796146765ce388952d649c32dc81ca0e4c2823c9f2f00b69bc5cb3af686434867459b6dc378fb9a6d59563d28b87c3ee1eceeedbb3 SHA512 4b4ad356615d046b8d67ea35b789f887a787ab01ece3234f6344518aef33cd30ca364fef5d85e11acfdb24003114c16ffdab82922fb135d5425fbcd541064a76
+DIST coreutils-9.5.tar.xz 6007136 BLAKE2B 6fd3a77697c9e85f31415c6ad66559faf18acc7d346677a89d4a999c2027886551e78842a7283e7b3b44fe8ef2fde04ba2f88df32a7844d5f69d45bcb7a04b6f SHA512 2ca0deac4dc10a80fd0c6fd131252e99d457fd03b7bd626a6bc74fe5a0529c0a3d48ce1f5da1d3b3a7a150a1ce44f0fbb6b68a6ac543dfd5baa3e71f5d65401c
+DIST coreutils-9.5.tar.xz.sig 833 BLAKE2B 37c29984bceee0ff3bffde76712f71dbb118c228e328dc230d5c53c37da12f5ec2130e0123b97fda4a561f556c3be307fdbe1f0c21279db2c84030818386f626 SHA512 029997e0f4ee64e561853cff7c8a124f58cc891598595b44c4a46f9813b4b71c9d677464bc8a26d294e9971832f4b87c23777fea4fac6e8e30f06ad93b9957d5
diff --git a/sys-apps/coreutils/coreutils-8.30.ebuild b/sys-apps/coreutils/coreutils-8.30.ebuild
deleted file mode 100644
index 0f5e13380cb3..000000000000
--- a/sys-apps/coreutils/coreutils-8.30.ebuild
+++ /dev/null
@@ -1,206 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="6"
-
-PYTHON_COMPAT=( python{2_7,3_6} )
-
-inherit eutils flag-o-matic python-any-r1 toolchain-funcs
-
-PATCH_VER="01"
-DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
-HOMEPAGE="https://www.gnu.org/software/coreutils/"
-SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
-	mirror://gentoo/${P}-patches-${PATCH_VER}.tar.xz
-	https://dev.gentoo.org/~polynomial-c/dist/${P}-patches-${PATCH_VER}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="alpha amd64 arm arm64 hppa ia64 m68k ~mips ppc ppc64 s390 sh sparc x86 ~x86-linux"
-IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test userland_BSD vanilla xattr"
-RESTRICT="!test? ( test )"
-
-LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
-	caps? ( sys-libs/libcap )
-	gmp? ( dev-libs/gmp:=[static-libs] )
-	xattr? ( !userland_BSD? ( sys-apps/attr[static-libs] ) )"
-RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
-	selinux? ( sys-libs/libselinux )
-	nls? ( virtual/libintl )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	app-arch/xz-utils
-	test? (
-		dev-lang/perl
-		dev-perl/Expect
-		!userland_BSD? (
-			dev-util/strace
-		)
-		${PYTHON_DEPS}
-		$(python_gen_any_dep 'dev-python/pyinotify[${PYTHON_USEDEP}]')
-	)"
-RDEPEND+="
-	hostname? ( !sys-apps/net-tools[hostname] )
-	kill? (
-		!sys-apps/util-linux[kill]
-		!sys-process/procps[kill]
-	)
-	!app-misc/realpath
-	!<sys-apps/util-linux-2.13
-	!<sys-apps/sandbox-2.10-r4
-	!sys-apps/stat
-	!net-mail/base64
-	!sys-apps/mktemp
-	!<app-forensics/tct-1.18-r1
-	!<net-fs/netatalk-2.0.3-r4"
-
-pkg_setup() {
-	if use test ; then
-		python-any-r1_pkg_setup
-	fi
-}
-
-src_prepare() {
-	if ! use vanilla ; then
-		eapply "${WORKDIR}"/patch/*.patch
-	fi
-
-	eapply_user
-
-	# Since we've patched many .c files, the make process will try to
-	# re-build the manpages by running `./bin --help`.  When doing a
-	# cross-compile, we can't do that since 'bin' isn't a native bin.
-	# Also, it's not like we changed the usage on any of these things,
-	# so let's just update the timestamps and skip the help2man step.
-	set -- man/*.x
-	touch ${@/%x/1}
-
-	# Avoid perl dep for compiled in dircolors default #348642
-	if ! has_version dev-lang/perl ; then
-		touch src/dircolors.h
-		touch ${@/%x/1}
-	fi
-}
-
-src_configure() {
-	local myconf=(
-		--with-packager="Gentoo"
-		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
-		--with-packager-bug-reports="https://bugs.gentoo.org/"
-		--enable-install-program="arch,$(usev hostname),$(usev kill)"
-		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
-		--enable-largefile
-		$(usex caps '' --disable-libcap)
-		$(use_enable nls)
-		$(use_enable acl)
-		$(use_enable multicall single-binary)
-		$(use_enable xattr)
-		$(use_with gmp)
-	)
-	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
-		export fu_cv_sys_stat_statfs2_bsize=yes #311569
-		export gl_cv_func_realpath_works=yes #416629
-	fi
-
-	export gl_cv_func_mknod_works=yes #409919
-	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
-	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
-	use userland_BSD && myconf+=( -program-prefix=g --program-transform-name=s/stat/nustat/ )
-	# kill/uptime - procps
-	# groups/su   - shadow
-	# hostname    - net-tools
-	econf "${myconf[@]}"
-}
-
-src_test() {
-	# Known to fail with FEATURES=usersandbox (bug #439574):
-	#   -  tests/du/long-from-unreadable.sh} (bug #413621)
-	#   -  tests/rm/deep-2.sh (bug #413621)
-	#   -  tests/dd/no-allocate.sh (bug #629660)
-	if has usersandbox $FEATURES ; then
-		ewarn "You are emerging ${P} with 'usersandbox' enabled." \
-			"Expect some test failures or emerge with 'FEATURES=-usersandbox'!"
-	fi
-
-	# Non-root tests will fail if the full path isn't
-	# accessible to non-root users
-	chmod -R go-w "${WORKDIR}"
-	chmod a+rx "${WORKDIR}"
-
-	# coreutils tests like to do `mount` and such with temp dirs
-	# so make sure /etc/mtab is writable #265725
-	# make sure /dev/loop* can be mounted #269758
-	mkdir -p "${T}"/mount-wrappers
-	mkwrap() {
-		local w ww
-		for w in "$@" ; do
-			ww="${T}/mount-wrappers/${w}"
-			cat <<-EOF > "${ww}"
-				#!${EPREFIX}/bin/sh
-				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P $w) "\$@"
-			EOF
-			chmod a+rx "${ww}"
-		done
-	}
-	mkwrap mount umount
-
-	addwrite /dev/full
-	#export RUN_EXPENSIVE_TESTS="yes"
-	#export FETISH_GROUPS="portage wheel"
-	env PATH="${T}/mount-wrappers:${PATH}" \
-	emake -j1 -k check
-}
-
-src_install() {
-	default
-
-	insinto /etc
-	newins src/dircolors.hin DIR_COLORS
-
-	if [[ ${USERLAND} == "GNU" ]] ; then
-		cd "${ED%/}"/usr/bin || die
-		dodir /bin
-		# move critical binaries into /bin (required by FHS)
-		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
-		           mkdir mknod mv pwd rm rmdir stty sync true uname"
-		mv ${fhs} ../../bin/ || die "could not move fhs bins"
-		if use hostname; then
-			mv hostname ../../bin/ || die
-		fi
-		if use kill; then
-			mv kill ../../bin/ || die
-		fi
-		if use split-usr ; then
-			# move critical binaries into /bin (common scripts)
-			local com="basename chroot cut dir dirname du env expr head mkfifo
-			           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
-			mv ${com} ../../bin/ || die "could not move common bins"
-			# create a symlink for uname in /usr/bin/ since autotools require it
-			local x
-			for x in ${com} uname ; do
-				dosym ../../bin/${x} /usr/bin/${x}
-			done
-		fi
-	else
-		# For now, drop the man pages, collides with the ones of the system.
-		rm -rf "${ED%/}"/usr/share/man
-	fi
-
-}
-
-pkg_postinst() {
-	ewarn "Make sure you run 'hash -r' in your active shells."
-	ewarn "You should also re-source your shell settings for LS_COLORS"
-	ewarn "  changes, such as: source /etc/profile"
-
-	# Help out users using experimental filesystems
-	if grep -qs btrfs "${EROOT%/}"/etc/fstab /proc/mounts ; then
-		case $(uname -r) in
-		2.6.[12][0-9]|2.6.3[0-7]*)
-			ewarn "You are running a system with a buggy btrfs driver."
-			ewarn "Please upgrade your kernel to avoid silent corruption."
-			ewarn "See: https://bugs.gentoo.org/353907"
-			;;
-		esac
-	fi
-}
diff --git a/sys-apps/coreutils/coreutils-8.31.ebuild b/sys-apps/coreutils/coreutils-8.31.ebuild
deleted file mode 100644
index 565e641c8b48..000000000000
--- a/sys-apps/coreutils/coreutils-8.31.ebuild
+++ /dev/null
@@ -1,206 +0,0 @@
-# Copyright 1999-2020 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="6"
-
-PYTHON_COMPAT=( python{2_7,3_{6,7}} )
-
-inherit eutils flag-o-matic python-any-r1 toolchain-funcs
-
-PATCH="${PN}-8.30-patches-01"
-DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
-HOMEPAGE="https://www.gnu.org/software/coreutils/"
-SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
-	mirror://gentoo/${PATCH}.tar.xz
-	https://dev.gentoo.org/~polynomial-c/dist/${PATCH}.tar.xz"
-
-LICENSE="GPL-3"
-SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~x86-linux"
-IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test userland_BSD vanilla xattr"
-RESTRICT="!test? ( test )"
-
-LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
-	caps? ( sys-libs/libcap )
-	gmp? ( dev-libs/gmp:=[static-libs] )
-	xattr? ( !userland_BSD? ( sys-apps/attr[static-libs] ) )"
-RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
-	selinux? ( sys-libs/libselinux )
-	nls? ( virtual/libintl )"
-DEPEND="${RDEPEND}
-	static? ( ${LIB_DEPEND} )
-	app-arch/xz-utils
-	test? (
-		dev-lang/perl
-		dev-perl/Expect
-		!userland_BSD? (
-			dev-util/strace
-		)
-		${PYTHON_DEPS}
-		$(python_gen_any_dep 'dev-python/pyinotify[${PYTHON_USEDEP}]')
-	)"
-RDEPEND+="
-	hostname? ( !sys-apps/net-tools[hostname] )
-	kill? (
-		!sys-apps/util-linux[kill]
-		!sys-process/procps[kill]
-	)
-	!app-misc/realpath
-	!<sys-apps/util-linux-2.13
-	!<sys-apps/sandbox-2.10-r4
-	!sys-apps/stat
-	!net-mail/base64
-	!sys-apps/mktemp
-	!<app-forensics/tct-1.18-r1
-	!<net-fs/netatalk-2.0.3-r4"
-
-pkg_setup() {
-	if use test ; then
-		python-any-r1_pkg_setup
-	fi
-}
-
-src_prepare() {
-	if ! use vanilla ; then
-		eapply "${WORKDIR}"/patch/*.patch
-	fi
-
-	eapply_user
-
-	# Since we've patched many .c files, the make process will try to
-	# re-build the manpages by running `./bin --help`.  When doing a
-	# cross-compile, we can't do that since 'bin' isn't a native bin.
-	# Also, it's not like we changed the usage on any of these things,
-	# so let's just update the timestamps and skip the help2man step.
-	set -- man/*.x
-	touch ${@/%x/1}
-
-	# Avoid perl dep for compiled in dircolors default #348642
-	if ! has_version dev-lang/perl ; then
-		touch src/dircolors.h
-		touch ${@/%x/1}
-	fi
-}
-
-src_configure() {
-	local myconf=(
-		--with-packager="Gentoo"
-		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
-		--with-packager-bug-reports="https://bugs.gentoo.org/"
-		--enable-install-program="arch,$(usev hostname),$(usev kill)"
-		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
-		--enable-largefile
-		$(usex caps '' --disable-libcap)
-		$(use_enable nls)
-		$(use_enable acl)
-		$(use_enable multicall single-binary)
-		$(use_enable xattr)
-		$(use_with gmp)
-	)
-	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
-		export fu_cv_sys_stat_statfs2_bsize=yes #311569
-		export gl_cv_func_realpath_works=yes #416629
-	fi
-
-	export gl_cv_func_mknod_works=yes #409919
-	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
-	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
-	use userland_BSD && myconf+=( -program-prefix=g --program-transform-name=s/stat/nustat/ )
-	# kill/uptime - procps
-	# groups/su   - shadow
-	# hostname    - net-tools
-	econf "${myconf[@]}"
-}
-
-src_test() {
-	# Known to fail with FEATURES=usersandbox (bug #439574):
-	#   -  tests/du/long-from-unreadable.sh} (bug #413621)
-	#   -  tests/rm/deep-2.sh (bug #413621)
-	#   -  tests/dd/no-allocate.sh (bug #629660)
-	if has usersandbox ${FEATURES} ; then
-		ewarn "You are emerging ${P} with 'usersandbox' enabled." \
-			"Expect some test failures or emerge with 'FEATURES=-usersandbox'!"
-	fi
-
-	# Non-root tests will fail if the full path isn't
-	# accessible to non-root users
-	chmod -R go-w "${WORKDIR}"
-	chmod a+rx "${WORKDIR}"
-
-	# coreutils tests like to do `mount` and such with temp dirs
-	# so make sure /etc/mtab is writable #265725
-	# make sure /dev/loop* can be mounted #269758
-	mkdir -p "${T}"/mount-wrappers || die
-	mkwrap() {
-		local w ww
-		for w in "${@}" ; do
-			ww="${T}/mount-wrappers/${w}"
-			cat <<-EOF > "${ww}"
-				#!${EPREFIX}/bin/sh
-				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
-			EOF
-			chmod a+rx "${ww}"
-		done
-	}
-	mkwrap mount umount
-
-	addwrite /dev/full
-	#export RUN_EXPENSIVE_TESTS="yes"
-	#export FETISH_GROUPS="portage wheel"
-	env PATH="${T}/mount-wrappers:${PATH}" \
-	emake -j1 -k check
-}
-
-src_install() {
-	default
-
-	insinto /etc
-	newins src/dircolors.hin DIR_COLORS
-
-	if [[ ${USERLAND} == "GNU" ]] ; then
-		cd "${ED%/}"/usr/bin || die
-		dodir /bin
-		# move critical binaries into /bin (required by FHS)
-		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
-		           mkdir mknod mv pwd rm rmdir stty sync true uname"
-		mv ${fhs} ../../bin/ || die "could not move fhs bins"
-		if use hostname; then
-			mv hostname ../../bin/ || die
-		fi
-		if use kill; then
-			mv kill ../../bin/ || die
-		fi
-		if use split-usr ; then
-			# move critical binaries into /bin (common scripts)
-			local com="basename chroot cut dir dirname du env expr head mkfifo
-			           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
-			mv ${com} ../../bin/ || die "could not move common bins"
-			# create a symlink for uname in /usr/bin/ since autotools require it
-			local x
-			for x in ${com} uname ; do
-				dosym ../../bin/${x} /usr/bin/${x}
-			done
-		fi
-	else
-		# For now, drop the man pages, collides with the ones of the system.
-		rm -rf "${ED%/}"/usr/share/man
-	fi
-
-}
-
-pkg_postinst() {
-	ewarn "Make sure you run 'hash -r' in your active shells."
-	ewarn "You should also re-source your shell settings for LS_COLORS"
-	ewarn "  changes, such as: source /etc/profile"
-
-	# Help out users using experimental filesystems
-	if grep -qs btrfs "${EROOT%/}"/etc/fstab /proc/mounts ; then
-		case $(uname -r) in
-		2.6.[12][0-9]|2.6.3[0-7]*)
-			ewarn "You are running a system with a buggy btrfs driver."
-			ewarn "Please upgrade your kernel to avoid silent corruption."
-			ewarn "See: https://bugs.gentoo.org/353907"
-			;;
-		esac
-	fi
-}
diff --git a/sys-apps/coreutils/coreutils-8.31-r1.ebuild b/sys-apps/coreutils/coreutils-8.32-r1.ebuild
index 643aa3aeeca6..01a7a97fc192 100644
--- a/sys-apps/coreutils/coreutils-8.31-r1.ebuild
+++ b/sys-apps/coreutils/coreutils-8.32-r1.ebuild
@@ -1,22 +1,25 @@
-# Copyright 1999-2020 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI="6"
+EAPI=7
 
-PYTHON_COMPAT=( python{2_7,3_{6,7}} )
+PYTHON_COMPAT=( python3_10 )
 
-inherit eutils flag-o-matic python-any-r1 toolchain-funcs
+inherit flag-o-matic python-any-r1 toolchain-funcs
 
 PATCH="${PN}-8.30-patches-01"
 DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
 HOMEPAGE="https://www.gnu.org/software/coreutils/"
 SRC_URI="mirror://gnu/${PN}/${P}.tar.xz
-	mirror://gentoo/${PATCH}.tar.xz
-	https://dev.gentoo.org/~polynomial-c/dist/${PATCH}.tar.xz"
+	!vanilla? (
+		mirror://gentoo/${PATCH}.tar.xz
+		https://dev.gentoo.org/~polynomial-c/dist/${PATCH}.tar.xz
+	)
+"
 
-LICENSE="GPL-3"
+LICENSE="GPL-3+"
 SLOT="0"
-KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sh ~sparc ~x86 ~x86-linux"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
 IUSE="acl caps gmp hostname kill multicall nls selinux +split-usr static test vanilla xattr"
 RESTRICT="!test? ( test )"
 
@@ -27,23 +30,26 @@ LIB_DEPEND="acl? ( sys-apps/acl[static-libs] )
 RDEPEND="!static? ( ${LIB_DEPEND//\[static-libs]} )
 	selinux? ( sys-libs/libselinux )
 	nls? ( virtual/libintl )"
-DEPEND="${RDEPEND}
+DEPEND="
+	${RDEPEND}
 	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
 	app-arch/xz-utils
+	dev-lang/perl
 	test? (
+		dev-debug/strace
 		dev-lang/perl
 		dev-perl/Expect
-		dev-util/strace
 		${PYTHON_DEPS}
-		$(python_gen_any_dep 'dev-python/pyinotify[${PYTHON_USEDEP}]')
-	)"
+	)
+"
 RDEPEND+="
 	hostname? ( !sys-apps/net-tools[hostname] )
 	kill? (
 		!sys-apps/util-linux[kill]
 		!sys-process/procps[kill]
 	)
-	!app-misc/realpath
 	!<sys-apps/util-linux-2.13
 	!<sys-apps/sandbox-2.10-r4
 	!sys-apps/stat
@@ -59,24 +65,30 @@ pkg_setup() {
 }
 
 src_prepare() {
+	local PATCHES=(
+		"${FILESDIR}"/coreutils-8.32-ls-restore-8.31-behavior.patch
+	)
+
 	if ! use vanilla ; then
-		eapply "${WORKDIR}"/patch/*.patch
+		PATCHES+=( "${WORKDIR}"/patch )
+		PATCHES+=( "${FILESDIR}"/${PN}-8.32-sandbox-env-test.patch )
 	fi
 
-	eapply_user
+	default
 
 	# Since we've patched many .c files, the make process will try to
 	# re-build the manpages by running `./bin --help`.  When doing a
 	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
 	# Also, it's not like we changed the usage on any of these things,
 	# so let's just update the timestamps and skip the help2man step.
 	set -- man/*.x
-	touch ${@/%x/1}
+	touch ${@/%x/1} || die
 
-	# Avoid perl dep for compiled in dircolors default #348642
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
 	if ! has_version dev-lang/perl ; then
-		touch src/dircolors.h
-		touch ${@/%x/1}
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
 	fi
 }
 
@@ -85,6 +97,9 @@ src_configure() {
 		--with-packager="Gentoo"
 		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
 		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
 		--enable-install-program="arch,$(usev hostname),$(usev kill)"
 		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
 		--enable-largefile
@@ -95,17 +110,28 @@ src_configure() {
 		$(use_enable xattr)
 		$(use_with gmp)
 	)
+
 	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
-		export fu_cv_sys_stat_statfs2_bsize=yes #311569
-		export gl_cv_func_realpath_works=yes #416629
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
 	fi
 
-	export gl_cv_func_mknod_works=yes #409919
-	use static && append-ldflags -static && sed -i '/elf_sys=yes/s:yes:no:' configure #321821
-	use selinux || export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no #301782
-	# kill/uptime - procps
-	# groups/su   - shadow
-	# hostname    - net-tools
 	econf "${myconf[@]}"
 }
 
@@ -121,12 +147,13 @@ src_test() {
 
 	# Non-root tests will fail if the full path isn't
 	# accessible to non-root users
-	chmod -R go-w "${WORKDIR}"
-	chmod a+rx "${WORKDIR}"
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
 
-	# coreutils tests like to do `mount` and such with temp dirs
-	# so make sure /etc/mtab is writable #265725
-	# make sure /dev/loop* can be mounted #269758
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
 	mkdir -p "${T}"/mount-wrappers || die
 	mkwrap() {
 		local w ww
@@ -136,14 +163,14 @@ src_test() {
 				#!${EPREFIX}/bin/sh
 				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
 			EOF
-			chmod a+rx "${ww}"
+			chmod a+rx "${ww}" || die
 		done
 	}
 	mkwrap mount umount
 
 	addwrite /dev/full
 	#export RUN_EXPENSIVE_TESTS="yes"
-	#export FETISH_GROUPS="portage wheel"
+	#export COREUTILS_GROUPS="portage wheel"
 	env PATH="${T}/mount-wrappers:${PATH}" \
 	emake -j1 -k check
 }
@@ -155,27 +182,32 @@ src_install() {
 	newins src/dircolors.hin DIR_COLORS
 
 	if use split-usr ; then
-		cd "${ED%/}"/usr/bin || die
+		cd "${ED}"/usr/bin || die
 		dodir /bin
-		# move critical binaries into /bin (required by FHS)
+
+		# Move critical binaries into /bin (required by FHS)
 		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
 		           mkdir mknod mv pwd rm rmdir stty sync true uname"
-		mv ${fhs} ../../bin/ || die "could not move fhs bins"
-		if use hostname; then
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
 			mv hostname ../../bin/ || die
 		fi
-		if use kill; then
+
+		if use kill ; then
 			mv kill ../../bin/ || die
 		fi
-		# move critical binaries into /bin (common scripts)
-		# Why are these required for booting?
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
 		local com="basename chroot cut dir dirname du env expr head mkfifo
 		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
-		mv ${com} ../../bin/ || die "could not move common bins"
-		# create a symlink for uname in /usr/bin/ since autotools require it
-		# Other than uname, we need to figure out why we are
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
 		# creating symlinks for these in /usr/bin instead of leaving
-		# the files there in the first place.
+		# the files there in the first place...)
 		local x
 		for x in ${com} uname ; do
 			dosym ../../bin/${x} /usr/bin/${x}
diff --git a/sys-apps/coreutils/coreutils-9.4-r1.ebuild b/sys-apps/coreutils/coreutils-9.4-r1.ebuild
new file mode 100644
index 000000000000..cd9bf44d0689
--- /dev/null
+++ b/sys-apps/coreutils/coreutils-9.4-r1.ebuild
@@ -0,0 +1,308 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Try to keep an eye on Fedora's packaging: https://src.fedoraproject.org/rpms/coreutils
+# The upstream coreutils maintainers also maintain the package in Fedora and may
+# backport fixes which we want to pick up.
+#
+# Also recommend subscribing to the coreutils and bug-coreutils MLs.
+
+PYTHON_COMPAT=( python3_{10..11} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/coreutils.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+MY_PATCH="${PN}-9.4-patches"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/coreutils.git"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).156-b3afb"
+	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
+fi
+
+SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="acl caps gmp hostname kill multicall nls +openssl selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="
+	acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	openssl? ( dev-libs/openssl:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	test? (
+		dev-debug/strace
+		dev-lang/perl
+		dev-perl/Expect
+		${PYTHON_DEPS}
+	)
+	verify-sig? ( sec-keys/openpgp-keys-coreutils )
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs (bug #898370)
+	unreachable MIN alignof static_assert
+)
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+
+		sed -i -e "s:submodule-checks ?= no-submodule-changes public-submodule-commit:submodule-checks ?= no-submodule-changes:" gnulib/top/maint.mk || die
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# TODO: past 2025, we may need to add our own hack for bug #907474.
+	local PATCHES=(
+		# Upstream patches
+		"${FILESDIR}"/${P}-gnulib-openssl-1.1.patch
+		"${FILESDIR}"/${P}-CVE-2024-0684.patch
+		"${FILESDIR}"/${P}-gnulib-clang-18-c23-stdckdint.patch
+	)
+
+	if ! use vanilla && [[ -d "${WORKDIR}"/${MY_PATCH} ]] ; then
+		PATCHES+=( "${WORKDIR}"/${MY_PATCH} )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1} || die
+
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
+	fi
+}
+
+src_configure() {
+	# TODO: in future (>9.4?), we may want to wire up USE=systemd:
+	# still experimental at the moment, but:
+	# https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=85edb4afbd119fb69a0d53e1beb71f46c9525dd0
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		$(usev !caps --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp libgmp)
+		$(use_with openssl)
+	)
+
+	if use gmp ; then
+		myconf+=( --with-libgmp-prefix="${ESYSROOT}"/usr )
+	fi
+
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
+
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}" || die
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+
+	#local -x RUN_EXPENSIVE_TESTS="yes"
+	#local -x COREUTILS_GROUPS="portage wheel"
+	local -x PATH="${T}/mount-wrappers:${PATH}"
+	local -x gl_public_submodule_commit=
+
+	local xfail_tests=(
+		# bug #629660
+		#tests/dd/no-allocate.sh
+
+		# bug #675802
+		tests/env/env-S
+		tests/env/env-S.pl
+
+		# bug #413621 and bug #548250
+		tests/du/long-from-unreadable.sh
+		tests/ls/removed-directory
+		tests/ls/removed-directory.sh
+		tests/ls/stat-free-symlinks
+		tests/ls/stat-free-symlinks.sh
+		tests/rm/deep-2
+		tests/rm/deep-2.sh
+
+		# We have a patch which fixes this (bug #259876)
+		#tests/touch/not-owner
+		#tests/touch/not-owner.sh
+	)
+
+	# This test is flaky (bug #910640).
+	cat > tests/tty/tty-eof.pl <<-EOF || die
+	#!/usr/bin/perl
+	exit 77;
+	EOF
+
+	# We set DISABLE_HARD_ERRORS because some of the tests hard error-out
+	# because of sandbox. They're skipped above but DISABLE_HARD_ERRORS is needed
+	# to downgrade them to FAIL.
+	emake -k check \
+		VERBOSE=yes \
+		DISABLE_HARD_ERRORS=yes \
+		XFAIL_TESTS="${xfail_tests[*]}"
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+
+		# Move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
+			mv hostname ../../bin/ || die
+		fi
+
+		if use kill ; then
+			mv kill ../../bin/ || die
+		fi
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place...)
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sys-apps/coreutils/coreutils-9.4.ebuild b/sys-apps/coreutils/coreutils-9.4.ebuild
new file mode 100644
index 000000000000..7f7d258299b7
--- /dev/null
+++ b/sys-apps/coreutils/coreutils-9.4.ebuild
@@ -0,0 +1,306 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Try to keep an eye on Fedora's packaging: https://src.fedoraproject.org/rpms/coreutils
+# The upstream coreutils maintainers also maintain the package in Fedora and may
+# backport fixes which we want to pick up.
+#
+# Also recommend subscribing to the coreutils and bug-coreutils MLs.
+
+PYTHON_COMPAT=( python3_{10..11} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/coreutils.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+MY_PATCH="${PN}-9.4-patches"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/coreutils.git"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).156-b3afb"
+	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~x86-linux"
+fi
+
+SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="acl caps gmp hostname kill multicall nls +openssl selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="
+	acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	openssl? ( dev-libs/openssl:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	test? (
+		dev-debug/strace
+		dev-lang/perl
+		dev-perl/Expect
+		${PYTHON_DEPS}
+	)
+	verify-sig? ( sec-keys/openpgp-keys-coreutils )
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs (bug #898370)
+	unreachable MIN alignof static_assert
+)
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+
+		sed -i -e "s:submodule-checks ?= no-submodule-changes public-submodule-commit:submodule-checks ?= no-submodule-changes:" gnulib/top/maint.mk || die
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# TODO: past 2025, we may need to add our own hack for bug #907474.
+	local PATCHES=(
+		# Upstream patches
+		"${FILESDIR}"/${P}-gnulib-openssl-1.1.patch
+	)
+
+	if ! use vanilla && [[ -d "${WORKDIR}"/${MY_PATCH} ]] ; then
+		PATCHES+=( "${WORKDIR}"/${MY_PATCH} )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1} || die
+
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
+	fi
+}
+
+src_configure() {
+	# TODO: in future (>9.4?), we may want to wire up USE=systemd:
+	# still experimental at the moment, but:
+	# https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=85edb4afbd119fb69a0d53e1beb71f46c9525dd0
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		$(usev !caps --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp libgmp)
+		$(use_with openssl)
+	)
+
+	if use gmp ; then
+		myconf+=( --with-libgmp-prefix="${ESYSROOT}"/usr )
+	fi
+
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
+
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}" || die
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+
+	#local -x RUN_EXPENSIVE_TESTS="yes"
+	#local -x COREUTILS_GROUPS="portage wheel"
+	local -x PATH="${T}/mount-wrappers:${PATH}"
+	local -x gl_public_submodule_commit=
+
+	local xfail_tests=(
+		# bug #629660
+		#tests/dd/no-allocate.sh
+
+		# bug #675802
+		tests/env/env-S
+		tests/env/env-S.pl
+
+		# bug #413621 and bug #548250
+		tests/du/long-from-unreadable.sh
+		tests/ls/removed-directory
+		tests/ls/removed-directory.sh
+		tests/ls/stat-free-symlinks
+		tests/ls/stat-free-symlinks.sh
+		tests/rm/deep-2
+		tests/rm/deep-2.sh
+
+		# We have a patch which fixes this (bug #259876)
+		#tests/touch/not-owner
+		#tests/touch/not-owner.sh
+	)
+
+	# This test is flaky (bug #910640).
+	cat > tests/tty/tty-eof.pl <<-EOF || die
+	#!/usr/bin/perl
+	exit 77;
+	EOF
+
+	# We set DISABLE_HARD_ERRORS because some of the tests hard error-out
+	# because of sandbox. They're skipped above but DISABLE_HARD_ERRORS is needed
+	# to downgrade them to FAIL.
+	emake -k check \
+		VERBOSE=yes \
+		DISABLE_HARD_ERRORS=yes \
+		XFAIL_TESTS="${xfail_tests[*]}"
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+
+		# Move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
+			mv hostname ../../bin/ || die
+		fi
+
+		if use kill ; then
+			mv kill ../../bin/ || die
+		fi
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place...)
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sys-apps/coreutils/coreutils-9.5.ebuild b/sys-apps/coreutils/coreutils-9.5.ebuild
new file mode 100644
index 000000000000..187e8ba621a9
--- /dev/null
+++ b/sys-apps/coreutils/coreutils-9.5.ebuild
@@ -0,0 +1,305 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Try to keep an eye on Fedora's packaging: https://src.fedoraproject.org/rpms/coreutils
+# The upstream coreutils maintainers also maintain the package in Fedora and may
+# backport fixes which we want to pick up.
+#
+# Also recommend subscribing to the coreutils and bug-coreutils MLs.
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/coreutils.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+MY_PATCH="${PN}-9.5-patches"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/coreutils.git"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).185-541b02"
+	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+fi
+
+SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="acl caps gmp hostname kill multicall nls +openssl selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="
+	acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	openssl? ( dev-libs/openssl:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	test? (
+		dev-debug/strace
+		dev-lang/perl
+		dev-perl/Expect
+		${PYTHON_DEPS}
+	)
+	verify-sig? ( sec-keys/openpgp-keys-coreutils )
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs (bug #898370)
+	unreachable MIN alignof static_assert
+)
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+
+		sed -i -e "s:submodule-checks ?= no-submodule-changes public-submodule-commit:submodule-checks ?= no-submodule-changes:" gnulib/top/maint.mk || die
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# TODO: past 2025, we may need to add our own hack for bug #907474.
+	local PATCHES=(
+		# Upstream patches
+	)
+
+	if ! use vanilla && [[ -d "${WORKDIR}"/${MY_PATCH} ]] ; then
+		PATCHES+=( "${WORKDIR}"/${MY_PATCH} )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1} || die
+
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
+	fi
+}
+
+src_configure() {
+	# TODO: in future (>9.4?), we may want to wire up USE=systemd:
+	# still experimental at the moment, but:
+	# https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=85edb4afbd119fb69a0d53e1beb71f46c9525dd0
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		$(usev !caps --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp libgmp)
+		$(use_with openssl)
+	)
+
+	if use gmp ; then
+		myconf+=( --with-libgmp-prefix="${ESYSROOT}"/usr )
+	fi
+
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
+
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}" || die
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+
+	#local -x RUN_EXPENSIVE_TESTS="yes"
+	#local -x COREUTILS_GROUPS="portage wheel"
+	local -x PATH="${T}/mount-wrappers:${PATH}"
+	local -x gl_public_submodule_commit=
+
+	local xfail_tests=(
+		# bug #629660
+		#tests/dd/no-allocate.sh
+
+		# bug #675802
+		tests/env/env-S
+		tests/env/env-S.pl
+
+		# bug #413621 and bug #548250
+		tests/du/long-from-unreadable.sh
+		tests/ls/removed-directory
+		tests/ls/removed-directory.sh
+		tests/ls/stat-free-symlinks
+		tests/ls/stat-free-symlinks.sh
+		tests/rm/deep-2
+		tests/rm/deep-2.sh
+
+		# We have a patch which fixes this (bug #259876)
+		#tests/touch/not-owner
+		#tests/touch/not-owner.sh
+	)
+
+	# This test is flaky (bug #910640).
+	cat > tests/tty/tty-eof.pl <<-EOF || die
+	#!/usr/bin/perl
+	exit 77;
+	EOF
+
+	# We set DISABLE_HARD_ERRORS because some of the tests hard error-out
+	# because of sandbox. They're skipped above but DISABLE_HARD_ERRORS is needed
+	# to downgrade them to FAIL.
+	emake -k check \
+		VERBOSE=yes \
+		DISABLE_HARD_ERRORS=yes \
+		XFAIL_TESTS="${xfail_tests[*]}"
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+
+		# Move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
+			mv hostname ../../bin/ || die
+		fi
+
+		if use kill ; then
+			mv kill ../../bin/ || die
+		fi
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place...)
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sys-apps/coreutils/coreutils-9999.ebuild b/sys-apps/coreutils/coreutils-9999.ebuild
new file mode 100644
index 000000000000..187e8ba621a9
--- /dev/null
+++ b/sys-apps/coreutils/coreutils-9999.ebuild
@@ -0,0 +1,305 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Try to keep an eye on Fedora's packaging: https://src.fedoraproject.org/rpms/coreutils
+# The upstream coreutils maintainers also maintain the package in Fedora and may
+# backport fixes which we want to pick up.
+#
+# Also recommend subscribing to the coreutils and bug-coreutils MLs.
+
+PYTHON_COMPAT=( python3_{10..12} )
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/coreutils.asc
+inherit flag-o-matic python-any-r1 toolchain-funcs verify-sig
+
+MY_PATCH="${PN}-9.5-patches"
+DESCRIPTION="Standard GNU utilities (chmod, cp, dd, ls, sort, tr, head, wc, who,...)"
+HOMEPAGE="https://www.gnu.org/software/coreutils/"
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/coreutils.git"
+	inherit git-r3
+elif [[ ${PV} == *_p* ]] ; then
+	# Note: could put this in devspace, but if it's gone, we don't want
+	# it in tree anyway. It's just for testing.
+	MY_SNAPSHOT="$(ver_cut 1-2).185-541b02"
+	SRC_URI="https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz -> ${P}.tar.xz"
+	SRC_URI+=" verify-sig? ( https://www.pixelbeat.org/cu/coreutils-${MY_SNAPSHOT}.tar.xz.sig -> ${P}.tar.xz.sig )"
+	S="${WORKDIR}"/${PN}-${MY_SNAPSHOT}
+else
+	SRC_URI="
+		mirror://gnu/${PN}/${P}.tar.xz
+		verify-sig? ( mirror://gnu/${PN}/${P}.tar.xz.sig )
+	"
+
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~x86-linux"
+fi
+
+SRC_URI+=" !vanilla? ( https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${MY_PATCH}.tar.xz )"
+
+LICENSE="GPL-3+"
+SLOT="0"
+IUSE="acl caps gmp hostname kill multicall nls +openssl selinux +split-usr static test vanilla xattr"
+RESTRICT="!test? ( test )"
+
+LIB_DEPEND="
+	acl? ( sys-apps/acl[static-libs] )
+	caps? ( sys-libs/libcap )
+	gmp? ( dev-libs/gmp:=[static-libs] )
+	openssl? ( dev-libs/openssl:=[static-libs] )
+	xattr? ( sys-apps/attr[static-libs] )
+"
+RDEPEND="
+	!static? ( ${LIB_DEPEND//\[static-libs]} )
+	selinux? ( sys-libs/libselinux )
+	nls? ( virtual/libintl )
+"
+DEPEND="
+	${RDEPEND}
+	static? ( ${LIB_DEPEND} )
+"
+BDEPEND="
+	app-arch/xz-utils
+	dev-lang/perl
+	test? (
+		dev-debug/strace
+		dev-lang/perl
+		dev-perl/Expect
+		${PYTHON_DEPS}
+	)
+	verify-sig? ( sec-keys/openpgp-keys-coreutils )
+"
+RDEPEND+="
+	hostname? ( !sys-apps/net-tools[hostname] )
+	kill? (
+		!sys-apps/util-linux[kill]
+		!sys-process/procps[kill]
+	)
+	!<sys-apps/util-linux-2.13
+	!<sys-apps/sandbox-2.10-r4
+	!sys-apps/stat
+	!net-mail/base64
+	!sys-apps/mktemp
+	!<app-forensics/tct-1.18-r1
+	!<net-fs/netatalk-2.0.3-r4
+"
+
+QA_CONFIG_IMPL_DECL_SKIP=(
+	# gnulib FPs (bug #898370)
+	unreachable MIN alignof static_assert
+)
+
+pkg_setup() {
+	if use test ; then
+		python-any-r1_pkg_setup
+	fi
+}
+
+src_unpack() {
+	if [[ ${PV} == 9999 ]] ; then
+		git-r3_src_unpack
+
+		cd "${S}" || die
+		./bootstrap || die
+
+		sed -i -e "s:submodule-checks ?= no-submodule-changes public-submodule-commit:submodule-checks ?= no-submodule-changes:" gnulib/top/maint.mk || die
+	elif use verify-sig ; then
+		# Needed for downloaded patch (which is unsigned, which is fine)
+		verify-sig_verify_detached "${DISTDIR}"/${P}.tar.xz{,.sig}
+	fi
+
+	default
+}
+
+src_prepare() {
+	# TODO: past 2025, we may need to add our own hack for bug #907474.
+	local PATCHES=(
+		# Upstream patches
+	)
+
+	if ! use vanilla && [[ -d "${WORKDIR}"/${MY_PATCH} ]] ; then
+		PATCHES+=( "${WORKDIR}"/${MY_PATCH} )
+	fi
+
+	default
+
+	# Since we've patched many .c files, the make process will try to
+	# re-build the manpages by running `./bin --help`.  When doing a
+	# cross-compile, we can't do that since 'bin' isn't a native bin.
+	#
+	# Also, it's not like we changed the usage on any of these things,
+	# so let's just update the timestamps and skip the help2man step.
+	set -- man/*.x
+	touch ${@/%x/1} || die
+
+	# Avoid perl dep for compiled in dircolors default (bug #348642)
+	if ! has_version dev-lang/perl ; then
+		touch src/dircolors.h || die
+		touch ${@/%x/1} || die
+	fi
+}
+
+src_configure() {
+	# TODO: in future (>9.4?), we may want to wire up USE=systemd:
+	# still experimental at the moment, but:
+	# https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=85edb4afbd119fb69a0d53e1beb71f46c9525dd0
+	local myconf=(
+		--with-packager="Gentoo"
+		--with-packager-version="${PVR} (p${PATCH_VER:-0})"
+		--with-packager-bug-reports="https://bugs.gentoo.org/"
+		# kill/uptime - procps
+		# groups/su   - shadow
+		# hostname    - net-tools
+		--enable-install-program="arch,$(usev hostname),$(usev kill)"
+		--enable-no-install-program="groups,$(usev !hostname),$(usev !kill),su,uptime"
+		$(usev !caps --disable-libcap)
+		$(use_enable nls)
+		$(use_enable acl)
+		$(use_enable multicall single-binary)
+		$(use_enable xattr)
+		$(use_with gmp libgmp)
+		$(use_with openssl)
+	)
+
+	if use gmp ; then
+		myconf+=( --with-libgmp-prefix="${ESYSROOT}"/usr )
+	fi
+
+	if tc-is-cross-compiler && [[ ${CHOST} == *linux* ]] ; then
+		# bug #311569
+		export fu_cv_sys_stat_statfs2_bsize=yes
+		# bug #416629
+		export gl_cv_func_realpath_works=yes
+	fi
+
+	# bug #409919
+	export gl_cv_func_mknod_works=yes
+
+	if use static ; then
+		append-ldflags -static
+		# bug #321821
+		sed -i '/elf_sys=yes/s:yes:no:' configure || die
+	fi
+
+	if ! use selinux ; then
+		# bug #301782
+		export ac_cv_{header_selinux_{context,flash,selinux}_h,search_setfilecon}=no
+	fi
+
+	econf "${myconf[@]}"
+}
+
+src_test() {
+	# Non-root tests will fail if the full path isn't
+	# accessible to non-root users
+	chmod -R go-w "${WORKDIR}" || die
+	chmod a+rx "${WORKDIR}" || die
+
+	# coreutils tests like to do `mount` and such with temp dirs,
+	# so make sure:
+	# - /etc/mtab is writable (bug #265725)
+	# - /dev/loop* can be mounted (bug #269758)
+	mkdir -p "${T}"/mount-wrappers || die
+	mkwrap() {
+		local w ww
+		for w in "${@}" ; do
+			ww="${T}/mount-wrappers/${w}"
+			cat <<-EOF > "${ww}"
+				#!${EPREFIX}/bin/sh
+				exec env SANDBOX_WRITE="\${SANDBOX_WRITE}:/etc/mtab:/dev/loop" $(type -P ${w}) "\$@"
+			EOF
+			chmod a+rx "${ww}" || die
+		done
+	}
+	mkwrap mount umount
+
+	addwrite /dev/full
+
+	#local -x RUN_EXPENSIVE_TESTS="yes"
+	#local -x COREUTILS_GROUPS="portage wheel"
+	local -x PATH="${T}/mount-wrappers:${PATH}"
+	local -x gl_public_submodule_commit=
+
+	local xfail_tests=(
+		# bug #629660
+		#tests/dd/no-allocate.sh
+
+		# bug #675802
+		tests/env/env-S
+		tests/env/env-S.pl
+
+		# bug #413621 and bug #548250
+		tests/du/long-from-unreadable.sh
+		tests/ls/removed-directory
+		tests/ls/removed-directory.sh
+		tests/ls/stat-free-symlinks
+		tests/ls/stat-free-symlinks.sh
+		tests/rm/deep-2
+		tests/rm/deep-2.sh
+
+		# We have a patch which fixes this (bug #259876)
+		#tests/touch/not-owner
+		#tests/touch/not-owner.sh
+	)
+
+	# This test is flaky (bug #910640).
+	cat > tests/tty/tty-eof.pl <<-EOF || die
+	#!/usr/bin/perl
+	exit 77;
+	EOF
+
+	# We set DISABLE_HARD_ERRORS because some of the tests hard error-out
+	# because of sandbox. They're skipped above but DISABLE_HARD_ERRORS is needed
+	# to downgrade them to FAIL.
+	emake -k check \
+		VERBOSE=yes \
+		DISABLE_HARD_ERRORS=yes \
+		XFAIL_TESTS="${xfail_tests[*]}"
+}
+
+src_install() {
+	default
+
+	insinto /etc
+	newins src/dircolors.hin DIR_COLORS
+
+	if use split-usr ; then
+		cd "${ED}"/usr/bin || die
+		dodir /bin
+
+		# Move critical binaries into /bin (required by FHS)
+		local fhs="cat chgrp chmod chown cp date dd df echo false ln ls
+		           mkdir mknod mv pwd rm rmdir stty sync true uname"
+		mv ${fhs} ../../bin/ || die "Could not move FHS bins!"
+
+		if use hostname ; then
+			mv hostname ../../bin/ || die
+		fi
+
+		if use kill ; then
+			mv kill ../../bin/ || die
+		fi
+
+		# Move critical binaries into /bin (common scripts)
+		# (Why are these required for booting?)
+		local com="basename chroot cut dir dirname du env expr head mkfifo
+		           mktemp readlink seq sleep sort tail touch tr tty vdir wc yes"
+		mv ${com} ../../bin/ || die "Could not move common bins!"
+
+		# Create a symlink for uname in /usr/bin/ since autotools require it.
+		# (Other than uname, we need to figure out why we are
+		# creating symlinks for these in /usr/bin instead of leaving
+		# the files there in the first place...)
+		local x
+		for x in ${com} uname ; do
+			dosym ../../bin/${x} /usr/bin/${x}
+		done
+	fi
+}
+
+pkg_postinst() {
+	ewarn "Make sure you run 'hash -r' in your active shells."
+	ewarn "You should also re-source your shell settings for LS_COLORS"
+	ewarn "  changes, such as: source /etc/profile"
+}
diff --git a/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch b/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch
new file mode 100644
index 000000000000..62a35cd85ad1
--- /dev/null
+++ b/sys-apps/coreutils/files/coreutils-8.32-ls-restore-8.31-behavior.patch
@@ -0,0 +1,94 @@
+From 10fcb97bd728f09d4a027eddf8ad2900f0819b0a Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 5 Mar 2020 17:25:29 -0800
+Subject: ls: restore 8.31 behavior on removed directories
+
+* src/ls.c: Do not include <sys/sycall.h>
+(print_dir): Don't worry about whether the directory is removed.
+* tests/ls/removed-directory.sh: Adjust to match new (i.e., old)
+behavior.
+ 
+diff --git a/src/ls.c b/src/ls.c
+index 24b983287..4acf5f44d 100644
+--- a/src/ls.c
++++ b/src/ls.c
+@@ -49,10 +49,6 @@
+ # include <sys/ptem.h>
+ #endif
+ 
+-#ifdef __linux__
+-# include <sys/syscall.h>
+-#endif
+-
+ #include <stdio.h>
+ #include <assert.h>
+ #include <setjmp.h>
+@@ -2896,7 +2892,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+   struct dirent *next;
+   uintmax_t total_blocks = 0;
+   static bool first = true;
+-  bool found_any_entries = false;
+ 
+   errno = 0;
+   dirp = opendir (name);
+@@ -2972,7 +2967,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+       next = readdir (dirp);
+       if (next)
+         {
+-          found_any_entries = true;
+           if (! file_ignored (next->d_name))
+             {
+               enum filetype type = unknown;
+@@ -3018,22 +3012,6 @@ print_dir (char const *name, char const *realname, bool command_line_arg)
+           if (errno != EOVERFLOW)
+             break;
+         }
+-#ifdef __linux__
+-      else if (! found_any_entries)
+-        {
+-          /* If readdir finds no directory entries at all, not even "." or
+-             "..", then double check that the directory exists.  */
+-          if (syscall (SYS_getdents, dirfd (dirp), NULL, 0) == -1
+-              && errno != EINVAL)
+-            {
+-              /* We exclude EINVAL as that pertains to buffer handling,
+-                 and we've passed NULL as the buffer for simplicity.
+-                 ENOENT is returned if appropriate before buffer handling.  */
+-              file_failure (command_line_arg, _("reading directory %s"), name);
+-            }
+-          break;
+-        }
+-#endif
+       else
+         break;
+ 
+diff --git a/tests/ls/removed-directory.sh b/tests/ls/removed-directory.sh
+index e8c835dab..fe8f929a1 100755
+--- a/tests/ls/removed-directory.sh
++++ b/tests/ls/removed-directory.sh
+@@ -26,20 +26,14 @@ case $host_triplet in
+   *) skip_ 'non linux kernel' ;;
+ esac
+ 
+-LS_FAILURE=2
+-
+-cat <<\EOF >exp-err || framework_failure_
+-ls: reading directory '.': No such file or directory
+-EOF
+-
+ cwd=$(pwd)
+ mkdir d || framework_failure_
+ cd d || framework_failure_
+ rmdir ../d || framework_failure_
+ 
+-returns_ $LS_FAILURE ls >../out 2>../err || fail=1
++ls >../out 2>../err || fail=1
+ cd "$cwd" || framework_failure_
+ compare /dev/null out || fail=1
+-compare exp-err err || fail=1
++compare /dev/null err || fail=1
+ 
+ Exit $fail
+-- 
+cgit v1.2.1
+
diff --git a/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch b/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch
new file mode 100644
index 000000000000..40b1554d948a
--- /dev/null
+++ b/sys-apps/coreutils/files/coreutils-8.32-sandbox-env-test.patch
@@ -0,0 +1,64 @@
+Skip tests known to fail when running under Gentoo sandbox.
+
+--- a/tests/du/long-from-unreadable.sh
++++ b/tests/du/long-from-unreadable.sh
+@@ -29,6 +29,9 @@
+ # unnecessarily to using FTS_NOCHDIR mode in this corner case.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ du
+ 
+ require_perl_
+--- a/tests/ls/removed-directory.sh
++++ b/tests/ls/removed-directory.sh
+@@ -19,6 +19,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ ls
+ 
+ case $host_triplet in
+--- a/tests/ls/stat-free-symlinks.sh
++++ b/tests/ls/stat-free-symlinks.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ ls
+ require_strace_ stat
+ 
+--- a/tests/misc/env-S.pl
++++ b/tests/misc/env-S.pl
+@@ -30,6 +30,11 @@ $env = $1;
+ # Turn off localization of executable's output.
+ @ENV{qw(LANGUAGE LANG LC_ALL)} = ('C') x 3;
+ 
++# Skip if sandbox is enabled
++if ($ENV{SANDBOX_ACTIVE}) {
++     CuSkip::skip "Gentoo: Test known bad under sandbox (#675802)\n";
++}
++
+ my @Tests =
+     (
+      # Test combination of -S and regular arguments
+--- a/tests/rm/deep-2.sh
++++ b/tests/rm/deep-2.sh
+@@ -17,6 +17,9 @@
+ # along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ 
+ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
++# Avoid #413621 until #548250 is resolved
++test -n "$SANDBOX_ACTIVE" && skip_ "Gentoo: Test known bad under sandbox (#413621)"
++
+ print_ver_ rm
+ require_perl_
+ 
diff --git a/sys-apps/coreutils/files/coreutils-9.4-CVE-2024-0684.patch b/sys-apps/coreutils/files/coreutils-9.4-CVE-2024-0684.patch
new file mode 100644
index 000000000000..293919a006fe
--- /dev/null
+++ b/sys-apps/coreutils/files/coreutils-9.4-CVE-2024-0684.patch
@@ -0,0 +1,31 @@
+https://bugs.gentoo.org/922474
+https://www.openwall.com/lists/oss-security/2024/01/18/2
+https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=c4c5ed8f4e9cd55a12966d4f520e3a13101637d9
+
+From c4c5ed8f4e9cd55a12966d4f520e3a13101637d9 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 16 Jan 2024 13:48:32 -0800
+Subject: split: do not shrink hold buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+* src/split.c (line_bytes_split): Do not shrink hold buffer.
+If it’s large for this batch it’s likely to be large for the next
+batch, and for ‘split’ it’s not worth the complexity/CPU hassle to
+shrink it.  Do not assume hold_size can be bufsize.
+--- a/src/split.c
++++ b/src/split.c
+@@ -809,10 +809,7 @@ line_bytes_split (intmax_t n_bytes, char *buf, idx_t bufsize)
+             {
+               cwrite (n_out == 0, hold, n_hold);
+               n_out += n_hold;
+-              if (n_hold > bufsize)
+-                hold = xirealloc (hold, bufsize);
+               n_hold = 0;
+-              hold_size = bufsize;
+             }
+ 
+           /* Output to eol if present.  */
+-- 
+cgit v1.1
diff --git a/sys-apps/coreutils/files/coreutils-9.4-gnulib-clang-18-c23-stdckdint.patch b/sys-apps/coreutils/files/coreutils-9.4-gnulib-clang-18-c23-stdckdint.patch
new file mode 100644
index 000000000000..44982a17a78c
--- /dev/null
+++ b/sys-apps/coreutils/files/coreutils-9.4-gnulib-clang-18-c23-stdckdint.patch
@@ -0,0 +1,30 @@
+https://bugs.gentoo.org/926349
+https://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commit;h=67c298c36f6
+
+From 67c298c36f69b6906840b7584be06b7b5f33f829 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 16 Jan 2024 17:21:08 -0800
+Subject: [PATCH] posixtm: pacify clang 18
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Khem Raj in:
+https://lists.gnu.org/r/bug-gnulib/2024-01/msg00045.html
+* lib/posixtm.c (posixtime): Pacify clang 18 by converting bool to int.
+Arguably this is a bug in draft C2x, since the non-pointer args to
+ckd_add should promote just like any other expressions do;
+but thatâs not clangâs fault.
+--- a/lib/posixtm.c
++++ b/lib/posixtm.c
+@@ -191,7 +191,7 @@ posixtime (time_t *p, const char *s, unsigned int syntax_bits)
+              | (tm0.tm_min ^ tm1.tm_min)
+              | (tm0.tm_sec ^ tm1.tm_sec)))
+         {
+-          if (ckd_add (&t, t, leapsec))
++          if (ckd_add (&t, t, +leapsec))
+             return false;
+           *p = t;
+           return true;
+-- 
+2.17.1
diff --git a/sys-apps/coreutils/files/coreutils-9.4-gnulib-openssl-1.1.patch b/sys-apps/coreutils/files/coreutils-9.4-gnulib-openssl-1.1.patch
new file mode 100644
index 000000000000..3576c7d0d1eb
--- /dev/null
+++ b/sys-apps/coreutils/files/coreutils-9.4-gnulib-openssl-1.1.patch
@@ -0,0 +1,165 @@
+https://bugs.gentoo.org/913368
+https://debbugs.gnu.org/65674
+https://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=ce20e238f0b4448a098bd7c076c131edbc759764
+
+From ce20e238f0b4448a098bd7c076c131edbc759764 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Fri, 1 Sep 2023 12:55:30 +0200
+Subject: crypto/{sha*,md5,sm3}-buffer: Fix --with-openssl (regr. 2023-08-26).
+
+Reported by Agostino Sarubbo via Sam James <sam@gentoo.org> in
+<https://lists.gnu.org/archive/html/bug-gnulib/2023-09/msg00000.html>.
+
+* lib/sha1.h: Test the OpenSSL major version before attempting to
+include <openssl/configuration.h>.
+* lib/sha256.h: Likewise.
+* lib/sha512.h: Likewise.
+* lib/md5.h: Likewise.
+* lib/sm3.h: Likewise.
+--- a/lib/md5.h
++++ b/lib/md5.h
+@@ -33,14 +33,18 @@
+ #   define OPENSSL_API_COMPAT 0x10101000L /* FIXME: Use OpenSSL 1.1+ API.  */
+ #  endif
+ /* If <openssl/macros.h> would give a compile-time error, don't use OpenSSL.  */
+-#  include <openssl/configuration.h>
+-#  if (OPENSSL_CONFIGURED_API \
+-       < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
+-          ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
+-          + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
+-          + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
+-#   undef HAVE_OPENSSL_MD5
+-#  else
++#  include <openssl/opensslv.h>
++#  if OPENSSL_VERSION_MAJOR >= 3
++#   include <openssl/configuration.h>
++#   if (OPENSSL_CONFIGURED_API \
++        < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
++           ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
++           + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
++           + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
++#    undef HAVE_OPENSSL_MD5
++#   endif
++#  endif
++#  if HAVE_OPENSSL_MD5
+ #   include <openssl/md5.h>
+ #  endif
+ # endif
+--- a/lib/sha1.h
++++ b/lib/sha1.h
+@@ -32,14 +32,18 @@
+ #   define OPENSSL_API_COMPAT 0x10101000L /* FIXME: Use OpenSSL 1.1+ API.  */
+ #  endif
+ /* If <openssl/macros.h> would give a compile-time error, don't use OpenSSL.  */
+-#  include <openssl/configuration.h>
+-#  if (OPENSSL_CONFIGURED_API \
+-       < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
+-          ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
+-          + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
+-          + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
+-#   undef HAVE_OPENSSL_SHA1
+-#  else
++#  include <openssl/opensslv.h>
++#  if OPENSSL_VERSION_MAJOR >= 3
++#   include <openssl/configuration.h>
++#   if (OPENSSL_CONFIGURED_API \
++        < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
++           ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
++           + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
++           + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
++#    undef HAVE_OPENSSL_SHA1
++#   endif
++#  endif
++#  if HAVE_OPENSSL_SHA1
+ #   include <openssl/sha.h>
+ #  endif
+ # endif
+--- a/lib/sha256.h
++++ b/lib/sha256.h
+@@ -31,14 +31,18 @@
+ #   define OPENSSL_API_COMPAT 0x10101000L /* FIXME: Use OpenSSL 1.1+ API.  */
+ #  endif
+ /* If <openssl/macros.h> would give a compile-time error, don't use OpenSSL.  */
+-#  include <openssl/configuration.h>
+-#  if (OPENSSL_CONFIGURED_API \
+-       < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
+-          ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
+-          + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
+-          + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
+-#   undef HAVE_OPENSSL_SHA256
+-#  else
++#  include <openssl/opensslv.h>
++#  if OPENSSL_VERSION_MAJOR >= 3
++#   include <openssl/configuration.h>
++#   if (OPENSSL_CONFIGURED_API \
++        < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
++           ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
++           + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
++           + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
++#    undef HAVE_OPENSSL_SHA256
++#   endif
++#  endif
++#  if HAVE_OPENSSL_SHA256
+ #   include <openssl/sha.h>
+ #  endif
+ # endif
+--- a/lib/sha512.h
++++ b/lib/sha512.h
+@@ -31,14 +31,18 @@
+ #   define OPENSSL_API_COMPAT 0x10101000L /* FIXME: Use OpenSSL 1.1+ API.  */
+ #  endif
+ /* If <openssl/macros.h> would give a compile-time error, don't use OpenSSL.  */
+-#  include <openssl/configuration.h>
+-#  if (OPENSSL_CONFIGURED_API \
+-       < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
+-          ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
+-          + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
+-          + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
+-#   undef HAVE_OPENSSL_SHA512
+-#  else
++#  include <openssl/opensslv.h>
++#  if OPENSSL_VERSION_MAJOR >= 3
++#   include <openssl/configuration.h>
++#   if (OPENSSL_CONFIGURED_API \
++        < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
++           ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
++           + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
++           + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
++#    undef HAVE_OPENSSL_SHA512
++#   endif
++#  endif
++#  if HAVE_OPENSSL_SHA512
+ #   include <openssl/sha.h>
+ #  endif
+ # endif
+--- a/lib/sm3.h
++++ b/lib/sm3.h
+@@ -40,14 +40,18 @@
+ #   define OPENSSL_API_COMPAT 0x10101000L /* FIXME: Use OpenSSL 1.1+ API.  */
+ #  endif
+ /* If <openssl/macros.h> would give a compile-time error, don't use OpenSSL.  */
+-#  include <openssl/configuration.h>
+-#  if (OPENSSL_CONFIGURED_API \
+-       < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
+-          ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
+-          + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
+-          + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
+-#   undef HAVE_OPENSSL_SM3
+-#  else
++#  include <openssl/opensslv.h>
++#  if OPENSSL_VERSION_MAJOR >= 3
++#   include <openssl/configuration.h>
++#   if (OPENSSL_CONFIGURED_API \
++        < (OPENSSL_API_COMPAT < 0x900000L ? OPENSSL_API_COMPAT : \
++           ((OPENSSL_API_COMPAT >> 28) & 0xF) * 10000 \
++           + ((OPENSSL_API_COMPAT >> 20) & 0xFF) * 100 \
++           + ((OPENSSL_API_COMPAT >> 12) & 0xFF)))
++#    undef HAVE_OPENSSL_SM3
++#   endif
++#  endif
++#  if HAVE_OPENSSL_SM3
+ #   include <openssl/sm3.h>
+ #  endif
+ # endif
+-- 
+cgit v1.1
diff --git a/sys-apps/coreutils/metadata.xml b/sys-apps/coreutils/metadata.xml
index 4e46af051b39..1e1f3acef011 100644
--- a/sys-apps/coreutils/metadata.xml
+++ b/sys-apps/coreutils/metadata.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
 <pkgmetadata>
 <maintainer type="project">
 	<email>base-system@gentoo.org</email>
@@ -12,9 +12,11 @@
 	<flag name="hostname">Build the hostname program</flag>
 	<flag name="kill">Build the kill program</flag>
 	<flag name="multicall">Build all tools into a single `coreutils` program akin to busybox to save space</flag>
+	<flag name="openssl">Use openssl libcrypto hash routines for hash functions</flag>
 	<flag name="split-usr">Enable this if /bin and /usr/bin are separate directories</flag>
 </use>
 <upstream>
 	<remote-id type="cpe">cpe:/a:gnu:coreutils</remote-id>
+	<remote-id type="savannah">coreutils</remote-id>
 </upstream>
 </pkgmetadata>